Add experimental filtered IoT Agent installer

.gitignore

@@ -6,6 +6,7 @@ install_script.sh
 install_script_docker_injection.sh
 install_script_agent6.sh
 install_script_agent7.sh
+install_script_agent7_iot.sh
 .vscode/launch.json
 .vscode/settings.json
 .idea/*

.gitlab-ci.yml

@@ -46,12 +46,14 @@ generate-scripts:
   stage: generate
   script:
     - make
+    - ./test/generated-script-test.sh
   artifacts:
     expire_in: 2 weeks
     paths:
       - install_script.sh
       - install_script_agent6.sh
       - install_script_agent7.sh
+      - install_script_agent7_iot.sh
       - install_script_docker_injection.sh
       - install_script_op_worker1.sh
       - install_script_op_worker2.sh
@@ -93,6 +95,7 @@ unit_tests:
     - DD_API_KEY=123 DD_SITE="datadoghq.com" DD_INSTALL_ONLY=true bash -c "$(curl -L https://s3.amazonaws.com/dd-agent/scripts/install_script_agent7.sh)"
     - python3 unit_tests/extract_functions.py
     - ./unit_tests/test_install_script.sh
+    - ./unit_tests/test_iot_deb_orchestration.sh
 
 .test:
   image: registry.ddbuild.io/images/${IMAGE}
@@ -185,6 +188,23 @@ test:
     paths:
       - artifacts/
 
+test_iot_filtered_ubuntu_22_04:
+  extends: .test
+  variables:
+    IMAGE: mirror/ubuntu:22.04
+    MAJOR_VERSION: 7
+    SCRIPT: install_script_agent7_iot.sh
+
+test_iot_filtered_debian_12_pinned:
+  extends: .test
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push"'
+  variables:
+    IMAGE: mirror/debian:12.1
+    MAJOR_VERSION: 7
+    DD_AGENT_MINOR_VERSION: 82
+    SCRIPT: install_script_agent7_iot.sh
+
 # These tests should not be launched on pipelines triggered by datadog-agent pipelines, but in the future we will trigger
 # them from the `6.53.x` branch of the datadog-agent repo
 test_agent6:

CHANGELOG.rst

@@ -5,6 +5,8 @@ Release Notes
 Unreleased
 ================
 
+- Add an experimental Debian/Ubuntu installer for a filesystem-filtered IoT Agent profile.
+
 1.46.0
 ================
 

Makefile

@@ -1,7 +1,7 @@
-all: install_script.sh install_script_agent6.sh install_script_agent7.sh install_script_docker_injection.sh
+all: install_script.sh install_script_agent6.sh install_script_agent7.sh install_script_agent7_iot.sh install_script_docker_injection.sh
 
 clean:
-	rm -f install_script.sh install_script_agent6.sh install_script_agent7.sh install_script_docker_injection.sh
+	rm -f install_script.sh install_script_agent6.sh install_script_agent7.sh install_script_agent7_iot.sh install_script_docker_injection.sh
 
 define DEPRECATION_MESSAGE
 \n\
@@ -20,49 +20,78 @@ endif
 
 CUR_VERSION:=$(shell awk -F "=" '/^install_script_version=/{print $$NF}' install_script.sh.template)
 
+STRIP_FILTERED_IOT_ONLY = -e '/BEGIN GENERATED FILTERED IOT ONLY/,/END GENERATED FILTERED IOT ONLY/d'
+STRIP_FILTERED_IOT_ONLY_MARKERS = -e '/BEGIN GENERATED FILTERED IOT ONLY/d' -e '/END GENERATED FILTERED IOT ONLY/d'
+
 install_script.sh: install_script.sh.template
 	export DEPRECATION_MESSAGE
 	sed -e 's|AGENT_MAJOR_VERSION_PLACEHOLDER|6|' \
 		-e 's|INSTALL_SCRIPT_REPORT_VERSION_PLACEHOLDER|Agent|' \
 		-e 's|INSTALL_INFO_VERSION_PLACEHOLDER||' \
 		-e 's|IS_LEGACY_SCRIPT_PLACEHOLDER|true|' \
+		-e 's|IOT_FILTERED_INSTALL_PLACEHOLDER|false|' \
+		-e 's|DD_INFRASTRUCTURE_MODE_APT_PLACEHOLDER||' \
+		-e 's|IOT_APT_FAILURE_PLACEHOLDER||' \
 		-e 's|DD_APM_INSTRUMENTATION_ENABLED_DOCKER_PLACEHOLDER||' \
 		-e 's|APM_TELEMETRY_SAFE_AGENT_VERSION_OVERRIDE_PLACEHOLDER||' \
 		-e 's|DEPRECATION_MESSAGE_PLACEHOLDER|echo -e "\\033[33m${DEPRECATION_MESSAGE}\\033[0m"|' \
-		install_script.sh.template > $@
+		$(STRIP_FILTERED_IOT_ONLY) install_script.sh.template > $@
 	chmod +x $@
 
 install_script_agent6.sh: install_script.sh.template
 	sed -e 's|AGENT_MAJOR_VERSION_PLACEHOLDER|6|' \
 		-e 's|INSTALL_SCRIPT_REPORT_VERSION_PLACEHOLDER|Agent 6|' \
 		-e 's|INSTALL_INFO_VERSION_PLACEHOLDER|_agent6|' \
 		-e 's|IS_LEGACY_SCRIPT_PLACEHOLDER||' \
+		-e 's|IOT_FILTERED_INSTALL_PLACEHOLDER|false|' \
+		-e 's|DD_INFRASTRUCTURE_MODE_APT_PLACEHOLDER||' \
+		-e 's|IOT_APT_FAILURE_PLACEHOLDER||' \
 		-e 's|DD_APM_INSTRUMENTATION_ENABLED_DOCKER_PLACEHOLDER||' \
 		-e 's|APM_TELEMETRY_SAFE_AGENT_VERSION_OVERRIDE_PLACEHOLDER||' \
 		-e 's|DEPRECATION_MESSAGE_PLACEHOLDER||' \
-		install_script.sh.template > $@
+		$(STRIP_FILTERED_IOT_ONLY) install_script.sh.template > $@
 	chmod +x $@
 
 install_script_agent7.sh: install_script.sh.template
 	sed -e 's|AGENT_MAJOR_VERSION_PLACEHOLDER|7|' \
 		-e 's|INSTALL_SCRIPT_REPORT_VERSION_PLACEHOLDER|Agent 7|' \
 		-e 's|INSTALL_INFO_VERSION_PLACEHOLDER|_agent7|' \
 		-e 's|IS_LEGACY_SCRIPT_PLACEHOLDER||' \
+		-e 's|IOT_FILTERED_INSTALL_PLACEHOLDER|false|' \
+		-e 's|DD_INFRASTRUCTURE_MODE_APT_PLACEHOLDER||' \
+		-e 's|IOT_APT_FAILURE_PLACEHOLDER||' \
+		-e 's|DD_APM_INSTRUMENTATION_ENABLED_DOCKER_PLACEHOLDER||' \
+		-e 's|APM_TELEMETRY_SAFE_AGENT_VERSION_OVERRIDE_PLACEHOLDER||' \
+		-e 's|DEPRECATION_MESSAGE_PLACEHOLDER||' \
+		$(STRIP_FILTERED_IOT_ONLY) install_script.sh.template > $@
+	chmod +x $@
+
+install_script_agent7_iot.sh: install_script.sh.template
+	sed -e 's|AGENT_MAJOR_VERSION_PLACEHOLDER|7|' \
+		-e 's|INSTALL_SCRIPT_REPORT_VERSION_PLACEHOLDER|Agent 7 IoT Filtered|' \
+		-e 's|INSTALL_INFO_VERSION_PLACEHOLDER|_agent7_iot|' \
+		-e 's|IS_LEGACY_SCRIPT_PLACEHOLDER||' \
+		-e 's|IOT_FILTERED_INSTALL_PLACEHOLDER|true|' \
+		-e "s|DD_INFRASTRUCTURE_MODE_APT_PLACEHOLDER|DD_INFRASTRUCTURE_MODE='iot' |" \
+		-e 's~IOT_APT_FAILURE_PLACEHOLDER~ || iot_apt_exit_code=$$?~' \
 		-e 's|DD_APM_INSTRUMENTATION_ENABLED_DOCKER_PLACEHOLDER||' \
 		-e 's|APM_TELEMETRY_SAFE_AGENT_VERSION_OVERRIDE_PLACEHOLDER||' \
 		-e 's|DEPRECATION_MESSAGE_PLACEHOLDER||' \
-		install_script.sh.template > $@
+		$(STRIP_FILTERED_IOT_ONLY_MARKERS) install_script.sh.template > $@
 	chmod +x $@
 
 install_script_docker_injection.sh: install_script.sh.template
 	sed -e 's|AGENT_MAJOR_VERSION_PLACEHOLDER|7|' \
 		-e 's|INSTALL_SCRIPT_REPORT_VERSION_PLACEHOLDER|Docker Injection|' \
 		-e 's|INSTALL_INFO_VERSION_PLACEHOLDER|_docker_injection|' \
 		-e 's|IS_LEGACY_SCRIPT_PLACEHOLDER||' \
+		-e 's|IOT_FILTERED_INSTALL_PLACEHOLDER|false|' \
+		-e 's|DD_INFRASTRUCTURE_MODE_APT_PLACEHOLDER||' \
+		-e 's|IOT_APT_FAILURE_PLACEHOLDER||' \
 		-e 's|DD_APM_INSTRUMENTATION_ENABLED_DOCKER_PLACEHOLDER|export DD_APM_INSTRUMENTATION_ENABLED="docker"|' \
 		-e 's|APM_TELEMETRY_SAFE_AGENT_VERSION_OVERRIDE_PLACEHOLDER|safe_agent_version=noagent_autoinstrumentation|' \
 		-e 's|DEPRECATION_MESSAGE_PLACEHOLDER||' \
-		install_script.sh.template > $@
+		$(STRIP_FILTERED_IOT_ONLY) install_script.sh.template > $@
 	chmod +x $@
 
 pre_release_%:

README.md

@@ -79,6 +79,26 @@ This repository contains 2 basic files, `install_script.sh.template` and `Makefi
 * `install_script.sh` - Install script that uses `DD_AGENT_MAJOR_VERSION=6` by default and also emits a deprecation warning when run.
 * `install_script_agent6.sh` - Install script that uses `DD_AGENT_MAJOR_VERSION=6` by default.
 * `install_script_agent7.sh` - Install script that uses `DD_AGENT_MAJOR_VERSION=7` by default.
+* `install_script_agent7_iot.sh` - Experimental Agent 7 variant that installs a filesystem-filtered normal `datadog-agent` DEB for IoT deployments.
+
+The filtered IoT installer currently supports Debian and Ubuntu only. RPM installation remains unsupported because the Agent RPM post-install scriptlet needs the embedded installer while the final filtered layout removes it; reconciling that transient requirement with RPM's recorded file state needs a separate design.
+
+The filtered IoT installer is fresh-install-only: it rejects an existing Agent package or configuration. Ordinary APT upgrades of a filtered installation are not supported yet. The dedicated dpkg path-filter policy intentionally remains installed after a successful DEB installation so that unsupported upgrades cannot silently restore the excluded payload.
+
+After package, layout, configuration, and service handling succeed, the installer publishes `/etc/datadog-agent/install_profile` as root-owned mode `0644` with this schema (using the exact installed DEB version):
+
+```yaml
+version: 1
+profile: iot-filtered
+manifest: iot-v1
+package: datadog-agent
+package_version: '1:7.82.0-1'
+installer: install_script_agent7_iot
+```
+
+This marker is the installer-side contract for the normal Agent's filtered-IoT companion-process guard; the Agent-side guard is maintained in the `datadog-agent` repository rather than in this install script.
+
+For scale only, a same-version Agent 7.82 DEB comparison on the validated test layout showed about a 77% reduction in installed logical bytes. This result is experimental and varies with package and platform; CI does not enforce a hard disk-reduction threshold.
 
 The generated files must never be committed to this repository. All changes must be done by modifications of the template file and Makefile.