·
Last changedVersion:
This version passed the hardening gate. Hardening applied 12 targeted changes and preserved all other text. Classified findings before hardening: 0. Classified findings closed: 0. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 5. Review findings remaining: 1.
None
None
Expand | File | Group | Subtype | Severity | Status |
|---|
No findings available
0 findings
Guidance for designing keys and routing reads in a sharded Redis Cluster (and in standalone primary/replica replication). Covers the two failure modes that bite most new cluster users: CROSSSLOT errors on multi-key operations, and overloading primaries with read traffic.
CROSSSLOT error on MGET, SDIFF, transactions, or pipelines.Redis Cluster distributes keys across 16,384 slots by hashing the key name. Any command that touches multiple keys (MGET, SDIFF, SUNIONSTORE, transactions, Lua scripts with multiple KEYS[]) requires all keys to live on the same slot — otherwise the server returns a CROSSSLOT error.
Hash tags force this: the part between { and } is the only thing hashed for slot assignment, so two keys sharing a hash tag always land together.
Cluster aware clients such as redis-py split a plain pipeline across nodes, so this batch fails with CROSSSLOT only when it runs as a transaction or when the same keys go into one multi-key command such as MGET. Some clients or proxies may still reject pipelines that span slots.
Rules of thumb:
{user:1001}. Avoid bare {1001} — unrelated namespaces (purchase:{1001}, employee:{1001}) would all collide on the same slot.If reads dominate writes, route them to replicas to free primary capacity. Works both in Redis Cluster (each shard has 1+ replica) and in standalone primary/replica replication.
Newer redis-py releases deprecate this flag in favor of a load balancing strategy option; check the docs for your client version.
For non-cluster setups, point two clients at the right nodes:
These examples leave out authentication and encryption for brevity. Real deployments should use a password or access control user and TLS, with credentials loaded from the environment or a secret store rather than written into code.
The trade-off is consistency: replicas are eventually consistent. Don't read your own writes from a replica; don't use replica reads for anything that requires strict freshness (financial balances, idempotency state). Good fits: cache layers, analytics, dashboards, recommendation feeds.
The replica read setting applies to every read on that client, so keep a separate replica reading client for caches and dashboards, and read sessions, auth tokens, rate limits, and idempotency keys through a client that reads only from the primary.
See references/read-replicas.md.
Get started with chainctlchainctl skill install public/redis/redis-clustering:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/redis/skills/redis-clustering:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/hash-tags.md
references/read-replicas.md