redis_sentinel: Add SSL/TLS, username/ACL, and Redis 7+ replica support

[ian28223]

Summary

Modernizes the Redis Sentinel check to support TLS-enabled deployments and Redis 6+ ACLs.

Supersedes #2939 (opened by @amendez-primer, auto-closed for inactivity after CI kept failing). Same change set, with the CI failures fixed and review feedback addressed:

• Formatting: ran ddev test --fmt redis_sentinel with the current ddev version, which the original review asked for but the PR never got an updated pass on.
• Dependency validation: ddev validate dep rejects unstable >= pins. The redis dependency is now pinned exactly (redis==7.3.0, matching redisdb in integrations-core) instead of redis>=4.5.0.
• Minimum base package floor: bumped datadog-checks-base from >=4.2.0 to >=37.10.0. The old floor imports six.moves, which isn't declared as a hard dependency, and its [deps] extra pins an old ddtrace with no cp313 wheel — both broke the "minimum base package" CI job on unmodified master too, unrelated to this PR's changes.
• _get_sentinel_replicas() removed: a reviewer caught that redis.StrictRedis never had a sentinel_replicas method in any released version, so the hasattr() check was always False and this always fell through to sentinel_slaves() — dead code with an inaccurate description (see below).
• ssl_check_hostname added: a reviewer caught that redis-py defaults hostname verification to True and only disables it when ssl_cert_reqs is CERT_NONE, so a sentinel reached by IP with a hostname-mismatched cert had no escape short of disabling certificate verification entirely. Matches redisdb's existing option.

Fixes #2938, #2395

Changes

1. SSL/TLS support (#2938)

The check previously created redis.StrictRedis connections without any SSL parameters, making it impossible to connect to TLS-enabled Sentinel instances (e.g. AWS ElastiCache, Azure Cache for Redis).

Added support for: ssl, ssl_certfile, ssl_keyfile, ssl_ca_certs, ssl_cert_reqs, ssl_check_hostname — matching the core redisdb integration.

2. Username / ACL support (#2395)

Redis 6+ introduced ACLs requiring a username parameter. Without it, AUTH fails with: AUTH <password> called without any password configured for the default user.

Added sentinel_username instance config option, passed through to StrictRedis(username=...).

3. Socket timeout

Added socket_timeout config option (default: 5s) to prevent the check from hanging indefinitely on unreachable sentinels.

Note: an earlier revision of this PR also claimed a Redis 7+ SENTINEL REPLICAS fallback (#1586). That code path was dead (see above) and the underlying premise didn't hold up either — SENTINEL SLAVES is still a live alias for SENTINEL REPLICAS in current Redis, not a removed subcommand — so it's been dropped rather than reimplemented.

Files changed

File	Change
redis_sentinel.py	SSL, username, timeout params in _load_config()
conf.yaml.example	Documented all new config options
test_redis_sentinel.py	Tests for SSL, username, timeout config
pyproject.toml	Bumped redis dep to ==7.3.0 (pinned, matches redisdb); bumped datadog-checks-base floor to >=37.10.0
__about__.py / CHANGELOG.md	Bumped to 1.2.0

Backward compatibility

• All new options are optional with sensible defaults
• Without ssl: true, behavior is identical to before

Test plan

• ddev test --lint redis_sentinel passes (ruff format + check)
• ddev test redis_sentinel -- -m unit passes (4/4 unit tests)
• CI: lint, unit/integration tests, and minimum-base-package job all green
• Integration tests (ddev test redis_sentinel) — pass locally except for an arm64/amd64 emulation issue with the erichsu/redis-sentinel test image unrelated to this change; CI runs on amd64 and is green

🤖 Generated with Claude Code

[datadog-datadog-prod-us1]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 87.56% (+2.48%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f8c911b | Docs | Datadog PR Page | Give us feedback!}

[ian28223]

Thanks for the thorough review — I verified all four points against redis-py 7.3.0 source directly and they all held up:

1. ssl_check_hostname — confirmed SSLConnection.__init__ sets self.check_hostname = ssl_check_hostname if self.cert_reqs != ssl.CERT_NONE else False, so it stays True by default at CERT_REQUIRED/CERT_OPTIONAL. Added the passthrough + conf.yaml.example entry, matching redisdb.
2. Version bump / CHANGELOG — bumped to 1.2.0 and added the changelog entry.
3. _get_sentinel_replicas() — confirmed hasattr(redis.StrictRedis, 'sentinel_replicas') is False on 7.3.0 (no such method anywhere in redis.commands.sentinel.SentinelCommands), so it was dead code. Removed the helper, restored the direct sentinel_slaves() call, and dropped the inaccurate Redis 7+/Redis sentinel integration needs an update because of removed SLAVES command #1586 claim from the description.
4. Test mock — reverted to mock.patch('redis.StrictRedis.sentinel_slaves', ...) now that the helper's gone.

Pushed in f8c911b. Lint and unit tests pass locally.