test(ssi): e2e tests for SSI Instrumentation Rules via Remote Config - #55057
Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 7 commits intoAug 28, 2026
Merged
Conversation
Contributor
|
🎯 Code Coverage (details) 🔗 Commit SHA: f0dc302 | Docs | View more details | Give us feedback! |
Contributor
Files inventory check summaryFile checks results against ancestor 61c8df89: Results for datadog-agent_7.84.0~devel.git.570.f0dc302.pipeline.133860985-1_amd64.deb:No change detected Results for datadog-iot-agent_7.84.0~devel.git.570.f0dc302.pipeline.133860985-1_amd64.deb:No change detected |
Contributor
Static quality checks✅ Please find below the results from static quality gates Successful checksInfo
|
Regression DetectorRegression Detector ResultsMetrics dashboard Baseline: ee726f0 Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | quality_gate_metrics_logs | memory utilization | +1.56 | [+1.33, +1.79] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_logs | % cpu utilization | +0.62 | [-0.25, +1.49] | 1 | Logs bounds checks dashboard |
| ➖ | dsd_uds_10mb_3k_timestamped_contexts_cpu | % cpu utilization | +0.59 | [+0.32, +0.85] | 1 | Logs |
| ➖ | quality_gate_private_action_runner | memory utilization | +0.27 | [+0.14, +0.39] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle_all_features | memory utilization | +0.18 | [+0.15, +0.22] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle | memory utilization | -0.00 | [-0.04, +0.04] | 1 | Logs bounds checks dashboard |
| ➖ | dsd_uds_10mb_3k_timestamped_contexts_memory | memory utilization | -0.03 | [-0.25, +0.18] | 1 | Logs |
| ➖ | quality_gate_security_no_fs_load | memory utilization | -0.08 | [-0.16, +0.01] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_idle | memory utilization | -0.16 | [-0.21, -0.11] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_mean_fs_load | memory utilization | -0.23 | [-0.26, -0.20] | 1 | Logs bounds checks dashboard |
Bounds Checks: ✅ Passed
| perf | experiment | bounds_check_name | replicates_passed | observed_value | links |
|---|---|---|---|---|---|
| ✅ | quality_gate_idle | intake_connections | 10/10 | 4 = 4 | bounds checks dashboard |
| ✅ | quality_gate_idle | memory_usage | 10/10 | 174.37MiB ≤ 179MiB | bounds checks dashboard |
| ✅ | quality_gate_idle | total_bytes_received | 10/10 | 744.19KiB ≤ 819.20KiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | intake_connections | 10/10 | 4 = 4 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | memory_usage | 10/10 | 516.20MiB ≤ 537MiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | total_bytes_received | 10/10 | 1.14MiB ≤ 1.25MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | intake_connections | 10/10 | 19 ≤ 40 | bounds checks dashboard |
| ✅ | quality_gate_logs | memory_usage | 10/10 | 215.97MiB ≤ 220MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_logs | total_bytes_received | 10/10 | 263.09MiB ≤ 292MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | cpu_usage | 10/10 | 367.72 ≤ 2000 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | intake_connections | 10/10 | 18 ≤ 40 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | memory_usage | 10/10 | 429.81MiB ≤ 455MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | total_bytes_received | 10/10 | 0.94GiB ≤ 1.04GiB | bounds checks dashboard |
| ✅ | quality_gate_private_action_runner | memory_usage | 10/10 | 72.79MiB ≤ 75MiB | bounds checks dashboard |
| ✅ | quality_gate_security_idle | cpu_usage | 10/10 | 28.69 ≤ 100 | bounds checks dashboard |
| ✅ | quality_gate_security_idle | memory_usage | 10/10 | 328.32MiB ≤ 355MiB | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | cpu_usage | 10/10 | 61.54 ≤ 200 | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | memory_usage | 10/10 | 304.41MiB ≤ 335MiB | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | cpu_usage | 10/10 | 22.40 ≤ 100 | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | memory_usage | 10/10 | 314.14MiB ≤ 345MiB | bounds checks dashboard |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
CI Pass/Fail Decision
✅ Passed. All Quality Gates passed.
- quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
iamluc
changed the title
iamluc
changed the title
iamluc
added
changelog/no-changelog
2 tasks
iamluc
marked this pull request as ready for review
August 20, 2026 06:31
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 02f4ac64d6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Contributor
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
maattdd
approved these changes
Aug 27, 2026
gh-worker-dd-mergequeue-cf854d
Bot
requested review from
a team
as code owners
August 28, 2026 08:41
Cover the case where an APM_POLICIES RC payload matches only host/Linux constraints while a pod is opted in via annotations in another namespace: assert lib injection stays on and SSI env vars are not applied.
Apply gofmt to the RC test constants and replace fmt.Sprintf with string concatenation to satisfy perfsprint.
Cover host-only non-match, namespace on-demand SSI, helm fallback, and a deny policy that overrides the local helm target.
ssi_test.go imports fakeintake; gazelle mode=diff failed without the dep on the ssi_test target.
Fakeintake poll counters also move for node agents, so they are not a signal that the cluster-agent applied APM_POLICIES. Re-admit until the expected mutation appears instead.
INJECT_DENY makes MutatePod a no-op, so waiting for APM annotations never succeeds. Wait for the absence of LD_PRELOAD instead.
Host-only outcome equals the helm baseline, so a one-shot restart does not prove RC was consumed. Publish a matching policy first, then replace the same document and wait for lib-injection. Also fail the test if RC cleanup cannot delete the document.
iamluc
force-pushed
the
luc/ssi-e2e-rc-no-false-positive
branch
from
August 28, 2026 08:43
7368cce to
f0dc302
Compare
gh-worker-dd-mergequeue-cf854d
Bot
merged commit Aug 28, 2026
1aba30e
into
main
300 of 308 checks passed
gh-worker-dd-mergequeue-cf854d
Bot
deleted the
luc/ssi-e2e-rc-no-false-positive
branch
August 28, 2026 13:11
gh-worker-dd-mergequeue-cf854d Bot
pushed a commit
that referenced
this pull request
Aug 31, 2026
### What does this PR do? Unify SSI matching on a single last-TRUE-wins matcher: - **Static targets** (Helm / Operator / `datadog.yaml`) are reversed at construction so config first-wins is preserved. - **RC policies** keep wire order (catch-all first, exceptions after) and are last-TRUE-wins as-is. - Evaluation is static first, then RC, then SSI inject-all only when both are absent. A matched deny does not fall through. ``` SSI | static targets | RC | Decision off | — | none | nothing off | — | policies | last matching policy, else nothing on | none | none | everything on | none | policies | last matching policy, else nothing on | present | none | first (as in the yaml) matching target, else nothing on | present | policies | first (as in the yaml) matching target, else last matching policy, else nothing ``` Rebased onto `main` after #55057 merged. ### Motivation RC is already last-wins on the wire. Using the same matcher for static targets (by reversing them) avoids two matching modes. Static targeting is evaluated before RC so a remote deny cannot override an explicit local target. ### Describe how you validated your changes - [x] Unit tests: `./pkg/clusteragent/admission/mutate/autoinstrumentation` - [ ] E2E `TestSSISuite/TestRemoteConfig` (HelmTargetWinsOverRemoteDeny, LastMatchingRemotePolicyWins) ### Additional Notes `HelmTargetWinsOverRemoteDeny` now expects the helm python workload to **keep** SSI when an RC deny matches `targeted-namespace`. That inverts #55057, where remote-before-local made the deny win. Co-authored-by: luc.vieillescazes <luc.vieillescazes@datadoghq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Expands
TestSSISuite/TestRemoteConfigso APM_POLICIES is exercised end-to-end against three workloads (helm target, annotated lib-injection, unannotated) and three RC documents:k8s_lib_injection, unannotated stays uninjected, helm target still gets SSI (applied-target=python-apps).NAMESPACE_NAME=other) enables SSI outside the helm target, including true on-demand on the unannotated pod (applied-policyset). Helm fallback is unchanged.targeted-namespaceoverrides the local helm target (no injection, noapplied-target). Namespaceotheris unchanged.Cluster-agent RC on the published chart is enabled via
remoteInstrumentation.enabled(temporary until helm-charts#2868). Extra cluster-agent env usesenvDictso fakeintake RC settings are not replaced.Stacked on #55019.
Motivation
Catch the SSI false-positive (host-only RC flipping annotated pods), prove on-demand SSI from RC, and prove remote-before-local override — none of which unit tests cover through fakeintake + admission.
Describe how you validated your changes
dda inv new-e2e-tests.run --targets=./tests/ssi --run='TestSSISuite/TestRemoteConfig'new-e2e-ssijobAdditional Notes
remoteInstrumentation.enabledis only the published-chart RC gate, not the feature under test. Drop it once helm-charts#2868 is released.