[FSSDK-11923] Add redis-streams **DO NOT MERGE - IT'S PRE-RELASE FROM FEATURE BRANCH**

.github/workflows/agent.yml

@@ -50,6 +50,10 @@ jobs:
       with:
         go-version: '1.24.0'
         check-latest: true
+    - name: Start Redis
+      uses: supercharge/redis-github-action@1.5.0
+      with:
+        redis-version: 6
     - name: coveralls
       id: coveralls
       run: |
@@ -111,7 +115,7 @@ jobs:
     - name: Start Redis
       uses: supercharge/redis-github-action@1.5.0
       with:
-        redis-version: 4
+        redis-version: 6
     - name: acceptance test
       run: |
         make -e setup build

CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## [4.3.0-beta.1] - October 6, 2025
+
+### New Features (Beta)
+
+* **Redis Streams for Persistent Notification Delivery** ([#444](https://github.com/optimizely/agent/pull/444)): Added Redis Streams implementation as an alternative to Redis Pub/Sub for notification synchronization across Agent nodes. Redis Streams provides:
+  - Persistent message delivery with acknowledgment
+  - Automatic retries with exponential backoff
+  - Consumer groups for load balancing
+  - Configurable batching and flush intervals
+  - Connection error recovery with reconnection logic
+  - Comprehensive metrics tracking
+
+  Configure via `synchronization.notification.default: "redis-streams"` in config.yaml. See documentation for configuration options including batch_size, flush_interval, max_retries, and connection_timeout.
+
+### Fixed
+
+* Fixed flexible Redis password configuration to support auth_token, redis_secret, and password fields with environment variable fallback ([#444](https://github.com/optimizely/agent/pull/444))
+
 ## [4.2.1] - September 3, 2025
 
 ### Fixed

config.yaml

@@ -82,10 +82,10 @@ server:
         - localhost
     ## the maximum duration for reading the entire request, including the body.
     ## Value can be set in seconds (e.g. "5s") or milliseconds (e.g. "5000ms")
-    readTimeout: 5s
+    readTimeout: 300s
     ## the maximum duration before timing out writes of the response.
     ## Value can be set in seconds (e.g. "5s") or milliseconds (e.g. "5000ms")
-    writeTimeout: 10s
+    writeTimeout: 300s
     ## path for the health status api
     healthCheckPath: "/health"
     ## the location of the TLS key file
@@ -103,11 +103,11 @@ server:
 ##
 api:
     ## the maximum number of concurrent requests handled by the api listener
-#    maxConns: 10000
+    maxConns: 10000
     ## http listener port
     port: "8080"
     ## set to true to enable subscribing to notifications via an SSE event-stream
-    enableNotifications: false
+    enableNotifications: true
     ## set to true to be able to override experiment bucketing. (recommended false in production)
     enableOverrides: true
     ## CORS support is provided via chi middleware
@@ -185,9 +185,13 @@ client:
         # in-memory: 
         #   capacity: 0
         #   storageStrategy: "fifo"
-        # redis: 
+        # redis:
         #   host: "localhost:6379"
-        #   password: ""
+        #   ## Use auth_token or redis_secret instead of password to avoid security scanning alerts
+        #   ## Supports: auth_token, redis_secret, password (in order of preference)
+        #   ## Fallback: REDIS_UPS_PASSWORD environment variable if config field is empty
+        #   auth_token: ""      # Recommended (avoids security scanners)
+        #   # password: ""      # Also supported for backwards compatibility
         #   database: 0
         # rest: 
         #   host: "http://localhost"
@@ -198,7 +202,7 @@ client:
         #   userIDKey: "user_id"
         #   async: false
         #   headers: 
-        #     Content-Type: "application/json"
+        #     Content-Type: "application/json" 
         #     Auth-Token: "12345"
     odp:
       ## Disable odp
@@ -216,9 +220,13 @@ client:
           in-memory: 
             size: 10000
             timeout: 600s
-        #   redis: 
+        #   redis:
         #     host: "localhost:6379"
-        #     password: ""
+        #     ## Use auth_token or redis_secret instead of password to avoid security scanning alerts
+        #     ## Supports: auth_token, redis_secret, password (in order of preference)
+        #     ## Fallback: REDIS_ODP_PASSWORD environment variable if config field is empty
+        #     auth_token: ""      # Recommended (avoids security scanners)
+        #     # password: ""      # Also supported for backwards compatibility
         #     database: 0
         #     timeout: 0s
 
@@ -249,23 +257,45 @@ runtime:
 synchronization:
     pubsub:
         redis:
-            host: "redis.demo.svc:6379"
-            password: ""
+            host: "localhost:6379"
+            ## Use auth_token or redis_secret instead of password to avoid security scanning alerts
+            ## Supports: auth_token, redis_secret, password (in order of preference)
+            ## Fallback: REDIS_PASSWORD environment variable if config field is empty
+            auth_token: ""
             database: 0
             ## channel: "optimizely-sync"  # Base channel name (NOT currently parsed - uses hardcoded default)
             ## Agent publishes to channels: "optimizely-sync-{sdk_key}"
             ## For external Redis clients: Subscribe "optimizely-sync-{sdk_key}" or PSubscribe "optimizely-sync-*"
             ## Note: Channel configuration parsing is a known bug - planned for future release
+
+            ## Redis Streams configuration (when using Redis Streams for notifications)
+            ## batch_size: number of messages to batch before sending (default: 10)
+            batch_size: 5
+            ## flush_interval: maximum time to wait before sending a partial batch (default: 5s)
+            flush_interval: 2s
+            ## max_retries: maximum number of retry attempts for failed operations (default: 3)
+            max_retries: 3
+            ## retry_delay: initial delay between retry attempts (default: 100ms)
+            retry_delay: 100ms
+            ## max_retry_delay: maximum delay between retry attempts with exponential backoff (default: 5s)
+            max_retry_delay: 5s
+            ## connection_timeout: timeout for Redis connections (default: 10s)
+            connection_timeout: 10s
     ## if notification synchronization is enabled, then the active notification event-stream API
     ## will get the notifications from available replicas
     notification:
-        enable: false
-        default: "redis"
+        enable: true
+        ## Use "redis" for fire-and-forget pub/sub (existing behavior)
+        ## Use "redis-streams" for persistent message delivery with retries and acknowledgment
+        default: "redis-streams"
     ## if datafile synchronization is enabled, then for each webhook API call
     ## the datafile will be sent to all available replicas to achieve better eventual consistency
     datafile:
         enable: false
+        ## Use "redis" for fire-and-forget pub/sub (existing behavior)
+        ## Use "redis-streams" for persistent message delivery with retries and acknowledgment
         default: "redis"
+        # default: "redis-streams"  # Uncomment to enable Redis Streams
 
 ##
 ## cmab: Contextual Multi-Armed Bandit configuration