Redis + Sentinel rotating TLS certs on the fly

user_3439135 0
Viewed 271

I'm wondering if there is a way to rotate TLS certs/keys on the fly (without stopping an instance) for redis servers and redis sentinels.

For redis servers (not sentinels) it is possible to use

CONFIG SET tls-cert-file xxx
CONFIG SET tls-cert-key yyy
...

And those commands work as expected - once they are executed server now works with newly provided certs.

However for sentinels any of:

  • CONFIG SET
  • SENTINEL CONFIG SET
  • SENTINEL SET

Do not seem to support changing tls-cert-file or tls-cert-key options.

Question:

So is there an alternative way to do the same trick for sentinels? Or the only possible option for sentinels is to restart them?

redis ssl
1 Answers
127.0.0.1:26379> sentinel config get *
 1) "resolve-hostnames"
 2) "no"
 3) "announce-hostnames"
 4) "no"
 5) "announce-ip"
 6) ""
 7) "announce-port"
 8) "0"
 9) "sentinel-user"
10) ""
11) "sentinel-pass"
12) ""

I think that's all you can do with config set in Sentinels

user_7439750
Related