Auto-discovery mechanism for Valkey and selective cluster monitoring by tag

[barryib]

Description

Is there interest in implementing an auto-discovery mechanism for Valkey databases similar to the one available for RDS? Additionally, could there be support for automatically start monitoring of only those clusters that have a defined tag (for example), instead of discovering all available instances? This would help reduce the operational burden, providing more precise and efficient monitoring onboarding.

Suggested solution

Add a Valkey discovery mechanism, analogous to RDS discovery, to automatically find eligible Valkey clusters. Incorporate filtering logic to allow for onboarding only clusters that match user-specified tags, so monitoring can be targeted and not indiscriminately apply to all instances.

Additional context

Currently, onboarding Valkey for monitoring may require manual intervention or broad discovery with limited control. Filtering by cluster tag would align with practices common in cloud environments and streamline operations.

Code of Conduct

• I agree to follow this project's Code of Conduct

[martinrvisser]

Thanks for the issue. How would authentication work in this scenario?

[barryib]

Thanks for the question! Authentication works at two layers:

1. AWS API (discovery)
PMM uses the default AWS credential chain (IRSA on EKS, env vars, or ~/.aws) to call DescribeReplicationGroups and ListTagsForResource. No extra config needed beyond granting the IAM identity those two permissions.

2. Valkey/Redis connection (monitoring)
The current PR (#5303) skips clusters with AUTH tokens or ACL user groups — only unauthenticated clusters are discovered for now. A follow-up PR would add credential support via a two-tier approach:

• Per-cluster: add a pmm_secret_arn tag on the ElastiCache cluster pointing to an AWS Secrets Manager secret {"username": "monitoring", "password": "..."}. The reconciler already calls ListTagsForResource per cluster, so it just needs to fetch the secret when this tag is present (one new IAM permission: secretsmanager:GetSecretValue).
• Global fallback: configure a shared monitoring username/password in PMM settings for environments where all clusters use the same credentials.

Note on IAM authentication
ElastiCache does support IAM-based authentication for Redis OSS 7.0+ and Valkey 7.2+ (short-lived tokens generated via the AWS SDK, no stored credentials needed). This is not in scope for now, but is a natural extension once the Secrets Manager path is in place.

cc @angelvilardellperez