Issue with Redis Sentinel Setup in DefectDojo 2.42.1

[GeovannyGomes]

Dear community, could you please advise what's wrong with my setup?

We recently upgraded DefectDojo from version 2.36.4 to 2.42.1, which required some changes to our Helm values, including replacing RabbitMQ with Redis.

By default, the Helm chart uses a single Redis master pod and we need it to be high available for a production environment. To ensure high availability, we attempted to use the Redis Sentinel Setup with the following configuration:

redis:
  enabled: true
  scheme: "sentinel"
  transportEncryption:
    enabled: false
    params: ''
  auth:
    existingSecret: defectdojo-redis-specific
    existingSecretPasswordKey: redis-password
    password: ""
  architecture: replication
  sentinel:
    enabled: true
  replica:
    replicaCount: 3
    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 100
          podAffinityTerm:
            labelSelector:
              matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values:
                - redis
            topologyKey: "topology.kubernetes.io/hostname"
    nodeSelector:
      eks.amazonaws.com/capacityType: "SPOT"

With this setup, the three Redis replicas are correctly created, but the application fails to communicate with Redis master.

However, when using the following standalone setup (which is basically the default from values.yaml), we do not encounter this issue:

redis:
  enabled: true
  scheme: "redis"
  transportEncryption:
    enabled: false
    params: ''
  auth:
    existingSecret: defectdojo-redis-specific
    existingSecretPasswordKey: redis-password
    password: ""
  architecture: standalone
  master:
    nodeSelector:
      eks.amazonaws.com/capacityType: "ON_DEMAND"

We also have this configuration enabled

celery:
  broker: 'redis'

Could someone help me understand the correct setup for using Redis Sentinel with DefectDojo? Or a different HA approach?

[valentijnscholten]

You might get a bigger audience on our Slack channel for this question:

The easiest and fastest way to help you is via Slack. There's a free and easy signup to join our #defectdojo channel in the OWASP Slack workspace: Get Access.

[GeovannyGomes]

Hi @valentijnscholten , I'll ask my question there also. Thank you!