Azure Cache for Redis Guide

# Create a Premium tier cache with clustering
az redis create \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --location eastus \
  --sku Premium \
  --vm-size P1 \
  --shard-count 2 \
  --enable-non-ssl-port false \
  --minimum-tls-version 1.2 \
  --redis-version 6 \
  --tags project=myapp environment=production

# Wait for provisioning to complete (can take 15-30 minutes for Premium)
az redis show \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --query '{Name:name, Status:provisioningState, Host:hostName, Port:sslPort, Shards:shardCount}' \
  --output table

# Retrieve access keys
az redis list-keys \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod

# Configure firewall rules (if not using VNet)
az redis firewall-rules create \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --rule-name AllowAppService \
  --start-ip 10.0.1.0 \
  --end-ip 10.0.1.255

# Enable Microsoft Entra ID authentication (recommended)
az redis update \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --set redisConfiguration.aad-enabled=true

# Configure diagnostic settings
az monitor diagnostic-settings create \
  --resource /subscriptions/<sub-id>/resourceGroups/rg-cache-prod/providers/Microsoft.Cache/redis/redis-myapp-prod \
  --name redis-diagnostics \
  --workspace /subscriptions/<sub-id>/resourceGroups/rg-monitoring/providers/Microsoft.OperationalInsights/workspaces/law-central \
  --metrics '[{"category": "AllMetrics", "enabled": true}]'

using StackExchange.Redis;
using Microsoft.Extensions.Caching.StackExchangeRedis;

var builder = WebApplication.CreateBuilder(args);

// Option 1: StackExchange.Redis with connection multiplexer
builder.Services.AddSingleton<IConnectionMultiplexer>(sp =>
{
    var config = ConfigurationOptions.Parse(
        builder.Configuration.GetConnectionString("Redis")!);
    config.AbortOnConnectFail = false;       // Don't crash on startup if Redis is down
    config.ConnectRetry = 3;                  // Retry connection attempts
    config.ConnectTimeout = 5000;             // 5 second connection timeout
    config.SyncTimeout = 3000;                // 3 second operation timeout
    config.ReconnectRetryPolicy = new ExponentialRetry(5000);
    return ConnectionMultiplexer.Connect(config);
});

// Option 2: IDistributedCache abstraction (simpler API)
builder.Services.AddStackExchangeRedisCache(options =>
{
    options.Configuration = builder.Configuration.GetConnectionString("Redis");
    options.InstanceName = "myapp:";          // Key prefix for namespace isolation
});

var app = builder.Build();

// Example: Using IConnectionMultiplexer directly
app.MapGet("/api/products/{id}", async (string id, IConnectionMultiplexer redis) =>
{
    var db = redis.GetDatabase();
    var cacheKey = $"product:{id}";

    // Try cache first
    var cached = await db.StringGetAsync(cacheKey);
    if (cached.HasValue)
    {
        return Results.Ok(JsonSerializer.Deserialize<Product>(cached!));
    }

    // Cache miss: fetch from database
    var product = await GetProductFromDatabase(id);
    if (product == null) return Results.NotFound();

    // Store in cache with 10-minute expiry
    await db.StringSetAsync(cacheKey, JsonSerializer.Serialize(product),
        TimeSpan.FromMinutes(10));

    return Results.Ok(product);
});

app.Run();

public class CacheService
{
    private readonly IDatabase _redis;
    private readonly ILogger<CacheService> _logger;

    // Cache-aside with stampede protection using Redis SETNX
    public async Task<T?> GetOrSetAsync<T>(
        string key,
        Func<Task<T>> factory,
        TimeSpan expiry,
        TimeSpan lockTimeout = default)
    {
        lockTimeout = lockTimeout == default ? TimeSpan.FromSeconds(10) : lockTimeout;

        // 1. Try to get from cache
        var cached = await _redis.StringGetAsync(key);
        if (cached.HasValue)
        {
            return JsonSerializer.Deserialize<T>(cached!);
        }

        // 2. Cache miss - acquire a distributed lock to prevent stampede
        var lockKey = $"lock:{key}";
        var lockValue = Guid.NewGuid().ToString();
        var acquired = await _redis.StringSetAsync(lockKey, lockValue,
            lockTimeout, When.NotExists);

        if (!acquired)
        {
            // Another thread is populating the cache; wait and retry
            await Task.Delay(100);
            cached = await _redis.StringGetAsync(key);
            if (cached.HasValue)
                return JsonSerializer.Deserialize<T>(cached!);

            // Still nothing; fall through to factory
        }

        try
        {
            // 3. Load from the authoritative data source
            var value = await factory();
            if (value == null) return default;

            // 4. Populate cache with a TTL
            var serialized = JsonSerializer.Serialize(value);
            await _redis.StringSetAsync(key, serialized, expiry);

            return value;
        }
        finally
        {
            // 5. Release the lock (only if we still own it)
            var script = @"
                if redis.call('get', KEYS[1]) == ARGV[1] then
                    return redis.call('del', KEYS[1])
                else
                    return 0
                end";
            await _redis.ScriptEvaluateAsync(script,
                new RedisKey[] { lockKey },
                new RedisValue[] { lockValue });
        }
    }

    // Cache invalidation on write operations
    public async Task InvalidateAsync(params string[] keys)
    {
        var redisKeys = keys.Select(k => (RedisKey)k).ToArray();
        await _redis.KeyDeleteAsync(redisKeys);

        _logger.LogInformation("Invalidated {Count} cache keys: {Keys}",
            keys.Length, string.Join(", ", keys));
    }
}

var builder = WebApplication.CreateBuilder(args);

// Configure Redis as the distributed session store
builder.Services.AddStackExchangeRedisCache(options =>
{
    options.Configuration = builder.Configuration.GetConnectionString("Redis");
    options.InstanceName = "session:";
});

builder.Services.AddSession(options =>
{
    options.IdleTimeout = TimeSpan.FromMinutes(30);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.Cookie.SameSite = SameSiteMode.Strict;
});

var app = builder.Build();
app.UseSession();

// Example: Store and retrieve session data
app.MapPost("/api/cart/add", async (HttpContext context, CartItem item) =>
{
    var cart = context.Session.GetString("cart");
    var items = cart != null
        ? JsonSerializer.Deserialize<List<CartItem>>(cart)!
        : new List<CartItem>();

    items.Add(item);
    context.Session.SetString("cart", JsonSerializer.Serialize(items));

    return Results.Ok(new { ItemCount = items.Count });
});

app.MapGet("/api/cart", async (HttpContext context) =>
{
    var cart = context.Session.GetString("cart");
    var items = cart != null
        ? JsonSerializer.Deserialize<List<CartItem>>(cart)!
        : new List<CartItem>();

    return Results.Ok(items);
});

# Enable RDB persistence (snapshot every 15 minutes)
az redis update \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --set redisConfiguration.rdb-backup-enabled=true \
       redisConfiguration.rdb-backup-frequency=15 \
       redisConfiguration.rdb-storage-connection-string="<storage-connection-string>"

# Enable AOF persistence for minimum data loss
az redis update \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --set redisConfiguration.aof-enabled=true \
       redisConfiguration.aof-storage-connection-string-0="<storage-connection-string>"

# Export a snapshot manually (for backup before major changes)
az redis export \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --prefix backup-20240115 \
  --container "https://stredisbackup.blob.core.windows.net/backups" \
  --file-format rdb

# Import a snapshot (for restoring data)
az redis import \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --files "https://stredisbackup.blob.core.windows.net/backups/backup-20240115.rdb" \
  --file-format rdb

# Scale up: change the VM size (Premium tier)
az redis update \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --sku Premium \
  --vm-size P2

# Scale out: add more shards to the cluster
az redis update \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --shard-count 4

# Scale in: reduce shards (data will be rebalanced)
az redis update \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --shard-count 2

# Check cluster info
az redis show \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --query '{Name:name, Shards:shardCount, Size:sku.name, Family:sku.family, Capacity:sku.capacity}' \
  --output table

# Create primary cache in East US (already exists)
# Create secondary cache in West US
az redis create \
  --resource-group rg-cache-dr \
  --name redis-myapp-westus \
  --location westus \
  --sku Premium \
  --vm-size P1 \
  --shard-count 2

# Link the caches for geo-replication
az redis server-link create \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --server-to-link /subscriptions/<sub-id>/resourceGroups/rg-cache-dr/providers/Microsoft.Cache/redis/redis-myapp-westus \
  --replication-role Secondary

# Check replication status
az redis server-link list \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --output table

# Failover: unlink geo-replication (promotes secondary to independent primary)
# WARNING: This is a manual process and breaks the replication link
az redis server-link delete \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --linked-server-name redis-myapp-westus

# Disable non-SSL port and enforce TLS 1.2
az redis update \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --set enableNonSslPort=false \
       minimumTlsVersion=1.2

# Create a private endpoint for the Redis cache
az network private-endpoint create \
  --resource-group rg-cache-prod \
  --name pe-redis-myapp \
  --vnet-name vnet-app-prod \
  --subnet snet-private-endpoints \
  --private-connection-resource-id /subscriptions/<sub-id>/resourceGroups/rg-cache-prod/providers/Microsoft.Cache/redis/redis-myapp-prod \
  --group-id redisCache \
  --connection-name pec-redis

# Disable public network access
az redis update \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --set publicNetworkAccess=Disabled

# Regenerate access keys (rotate primary key)
az redis regenerate-key \
  --resource-group rg-cache-prod \
  --name redis-myapp-prod \
  --key-type Primary

# Query key Redis metrics
az monitor metrics list \
  --resource /subscriptions/<sub-id>/resourceGroups/rg-cache-prod/providers/Microsoft.Cache/redis/redis-myapp-prod \
  --metric "percentProcessorTime" "usedmemorypercentage" "cacheHits" "cacheMisses" "evictedkeys" "connectedclients" \
  --aggregation Average Maximum \
  --interval PT5M \
  --output table

# Create alerts for critical Redis metrics
az monitor metrics alert create \
  --resource-group rg-cache-prod \
  --name "alert-redis-high-memory" \
  --description "Redis memory usage exceeds 90%" \
  --scopes /subscriptions/<sub-id>/resourceGroups/rg-cache-prod/providers/Microsoft.Cache/redis/redis-myapp-prod \
  --condition "avg usedmemorypercentage > 90" \
  --window-size 5m \
  --evaluation-frequency 1m \
  --severity 1 \
  --action ag-platform-team

az monitor metrics alert create \
  --resource-group rg-cache-prod \
  --name "alert-redis-high-server-load" \
  --description "Redis server load exceeds 80%" \
  --scopes /subscriptions/<sub-id>/resourceGroups/rg-cache-prod/providers/Microsoft.Cache/redis/redis-myapp-prod \
  --condition "avg percentProcessorTime > 80" \
  --window-size 5m \
  --evaluation-frequency 1m \
  --severity 2 \
  --action ag-platform-team