Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Greptile Summary

This PR consolidates duplicated Redis connection branching in cache_backends.py and cache_utils.py into the shared create_redis_client() factory in unstract-core, while also adding TLS support to that factory so it is not dropped during consolidation.

Key changes:

• _resolve_redis_env() now reads TLS-related env vars and populates them in the returned env dict.
• _build_connection_kwargs() forwards TLS fields when TLS is active, centralising that logic.
• _create_standalone_client() now delegates fully to _build_connection_kwargs() instead of building its own kwargs dict, removing the locally-duplicated TLS handling.
• RedisClient.__init__() is removed; the class can only be instantiated via RedisClient.from_env() or the __new__() pattern used by cache_backends.py. No callers of the old constructor were found in the codebase.
• Both worker cache modules (RedisCacheBackend and WorkerCacheManager) drop the if/else Sentinel branches and call create_redis_client() directly.

Issue found:

• _create_sentinel_client() builds sentinel_kwargs using the include_auth_only branch of _build_connection_kwargs, which skips the newly added TLS fields. Master connections are secured correctly via master_kwargs, but the Sentinel discovery connections carry no TLS parameters. In a cluster where Sentinel servers themselves require TLS, discovery will fail at the handshake step. See the inline comment on redis_client.py line 223.

Confidence Score: 3/5

• Safe to merge for standard (non-TLS Sentinel) deployments; TLS-protected Sentinel clusters will have broken discovery when SSL is enabled.
• The DRY refactoring is clean and correct for both standalone mode and standard Sentinel mode. The SSL addition is correct for standalone and for Sentinel master connections. However, the include_auth_only path in _build_connection_kwargs does not propagate SSL to Sentinel discovery connections, meaning any deployment that enables CACHE_REDIS_SSL=true with Sentinel mode will fail to connect to TLS-protected Sentinel servers. This is a logic gap directly introduced by this PR's SSL changes, warranting a score of 3 rather than 4-5.
• unstract/core/src/unstract/core/cache/redis_client.py — specifically the _build_connection_kwargs include_auth_only branch and _create_sentinel_client

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["create_redis_client(env_prefix)"] --> B{Sentinel mode?}
    B -- yes --> C["_create_sentinel_client()"]
    B -- no --> D["_create_standalone_client()"]

    D --> E["_resolve_redis_env()\nreads host, port, auth,\ndb, tls settings"]
    E --> F["_build_connection_kwargs()\nnormal path\ntls params included"]
    F --> G{max_connections?}
    G -- yes --> H["ConnectionPool + redis.Redis"]
    G -- no --> I["redis.Redis(kwargs)"]

    C --> J["_resolve_redis_env()\nreads host, port, auth,\ndb, tls settings"]
    J --> K["_build_connection_kwargs()\nauth-only path\ntls params SKIPPED\nsentinel_kwargs"]
    J --> L["_build_connection_kwargs()\nnormal path\ntls params included\nmaster_kwargs"]
    K --> M["Sentinel(sentinels, sentinel_kwargs)"]
    L --> M
    M --> N["sentinel.master_for\nmaster_kwargs"]

This is a comment left during a code review.
Path: unstract/core/src/unstract/core/cache/redis_client.py
Line: 223-229

Comment:
**SSL not forwarded to Sentinel discovery**

The `sentinel_kwargs` dict is assembled via the `include_auth_only` code path, which returns before the SSL block added in `_build_connection_kwargs` (lines 162–164) is reached. Only `master_kwargs` ends up carrying the SSL fields.

This means that when the `{prefix}SSL` env var is enabled and Sentinel servers are themselves TLS-protected, the discovery step will fail at the handshake — even though master connections are correctly secured.

To close the gap, the `include_auth_only` branch inside `_build_connection_kwargs` should also forward the `ssl` / `ssl_cert_reqs` fields from the `env` dict before returning.

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: 67676a0}

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud