Skip to content

Update ACL rules for Replication - #457

Open
hieu2102 wants to merge 2 commits into
valkey-io:mainfrom
hieu2102:update-asm-acl
Open

Update ACL rules for Replication#457
hieu2102 wants to merge 2 commits into
valkey-io:mainfrom
hieu2102:update-asm-acl

Conversation

@hieu2102

@hieu2102 hieu2102 commented Jul 15, 2026

Copy link
Copy Markdown
Contributor
  1. Add permission for SYNC (required by Dual Channel Replication)
    Dual Channel Replication request a full resync from primary node using SYNC (replication.c#L3187):
static int dualChannelReplHandleReplconfReply(connection *conn, sds *err) {
// excluded for brevity
// ...
    if (connSyncWrite(conn, "SYNC\r\n", 6, server.repl_syncio_timeout * 1000) == -1) {
        dualChannelServerLog(LL_WARNING, "I/O error writing to Primary: %s", connGetLastError(conn));
        return C_ERR;
    }
    return C_OK;
}
  1. Update the permissions required by Atomic Slot Migration.
    The set of ACL rules currently mentioned in the doc does not work if the cluster has data:
# configure replication users with the set of ACL rules as mentioned in the docs
cat <<EOF > users.acl
user _r on >hello -@all +psync +replconf +ping +cluster|syncslots
EOF
cat <<EOF > config.sh
export ADDITIONAL_OPTIONS="--aclfile /opt/valkey/users.acl --primaryuser _r --primaryauth hello --loadmodule /opt/valkey-audit/build/libvalkeyaudit.so --audit.enabled yes --audit.events all --audit.command_result_mode all"
EOF
./utils/create-cluster/create-cluster start
./utils/create-cluster/create-cluster create

# write some keys
for i in {0000..9999}; do
    valkey-cli -p 30001 -c set $i $i
done

# execute ASM
tnode="$(valkey-cli  -c -p 30001 cluster nodes | grep master|grep -v myself |head -n 1 | awk '{print $1}')"
valkey-cli -c -p 30001 cluster migrateslots slotsrange 0 0 node $tnode

Log output of the ASM job:

26589:M 13 Jul 2026 07:34:45.785 * New slot import job created: {name: b5094a3be505334c4888e62f6054456615db3d0a, operation: import, source_node_id: 73bedc79e32275057cec49e9cc5ff0386054ebd5, slots: 0-0}.
26589:M 13 Jul 2026 07:34:45.786 * Slot migration {name: b5094a3be505334c4888e62f6054456615db3d0a, operation: import, source_node_id: 73bedc79e32275057cec49e9cc5ff0386054ebd5, slots: 0-0} state transition: waiting-for-ack -> receiving-snapshot
26589:M 13 Jul 2026 07:34:45.894 # == CRITICAL == This slot-import-target is sending an error to its slot-import-source: '-NOPERM No permissions to access a key' after processing the command 'set'
26589:M 13 Jul 2026 07:34:45.894 * Slot migration {name: b5094a3be505334c4888e62f6054456615db3d0a, operation: import, source_node_id: 73bedc79e32275057cec49e9cc5ff0386054ebd5, slots: 0-0} state transition: receiving-snapshot -> cleaning-up
26589:M 13 Jul 2026 07:34:45.895 * Cleaning up slot migration {name: b5094a3be505334c4888e62f6054456615db3d0a, operation: import, source_node_id: 73bedc79e32275057cec49e9cc5ff0386054ebd5, slots: 0-0} after failed
26589:M 13 Jul 2026 07:34:45.895 * Slot migration {name: b5094a3be505334c4888e62f6054456615db3d0a, operation: import, source_node_id: 73bedc79e32275057cec49e9cc5ff0386054ebd5, slots: 0-0} state transition: cleaning-up -> failed
26589:M 13 Jul 2026 07:34:45.895 # Slot migration {name: b5094a3be505334c4888e62f6054456615db3d0a, operation: import, source_node_id: 73bedc79e32275057cec49e9cc5ff0386054ebd5, slots: 0-0} finished. State: failed, Message: Failed to process command during slot migration. Check logs for more information

hieu2102 added 2 commits July 15, 2026 09:34
Signed-off-by: hieu2102 <hieund2102@gmail.com>
Signed-off-by: hieu2102 <hieund2102@gmail.com>
@hieu2102 hieu2102 changed the title Update ACL rules for Atomic Slot Migration Update ACL rules for Replication Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant