fix(data-race): lock ntmConfig.GetNode for concurrent access (#55389) - #55434
Draft
usamasaqib wants to merge 110 commits into
Draft
fix(data-race): lock ntmConfig.GetNode for concurrent access (#55389)#55434usamasaqib wants to merge 110 commits into
usamasaqib wants to merge 110 commits into
Conversation
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Adds `c.RLock()` / `defer c.RUnlock()` to `ntmConfig.GetNode()`. ### Motivation `GetNode()` reads `c.root` and traverses the tree without the read lock, racing with `Set()` which modifies the tree under the write lock. ``` WARNING: DATA RACE Read at ... by goroutine A: (*ntmConfig).GetNode() config.go:894 // curr.GetChild(part) ... configstreamconsumer.streamLoop -> applyUpdate -> IsSetting Previous write at ... by goroutine B: (*ntmConfig).Set() config.go:265 // c.root.Merge(newTree) ... configstreamconsumer.applyUpdate ``` ### Describe how you validated your changes CI ### Additional Notes `GetNode` is only called from `IsSetting()` (no lock held), so adding `RLock` introduces no deadlock risk. Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [github.com/stretchr/testify](https://redirect.github.com/stretchr/testify) | `v1.11.1` → `v1.12.0` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>stretchr/testify (github.com/stretchr/testify)</summary> ### [`v1.12.0`](https://redirect.github.com/stretchr/testify/releases/tag/v1.12.0) [Compare Source](https://redirect.github.com/stretchr/testify/compare/v1.11.1...v1.12.0) #### What's Changed ##### Functional Changes - assert: make \*AssertionFunc types just aliases by [@​dolmen](https://redirect.github.com/dolmen) in [#​1563](https://redirect.github.com/stretchr/testify/pull/1563) ##### Fixes - mock: avoid panic when expected type is nil in Arguments.Diff by [@​mutaiib](https://redirect.github.com/mutaiib) in [#​1775](https://redirect.github.com/stretchr/testify/pull/1775) - mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1786](https://redirect.github.com/stretchr/testify/pull/1786) - suite: validate method signatures and continue execution for valid tests by [@​vyas-git](https://redirect.github.com/vyas-git) in [#​1665](https://redirect.github.com/stretchr/testify/pull/1665) - assert.PanicsWithError: report error message by [@​olivergondza](https://redirect.github.com/olivergondza) in [#​1400](https://redirect.github.com/stretchr/testify/pull/1400) - assert: IsIncreasing et al can return false w/out failing by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1787](https://redirect.github.com/stretchr/testify/pull/1787) - add type to error message of assert.Same by [@​egawata](https://redirect.github.com/egawata) in [#​1792](https://redirect.github.com/stretchr/testify/pull/1792) - mock.AssertExpectationsForObjects fix panic with wrong testObject type. by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1795](https://redirect.github.com/stretchr/testify/pull/1795) - assert: truncate very long objects in test failure messages by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1646](https://redirect.github.com/stretchr/testify/pull/1646) - assert: fix NotSubset error messages using %#v instead of %q (fixes [#​1800](https://redirect.github.com/stretchr/testify/issues/1800)) by [@​nghiack7](https://redirect.github.com/nghiack7) in [#​1888](https://redirect.github.com/stretchr/testify/pull/1888) - suite: prevent panic when SetupTest skips with HandleStats by [@​blackwell-systems](https://redirect.github.com/blackwell-systems) in [#​1877](https://redirect.github.com/stretchr/testify/pull/1877) ##### Documentation, Build & CI - CI: test also with Go 1.23 by [@​dolmen](https://redirect.github.com/dolmen) in [#​1783](https://redirect.github.com/stretchr/testify/pull/1783) - Vendor unmaintained github.com/pmezard/go-difflib by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1708](https://redirect.github.com/stretchr/testify/pull/1708) - Promote ccoVeille to maintainer by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1784](https://redirect.github.com/stretchr/testify/pull/1784) - build(deps): bump actions/setup-go from 5 to 6 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1790](https://redirect.github.com/stretchr/testify/pull/1790) - assert.YAMLEq: Document mutlidoc behavior by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1791](https://redirect.github.com/stretchr/testify/pull/1791) - \_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by [@​dolmen](https://redirect.github.com/dolmen) in [#​1782](https://redirect.github.com/stretchr/testify/pull/1782) - doc: remove ineffective inline code blocks by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1714](https://redirect.github.com/stretchr/testify/pull/1714) - Tag generated assertions as non-generated in new .gitattributes by [@​ubunatic](https://redirect.github.com/ubunatic) in [#​1815](https://redirect.github.com/stretchr/testify/pull/1815) - chore: vendor go-spew from <https://github.com/davecgh/go-spew> by [@​ccoVeille](https://redirect.github.com/ccoVeille) in [#​1827](https://redirect.github.com/stretchr/testify/pull/1827) - require: fix godoc generation for assertions returning a bool by [@​Baxromumarov](https://redirect.github.com/Baxromumarov) in [#​1850](https://redirect.github.com/stretchr/testify/pull/1850) - docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by [@​a2not](https://redirect.github.com/a2not) in [#​1821](https://redirect.github.com/stretchr/testify/pull/1821) - docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by [@​a2not](https://redirect.github.com/a2not) in [#​1842](https://redirect.github.com/stretchr/testify/pull/1842) - EMERITUS.md: add [@​tylerb](https://redirect.github.com/tylerb) by [@​dolmen](https://redirect.github.com/dolmen) in [#​1812](https://redirect.github.com/stretchr/testify/pull/1812) - CI: test also with Go 1.24 by [@​alexandear](https://redirect.github.com/alexandear) in [#​1856](https://redirect.github.com/stretchr/testify/pull/1856) - deps: bump objx to v0.5.3 and remove dependency cycle issue by [@​ccoVeille](https://redirect.github.com/ccoVeille) in [#​1823](https://redirect.github.com/stretchr/testify/pull/1823) - CI: upgrade GitHub Actions and pin hashes by [@​SuperQ](https://redirect.github.com/SuperQ) in [#​1883](https://redirect.github.com/stretchr/testify/pull/1883) - CI: add \_readme-gofmt tool to reformat Go code in README by [@​dolmen](https://redirect.github.com/dolmen) in [#​1889](https://redirect.github.com/stretchr/testify/pull/1889) - CI: add check of GitHub Action pinned hashes against tag by [@​dolmen](https://redirect.github.com/dolmen) in [#​1885](https://redirect.github.com/stretchr/testify/pull/1885) - \_codegen: modernize by [@​dolmen](https://redirect.github.com/dolmen) in [#​1890](https://redirect.github.com/stretchr/testify/pull/1890) - build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1906](https://redirect.github.com/stretchr/testify/pull/1906) - mock: Mock.Return does not exist anymore by [@​Kentzo](https://redirect.github.com/Kentzo) in [#​1905](https://redirect.github.com/stretchr/testify/pull/1905) #### New Contributors - [@​mutaiib](https://redirect.github.com/mutaiib) made their first contribution in [#​1775](https://redirect.github.com/stretchr/testify/pull/1775) - [@​vyas-git](https://redirect.github.com/vyas-git) made their first contribution in [#​1665](https://redirect.github.com/stretchr/testify/pull/1665) - [@​olivergondza](https://redirect.github.com/olivergondza) made their first contribution in [#​1400](https://redirect.github.com/stretchr/testify/pull/1400) - [@​egawata](https://redirect.github.com/egawata) made their first contribution in [#​1792](https://redirect.github.com/stretchr/testify/pull/1792) - [@​ubunatic](https://redirect.github.com/ubunatic) made their first contribution in [#​1815](https://redirect.github.com/stretchr/testify/pull/1815) - [@​Baxromumarov](https://redirect.github.com/Baxromumarov) made their first contribution in [#​1850](https://redirect.github.com/stretchr/testify/pull/1850) - [@​a2not](https://redirect.github.com/a2not) made their first contribution in [#​1821](https://redirect.github.com/stretchr/testify/pull/1821) - [@​nghiack7](https://redirect.github.com/nghiack7) made their first contribution in [#​1888](https://redirect.github.com/stretchr/testify/pull/1888) - [@​blackwell-systems](https://redirect.github.com/blackwell-systems) made their first contribution in [#​1877](https://redirect.github.com/stretchr/testify/pull/1877) - [@​Kentzo](https://redirect.github.com/Kentzo) made their first contribution in [#​1905](https://redirect.github.com/stretchr/testify/pull/1905) **Full Changelog**: <stretchr/testify@v1.11.0...v1.12.0> #### What's Changed - mock: avoid panic when expected type is nil in Arguments.Diff by [@​mutaiib](https://redirect.github.com/mutaiib) in [#​1775](https://redirect.github.com/stretchr/testify/pull/1775) - CI: test also with Go 1.23 by [@​dolmen](https://redirect.github.com/dolmen) in [#​1783](https://redirect.github.com/stretchr/testify/pull/1783) - mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1786](https://redirect.github.com/stretchr/testify/pull/1786) - suite: validate method signatures and continue execution for valid tests by [@​vyas-git](https://redirect.github.com/vyas-git) in [#​1665](https://redirect.github.com/stretchr/testify/pull/1665) - Vendor unmaintained github.com/pmezard/go-difflib by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1708](https://redirect.github.com/stretchr/testify/pull/1708) - Promote ccoVeille to maintainer by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1784](https://redirect.github.com/stretchr/testify/pull/1784) - build(deps): bump actions/setup-go from 5 to 6 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1790](https://redirect.github.com/stretchr/testify/pull/1790) - assert.PanicsWithError: report error message by [@​olivergondza](https://redirect.github.com/olivergondza) in [#​1400](https://redirect.github.com/stretchr/testify/pull/1400) - assert: IsIncreasing et al can return false w/out failing by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1787](https://redirect.github.com/stretchr/testify/pull/1787) - add type to error message of assert.Same by [@​egawata](https://redirect.github.com/egawata) in [#​1792](https://redirect.github.com/stretchr/testify/pull/1792) - assert.YAMLEq: Document mutlidoc behavior by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1791](https://redirect.github.com/stretchr/testify/pull/1791) - mock.AssertExpectationsForObjects fix panic with wrong testObject type. by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1795](https://redirect.github.com/stretchr/testify/pull/1795) - \_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by [@​dolmen](https://redirect.github.com/dolmen) in [#​1782](https://redirect.github.com/stretchr/testify/pull/1782) - assert: truncate very long objects in test failure messages by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1646](https://redirect.github.com/stretchr/testify/pull/1646) - doc: remove ineffective inline code blocks by [@​brackendawson](https://redirect.github.com/brackendawson) in [#​1714](https://redirect.github.com/stretchr/testify/pull/1714) - Tag generated assertions as non-generated in new .gitattributes by [@​ubunatic](https://redirect.github.com/ubunatic) in [#​1815](https://redirect.github.com/stretchr/testify/pull/1815) - chore: vendor go-spew from <https://github.com/davecgh/go-spew> by [@​ccoVeille](https://redirect.github.com/ccoVeille) in [#​1827](https://redirect.github.com/stretchr/testify/pull/1827) - require: fix godoc generation for assertions returning a bool by [@​Baxromumarov](https://redirect.github.com/Baxromumarov) in [#​1850](https://redirect.github.com/stretchr/testify/pull/1850) - docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by [@​a2not](https://redirect.github.com/a2not) in [#​1821](https://redirect.github.com/stretchr/testify/pull/1821) - docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by [@​a2not](https://redirect.github.com/a2not) in [#​1842](https://redirect.github.com/stretchr/testify/pull/1842) - EMERITUS.md: add [@​tylerb](https://redirect.github.com/tylerb) by [@​dolmen](https://redirect.github.com/dolmen) in [#​1812](https://redirect.github.com/stretchr/testify/pull/1812) - CI: test also with Go 1.24 by [@​alexandear](https://redirect.github.com/alexandear) in [#​1856](https://redirect.github.com/stretchr/testify/pull/1856) - deps: bump objx to v0.5.3 and remove dependency cycle issue by [@​ccoVeille](https://redirect.github.com/ccoVeille) in [#​1823](https://redirect.github.com/stretchr/testify/pull/1823) - CI: upgrade GitHub Actions and pin hashes by [@​SuperQ](https://redirect.github.com/SuperQ) in [#​1883](https://redirect.github.com/stretchr/testify/pull/1883) - assert: fix NotSubset error messages using %#v instead of %q (fixes [#​1800](https://redirect.github.com/stretchr/testify/issues/1800)) by [@​nghiack7](https://redirect.github.com/nghiack7) in [#​1888](https://redirect.github.com/stretchr/testify/pull/1888) - suite: prevent panic when SetupTest skips with HandleStats by [@​blackwell-systems](https://redirect.github.com/blackwell-systems) in [#​1877](https://redirect.github.com/stretchr/testify/pull/1877) - CI: add \_readme-gofmt tool to reformat Go code in README by [@​dolmen](https://redirect.github.com/dolmen) in [#​1889](https://redirect.github.com/stretchr/testify/pull/1889) - CI: add check of GitHub Action pinned hashes against tag by [@​dolmen](https://redirect.github.com/dolmen) in [#​1885](https://redirect.github.com/stretchr/testify/pull/1885) - \_codegen: modernize by [@​dolmen](https://redirect.github.com/dolmen) in [#​1890](https://redirect.github.com/stretchr/testify/pull/1890) - assert: make \*AssertionFunc types just aliases by [@​dolmen](https://redirect.github.com/dolmen) in [#​1563](https://redirect.github.com/stretchr/testify/pull/1563) - build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1906](https://redirect.github.com/stretchr/testify/pull/1906) - mock: Mock.Return does not exist anymore by [@​Kentzo](https://redirect.github.com/Kentzo) in [#​1905](https://redirect.github.com/stretchr/testify/pull/1905) #### New Contributors - [@​mutaiib](https://redirect.github.com/mutaiib) made their first contribution in [#​1775](https://redirect.github.com/stretchr/testify/pull/1775) - [@​vyas-git](https://redirect.github.com/vyas-git) made their first contribution in [#​1665](https://redirect.github.com/stretchr/testify/pull/1665) - [@​olivergondza](https://redirect.github.com/olivergondza) made their first contribution in [#​1400](https://redirect.github.com/stretchr/testify/pull/1400) - [@​egawata](https://redirect.github.com/egawata) made their first contribution in [#​1792](https://redirect.github.com/stretchr/testify/pull/1792) - [@​ubunatic](https://redirect.github.com/ubunatic) made their first contribution in [#​1815](https://redirect.github.com/stretchr/testify/pull/1815) - [@​Baxromumarov](https://redirect.github.com/Baxromumarov) made their first contribution in [#​1850](https://redirect.github.com/stretchr/testify/pull/1850) - [@​a2not](https://redirect.github.com/a2not) made their first contribution in [#​1821](https://redirect.github.com/stretchr/testify/pull/1821) - [@​nghiack7](https://redirect.github.com/nghiack7) made their first contribution in [#​1888](https://redirect.github.com/stretchr/testify/pull/1888) - [@​blackwell-systems](https://redirect.github.com/blackwell-systems) made their first contribution in [#​1877](https://redirect.github.com/stretchr/testify/pull/1877) - [@​Kentzo](https://redirect.github.com/Kentzo) made their first contribution in [#​1905](https://redirect.github.com/stretchr/testify/pull/1905) **Full Changelog**: <stretchr/testify@v1.11.0...v1.12.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhbmdlbG9nL25vLWNoYW5nZWxvZyIsImRlcGVuZGVuY2llcyIsImRlcGVuZGVuY2llcy1nbyIsInFhL25vLWNvZGUtY2hhbmdlIl19--> Co-authored-by: rdesgroppes <regis.desgroppes@datadoghq.com> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
Contributor
Static quality checks✅ Please find below the results from static quality gates 33 successful checks with minimal change (< 2 KiB)
|
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [saphyr-parser](https://redirect.github.com/saphyr-rs/saphyr) | workspace.dependencies | patch | `0.0.11` → `0.0.12` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>saphyr-rs/saphyr (saphyr-parser)</summary> ### [`v0.0.12`](https://redirect.github.com/saphyr-rs/saphyr/compare/v0.0.11...v0.0.12) [Compare Source](https://redirect.github.com/saphyr-rs/saphyr/compare/v0.0.11...v0.0.12) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhbmdlbG9nL25vLWNoYW5nZWxvZyIsImRlcGVuZGVuY2llcyIsImRlcGVuZGVuY2llcy1jYXJnbyIsInFhL25vLWNvZGUtY2hhbmdlIl19--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [github.com/DataDog/datadog-traceroute](https://redirect.github.com/DataDog/datadog-traceroute) | `v1.0.19` → `v1.0.20` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>DataDog/datadog-traceroute (github.com/DataDog/datadog-traceroute)</summary> ### [`v1.0.20`](https://redirect.github.com/DataDog/datadog-traceroute/releases/tag/v1.0.20) [Compare Source](https://redirect.github.com/DataDog/datadog-traceroute/compare/v1.0.19...v1.0.20) #### What's Changed - Bump Go to 1.26.6 (CVE-2026-39821) by [@​GuilhermeBorges](https://redirect.github.com/GuilhermeBorges) in [#​142](https://redirect.github.com/DataDog/datadog-traceroute/pull/142) #### New Contributors - [@​GuilhermeBorges](https://redirect.github.com/GuilhermeBorges) made their first contribution in [#​142](https://redirect.github.com/DataDog/datadog-traceroute/pull/142) **Full Changelog**: <DataDog/datadog-traceroute@v1.0.19...v1.0.20> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhbmdlbG9nL25vLWNoYW5nZWxvZyIsImRlcGVuZGVuY2llcyIsImRlcGVuZGVuY2llcy1nbyIsInFhL25vLWNvZGUtY2hhbmdlIl19--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [github.com/rabbitmq/amqp091-go](https://redirect.github.com/rabbitmq/amqp091-go) | `v1.13.0` → `v1.14.0` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>rabbitmq/amqp091-go (github.com/rabbitmq/amqp091-go)</summary> ### [`v1.14.0`](https://redirect.github.com/rabbitmq/amqp091-go/blob/HEAD/CHANGELOG.md#v1140-2026-08-18) [Compare Source](https://redirect.github.com/rabbitmq/amqp091-go/compare/v1.13.0...v1.14.0) [Full Changelog](https://redirect.github.com/rabbitmq/amqp091-go/compare/v1.13.0...v1.14.0) **Implemented enhancements:** - refactor: extract shared close prologue into beginClose() [#​376](https://redirect.github.com/rabbitmq/amqp091-go/pull/376) ([suchitd](https://redirect.github.com/suchitd)) **Fixed bugs:** - Retry consumer recovery instead of cancelling on a failed re-subscribe [#​380](https://redirect.github.com/rabbitmq/amqp091-go/pull/380) ([lukebakken](https://redirect.github.com/lukebakken)) - Fix auto-recovery correctness gaps [#​379](https://redirect.github.com/rabbitmq/amqp091-go/pull/379) ([suchitd](https://redirect.github.com/suchitd)) - Enforce frame size in pre-negotiation state [#​377](https://redirect.github.com/rabbitmq/amqp091-go/pull/377) ([Zerpet](https://redirect.github.com/Zerpet)) - test: retry cleanup connection after clearing memory alarm [#​375](https://redirect.github.com/rabbitmq/amqp091-go/pull/375) ([suchitd](https://redirect.github.com/suchitd)) - fix: eliminate flakiness in TestTLSHandshake [#​373](https://redirect.github.com/rabbitmq/amqp091-go/pull/373) ([suchitd](https://redirect.github.com/suchitd)) - fix: close goroutine leaks from Close()/Reconnect() races [#​372](https://redirect.github.com/rabbitmq/amqp091-go/pull/372) ([suchitd](https://redirect.github.com/suchitd)) **Merged pull requests:** - chore(deps): reduce github-actions dependabot updates to weekly [#​384](https://redirect.github.com/rabbitmq/amqp091-go/pull/384) ([suchitd](https://redirect.github.com/suchitd)) - chore(deps): bump github/codeql-action from 4.37.5 to 4.37.6 in the github-actions group [#​383](https://redirect.github.com/rabbitmq/amqp091-go/pull/383) ([dependabot\[bot\]](https://redirect.github.com/apps/dependabot)) - docs: update CLAUDE.md with lifecycle/log files and updated recovery details [#​382](https://redirect.github.com/rabbitmq/amqp091-go/pull/382) ([suchitd](https://redirect.github.com/suchitd)) - chore(deps): bump github/codeql-action from 4.37.4 to 4.37.5 in the github-actions group [#​381](https://redirect.github.com/rabbitmq/amqp091-go/pull/381) ([dependabot\[bot\]](https://redirect.github.com/apps/dependabot)) - chore(deps): bump github/codeql-action from 4.37.3 to 4.37.4 in the github-actions group [#​378](https://redirect.github.com/rabbitmq/amqp091-go/pull/378) ([dependabot\[bot\]](https://redirect.github.com/apps/dependabot)) - chore(deps): bump github/codeql-action from 4 to 4.37.3 in the github-actions group [#​374](https://redirect.github.com/rabbitmq/amqp091-go/pull/374) ([dependabot\[bot\]](https://redirect.github.com/apps/dependabot)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhbmdlbG9nL25vLWNoYW5nZWxvZyIsImRlcGVuZGVuY2llcyIsImRlcGVuZGVuY2llcy1nbyIsInFhL25vLWNvZGUtY2hhbmdlIl19--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Extends the `clusterAgentClientLock` (added in #54638 for `clusterAgentAPIClient`) to also cover `clusterAgentAPIEndpoint` and `clusterAgentAPIRequestHeaders`: - `init()` builds the endpoint and headers on locals, then stores them under the write lock. - `buildURL()` and `ClusterAgentAPIEndpoint()` take the read lock before reading `clusterAgentAPIEndpoint`. - `doQuery()` reads the request headers via a new `requestHeaders()` helper that takes the read lock and returns a `Clone()`. ### Motivation #54638 fixed the race on `DCAClient.clusterAgentAPIClient` but left the sibling fields `clusterAgentAPIEndpoint` and `clusterAgentAPIRequestHeaders` unlocked. The same `GetClusterAgentClient → init()` vs. `ClusterChecksConfigProvider.IsUpToDate → doQuery/buildURL` path still races on those fields: ``` WARNING: DATA RACE Write at ... by goroutine A: (*DCAClient).init() clusteragent.go:141 / :151 // endpoint + headers ... GetClusterAgentClient -> clustername.GetClusterID -> hosttags.Get -> rcservice.refresh Previous read at ... by goroutine B: (*DCAClient).buildURL() clusteragent.go:281 // c.clusterAgentAPIEndpoint (*DCAClient).doQuery() clusteragent.go:298 // req.Header = c.clusterAgentAPIRequestHeaders ... ClusterChecksConfigProvider.initClient -> IsUpToDate ``` ### Describe how you validated your changes CI ### Additional Notes Follow-up to #54638. Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Swallows TOC overflow failures in the two AIX/ppc64 cross-compile jobs (`cross_build_agent-binary_aix_ppc64`, `cross_build_trace_agent-binary_aix_ppc64`). The build output is tee'd to a log; if the build fails and the log contains a TOC overflow, the job exits 0. Any other failure is still propagated. ### Motivation The AIX/ppc64 external linker (binutils `xcofflink`) intermittently fails with a TOC overflow (TOC size > 64KiB). It's flaky and undiagnosed. ### Describe how you validated your changes - Parsed the YAML to confirm the `before_script` literal block produces a valid wrapper script. - Ran the wrapper against simulated cases: TOC overflow (binutils and AIX native `ld` formats) → swallowed (exit 0); real failure → propagated with original code; genuine success → `file` verifies the binary. ### Additional Notes Known trade-off: a TOC-overflow run produces no binary artifact but reports green, so the AIX binaries may be missing from affected pipelines. Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>
### What does this PR do? Enable v3beta sketch shadowing. ### Motivation Additional verification before switching all sketches to use the v3 format by default. ### Describe how you validated your changes Run the agent with `DD_SERIALIZER_EXPERIMENTAL_USE_V3_API_SKETCHES_SHADOW_SAMPLE_RATE=0.5` pointed at the test intake and verify via telemetry number of transactions for `sketches_v3beta` is roughly 50% of transactions for `sketches` endpoint. When doing final QA: Run the agent with `DD_SERIALIZER_EXPERIMENTAL_USE_V3_API_SKETCHES_SHADOW_SAMPLE_RATE=0.5` with the real intake and verify that it accepts sketches_v3beta payloads without errors. ### Additional Notes Co-authored-by: vikentiy.fesunov <vikentiy.fesunov@datadoghq.com>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [go.temporal.io/sdk](https://redirect.github.com/temporalio/sdk-go) | `v1.47.0` → `v1.48.0` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>temporalio/sdk-go (go.temporal.io/sdk)</summary> ### [`v1.48.0`](https://redirect.github.com/temporalio/sdk-go/releases/tag/v1.48.0) [Compare Source](https://redirect.github.com/temporalio/sdk-go/compare/v1.47.0...v1.48.0) ##### Highlights ##### Added - Added experimental `workflow.GetRandomStream` for named deterministic pseudorandom values in workflows. - Added experimental `workflow.IsReadOnly` to report whether the workflow context is in a read-only path. - Added `client.Options.SdkName` and `client.Options.SdkVersion` to override the SDK name and version reported in worker heartbeats. - Added `client.WorkflowRun.GetFirstExecutionRunID` to expose the first execution run ID returned by the server when starting a workflow. - Added `client.Client.CancelWorkflowWithOptions` and `client.Client.TerminateWorkflowWithOptions` to target a workflow execution chain by its first execution run ID. Cancellation options can also specify a reason. - Added `go.temporal.io/sdk/interceptor/tracing`, a reworked tracing interceptor with corrected span parenting and span directions for span-kind mapping. It backs the new `contrib/opentelemetry-v2` module and is not span-compatible with the tracing interceptor used by `contrib/opentelemetry` (v1). ##### Changed - Improved the performance of yield-heavy workloads by eliminating unnecessary computation and heap allocations. - Replaced the internal `OnceCell` implementation with `sync.OnceValue` for lazy workflow run ID lookup. ##### Fixed - Data converter errors raised while deserializing Nexus operation input are no longer replaced with a generic `BAD_REQUEST` handler error. A `temporal.ApplicationError` or a `nexus.HandlerError` is now propagated to the caller as-is, and any other error is wrapped in a `BAD_REQUEST` `nexus.HandlerError` that retains the original error as its cause. As an exception, a non-retryable `temporal.ApplicationError` with type `PayloadValidationError` is reported as a `BAD_REQUEST` `nexus.HandlerError` with the original error as its cause, since it indicates the operation input itself is invalid. - Prevent workflow task failures when an activity with a custom ID completes while its cancellation command is pending. - `TestWorkflowEnvironment.MutableSideEffect` now honors the provided equals function and only updates the recorded value when it changes, matching the real worker. Previously it ignored equals and returned a freshly computed value on every call. - Nexus operation link propagation for stand-alone activities: when a Nexus operation handler uses `client.ExecuteActivity`, inbound Nexus request links are forwarded to the activity and the activity link returned by the server is propagated back to the Nexus operation caller. ##### What's Changed - Fix Pending Activity cancellation is not removed after completion when using a custom Activity ID by [@​Quinn-With-Two-Ns](https://redirect.github.com/Quinn-With-Two-Ns) in [#​2513](https://redirect.github.com/temporalio/sdk-go/pull/2513) - Print only test failures by default, full logs in files by [@​yuandrew](https://redirect.github.com/yuandrew) in [#​2510](https://redirect.github.com/temporalio/sdk-go/pull/2510) - Honor equals function in test env MutableSideEffect by [@​PardhuTI](https://redirect.github.com/PardhuTI) in [#​2516](https://redirect.github.com/temporalio/sdk-go/pull/2516) - fix: add TMPRL1105 prefix to extstore error by [@​jmaeagle99](https://redirect.github.com/jmaeagle99) in [#​2515](https://redirect.github.com/temporalio/sdk-go/pull/2515) - feat: allow overriding SDK name/version in worker heartbeats by [@​xepozz](https://redirect.github.com/xepozz) in [#​2511](https://redirect.github.com/temporalio/sdk-go/pull/2511) - perf: replace runtime.CallersFrames in isPanicking with FuncForPC by [@​brucearctor](https://redirect.github.com/brucearctor) in [#​2336](https://redirect.github.com/temporalio/sdk-go/pull/2336) - contrib: add Google Cloud Storage driver for external payload storage by [@​brucearctor](https://redirect.github.com/brucearctor) in [#​2366](https://redirect.github.com/temporalio/sdk-go/pull/2366) - Bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /contrib/gcp/gcsdriver/gcssdk by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2534](https://redirect.github.com/temporalio/sdk-go/pull/2534) - \[AI-383] contrib/googleadk: add replay-safe OpenTelemetry provider wrappers by [@​DABH](https://redirect.github.com/DABH) in [#​2514](https://redirect.github.com/temporalio/sdk-go/pull/2514) - Replace internal OnceCell with OnceValue by [@​Quinn-With-Two-Ns](https://redirect.github.com/Quinn-With-Two-Ns) in [#​2541](https://redirect.github.com/temporalio/sdk-go/pull/2541) - feat: add workflow\.GetRandomStream and workflow\.IsReadOnly by [@​patbeqo](https://redirect.github.com/patbeqo) in [#​2521](https://redirect.github.com/temporalio/sdk-go/pull/2521) - Add CancelWorkflowWithOptions and TerminateWorkflowWithOptions by [@​Quinn-With-Two-Ns](https://redirect.github.com/Quinn-With-Two-Ns) in [#​2543](https://redirect.github.com/temporalio/sdk-go/pull/2543) - fix(extstore): correct minimum Go SDK requirement to v1.43.1 by [@​jmaeagle99](https://redirect.github.com/jmaeagle99) in [#​2551](https://redirect.github.com/temporalio/sdk-go/pull/2551) - Refactor integration test client creation by [@​dplyukhin](https://redirect.github.com/dplyukhin) in [#​2544](https://redirect.github.com/temporalio/sdk-go/pull/2544) - chore: update driver change logs with release dates by [@​jmaeagle99](https://redirect.github.com/jmaeagle99) in [#​2555](https://redirect.github.com/temporalio/sdk-go/pull/2555) - fix: correct change log version 1.47.0 by [@​jmaeagle99](https://redirect.github.com/jmaeagle99) in [#​2556](https://redirect.github.com/temporalio/sdk-go/pull/2556) - Use synctest for tests by [@​yuandrew](https://redirect.github.com/yuandrew) in [#​2548](https://redirect.github.com/temporalio/sdk-go/pull/2548) - Add script to prepare new releases by [@​dplyukhin](https://redirect.github.com/dplyukhin) in [#​2523](https://redirect.github.com/temporalio/sdk-go/pull/2523) - Configure test-focused linters by [@​yuandrew](https://redirect.github.com/yuandrew) in [#​2561](https://redirect.github.com/temporalio/sdk-go/pull/2561) - Add envconfig support to integration test harness by [@​THardy98](https://redirect.github.com/THardy98) in [#​2539](https://redirect.github.com/temporalio/sdk-go/pull/2539) - Add testify suite assertion lifecycle check by [@​yuandrew](https://redirect.github.com/yuandrew) in [#​2553](https://redirect.github.com/temporalio/sdk-go/pull/2553) - Expose First Execution Run on WorkflowRun by [@​Quinn-With-Two-Ns](https://redirect.github.com/Quinn-With-Two-Ns) in [#​2542](https://redirect.github.com/temporalio/sdk-go/pull/2542) - feat(opentelemetry): add support for OTEL v2 by [@​patbeqo](https://redirect.github.com/patbeqo) in [#​2475](https://redirect.github.com/temporalio/sdk-go/pull/2475) - Fix double sending link on SAA by [@​Quinn-With-Two-Ns](https://redirect.github.com/Quinn-With-Two-Ns) in [#​2525](https://redirect.github.com/temporalio/sdk-go/pull/2525) - Document pull request template by [@​yuandrew](https://redirect.github.com/yuandrew) in [#​2575](https://redirect.github.com/temporalio/sdk-go/pull/2575) - Run checks for contrib modules by [@​yuandrew](https://redirect.github.com/yuandrew) in [#​2558](https://redirect.github.com/temporalio/sdk-go/pull/2558) - Propagate data converter errors from Nexus input deserialization by [@​bergundy](https://redirect.github.com/bergundy) in [#​2549](https://redirect.github.com/temporalio/sdk-go/pull/2549) ##### New Contributors - [@​PardhuTI](https://redirect.github.com/PardhuTI) made their first contribution in [#​2516](https://redirect.github.com/temporalio/sdk-go/pull/2516) - [@​patbeqo](https://redirect.github.com/patbeqo) made their first contribution in [#​2521](https://redirect.github.com/temporalio/sdk-go/pull/2521) **Full Changelog**: <temporalio/sdk-go@v1.47.0...v1.48.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhbmdlbG9nL25vLWNoYW5nZWxvZyIsImRlcGVuZGVuY2llcyIsImRlcGVuZGVuY2llcy1nbyIsInFhL25vLWNvZGUtY2hhbmdlIl19--> [AI-383]: https://datadoghq.atlassian.net/browse/AI-383?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [github.com/pulumi/pulumi-gcp/sdk/v9](https://redirect.github.com/pulumi/pulumi-gcp) | `v9.30.0` → `v9.34.1` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>pulumi/pulumi-gcp (github.com/pulumi/pulumi-gcp/sdk/v9)</summary> ### [`v9.34.1`](https://redirect.github.com/pulumi/pulumi-gcp/releases/tag/v9.34.1) [Compare Source](https://redirect.github.com/pulumi/pulumi-gcp/compare/v9.34.0...v9.34.1) #### What's Changed - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​3917](https://redirect.github.com/pulumi/pulumi-gcp/pull/3917) - Update module github.com/go-git/go-git/v6 to v6.0.0-alpha.5 \[SECURITY] by [@​pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot] in [#​3918](https://redirect.github.com/pulumi/pulumi-gcp/pull/3918) - Update first-party Pulumi dependencies by [@​pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot] in [#​3919](https://redirect.github.com/pulumi/pulumi-gcp/pull/3919) - Update module github.com/pulumi/pulumi-yaml to v1.38.2 by [@​pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot] in [#​3924](https://redirect.github.com/pulumi/pulumi-gcp/pull/3924) - Align Plugin Framework external\_credentials block cardinality by [@​pose](https://redirect.github.com/pose) in [#​3923](https://redirect.github.com/pulumi/pulumi-gcp/pull/3923) **Full Changelog**: <pulumi/pulumi-gcp@v9.34.0...v9.34.1> ### [`v9.34.0`](https://redirect.github.com/pulumi/pulumi-gcp/releases/tag/v9.34.0) [Compare Source](https://redirect.github.com/pulumi/pulumi-gcp/compare/v9.33.0...v9.34.0) #### What's Changed - Upgrade pulumi-terraform-bridge to v3.136.0 by [@​pulumi-bot](https://redirect.github.com/pulumi-bot) in [#​3913](https://redirect.github.com/pulumi/pulumi-gcp/pull/3913) - Update first-party Pulumi dependencies by [@​pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot] in [#​3914](https://redirect.github.com/pulumi/pulumi-gcp/pull/3914) - Upgrade terraform-provider-google-beta to v7.43.0 by [@​pose](https://redirect.github.com/pose) in [#​3915](https://redirect.github.com/pulumi/pulumi-gcp/pull/3915) **Full Changelog**: <pulumi/pulumi-gcp@v9.33.0...v9.34.0> ### [`v9.33.0`](https://redirect.github.com/pulumi/pulumi-gcp/releases/tag/v9.33.0) [Compare Source](https://redirect.github.com/pulumi/pulumi-gcp/compare/v9.32.1...v9.33.0) #### What's Changed - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​3909](https://redirect.github.com/pulumi/pulumi-gcp/pull/3909) - Update first-party Pulumi dependencies by [@​pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot] in [#​3905](https://redirect.github.com/pulumi/pulumi-gcp/pull/3905) - Update first-party Pulumi dependencies to v3.256.0 by [@​pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot] in [#​3910](https://redirect.github.com/pulumi/pulumi-gcp/pull/3910) - Upgrade terraform-provider-google-beta to v7.42.0 by [@​pose](https://redirect.github.com/pose) in [#​3911](https://redirect.github.com/pulumi/pulumi-gcp/pull/3911) **Full Changelog**: <pulumi/pulumi-gcp@v9.32.1...v9.33.0> ### [`v9.32.1`](https://redirect.github.com/pulumi/pulumi-gcp/releases/tag/v9.32.1) [Compare Source](https://redirect.github.com/pulumi/pulumi-gcp/compare/v9.31.0...v9.32.1) ##### What's Changed - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​3901](https://redirect.github.com/pulumi/pulumi-gcp/pull/3901) - Update first-party Pulumi dependencies by [@​pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot] in [#​3898](https://redirect.github.com/pulumi/pulumi-gcp/pull/3898) - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​3902](https://redirect.github.com/pulumi/pulumi-gcp/pull/3902) - Update pulumi/verify-provider-release action to v1.3.2 by [@​pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot] in [#​3903](https://redirect.github.com/pulumi/pulumi-gcp/pull/3903) - Update vulnerable dependencies \[SECURITY] by [@​pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot] in [#​3904](https://redirect.github.com/pulumi/pulumi-gcp/pull/3904) - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​3907](https://redirect.github.com/pulumi/pulumi-gcp/pull/3907) **Full Changelog**: <pulumi/pulumi-gcp@v9.32.0...v9.32.1> ### [`v9.31.0`](https://redirect.github.com/pulumi/pulumi-gcp/releases/tag/v9.31.0) [Compare Source](https://redirect.github.com/pulumi/pulumi-gcp/compare/v9.30.0...v9.31.0) #### What's Changed - Remove obsolete patch 0003-rebase-bigquery\_dataset by [@​eon-pulumi-agent](https://redirect.github.com/eon-pulumi-agent)\[bot] in [#​3877](https://redirect.github.com/pulumi/pulumi-gcp/pull/3877) - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​3878](https://redirect.github.com/pulumi/pulumi-gcp/pull/3878) - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​3881](https://redirect.github.com/pulumi/pulumi-gcp/pull/3881) - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​3885](https://redirect.github.com/pulumi/pulumi-gcp/pull/3885) - Upgrade terraform-provider-google-beta to v7.40.0 by [@​pose](https://redirect.github.com/pose) in [#​3884](https://redirect.github.com/pulumi/pulumi-gcp/pull/3884) #### New Contributors - [@​eon-pulumi-agent](https://redirect.github.com/eon-pulumi-agent)\[bot] made their first contribution in [#​3877](https://redirect.github.com/pulumi/pulumi-gcp/pull/3877) **Full Changelog**: <pulumi/pulumi-gcp@v9.30.0...v9.31.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhbmdlbG9nL25vLWNoYW5nZWxvZyIsImRlcGVuZGVuY2llcyIsImRlcGVuZGVuY2llcy1nbyIsInFhL25vLWNvZGUtY2hhbmdlIl19--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Bump memory for go_e2e_test_binaries. With recent changes introduced in #53982 the memory are bigger and need more memory if we want to keep building them 4 at a time ### Motivation ### Describe how you validated your changes ### Additional Notes
### What does this PR do? Gives the Datadog Operator e2e component its own `operator-datadog-credentials` Secret and configures the Operator Helm release to use it. The DDA component continues to own `dda-datadog-credentials`, so the two Pulumi components no longer target the same Kubernetes object. ### Motivation The Operator and DDA components coexist in the same namespace during Operator e2e tests. Both previously registered distinct Pulumi resources backed by the same `dda-datadog-credentials` Secret. Pulumi Kubernetes v4.29 and later use client-side create for new resources and return `AlreadyExists` instead of silently upserting an object owned by another resource. After updating the Operator e2e framework dependency for [DataDog/datadog-operator#3387](DataDog/datadog-operator#3387), every Kubernetes matrix job failed on its first DDA environment update. Using separate names keeps lifecycle ownership explicit without enabling the global `upsertExistingObjects` compatibility behavior or coupling the two components through a shared resource. ### Describe how you validated your changes - `dda inv test --module=test/e2e-framework --targets=./components/datadog/operator` — passed; the package currently contains no unit-test files. - `dda inv linter.go --module=test/e2e-framework --targets=./components/datadog/operator` — passed with zero issues. - Repository commit and pre-push hooks passed, including formatting, module tidiness, Go tests, and Go linting. The full e2e suite was not run locally. ### Additional Notes No Reno note is included because this only changes internal e2e infrastructure and does not affect the Agent binary. Co-authored-by: timothee.bavelier <timothee.bavelier@datadoghq.com>
The collector and sbomutil sit under /comp/core/workloadmeta, so ownership falls to container-platform. agent-security writes and reviews them. Co-authored-by: david.ducolombier <david.ducolombier@datadoghq.com>
## What does this PR do? Uses the OpenTelemetry `url.template` attribute when generating resource names for HTTP client spans. Client spans now use `METHOD url.template` when available and retain the method-only fallback otherwise. Server spans continue to use `METHOD http.route`. Fixes #31570. ## Motivation HTTP client resource names currently collapse to the HTTP method even when OpenTelemetry instrumentation provides a low-cardinality URL template. Using the template produces more useful resource grouping without falling back to high-cardinality raw URLs. ## Testing Added focused unit coverage for client URL templates, method-only fallback, and client/server attribute precedence. Local `dda inv test --targets=./pkg/trace/api,./pkg/trace/otel/traceutil` could not run because Windows Defender quarantined the standalone `dda.exe` after its PyPI bootstrap failed with a TLS handshake error. CI is expected to run the required test targets. ## Additional Notes The current commit is unsigned because no local signing key is configured; it will need to be replaced with a signed commit before merge. Co-authored-by: jade-guiton-dd <jade.guiton@datadoghq.com>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [github.com/pierrec/lz4/v4](https://redirect.github.com/pierrec/lz4) | `v4.1.28` → `v4.1.29` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>pierrec/lz4 (github.com/pierrec/lz4/v4)</summary> ### [`v4.1.29`](https://redirect.github.com/pierrec/lz4/compare/v4.1.28...v4.1.29) [Compare Source](https://redirect.github.com/pierrec/lz4/compare/v4.1.28...v4.1.29) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhbmdlbG9nL25vLWNoYW5nZWxvZyIsImRlcGVuZGVuY2llcyIsImRlcGVuZGVuY2llcy1nbyIsInFhL25vLWNvZGUtY2hhbmdlIl19--> Co-authored-by: rdesgroppes <regis.desgroppes@datadoghq.com> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [yaml-rust2](https://redirect.github.com/Ethiraric/yaml-rust2) | workspace.dependencies | minor | `0.11` → `0.12` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>Ethiraric/yaml-rust2 (yaml-rust2)</summary> ### [`v0.12.0`](https://redirect.github.com/Ethiraric/yaml-rust2/blob/HEAD/CHANGELOG.md#v0120) [Compare Source](https://redirect.github.com/Ethiraric/yaml-rust2/compare/v0.11.1...v0.12.0) **Changes**: - The minimum supported Rust version is now v1.85.0. - `hashlink` was upgraded to v0.12.1. - `quickcheck` (dev-only dependency) was upgraded to v1.1.0. - `toml` (dev-only dependency) was upgraded to v1.1.4. - ([#​79](https://redirect.github.com/Ethiraric/yaml-rust2/issues/79)) corrected the documentation for `Marker::index`. ### [`v0.11.1`](https://redirect.github.com/Ethiraric/yaml-rust2/blob/HEAD/CHANGELOG.md#v0111) [Compare Source](https://redirect.github.com/Ethiraric/yaml-rust2/compare/v0.11.0...v0.11.1) **Changes**: - ([#​78](https://redirect.github.com/Ethiraric/yaml-rust2/issues/78)) Fix parsing short YAML documents to avoid infinite loops. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiY2hhbmdlbG9nL25vLWNoYW5nZWxvZyIsImRlcGVuZGVuY2llcyIsImRlcGVuZGVuY2llcy1jYXJnbyIsInFhL25vLWNvZGUtY2hhbmdlIl19--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
Skill file documenting how to trigger the `cws-btfhub-sync` workflow and land its output after adding a new constantfetch offset. Covers the two things that are easy to get wrong: `--ref main` + `base_branch=<feature-branch>` (otherwise the generator never sees the new offset requests and the sync yields an empty diff), and polling the ~15-job matrix from a background shell instead of `gh run watch`. Docs only, no code change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: daniel.mercier <daniel.mercier@datadoghq.com>
…55394) <!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Setting a wildcard ("*") entry in kubernetes_namespace_annotations_as_tags (or the equivalent kubernetes_resources_annotations_as_tags: {namespaces: {"*": ...}}) crashes the process running the kubernetes_state_core check (the Cluster Agent, or a Cluster Check Runner if the check is dispatched there) with a panic. The crash happens as soon as any namespace with zero annotations is processed (e.g. default, kube-system in a stock cluster), so it reproduces on virtually any real cluster. ### Describe how you validated your changes added Unit tests E2E tests already exist. Co-authored-by: adel.hajhassan <adel.hajhassan@datadoghq.com>
…payload (#55406) ### What does this PR do? Makes the payload-decoding test helpers in `pkg/trace/writer` fail the test instead of panicking when a recorded payload cannot be decompressed. ### Motivation `TestTraceWriterMultipleEndpointsConcurrent` failed on `main` ([job 1977041561](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1977041561)) with: ``` === FAIL: pkg/trace/writer TestTraceWriterMultipleEndpointsConcurrent (5.11s) trace_test.go:172: Received unexpected error: gzip: invalid header panic: runtime error: invalid memory address or nil pointer dereference compress/gzip.(*Reader).Read(0x0, ...) io.ReadAll -> writer.payloadsContain (trace_test.go:175) ``` The error was checked with `assert.NoError`, so the helper continued with a nil `*gzip.Reader` and segfaulted. The panic then made the harness abort the reruns — `ERROR rerun aborted because previous run had a suspected panic and some test may not have run` — so `--rerun-fails=2` and test-washer were bypassed and one rare flake failed the entire job. This PR only removes the panic, so the next occurrence reports the assertion, gets retried, and stays diagnosable. ### Describe how you validated your changes - `dda inv test-new --targets=./pkg/trace/writer --race` → PASSED - Targeted `-test.v` run of every test that exercises the three helpers (`TestStatsWriter`, `TestStatsSyncWriter`, `TestStatsWriterInfo`, `TestTraceWriter`, `TestTraceWriterMultipleEndpointsConcurrent`, `TestTraceWriterV1`, `TestTraceWriterV1PayloadSplitting`) → all PASS - `gofmt -l pkg/trace/writer/` clean - Reproduction attempt for the underlying flake: race-instrumented package binary, 240 full-suite runs, 6 concurrent copies on 16 cores — 0 failures, so the flake is well below 1-in-240 on macOS/arm64 and the fix cannot be validated by reproducing the original panic locally. ### Additional Notes Co-authored-by: andrew.glaude <andrew.glaude@datadoghq.com>
### What does this PR do? We now have our team @DataDog/agent-anomaly-detection, updated code owners and other files for this. ### Motivation ### Describe how you validated your changes ### Additional Notes Co-authored-by: celian.raimbault <celian.raimbault@datadoghq.com>
mergeRuntimeProperties copies each component of the existing BOM before enriching it, but the copy shared the Properties slice backing array. When the component already carried a runtime property, which is the case on every merge round after the first, updateProperty replaced the entry in place and the write landed in the caller's BOM. The only caller passes a BOM freshly decompressed from the image entity, so the payloads the Agent sends today are correct. Cloning the slice keeps that true for the next caller. Co-authored-by: david.ducolombier <david.ducolombier@datadoghq.com>
The loader stats a configuration file, reads it, then parses whatever it got. A read that fails, typically a permission denied on a root-owned kubeconfig, went to the errors list alone. Parsing an empty read yields an empty configuration, matching a file that really is empty, and the errors list stays out of reach of the rules. So an unreadable file quietly became a file holding nothing. detectManagedEnvironment falls back to the kubelet kubeconfig to recognize an EKS, GKE or AKS control plane when the node labels say nothing, and it walked the three empty maps of a manufactured kubeconfig to conclude that the node was unmanaged. Content that could not be read is now left out rather than parsed, so the detection sees an absent kubeconfig rather than invented evidence. Such a node is still reported as unmanaged: classifying it needs a resource type the rule set would have to define, which is a separate matter. The ownership and permissions from the stat are kept, which also fixes the benchmarks looking at them. They used to see a mode of zero for an unreadable kubelet configuration file and pass. Updates CSPDE-1519. Co-authored-by: david.ducolombier <david.ducolombier@datadoghq.com>
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? On AIX, use `gotestsum` binary directly rather than through bazel. ### Motivation (Re-)enable running unit tests on AIX. ### Describe how you validated your changes Manual validation on an AIX host. A follow-up PR will add a CI job running unit tests on an AIX host. ### Additional notes Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>
…55263) <!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Adds retry-with-backoff to the External Metrics Provider startup. A transient APIServer failure during setup is now retried up to a configurable number of times before giving up, instead of failing once and silently leaving the server down. Also adds three new settings under external_metrics_provider: `startup_retries` (default 5), `startup_retry_delay` (default 2s), and `startup_retry_max_delay` (default 30s). The HPA gvr discovery had to be moved into the `setupAPIServerDeps` step, so that it can also be retried on a failure. ### Motivation https://datadoghq.atlassian.net/browse/CONTINT-5549 https://dd.slack.com/archives/C4TQDFK1P/p1787167225579619 ### Describe how you validated your changes Added unit tests specifically exercising the retry setup function. ### Additional Notes Co-authored-by: jon.rosario <jon.rosario@datadoghq.com>
### What does this PR do? The value being set must match the type of the setting. This commit fixes invalid calls to set and a few invalid types in the schema. Co-authored-by: maxime.mouial <maxime.mouial@datadoghq.com>
Feature detection reports this with log.Infof, but it runs while the configuration is still loading, so the message is buffered and only filtered against the final log level once the logger is installed. On an Agent running at log_level warn it is discarded and never written anywhere. The condition deserves a warning. On Unix socket.IsAvailable calls a socket unreachable only when the dial fails with a permission error, so the Agent user cannot open it and container metrics, container image collection and container image vulnerability scanning are all silently disabled. Windows also counts a pipe that is merely busy, but a pipe the Agent cannot open in half a second is worth surfacing too. Co-authored-by: david.ducolombier <david.ducolombier@datadoghq.com>
### What does this PR do? - Adds `/opt/datadog-agent/.dd-agent-identity` file created by the user `dd-agent` so `stat` operations - Makes `GetAgentUserGroupIDs` fallback on the marker if `dd-agent` doesn't exist ### Motivation In current agent deployments, the image `/etc/passwd` is overwritten by the node's for process checks. the `dd-agent` disappears and cannot be found by `user.Lookup` calls. The marker is a temporary solution while operator/process discovery can mount `/etc/passwd` somewhere without masking image users ### Describe how you validated your changes ### Additional Notes Co-authored-by: theo.demagalhaes <theo.demagalhaes@datadoghq.com>
…5587) ### What does this PR do? Request 64Gi for `.bazel:coverage:linux`, **restoring** 4Gi per concurrent action. ### Motivation `bazel:coverage:linux-amd64` failed 3 attempts in a row on #55574, a 22-module `aws-sdk-go-v2` bump ([example](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1993173424)): ``` ERROR: GoLink .../cwsinstrumentation_test_dca failed: (Segmentation fault) runtime: memory allocated by OS [0x0, 0x323d55da6080) not in usable address space: fatal error: unexpected signal during runtime execution [signal SIGSEGV] runtime.(*mheap).sysAlloc ``` Three tests were also killed at the 600s **timeout** having emitted no output, though each passes in under a second locally under the very same `bazel coverage` command. `.bazel:runner:linux-*` requests 8 CPUs and 32Gi. `.bazel:coverage:linux` overrides the CPU request to 16, which `--jobs=$KUBERNETES_CPU_REQUEST` follows, yet leaves memory untouched: 2Gi per concurrent action, half of what `.bazel:test:linux` gets, for the one job pairing coverage instrumentation with the **way more demanding** `--config=gorace`. Cold caches expose it, as that bump invalidated ten large generated service clients at once (`ec2`, `s3`, `ssm`, `rds`, `eks`, ...): every slot held a multi-minute compile and the action counter advanced by 121 in 44 minutes. ### Describe how you validated your changes `extends` lists `.bazel:coverage:linux` last, so its `variables` win over the runner's, as the observed `--jobs=16` already demonstrates. ### Additional Notes Lowering `--jobs` back to 8 would equally relieve the pressure, at the cost of the parallelism the job was granted in #54613. `.bazel:coverage:macos` passes no `--jobs`, letting Bazel size the pool from the host, so it needs nothing here. Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>
### What does this PR do? - adds `seLinuxOptions` to relevant paths + prepare helm changes for when PR is merged ### Motivation Mention and adapt manifests to support SELinux in default configs ### Describe how you validated your changes ### Additional Notes Co-authored-by: theo.demagalhaes <theo.demagalhaes@datadoghq.com>
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Bump devenv version in workspace config ### Motivation ### Describe how you validated your changes ### Additional Notes Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com> Co-authored-by: kevin.fairise <kevin.fairise@datadoghq.com>
…5496) <!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Update Gitlab config to run as allowed to fail the MacOS job on main. Just to stress test the system. There is also a small trick to make sure we skip the main runs if we disable the MacOS pooling through the feature flag. Otherwise we're going to consume all the MacOS pool very fast ### Motivation EUDM folks want to start running MacOS job on all the branches containing `macos` in the name. Before doing we'd rather stress test it a bit. ### Describe how you validated your changes ### Additional Notes Co-authored-by: kevin.fairise <kevin.fairise@datadoghq.com>
…55310) ### What does this PR do? Adds `nodetreemodel.DirectBulkSet` to `model.Writer`, taking a whole resolved snapshot (`[]model.DirectSetting`) in one pass. Unlike `Set` it accepts `SourceEnvVar` and skips change notifications, so it exists for config streaming and nothing else should call it. A key absent from the client's schema is warned and stored rather than dropped, matching the YAML loader, so the client mirrors the sender. Incremental updates still go through `Set`, so notifications continue to reach registered receivers. ### Motivation Remote agents (trace-agent, process-agent, security-agent, system-probe) disable their own env-var layer and instead mirror the core agent's resolved config over configstream, keeping each setting's original source. Env vars are set on the core agent's process, so a faithful mirror has to write those settings as `SourceEnvVar` — but `nodetreemodel.Set` refuses to write that layer, since it's normally populated by reading the process's own environment. So today every env-var-sourced setting in a snapshot is dropped: the remote agents silently diverge from the core agent's config, and it was one of the largest sources of configstream error-log noise in staging. The fix is a separate ingestion path that accepts the real source, leaving `Set`'s guardrail in place for direct callers. ### Describe how you validated your changes Ran a real configstream session locally: core agent with `DD_LOG_LEVEL`, `DD_TAGS`, `DD_APM_ENV` and `DD_APM_MAX_MEMORY` set, and a trace-agent started with an empty environment (the consumer disables its own env-var layer, so anything env-sourced it ends up with can only have come from the stream). - 2136 settings applied in ~84ms, zero `"Writing to env var layers is not allowed..."` errors. - All four landed: the trace-agent logs at DEBUG, and `/info` reports `default_env = livetest-env` (from the nested `apm_config.env`) and `max_memory = 300000000`. - Live updates still take effect: `agent config set log_level info` arrived as a `ConfigUpdate` and silenced the trace-agent's DEBUG lines. - `TestDirectBulkSet` pins precedence (a `SourceFile` write loses to an existing `SourceAgentRuntime` value in the same call) and unknown-key storage. Also ran `dda inv linter.go`, `dda inv test` and `dda inv tidy`, all passing. Co-authored-by: rahul.kaukuntla <rahul.kaukuntla@datadoghq.com>
### What does this PR do? Pick up NCM eviction configurations from the datadog.yaml. Use these values in the eviction function. Call the eviction function after we write to the db to ensure that we do not exceed memory constraints. Evictions are tracked under a new Datadog internal metric: `datadog.ncm.store.configs_evicted` ### Motivation ### Describe how you validated your changes ### Additional Notes ### Local Validation That datadog.yaml is read correctly set `dev/dist/datadog.yaml`: ``` log_level: debug api_key: *** dd_url: 'https://dd.datad0g.com/' hostname: "sophie-local" process_config: process_collection: enabled: true network_devices: config_management: rollback: enabled: true store: min_configs_per_device: 2 max_configs_per_device: 24 max_raw_config_store_bytes: 2000000000 ``` run commands: ``` dda inv agent.build --build-exclude=systemd ./bin/agent/agent run -c ./bin/agent/dist/datadog.yaml ``` View debug logs: <img width="1439" height="61" alt="Screenshot 2026-06-23 at 11 59 38 AM" src="https://github.com/user-attachments/assets/c2f526a1-76e4-407e-9569-be1adc573112" /> ### CML eviction e2e test Confirmed eviction order with simulation on CML - set low number of bytes for store config - change configuration of network device, expecting removal of configurations in alignment with eviction policy - check evicted uuids in logs, confirm that inventory_reported_at does not continue to update for evicted configs in orgstore ### QA flow in CML (Conducted on latest implementation) Connect to ndm-lab wifi. Configure agent on laptop to point towards Arista device. Run agent on local branch: ``` dda inv -e agent.build sudo ./bin/agent/agent run -c ./bin/agent/dist/datadog.yaml ``` Ssh into Arista device, change hostname: ``` enable configure terminal hostname <new_hostname> end write memory ``` Inspect local ncm_config.bd file with ncmshow tool. Inspect payloads emitted: `sudo ./bin/agent/agent stream-event-platform --type ndmconfig` ### QA flow in CML (Conducted on initial implementation) 1) Configure datadog.yaml file inside of CML yaml file for test case, import lab to CML 2) Make needed configuration changes for test case 3) Validate Boltdb state with the following steps: ssh into vm running agent in cml, display device_config.db in cml as base 64: `sudo base64 /opt/datadog-agent/run/ncm_config.db` copy and paste the db output into a .txt file in local computer convert to a bin file: `base64 -d ~/Documents/cml_boltdb.txt > ~/Documents/cml_boltdb.bin` explore file using ncm show: ``` cd ~/go/src/github.com/DataDog/ndm-tools/ncmshow ./ncmshow ~Documents/cml_boltdb.bin ``` ### Manual test cases 1) Set configuration to: min_configs_per_device: 1, max_configs_per_device: 24, max_raw_config_store_bytes: 8 Get BoltDB state: <img width="849" height="88" alt="Screenshot 2026-08-05 at 9 51 16 AM" src="https://github.com/user-attachments/assets/68b152bf-a4d2-4208-9651-84d014c6177d" /> Change hostname Get BoltDB state: <img width="850" height="92" alt="Screenshot 2026-08-05 at 9 51 23 AM" src="https://github.com/user-attachments/assets/bbffc9bb-ca2f-46b1-8c12-9996c39ae3ca" /> (Should see 2 configs per device, even though min configs is set to 1 it should get overridden to 2. Min configs should override the config store requirement - will see that even after eviction not within this setting.) - note here, old running config was evicted so that the modified one could be stored <img width="969" height="531" alt="Screenshot 2026-08-05 at 10 12 01 AM" src="https://github.com/user-attachments/assets/72e3942e-8cf5-43eb-9b65-21e1de3a3855" /> 2) Set configuration to: min_configs_per_device: 1, max_configs_per_device: 3, max_raw_config_store_bytes: 1000000 Change hostname Change hostname <img width="561" height="605" alt="Screenshot 2026-08-05 at 12 32 52 PM" src="https://github.com/user-attachments/assets/96d92227-ed84-4dcf-857b-8ad2d94adddb" /> Get BoltDB state: <img width="853" height="138" alt="Screenshot 2026-08-05 at 12 32 43 PM" src="https://github.com/user-attachments/assets/24adf9c7-a637-443c-80c3-ea50b14a23ad" /> BoltDB only has 3 max configs for evictionCML2:10:10:1:2 even though there is enough space in the (db only 66000 bytes) because of the upper max_raw setting. Co-authored-by: sophie.ruetschi <sophie.ruetschi@datadoghq.com>
…ake (#55585) ### What does this PR do? Match `countingForwarder`'s sketch counter on the sketch-series intake endpoint instead of any endpoint whose name contains "sketch". ### Motivation Despite #54469, `TestStopDrainsBeforeFlush` still fails at times ([example job output](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1993173424), [Flaky Management dashboard](https://app.datadoghq.com/ci/ci-cd/flaky-management/explorer?query=fingerprint_fqn%3A60e9b51ef57d69be&sort=-impact&viewMode=flaky)) with: ``` FAIL //pkg/serverless/metrics:metrics_test :: TestStopDrainsBeforeFlush type: assertion metric_test.go:150: Not equal:, expected: 100, actual : 101, every AddEnhancedMetric followed by Stop() must produce exactly one sketch flush ``` => an _over_-count, where #54469 fixed an _under_-count. It turns out that `buildPipelinesRng` adds a second pipeline shipping a duplicate of every sketch payload to the `v3beta` validation route, on a per-flush coin flip whose default rate is 0.001[^1] and whose default site allow-list matches the fake `datadoghq.com` resolver the test installs. 💡 That endpoint is named `sketches_v3beta`, so the substring match **takes it for an extra flush**. `TestWaitForPendingSamplesDrainsThroughWrappedDemux` asserts the same exact count and is [equally affected](https://app.datadoghq.com/logs?query=service%3Agitlab-ci%20%40ci.pipeline.name%3A%22DataDog%2Fdatadog-agent%22%20FAIL%20%28TestStopDrainsBeforeFlush%20OR%20TestWaitForPendingSamplesDrainsThroughWrappedDemux%29&agg_m=count&agg_m_source=base&agg_t=count&clustering_pattern_field_path=message&cols=host%2Cservice%2Cci.node.name&index=ci-app-pipeline-logs-gitlab-datadog-agent&messageDisplay=inline&refresh_mode=sliding&storage=hot&stream_sort=time%2Cdesc&viz=stream&from_ts=1787324973736&to_ts=1787929773736&live=true), hence the fix sits in the shared forwarder rather than in one test. ### Describe how you validated your changes A stack trace per submission shows both copies leaving a single `SendSketch` call, and forcing `sketches.shadow_sample_rate` to 1.0 counts 200 sketches for 100 iterations before, 100 after. Before, under `--config=gorace --runs_per_test=30`, `TestStopDrainsBeforeFlush` failed 7 times and `TestWaitForPendingSamplesDrainsThroughWrappedDemux` 2 times. After, 60 runs of the whole package pass under race and 20 without, along with `//pkg/aggregator/...` and `//pkg/serializer/...`. ### Additional Notes Naming the one authoritative route keeps any future duplicate, shadow or otherwise, out of the count by construction. Should the sketches v3 rollout make `sketches_v3` authoritative, every run counts 0 and fails outright rather than flaking. [^1]: the low rate is why it went unnoticed for 18 days rather than being caught by #54581's own pipeline: - at 1.0 that PR's CI would have gone red on the spot, - at 0.001[^1] it slipped through review, through the author's local runs, and through every serverless CI run until the dice came up. Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>
…5552) ## What this change does Adds target in `cmd/agent/selinux/BUILD.bazel` that compiles `system_probe_policy.te` into a packaged `system_probe_policy.pp` policy module. Based on tasks/selinux.py%compile_system_probe_policy_file` This PR only adds the new Bazel target as a parallel, currently-unused path — it does **not** change omnibus to call it. Wiring `omnibus/config/software/datadog-agent.rb` to use this genrule instead of the `dda inv` task is left as a separate, riskier follow-up PR, per the "small tactical PRs" approach used across the omnibus deprecation effort. ## Motivation ## How did you validate this - CI This session ran on macOS, where the SELinux userspace tools (`checkmodule`, `semodule_package`) are not available and cannot reasonably be installed, so **the genrule's actual compilation was NOT tested/run locally**. What was validated on macOS: - `bazel query //cmd/agent/selinux:all` — target parses and is discoverable. - `bazel build --nobuild //cmd/agent/selinux:system_probe_policy_pp` — correctly reports the target as platform-incompatible on macOS (proves the `target_compatible_with` constraint works as intended). - `bazel build --nobuild --platforms=@rules_go//go/toolchain:linux_amd64 //cmd/agent/selinux:system_probe_policy_pp` — analysis phase succeeds for the Linux platform (target configures correctly; no actions were executed since `--nobuild` was used). - `bazel run //bazel/buildifier` — no formatting complaints. - Hand validate on linux ``` bazel build //cmd/agent/selinux/... Target //cmd/agent/selinux:system_probe_policy up-to-date: /var/cache/dd/bazel/_bazel_root/81a15fa9a2846e82038a778136785275/execroot/_main/bazel-out/aarch64-fastbuild/bin/cmd/agent/selinux/system_probe_policy.pp ``` ## Future steps Add this target somewhere in //packages/agent and eliminate the dda call from omnibus/config/software/datadog-agent.rb. Generated with [Claude Code](https://claude.com/claude-code), but then I had to rewrite it. Co-authored-by: tony.aiuto <tony.aiuto@datadoghq.com>
) <!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Inlines `LookupStandard` to hold `s.RLock()` for the entire operation (store lookup + `getStandard()`), instead of calling `getEntityTags` (which releases the `RLock` before returning) and then reading `e.sourceTags` unlocked. ### Motivation `LookupStandard` called `getEntityTags` (which acquires `RLock`, gets the pointer, releases, returns) then called `getStandard()` on the returned pointer without the lock. `getStandard()` iterates `e.sourceTags`, which is written by `setTagsForSource` under `s.Lock()` in `ProcessTagInfo`. The read and write of `e.sourceTags` race: ``` WARNING: DATA RACE Write at ... by goroutine 556: (*EntityTagsWithMultipleSources).setTagsForSource() entity_tags.go:235 ... tagstore.ProcessTagInfo -> WorkloadMetaCollector.processEvents -> stream Previous read at ... by goroutine 870: (*EntityTagsWithMultipleSources).getStandard() entity_tags.go:116 ... tagstore.LookupStandard -> localTagger.Standard -> ServiceNameFromTags -> tailerfactory.defaultSourceAndService ``` ### Describe how you validated your changes CI ### Additional Notes `LookupHashed` and `LookupHashedWithCompleteness` already hold `s.RLock()` for the whole operation — this brings `LookupStandard` in line with them. Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>
### What does this PR do? Back-fills the otel-agent's core config path with the default `datadog.yaml` location on Linux when neither `--core-config` nor `DD_CORE_CONFIG` was supplied, mirroring what `command_windows.go` already does. The fallback is gated twice: - **The file must exist.** `loadCustom` propagates the `ReadInConfig` error (`pkg/config/setup/config.go:527`), so an unconditional default would turn a working collector into a boot loop for every deployment that legitimately has no core Agent (gateway mode, BYOC, standalone on a bare host). - **`DD_OTEL_STANDALONE` opts out.** The dedicated otel-agent image bakes that var in and is built `FROM` the Agent image, so without this it could pick up a `datadog.yaml` left in place by an entrypoint script. The env var is read directly because the config is not loaded yet at this point. ### Motivation [OTAGENT-1268](https://datadoghq.atlassian.net/browse/OTAGENT-1268). DDOT cannot reach the core Agent in Docker, ECS, and ECS Fargate: ``` grpc: addrConn.createTransport failed to connect to {Addr: "localhost:5001" ...} tls: failed to verify certificate: x509: certificate signed by unknown authority ``` Without a core config, `NewConfigComponent` (`cmd/otel-agent/config/agent_config.go:113`) skips `LoadDatadog` entirely. The IPC cert and auth token then resolve against the process working directory instead of `/etc/datadog-agent`, so the collector mints its own CA and the handshake fails. Skipping `LoadDatadog` also skips `DetectFeatures()` and `ApplyOverrideFuncs()`, which run in its `defer`. Only the two container entrypoints are affected. Every other launcher already passes the flag: | Launcher | `--core-config` | |---|---| | `packages/ddot/{debian,redhat}/*` | yes | | `pkg/fleet/installer/.../processes.d/datadog-agent-ddot.yaml` | yes | | Helm / Operator | yes | | Windows (`command_windows.go:40`) | yes, back-filled | | `Dockerfiles/agent/s6-services/otel/run` | no | | `Dockerfiles/agent/entrypoint.d/otel-agent` | no | | `Dockerfiles/otel-agent/Dockerfile` (standalone) | no, intentionally | The fix lands in the `run` command's `RunE`. Since the root command is a shallow copy of it (`cmd/otel-agent/command/command.go:70`), this covers both `otel-agent --config ...` (containers) and `otel-agent run --config ...` (packages). ### Describe how you validated your changes Validated with unit tests and running locally in a Docker container (with and without `DD_OTEL_STANDALONE`) ### Additional Notes - `otel_standalone` still defaults to `false` (`pkg/config/setup/all_settings.go:1004`), so this is live for all connected-mode container users today, not only those who set `DD_OTEL_STANDALONE=false` explicitly. - I deliberately did **not** add `--core-config` to the entrypoint scripts. That is less safe than the gated Go path: if the `datadog.yaml` symlink is not in place yet the collector hard-fails, and `s6-services/otel/finish` restart-loops it every 2s. [OTAGENT-1268]: https://datadoghq.atlassian.net/browse/OTAGENT-1268?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: stanley.liu <stanley.liu@datadoghq.com>
…5582) ### What does this PR do? Replace `github.com/goccy/go-yaml` with `go.yaml.in/yaml/v3` in the 3 test files that use it, and drop the now-unused dependency from `go.mod`. ### Motivation Finish removing one of our many YAML dependencies, therefore completing: - #46070. `goccy/go-yaml`'s main [stated rationale](https://github.com/goccy/go-yaml#why-a-new-library) for existing was that `go-yaml/yaml` was unmaintained and offered no AST-level access for reversible transformations. Both are addressed today: `go.yaml.in/yaml` is the actively maintained fork, and its `yaml.Node` type supports the same tag, comment, and style preserving round-trip that `scanner_test.go` needed `goccy`'s `ast` and `token` packages for. ### Additional Notes As [spotted by Codex](#55582 (comment)), regenerating `testdata/symbols.yaml` was unavoidable because `go.yaml.in/yaml/v3`'s encoder has no public option to reproduce `goccy`'s exact output: there is no way to add artificial indentation to a root-level sequence, and its scalar quoting is more canonical than `goccy'`s, only quoting where the YAML spec actually requires it. Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>
…ndpoint (#55591) Fix the `connectivityCheck` Private Action failing on large subnets by clearing the `server_timeout` deadline in the connectivity check endpoint. The CMD API server arms a write deadline on the connection for every request (`server_timeout`, 30s by default, via `TimeoutHandlerFunc` in `comp/api/grpcserver/helpers/grpc.go`). A connectivity check over a large subnet outlives it, so the response write fails and the connection is torn down mid-scan. - **Previously**: running the action on a `10.0.0.0/23` failed after 2-4 minutes with `failed to run connectivity checks: failed to reach the Agent: Post "https://localhost:5001/agent/networkdevices/connectivity-check": local error: tls: bad record MAC`. A `10.0.0.0/29` worked, because it completes well under 30s. - **Now**: the endpoint clears the deadline before running the checks, the same way the flare, diagnose and log-stream endpoints already do. The error is misleading because it doesn't surface as a timeout. `writeRecordLocked` encrypts a record — advancing the TLS sequence number — *before* writing it, so the write failing on the expired deadline leaves the sequence number ahead of what actually reached the wire. `closeNotify` then re-arms the deadline and successfully sends `close_notify` at the advanced sequence number, which the client authenticates at the old one and rejects with `bad_record_mac`. The timing tracks the scan duration rather than `server_timeout` because nothing is written at the 30s mark. Extending the deadline instead of clearing it wouldn't help: any finite value just moves the same failure to a larger subnet, since a connection deadline can't fail gracefully. Bounding belongs at the context level, and the caller already provides it — `private_action_runner.task_timeout_seconds` cancels the request, which cancels the handler's errgroup. Related: #52174 (original implementation). ## Validation - `bazel test //comp/networkdevices/impl:impl_test` passes. - Checked the cancellation path in a standalone harness replicating the server wiring (`ConnContext` + `TimeoutHandlerFunc` + forced-`h2` TLS), with 10s of work and a 1s client timeout: the handler observes cancellation at 1.02s both with and without the deadline cleared. So clearing it doesn't leave the check running unbounded once the caller gives up. - <screenshot: `connectivityCheck` action run against a `10.0.0.0/23`, completing successfully> 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: pierre.lin <pierre.lin@datadoghq.com>
…hen feature branch already exists (#55523) <!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? In the PR creation step, sets the `base` branch to the branch where the workflow is from. ### Motivation By default, `base` is set to the current branch but if the branch passed as an input already exists, the prior step will checkout to the same branch and fail the PR creation. ### Describe how you validated your changes Cannot really test it because the workflow cannot get the permissions when run from branches other than `main` and release branches. ### Additional Notes Co-authored-by: maxime.chambre <maxime.chambre@datadoghq.com>
…re-gcp (#55549) <!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Use `serverless-azure-and-gcp` team instead of `serverless-azure-gcp` as owners. ### Motivation `serverless-azure-and-gcp` is an automatically managed, up to date team while `serverless-azure-gcp` is deprecated. ### Describe how you validated your changes ### Additional Notes Co-authored-by: duncan.harvey <duncan.harvey@datadoghq.com>
### What does this PR do? Tightens `ProcessState::can_transition_to` so it only allows transitions that production code actually uses. Removes eight unused shortcut edges (e.g. `Created → Running`, `Exited → Running`, `Stopping → Exited`) and drops redundant doc comments on the enum variants. ### Motivation The transition table included paths that never occur in runtime code. Every spawn goes through `Starting`, every restart re-enters via `Starting`, and `set_last_status` always maps `Stopping` to `Stopped`. The extra edges made the state machine harder to reason about and could mask invalid transitions in tests. ### Describe how you validated your changes - `cargo test -p dd-procmgrd` (full unit test suite) ### Additional Notes Stacked procmgr PRs that add `(Starting, Stopped)` (e.g. #55505) should rebase on this and re-add that single edge to `can_transition_to`. Co-authored-by: josemanuel.almaza <josemanuel.almaza@datadoghq.com>
…55186) <!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Renames the unreleased Baseline Dynamic Tests feature to Basic Dynamic Tests across the Agent implementation, configuration schema, payload contract, unit tests, Bazel wiring, and E2E coverage. - Renames `baseline_tests_enabled` to `basic_tests_enabled`. - Renames the dynamic test profile from `baseline` to `basic`. - Keeps the selection budget at five high-volume paths per Agent per window. - Removes the old names without compatibility aliases because this is a new configuration that has not been released and is not used by any customers yet. ### Motivation Align the Agent with the updated [Basic Dynamic Tests for CNM RFC](https://datadoghq.atlassian.net/wiki/spaces/NP2/pages/7091453953/RFC+Basic+Dynamic+Tests+for+CNM) and use terminology that better describes the included, limited-coverage mode. ### Describe how you validated your changes - `bazel test //comp/networkpath/npcollector/impl:impl_test //comp/rdnsquerier/impl:impl_test //pkg/networkpath/payload:payload_test` - `git diff --check` - Verified the RFC consistently states five paths and uses the Basic configuration name. ### Additional Notes No backward compatibility is needed: the configuration is new, has not been released, and no customers are using it yet. Co-authored-by: alexandre.yang <alexandre.yang@datadoghq.com>
### What does this PR do? Those artifact will be picked up by the release temporal pipeline to open PRs against different repos. Co-authored-by: rahul.kaukuntla <rahul.kaukuntla@datadoghq.com>
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Post performance PR comment for trace-agent benchmarks. ### Motivation pr-commenter from BP no longer works in dd-agent repo after removal of PR Commenter Datadog App. This PR fixes PR commenting. ### Describe how you validated your changes PR comment is present on PR that runs trace-agent benchmarks. Co-authored-by: dmytro.yurchenko <dmytro.yurchenko@datadoghq.com>
### What does this PR do? Registers the Private Action Runner signing-key callback as a Remote Config listener during `Fx` construction instead of subscribing after the runner starts. This significantly speeds up key retrieval and therefore runner readiness. This applies to both the current monolith and upcoming split mode PARs: - the monolith registers before its Remote Config client starts polling; - a cold split-mode executor registers with the Core Agent before it needs the current `AP_RUNNER_KEYS` snapshot. Registering early prevents the runner from missing the initial key callback and waiting for a later Remote Config polling cycle. ### Motivation Signing keys gate runner readiness. If registration happens after the Remote Config client has already delivered its initial snapshot, the monolith or split executor can remain blocked until the next poll. The monolithic E2E confirmed the runner becomes ready through the eager listener path. In the deployed split-mode E2E, a cold executor received the existing key snapshot and became ready about 175 ms after process spawn. ### Describe how you validated your changes - `dda inv test --targets=./comp/privateactionrunner/fx,./comp/privateactionrunner/impl,./pkg/privateactionrunner/task-verifier` - Local Pulumi monolithic E2E using Agent and Fake Intake artifacts from pipeline `133978527`: - `TestLinuxPrivateActionRunnerEnabledSuite/TestPrivateActionRunnerStartsWhenEnabled` - Passed and reached `Keys manager ready` through the eager listener path. - Local Pulumi split-mode E2E using the same pipeline artifacts: - `TestLinuxPARSplitSuite/TestSplitControlPlaneEndToEnd` - Passed with real ED25519 task verification, key rotation/revocation, and cold executor restart. - Initial cold executor became ready about 175 ms after process spawn. ### Additional Notes Extracted from the Private Action Runner split-deployment stack so it can merge independently. Co-authored-by: ilya.rubnich <ilya.rubnich@datadoghq.com>
### What does this PR do? - adjusts the memory limit for the `logs` quality gate given the new buffer for the `memory_allotment` ### Motivation In the last PR (#55517), the `memory_allotment` buffer was recalculated to be 30% across the board for quality gates. The original 20% buffer for the `logs` quality gate resulted in better performance for the Agent because of the downwards pressure from the OS/etc. `memory_allotment` in memory bound quality gates should not be a lever that is used to gain performance. It's something that SMP needs to tackle. ### Describe how you validated your changes A nightly sized job was run with this configuration exactly on `agent-nightlies`, the `job_id` is: `70d20df4-9c79-4b69-a640-ce7aad1cd3e5`. ### Additional Notes N/A Co-authored-by: paul.reinlein <paul.reinlein@datadoghq.com>
### What does this PR do? Eliminates a small script by folding it into datadog-agent.rb. ### Motivation Makes reasoning about the final stages of omnibus deprecation easier. ### Describe how you validated your changes CI, no test failures. Co-authored-by: tony.aiuto <tony.aiuto@datadoghq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds
c.RLock()/defer c.RUnlock()tontmConfig.GetNode().Motivation
GetNode()readsc.rootand traverses the tree without the read lock, racing withSet()which modifies the tree under the write lock.Describe how you validated your changes
CI
Additional Notes
GetNodeis only called fromIsSetting()(no lock held), so addingRLockintroduces no deadlock risk.What does this PR do?
Motivation
Describe how you validated your changes
Additional Notes