[review-fix 1] Preserve traceroute defaults and hide baseline flag

- register explicit traceroute before platform default modules are selected
- keep the baseline rollout setting internal and omit it from generated examples
- cover the Windows injector dependency for explicit traceroute

Source: Codex review thread and maintainer direction

Validation: bazel test //pkg/system-probe/config:config_test; dda inv schema.lint; dda inv schema.template-all; git diff --check

Author: AlexandreYang

pkg/config/example/datadog-agent_linux.yaml.example

@@ -2216,17 +2216,6 @@ api_key:
 #
 #     enabled: true
 
-#     # @param baseline_tests - custom object - optional
-#     # Configuration for included baseline Network Path Dynamic Tests.
-#
-#     baseline_tests:
-
-#       # @param enabled - boolean - optional - default: false
-#       # @env DD_NETWORK_PATH_CONNECTIONS_MONITORING_BASELINE_TESTS_ENABLED - boolean - optional - default: false
-#       # Enables up to three included Network Path Dynamic Tests every 30 minutes when Cloud Network Monitoring is enabled.
-#
-#       enabled: true
-
 #   # @param collector - custom object - optional
 #   # Configuration related to Network Path Collector used for Network Path Dynamic Test
 #   # to monitor network traffic connections on the host.

pkg/config/example/datadog-agent_windows.yaml.example

@@ -2231,17 +2231,6 @@ api_key:
 #
 #     enabled: true
 
-#     # @param baseline_tests - custom object - optional
-#     # Configuration for included baseline Network Path Dynamic Tests.
-#
-#     baseline_tests:
-
-#       # @param enabled - boolean - optional - default: false
-#       # @env DD_NETWORK_PATH_CONNECTIONS_MONITORING_BASELINE_TESTS_ENABLED - boolean - optional - default: false
-#       # Enables up to three included Network Path Dynamic Tests every 30 minutes when Cloud Network Monitoring is enabled.
-#
-#       enabled: true
-
 #   # @param collector - custom object - optional
 #   # Configuration related to Network Path Collector used for Network Path Dynamic Test
 #   # to monitor network traffic connections on the host.

pkg/config/schema/yaml/core_schema.yaml

@@ -1726,16 +1726,15 @@ properties:
           baseline_tests:
             node_type: section
             type: object
-            visibility: public
             description: Configuration for included baseline Network Path Dynamic Tests.
             properties:
               enabled:
                 node_type: setting
                 type: boolean
                 default: false
-                visibility: public
-                description: Enables up to three included Network Path Dynamic Tests every
-                  30 minutes when Cloud Network Monitoring is enabled.
+                description: Enables up to three included Network Path Dynamic Tests immediately
+                  for the first eligible snapshot, then every 30 minutes, when Cloud Network
+                  Monitoring is enabled.
                 example: 'true'
       collector:
         node_type: section

pkg/system-probe/config/config.go

@@ -182,6 +182,11 @@ func load() (*types.Config, error) {
 	if cfg.GetBool(pngNS("enabled")) {
 		c.EnabledModules[PingModule] = struct{}{}
 	}
+	// Keep explicit traceroute activation with the other explicit modules so
+	// platform default modules can observe it below.
+	if cfg.GetBool(tracerouteNS("enabled")) {
+		c.EnabledModules[TracerouteModule] = struct{}{}
+	}
 	if cfg.GetBool(discoveryNS("enabled")) {
 		c.EnabledModules[DiscoveryModule] = struct{}{}
 	}
@@ -241,7 +246,7 @@ func load() (*types.Config, error) {
 	// activate traceroute even when system-probe was not explicitly enabled.
 	c.Enabled = len(c.EnabledModules) > 0
 	cfg.Set(spNS("enabled"), c.Enabled, pkgconfigmodel.SourceAgentRuntime)
-	if cfg.GetBool(tracerouteNS("enabled")) || npconfig.ResolveDynamicTestsState(coreCfg, cfg) != npconfig.DynamicTestsOff {
+	if npconfig.ResolveDynamicTestsState(coreCfg, cfg) != npconfig.DynamicTestsOff {
 		c.EnabledModules[TracerouteModule] = struct{}{}
 	}
 	c.Enabled = len(c.EnabledModules) > 0

pkg/system-probe/config/config_test.go

@@ -166,17 +166,18 @@ func TestEnableDiscovery(t *testing.T) {
 
 func TestTracerouteModuleDynamicTestsState(t *testing.T) {
 	tests := []struct {
-		name       string
-		core       map[string]any
-		sysprobe   map[string]any
-		wantEnable bool
+		name                 string
+		core                 map[string]any
+		sysprobe             map[string]any
+		wantEnable           bool
+		checkDefaultInjector bool
 	}{
 		{name: "baseline disabled has no impact", core: map[string]any{"network_path.connections_monitoring.baseline_tests.enabled": false}, sysprobe: map[string]any{"system_probe_config.enabled": true, "network_config.enabled": true}},
 		{name: "baseline outside CNM", core: map[string]any{"network_path.connections_monitoring.baseline_tests.enabled": true}, sysprobe: map[string]any{"system_probe_config.enabled": true, "network_config.enabled": false}},
 		{name: "effective baseline with implicit system probe", core: map[string]any{"network_path.connections_monitoring.baseline_tests.enabled": true}, sysprobe: map[string]any{"network_config.enabled": true}, wantEnable: true},
 		{name: "effective baseline", core: map[string]any{"network_path.connections_monitoring.baseline_tests.enabled": true}, sysprobe: map[string]any{"system_probe_config.enabled": true, "network_config.enabled": true}, wantEnable: true},
 		{name: "effective standard", core: map[string]any{"network_path.connections_monitoring.enabled": true}, sysprobe: map[string]any{"system_probe_config.enabled": true, "network_config.enabled": true}, wantEnable: true},
-		{name: "explicit traceroute remains supported", sysprobe: map[string]any{"traceroute.enabled": true}, wantEnable: true},
+		{name: "explicit traceroute remains supported", sysprobe: map[string]any{"traceroute.enabled": true}, wantEnable: true, checkDefaultInjector: true},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -191,6 +192,9 @@ func TestTracerouteModuleDynamicTestsState(t *testing.T) {
 			cfg, err := New("/doesnotexist", "")
 			require.NoError(t, err)
 			assert.Equal(t, tt.wantEnable, cfg.ModuleIsEnabled(TracerouteModule))
+			if tt.checkDefaultInjector && runtime.GOOS == "windows" {
+				assert.True(t, cfg.ModuleIsEnabled(InjectorModule), "explicit traceroute should enable the default injector module")
+			}
 		})
 	}
 }