redis_sentinel: Add SSL/TLS, username/ACL, and Redis 7+ replica support

[amendez-primer]

Summary

Modernizes the Redis Sentinel check to support TLS-enabled deployments, Redis 6+ ACLs, and Redis 7+ command changes.

Fixes #2938, #2395, #1586

Changes

1. SSL/TLS support (#2938)

The check previously created redis.StrictRedis connections without any SSL parameters, making it impossible to connect to TLS-enabled Sentinel instances (e.g. AWS ElastiCache, Azure Cache for Redis).

Added support for: ssl, ssl_certfile, ssl_keyfile, ssl_ca_certs, ssl_cert_reqs — matching the core redisdb integration.

2. Username / ACL support (#2395)

Redis 6+ introduced ACLs requiring a username parameter. Without it, AUTH fails with: AUTH <password> called without any password configured for the default user.

Added sentinel_username instance config option, passed through to StrictRedis(username=...).

3. Redis 7+ REPLICAS command (#1586)

Redis 7 removed the SENTINEL SLAVES subcommand in favor of SENTINEL REPLICAS. The check now uses sentinel_replicas() (redis-py 4.2+) with a fallback to sentinel_slaves() for older Redis versions.

4. Socket timeout

Added socket_timeout config option (default: 5s) to prevent the check from hanging indefinitely on unreachable sentinels.

Files changed

File	Change
redis_sentinel.py	SSL, username, timeout params in _load_config(); _get_sentinel_replicas() helper
conf.yaml.example	Documented all new config options
test_redis_sentinel.py	Tests for SSL, username, timeout config; updated mock for replicas
pyproject.toml	Bumped redis dep from 2.10.5 to >=4.5.0

Example config (Helm)

datadog:
  confd:
    redis_sentinel.yaml: |-
      instances:
        - sentinel_host: sentinel.example.com
          sentinel_port: 26379
          sentinel_username: default
          sentinel_password: secret
          ssl: true
          ssl_ca_certs: /etc/ssl/certs/ca.pem
          ssl_certfile: /etc/ssl/certs/client.pem
          ssl_keyfile: /etc/ssl/certs/client-key.pem
          socket_timeout: 10
          masters:
            - mymaster

Backward compatibility

• All new options are optional with sensible defaults
• Without ssl: true, behavior is identical to before
• _get_sentinel_replicas() falls back to sentinel_slaves() if sentinel_replicas() is unavailable

[lucia-sb]

Hi! Could you run ddev test --fmt to fix the linting failures?
Thanks!!

[lucia-sb]

@amendez-primer Could you make sure you’re using the latest version of ddev (14.4.0) when running the command? The formatting requirements can sometimes change between versions