config.go

// Unless explicitly stated otherwise all files in this repository are licensed
// under the Apache License Version 2.0.
// This product includes software developed at Datadog (https://www.datadoghq.com/).
// Copyright 2016-present Datadog, Inc.

// Package setup defines the configuration of the agent
package setup

import (
	"context"
	"errors"
	"fmt"
	"net"
	"os"
	"runtime"
	"slices"
	"strconv"
	"strings"
	"sync"
	"time"

	"go.yaml.in/yaml/v2"

	cloudauthconfig "github.com/DataDog/datadog-agent/comp/core/delegatedauth/api/cloudauth/config"
	"github.com/DataDog/datadog-agent/comp/core/delegatedauth/common"
	delegatedauth "github.com/DataDog/datadog-agent/comp/core/delegatedauth/def"
	secrets "github.com/DataDog/datadog-agent/comp/core/secrets/def"
	"github.com/DataDog/datadog-agent/pkg/config/create"
	pkgconfigenv "github.com/DataDog/datadog-agent/pkg/config/env"
	pkgconfigmodel "github.com/DataDog/datadog-agent/pkg/config/model"
	"github.com/DataDog/datadog-agent/pkg/config/structure"
	pkgfips "github.com/DataDog/datadog-agent/pkg/fips"
	"github.com/DataDog/datadog-agent/pkg/util/log"
	"github.com/DataDog/datadog-agent/pkg/util/scrubber"
	"github.com/DataDog/datadog-agent/pkg/util/system"

	// imported by the generated code. We duplicate the import here to keep it in go.mod
	_ "github.com/DataDog/datadog-agent/pkg/config/helper"
)

const (
	// DefaultRuntimePoliciesDir is the default policies directory used by the runtime security module
	DefaultRuntimePoliciesDir = "/etc/datadog-agent/runtime-security.d"

	// maxExternalMetricsProviderChunkSize ensures batch queries are limited in size.
	maxExternalMetricsProviderChunkSize = 35

	// Traces specifies the data type used for Vector override. See https://vector.dev/docs/reference/configuration/sources/datadog_agent/ for additional details.
	Traces string = "traces"
)

var (
	// datadog is the global configuration object
	// NOTE: The constructor `create.New` returns a `model.BuildableConfig`, which is the
	// most general interface for the methods implemented by these types. However, we store
	// them as `model.Config` because that is what the global `Datadog()` accessor returns.
	// Keeping these types aligned signficantly reduces the compiled size of this binary.
	// See https://datadoghq.atlassian.net/wiki/spaces/ACFG/pages/5386798973/Datadog+global+accessor+PR+size+increase
	datadog     pkgconfigmodel.Config
	systemProbe pkgconfigmodel.Config

	datadogMutex     = sync.RWMutex{}
	systemProbeMutex = sync.RWMutex{}
)

// SetDatadog sets the the reference to the agent configuration.
// This is currently used by the legacy converter and config mocks and should not be user anywhere else. Once the
// legacy converter and mock have been migrated we will remove this function.
func SetDatadog(cfg pkgconfigmodel.BuildableConfig) {
	datadogMutex.Lock()
	defer datadogMutex.Unlock()
	datadog = cfg
}

// SetSystemProbe sets the the reference to the systemProbe configuration.
// This is currently used by the config mocks and should not be user anywhere else. Once the mocks have been migrated we
// will remove this function.
func SetSystemProbe(cfg pkgconfigmodel.BuildableConfig) {
	systemProbeMutex.Lock()
	defer systemProbeMutex.Unlock()
	systemProbe = cfg
}

func init() {
	// init default for code that access the config before it initialized
	InitConfigObjects()
}

// Variables to initialize at start time
var (
	// StartTime is the agent startup time
	StartTime = time.Now()
)

// Listeners helps unmarshalling `listeners` config param
type Listeners struct {
	Name             string `mapstructure:"name"`
	EnabledProviders map[string]struct{}
}

// SetEnabledProviders registers the enabled config providers in the listener config
func (l *Listeners) SetEnabledProviders(ep map[string]struct{}) {
	l.EnabledProviders = ep
}

// IsProviderEnabled returns whether a config provider is enabled
func (l *Listeners) IsProviderEnabled(provider string) bool {
	_, found := l.EnabledProviders[provider]

	return found
}

const (
	// Metrics type covers series & sketches
	Metrics string = "metrics"
	// Logs type covers all outgoing logs
	Logs string = "logs"
)

// InitConfigObjects initializes the global config objects use across the code. This should never be called anywhere
// but from the main.
func InitConfigObjects() {
	// Assign the config globals, using locks to make the tests happy
	SetDatadog(create.NewConfig("datadog"))          // nolint: forbidigo // legitimate use of SetDatadog
	SetSystemProbe(create.NewConfig("system-probe")) // nolint: forbidigo // legitimate use of SetDatadog

	// This calls the generate code from the schema to declare the configuration (name, defaults, env vars, ...)
	initConfig()

	// Post-init fixups, custom logic to tweak certain settings
	fixupInitConfig()

	// Build the environment variable layer
	datadog.(pkgconfigmodel.BuildableConfig).BuildSchema()
	systemProbe.(pkgconfigmodel.BuildableConfig).BuildSchema()

	// Fixups that need to read config values must run after BuildSchema(), once the config is ready for use.
	fixupPostBuildConfig()
}

// InitConfig initializes the config defaults on a config used by all agents
// (in particular more than just the serverless agent).
func InitConfig(config pkgconfigmodel.Setup) {
	// Settings that are shared in common between serverless and the full agent, split up by feature / product
	initCommonBase(config)
	// Settings just for the full agent in general
	initCoreAgentFull(config)

	processesAddOverrideOnce.Do(func() {
		pkgconfigmodel.AddOverrideFunc(loadProcessTransforms)
	})
}

// LoadProxyFromEnv overrides the proxy settings with environment variables
func LoadProxyFromEnv(config pkgconfigmodel.ReaderWriter) {
	// Viper doesn't handle mixing nested variables from files and set
	// manually.  If we manually set one of the sub value for "proxy" all
	// other values from the conf file will be shadowed when using
	// 'config.Get("proxy")'. For that reason we first get the value from
	// the conf files, overwrite them with the env variables and reset
	// everything.

	// When FIPS proxy is enabled we ignore proxy setting to force data to the local proxy
	if config.GetBool("fips.enabled") {
		log.Infof("'fips.enabled' has been set to true. Ignoring proxy setting.")
		return
	}

	log.Info("Loading proxy settings")

	lookupEnvCaseInsensitive := func(key string) (string, bool) {
		value, found := os.LookupEnv(key)
		if !found {
			value, found = os.LookupEnv(strings.ToLower(key))
		}
		if found {
			log.Infof("Found '%v' env var, using it for the Agent proxy settings", key)
		}
		return value, found
	}

	lookupEnv := func(key string) (string, bool) {
		value, found := os.LookupEnv(key)
		if found {
			log.Infof("Found '%v' env var, using it for the Agent proxy settings", key)
		}
		return value, found
	}

	p := &pkgconfigmodel.Proxy{}
	if err := structure.UnmarshalKey(config, "proxy", p); err != nil {
		log.Errorf("Could not load proxy setting from the configuration (ignoring): %s", err)
	}

	if HTTP, found := lookupEnv("DD_PROXY_HTTP"); found {
		p.HTTP = HTTP
	} else if HTTP, found := lookupEnvCaseInsensitive("HTTP_PROXY"); found {
		p.HTTP = HTTP
	}

	if HTTPS, found := lookupEnv("DD_PROXY_HTTPS"); found {
		p.HTTPS = HTTPS
	} else if HTTPS, found := lookupEnvCaseInsensitive("HTTPS_PROXY"); found {
		p.HTTPS = HTTPS
	}

	if noProxy, found := lookupEnv("DD_PROXY_NO_PROXY"); found {
		p.NoProxy = strings.FieldsFunc(noProxy, func(r rune) bool {
			return r == ',' || r == ' '
		}) // comma and space-separated list, consistent with viper and documentation
	} else if noProxy, found := lookupEnvCaseInsensitive("NO_PROXY"); found {
		p.NoProxy = strings.Split(noProxy, ",") // comma-separated list, consistent with other tools that use the NO_PROXY env var
	}

	if !config.GetBool("use_proxy_for_cloud_metadata") {
		log.Debugf("'use_proxy_for_cloud_metadata' is enabled: adding cloud provider URL to the no_proxy list")
		p.NoProxy = append(p.NoProxy,
			"169.254.169.254", // Azure, EC2, GCE
			"100.100.100.200", // Alibaba
		)
	}

	// We have to set each value individually so both config.Get("proxy")
	// and config.Get("proxy.http") work
	if p.HTTPS != "" || p.HTTP != "" || len(p.NoProxy) > 0 {
		config.Set("proxy.http", p.HTTP, pkgconfigmodel.SourceConfigPostInit)
		config.Set("proxy.https", p.HTTPS, pkgconfigmodel.SourceConfigPostInit)

		// If this is set to an empty []string, viper will have a type conflict when merging
		// this config during secrets resolution. It unmarshals empty yaml lists to type
		// []interface{}, which will then conflict with type []string and fail to merge.
		noProxy := make([]interface{}, len(p.NoProxy))
		for idx := range p.NoProxy {
			noProxy[idx] = p.NoProxy[idx]
		}
		config.Set("proxy.no_proxy", noProxy, pkgconfigmodel.SourceConfigPostInit)
	}
}

// Merge will merge additional configuration into an existing configuration
func Merge(configPaths []string, config pkgconfigmodel.Config) error {
	for _, configPath := range configPaths {
		if f, err := os.Open(configPath); err == nil {
			err = config.MergeConfig(f)
			_ = f.Close()
			if err != nil {
				return fmt.Errorf("error merging %s config file: %w", configPath, err)
			}
		} else {
			log.Infof("no config exists at %s, ignoring...", configPath)
		}
	}

	return nil
}

func findUnknownKeys(config pkgconfigmodel.Config) []string {
	var unknownKeys []string
	knownKeys := config.GetKnownKeysLowercased()
	loadedKeys := config.AllKeysLowercased()
	for _, loadedKey := range loadedKeys {
		if _, found := knownKeys[loadedKey]; !found {
			nestedValue := false
			// If a value is within a known key it is considered known.
			for knownKey := range knownKeys {
				if strings.HasPrefix(loadedKey, knownKey+".") {
					nestedValue = true
					break
				}
			}
			if !nestedValue {
				unknownKeys = append(unknownKeys, loadedKey)
			}
		}
	}
	return unknownKeys
}

func findUnexpectedUnicode(config pkgconfigmodel.Config) []string {
	messages := make([]string, 0)
	checkAndRecordString := func(str string, prefix string) {
		if res := FindUnexpectedUnicode(str); len(res) != 0 {
			for _, detected := range res {
				msg := fmt.Sprintf("%s - Unexpected unicode %s codepoint '%U' detected at byte position %v", prefix, detected.reason, detected.codepoint, detected.position)
				messages = append(messages, msg)
			}
		}
	}

	var visitElement func(string, interface{})
	visitElement = func(key string, element interface{}) {
		switch elementValue := element.(type) {
		case string:
			checkAndRecordString(elementValue, fmt.Sprintf("For key '%s', configuration value string '%s'", key, elementValue))
		case []string:
			for _, s := range elementValue {
				checkAndRecordString(s, fmt.Sprintf("For key '%s', configuration value string '%s'", key, s))
			}
		case []interface{}:
			for _, listItem := range elementValue {
				visitElement(key, listItem)
			}
		}
	}

	allKeys := config.AllKeysLowercased()
	for _, key := range allKeys {
		checkAndRecordString(key, fmt.Sprintf("Configuration key string '%s'", key))
		if unknownValue := config.Get(key); unknownValue != nil {
			visitElement(key, unknownValue)
		}
	}

	return messages
}

func findUnknownEnvVars(config pkgconfigmodel.Config, environ []string, additionalKnownEnvVars []string) []string {
	var unknownVars []string

	knownVars := map[string]struct{}{
		// these variables are used by the agent, but not via the Config struct,
		// so must be listed separately.
		"DD_INSIDE_CI":      {},
		"DD_PROXY_HTTP":     {},
		"DD_PROXY_HTTPS":    {},
		"DD_PROXY_NO_PROXY": {},
		// these variables are used by serverless, but not via the Config struct
		"DD_AAS_DOTNET_EXTENSION_VERSION":          {},
		"DD_AAS_EXTENSION_VERSION":                 {},
		"DD_AAS_JAVA_EXTENSION_VERSION":            {},
		"DD_AGENT_PIPE_NAME":                       {},
		"DD_API_KEY_SECRET_ARN":                    {},
		"DD_APM_FLUSH_DEADLINE_MILLISECONDS":       {},
		"DD_APPSEC_ENABLED":                        {},
		"DD_AZURE_APP_SERVICES":                    {},
		"DD_DOGSTATSD_ARGS":                        {},
		"DD_DOGSTATSD_PATH":                        {},
		"DD_DOGSTATSD_WINDOWS_PIPE_NAME":           {},
		"DD_DOTNET_TRACER_HOME":                    {},
		"DD_EXTENSION_PATH":                        {},
		"DD_FLUSH_TO_LOG":                          {},
		"DD_KMS_API_KEY":                           {},
		"DD_INTEGRATIONS":                          {},
		"DD_INTERNAL_NATIVE_LOADER_PATH":           {},
		"DD_INTERNAL_PROFILING_NATIVE_ENGINE_PATH": {},
		"DD_LOGS_INJECTION":                        {},
		"DD_MERGE_XRAY_TRACES":                     {},
		"DD_PROFILER_EXCLUDE_PROCESSES":            {},
		"DD_PROFILING_LOG_DIR":                     {},
		"DD_RUNTIME_METRICS_ENABLED":               {},
		"DD_SERVERLESS_APPSEC_ENABLED":             {},
		"DD_SERVERLESS_FLUSH_STRATEGY":             {},
		"DD_SERVICE":                               {},
		"DD_TRACE_AGENT_ARGS":                      {},
		"DD_TRACE_AGENT_PATH":                      {},
		"DD_TRACE_AGENT_URL":                       {},
		"DD_TRACE_LOG_DIRECTORY":                   {},
		"DD_TRACE_LOG_PATH":                        {},
		"DD_TRACE_METRICS_ENABLED":                 {},
		"DD_TRACE_PIPE_NAME":                       {},
		"DD_TRACE_TRANSPORT":                       {},
		"DD_VERSION":                               {},
		// this variable is used by the Kubernetes leader election mechanism
		"DD_POD_NAME": {},
		// this variable is used by tracers
		"DD_INSTRUMENTATION_TELEMETRY_ENABLED": {},
		// these variables are used by source code integration
		"DD_GIT_COMMIT_SHA":     {},
		"DD_GIT_REPOSITORY_URL": {},
		// signals whether or not ADP is enabled (deprecated)
		"DD_ADP_ENABLED": {},
		// trace-loader socket file descriptors
		"DD_APM_NET_RECEIVER_FD":  {},
		"DD_APM_UNIX_RECEIVER_FD": {},
		"DD_OTLP_CONFIG_GRPC_FD":  {},
	}
	for _, key := range config.GetEnvVars() {
		knownVars[key] = struct{}{}
	}
	for _, key := range additionalKnownEnvVars {
		knownVars[key] = struct{}{}
	}

	for _, equality := range environ {
		key := strings.SplitN(equality, "=", 2)[0]
		if !strings.HasPrefix(key, "DD_") {
			continue
		}
		if _, known := knownVars[key]; !known {
			unknownVars = append(unknownVars, key)
		}
	}
	return unknownVars
}

func useHostEtc(config pkgconfigmodel.Config) {
	if pkgconfigenv.IsContainerized() && pathExists("/host/etc") {
		if !config.GetBool("ignore_host_etc") {
			if val, isSet := os.LookupEnv("HOST_ETC"); !isSet {
				// We want to detect the host distro informations instead of the one from the container.
				// 'HOST_ETC' is used by some libraries like gopsutil and by the system-probe to
				// download the right kernel headers.
				os.Setenv("HOST_ETC", "/host/etc")
				log.Debug("Setting environment variable HOST_ETC to '/host/etc'")
			} else {
				log.Debugf("'/host/etc' folder detected but HOST_ETC is already set to '%s', leaving it untouched", val)
			}
		} else {
			log.Debug("/host/etc detected but ignored because 'ignore_host_etc' is set to true")
		}
	}
}

func checkConflictingOptions(config pkgconfigmodel.Config) error {
	// Verify that either use_podman_logs OR docker_path_override are set since they conflict
	if config.GetBool("logs_config.use_podman_logs") && len(config.GetString("logs_config.docker_path_override")) > 0 {
		log.Warnf("'use_podman_logs' is set to true and 'docker_path_override' is set, please use one or the other")
		return errors.New("'use_podman_logs' is set to true and 'docker_path_override' is set, please use one or the other")
	}

	return nil
}

// LoadDatadog reads config files and initializes config with decrypted secrets
func LoadDatadog(config pkgconfigmodel.Config, secretResolver secrets.Component, delegatedAuthComp delegatedauth.Component, additionalEnvVars []string) error {
	// Feature detection running in a defer func as it always  need to run (whether config load has been successful or not)
	// Because some Agents (e.g. trace-agent) will run even if config file does not exist
	defer func() {
		// Environment feature detection needs to run before applying override funcs
		// as it may provide such overrides
		pkgconfigenv.DetectFeatures(config)
		pkgconfigmodel.ApplyOverrideFuncs(config)
	}()

	err := loadCustom(config, additionalEnvVars)
	if err != nil {
		if errors.Is(err, os.ErrPermission) {
			return log.Warnf("Error loading config: %v (check config file permissions for dd-agent user)", err)
		}
		return err
	}

	// We resolve proxy setting before secrets. This allows setting secrets through DD_PROXY_* env variables
	LoadProxyFromEnv(config)

	if err := resolveSecrets(config, secretResolver, "datadog.yaml"); err != nil {
		return err
	}

	// Configure delegated auth after secrets are resolved but before other components initialize
	// Cloud provider detection happens automatically within the delegatedauth component
	// Use a background context since LoadDatadog doesn't take a context parameter.
	// The context is still useful for cancellation during cloud provider detection and initial API key fetch.
	if err := configureDelegatedAuth(context.Background(), config, delegatedAuthComp); err != nil {
		log.Errorf("Failed to configure delegated authentication: %v. Agent will continue without delegated auth.", err)
	}

	// Verify 'DD_URL' and 'DD_DD_URL' conflicts
	if envVarAreSetAndNotEqual("DD_DD_URL", "DD_URL") {
		log.Warnf("'DD_URL' and 'DD_DD_URL' variables are both set in environment. Using 'DD_DD_URL' value")
	}

	useHostEtc(config)

	err = checkConflictingOptions(config)
	if err != nil {
		return err
	}

	sanitizeAPIKeyConfig(config, "api_key")
	sanitizeAPIKeyConfig(config, "logs_config.api_key")
	SanitizeDataPlaneConfig(config)
	setNumWorkers(config)

	flareStrippedKeys := config.GetStringSlice("flare_stripped_keys")
	if len(flareStrippedKeys) > 0 {
		log.Warn("flare_stripped_keys is deprecated, please use scrubber.additional_keys instead.")
		scrubber.AddStrippedKeys(flareStrippedKeys)
	}
	scrubberAdditionalKeys := config.GetStringSlice("scrubber.additional_keys")
	if len(scrubberAdditionalKeys) > 0 {
		scrubber.AddStrippedKeys(scrubberAdditionalKeys)
	}

	return setupFipsEndpoints(config)
}

// configureDelegatedAuth initializes the delegated auth component with configuration parameters.
// This allows the component to fetch API keys from cloud providers and write them to the config
// before other components are initialized.
// Delegated auth can be configured for any config prefix that has an api_key.
// Delegated auth is automatically enabled when org_uuid is specified for a given prefix.
// Cloud provider detection happens automatically within the delegatedauth component.
// The context is used for cloud provider detection and initial API key fetch.
func configureDelegatedAuth(ctx context.Context, config pkgconfigmodel.Config, delegatedAuthComp delegatedauth.Component) error {
	// Use the list of registered delegated auth configs that were set up via bindDelegatedAuthConfig
	// To add delegated auth support for a new config prefix, call bindDelegatedAuthConfig(config, prefix)
	// during config initialization (see bindDelegatedAuthConfig for examples)

	// Get global provider config from delegated_auth prefix (used for all instances)
	var providerConfig common.ProviderConfig
	provider := config.GetString("delegated_auth.provider")
	switch provider {
	case "aws":
		providerConfig = &cloudauthconfig.AWSProviderConfig{
			Region: config.GetString("delegated_auth.aws.region"),
		}
	case "":
		// Empty provider means auto-detect, so ProviderConfig stays nil even when
		// delegated_auth.aws.region is set: a non-nil ProviderConfig means "explicitly configured"
		// downstream and would skip provider detection entirely. The component reads the configured
		// region itself once detection picks AWS.
	}

	// Scan all registered prefixes to find which ones have delegated auth enabled
	for _, section := range delegatedAuthKeys {
		// Check if org_uuid is set for this prefix
		orgUUID := config.GetString(section.delegatedAuthPath + ".org_uuid")
		if orgUUID == "" {
			continue
		}

		log.Infof("Configuring delegated authentication for '%s'", section.description)

		// Call AddInstance - the component auto-initializes on the first call
		// Config and ProviderConfig are only used on the first call
		err := delegatedAuthComp.AddInstance(ctx, delegatedauth.InstanceParams{
			Config:          config,
			ProviderConfig:  providerConfig,
			OrgUUID:         orgUUID,
			RefreshInterval: config.GetInt(section.delegatedAuthPath + ".refresh_interval_mins"),
			APIKeyConfigKey: section.apiKeyPath,
		})
		if err != nil {
			log.Errorf("Failed to configure delegated auth for '%s': %v", section.description, err)
		}
	}

	return nil
}

// LoadSystemProbe reads config files and initializes config with decrypted secrets for system-probe
func LoadSystemProbe(config pkgconfigmodel.Config, additionalKnownEnvVars []string) error {
	return loadCustom(config, additionalKnownEnvVars)
}

// loadCustom reads config into the provided config object
func loadCustom(config pkgconfigmodel.Config, additionalKnownEnvVars []string) error {
	log.Info("Starting to load the configuration")
	if err := config.ReadInConfig(); err != nil {
		return err
	}

	for _, key := range findUnknownKeys(config) {
		log.Warnf("Unknown key in config file: %v", key)
	}

	for _, v := range findUnknownEnvVars(config, os.Environ(), additionalKnownEnvVars) {
		log.Warnf("Unknown environment variable: %v", v)
	}

	for _, warningMsg := range findUnexpectedUnicode(config) {
		log.Warnf("%s", warningMsg)
	}

	return nil
}

// setupFipsEndpoints overwrites the Agent endpoint for outgoing data to be sent to the local FIPS proxy. The local FIPS
// proxy will be in charge of forwarding data to the Datadog backend following FIPS standard. Starting from
// fips.port_range_start we will assign a dedicated port per product (metrics, logs, traces, ...).
func setupFipsEndpoints(config pkgconfigmodel.Config) error {
	// Each port is dedicated to a specific data type:
	//
	// port_range_start: HAProxy stats
	// port_range_start + 1:  metrics
	// port_range_start + 2:  traces
	// port_range_start + 3:  profiles
	// port_range_start + 4:  processes
	// port_range_start + 5:  logs
	// port_range_start + 6:  databases monitoring metrics, metadata and activity
	// port_range_start + 7:  databases monitoring samples
	// port_range_start + 8:  network devices metadata
	// port_range_start + 9:  network devices snmp traps
	// port_range_start + 10: instrumentation telemetry
	// port_range_start + 11: appsec events (unused)
	// port_range_start + 12: orchestrator explorer
	// port_range_start + 13: runtime security
	// port_range_start + 14: compliance
	// port_range_start + 15: network devices netflow

	// The `datadog-fips-agent` flavor is incompatible with the fips-proxy and we do not want to downgrade to http or
	// route traffic through a proxy for the above products
	fipsFlavor, err := pkgfips.Enabled()
	if err != nil {
		return err
	}

	if fipsFlavor {
		log.Debug("FIPS mode is enabled in the agent. Ignoring fips-proxy settings")
		return nil
	}

	if !config.GetBool("fips.enabled") {
		log.Debug("FIPS mode is disabled")
		return nil
	}

	log.Warn("The FIPS Agent (`datadog-fips-agent`) will replace the FIPS Proxy as the FIPS-compliant implementation of the Agent in the future. Please ensure that you transition to `datadog-fips-agent` as soon as possible.")

	const (
		proxyStats                 = 0
		metrics                    = 1
		traces                     = 2
		profiles                   = 3
		processes                  = 4
		logs                       = 5
		databasesMonitoringMetrics = 6
		databasesMonitoringSamples = 7
		networkDevicesMetadata     = 8
		networkDevicesSnmpTraps    = 9
		instrumentationTelemetry   = 10
		appsecEvents               = 11
		orchestratorExplorer       = 12
		runtimeSecurity            = 13
		compliance                 = 14
		networkDevicesNetflow      = 15
	)

	localAddress, err := system.IsLocalAddress(config.GetString("fips.local_address"))
	if err != nil {
		return fmt.Errorf("fips.local_address: %s", err)
	}

	portRangeStart := config.GetInt("fips.port_range_start")
	urlFor := func(port int) string { return net.JoinHostPort(localAddress, strconv.Itoa(portRangeStart+port)) }

	log.Warnf("FIPS mode is enabled! All communication to DataDog will be routed to the local FIPS proxy on '%s' starting from port %d", localAddress, portRangeStart)

	// Disabling proxy to make sure all data goes directly to the FIPS proxy
	_ = os.Unsetenv("HTTP_PROXY")
	_ = os.Unsetenv("HTTPS_PROXY")

	// HTTP for now, will soon be updated to HTTPS
	protocol := "http://"
	if config.GetBool("fips.https") {
		protocol = "https://"
		config.Set("skip_ssl_validation", !config.GetBool("fips.tls_verify"), pkgconfigmodel.SourceAgentRuntime)
	}

	// The following overwrites should be kept in sync with the documentation for the fips.enabled config
	// setting in pkg/config/schema/yaml/.

	config.Set("dd_url", protocol+urlFor(metrics), pkgconfigmodel.SourceAgentRuntime)

	setupFipsLogsConfig(config, "logs_config.", urlFor(logs))
	config.Set("logs_config.use_http", true, pkgconfigmodel.SourceAgentRuntime)

	config.Set("apm_config.apm_dd_url", protocol+urlFor(traces), pkgconfigmodel.SourceAgentRuntime)
	// Adding "/api/v2/profile" because it's not added to the 'apm_config.profiling_dd_url' value by the Agent
	config.Set("apm_config.profiling_dd_url", protocol+urlFor(profiles)+"/api/v2/profile", pkgconfigmodel.SourceAgentRuntime)
	config.Set("apm_config.telemetry.dd_url", protocol+urlFor(instrumentationTelemetry), pkgconfigmodel.SourceAgentRuntime)

	config.Set("process_config.process_dd_url", protocol+urlFor(processes), pkgconfigmodel.SourceAgentRuntime)

	// Historically we used a different port for samples because the intake hostname defined in epforwarder.go was different
	// (even though the underlying IPs were the same as the ones for DBM metrics intake hostname). We're keeping 2 ports for backward compatibility reason.
	setupFipsLogsConfig(config, "database_monitoring.metrics.", urlFor(databasesMonitoringMetrics))
	setupFipsLogsConfig(config, "database_monitoring.activity.", urlFor(databasesMonitoringMetrics))
	setupFipsLogsConfig(config, "database_monitoring.samples.", urlFor(databasesMonitoringSamples))

	setupFipsLogsConfig(config, "network_devices.metadata.", urlFor(networkDevicesMetadata))
	setupFipsLogsConfig(config, "network_devices.snmp_traps.forwarder.", urlFor(networkDevicesSnmpTraps))
	setupFipsLogsConfig(config, "network_devices.netflow.forwarder.", urlFor(networkDevicesNetflow))

	config.Set("orchestrator_explorer.orchestrator_dd_url", protocol+urlFor(orchestratorExplorer), pkgconfigmodel.SourceAgentRuntime)

	setupFipsLogsConfig(config, "runtime_security_config.endpoints.", urlFor(runtimeSecurity))

	setupFipsLogsConfig(config, "compliance_config.endpoints.", urlFor(compliance))

	return nil
}

func setupFipsLogsConfig(config pkgconfigmodel.Config, configPrefix string, url string) {
	config.Set(configPrefix+"logs_no_ssl", !config.GetBool("fips.https"), pkgconfigmodel.SourceAgentRuntime)
	config.Set(configPrefix+"logs_dd_url", url, pkgconfigmodel.SourceAgentRuntime)
}

// ResolveSecrets merges all the secret values from origin into config. Secret values
// are identified by a value of the form "ENC[key]" where key is the secret key.
// See: https://github.com/DataDog/datadog-agent/blob/main/docs/agent/secrets.md
//
// It is the exported counterpart of resolveSecrets and may be called by agent
// binaries that build the config before starting the FX graph (e.g. the otel-agent
// in standalone mode, where secrets must be resolved so that ENC[] handles in env
// vars such as DD_HOSTNAME are processed before components like hostnameimpl read
// the config).
func ResolveSecrets(config pkgconfigmodel.Config, secretResolver secrets.Component, origin string) error {
	return resolveSecrets(config, secretResolver, origin)
}

// resolveSecrets merges all the secret values from origin into config. Secret values
// are identified by a value of the form "ENC[key]" where key is the secret key.
// See: https://github.com/DataDog/datadog-agent/blob/main/docs/agent/secrets.md
func resolveSecrets(config pkgconfigmodel.Config, secretResolver secrets.Component, origin string) error {
	log.Info("Starting to resolve secrets")

	var multiBackends map[string]secrets.SecretBackendConfig
	if err := structure.UnmarshalKey(config, "multi_secret_backends", &multiBackends); err != nil {
		log.Warnf("multi_secret_backends: %v", err)
	}

	// We have to init the secrets package before we can use it to decrypt
	// anything.
	secretResolver.Configure(secrets.ConfigParams{
		Type:                         config.GetString("secret_backend_type"),
		Config:                       config.GetStringMap("secret_backend_config"),
		MultiBackends:                multiBackends,
		Command:                      config.GetString("secret_backend_command"),
		Arguments:                    config.GetStringSlice("secret_backend_arguments"),
		Timeout:                      config.GetInt("secret_backend_timeout"),
		MaxSize:                      config.GetInt("secret_backend_output_max_size"),
		RefreshInterval:              config.GetInt("secret_refresh_interval"),
		RefreshIntervalScatter:       config.GetBool("secret_refresh_scatter"),
		GroupExecPerm:                config.GetBool("secret_backend_command_allow_group_exec_perm"),
		RemoveLinebreak:              config.GetBool("secret_backend_remove_trailing_line_break"),
		RunPath:                      config.GetString("run_path"),
		AuditFileMaxSize:             config.GetInt("secret_audit_file_max_size"),
		ScopeIntegrationToNamespace:  config.GetBool("secret_scope_integration_to_their_k8s_namespace"),
		AllowedNamespace:             config.GetStringSlice("secret_allowed_k8s_namespace"),
		ImageToHandle:                config.GetStringMapStringSlice("secret_image_to_handle"),
		APIKeyFailureRefreshInterval: config.GetInt("secret_refresh_on_api_key_failure_interval"),
	})

	if config.GetString("secret_backend_command") != "" || config.GetString("secret_backend_type") != "" || len(multiBackends) > 0 {
		// Viper doesn't expose the final location of the file it
		// loads. Since we are searching for 'datadog.yaml' in multiple
		// locations we let viper determine the one to use before
		// updating it.
		yamlConf, err := yaml.Marshal(config.AllSettings())
		if err != nil {
			return fmt.Errorf("unable to marshal configuration to YAML to decrypt secrets: %v", err)
		}

		secretResolver.SubscribeToChanges(func(handle, settingOrigin string, settingPath []string, _, newValue any) {
			if origin != settingOrigin {
				return
			}
			if err := configAssignAtPath(config, settingPath, newValue); err != nil {
				log.Errorf("Could not assign new value of secret %s (%+q) to config: %s", handle, settingPath, err)
			}
		})
		if _, err = secretResolver.Resolve(yamlConf, origin, "", "", true); err != nil {
			return fmt.Errorf("unable to decrypt secret from datadog.yaml: %v", err)
		}
	}
	log.Info("Finished resolving secrets")
	return nil
}

// confgAssignAtPath assigns a value to the given setting of the config
// This works around viper issues that prevent us from assigning to fields that have a dot in the
// name (example: 'additional_endpoints.http://url.com') and also allows us to assign to individual
// elements of a slice of items (example: 'proxy.no_proxy.0' to assign index 0 of 'no_proxy')
func configAssignAtPath(config pkgconfigmodel.Config, settingPath []string, newValue any) error {
	settingName := strings.Join(settingPath, ".")
	if config.IsKnown(settingName) {
		config.Set(settingName, newValue, pkgconfigmodel.SourceSecret)
		return nil
	}

	// Trying to assign to an unknown config field can happen when trying to set a
	// value inside of a compound object (a slice or a map) which allows arbitrary key
	// values. Some settings where this happens include `additional_endpoints`, or
	// `kubernetes_node_annotations_as_tags`, etc. Since these arbitrary keys can
	// contain a '.' character, we are unable to use the standard `config.Set` method.
	// Instead, we remove trailing elements from the end of the path until we find a known
	// config field, retrieve the compound object at that point, and then use the trailing
	// elements to figure out how to modify that particular object, before setting it back
	// on the config.
	//
	// Example with the follow configuration:
	//
	//    process_config:
	//      additional_endpoints:
	//        http://url.com:
	//         - ENC[handle_to_password]
	//
	// Calling this function like:
	//
	//   configAssignAtPath(config, ['process_config', 'additional_endpoints', 'http://url.com', '0'], 'password')
	//
	// This is split into:
	//   ['process_config', 'additional_endpoints']  // a known config field
	// and:
	//   ['http://url.com', '0']                     // trailing elements
	//
	// This function will effectively do:
	//
	// var original map[string][]string = config.Get('process_config.additional_endpoints')
	// var slice []string               = original['http://url.com']
	// slice[0] = 'password'
	// config.Set('process_config.additional_endpoints', original)

	trailingElements := make([]string, 0, len(settingPath))
	// copy the path and hold onto the original, useful for error messages
	path := slices.Clone(settingPath)
	for {
		if len(path) == 0 {
			return fmt.Errorf("unknown config setting '%s'", settingPath)
		}
		// get the last element from the path and add it to the trailing elements
		lastElem := path[len(path)-1]
		trailingElements = append(trailingElements, lastElem)
		// remove that element from the path and see if we've reached a known field
		path = path[:len(path)-1]
		settingName = strings.Join(path, ".")
		if config.IsKnown(settingName) {
			break
		}
	}
	slices.Reverse(trailingElements)

	// retrieve the config value at the known field
	startingValue := config.Get(settingName)
	iterateValue := startingValue
	// iterate down until we find the final object that we are able to modify
	for k, elem := range trailingElements {
		switch modifyValue := iterateValue.(type) {
		case map[string]interface{}:
			if k == len(trailingElements)-1 {
				// if we reached the final object, modify it directly by assigning the newValue parameter
				modifyValue[elem] = newValue
			} else {
				// otherwise iterate inside that compound object
				iterateValue = modifyValue[elem]
			}
		case map[interface{}]interface{}:
			if k == len(trailingElements)-1 {
				// use integer key when it exists in map to avoid mixing string and integer keys (e.g., "2" and 2)
				if index, err := strconv.Atoi(elem); err == nil {
					if _, exists := modifyValue[index]; exists {
						modifyValue[index] = newValue
						continue
					}
				}
				modifyValue[elem] = newValue
			} else {
				iterateValue = modifyValue[elem]
			}
		case []string:
			index, err := strconv.Atoi(elem)
			if err != nil {
				return err
			}
			if index >= len(modifyValue) {
				return fmt.Errorf("index out of range %d >= %d", index, len(modifyValue))
			}
			if k == len(trailingElements)-1 {
				modifyValue[index] = fmt.Sprintf("%s", newValue)
			} else {
				iterateValue = modifyValue[index]
			}
		case []interface{}:
			index, err := strconv.Atoi(elem)
			if err != nil {
				return err
			}
			if index >= len(modifyValue) {
				return fmt.Errorf("index out of range %d >= %d", index, len(modifyValue))
			}
			if k == len(trailingElements)-1 {
				modifyValue[index] = newValue
			} else {
				iterateValue = modifyValue[index]
			}
		default:
			return fmt.Errorf("cannot assign to setting '%s' of type %T", settingPath, iterateValue)
		}
	}

	config.Set(settingName, startingValue, pkgconfigmodel.SourceSecret)
	return nil
}

// envVarAreSetAndNotEqual returns true if two given variables are set in environment and are not equal.
func envVarAreSetAndNotEqual(lhsName string, rhsName string) bool {
	lhsValue, lhsIsSet := os.LookupEnv(lhsName)
	rhsValue, rhsIsSet := os.LookupEnv(rhsName)

	return lhsIsSet && rhsIsSet && lhsValue != rhsValue
}

// sanitizeAPIKeyConfig strips newlines and other control characters from a given key.
func sanitizeAPIKeyConfig(config pkgconfigmodel.Config, key string) {
	if !config.IsKnown(key) || !config.IsConfigured(key) {
		return
	}
	original := config.GetString(key)
	trimmed := strings.TrimSpace(original)
	if original == trimmed {
		return
	}
	config.Set(key, trimmed, pkgconfigmodel.SourceAgentRuntime)
}

// sanitizeDataPlaneConfig gates data_plane.enabled to supported platforms and
// configurations. The Agent Data Plane (ADP) is supported on Linux, macOS, AIX,
// and Windows. On unsupported platforms, or on Windows when process_manager.enabled
// is false, this function always installs a SourceAgentRuntime override of
// false, which beats file and fleet-policy sources and prevents them from
// re-enabling ADP after this call returns. A warning is emitted only when the
// value was explicitly set to true at call time.
//
// Windows ADP runs only under dd-procmgr (via processes.d); dd-procmgr-service is
// started by the core Agent only when process_manager.enabled is true.
//
// The goos parameter is the target OS string (normally runtime.GOOS). It is
// exposed as a parameter so that tests can exercise both branches without
// needing to cross-compile.
//
// The envLookup parameter is normally os.Getenv. It is exposed as a parameter
// so tests can inject a stub without touching global state.
// When DD_DATA_PLANE_FORCE_ENABLE=true the OS gate is skipped entirely; this
// is intended for local development on unsupported platforms only.
func sanitizeDataPlaneConfig(config pkgconfigmodel.Config, goos string, envLookup func(string) string) {
	if envLookup("DD_DATA_PLANE_FORCE_ENABLE") == "true" {
		return
	}

	switch {
	case goos == "linux", goos == "darwin", goos == "aix":
		return
	case goos == "windows":
		if config.GetBool("process_manager.enabled") {
			// LoadDatadog may have locked data_plane.enabled=false before fleet policies
			// were merged; SourceAgentRuntime outranks SourceFleetPolicies, so clear the
			// stale runtime override once process manager is enabled.
			if config.GetSource(DataPlaneEnabled) == pkgconfigmodel.SourceAgentRuntime {
				config.UnsetForSource(DataPlaneEnabled, pkgconfigmodel.SourceAgentRuntime)
			}
			return
		}
		if config.GetBool(DataPlaneEnabled) {
			log.Warnf("%s requires process_manager.enabled on Windows and will be ignored", DataPlaneEnabled)
		}
	default:
		if config.GetBool(DataPlaneEnabled) {
			log.Warnf("%s is not supported on %s and will be ignored", DataPlaneEnabled, goos)
		}
	}

	config.Set(DataPlaneEnabled, false, pkgconfigmodel.SourceAgentRuntime)
}

// SanitizeDataPlaneConfig applies sanitizeDataPlaneConfig for the current host.
// It is also called after fleet policy merging because fleet policies may set
// process_manager.enabled or data_plane.enabled after the initial LoadDatadog pass.
func SanitizeDataPlaneConfig(config pkgconfigmodel.Config) {
	sanitizeDataPlaneConfig(config, runtime.GOOS, os.Getenv)
}

// sanitizeExternalMetricsProviderChunkSize ensures the value of `external_metrics_provider.chunk_size` is within an acceptable range
func sanitizeExternalMetricsProviderChunkSize(config pkgconfigmodel.Config) {
	if !config.IsKnown("external_metrics_provider.chunk_size") {
		return
	}

	chunkSize := config.GetInt("external_metrics_provider.chunk_size")
	if chunkSize <= 0 {
		log.Warnf("external_metrics_provider.chunk_size cannot be negative: %d", chunkSize)
		config.Set("external_metrics_provider.chunk_size", 1, pkgconfigmodel.SourceAgentRuntime)
	}
	if chunkSize > maxExternalMetricsProviderChunkSize {
		log.Warnf("external_metrics_provider.chunk_size has been set to %d, which is higher than the maximum allowed value %d. Using %d.", chunkSize, maxExternalMetricsProviderChunkSize, maxExternalMetricsProviderChunkSize)
		config.Set("external_metrics_provider.chunk_size", maxExternalMetricsProviderChunkSize, pkgconfigmodel.SourceAgentRuntime)
	}
}

func toggleDefaultPayloads(config pkgconfigmodel.Config) {
	// Disables metric data submission (including Custom Metrics) so that hosts stop showing up in Datadog.
	// Used namely for Error Tracking Standalone where it is not needed.
	if !config.GetBool("core_agent.enabled") {
		config.Set("enable_payloads.events", false, pkgconfigmodel.SourceAgentRuntime)
		config.Set("enable_payloads.series", false, pkgconfigmodel.SourceAgentRuntime)
		config.Set("enable_payloads.service_checks", false, pkgconfigmodel.SourceAgentRuntime)
		config.Set("enable_payloads.sketches", false, pkgconfigmodel.SourceAgentRuntime)
	}
}

func applyInfrastructureModeOverrides(config pkgconfigmodel.Config) {
	infraMode := config.GetString("infrastructure_mode")

	// Apply legacy alias: copy values from legacy key to integration.additional
	// Legacy `allowed_additional_checks` -> `integration.additional`
	if legacyAdditional := config.GetStringSlice("allowed_additional_checks"); len(legacyAdditional) > 0 {
		combined := append(config.GetStringSlice("integration.additional"), legacyAdditional...)
		config.Set("integration.additional", combined, pkgconfigmodel.SourceAgentRuntime)
	}

	if infraMode == "end_user_device" {
		// Enable features for end_user_device mode
		config.Set("process_config.process_collection.enabled", true, pkgconfigmodel.SourceInfraMode)
		config.Set("software_inventory.enabled", true, pkgconfigmodel.SourceInfraMode)
		config.Set("notable_events.enabled", true, pkgconfigmodel.SourceInfraMode)
		config.Set("logon_duration.enabled", true, pkgconfigmodel.SourceInfraMode)
	} else if infraMode == "none" {
		// Disable integrations (no host metrics collection)
		config.Set("integration.enabled", false, pkgconfigmodel.SourceInfraMode)
		// Avoid detailed ECS task metadata collection when not collecting infrastructure.
		config.Set("ecs_task_collection_enabled", false, pkgconfigmodel.SourceInfraMode)
	}
}

// ApplyUseDogstatsdSuppression is a post-load override that, when
// use_dogstatsd is false, forces data_plane.dogstatsd.enabled to false
// so the Agent Data Plane process (which reads the latter via the
// config stream) skips its DogStatsD source. data_plane.enabled is
// intentionally left alone so other ADP pipelines (e.g. OTLP) keep
// working independently of the DogStatsD master toggle.
//
// It is registered as an override func (runs after datadog.yaml loads) and
// also called explicitly after fleet policy merging, because fleet policies
// are applied after the initial override pass.
//
// Matches the truth table at
// https://github.com/DataDog/saluki/issues/1334#issuecomment-4292253054.
func ApplyUseDogstatsdSuppression(config pkgconfigmodel.Config) {
	if !config.GetBool("use_dogstatsd") && config.GetBool("data_plane.dogstatsd.enabled") {
		log.Infof("Forcing data_plane.dogstatsd.enabled=false because use_dogstatsd=false")
		config.Set("data_plane.dogstatsd.enabled", false, pkgconfigmodel.SourceAgentRuntime)
	}
}

// ComputeDataPlaneStopTimeout is a post-load override that, when the user has
// not explicitly set data_plane.stop_timeout, recomputes it from
// aggregator_stop_timeout + forwarder_stop_timeout. The Agent Data Plane reads
// this value via the config stream to size its topology graceful-shutdown
// budget; computing the sum here keeps that budget aligned with the documented
// core-agent shutdown window even when users customize the component
// timeouts.
//
// It is registered as an override func (runs after datadog.yaml loads) and
// also called explicitly after fleet policy merging, because fleet policies
// are applied after the initial override pass.
func ComputeDataPlaneStopTimeout(config pkgconfigmodel.Config) {
	if config.GetSource("data_plane.stop_timeout") != pkgconfigmodel.SourceDefault {
		return
	}
	sum := config.GetInt("aggregator_stop_timeout") + config.GetInt("forwarder_stop_timeout")
	// Keep the source as default: the value is a derived default, not an
	// agent runtime decision, so it should be filtered out by views that
	// strip defaults (e.g. config dumps for diagnostics).
	config.Set("data_plane.stop_timeout", sum, pkgconfigmodel.SourceDefault)
}

// pathExists returns true if the given path exists
func pathExists(path string) bool {
	_, err := os.Stat(path)
	return !os.IsNotExist(err)
}

// setNumWorkers is a helper to set the effective number of workers for
// a given config.
func setNumWorkers(config pkgconfigmodel.Config) {
	if !config.IsKnown("check_runners") {
		return
	}

	wTracemalloc := config.GetBool("tracemalloc_debug")
	if wTracemalloc {
		log.Infof("Tracemalloc enabled, only one check runner enabled to run checks serially")

		// update config with the actual effective number of workers
		config.Set("check_runners", 1, pkgconfigmodel.SourceAgentRuntime)
	}
}

func getPlatformDefault(platformValues map[string]interface{}) interface{} {
	if pkgconfigenv.IsECSFargate() {
		if val, found := platformValues["fargate"]; found {
			return val
		}
	}
	if pkgconfigenv.IsContainerized() {
		if val, found := platformValues["container"]; found {
			return val
		}
	}
	if val, found := platformValues[runtime.GOOS]; found {
		return val
	}
	if val, found := platformValues["other"]; found {
		return val
	}
	return nil
}