WIF-48: wire delegated auth into OTel agent - #55481
Draft
wynbennett wants to merge 5 commits into
Draft
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d6a4dc1d35
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| pidfx.Module(), | ||
| fx.Supply(pidimpl.NewParams(params.pidfilePath)), | ||
| fx.Provide(func(c defaultforwarder.Component, cfg coreconfig.Component, l log.Component, sec secrets.Component) (defaultforwarder.Forwarder, error) { | ||
| fx.Provide(func(c defaultforwarder.Component, cfg coreconfig.Component, l log.Component, sec secrets.Component, delegatedAuth delegatedauth.Component) (defaultforwarder.Forwarder, error) { |
There was a problem hiding this comment.
When the synchronous forwarder is used with delegated authentication, this parameter is always the no-op implementation: the same Fx graph still installs delegatedauthnoopfx.Module() below, and NewConfigComponent loads the configuration with DelegatedAuthNoop. Consequently no delegated-auth instance fetches or refreshes an API key, so passing the component to NewOTelSyncForwarder does not enable the advertised authentication path and affected exports continue to fail authorization. Instantiate the real delegated-auth component before configuration loading and supply that same instance to the forwarder.
Useful? React with 👍 / 👎.
Contributor
Author
There was a problem hiding this comment.
Fixed in commit d52fb48. runOTelAgentCommand now creates the real delegated auth component (delegatedauthimpl.NewComponent()) before calling NewConfigComponent, so DELA directives are discovered during config loading. The same instance is supplied to the fx graph via fx.Supply(delegatedAuthComp), replacing the previous delegatedauthnoopfx.Module() in both standalone and connected agent paths. NewConfigComponent now accepts a delegatedauth.Component parameter and passes it to LoadDatadog instead of the noop type.
wynbennett
marked this pull request as draft
August 26, 2026 19:56
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 26, 2026 20:58
d6a4dc1 to
776fea3
Compare
wynbennett
changed the base branch from
main
to
wyn.bennett/wif-credential-provider-consumers
August 26, 2026 20:59
Contributor
Go Package Import DifferencesBaseline: d725d90
|
This comment has been minimized.
This comment has been minimized.
Contributor
Files inventory check summaryFile checks results against ancestor c35c49a9: Results for datadog-agent_7.84.0~devel.git.608.4224b16.pipeline.134054631-1_amd64.deb:Detected file changes:
|
Contributor
Static quality checks❌ Please find below the results from static quality gates Error
Gate failure full details
Static quality gate failures prevent this PR from merging! Successful checksInfo
|
Regression DetectorRegression Detector ResultsMetrics dashboard Baseline: d725d90 Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | dsd_uds_10mb_3k_timestamped_contexts_cpu | % cpu utilization | +2.05 | [+1.80, +2.30] | 1 | Logs |
| ➖ | dsd_uds_10mb_3k_timestamped_contexts_memory | memory utilization | +1.31 | [+1.10, +1.53] | 1 | Logs |
| ➖ | quality_gate_logs | % cpu utilization | +0.85 | [-0.02, +1.72] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle | memory utilization | +0.78 | [+0.73, +0.82] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_no_fs_load | memory utilization | +0.53 | [+0.45, +0.61] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_private_action_runner | memory utilization | +0.35 | [+0.22, +0.47] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_mean_fs_load | memory utilization | +0.30 | [+0.26, +0.34] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle_all_features | memory utilization | -0.08 | [-0.12, -0.05] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_idle | memory utilization | -0.09 | [-0.13, -0.04] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_metrics_logs | memory utilization | -0.93 | [-1.16, -0.70] | 1 | Logs bounds checks dashboard |
Bounds Checks: ✅ Passed
| perf | experiment | bounds_check_name | replicates_passed | observed_value | links |
|---|---|---|---|---|---|
| ✅ | quality_gate_idle | intake_connections | 10/10 | 4 = 4 | bounds checks dashboard |
| ✅ | quality_gate_idle | memory_usage | 10/10 | 175.04MiB ≤ 179MiB | bounds checks dashboard |
| ✅ | quality_gate_idle | total_bytes_received | 10/10 | 751.60KiB ≤ 819.20KiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | intake_connections | 10/10 | 4 = 4 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | memory_usage | 10/10 | 518.99MiB ≤ 537MiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | total_bytes_received | 10/10 | 1.15MiB ≤ 1.25MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | intake_connections | 10/10 | 19 ≤ 40 | bounds checks dashboard |
| ✅ | quality_gate_logs | memory_usage | 10/10 | 211.51MiB ≤ 228MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_logs | total_bytes_received | 10/10 | 263.46MiB ≤ 292MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | cpu_usage | 10/10 | 367.10 ≤ 2000 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | intake_connections | 10/10 | 20 ≤ 40 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | memory_usage | 10/10 | 416.07MiB ≤ 455MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | total_bytes_received | 10/10 | 0.94GiB ≤ 1.04GiB | bounds checks dashboard |
| ✅ | quality_gate_private_action_runner | memory_usage | 10/10 | 72.73MiB ≤ 75MiB | bounds checks dashboard |
| ✅ | quality_gate_security_idle | cpu_usage | 10/10 | 28.77 ≤ 100 | bounds checks dashboard |
| ✅ | quality_gate_security_idle | memory_usage | 10/10 | 326.25MiB ≤ 355MiB | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | cpu_usage | 10/10 | 60.16 ≤ 200 | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | memory_usage | 10/10 | 305.62MiB ≤ 335MiB | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | cpu_usage | 10/10 | 22.36 ≤ 100 | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | memory_usage | 10/10 | 313.60MiB ≤ 345MiB | bounds checks dashboard |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
CI Pass/Fail Decision
✅ Passed. All Quality Gates passed.
- quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
5 times, most recently
from
August 28, 2026 02:24
189e8db to
a3ccb15
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 28, 2026 04:36
a3ccb15 to
5fc5a66
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 28, 2026 04:42
5fc5a66 to
35728db
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 28, 2026 14:18
35728db to
9b1def8
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 28, 2026 14:48
9b1def8 to
4af233e
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
2 times, most recently
from
August 28, 2026 16:26
5db19a4 to
5db97f9
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 28, 2026 20:36
a3df552 to
57ea406
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 28, 2026 21:09
57ea406 to
4224b16
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 31, 2026 14:36
4224b16 to
2c8db3c
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 31, 2026 15:17
2c8db3c to
b1e927e
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 31, 2026 15:38
b1e927e to
0a8ddac
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 31, 2026 15:41
0a8ddac to
1b7c68f
Compare
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 31, 2026 15:49
1b7c68f to
8233c46
Compare
Contributor
BenchmarksBenchmark execution time: 2026-08-31 18:47:08 Comparing candidate commit b1529ad in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 3 metrics, 0 unstable metrics.
|
…logs agent This PR wires the credential Provider interface from delegatedauth into the three data-plane consumers: Forwarder: - Forwarder takes credentials from providers, buffering until they resolve - Resolver discovers credential providers for each endpoint - Transactions carry credential context - OTel sync forwarder accepts a delegated auth component - HTTP transactions serializer hardened for credential backpressure Trace writers: - Trace writers take credentials from providers, holding payloads until resolve - Sender resolves credentials before forwarding - Pipeline stats skips delegated-auth endpoints (no API key) - Trace agent impl and config wiring for credential providers Logs agent: - Logs endpoints take their credential from a provider - Wire delegated auth into the logs agent end to end - Stop logs TCP from leaking the directive on the wire - Harden Authorize, fix serverless build - Logs library HTTP destination supports credential providers
Fix P1 finding from the Codex/Autotest review: the OTel agent was passing the noop delegated auth component to NewOTelSyncForwarder, so no DELA directives were ever discovered or credentials exchanged. Changes: - NewConfigComponent now accepts a delegatedauth.Component parameter and passes it to LoadDatadog instead of the noop type - runOTelAgentCommand creates the real delegatedauth component (delegatedauthimpl.NewComponent) before config loading and supplies the same instance to the fx graph via fx.Supply - Replaced delegatedauthnoopfx.Module() with fx.Supply(delegatedAuthComp) in both standalone and connected agent fx option chains - Updated BUILD.bazel deps: noop-impl/types → def, fx-noop → impl - Updated all test callers of NewConfigComponent to pass nil
NewConfigComponent gained a delegatedauth.Component parameter in PR3, but the integration test caller was not updated. Pass the noop implementation since the test doesn't exercise delegated auth.
…umers branch WIF-48
Line 163 was missed when adding the delegatedAuthComp parameter to NewConfigComponent. WIF-48
wynbennett
force-pushed
the
wyn.bennett/wif-credential-provider-otel
branch
from
August 31, 2026 18:27
9be14e9 to
b1529ad
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR wires the delegated auth component into the OTel agent so that the OTel sync forwarder can attach delegated-auth credentials to outbound requests, completing the end-to-end credential provider chain started in PRs #55479 and #55480.
What changed
The OTel agent run command (
cmd/otel-agent/subcommands/run/command.go) now injectsdelegatedauth.Componentinto the fx provide function that constructs the sync forwarder. The serializer exporter (comp/otelcol/otlp/components/exporter/serializerexporter/serializer.go) similarly acceptsdelegatedauth.Componentfrom the fx graph and passes it toNewOTelSyncForwarder, which was given adelegatedAuthparameter in PR #55480. In the test helper (exporter_test.go),nilis passed for the delegated auth component since tests do not exercise the credential provider path.Wiring
Why this is a separate PR
The OTel agent has its own BUILD.bazel targets and go.mod, and the sync forwarder signature change originates in PR #55480. Splitting the wiring into its own PR keeps the diff small and makes it easy to review the fx injection in isolation.
Architecture doc
See Delegated Authentication in the Agent: Architecture and Path Forward for the full design, including the previous approach vs. the new Provider interface, locking, and future work.
Stacked PRs
WIF-48