Merge branch 'main' into niharikag09/otel-url-template-resource-name

Author: niharikag09

.bazelrc

@@ -110,7 +110,7 @@ common:ci --noexperimental_convenience_symlinks # not CI-suitable: "These symlin
 common:ci --remote_download_regex=.*/test\.xml$ # force-download test.xml even under --remote_download_outputs=toplevel, so junit collection can read it locally
 
 # Project/Language configs --------------------------------------------------------------------------------------
-import %workspace%/bazel/configs/flavors.bazelrc
+import %workspace%/bazel/configs/go_tests.bazelrc
 import %workspace%/bazel/configs/rust.bazelrc
 
 # Global release config ------------------------------------------------------------------------------------------------

.github/CODEOWNERS

@@ -409,6 +409,7 @@
 /comp/core/configstream @DataDog/fleet-automation
 /comp/core/configstreamconsumer @DataDog/fleet-automation
 /comp/core/configsync @DataDog/fleet-automation
+/comp/core/delegatedauth @DataDog/credential-management
 /comp/core/diagnose @DataDog/fleet-remediation
 /comp/core/flare @DataDog/fleet-remediation
 /comp/core/gui @DataDog/fleet-remediation
@@ -687,6 +688,7 @@
 /pkg/tagset/                            @DataDog/agent-runtimes
 /pkg/util/                              @DataDog/agent-runtimes
 /pkg/util/aggregatingqueue              @DataDog/container-integrations @DataDog/container-platform
+/pkg/util/aws/creds/                    @DataDog/credential-management
 /pkg/util/cloudproviders/cloudfoundry/  @DataDog/agent-integrations
 /pkg/util/clusteragent/                 @DataDog/container-platform
 /pkg/util/confmaputils                       @DataDog/opentelemetry-agent @DataDog/profiling-full-host

.gitlab-ci.yml

@@ -474,12 +474,15 @@ variables:
 
 # fakeintake changes that rebuild the published image (server binary only).
 # Client/CLI/docs changes don't. Keep in sync with _is_server_file() in tasks/fakeintake.py.
+# Only `.go` files under the server paths matter: the image is built from the Go sources
+# via test/fakeintake/Dockerfile, so BUILD.bazel and test fixtures don't affect it
+# (rules:changes has no exclusion syntax, hence the extension in the glob).
 .fakeintake_server_paths: &fakeintake_server_paths
   paths:
-    - test/fakeintake/cmd/server/**/*
-    - test/fakeintake/server/**/*
-    - test/fakeintake/aggregator/**/*
-    - test/fakeintake/api/**/*
+    - test/fakeintake/cmd/server/**/*.go
+    - test/fakeintake/server/**/*.go
+    - test/fakeintake/aggregator/**/*.go
+    - test/fakeintake/api/**/*.go
     - test/fakeintake/go.mod
     - test/fakeintake/go.sum
     - test/fakeintake/Dockerfile

.gitlab/build/bazel/test.yml

@@ -33,33 +33,33 @@
   - dda inv -- -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
 
 bazel:test:linux-amd64:
-  extends: [ .bazel:test:reporting, .bazel:runner:linux-amd64, .bazel:test ]
+  extends: [.bazel:test:reporting, .bazel:runner:linux-amd64, .bazel:test]
   script:
     - !reference [.bazel:test:reporting:ci_links]
-    - bazel test --jobs=$KUBERNETES_CPU_REQUEST --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE --config=no-dd-agent-go-tests //...
+    - bazel test --config=gorace --jobs=$KUBERNETES_CPU_REQUEST --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE //...
 
 bazel:test:linux-arm64:
-  extends: [ .bazel:test:reporting, .bazel:runner:linux-arm64, .bazel:test ]
+  extends: [.bazel:test:reporting, .bazel:runner:linux-arm64, .bazel:test]
   script:
     - !reference [.bazel:test:reporting:ci_links]
-    - bazel test --jobs=$KUBERNETES_CPU_REQUEST --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE --config=no-dd-agent-go-tests //...
+    - bazel test --config=gorace --jobs=$KUBERNETES_CPU_REQUEST --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE //...
 
 bazel:test:macos-amd64:
-  extends: [ .bazel:test:reporting, .bazel:runner:macos-amd64, .bazel:test ]
+  extends: [.bazel:test:reporting, .bazel:runner:macos-amd64, .bazel:test]
   script:
     - !reference [.install_python_dependencies]
     - !reference [.bazel:test:reporting:ci_links]
-    - bazel test --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE --config=no-dd-agent-go-tests //...
+    - bazel test --config=gorace --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE //...
   after_script:
     - !reference [.install_python_dependencies]
     - !reference [.bazel:test:reporting, after_script]
 
 bazel:test:macos-arm64:
-  extends: [ .bazel:test:reporting, .bazel:runner:macos-arm64, .bazel:test ]
+  extends: [.bazel:test:reporting, .bazel:runner:macos-arm64, .bazel:test]
   script:
     - !reference [.install_python_dependencies]
     - !reference [.bazel:test:reporting:ci_links]
-    - bazel test --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE --execution_log_compact_file=$CI_PROJECT_DIR/bazel-exec.log --config=no-dd-agent-go-tests //...
+    - bazel test --config=gorace --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE --execution_log_compact_file=$CI_PROJECT_DIR/bazel-exec.log //...
   after_script:
     - !reference [.install_python_dependencies]
     - !reference [.bazel:test:reporting, after_script]
@@ -69,112 +69,22 @@ bazel:test:macos-arm64:
       - bazel-bep-*.json
       - bazel-exec.log
 
+# Windows splits the build from the Go tests, unlike the other platforms: the
+# runner has 16 CPUs, and compiling the rest of the repo alongside ~1k
+# race-instrumented tests starves them enough that tests waiting on wall-clock
+# time fail. This job covers everything but the Go tests.
 bazel:test:windows-amd64:
-  extends: [ .bazel:runner:windows-amd64, .bazel:test ]
+  extends: [.bazel:runner:windows-amd64, .bazel:test]
   variables:
     POWERSHELL_SCRIPT: >-
-      bazel test --keep_going --config=no-dd-agent-go-tests
-      //... --
+      bazel test --config=gorace --config=no-dd-agent-go-tests --keep_going //... --
       -//bazel/rules/dd_packaging/...
       -//packages/agent/linux/...
 
-# Per-flavor test jobs. Each runs the tests for one agent flavor, mirroring the
-# dda inv test --flavor=<f> topology. --config=<flavor> sets
-# --test_tag_filters=flavor_<flavor>, selecting only the matching go_test variants.
-.bazel:test:flavor:
-  extends: [ .bazel:test, .bazel:test:reporting ]
-  script:
-    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token) || echo 'Failed to fetch an API key, no metrics will be emitted'; export DD_API_KEY
-    - !reference [.bazel:test:reporting:ci_links]
-    - bazel test --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE --build_tests_only --config=$FLAVOR //pkg/... //comp/... //cmd/...
-    - dda inv -- -e bazel.ensure-test-parity --bep $BEP_FILE --flavor-name $FLAVOR --emit-metrics
-
-# macOS flavor variant: re-installs dda in both script and after_script since
-# macOS shell executors run each phase in a fresh shell.
-.bazel:test:flavor:macos:
-  extends: .bazel:test:flavor
-  script:
-    - !reference [.install_python_dependencies]
-    - !reference [.bazel:test:flavor, script]
-  after_script:
-    - !reference [.install_python_dependencies]
-    - !reference [.bazel:test:reporting, after_script]
-
-bazel:test:linux-amd64:base:
-  extends: [ .bazel:runner:linux-amd64, .bazel:test:flavor ]
-  variables:
-    FLAVOR: base
-
-bazel:test:linux-amd64:dogstatsd:
-  extends: [ .bazel:runner:linux-amd64, .bazel:test:flavor ]
-  variables:
-    FLAVOR: dogstatsd
-
-bazel:test:linux-amd64:heroku:
-  extends: [ .bazel:runner:linux-amd64, .bazel:test:flavor ]
-  variables:
-    FLAVOR: heroku
-
-bazel:test:linux-amd64:iot:
-  extends: [ .bazel:runner:linux-amd64, .bazel:test:flavor ]
-  variables:
-    FLAVOR: iot
-
-bazel:test:linux-arm64:base:
-  extends: [ .bazel:runner:linux-arm64, .bazel:test:flavor ]
-  variables:
-    FLAVOR: base
-
-bazel:test:linux-arm64:dogstatsd:
-  extends: [ .bazel:runner:linux-arm64, .bazel:test:flavor ]
-  variables:
-    FLAVOR: dogstatsd
-
-bazel:test:linux-arm64:heroku:
-  extends: [ .bazel:runner:linux-arm64, .bazel:test:flavor ]
-  variables:
-    FLAVOR: heroku
-
-bazel:test:linux-arm64:iot:
-  extends: [ .bazel:runner:linux-arm64, .bazel:test:flavor ]
-  variables:
-    FLAVOR: iot
-
-bazel:test:macos-amd64:base:
-  extends: [ .bazel:runner:macos-amd64, .bazel:test:flavor:macos ]
-  variables:
-    FLAVOR: base
-
-bazel:test:macos-amd64:dogstatsd:
-  extends: [ .bazel:runner:macos-amd64, .bazel:test:flavor:macos ]
-  variables:
-    FLAVOR: dogstatsd
-
-bazel:test:macos-arm64:base:
-  extends: [ .bazel:runner:macos-arm64, .bazel:test:flavor:macos ]
-  variables:
-    FLAVOR: base
-
-bazel:test:macos-arm64:dogstatsd:
-  extends: [ .bazel:runner:macos-arm64, .bazel:test:flavor:macos ]
-  variables:
-    FLAVOR: dogstatsd
-
-# Windows can't extend .bazel:test:flavor: the Windows runner template consumes
-# POWERSHELL_SCRIPT instead of `script:`, and the test pattern needs to exclude
-# Linux-only packaging targets.
-bazel:test:windows-amd64:base:
-  extends: [ .bazel:runner:windows-amd64, .bazel:test ]
+bazel:test:windows-amd64:go:
+  extends: [.bazel:runner:windows-amd64, .bazel:test]
   variables:
     POWERSHELL_SCRIPT: >-
-      bazel test --keep_going --build_tests_only --config=base
-      --build_event_json_file=$CI_PROJECT_DIR/bazel-bep-base.json
-      //pkg/... //comp/... //cmd/...;
-      dda inv -- -e bazel.ensure-test-parity
-      --bep $CI_PROJECT_DIR/bazel-bep-base.json
-      --flavor-name base
-  artifacts:
-    when: always
-    paths:
-      - bazel-bep-*.json
-    expire_in: 1 week
+      bazel test --config=gorace --config=dd-agent-go-tests-only --build_tests_only --keep_going //... --
+      -//bazel/rules/dd_packaging/...
+      -//packages/agent/linux/...

.gitlab/windows/test/e2e_install_packages/windows.yml

@@ -65,7 +65,6 @@
       - E2E_MSI_TEST: TestInstallExistingAltDir
       - E2E_MSI_TEST: TestInstallAltDirAndCorruptForUninstall
       - E2E_MSI_TEST: TestInstallFail
-      - E2E_MSI_TEST: TestInstallWithUntrustedConfigRoot
       - E2E_MSI_TEST: TestInstallWithLanmanServerDisabled
       - E2E_MSI_TEST: TestInstallWithInstallOnlyFlag
       - E2E_MSI_TEST: TestInstallWithAutologger

BUILD.bazel

@@ -1,4 +1,8 @@
 # Global build settings
+# gazelle:dd_agent_go_test on
+# gazelle:go_canonical_test_tag_set docker kubelet
+# gazelle:go_canonical_test_tag_set cel clusterchecks kubeapiserver kubelet orchestrator
+# gazelle:go_canonical_test_tag_set linux_bpf
 
 load("@bazel_lib//lib:write_source_files.bzl", "write_source_file", "write_source_files")
 load("@bazel_skylib//rules:common_settings.bzl", "bool_flag", "string_flag")

CHANGELOG-DCA.rst

@@ -2,6 +2,106 @@
 Release Notes
 =============
 
+.. _Release Notes_7.82.0:
+
+7.82.0
+======
+
+.. _Release Notes_7.82.0_Prelude:
+
+Prelude
+-------
+
+Released on: 2026-08-05
+Pinned to datadog-agent v7.82.0: `CHANGELOG <https://github.com/DataDog/datadog-agent/blob/main/CHANGELOG.rst#7820>`_.
+
+
+.. _Release Notes_7.82.0_New Features:
+
+New Features
+------------
+
+- The Cluster Agent's Prometheus HTTP Service Discovery provider supports
+  an optional ``exclude_filter`` field per endpoint entry. The field
+  accepts a CEL expression evaluated against each discovered target's
+  ``host``, ``port``, and ``labels`` fields. Targets for which the
+  expression returns ``true`` are skipped at collection time.
+
+
+.. _Release Notes_7.82.0_Enhancement Notes:
+
+Enhancement Notes
+-----------------
+
+- The Cluster Agent's leader election now uses a dedicated Kubernetes API server
+  client with independently managed client-side rate limiting to be more resilient.
+
+- Reduce scale-up stabilization windows for built-in DPA presets:
+  Optimize Cost from 300s to 190s, Optimize Balance from 600s to 130s,
+  and Optimize Performance from 900s to 70s. This allows faster
+  scale-up response for workloads using autoscaling profiles.
+
+- Cluster check stickiness is now enabled by default. The dispatcher biases
+  check placement toward the runner where a check previously ran, reducing
+  unnecessary check migrations. The behavior can be tuned or disabled via the
+  following configuration options:
+  
+  - ``cluster_checks.stickiness_enabled`` — enable or disable stickiness (default: ``true``)
+  - ``cluster_checks.stickiness_factor`` — multiplier applied to check cost when computing the bias (default: ``4.0``)
+  - ``cluster_checks.stickiness_upper_limit`` — maximum bias applied regardless of check cost (default: ``1.0``)
+  - ``cluster_checks.stickiness_lower_limit`` — minimum bias applied when stickiness is enabled (default: ``0.05``)
+
+
+.. _Release Notes_7.82.0_Bug Fixes:
+
+Bug Fixes
+---------
+
+- Fixed APM Single Step Instrumentation injecting the library twice when the
+  admission webhook is reinvoked (for example on GKE Autopilot, where another
+  mutating webhook triggers reinvocation). In CSI injection mode the pod has no
+  init container, so the re-admission guard failed to detect that the pod was
+  already instrumented and appended the injector to ``LD_PRELOAD`` a second time.
+  The guard now also checks for the instrumentation volume, which is present in
+  every injection mode.
+
+- Fixed an issue where the Cluster Agent could associate a pod's detected
+  languages with the wrong Deployment. The Cluster Agent now only attributes a pod's
+  detected languages to a Deployment when the pod is owned by a ReplicaSet and
+  the ReplicaSet derived from the pod name matches the owner ReplicaSet. Pods
+  that are not owned by a ReplicaSet are no longer considered for
+  Deployment-level language detection.
+
+- Fix ``cluster_checks.nodes_reporting`` gauge drifting upward across
+  leader elections. The metric is now correctly decremented when the
+  cluster agent loses leadership and the node store is reset.
+
+- Fix `agent` commands in DCA (listener should always be started)
+
+- Fix permission in docker image when executing "/readsecret.sh" script with dd-agent user
+
+- Fixed an issue in the KSM check where cluster-aggregate metrics
+  (``kubernetes_state.container.<cpu|memory>_requested.total``,
+  ``kubernetes_state.container.<cpu|memory|gpu|mig>_limit.total``,
+  and the ``initcontainer`` equivalents) reported incorrect cluster totals
+  when the check ran with ``pod_collection_mode: node_kubelet``. The
+  aggregate metrics are now computed from a dedicated instance (running on
+  the cluster-agent or a cluster-checks runner) in the new
+  ``pod_collection_mode: cluster_aggregates_only`` mode, which watches all
+  pods directly from the API server. To enable the fix, set the
+  ``cluster_aggregates_enabled: true`` instance option on the
+  ``node_kubelet`` and ``cluster_unassigned`` instances; those instances then
+  suppress the affected accumulators, eliminating multi-source gauge collision
+  at ingestion. Without that option the previous (colliding) behavior is
+  unchanged, so it must be set alongside deploying the
+  ``cluster_aggregates_only`` instance. The fix preserves the per-pod metric
+  scaling benefit of ``node_kubelet`` mode while restoring correct cluster
+  aggregates.
+
+- Fix a bug in the orchestrator explorer check that led to trying to collect
+  Kubernetes subresources under certain custom resource API groups.
+
+
 .. _Release Notes_7.81.3:
 
 7.81.3