StackExchange / StackExchange.Redis

General purpose redis client
https://stackexchange.github.io/StackExchange.Redis/
Other
5.86k stars 1.5k forks source link

Update docs with required permissions when using restrictive sentinel permissions #2566

Open molteber opened 10 months ago

molteber commented 10 months ago

I'm using restrictive permissions for users when they connect to our sentinel instances to get our primary redis instance.

I set the permissions to what they mentioned in https://redis.io/docs/management/sentinel/#sentinel-access-control-list-authentication

-@all +auth +client|getname +client|id +client|setname +command +hello +ping +role +sentinel|get-master-addr-by-name +sentinel|master +sentinel|myid +sentinel|replicas +sentinel|sentinels

Using only this, one get the error

StackExchange.Redis.RedisConnectionException: Sentinel: The ConnectionMultiplexer is not a Sentinel connection. Detected as: Standalone

The current documentation mentions sort of that required permissions for sentinel is the whole sentinel command namespace, sort of. But I wanted to be able to use the restrictive permissions redis suggests themselves. So I started digging for what permissions you actually require, because the application works fine when the user is not restricted.

After a digging for a while I found the following: https://github.com/StackExchange/StackExchange.Redis/blob/main/src/StackExchange.Redis/ServerEndPoint.cs#L407-L412 I tried adding +sentinel|masters, and now it worked!

Not sure if this is the only sentinel command it requires to detect it as a sentinel server, but it think it will be useful to specify the permissions required to detect a sentinel server in the documentation