redis_sentinel: Add SSL/TLS, username/ACL, and Redis 7+ replica support

redis_sentinel/datadog_checks/redis_sentinel/data/conf.yaml.example

@@ -7,23 +7,62 @@ instances:
     #
   - sentinel_host: localhost
 
-    ## @param sentinel_port - string - required
+    ## @param sentinel_port - integer - required
     ## Port to connect to when reaching `sentinel_host`.
     #
     sentinel_port: 26379
 
     ## @param sentinel_password - string - optional
-    ## Password for authenticating to the Sentinel host
+    ## Password for authenticating to the Sentinel host.
     #
-    # sentinel_password: <password>
+    # sentinel_password: <PASSWORD>
+
+    ## @param sentinel_username - string - optional
+    ## Username for authenticating to the Sentinel host. Redis 6+ only (ACL support).
+    #
+    # sentinel_username: <USERNAME>
 
     ## @param masters - list of strings - required
-    ## List of masters name to collect data from
+    ## List of masters name to collect data from.
     #
     masters:
       - <MASTER_NAME_1>
       - <MASTER_NAME_2>
 
+    ## @param socket_timeout - integer - optional - default: 5
+    ## Timeout in seconds for connecting to and reading from the Sentinel host.
+    #
+    # socket_timeout: 5
+
+    ## @param ssl - boolean - optional - default: false
+    ## Enable SSL/TLS encryption for the Sentinel connection.
+    #
+    # ssl: false
+
+    ## @param ssl_keyfile - string - optional
+    ## The path to the client-side private keyfile.
+    #
+    # ssl_keyfile: <CERT_KEY_PATH>
+
+    ## @param ssl_certfile - string - optional
+    ## The path to the client-side certificate file.
+    #
+    # ssl_certfile: <CERT_PEM_PATH>
+
+    ## @param ssl_ca_certs - string - optional
+    ## The path to the CA certs file.
+    #
+    # ssl_ca_certs: <CERT_PATH>
+
+    ## @param ssl_cert_reqs - integer - optional - default: 2
+    ## Specifies whether a certificate is required from the
+    ## other side of the connection, and whether it's validated if provided.
+    ##   * 0 for ssl.CERT_NONE (certificates ignored)
+    ##   * 1 for ssl.CERT_OPTIONAL (not required, but validated if provided)
+    ##   * 2 for ssl.CERT_REQUIRED (required and validated)
+    #
+    # ssl_cert_reqs: 2
+
     ## @param tags - list of key:value elements - optional
     ## List of tags to attach to every metric, event and service check emitted by this integration.
     ##

redis_sentinel/datadog_checks/redis_sentinel/redis_sentinel.py

@@ -24,13 +24,40 @@ def _load_config(self, instance):
             raise ConfigurationError('Configuration error. "sentinel_port" must be an int.')
 
         passwd = instance.get('sentinel_password', None)
-
-        return host, port, passwd
+        username = instance.get('sentinel_username', None)
+        socket_timeout = instance.get('socket_timeout', 5)
+
+        ssl_kwargs = {}
+        if instance.get('ssl', False):
+            ssl_kwargs['ssl'] = True
+            ssl_certfile = instance.get('ssl_certfile')
+            if ssl_certfile:
+                ssl_kwargs['ssl_certfile'] = ssl_certfile
+            ssl_keyfile = instance.get('ssl_keyfile')
+            if ssl_keyfile:
+                ssl_kwargs['ssl_keyfile'] = ssl_keyfile
+            ssl_ca_certs = instance.get('ssl_ca_certs')
+            if ssl_ca_certs:
+                ssl_kwargs['ssl_ca_certs'] = ssl_ca_certs
+            ssl_cert_reqs = instance.get('ssl_cert_reqs')
+            if ssl_cert_reqs is not None:
+                ssl_kwargs['ssl_cert_reqs'] = ssl_cert_reqs
+
+        return host, port, passwd, username, socket_timeout, ssl_kwargs
 
     def check(self, instance):
-        host, port, password = self._load_config(instance)
-
-        redis_conn = redis.StrictRedis(host=host, port=port, password=password, db=0)
+        host, port, password, username, socket_timeout, ssl_kwargs = self._load_config(instance)
+
+        redis_conn = redis.StrictRedis(
+            host=host,
+            port=port,
+            password=password,
+            username=username,
+            db=0,
+            socket_timeout=socket_timeout,
+            socket_connect_timeout=socket_timeout,
+            **ssl_kwargs,
+        )
 
         for master_name in instance['masters']:
             base_tags = ['redis_name:%s' % master_name] + instance.get('tags', [])
@@ -44,6 +71,15 @@ def _process_instance_master(self, redis_conn, master_name, base_tags):
         self._process_slaves_stats(redis_conn, master_name, base_tags, master_tags)
         self._process_sentinels_stats(redis_conn, master_name, base_tags, master_tags)
 
+    def _get_sentinel_replicas(self, redis_conn, master_name):
+        """Get replica stats using sentinel_replicas() (Redis 7+) with fallback to sentinel_slaves()."""
+        if hasattr(redis_conn, 'sentinel_replicas'):
+            try:
+                return redis_conn.sentinel_replicas(master_name)
+            except Exception:
+                pass
+        return redis_conn.sentinel_slaves(master_name)
+
     def _process_sentinels_stats(self, redis_conn, master_name, base_tags, master_tags):
         """
         [{
@@ -124,7 +160,7 @@ def _process_slaves_stats(self, redis_conn, master_name, base_tags, master_tags)
             'slave-repl-offset': 12345678,
         }]
         """
-        slaves_stats = redis_conn.sentinel_slaves(master_name)
+        slaves_stats = self._get_sentinel_replicas(redis_conn, master_name)
         slaves_odown = 0
         slaves_sdown = 0
 

redis_sentinel/pyproject.toml

@@ -29,15 +29,15 @@ classifiers = [
     "Private :: Do Not Upload",
 ]
 dependencies = [
-    "datadog-checks-base>=4.2.0",
+    "datadog-checks-base>=37.10.0",
 ]
 dynamic = [
     "version",
 ]
 
 [project.optional-dependencies]
 deps = [
-    "redis==2.10.5",
+    "redis==7.3.0",
 ]
 
 [project.urls]

redis_sentinel/tests/test_redis_sentinel.py

@@ -46,18 +46,90 @@ def test_load_config():
         c._load_config({'sentinel_host': 'localhost', 'sentinel_port': 'port'})
 
     # Expect to pass when port is an integer, with no password defined.
-    host, port, password = c._load_config({'sentinel_host': 'localhost', 'sentinel_port': 123, 'masters': 'mymaster'})
+    host, port, password, username, socket_timeout, ssl_kwargs = c._load_config(
+        {'sentinel_host': 'localhost', 'sentinel_port': 123, 'masters': 'mymaster'}
+    )
     assert host == 'localhost'
     assert port == 123
     assert password is None
+    assert username is None
+    assert socket_timeout == 5
+    assert ssl_kwargs == {}
 
     # Expect to pass when port is an integer, with password defined.
-    host, port, password = c._load_config(
+    host, port, password, username, socket_timeout, ssl_kwargs = c._load_config(
         {'sentinel_host': 'localhost', 'sentinel_port': 123, 'masters': 'mymaster', 'sentinel_password': 'password1'}
     )
     assert host == 'localhost'
     assert port == 123
     assert password == 'password1'
+    assert username is None
+    assert ssl_kwargs == {}
+
+
+@pytest.mark.unit
+def test_load_config_username():
+    c = RedisSentinelCheck('redis_sentinel', {}, {})
+
+    host, port, password, username, socket_timeout, ssl_kwargs = c._load_config(
+        {
+            'sentinel_host': 'localhost',
+            'sentinel_port': 123,
+            'masters': 'mymaster',
+            'sentinel_password': 'password1',
+            'sentinel_username': 'myuser',
+        }
+    )
+    assert username == 'myuser'
+    assert password == 'password1'
+
+
+@pytest.mark.unit
+def test_load_config_ssl():
+    c = RedisSentinelCheck('redis_sentinel', {}, {})
+
+    # SSL disabled by default
+    _, _, _, _, _, ssl_kwargs = c._load_config(
+        {'sentinel_host': 'localhost', 'sentinel_port': 123, 'masters': 'mymaster'}
+    )
+    assert ssl_kwargs == {}
+
+    # SSL enabled with all options
+    _, _, _, _, _, ssl_kwargs = c._load_config(
+        {
+            'sentinel_host': 'localhost',
+            'sentinel_port': 123,
+            'masters': 'mymaster',
+            'ssl': True,
+            'ssl_certfile': '/path/to/cert.pem',
+            'ssl_keyfile': '/path/to/key.pem',
+            'ssl_ca_certs': '/path/to/ca.pem',
+            'ssl_cert_reqs': 2,
+        }
+    )
+    assert ssl_kwargs == {
+        'ssl': True,
+        'ssl_certfile': '/path/to/cert.pem',
+        'ssl_keyfile': '/path/to/key.pem',
+        'ssl_ca_certs': '/path/to/ca.pem',
+        'ssl_cert_reqs': 2,
+    }
+
+    # SSL enabled with minimal options
+    _, _, _, _, _, ssl_kwargs = c._load_config(
+        {'sentinel_host': 'localhost', 'sentinel_port': 123, 'masters': 'mymaster', 'ssl': True}
+    )
+    assert ssl_kwargs == {'ssl': True}
+
+
+@pytest.mark.unit
+def test_load_config_socket_timeout():
+    c = RedisSentinelCheck('redis_sentinel', {}, {})
+
+    _, _, _, _, socket_timeout, _ = c._load_config(
+        {'sentinel_host': 'localhost', 'sentinel_port': 123, 'masters': 'mymaster', 'socket_timeout': 10}
+    )
+    assert socket_timeout == 10
 
 
 @pytest.mark.integration
@@ -92,7 +164,7 @@ def test_down_slaves(aggregator, instance):
     for _ in range(7):
         sentinel_slaves.append({'is_odown': False, 'is_sdown': True})
 
-    with mock.patch('redis.StrictRedis.sentinel_slaves', return_value=sentinel_slaves):
+    with mock.patch.object(check, '_get_sentinel_replicas', return_value=sentinel_slaves):
         check.check(instance)
 
         aggregator.assert_metric('redis.sentinel.odown_slaves', 5)