diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644
--- a/files/gitlab-config-template/gitlab.rb.template
+++ b/files/gitlab-config-template/gitlab.rb.template
@@ -789,7 +789,7 @@
 # gitlab_rails['redis_sentinels'] = [
 #   {'host' => '127.0.0.1', 'port' => 26379},
 # ]
-
+# gitlab_rails['redis_sentinels_password'] = 'sentinel-requirepass-goes-here'
 
 #### Cluster support
 ####! Cluster support is only available for selected Redis instances. `resque.yml` will not
@@ -806,8 +806,9 @@
 ###! Docs: https://docs.gitlab.com/omnibus/settings/redis.html#running-with-multiple-redis-instances
 # gitlab_rails['redis_cache_instance'] = nil
 # gitlab_rails['redis_cache_sentinels'] = nil
+# gitlab_rails['redis_cache_sentinels_password'] = nil
 # gitlab_rails['redis_cache_username'] = nil
 # gitlab_rails['redis_cache_password'] = nil
 # gitlab_rails['redis_cache_cluster_nodes'] = nil
 # gitlab_rails['redis_queues_instance'] = nil
 # gitlab_rails['redis_queues_sentinels'] = nil
@@ -809,10 +810,11 @@
 # gitlab_rails['redis_cache_username'] = nil
 # gitlab_rails['redis_cache_password'] = nil
 # gitlab_rails['redis_cache_cluster_nodes'] = nil
 # gitlab_rails['redis_queues_instance'] = nil
 # gitlab_rails['redis_queues_sentinels'] = nil
+# gitlab_rails['redis_queues_sentinels_password'] = nil
 # gitlab_rails['redis_queues_username'] = nil
 # gitlab_rails['redis_queues_password'] = nil
 # gitlab_rails['redis_queues_cluster_nodes'] = nil
 # gitlab_rails['redis_shared_state_instance'] = nil
 # gitlab_rails['redis_shared_state_sentinels'] = nil
@@ -814,10 +816,11 @@
 # gitlab_rails['redis_queues_username'] = nil
 # gitlab_rails['redis_queues_password'] = nil
 # gitlab_rails['redis_queues_cluster_nodes'] = nil
 # gitlab_rails['redis_shared_state_instance'] = nil
 # gitlab_rails['redis_shared_state_sentinels'] = nil
+# gitlab_rails['redis_shared_state_sentinels_password'] = nil
 # gitlab_rails['redis_shared_state_username'] = nil
 # gitlab_rails['redis_shared_state_password'] = nil
 # gitlab_rails['redis_shared_state_cluster_nodes'] = nil
 # gitlab_rails['redis_trace_chunks_instance'] = nil
 # gitlab_rails['redis_trace_chunks_sentinels'] = nil
@@ -819,10 +822,11 @@
 # gitlab_rails['redis_shared_state_username'] = nil
 # gitlab_rails['redis_shared_state_password'] = nil
 # gitlab_rails['redis_shared_state_cluster_nodes'] = nil
 # gitlab_rails['redis_trace_chunks_instance'] = nil
 # gitlab_rails['redis_trace_chunks_sentinels'] = nil
+# gitlab_rails['redis_trace_chunks_sentinels_password'] = nil
 # gitlab_rails['redis_trace_chunks_username'] = nil
 # gitlab_rails['redis_trace_chunks_password'] = nil
 # gitlab_rails['redis_trace_chunks_cluster_nodes'] = nil
 # gitlab_rails['redis_actioncable_instance'] = nil
 # gitlab_rails['redis_actioncable_sentinels'] = nil
@@ -824,10 +828,11 @@
 # gitlab_rails['redis_trace_chunks_username'] = nil
 # gitlab_rails['redis_trace_chunks_password'] = nil
 # gitlab_rails['redis_trace_chunks_cluster_nodes'] = nil
 # gitlab_rails['redis_actioncable_instance'] = nil
 # gitlab_rails['redis_actioncable_sentinels'] = nil
+# gitlab_rails['redis_actioncable_sentinels_password'] = nil
 # gitlab_rails['redis_actioncable_username'] = nil
 # gitlab_rails['redis_actioncable_password'] = nil
 # gitlab_rails['redis_actioncable_cluster_nodes'] = nil
 # gitlab_rails['redis_rate_limiting_instance'] = nil
 # gitlab_rails['redis_rate_limiting_sentinels'] = nil
@@ -829,10 +834,11 @@
 # gitlab_rails['redis_actioncable_username'] = nil
 # gitlab_rails['redis_actioncable_password'] = nil
 # gitlab_rails['redis_actioncable_cluster_nodes'] = nil
 # gitlab_rails['redis_rate_limiting_instance'] = nil
 # gitlab_rails['redis_rate_limiting_sentinels'] = nil
+# gitlab_rails['redis_rate_limiting_sentinels_password'] = nil
 # gitlab_rails['redis_rate_limiting_username'] = nil
 # gitlab_rails['redis_rate_limiting_password'] = nil
 # gitlab_rails['redis_rate_limiting_cluster_nodes'] = nil
 # gitlab_rails['redis_sessions_instance'] = nil
 # gitlab_rails['redis_sessions_sentinels'] = nil
@@ -834,10 +840,11 @@
 # gitlab_rails['redis_rate_limiting_username'] = nil
 # gitlab_rails['redis_rate_limiting_password'] = nil
 # gitlab_rails['redis_rate_limiting_cluster_nodes'] = nil
 # gitlab_rails['redis_sessions_instance'] = nil
 # gitlab_rails['redis_sessions_sentinels'] = nil
+# gitlab_rails['redis_sessions_sentinels_password'] = nil
 # gitlab_rails['redis_sessions_username'] = nil
 # gitlab_rails['redis_sessions_password'] = nil
 # gitlab_rails['redis_sessions_cluster_nodes'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_instance'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_sentinels'] = nil
@@ -839,10 +846,11 @@
 # gitlab_rails['redis_sessions_username'] = nil
 # gitlab_rails['redis_sessions_password'] = nil
 # gitlab_rails['redis_sessions_cluster_nodes'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_instance'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_sentinels'] = nil
+# gitlab_rails['redis_cluster_rate_limiting_sentinels_password'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_username'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_password'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_cluster_nodes'] = nil
 # gitlab_rails['redis_repository_cache_instance'] = nil
 # gitlab_rails['redis_repository_cache_sentinels'] = nil
@@ -844,8 +852,9 @@
 # gitlab_rails['redis_cluster_rate_limiting_username'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_password'] = nil
 # gitlab_rails['redis_cluster_rate_limiting_cluster_nodes'] = nil
 # gitlab_rails['redis_repository_cache_instance'] = nil
 # gitlab_rails['redis_repository_cache_sentinels'] = nil
+# gitlab_rails['redis_repository_cache_sentinels_password'] = nil
 # gitlab_rails['redis_repository_cache_username'] = nil
 # gitlab_rails['redis_repository_cache_password'] = nil
 # gitlab_rails['redis_repository_cache_cluster_nodes'] = nil
diff --git a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi 100644
--- a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb
+++ b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb
@@ -27,5 +27,6 @@
 gitlab_kas_authentication_secret_file = File.join(working_dir, 'authentication_secret_file')
 gitlab_kas_private_api_authentication_secret_file = File.join(working_dir, 'private_api_authentication_secret_file')
 redis_host, redis_port, redis_password = redis_helper.redis_params
+redis_password_present = redis_password && !redis_password.empty?
 redis_sentinels = node['gitlab']['gitlab_rails']['redis_sentinels']
 redis_sentinels_master_name = node['redis']['master_name']
@@ -30,3 +31,6 @@
 redis_sentinels = node['gitlab']['gitlab_rails']['redis_sentinels']
 redis_sentinels_master_name = node['redis']['master_name']
+redis_sentinels_password = node['gitlab']['gitlab_rails']['redis_sentinels_password']
+redis_sentinels_password_present = redis_sentinels_password && !redis_sentinels_password.empty?
+
 gitlab_kas_redis_password_file = File.join(working_dir, 'redis_password_file')
@@ -32,4 +36,5 @@
 gitlab_kas_redis_password_file = File.join(working_dir, 'redis_password_file')
+gitlab_kas_redis_sentinels_password_file = File.join(working_dir, 'redis_sentinels_password_file')
 redis_default_port = URI::Redis::DEFAULT_PORT
 redis_network = redis_helper.redis_url.scheme == 'unix' ? 'unix' : 'tcp'
 redis_ssl = node['gitlab']['gitlab_rails']['redis_ssl']
@@ -99,7 +104,17 @@
   group account_helper.gitlab_group
   mode '0640'
   notifies :restart, 'runit_service[gitlab-kas]'
-  only_if { redis_password && !redis_password.empty? }
+  only_if { redis_password_present }
+  sensitive true
+end
+
+file gitlab_kas_redis_sentinels_password_file do
+  content redis_sentinels_password
+  owner 'root'
+  group account_helper.gitlab_group
+  mode '0640'
+  notifies :restart, 'runit_service[gitlab-kas]'
+  only_if { redis_sentinels_password_present }
   sensitive true
 end
 
@@ -116,5 +131,5 @@
       redis_address: redis_address,
       redis_ssl: redis_ssl,
       redis_default_port: redis_default_port,
-      redis_password_file: redis_password ? gitlab_kas_redis_password_file : nil,
+      redis_password_file: redis_password_present ? gitlab_kas_redis_password_file : nil,
       redis_sentinels_master_name: redis_sentinels_master_name,
@@ -120,5 +135,6 @@
       redis_sentinels_master_name: redis_sentinels_master_name,
-      redis_sentinels: redis_sentinels
+      redis_sentinels: redis_sentinels,
+      redis_sentinels_password_file: redis_sentinels_password_present ? gitlab_kas_redis_sentinels_password_file : nil
     )
   )
   notifies :restart, 'runit_service[gitlab-kas]'
diff --git a/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb b/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3RlbXBsYXRlcy9kZWZhdWx0L2dpdGxhYi1rYXMtY29uZmlnLnltbC5lcmI=..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3RlbXBsYXRlcy9kZWZhdWx0L2dpdGxhYi1rYXMtY29uZmlnLnltbC5lcmI= 100644
--- a/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb
+++ b/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb
@@ -58,6 +58,9 @@
     <%- @redis_sentinels.each do |sentinel| %>
       - '<%= sentinel['host'] %>:<%= sentinel['port'] || @redis_default_port %>'
     <%- end %>
+    <%- if @redis_sentinels_password_file %>
+    sentinel_password_file: <%= @redis_sentinels_password_file %>
+    <%- end %>
   <%- end %>
 api:
   listen:
diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi 100644
--- a/files/gitlab-cookbooks/gitlab/attributes/default.rb
+++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb
@@ -442,5 +442,6 @@
 default['gitlab']['gitlab_rails']['redis_socket'] = "/var/opt/gitlab/redis/redis.socket"
 default['gitlab']['gitlab_rails']['redis_enable_client'] = true
 default['gitlab']['gitlab_rails']['redis_sentinels'] = []
+default['gitlab']['gitlab_rails']['redis_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_cache_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_cache_sentinels'] = []
@@ -445,5 +446,6 @@
 default['gitlab']['gitlab_rails']['redis_cache_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_cache_sentinels'] = []
+default['gitlab']['gitlab_rails']['redis_cache_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_cache_username'] = nil
 default['gitlab']['gitlab_rails']['redis_cache_password'] = nil
 default['gitlab']['gitlab_rails']['redis_cache_cluster_nodes'] = []
@@ -451,6 +453,7 @@
 default['gitlab']['gitlab_rails']['redis_queues_username'] = nil
 default['gitlab']['gitlab_rails']['redis_queues_password'] = nil
 default['gitlab']['gitlab_rails']['redis_queues_sentinels'] = []
+default['gitlab']['gitlab_rails']['redis_queues_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_queues_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_shared_state_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_sentinels'] = []
@@ -454,8 +457,9 @@
 default['gitlab']['gitlab_rails']['redis_queues_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_shared_state_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_sentinels'] = []
+default['gitlab']['gitlab_rails']['redis_shared_state_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_username'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_password'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_trace_chunks_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_sentinels'] = []
@@ -457,10 +461,11 @@
 default['gitlab']['gitlab_rails']['redis_shared_state_username'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_password'] = nil
 default['gitlab']['gitlab_rails']['redis_shared_state_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_trace_chunks_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_sentinels'] = []
+default['gitlab']['gitlab_rails']['redis_trace_chunks_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_username'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_password'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_actioncable_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_sentinels'] = []
@@ -462,10 +467,11 @@
 default['gitlab']['gitlab_rails']['redis_trace_chunks_username'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_password'] = nil
 default['gitlab']['gitlab_rails']['redis_trace_chunks_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_actioncable_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_sentinels'] = []
+default['gitlab']['gitlab_rails']['redis_actioncable_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_username'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_password'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_rate_limiting_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_sentinels'] = []
@@ -467,10 +473,11 @@
 default['gitlab']['gitlab_rails']['redis_actioncable_username'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_password'] = nil
 default['gitlab']['gitlab_rails']['redis_actioncable_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_rate_limiting_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_sentinels'] = []
+default['gitlab']['gitlab_rails']['redis_rate_limiting_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_username'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_password'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_sessions_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_sentinels'] = []
@@ -472,10 +479,11 @@
 default['gitlab']['gitlab_rails']['redis_rate_limiting_username'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_password'] = nil
 default['gitlab']['gitlab_rails']['redis_rate_limiting_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_sessions_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_sentinels'] = []
+default['gitlab']['gitlab_rails']['redis_sessions_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_username'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_password'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_repository_cache_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_sentinels'] = []
@@ -477,10 +485,11 @@
 default['gitlab']['gitlab_rails']['redis_sessions_username'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_password'] = nil
 default['gitlab']['gitlab_rails']['redis_sessions_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_repository_cache_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_sentinels'] = []
+default['gitlab']['gitlab_rails']['redis_repository_cache_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_username'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_password'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_sentinels'] = []
@@ -482,8 +491,9 @@
 default['gitlab']['gitlab_rails']['redis_repository_cache_username'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_password'] = nil
 default['gitlab']['gitlab_rails']['redis_repository_cache_cluster_nodes'] = []
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_instance'] = nil
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_sentinels'] = []
+default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_sentinels_password'] = nil
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_username'] = nil
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_password'] = nil
 default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_cluster_nodes'] = []
diff --git a/files/gitlab-cookbooks/gitlab/libraries/redis_helper.rb b/files/gitlab-cookbooks/gitlab/libraries/redis_helper.rb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL3JlZGlzX2hlbHBlci5yYg==..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL3JlZGlzX2hlbHBlci5yYg== 100644
--- a/files/gitlab-cookbooks/gitlab/libraries/redis_helper.rb
+++ b/files/gitlab-cookbooks/gitlab/libraries/redis_helper.rb
@@ -37,6 +37,4 @@
       uri = URI('unix:/')
       uri.path = redis_socket
     else
-      scheme = gitlab_rails['redis_ssl'] ? 'rediss:/' : 'redis:/'
-      uri = URI(scheme)
       params = redis_params(support_sentinel_groupname: support_sentinel_groupname)
@@ -42,8 +40,12 @@
       params = redis_params(support_sentinel_groupname: support_sentinel_groupname)
-      # In case the password has non-alphanumeric passwords, be sure to encode it
-      params[2] = CGI.escape(params[2]) if params[2]
-      uri.host, uri.port, uri.password = params
-      uri.path = "/#{gitlab_rails['redis_database']}"
+
+      uri = build_redis_url(
+        ssl: gitlab_rails['redis_ssl'],
+        host: params[0],
+        port: params[1],
+        password: params[2],
+        path: "/#{gitlab_rails['redis_database']}"
+      )
     end
 
     uri
@@ -61,6 +63,37 @@
     raise "Cluster mode is not allowed for #{instance}" unless ALLOWED_REDIS_CLUSTER_INSTANCE.include?(instance)
   end
 
+  def build_redis_url(ssl:, host:, port:, path:, password:)
+    scheme = ssl ? 'rediss:/' : 'redis:/'
+    uri = URI(scheme)
+    uri.host = host
+    uri.port = port
+    uri.path = path
+    # In case the password has non-alphanumeric passwords, be sure to encode it
+    uri.password = CGI.escape(password) if password
+
+    uri
+  end
+
+  def redis_sentinel_urls(sentinels_key)
+    gitlab_rails = @node['gitlab']['gitlab_rails']
+
+    sentinels = gitlab_rails[sentinels_key]
+
+    return [] unless sentinels
+
+    sentinels_password = gitlab_rails["#{sentinels_key}_password"]
+
+    sentinels.map do |sentinel|
+      build_redis_url(
+        ssl: sentinel['ssl'],
+        host: sentinel['host'],
+        port: sentinel['port'],
+        path: '',
+        password: sentinels_password)
+    end
+  end
+
   def running_version
     return unless OmnibusHelper.new(@node).service_up?('redis')
 
diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI=..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI= 100644
--- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
+++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb
@@ -198,6 +198,7 @@
 
 redis_url = redis_helper.redis_url
 redis_sentinels = node['gitlab']['gitlab_rails']['redis_sentinels']
+redis_sentinels_password = node['gitlab']['gitlab_rails']['redis_sentinels_password']
 redis_enable_client = node['gitlab']['gitlab_rails']['redis_enable_client']
 
 templatesymlink "Create a secrets.yml and create a symlink to Rails root" do
@@ -226,7 +227,7 @@
   owner "root"
   group "root"
   mode "0644"
-  variables(redis_url: redis_url, redis_sentinels: redis_sentinels, redis_enable_client: redis_enable_client)
+  variables(redis_url: redis_url, redis_sentinels: redis_sentinels, redis_sentinels_password: redis_sentinels_password, redis_enable_client: redis_enable_client)
   dependent_services.each { |svc| notifies :restart, svc }
   sensitive true
 end
@@ -246,6 +247,7 @@
 templatesymlink "Create a cable.yml and create a symlink to Rails root" do
   url = node['gitlab']['gitlab_rails']['redis_actioncable_instance']
   sentinels = node['gitlab']['gitlab_rails']['redis_actioncable_sentinels']
+  sentinels_password = node['gitlab']['gitlab_rails']['redis_actioncable_sentinels_password']
 
   if url.nil?
     url = redis_url
@@ -258,7 +260,7 @@
   owner "root"
   group "root"
   mode "0644"
-  variables(redis_url: url, redis_sentinels: sentinels, redis_enable_client: redis_enable_client)
+  variables(redis_url: url, redis_sentinels: sentinels, redis_sentinels_password: sentinels_password, redis_enable_client: redis_enable_client)
   dependent_services.each { |svc| notifies :restart, svc }
   sensitive true
 end
@@ -267,6 +269,7 @@
   filename = "redis.#{instance}.yml"
   url = node['gitlab']['gitlab_rails']["redis_#{instance}_instance"]
   sentinels = node['gitlab']['gitlab_rails']["redis_#{instance}_sentinels"]
+  sentinels_password = node['gitlab']['gitlab_rails']["redis_#{instance}_sentinels_password"]
   clusters = node['gitlab']['gitlab_rails']["redis_#{instance}_cluster_nodes"]
   username = node['gitlab']['gitlab_rails']["redis_#{instance}_username"]
   password = node['gitlab']['gitlab_rails']["redis_#{instance}_password"]
@@ -285,6 +288,7 @@
     variables(
       redis_url: url,
       redis_sentinels: sentinels,
+      redis_sentinels_password: sentinels_password,
       redis_enable_client: redis_enable_client,
       cluster_nodes: clusters,
       cluster_username: username,
diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlLnJi..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlLnJi 100644
--- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb
+++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb
@@ -91,7 +91,7 @@
 _redis_host, _redis_port, redis_password = redis_helper.redis_params
 workhorse_keywatcher = node['gitlab']['gitlab_workhorse']['workhorse_keywatcher']
 redis_url = redis_helper.redis_url.to_s
-redis_sentinels = node['gitlab']['gitlab_rails']['redis_sentinels']
+redis_sentinel_urls = redis_helper.redis_sentinel_urls('redis_sentinels')
 redis_sentinel_master = node['redis']['master_name']
 redis_sentinel_master_password = node['redis']['master_password']
 config_file_path = File.join(working_dir, "config.toml")
@@ -110,7 +110,7 @@
     workhorse_keywatcher: workhorse_keywatcher,
     redis_url: redis_url,
     password: redis_password,
-    sentinels: redis_sentinels,
+    sentinels: redis_sentinel_urls,
     sentinel_master: redis_sentinel_master,
     shutdown_timeout: shutdown_timeout,
     master_password: redis_sentinel_master_password,
diff --git a/files/gitlab-cookbooks/gitlab/templates/default/cable.yml.erb b/files/gitlab-cookbooks/gitlab/templates/default/cable.yml.erb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvY2FibGUueW1sLmVyYg==..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvY2FibGUueW1sLmVyYg== 100644
--- a/files/gitlab-cookbooks/gitlab/templates/default/cable.yml.erb
+++ b/files/gitlab-cookbooks/gitlab/templates/default/cable.yml.erb
@@ -10,5 +10,6 @@
     -
       host: <%= sentinel['host'] %>
       port: <%= sentinel['port'] %>
+      <%- if @redis_sentinels_password %>password: "<%= @redis_sentinels_password %>"<% end %>
     <% end %>
   <% end %>
diff --git a/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb b/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvcmVzcXVlLnltbC5lcmI=..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvcmVzcXVlLnltbC5lcmI= 100644
--- a/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb
+++ b/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb
@@ -19,6 +19,7 @@
     -
       host: <%= sentinel['host'] %>
       port: <%= sentinel['port'] %>
+      <%- if @redis_sentinels_password %>password: "<%= @redis_sentinels_password %>"<% end %>
     <% end %>
   <% end %>
   <% end %>
diff --git a/files/gitlab-cookbooks/gitlab/templates/default/workhorse-config.toml.erb b/files/gitlab-cookbooks/gitlab/templates/default/workhorse-config.toml.erb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvd29ya2hvcnNlLWNvbmZpZy50b21sLmVyYg==..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvd29ya2hvcnNlLWNvbmZpZy50b21sLmVyYg== 100644
--- a/files/gitlab-cookbooks/gitlab/templates/default/workhorse-config.toml.erb
+++ b/files/gitlab-cookbooks/gitlab/templates/default/workhorse-config.toml.erb
@@ -17,7 +17,7 @@
 URL = "<%= @redis_url %>"
 Password = "<%= @password %>"
 <% else %>
-Sentinel = <%= @sentinels.map{ |sentinel| "tcp://#{sentinel['host']}:#{sentinel['port']}" }.to_s %>
+Sentinel = <%= @sentinels.to_json %>
 SentinelMaster = "<%= @sentinel_master %>"
 Password = "<%= @master_password %>"
 <% end %>
diff --git a/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb b/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZ2l0bGFiLWthc19zcGVjLnJi..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZ2l0bGFiLWthc19zcGVjLnJi 100644
--- a/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb
+++ b/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb
@@ -454,8 +454,8 @@
     end
 
     context 'with sentinel' do
-      before do
-        stub_gitlab_rb(
+      let(:sentinel_params) do
+        {
           external_url: 'https://gitlab.example.com',
           gitlab_rails: {
             redis_sentinels: [
@@ -467,7 +467,11 @@
           redis: {
             master_name: 'example-redis'
           }
-        )
+        }
+      end
+
+      before do
+        stub_gitlab_rb(sentinel_params)
       end
 
       it 'renders a single server configuration in to the kas config' do
@@ -489,6 +493,38 @@
           expect(kas_redis_cfg).not_to(include('server'))
         }
       end
+
+      context 'when there is a Sentinel password' do
+        before do
+          sentinel_params[:gitlab_rails]['redis_sentinels_password'] = 'some pass'
+
+          stub_gitlab_rb(sentinel_params)
+        end
+
+        it 'writes sentinel_password_file into the kas config' do
+          expect(chef_run).to render_file('/var/opt/gitlab/gitlab-kas/gitlab-kas-config.yml').with_content { |content|
+            kas_redis_cfg = YAML.safe_load(content)['redis']
+
+            expect(kas_redis_cfg).to(
+              include(
+                'sentinel' => {
+                  'master_name' => 'example-redis',
+                  'addresses' => [
+                    'a:1',
+                    'b:2',
+                    'c:6379'
+                  ],
+                  'sentinel_password_file' => '/var/opt/gitlab/gitlab-kas/redis_sentinels_password_file'
+                }
+              )
+            )
+          }
+        end
+
+        it 'renders the password file' do
+          expect(chef_run).to render_file('/var/opt/gitlab/gitlab-kas/redis_sentinels_password_file').with_content('some pass')
+        end
+      end
     end
   end
 
diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHNfc3BlYy5yYg==..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHNfc3BlYy5yYg== 100644
--- a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb
+++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb
@@ -350,7 +350,8 @@
           stub_gitlab_rb(gitlab_rails: {
                            redis_enable_client: false,
                            redis_actioncable_instance: "redis://:fakepass@fake.redis.actioncable.com:8888/2",
-                           redis_actioncable_sentinels: [{ host: 'actioncable', port: '1234' }, { host: 'actioncable', port: '3456' }]
+                           redis_actioncable_sentinels: [{ host: 'actioncable', port: '1234' }, { host: 'actioncable', port: '3456' }],
+                           redis_actioncable_sentinels_password: 'some pass'
                          })
         end
 
@@ -363,6 +364,7 @@
             hash_including(
               redis_url: "redis://:fakepass@fake.redis.actioncable.com:8888/2",
               redis_sentinels: [{ 'host' => 'actioncable', 'port' => '1234' }, { 'host' => 'actioncable', 'port' => '3456' }],
+              redis_sentinels_password: 'some pass',
               redis_enable_client: false
             )
           )
@@ -366,6 +368,13 @@
               redis_enable_client: false
             )
           )
+
+          expect(chef_run).to render_file("/var/opt/gitlab/gitlab-rails/etc/cable.yml").with_content { |content|
+            generated_yml = YAML.safe_load(content)
+            expect(generated_yml.dig('production', 'url')).to eq("redis://:fakepass@fake.redis.actioncable.com:8888/2")
+            expect(generated_yml.dig('production', 'cluster')).to eq(nil)
+            expect(generated_yml.dig('production', 'sentinels')).to eq([{ "host" => 'actioncable', 'port' => 1234, 'password' => 'some pass' }, { 'host' => 'actioncable', 'port' => 3456, 'password' => 'some pass' }])
+          }
         end
       end
 
@@ -390,6 +399,7 @@
             expect(chef_run).to create_templatesymlink("Create a redis.#{instance}.yml and create a symlink to Rails root").with_variables(
               redis_url: nil,
               redis_sentinels: [],
+              redis_sentinels_password: nil,
               redis_enable_client: false,
               cluster_nodes: [{ "host" => instance, "port" => "1234" }, { "host" => instance, "port" => "3456" }],
               cluster_username: instance,
@@ -426,6 +436,7 @@
             expect(chef_run).to create_templatesymlink("Create a redis.#{instance}.yml and create a symlink to Rails root").with_variables(
               redis_url: "redis://:fakepass@fake.redis.#{instance}.com:8888/2",
               redis_sentinels: [{ "host" => instance, "port" => "1234" }, { "host" => instance, "port" => "3456" }],
+              redis_sentinels_password: nil,
               redis_enable_client: false,
               cluster_nodes: [],
               cluster_username: nil,
@@ -445,6 +456,44 @@
           end
         end
 
+        context 'with Sentinel passwords' do
+          before do
+            stub_hash = { redis_enable_client: false }
+            redis_instances.each do |instance|
+              stub_hash["redis_#{instance}_instance"] = "redis://:fakepass@fake.redis.#{instance}.com:8888/2"
+              stub_hash["redis_#{instance}_sentinels"] = [{ host: instance, port: '1234' }, { host: instance, port: '3456' }]
+              stub_hash["redis_#{instance}_sentinels_password"] = 'sentinelpass'
+            end
+
+            stub_gitlab_rb(gitlab_rails: stub_hash)
+          end
+
+          it 'render separate config files' do
+            redis_instances.each do |instance|
+              expect(chef_run).to create_templatesymlink("Create a redis.#{instance}.yml and create a symlink to Rails root").with_variables(
+                redis_url: "redis://:fakepass@fake.redis.#{instance}.com:8888/2",
+                redis_sentinels: [{ "host" => instance, "port" => "1234" }, { "host" => instance, "port" => "3456" }],
+                redis_sentinels_password: 'sentinelpass',
+                redis_enable_client: false,
+                cluster_nodes: [],
+                cluster_username: nil,
+                cluster_password: nil
+              )
+
+              expect(chef_run).to render_file("/var/opt/gitlab/gitlab-rails/etc/redis.#{instance}.yml").with_content { |content|
+                generated_yml = YAML.safe_load(content)
+                expect(generated_yml.dig('production', 'url')).to eq("redis://:fakepass@fake.redis.#{instance}.com:8888/2")
+                expect(generated_yml.dig('production', 'sentinels')).to eq([{ "host" => instance, "port" => 1234, "password" => 'sentinelpass' }, { "host" => instance, "port" => 3456, "password" => 'sentinelpass' }])
+                expect(generated_yml.dig('production', 'cluster')).to eq(nil)
+                expect(generated_yml.dig('production', 'username')).to eq(nil)
+                expect(generated_yml.dig('production', 'password')).to eq(nil)
+              }
+
+              expect(chef_run).not_to delete_file("/var/opt/gitlab/gitlab-rails/etc/redis.#{instance}.yml")
+            end
+          end
+        end
+
         it 'still renders the default configuration file' do
           expect(chef_run).to create_templatesymlink('Create a resque.yml and create a symlink to Rails root')
         end
diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-workhorse_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-workhorse_spec.rb
index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlX3NwZWMucmI=..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlX3NwZWMucmI= 100644
--- a/spec/chef/cookbooks/gitlab/recipes/gitlab-workhorse_spec.rb
+++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-workhorse_spec.rb
@@ -553,7 +553,7 @@
     end
 
     it 'should generate config file with the specified values' do
-      content = 'Sentinel = ["tcp://127.0.0.1:2637", "tcp://127.0.8.1:1234"]'
+      content = 'Sentinel = ["redis://127.0.0.1:2637","redis://127.0.8.1:1234"]'
       content_url = 'URL ='
       content_sentinel_master = 'SentinelMaster = "gitlab-redis"'
       expect(chef_run).to render_file("/var/opt/gitlab/gitlab-workhorse/config.toml").with_content(content)
@@ -579,7 +579,36 @@
     end
 
     it 'should generate config file with the specified values' do
-      content = 'Sentinel = ["tcp://127.0.0.1:26379", "tcp://127.0.8.1:12345"]'
+      content = 'Sentinel = ["redis://127.0.0.1:26379","redis://127.0.8.1:12345"]'
+      content_sentinel_master = 'SentinelMaster = "examplemaster"'
+      content_sentinel_password = 'Password = "examplepassword"'
+      content_url = 'URL ='
+      expect(chef_run).to render_file("/var/opt/gitlab/gitlab-workhorse/config.toml").with_content(content)
+      expect(chef_run).to render_file("/var/opt/gitlab/gitlab-workhorse/config.toml").with_content(content_sentinel_master)
+      expect(chef_run).to render_file("/var/opt/gitlab/gitlab-workhorse/config.toml").with_content(content_sentinel_password)
+      expect(chef_run).not_to render_file("/var/opt/gitlab/gitlab-workhorse/config.toml").with_content(content_url)
+    end
+  end
+
+  context 'with Sentinels password specified' do
+    before do
+      stub_gitlab_rb(
+        gitlab_rails: {
+          redis_sentinels: [
+            { 'host' => '127.0.0.1', 'port' => 26379 },
+            { 'host' => '127.0.8.1', 'port' => 12345 }
+          ],
+          redis_sentinels_password: 'some pass'
+        },
+        redis: {
+          master_name: 'examplemaster',
+          master_password: 'examplepassword'
+        }
+      )
+    end
+
+    it 'should generate config file with the specified values' do
+      content = 'Sentinel = ["redis://:some+pass@127.0.0.1:26379","redis://:some+pass@127.0.8.1:12345"]'
       content_sentinel_master = 'SentinelMaster = "examplemaster"'
       content_sentinel_password = 'Password = "examplepassword"'
       content_url = 'URL ='