[Backport 7.82.x] Publish datadog-fips-proxy to the pipeline testing repositories - #55563
Closed
dd-octo-sts[bot] wants to merge 1 commit into
Closed
dd-octo-sts[bot] wants to merge 1 commit into
dd-octo-sts[bot] wants to merge 1 commit into
Conversation
…) ### What does this PR do? Publishes the released `datadog-fips-proxy` package into the testing repositories of the pipelines whose install-script tests need it, so the install script resolves it from the same repository as the Agent packages built by that pipeline. ### Motivation `test_install_script` triggers the `agent-linux-install-script` pipeline with `TESTING_APT_URL` and `TESTING_YUM_URL` so the install script installs the Agent built by the pipeline. Those variables land in the apt and yum configuration, so every Datadog package the script installs is resolved against the pipeline repository — including `datadog-fips-proxy`, which is released from another repository and is not published there. Nightly and RC pipelines failed with `Error: Unable to find a match: datadog-fips-proxy`. The mitigation was to stop forwarding those variables for the FIPS test, which leaves it installing the latest stable Agent instead of the pipeline's packages. ### Describe how you validated your changes `dda inv linter.full-gitlab-ci` passes locally. The [pipeline](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/pipelines/132516692) of test commit 89fb6f4 published `datadog-fips-proxy 1:1.1.29-1` into both testing repositories alongside the Agent it built. Its yum index still lists the package after the Agent upload rewrote that index, confirming `rpm-s3` merges rather than replaces. The [job](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1974262997) that triggers the install-script pipeline against it, on the [branch](DataDog/agent-linux-install-script#446) that restores the testing-variable forwarding, ran the FIPS suite on all five of its platforms and passed. The Debian 11 [job](https://gitlab.ddbuild.io/DataDog/agent-linux-install-script/-/jobs/1974914627) installed every package from the pipeline repository: ``` Get:1 https://apttesting.***.com/datadog-agent/pipeline-132516692-a7 stable-x86_64/7 amd64 datadog-agent amd64 1:7.84.0~devel.git.171.89fb6f4.pipeline.132516692-1 [188 MB] Get:2 https://apttesting.***.com/datadog-agent/pipeline-132516692-a7 stable-x86_64/7 amd64 datadog-fips-proxy amd64 1:1.1.29-1 [7590 kB] Get:3 https://apttesting.***.com/datadog-agent/pipeline-132516692-a7 stable-x86_64/7 amd64 datadog-signing-keys all 1:1.4.0-1 [23.7 kB] --- PASS: TestInstallFipsSuite/install-fips-datadog-agent-Debian_11-132584924/TestInstallFips ``` This is the configuration that previously failed with `Error: Unable to find a match: datadog-fips-proxy`. ### Additional Notes - Merging is blocked by DataDog/agent-linux-install-script#446. - Publishing before the Agent uploads instead of after them fails safe. Were `rpm-s3` ever to replace repository metadata rather than merge into it, this order costs `datadog-fips-proxy` its index entry and the FIPS test behaves as it does today; the reverse order would drop the Agent packages and break every e2e test that consumes them. A failed download now blocks the two Agent testing uploads rather than only the install-script test. Making the job `allow_failure: true` would trade that for a silent index race. Co-authored-by: ofek.lev <ofek.lev@datadoghq.com> (cherry picked from commit c212f32) ___ Co-authored-by: Ofek Lev <ofekmeister@gmail.com>
dd-octo-sts
Bot
added
backport
bot
changelog/no-changelog
dd-octo-sts
Bot
added
short review
Contributor
Author
Gitlab CI Configuration Changes
|
| Removed | Modified | Added | Renamed |
|---|---|---|---|
| 1 | 32 | 4 | 0 |
Updated: .gitlab/distribution.yml
Removed Jobs
- .setup_github_ci_platform_machine_images_token
- generate_windows_gitlab_runner_bump_pr_manual
- generate_windows_gitlab_runner_bump_pr
Changes Summary
| Removed | Modified | Added | Renamed |
|---|---|---|---|
| 3 | 0 | 0 | 0 |
ℹ️ Diff available in the job log.
Contributor
Author
Files inventory check summaryFile checks results against ancestor 8a0700e8: Results for datadog-agent_7.82.3.git.3.4de8a79.pipeline.133801846-1_amd64.deb:No change detected |
chouetz
approved these changes
Aug 31, 2026
Collaborator
|
/merge |
|
View all feedbacks in Devflow UI.
You are not allowed to use the merge queue towards |
Collaborator
|
This is no longer necessary. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport c212f32 from #54908.
What does this PR do?
Publishes the released
datadog-fips-proxypackage into the testing repositories of the pipelines whose install-script tests need it, so the install script resolves it from the same repository as the Agent packages built by that pipeline.Motivation
test_install_scripttriggers theagent-linux-install-scriptpipeline withTESTING_APT_URLandTESTING_YUM_URLso the install script installs the Agent built by the pipeline. Those variables land in the apt and yum configuration, so every Datadog package the script installs is resolved against the pipeline repository — includingdatadog-fips-proxy, which is released from another repository and is not published there. Nightly and RC pipelines failed withError: Unable to find a match: datadog-fips-proxy.The mitigation was to stop forwarding those variables for the FIPS test, which leaves it installing the latest stable Agent instead of the pipeline's packages.
Describe how you validated your changes
dda inv linter.full-gitlab-cipasses locally.The pipeline of test commit 89fb6f4 published
datadog-fips-proxy 1:1.1.29-1into both testing repositories alongside the Agent it built. Its yum index still lists the package after the Agent upload rewrote that index, confirmingrpm-s3merges rather than replaces.The job that triggers the install-script pipeline against it, on the branch that restores the testing-variable forwarding, ran the FIPS suite on all five of its platforms and passed. The Debian 11 job installed every package from the pipeline repository:
This is the configuration that previously failed with
Error: Unable to find a match: datadog-fips-proxy.Additional Notes
rpm-s3ever to replace repository metadata rather than merge into it, this order costsdatadog-fips-proxyits index entry and the FIPS test behaves as it does today; the reverse order would drop the Agent packages and break every e2e test that consumes them. A failed download now blocks the two Agent testing uploads rather than only the install-script test. Making the joballow_failure: truewould trade that for a silent index race.