Configure external Valkey

Configure Splunk AppDynamics Virtual Appliance to use a self-managed Valkey service.

1. Prepare a Valkey or Redis service that meets the supported contract.

   • Check the Valkey version is 9.0.5

   • Provide a stable endpoint that always reaches the current writable primary.
   • Provide reachable Sentinel endpoints that use one consistent primary-set name. For production, use at least three Sentinel voters.
   • Use the default ACL user and the same password on data nodes and Sentinel.
   • Enable TLS 1.2 or higher and host name verification on every configured endpoint.
   • Permit authentication, health, Sentinel discovery, role, normal read/write, expiry, and Lua EVAL operations.

   Valkey Cluster mode, a non-default ACL user, separate data and Sentinel passwords, plaintext connections, client-certificate authentication, and services that do not expose the required Sentinel protocol are not supported.

2. Configure availability, persistence, and capacity.

   For production, use one writable primary, at least two replicas, three Sentinel voters, and Sentinel quorum 2. Place them across independent failure domains.

   Use a tested eviction policy equivalent to allkeys-lru. Size the service for application data, connections, replication, persistence, failover, backups, and maintenance. Replication is not a backup; test restore and failover before production.

   Because EUM uses the stable data endpoint directly, that endpoint must follow the writable role after failover. Sentinel discovery alone is not sufficient.

3. Verify private network and DNS access from OpenShift.
   • Plan non-overlapping network ranges.
   • Configure forward and return routes, DNS, firewalls or security groups, NACLs, egress rules, and NetworkPolicies.
   • Allow the configured data and Sentinel ports, normally 6379 and 26379, only from approved sources.
   • Confirm that pods can reach the stable data endpoint, every Sentinel, and every primary address that Sentinel can advertise.
   • Check whether the Kubernetes cluster has network connectivity.
4. Prepare the TLS trust chain.

   Provide the complete PEM-encoded public CA chain for the server certificates. Certificate SANs must cover the stable data endpoint, every Sentinel endpoint, and the exact DNS name or IP address that Sentinel advertises.

5. Configure endpoints and TLS policy in config/external-redis.yaml.
   CODECopy

   externalRedis: schemaVersion: 1 dataEndpoint: host: redis-primary.customer.example.com port: 6379 sentinel: endpoints: - redis-sentinel-1.customer.example.com:26379 - redis-sentinel-2.customer.example.com:26379 - redis-sentinel-3.customer.example.com:26379 masterName: primaryset tls: enabled: true requireHostnameVerification: true

   externalRedis:
     schemaVersion: 1
     dataEndpoint:
       host: redis-primary.customer.example.com
       port: 6379
     sentinel:
       endpoints:
         - redis-sentinel-1.customer.example.com:26379
         - redis-sentinel-2.customer.example.com:26379
         - redis-sentinel-3.customer.example.com:26379
       masterName: primaryset
     tls:
       enabled: true
       requireHostnameVerification: true

   Keep both TLS settings true. Do not put the password or CA in this file.

6. Add the password and CA to the protected config/secrets.yaml file.
   CODECopy

   redis: external: password: "<default-user-and-sentinel-password>" caCert: |- -----BEGIN CERTIFICATE----- <public-CA-chain> -----END CERTIFICATE-----

   redis:
     external:
       password: "<default-user-and-sentinel-password>"
       caCert: |-
         -----BEGIN CERTIFICATE-----
         <public-CA-chain>
         -----END CERTIFICATE-----

   Keep config/secrets.yaml out of source control and restrict access to it.

7. Validate the service before installation.

   From the OpenShift network, verify DNS, routing, TLS identity, password authentication, Sentinel agreement, the writable role, and the required read/write and Lua operations. Confirm that the stable endpoint and the address returned by Sentinel identify the same writable primary.

8. Verify Valkey or Redis after installation.
   • Confirm that the redis-external release is deployed and that external mode is reported.