Add redis_sentinel SSL connection options

redis_sentinel/datadog_checks/redis_sentinel/data/conf.yaml.example

@@ -17,6 +17,28 @@ instances:
     #
     # sentinel_password: <password>
 
+    ## @param sentinel_ssl - boolean - optional - default: false
+    ## Enable SSL connection to the Sentinel host
+    #
+    # sentinel_ssl: false
+
+    ## @param sentinel_ssl_keyfile - string - optional
+    ## Path to SSL key file for Sentinel SSL connection
+    #
+    # sentinel_ssl_keyfile: <PRIVATE_KEY_PATH>
+
+
+    ## @param sentinel_ssl_certfile - string - optional
+    ## Path to SSL cert file for Sentinel SSL connection
+    #
+    # sentinel_ssl_certfile: <CERT_PATH>
+
+
+    ## @param sentinel_ssl_ca_certs - string - optional
+    ## Path to SSL CA cert file for Sentinel SSL connection
+    #
+    # sentinel_ssl_ca_certs: <CA_CERT_PATH>
+
     ## @param masters - list of strings - required
     ## List of masters name to collect data from
     #

redis_sentinel/datadog_checks/redis_sentinel/redis_sentinel.py

@@ -25,13 +25,27 @@ def _load_config(self, instance):
 
         passwd = instance.get('sentinel_password', None)
 
-        return host, port, passwd
+        ssl = instance.get('sentinel_ssl', False)
+        ssl_keyfile = instance.get('sentinel_ssl_keyfile', None)
+        ssl_certfile = instance.get('sentinel_ssl_certfile', None)
+        ssl_ca_certs = instance.get('sentinel_ssl_ca_certs', None)
 
-    def check(self, instance):
+        return host, port, passwd, ssl, ssl_keyfile, ssl_certfile, ssl_ca_certs
 
-        host, port, password = self._load_config(instance)
+    def check(self, instance):
 
-        redis_conn = redis.StrictRedis(host=host, port=port, password=password, db=0)
+        host, port, password, ssl, ssl_keyfile, ssl_certfile, ssl_ca_certs = self._load_config(instance)
+
+        redis_conn = redis.StrictRedis(
+            host=host,
+            port=port,
+            password=password,
+            ssl=ssl,
+            ssl_keyfile=ssl_keyfile,
+            ssl_certfile=ssl_certfile,
+            ssl_ca_certs=ssl_ca_certs,
+            db=0,
+        )
 
         for master_name in instance['masters']:
             base_tags = ['redis_name:%s' % master_name] + instance.get('tags', [])

redis_sentinel/tests/conftest.py

@@ -11,7 +11,7 @@
 
 @pytest.fixture(scope='session')
 def dd_environment():
-    with docker_run(os.path.join(DOCKER_DIR, 'docker-compose.yml'), log_patterns='Synchronization with slave'):
+    with docker_run(os.path.join(DOCKER_DIR, 'docker-compose.yml'), log_patterns='Synchronization with replica'):
         yield
 
 

redis_sentinel/tests/docker/docker-compose.yml

@@ -1,21 +1,15 @@
-version: '3'
-
 services:
-  master:
-    image: redis:3
-  slave:
-    image: redis:3
+  redis-master:
+    image: redis:7.4
+  redis-slave:
+    image: redis:7.4
     command: redis-server --slaveof redis-master 6379
-    links:
-      - master:redis-master
-  sentinel:
-    image: "erichsu/redis-sentinel:latest"
+  redis-sentinel:
+    image: bitnami/redis-sentinel:7.4
     environment:
+      - REDIS_MASTER_HOST=redis-master
       - SENTINEL_DOWN_AFTER=5000
       - SENTINEL_FAILOVER=5000
-    links:
-      - master:redis-master
-      - slave
     ports:
       - "26379:26379"
       - "6379:6379"

redis_sentinel/tests/test_redis_sentinel.py

@@ -45,19 +45,54 @@ def test_load_config():
     with pytest.raises(ConfigurationError):
         c._load_config({'sentinel_host': 'localhost', 'sentinel_port': 'port'})
 
-    # Expect to pass when port is an integer, with no password defined.
-    host, port, password = c._load_config({'sentinel_host': 'localhost', 'sentinel_port': 123, 'masters': 'mymaster'})
+    # When sentinel_ssl is a string
+    with pytest.raises(ConfigurationError):
+        c._load_config({'sentinel_host': 'localhost', 'sentinel_port': 'port', 'sentinel_ssl': 'true'})
+
+    # Expect to pass when port is an integer, with no password defined and ssl disabled.
+    host, port, password, ssl, ssl_keyfile, ssl_certfile, ssl_ca_certs = c._load_config(
+        {'sentinel_host': 'localhost', 'sentinel_port': 123, 'masters': 'mymaster'}
+    )
     assert host == 'localhost'
     assert port == 123
     assert password is None
+    assert ssl is False
+    assert ssl_keyfile is None
+    assert ssl_certfile is None
+    assert ssl_ca_certs is None
 
-    # Expect to pass when port is an integer, with password defined.
-    host, port, password = c._load_config(
+    # Expect to pass when port is an integer, with password defined and ssl disabled.
+    host, port, password, ssl, ssl_keyfile, ssl_certfile, ssl_ca_certs = c._load_config(
         {'sentinel_host': 'localhost', 'sentinel_port': 123, 'masters': 'mymaster', 'sentinel_password': 'password1'}
     )
     assert host == 'localhost'
     assert port == 123
     assert password == 'password1'
+    assert ssl is False
+    assert ssl_keyfile is None
+    assert ssl_certfile is None
+    assert ssl_ca_certs is None
+
+    # Expect to pass when ssl defined.
+    host, port, password, ssl, ssl_keyfile, ssl_certfile, ssl_ca_certs = c._load_config(
+        {
+            "sentinel_host": "localhost",
+            "sentinel_port": 123,
+            "masters": "mymaster",
+            "sentinel_password": "password1",
+            "sentinel_ssl": True,
+            "sentinel_ssl_keyfile": "/etc/certs/redis.key",
+            "sentinel_ssl_certfile": "/etc/certs/redis.crt",
+            "sentinel_ssl_ca_certs": "/etc/certs/ca.crt",
+        }
+    )
+    assert host == "localhost"
+    assert port == 123
+    assert password == "password1"
+    assert ssl is True
+    assert ssl_keyfile == "/etc/certs/redis.key"
+    assert ssl_certfile == "/etc/certs/redis.crt"
+    assert ssl_ca_certs == "/etc/certs/ca.crt"
 
 
 @pytest.mark.integration