WIUNIX ACADEMY
Set up Redis Sentinel high availability on Ubuntu and Debian
Page 5 of 7. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment5 editable values
LET’S BUILD
Open Sentinel maintenance locally
On each node, use ADMIN at the hidden prompt. The next session is read-only diagnostics despite using the maintenance identity; the restricted discovery identity is demonstrated separately.
sudo redis-cli --tls --cacert /etc/redis/tls/ca.pem --cert /etc/redis/tls/node.pem --key /etc/redis/tls/node.key -h 127.0.0.1 -p 26379 --user admin --askpass
The local Sentinel accepts authenticated TLS maintenance.
LET’S BUILD
Require quorum and full topology before failure testing
Run on all three Sentinels. CKQUORUM must report OK. MASTER should show quorum 2, num-other-sentinels 2, num-slaves 2 and no s_down/o_down/disconnected flag. REPLICAS must identify B/C with usable priority and healthy links. Check each voter’s distinct MYID. Never reduce quorum simply to make this check pass.
SENTINEL MYID
SENTINEL CKQUORUM academy
SENTINEL MASTER academy
SENTINEL REPLICAS academy
SENTINEL SENTINELS academy
QUIT
Check the role, exact values and required responses described above; stop on any unexpected result.
LET’S BUILD
Discover the writer with the client identity
On an approved client/admin host use its OWN protected client certificate and CA at the following paths. DISCOVERY is a separate secret from APP. Query all three seed addresses in your actual Sentinel-aware library, not only A; verify the returned endpoint with ROLE after connecting and reconnect/discover after a topology change. A hard-coded original IP, TCP round-robin or DNS record alone is not Sentinel failover support.
redis-cli --tls --cacert /etc/academy-client/ca.pem --cert /etc/academy-client/client.pem --key /etc/academy-client/client.key -h 10.20.0.11 -p 26379 --user discovery --askpass
The restricted discovery session opens from the approved client network.
LET’S BUILD
Read the active endpoint
In the DISCOVERY session. Before failover expect A/6379. The intentionally denied FAILOVER confirms this identity cannot perform administrative promotion. Its NOPERM response is the expected result. Do not grant the permission to resolve it.
SENTINEL GET-MASTER-ADDR-BY-NAME academy
SENTINEL FAILOVER academy
QUIT
Check the role, exact values and required responses described above; stop on any unexpected result.
Configure the actual application before calling it HA
Give the selected library all three TLS Sentinel addresses, group academy, DISCOVERY username/password and separate APP username/password for data connections. Enable CA validation, client certificates and the library’s actual endpoint-name checks where supported. Confirm both Sentinel and data connections use TLS; support for one is not proof of the other. Set finite connect/command timeouts and bounded retry/backoff. Retry an ambiguous write only when application semantics are idempotent; a network error does not mean the write never committed. Test the real library with your workload before enabling traffic. This CLI rehearsal demonstrates discovery and data, not automatic application reconnection.
LET’S BUILD
Retain a checked snapshot and protected configuration
On the CURRENT primary, with lab application writes paused and the current marker already verified on all receivers. Open a protected root shell for the next panel. Take and independently restore this backup BEFORE the failover rehearsal; repeat after the rehearsal if retaining the newer state. This is a consistent Redis RDB export plus protected configuration, not a live copy of a changing AOF directory. Transfer to approved encrypted storage separately. Never rely on it before the isolated restore succeeds.
sudo -i
A protected root shell is available on the current primary.