Instance Reconciler Behavior

​

Overview

​

Reconciliation Steps

​

1. Fencing Check

• Reads redis.io/fencedInstances annotation
• Parses JSON array of fenced pod names
• If current pod is in the list:
  • Logs: Pod is fenced, stopping redis-server
  • Sends SIGINT to redis-server process
  • Skips all remaining steps
  • Returns immediately

​

2. Role Reconciliation

​

Replica Mode Enabled

1. Extract external source from spec.replicaMode.source.host and spec.replicaMode.source.port (default: 6379)
2. If spec.replicaMode.promote=true and status.currentPrimary == POD_NAME:
   • Issue REPLICAOF NO ONE to promote out of replica mode
   • Record event: ReplicaModePromoteRequested
3. Otherwise:
   • Issue REPLICAOF <source.host> <source.port> if not already replicating from that source
   • Record event: ReplicaModeSourceUpdated

​

Standard Mode

1. Determine expected role:
   • isPrimary = (status.currentPrimary == POD_NAME)
2. Query Redis INFO replication for actual role
3. Compare expected vs actual:

• Issue REPLICAOF NO ONE
• Record event: PromotedToPrimary

• Resolve primary pod IP via Kubernetes API
• Issue REPLICAOF <primary-ip> 6379
• Record event: DemotedToReplica

• Query current master host/port from INFO replication
• If not matching expected primary IP:
  • Resolve primary pod IP
  • Issue REPLICAOF <primary-ip> 6379
  • Record event: ReplicaReconfigured

​

3. Config Reconciliation

• Iterate over spec.redis map
• Skip parameters requiring restart: bind, port, tls-port, unixsocket, databases
• For each live-reloadable parameter:
  • Issue CONFIG SET <key> <value>
• Record event: ConfigReloaded (only if spec.redis is non-empty)

• bind
• port
• tls-port
• unixsocket
• databases

• maxmemory
• maxmemory-policy
• tcp-keepalive
• timeout
• save

​

4. Secret Reconciliation

​

Auth Secret (spec.authSecret)

1. Read password from /projected/<authSecret.name>/password
2. Issue CONFIG SET requirepass <password>
3. Issue CONFIG SET masterauth <password>
4. Store password for replica mode auth override (see below)

​

ACL Config Secret (spec.aclConfigSecret)

1. Read ACL rules from /projected/<aclConfigSecret.name>/acl
2. Write to /data/users.acl (path configurable via REDIS_OPERATOR_ACL_FILE_PATH)
3. Issue ACL LOAD command

​

Replica Mode Auth Override

1. Read upstream password from /projected/<authSecretName>/password
2. Issue CONFIG SET masterauth <upstream-password>
3. This overrides the local auth password for upstream replication

• Clear stale upstream auth: CONFIG SET masterauth ""

​

5. TLS Certificate Rotation

1. Read certificate files:
   • /tls/tls.crt
   • /tls/tls.key
   • /tls/ca.crt
2. Compute SHA256 checksum for each file
3. Compare to cached checksums from previous reconciliation
4. If any checksum changed:
   • Issue CONFIG SET tls-cert-file /tls/tls.crt
   • Issue CONFIG SET tls-key-file /tls/tls.key
   • Issue CONFIG SET tls-ca-cert-file /tls/ca.crt
   • Record event: CertificatesRotated
   • Update cached checksums

• On first reconciliation, cache checksums without issuing CONFIG SET
• Certificates are initially loaded at redis-server startup

​

6. Status Reporting

1. Query Redis INFO replication
2. Build InstanceStatus object:
   • role: master or slave
   • connected: true
   • replicationOffset: master_repl_offset (primary) or slave_repl_offset (replica)
   • connectedReplicas: Number of connected replicas (primary only)
   • masterLinkStatus: up or down (replica only)
3. Patch status.instancesStatus[POD_NAME] using client-side merge patch

patch := client.MergeFrom(cluster.DeepCopy())
if cluster.Status.InstancesStatus == nil {
    cluster.Status.InstancesStatus = make(map[string]redisv1.InstanceStatus)
}
cluster.Status.InstancesStatus[r.podName] = status
return r.client.Status().Patch(ctx, cluster, patch)

​

Environment Variables

​

File Paths

​

Reconciliation Frequency

1. Watch events - Any change to the RedisCluster resource
2. Requeue - Not used (no periodic requeue)

​

Error Handling

• Cannot fetch RedisCluster CR
• Role reconciliation fails
• Status reporting fails

• Config reconciliation fails
• Secret reconciliation fails
• TLS certificate rotation fails

​

Events

​

Credentials Resolution

volumes:
  - name: projected-secrets
    projected:
      sources:
        - secret:
            name: redis-auth
            items:
              - key: password
                path: redis-auth/password
        - secret:
            name: acl-config
            items:
              - key: acl
                path: acl-config/acl

data, err := os.ReadFile("/projected/redis-auth/password")