[ACTP] package and activate par-control

Author: embeaken

.github/CODEOWNERS

@@ -192,6 +192,7 @@
 /.gitlab/.pre/deps_build/                                 @DataDog/ebpf-platform @DataDog/agent-build @DataDog/windows-products
 
 /.gitlab/windows/test/e2e_install_packages/windows.yml   @DataDog/windows-products
+/.gitlab/windows/test/e2e/windows.yml                    @DataDog/windows-products @DataDog/agent-devx
 
 /.gitlab/.pre/common/                                     @DataDog/agent-devx
 

.gitlab/JOBOWNERS

@@ -250,7 +250,7 @@ new-e2e-package-signing-*               @DataDog/agent-delivery
 # --- GPU ---
 new-e2e-gpu*                            @DataDog/ebpf-platform @DataDog/gpu-monitoring-agent
 # --- Action platform / discovery ---
-new-e2e-privateactionrunner             @DataDog/action-platform
+new-e2e-privateactionrunner*            @DataDog/action-platform
 new-e2e-discovery                       @DataDog/agent-discovery
 # --- Windows-only jobs (single owner: windows-products) ---
 new-e2e-windows-*                       @DataDog/windows-products

.gitlab/test/e2e/e2e.yml

@@ -489,6 +489,7 @@ new-e2e-privateactionrunner:
   variables:
     TARGETS: ./tests/privateactionrunner
     TEAM: action-platform
+    EXTRA_PARAMS: --skip "Windows"
 
 new-e2e-fips-compliance-test:
   extends: .new_e2e_template

.gitlab/windows/test/e2e/windows.yml

@@ -60,6 +60,18 @@ new-e2e-agent-subcommands-windows:
     ON_NIGHTLY_FIPS: "true"
     EXTRA_PARAMS: --run "Windows"
 
+new-e2e-privateactionrunner-windows:
+  extends: .new_e2e_template_needs_windows_x64
+  rules:
+    - !reference [.except_disable_e2e_tests]
+    - !reference [.except_mergequeue]
+    - !reference [.on_privateactionrunner_or_e2e_changes]
+    - !reference [.manual]
+  variables:
+    TARGETS: ./tests/privateactionrunner
+    TEAM: action-platform
+    EXTRA_PARAMS: --run "Windows"
+
 new-e2e-windows-fips-compliance-test:
   extends: .new_e2e_template
   needs:

omnibus/config/projects/agent.rb

@@ -340,6 +340,11 @@
   windows_symbol_stripping_file "#{install_dir}\\bin\\agent\\dd-procmgr.exe"
   windows_symbol_stripping_file "#{install_dir}\\bin\\agent\\agent-data-plane.exe"
 
+  if not fips_mode?
+    # TODO(ACTP-XXX): PAR is not enabled in Gov yet
+    windows_symbol_stripping_file "#{install_dir}\\bin\\agent\\par-control.exe"
+  end
+
   if windows_signing_enabled?
     # Sign additional binaries from here.
     # We can't request signing from the respective components/software definitions
@@ -366,7 +371,7 @@
       "#{install_dir}\\bin\\agent\\dd-procmgrd.exe",
       "#{install_dir}\\bin\\agent\\dd-procmgr.exe",
       "#{install_dir}\\bin\\agent\\agent-data-plane.exe",
-    ]
+    ] + (fips_mode? ? [] : ["#{install_dir}\\bin\\agent\\par-control.exe"])
 
     BINARIES_TO_SIGN.each do |bin|
       sign_file bin

omnibus/config/software/datadog-agent.rb

@@ -192,6 +192,10 @@
     elsif not heroku_target?
       copy 'bin/privateactionrunner/privateactionrunner', "#{install_dir}/embedded/bin"
     end
+
+    if linux_target? || windows_target?
+      command "bazel run #{omnibazel_flags} //pkg/privateactionrunner/par-control:install -- --destdir=#{install_dir}", :env => env, :live_stream => Omnibus.logger.live_stream(:info)
+    end
   end
 
   # System-probe

packages/agent/product/BUILD.bazel

@@ -54,6 +54,7 @@ pkg_filegroup(
     ] + select({
         "//packages/agent:linux_default": [
             "//pkg/discovery/module/rust:all_files",
+            "//pkg/privateactionrunner/par-control:all_files_linux",
             "//pkg/procmgr/rust:all_files_linux",
         ],
         "//packages/agent:linux_fips": [
@@ -73,6 +74,7 @@ pkg_filegroup(
         ],
         "@platforms//os:windows": [
             "//packages/windows:all_files",
+            "//pkg/privateactionrunner/par-control:all_files_windows",
             "//pkg/procmgr/rust:all_files_windows",
         ],
         "//conditions:default": [],

pkg/fleet/installer/packages/datadog_agent_linux.go

@@ -104,6 +104,7 @@ var (
 	// agentPackageUninstallPaths are the agent paths that are deleted during an uninstall
 	agentPackageUninstallPaths = file.Paths{
 		"embedded/ssl/fipsmodule.cnf",
+		"processes.d/datadog-agent-par-control.yaml",
 		"processes.d/datadog-agent-action-executor.yaml",
 		"run",
 		".pre_python_installed_packages.txt",
@@ -272,16 +273,29 @@ func retireLegacyProcmgrUnits(ctx HookContext) error {
 	return nil
 }
 
-const parExecutorProcmgrConfigName = "datadog-agent-action-executor.yaml"
+const (
+	parControlProcmgrConfigName  = "datadog-agent-par-control.yaml"
+	parExecutorProcmgrConfigName = "datadog-agent-action-executor.yaml"
+)
+
+func writePARProcmgrConfigs(installRoot string) error {
+	return errors.Join(
+		writePARProcmgrConfig(installRoot, parControlProcmgrConfigName, embedded.PARControlProcessConfig),
+		writePARProcmgrConfig(installRoot, parExecutorProcmgrConfigName, embedded.PARExecutorProcessConfig),
+	)
+}
 
-func writePARExecutorProcmgrConfig(installRoot string) error {
+func writePARProcmgrConfig(installRoot, name, config string) error {
 	processesDir := filepath.Join(installRoot, "processes.d")
-	config := strings.ReplaceAll(embedded.PARExecutorProcessConfig, "/opt/datadog-agent", installRoot)
+	config = strings.ReplaceAll(config, "/opt/datadog-agent", installRoot)
 	if err := os.MkdirAll(processesDir, 0755); err != nil {
-		return fmt.Errorf("failed to write PAR executor procmgr config: %w", err)
+		return fmt.Errorf("failed to create processes.d for %s: %w", name, err)
+	}
+	path := filepath.Join(processesDir, name)
+	if err := os.WriteFile(path, []byte(config), 0644); err != nil {
+		return fmt.Errorf("failed to write %s: %w", path, err)
 	}
-	path := filepath.Join(processesDir, parExecutorProcmgrConfigName)
-	return os.WriteFile(path, []byte(config), 0644)
+	return nil
 }
 
 // uninstallFilesystem cleans the filesystem by removing various temporary files, symlinks and installation metadata
@@ -368,8 +382,8 @@ func postInstallDatadogAgent(ctx HookContext) (err error) {
 	if err := writeDDOTProcmgrConfig(ctx.PackagePath); err != nil {
 		log.Warnf("failed to write DDOT process manager config: %v", err)
 	}
-	if err := writePARExecutorProcmgrConfig(ctx.PackagePath); err != nil {
-		log.Warnf("failed to write PAR executor process manager config: %v", err)
+	if err := writePARProcmgrConfigs(ctx.PackagePath); err != nil {
+		log.Warnf("failed to write PAR process manager configs: %v", err)
 	}
 	if err := agentService.WriteStable(ctx); err != nil {
 		return fmt.Errorf("failed to write stable units: %s", err)
@@ -484,8 +498,8 @@ func postStartExperimentDatadogAgent(ctx HookContext) error {
 	if err := restoreODBCConfig(ctx.PackagePath); err != nil {
 		log.Warnf("failed to restore ODBC config: %s", err)
 	}
-	if err := writePARExecutorProcmgrConfig(ctx.PackagePath); err != nil {
-		log.Warnf("failed to write PAR executor process manager config: %v", err)
+	if err := writePARProcmgrConfigs(ctx.PackagePath); err != nil {
+		log.Warnf("failed to write PAR process manager configs: %v", err)
 	}
 	if err := agentService.WriteExperiment(ctx); err != nil {
 		return err
@@ -534,8 +548,8 @@ func postPromoteExperimentDatadogAgent(ctx HookContext) error {
 	if err := installFilesystem(ctx); err != nil {
 		return err
 	}
-	if err := writePARExecutorProcmgrConfig(ctx.PackagePath); err != nil {
-		log.Warnf("failed to write PAR executor process manager config: %v", err)
+	if err := writePARProcmgrConfigs(ctx.PackagePath); err != nil {
+		log.Warnf("failed to write PAR process manager configs: %v", err)
 	}
 	detachedCtx := context.WithoutCancel(ctx.Context)
 	ctx.Context = detachedCtx

pkg/fleet/installer/packages/datadog_agent_par_linux_test.go

@@ -16,17 +16,43 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestWritePARExecutorProcmgrConfig(t *testing.T) {
+// Fleet policies follow the supervising unit's config dir, so an experiment
+// reads the experiment tree rather than stable.
+const fleetPoliciesDirSetting = "DD_FLEET_POLICIES_DIR: ${DD_CONF_DIR}/managed/datadog-agent/stable"
+
+func TestWritePARProcmgrConfigs(t *testing.T) {
 	installRoot := t.TempDir()
-	configPath := filepath.Join(installRoot, "processes.d", parExecutorProcmgrConfigName)
+	require.NoError(t, writePARProcmgrConfigs(installRoot))
 
-	require.NoError(t, writePARExecutorProcmgrConfig(installRoot))
-	content, err := os.ReadFile(configPath)
-	require.NoError(t, err)
+	executor := readProcmgrConfig(t, installRoot, parExecutorProcmgrConfigName)
+	assert.Contains(t, executor, "${DD_CONF_DIR}/datadog.yaml")
+	assert.Contains(t, executor, filepath.Join(installRoot, "embedded", "bin", "privateactionrunner"))
+	// Only par-control starts the executor, and procmgr must not resurrect it.
+	assert.Contains(t, executor, "auto_start: false")
+	assert.Contains(t, executor, "restart: never")
+	assert.Contains(t, executor, fleetPoliciesDirSetting)
+	assert.NotContains(t, executor, "/opt/datadog-agent/")
 
-	assert.Contains(t, string(content), "${DD_CONF_DIR}/datadog.yaml")
-	assert.Contains(t, string(content), filepath.Join(installRoot, "embedded", "bin", "privateactionrunner"))
-	assert.Contains(t, string(content), "auto_start: false")
-	assert.Contains(t, string(content), "restart: never")
-	assert.NotContains(t, string(content), "/opt/datadog-agent/")
+	control := readProcmgrConfig(t, installRoot, parControlProcmgrConfigName)
+	assert.Contains(t, control, "${DD_CONF_DIR}/datadog.yaml")
+	assert.Contains(t, control, filepath.Join(installRoot, "embedded", "bin", "par-control"))
+	// Rust resolves operational configuration directly; Go remains responsible
+	// only for the hostname-aware enrollment bootstrap.
+	assert.NotContains(t, control, "--config-helper")
+	assert.Contains(t, control, "--ensure-enrollment-command")
+	assert.Contains(t, control, filepath.Join(installRoot, "embedded", "bin", "privateactionrunner"))
+	assert.Contains(t, control, fleetPoliciesDirSetting)
+	// The control plane is always on: procmgr starts it with the Agent and restarts
+	// it on crash. on-failure ignores the clean exit taken when split mode is off.
+	assert.Contains(t, control, "auto_start: true")
+	assert.Contains(t, control, "stop_timeout: 180")
+	assert.Contains(t, control, "restart: on-failure")
+	assert.NotContains(t, control, "/opt/datadog-agent/")
+}
+
+func readProcmgrConfig(t *testing.T, installRoot, name string) string {
+	t.Helper()
+	content, err := os.ReadFile(filepath.Join(installRoot, "processes.d", name))
+	require.NoError(t, err)
+	return string(content)
 }

pkg/fleet/installer/packages/datadog_agent_windows.go

@@ -143,14 +143,10 @@ func postInstallDatadogAgent(ctx HookContext) error {
 		}
 	}
 
-	if err := ensureADPProcmgrConfig(); err != nil {
-		return fmt.Errorf("failed to write ADP process manager config: %w", err)
-	}
-	if err := ensurePARProcmgrConfig(); err != nil {
-		return fmt.Errorf("failed to write PAR process manager config: %w", err)
-	}
-	if err := ensurePARExecutorProcmgrConfig(); err != nil {
-		return fmt.Errorf("failed to write PAR executor process manager config: %w", err)
+	for _, cfg := range procmgrConfigs {
+		if err := ensureProcmgrConfig(cfg); err != nil {
+			return fmt.Errorf("failed to write %s process manager config: %w", cfg.label, err)
+		}
 	}
 
 	// No need to explicitly start the Agent here
@@ -203,47 +199,31 @@ func resolveDatadogProgramFilesInstallRoot() (string, error) {
 	return installRoot, nil
 }
 
-func ensureADPProcmgrConfig() error {
-	installRoot, err := resolveDatadogProgramFilesInstallRoot()
-	if err != nil {
-		return err
-	}
-
-	if env.FromEnv().ProcessManagerEnabled {
-		return processmanager.WriteADPProcmgrConfig(installRoot)
-	}
-	if err := processmanager.RemoveADPProcmgrConfig(installRoot); err != nil {
-		log.Warnf("ADP: could not remove stale process manager config: %v", err)
-	}
-	return nil
+// procmgrConfig is a processes.d definition managed at install time.
+type procmgrConfig struct {
+	label  string
+	write  func(installRoot string) error
+	remove func(installRoot string) error
 }
 
-func ensurePARProcmgrConfig() error {
-	installRoot, err := resolveDatadogProgramFilesInstallRoot()
-	if err != nil {
-		return err
-	}
-
-	if env.FromEnv().ProcessManagerEnabled {
-		return processmanager.WritePARProcmgrConfig(installRoot)
-	}
-	if err := processmanager.RemovePARProcmgrConfig(installRoot); err != nil {
-		log.Warnf("PAR: could not remove stale process manager config: %v", err)
-	}
-	return nil
+var procmgrConfigs = []procmgrConfig{
+	{"ADP", processmanager.WriteADPProcmgrConfig, processmanager.RemoveADPProcmgrConfig},
+	{"PAR", processmanager.WritePARProcmgrConfig, processmanager.RemovePARProcmgrConfig},
+	{"PAR executor", processmanager.WritePARExecutorProcmgrConfig, processmanager.RemovePARExecutorProcmgrConfig},
+	{"PAR control plane", processmanager.WritePARControlProcmgrConfig, processmanager.RemovePARControlProcmgrConfig},
 }
 
-func ensurePARExecutorProcmgrConfig() error {
+func ensureProcmgrConfig(cfg procmgrConfig) error {
 	installRoot, err := resolveDatadogProgramFilesInstallRoot()
 	if err != nil {
 		return err
 	}
 
 	if env.FromEnv().ProcessManagerEnabled {
-		return processmanager.WritePARExecutorProcmgrConfig(installRoot)
+		return cfg.write(installRoot)
 	}
-	if err := processmanager.RemovePARExecutorProcmgrConfig(installRoot); err != nil {
-		log.Warnf("PAR executor: could not remove stale process manager config: %v", err)
+	if err := cfg.remove(installRoot); err != nil {
+		log.Warnf("%s: could not remove stale process manager config: %v", cfg.label, err)
 	}
 	return nil
 }