Redis Proxy

Redis Proxy configuration overview.

[ proto]

  "stat_prefix": "...",
  "cluster": "...",
  "settings": "{...}",
  "latency_in_micros": "...",
  "prefix_routes": "{...}",
  "downstream_auth_password": "{...}"
(string, REQUIRED) The prefix to use when emitting statistics.

(string) Name of cluster from cluster manager. See the configuration section of the architecture overview for recommendations on configuring the backing cluster.


This field is deprecated. Use a catch_all route instead.

(, REQUIRED) Network settings for the connection pool to the upstream clusters.
(bool) Indicates that latency stat should be computed in microseconds. By default it is computed in milliseconds.

( List of unique prefixes used to separate keys from different workloads to different clusters. Envoy will always favor the longest match first in case of overlap. A catch-all cluster can be used to forward commands when there is no match. Time complexity of the lookups are in O(min(longest key prefix, key length)).


    - prefix: "ab"
      cluster: "cluster_a"
    - prefix: "abc"
      cluster: "cluster_b"

When using the above routes, the following prefixes would be sent to:

  • ‘get abc:users’ would retrive the key ‘abc:users’ from cluster_b.
  • ‘get ab:users’ would retrive the key ‘ab:users’ from cluster_a.
  • ‘get z:users’ would return a NoUpstreamHost error. A catch-all route would have retrieved the key from that cluster instead.

See the configuration section of the architecture overview for recommendations on configuring the backing clusters.

(core.DataSource) Authenticate Redis client connections locally by forcing downstream clients to issue a ‘Redis AUTH command <>`_ with this password before enabling any other command. If an AUTH command’s password matches this password, an “OK” response will be returned to the client. If the AUTH command password does not match this password, then an “ERR invalid password” error will be returned. If any other command is received before AUTH when this password is set, then a “NOAUTH Authentication required.” error response will be sent to the client. If an AUTH command is received when the password is not set, then an “ERR Client sent AUTH, but no password is set” error will be returned.

[ proto]

Redis connection pool settings.

  "op_timeout": "{...}",
  "enable_hashtagging": "...",
  "enable_redirection": "...",
  "max_buffer_size_before_flush": "...",
  "buffer_flush_timeout": "{...}"
(Duration) Per-operation timeout in milliseconds. The timer starts when the first command of a pipeline is written to the backend connection. Each response received from Redis resets the timer since it signifies that the next command is being processed by the backend. The only exception to this behavior is when a connection to a backend is not yet established. In that case, the connect timeout on the cluster will govern the timeout until the connection is ready.

(bool) Use hash tagging on every redis key to guarantee that keys with the same hash tag will be forwarded to the same upstream. The hash key used for determining the upstream in a consistent hash ring configuration will be computed from the hash tagged key instead of the whole key. The algorithm used to compute the hash tag is identical to the redis-cluster implementation.


  • ‘{user1000}.following’ and ‘{user1000}.followers’ will be sent to the same upstream
  • ‘{user1000}.following’ and ‘{user1001}.following’ might be sent to the same upstream
(bool) Accept moved and ask redirection errors from upstream redis servers, and retry commands to the specified target server. The target server does not need to be known to the cluster manager. If the command cannot be redirected, then the original error is passed downstream unchanged. By default, this support is not enabled.
(uint32) Maximum size of encoded request buffer before flush is triggered and encoded requests are sent upstream. If this is unset, the buffer flushes whenever it receives data and performs no batching. This feature makes it possible for multiple clients to send requests to Envoy and have them batched- for example if one is running several worker processes, each with its own Redis connection. There is no benefit to using this with a single downstream process. Recommended size (if enabled) is 1024 bytes.
(Duration) The encoded request buffer is flushed N milliseconds after the first request has been encoded, unless the buffer size has already exceeded max_buffer_size_before_flush. If max_buffer_size_before_flush is not set, this flush timer is not used. Otherwise, the timer should be set according to the number of clients, overall request rate and desired maximum latency for a single command. For example, if there are many requests being batched together at a high rate, the buffer will likely be filled before the timer fires. Alternatively, if the request rate is lower the buffer will not be filled as often before the timer fires. If max_buffer_size_before_flush is set, but buffer_flush_timeout is not, the latter defaults to 3ms.

[ proto]

  "routes": [],
  "case_insensitive": "...",
  "catch_all_cluster": "...",
  "catch_all_route": "{...}"
( List of prefix routes.
(bool) Indicates that prefix matching should be case insensitive.

(string) Optional catch-all route to forward commands that doesn’t match any of the routes. The catch-all route becomes required when no routes are specified. .. attention:

This field is deprecated. Use a :ref:`catch_all
( Optional catch-all route to forward commands that doesn’t match any of the routes. The catch-all route becomes required when no routes are specified.

[ proto]

  "prefix": "...",
  "remove_prefix": "...",
  "cluster": "...",
  "request_mirror_policy": []
(string) String prefix that must match the beginning of the keys. Envoy will always favor the longest match.
(bool) Indicates if the prefix needs to be removed from the key when forwarded.
(string, REQUIRED) Upstream cluster to forward the command to.
( Indicates that the route has a request mirroring policy.

[ proto]

The router is capable of shadowing traffic from one cluster to another. The current implementation is “fire and forget,” meaning Envoy will not wait for the shadow cluster to respond before returning the response from the primary cluster. All normal statistics are collected for the shadow cluster making this feature useful for testing.

  "cluster": "...",
  "runtime_fraction": "{...}",
  "exclude_read_commands": "..."
(string, REQUIRED) Specifies the cluster that requests will be mirrored to. The cluster must exist in the cluster manager configuration.

(core.RuntimeFractionalPercent) If not specified or the runtime key is not present, all requests to the target cluster will be mirrored.

If specified, Envoy will lookup the runtime key to get the percentage of requests to the mirror.

Parsing this field is implemented such that the runtime key’s data may be represented as a FractionalPercent proto represented as JSON/YAML and may also be represented as an integer with the assumption that the value is an integral percentage out of 100. For instance, a runtime key lookup returning the value “42” would parse as a FractionalPercent whose numerator is 42 and denominator is HUNDRED.

(bool) Set this to TRUE to only mirror write commands, this is effectively replicating the writes in a “fire and forget” manner.

[ proto]

RedisProtocolOptions specifies Redis upstream protocol options. This object is used in extension_protocol_options, keyed by the name envoy.redis_proxy.

  "auth_password": "{...}"
(core.DataSource) Upstream server password as defined by the requirepass directive in the server’s configuration file.