Set OpenSSL paths in registry #31960

clarkb7 · 2024-12-10T12:55:13Z

What does this PR do?

Fix embedded Python OpenSSL FIPS configuration by creating OpenSSL runtime path registry keys at install time

Add fipsmode component to aws windows host environment so fips mode can be enabled via pulumi prior to the Agent being installed, moves runtime test cases to the new test.

Motivation

https://datadoghq.atlassian.net/browse/WINA-1280

https://datadoghq.atlassian.net/browse/WINA-1222

Point Python's OpenSSL at our FIPS configuration without relying on env vars

Describe how you validated your changes

E2E test checks Python OpenSSL FIPS status and registry keys

Possible Drawbacks / Trade-offs

Current OpenSSL version (3.4) is hardcoded in a few places. Need input from agent delivery/devx teams on how best to centrally define and then distribute that information to the various places in the repo. The version is currently controlled in a separate repo.

Additional Notes

Depends on Agent flavor being added by DataDog/test-infra-definitions#1286

Depends on OpenSSL paths patch from DataDog/omnibus-software#567

agent-platform-auto-pr · 2024-12-10T13:18:31Z

[Fast Unit Tests Report]

On pipeline 54608855 (CI Visibility). The following jobs did not run any unit tests:

Jobs:

tests_deb-arm64-py3
tests_deb-x64-py3
tests_flavor_dogstatsd_deb-x64
tests_flavor_heroku_deb-x64
tests_flavor_iot_deb-x64
tests_rpm-arm64-py3
tests_rpm-x64-py3
tests_windows-x64

If you modified Go files and expected unit tests to run in these jobs, please double check the job logs. If you think tests should have been executed reach out to #agent-devx-help

cit-pr-commenter · 2024-12-10T13:46:24Z

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: df9cabed-a472-4918-8948-dddb91417c72

Baseline: 9cf6387
Comparison: 07113bd
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	tcp_syslog_to_blackhole	ingress throughput	+0.56	[+0.49, +0.64]	1	Logs
➖	file_to_blackhole_500ms_latency	egress throughput	+0.19	[-0.59, +0.97]	1	Logs
➖	quality_gate_idle_all_features	memory utilization	+0.17	[+0.10, +0.23]	1	Logs bounds checks dashboard
➖	file_to_blackhole_0ms_latency	egress throughput	+0.10	[-0.76, +0.96]	1	Logs
➖	file_to_blackhole_0ms_latency_http2	egress throughput	+0.07	[-0.68, +0.83]	1	Logs
➖	file_to_blackhole_100ms_latency	egress throughput	+0.06	[-0.65, +0.77]	1	Logs
➖	tcp_dd_logs_filter_exclude	ingress throughput	-0.00	[-0.02, +0.01]	1	Logs
➖	file_to_blackhole_300ms_latency	egress throughput	-0.01	[-0.65, +0.63]	1	Logs
➖	uds_dogstatsd_to_api	ingress throughput	-0.01	[-0.28, +0.25]	1	Logs
➖	file_to_blackhole_0ms_latency_http1	egress throughput	-0.05	[-0.88, +0.79]	1	Logs
➖	file_tree	memory utilization	-0.10	[-0.17, -0.03]	1	Logs
➖	file_to_blackhole_1000ms_latency_linear_load	egress throughput	-0.12	[-0.60, +0.36]	1	Logs
➖	quality_gate_idle	memory utilization	-0.48	[-0.51, -0.44]	1	Logs bounds checks dashboard
➖	quality_gate_logs	% cpu utilization	-1.28	[-4.35, +1.79]	1	Logs
➖	uds_dogstatsd_to_api_cpu	% cpu utilization	-1.51	[-2.38, -0.64]	1	Logs
➖	file_to_blackhole_1000ms_latency	egress throughput	-1.90	[-2.67, -1.12]	1	Logs

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	links
✅	file_to_blackhole_0ms_latency	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency	memory_usage	10/10
✅	file_to_blackhole_0ms_latency_http1	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency_http1	memory_usage	10/10
✅	file_to_blackhole_0ms_latency_http2	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency_http2	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency_linear_load	memory_usage	10/10
✅	file_to_blackhole_100ms_latency	lost_bytes	10/10
✅	file_to_blackhole_100ms_latency	memory_usage	10/10
✅	file_to_blackhole_300ms_latency	lost_bytes	10/10
✅	file_to_blackhole_300ms_latency	memory_usage	10/10
✅	file_to_blackhole_500ms_latency	lost_bytes	10/10
✅	file_to_blackhole_500ms_latency	memory_usage	10/10
✅	quality_gate_idle	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_idle	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_idle_all_features	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_logs	intake_connections	10/10
✅	quality_gate_logs	lost_bytes	10/10
✅	quality_gate_logs	memory_usage	10/10

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

✅ = significantly better comparison variant performance
❌ = significantly worse comparison variant performance
➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.

agent-platform-auto-pr · 2024-12-10T20:49:28Z

Gitlab CI Configuration Changes

Modified Jobs

new-e2e-windows-agent-a7-x86_64-fips

  new-e2e-windows-agent-a7-x86_64-fips:
    after_script:
    - $CI_PROJECT_DIR/tools/ci/junit_upload.sh
    artifacts:
      expire_in: 2 weeks
      paths:
      - $E2E_OUTPUT_DIR
      - junit-*.tgz
      reports:
        annotations:
        - $EXTERNAL_LINKS_PATH
      when: always
    before_script:
    - WINDOWS_AGENT_VERSION=$(invoke agent.version) || exit $?; export WINDOWS_AGENT_VERSION
    - mkdir -p $GOPATH/pkg/mod/cache && tar xJf modcache_e2e.tar.xz -C $GOPATH/pkg/mod/cache
      || exit 101
    - rm -f modcache_e2e.tar.xz
    - mkdir -p ~/.aws
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
      || exit $?
    - export AWS_PROFILE=agent-qa-ci
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AWS_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_AWS_PRIVATE_KEY_PATH && chmod 600 $E2E_AWS_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
      $AGENT_QA_E2E ssh_key_rsa > $E2E_AWS_PRIVATE_KEY_PATH || exit $?
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AZURE_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_AZURE_PRIVATE_KEY_PATH && chmod 600 $E2E_AZURE_PRIVATE_KEY_PATH &&
      $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key_rsa > $E2E_AZURE_PRIVATE_KEY_PATH
      || exit $?
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_GCP_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_GCP_PRIVATE_KEY_PATH && chmod 600 $E2E_GCP_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
      $AGENT_QA_E2E ssh_key_rsa > $E2E_GCP_PRIVATE_KEY_PATH || exit $?
    - pulumi login "s3://dd-pulumi-state?region=us-east-1&awssdk=v2&profile=$AWS_PROFILE"
    - ARM_CLIENT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE client_id)
      || exit $?; export ARM_CLIENT_ID
    - ARM_CLIENT_SECRET=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE token)
      || exit $?; export ARM_CLIENT_SECRET
    - ARM_TENANT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE tenant_id)
      || exit $?; export ARM_TENANT_ID
    - ARM_SUBSCRIPTION_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE subscription_id)
      || exit $?; export ARM_SUBSCRIPTION_ID
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_json > ~/gcp-credentials.json
      || exit $?
    - export GOOGLE_APPLICATION_CREDENTIALS=~/gcp-credentials.json
    - inv -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
    image: registry.ddbuild.io/ci/test-infra-definitions/runner$TEST_INFRA_DEFINITIONS_BUILDIMAGES_SUFFIX:$TEST_INFRA_DEFINITIONS_BUILDIMAGES
    needs:
    - go_e2e_deps
    - deploy_windows_testing-a7
    - deploy_windows_testing-a7-fips
    parallel:
      matrix:
      - EXTRA_PARAMS: --run "TestFIPSAgent$"
+     - EXTRA_PARAMS: --run "TestFIPSAgentAltDir$"
      - EXTRA_PARAMS: --run "TestFIPSAgentDoesNotInstallOverAgent$"
      - EXTRA_PARAMS: --run "TestAgentDoesNotInstallOverFIPSAgent$"
    rules:
    - if: $DEPLOY_AGENT == "true" || $DDR_WORKFLOW_ID != null
    - if: $RUN_E2E_TESTS == "off"
      when: never
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - if: $RUN_E2E_TESTS == "on"
      when: on_success
    - if: $CI_COMMIT_BRANCH == "main"
      when: on_success
    - if: $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
      when: on_success
    - if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
      when: on_success
    - changes:
        compare_to: main
        paths:
        - .gitlab/e2e/e2e.yml
        - test/new-e2e/pkg/**/*
        - test/new-e2e/go.mod
        - flakes.yaml
    - changes:
        compare_to: main
        paths:
        - tools/windows/DatadogAgentInstaller/**/*
        - .gitlab/e2e_install_packages/windows.yml
        - test/new-e2e/tests/windows/install-test/**/*
        - test/new-e2e/tests/windows/domain-test/**/*
        - tasks/msi.py
        - omnibus/python-scripts/**/*
        - omnibus/lib/**/*
        - omnibus/config/projects/agent.rb
        - omnibus/config/software/**/*
        - omnibus/config/templates/**/*
      when: on_success
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - allow_failure: true
      when: manual
    script:
    - export LAST_STABLE_VERSION=$(invoke release.get-release-json-value "last_stable::7"
      --no-worktree)
    - inv -e new-e2e-tests.run --targets $TARGETS -c ddagent:imagePullRegistry=669783387624.dkr.ecr.us-east-1.amazonaws.com
      -c ddagent:imagePullUsername=AWS -c ddagent:imagePullPassword=$(aws ecr get-login-password)
      --junit-tar junit-${CI_JOB_ID}.tgz ${EXTRA_PARAMS} --test-washer --logs-folder=$E2E_OUTPUT_DIR/logs
      --logs-post-processing --logs-post-processing-test-depth=$E2E_LOGS_PROCESSING_TEST_DEPTH
    stage: e2e_install_packages
    tags:
    - arch:amd64
    timeout: 1h15m
    variables:
      AGENT_MAJOR_VERSION: 7
      E2E_AWS_PRIVATE_KEY_PATH: /tmp/agent-qa-aws-ssh-key
      E2E_AWS_PUBLIC_KEY_PATH: /tmp/agent-qa-aws-ssh-key.pub
      E2E_AZURE_PRIVATE_KEY_PATH: /tmp/agent-qa-azure-ssh-key
      E2E_AZURE_PUBLIC_KEY_PATH: /tmp/agent-qa-azure-ssh-key.pub
      E2E_COMMIT_SHA: $CI_COMMIT_SHORT_SHA
      E2E_GCP_PRIVATE_KEY_PATH: /tmp/agent-qa-gcp-ssh-key
      E2E_GCP_PUBLIC_KEY_PATH: /tmp/agent-qa-gcp-ssh-key.pub
      E2E_KEY_PAIR_NAME: datadog-agent-ci-rsa
      E2E_LOGS_PROCESSING_TEST_DEPTH: 1
      E2E_OUTPUT_DIR: $CI_PROJECT_DIR/e2e-output
      E2E_PIPELINE_ID: $CI_PIPELINE_ID
      EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
      KUBERNETES_CPU_REQUEST: 6
      KUBERNETES_MEMORY_LIMIT: 16Gi
      KUBERNETES_MEMORY_REQUEST: 12Gi
      SHOULD_RUN_IN_FLAKES_FINDER: 'true'
      TARGETS: ./tests/windows/fips-test
      TEAM: windows-agent
      WINDOWS_AGENT_ARCH: x86_64
      WINDOWS_AGENT_FLAVOR: fips

Added Jobs

new-e2e-windows-fips-compliance-test

new-e2e-windows-fips-compliance-test:
  after_script:
  - $CI_PROJECT_DIR/tools/ci/junit_upload.sh
  artifacts:
    expire_in: 2 weeks
    paths:
    - $E2E_OUTPUT_DIR
    - junit-*.tgz
    reports:
      annotations:
      - $EXTERNAL_LINKS_PATH
    when: always
  before_script:
  - mkdir -p $GOPATH/pkg/mod/cache && tar xJf modcache_e2e.tar.xz -C $GOPATH/pkg/mod/cache
    || exit 101
  - rm -f modcache_e2e.tar.xz
  - mkdir -p ~/.aws
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
    || exit $?
  - export AWS_PROFILE=agent-qa-ci
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AWS_PUBLIC_KEY_PATH
    || exit $?
  - touch $E2E_AWS_PRIVATE_KEY_PATH && chmod 600 $E2E_AWS_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
    $AGENT_QA_E2E ssh_key_rsa > $E2E_AWS_PRIVATE_KEY_PATH || exit $?
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AZURE_PUBLIC_KEY_PATH
    || exit $?
  - touch $E2E_AZURE_PRIVATE_KEY_PATH && chmod 600 $E2E_AZURE_PRIVATE_KEY_PATH &&
    $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key_rsa > $E2E_AZURE_PRIVATE_KEY_PATH
    || exit $?
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_GCP_PUBLIC_KEY_PATH
    || exit $?
  - touch $E2E_GCP_PRIVATE_KEY_PATH && chmod 600 $E2E_GCP_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
    $AGENT_QA_E2E ssh_key_rsa > $E2E_GCP_PRIVATE_KEY_PATH || exit $?
  - pulumi login "s3://dd-pulumi-state?region=us-east-1&awssdk=v2&profile=$AWS_PROFILE"
  - ARM_CLIENT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE client_id)
    || exit $?; export ARM_CLIENT_ID
  - ARM_CLIENT_SECRET=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE token)
    || exit $?; export ARM_CLIENT_SECRET
  - ARM_TENANT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE tenant_id)
    || exit $?; export ARM_TENANT_ID
  - ARM_SUBSCRIPTION_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE subscription_id)
    || exit $?; export ARM_SUBSCRIPTION_ID
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_json > ~/gcp-credentials.json
    || exit $?
  - export GOOGLE_APPLICATION_CREDENTIALS=~/gcp-credentials.json
  - inv -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
  image: registry.ddbuild.io/ci/test-infra-definitions/runner$TEST_INFRA_DEFINITIONS_BUILDIMAGES_SUFFIX:$TEST_INFRA_DEFINITIONS_BUILDIMAGES
  needs:
  - go_e2e_deps
  - qa_agent_fips
  - deploy_windows_testing-a7-fips
  parallel:
    matrix:
    - EXTRA_PARAMS: --run "TestWindowsVM$"
  rules:
  - if: $RUN_E2E_TESTS == "off"
    when: never
  - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
    when: never
  - if: $RUN_E2E_TESTS == "on"
    when: on_success
  - if: $CI_COMMIT_BRANCH == "main"
    when: on_success
  - if: $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
    when: on_success
  - if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
    when: on_success
  - changes:
      compare_to: main
      paths:
      - .gitlab/e2e/e2e.yml
      - test/new-e2e/pkg/**/*
      - test/new-e2e/go.mod
      - flakes.yaml
  - changes:
      compare_to: main
      paths:
      - cmd/**/*
      - pkg/**/*
      - comp/**/*
      - test/new-e2e/tests/agent-runtimes/**/*
  - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
    when: never
  - allow_failure: true
    when: manual
  script:
  - inv -e new-e2e-tests.run --targets $TARGETS -c ddagent:imagePullRegistry=669783387624.dkr.ecr.us-east-1.amazonaws.com
    -c ddagent:imagePullUsername=AWS -c ddagent:imagePullPassword=$(aws ecr get-login-password)
    --junit-tar junit-${CI_JOB_ID}.tgz ${EXTRA_PARAMS} --test-washer --logs-folder=$E2E_OUTPUT_DIR/logs
    --logs-post-processing --logs-post-processing-test-depth=$E2E_LOGS_PROCESSING_TEST_DEPTH
  stage: e2e
  tags:
  - arch:amd64
  variables:
    E2E_AWS_PRIVATE_KEY_PATH: /tmp/agent-qa-aws-ssh-key
    E2E_AWS_PUBLIC_KEY_PATH: /tmp/agent-qa-aws-ssh-key.pub
    E2E_AZURE_PRIVATE_KEY_PATH: /tmp/agent-qa-azure-ssh-key
    E2E_AZURE_PUBLIC_KEY_PATH: /tmp/agent-qa-azure-ssh-key.pub
    E2E_COMMIT_SHA: $CI_COMMIT_SHORT_SHA
    E2E_GCP_PRIVATE_KEY_PATH: /tmp/agent-qa-gcp-ssh-key
    E2E_GCP_PUBLIC_KEY_PATH: /tmp/agent-qa-gcp-ssh-key.pub
    E2E_KEY_PAIR_NAME: datadog-agent-ci-rsa
    E2E_LOGS_PROCESSING_TEST_DEPTH: 1
    E2E_OUTPUT_DIR: $CI_PROJECT_DIR/e2e-output
    E2E_PIPELINE_ID: $CI_PIPELINE_ID
    EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
    KUBERNETES_CPU_REQUEST: 6
    KUBERNETES_MEMORY_LIMIT: 16Gi
    KUBERNETES_MEMORY_REQUEST: 12Gi
    SHOULD_RUN_IN_FLAKES_FINDER: 'true'
    TARGETS: ./tests/fips-compliance
    TEAM: windows-agent

Changes Summary

Removed	Modified	Added	Renamed
0	1	1	0

ℹ️ Diff available in the job log.

agent-platform-auto-pr · 2025-01-28T02:09:36Z

Test changes on VM

Use this command from test-infra-definitions to manually test this PR changes on a VM:

inv aws.create-vm --pipeline-id=54608855 --os-family=ubuntu

Note: This applies to commit 07113bd

agent-platform-auto-pr · 2025-01-28T02:12:19Z

Uncompressed package size comparison

Comparison with ancestor 9cf6387ef05f69dd092833ce1c5672a8bab806b1

Diff per package

package	diff	status	size	ancestor	threshold
datadog-agent-amd64-deb	0.00MB	✅	877.17MB	877.17MB	0.50MB
datadog-agent-x86_64-rpm	0.00MB	✅	886.91MB	886.91MB	0.50MB
datadog-agent-x86_64-suse	0.00MB	✅	886.91MB	886.91MB	0.50MB
datadog-agent-arm64-deb	0.00MB	✅	864.96MB	864.96MB	0.50MB
datadog-agent-aarch64-rpm	0.00MB	✅	874.68MB	874.68MB	0.50MB
datadog-dogstatsd-amd64-deb	0.00MB	✅	59.02MB	59.02MB	0.50MB
datadog-dogstatsd-x86_64-rpm	0.00MB	✅	59.09MB	59.09MB	0.50MB
datadog-dogstatsd-x86_64-suse	0.00MB	✅	59.09MB	59.09MB	0.50MB
datadog-dogstatsd-arm64-deb	0.00MB	✅	56.50MB	56.50MB	0.50MB
datadog-heroku-agent-amd64-deb	0.00MB	✅	456.42MB	456.42MB	0.50MB
datadog-iot-agent-amd64-deb	0.00MB	✅	93.82MB	93.82MB	0.50MB
datadog-iot-agent-x86_64-rpm	0.00MB	✅	93.89MB	93.89MB	0.50MB
datadog-iot-agent-x86_64-suse	0.00MB	✅	93.88MB	93.88MB	0.50MB
datadog-iot-agent-arm64-deb	0.00MB	✅	89.87MB	89.87MB	0.50MB
datadog-iot-agent-aarch64-rpm	0.00MB	✅	89.94MB	89.94MB	0.50MB

Decision

✅ Passed

chouetz

LGTM. Up to you to force the execution of this test on specific modified files, thanks in advance

chouetz · 2025-01-31T16:18:21Z

.gitlab/e2e/e2e.yml

+    - qa_agent_fips
+    - deploy_windows_testing-a7-fips
+  rules:
+    - !reference [.on_asc_or_e2e_changes]


Could/Should we add a trigger on this test when the pkg/fips is touched. Cf #incident-34533 and this thread

thanks I need to update that to .on_arun_or_e2e_changes, too

tools/windows/DatadogAgentInstaller/WixSetup/Datadog Agent/AgentInstaller.cs

jeremy-hanna

🔥

clarkb7 · 2025-01-31T21:28:36Z

/merge

dd-devflow · 2025-01-31T21:28:46Z

Devflow running: `/merge`

View all feedbacks in Devflow UI.

2025-01-31 21:28:46 UTC ℹ️ MergeQueue: pull request added to the queue

The median merge time in main is 27m.

2025-01-31 21:56:04 UTC ℹ️ MergeQueue: This merge request was merged

alexn-dd · 2025-02-03T16:14:14Z

tasks/msi.py

    env['AGENT_INSTALLER_OUTPUT_DIR'] = BUILD_OUTPUT_DIR
    env['NUGET_PACKAGES_DIR'] = NUGET_PACKAGES_DIR
    env['AGENT_PRODUCT_NAME_SUFFIX'] = ""
+    # Used for installation directories registry keys
+    # https://github.com/openssl/openssl/blob/master/NOTES-WINDOWS.md#installation-directories
+    # TODO: How best to configure the OpenSSL version?


This is a good question, because the version is spread among various files and can easily lead to version conflicts. Is there a ticket for tracking?

Note that if there is ever another SSL vulnerability like the Heartbleed bug, we need to act ASAP.

alexn-dd · 2025-02-03T16:23:47Z

Dockerfiles/agent/install.ps1

+} else {
+  $opensslctx = "datadog-agent"
+}
+$keyPath = "HKLM:\SOFTWARE\Wow6432Node\OpenSSL-$opensslVersion-$opensslctx"


Why WOW6432?

alexn-dd · 2025-02-03T16:26:29Z

Please check if the target location of the created registry keys is hardened. If it is not, then that spot is a prime location for injection.

github-actions bot added medium review team/agent-devx-loops team/windows-agent team/windows-kernel-integrations labels Dec 10, 2024

clarkb7 added changelog/no-changelog qa/no-code-change labels Dec 10, 2024

clarkb7 added 8 commits January 24, 2025 10:55

add fips pulumi component

2b69224

add example test

4a496d6

add parallel

19319a4

add flavor arg to msi.build

863cff2

create openssl winctx registry keys

f5d9745

test openssl registry paths

a1dba65

add fakeintake and custom check metrics

f1049a8

comments

c69b880

clarkb7 force-pushed the branden.clark/fips-e2e-component branch from e4f45c7 to c69b880 Compare January 28, 2025 01:42

update openssl expected output

363bf32

clarkb7 changed the title ~~Add Windows FIPS mode E2E component~~ Set OpenSSL paths Jan 30, 2025

clarkb7 added qa/done and removed qa/no-code-change labels Jan 30, 2025

clarkb7 added 6 commits January 30, 2025 09:19

Add openssl keys to container

5514679

Merge branch 'main' into branden.clark/fips-e2e-component

58ec243

lint

9770351

migrate runtime test cases

8ac1377

update ci

e1acb4d

update ci

defe6bd

clarkb7 requested review from a team as code owners January 31, 2025 00:24

clarkb7 requested a review from misteriaud January 31, 2025 00:24

clarkb7 added the ask-review label Jan 31, 2025

clarkb7 changed the title ~~Set OpenSSL paths~~ Set OpenSSL paths in registry Jan 31, 2025

vboulineau approved these changes Jan 31, 2025

View reviewed changes

richl-dd approved these changes Jan 31, 2025

View reviewed changes

julien-lebot approved these changes Jan 31, 2025

View reviewed changes

chouetz approved these changes Jan 31, 2025

View reviewed changes

jack0x2 reviewed Jan 31, 2025

View reviewed changes

tools/windows/DatadogAgentInstaller/WixSetup/Datadog Agent/AgentInstaller.cs Show resolved Hide resolved

Merge branch 'main' into branden.clark/fips-e2e-component

4ba5bc3

clarkb7 requested a review from a team as a code owner January 31, 2025 16:49

clarkb7 added 2 commits January 31, 2025 11:50

update rules ref

2e5630c

add altdir test

35c7021

clarkb7 requested review from a team as code owners January 31, 2025 17:08

github-actions bot added long review and removed medium review labels Jan 31, 2025

always use paths from registry

07113bd

jeremy-hanna approved these changes Jan 31, 2025

View reviewed changes

dd-mergequeue bot merged commit dcd0631 into main Jan 31, 2025
324 checks passed

dd-mergequeue bot deleted the branden.clark/fips-e2e-component branch January 31, 2025 21:56

github-actions bot added this to the 7.64.0 milestone Jan 31, 2025

alexn-dd reviewed Feb 3, 2025

View reviewed changes

clarkb7 added a commit that referenced this pull request Feb 3, 2025

[backport] Set OpenSSL paths in registry (#31960)

7c822ee

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Set OpenSSL paths in registry #31960

Set OpenSSL paths in registry #31960

clarkb7 commented Dec 10, 2024 •

edited

Loading

agent-platform-auto-pr bot commented Dec 10, 2024 •

edited

Loading

cit-pr-commenter bot commented Dec 10, 2024 •

edited

Loading

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

agent-platform-auto-pr bot commented Dec 10, 2024 •

edited

Loading

agent-platform-auto-pr bot commented Jan 28, 2025 •

edited

Loading

agent-platform-auto-pr bot commented Jan 28, 2025 •

edited

Loading

chouetz left a comment

chouetz Jan 31, 2025

clarkb7 Jan 31, 2025

jeremy-hanna left a comment

clarkb7 commented Jan 31, 2025

dd-devflow bot commented Jan 31, 2025 •

edited

Loading

alexn-dd Feb 3, 2025 •

edited

Loading

alexn-dd Feb 3, 2025

alexn-dd Feb 3, 2025

alexn-dd commented Feb 3, 2025 •

edited

Loading

Set OpenSSL paths in registry #31960

Set OpenSSL paths in registry #31960

Conversation

clarkb7 commented Dec 10, 2024 • edited Loading

What does this PR do?

Motivation

Describe how you validated your changes

Possible Drawbacks / Trade-offs

Additional Notes

agent-platform-auto-pr bot commented Dec 10, 2024 • edited Loading

cit-pr-commenter bot commented Dec 10, 2024 • edited Loading

Regression Detector

Regression Detector Results

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

CI Pass/Fail Decision

agent-platform-auto-pr bot commented Dec 10, 2024 • edited Loading

Gitlab CI Configuration Changes

Modified Jobs

Added Jobs

Changes Summary

agent-platform-auto-pr bot commented Jan 28, 2025 • edited Loading

Test changes on VM

agent-platform-auto-pr bot commented Jan 28, 2025 • edited Loading

Uncompressed package size comparison

Decision

chouetz left a comment

Choose a reason for hiding this comment

chouetz Jan 31, 2025

Choose a reason for hiding this comment

clarkb7 Jan 31, 2025

Choose a reason for hiding this comment

jeremy-hanna left a comment

Choose a reason for hiding this comment

clarkb7 commented Jan 31, 2025

dd-devflow bot commented Jan 31, 2025 • edited Loading

Devflow running: /merge

alexn-dd Feb 3, 2025 • edited Loading

Choose a reason for hiding this comment

alexn-dd Feb 3, 2025

Choose a reason for hiding this comment

alexn-dd Feb 3, 2025

Choose a reason for hiding this comment

alexn-dd commented Feb 3, 2025 • edited Loading

clarkb7 commented Dec 10, 2024 •

edited

Loading

agent-platform-auto-pr bot commented Dec 10, 2024 •

edited

Loading

cit-pr-commenter bot commented Dec 10, 2024 •

edited

Loading

agent-platform-auto-pr bot commented Dec 10, 2024 •

edited

Loading

agent-platform-auto-pr bot commented Jan 28, 2025 •

edited

Loading

agent-platform-auto-pr bot commented Jan 28, 2025 •

edited

Loading

dd-devflow bot commented Jan 31, 2025 •

edited

Loading

Devflow running: `/merge`

alexn-dd Feb 3, 2025 •

edited

Loading

alexn-dd commented Feb 3, 2025 •

edited

Loading