https://brtkwr.com/tags/sre/Recent content in Sre on brtkwr.comHugoenMon, 28 Sep 2026 16:00:00 +0000https://brtkwr.com/posts/2026-09-28-zero-downtime-redis-password-rotation/Mon, 28 Sep 2026 16:00:00 +0000https://brtkwr.com/posts/2026-09-28-zero-downtime-redis-password-rotation/<h2 id="tldr"> TL;DR <a class="heading-link" href="#tldr"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h2> <p>A Redis ACL user can hold two passwords at once, so a rotation needs no moment where anyone is locked out. Add the new password to every Redis and Sentinel process, publish it, restart the clients, then restart the Redis pods one by one. The restarts remove the old password; you can&rsquo;t do it at runtime on the Bitnami chart, because the health probes still log in with it. Before restarting, move <code>sentinel-pass</code> to the new password as well, or the Sentinels lock each other out.</p>