[ACTP] add par-control resolved configuration

Loads the settings par-control needs directly in Rust with Fleet policy >
environment > local YAML precedence, resolves runner identity, and leaves the
executor idle timeout to the executor itself.

Author: embeaken

Cargo.lock

@@ -45,6 +45,7 @@ nom = "8.0"
 normalize-path = "0.2"
 phf = { version = "0.14", features = ["macros"] }
 rawzip = "0.5.0"
+reqwest = { version = "0.12.28", default-features = false }
 xml-rs = "1.0"
 rmp-serde = "1.3"
 serde = { version = "1.0.219", features = ["derive", "std"] }

Cargo.toml

@@ -105,6 +105,14 @@ properties:
         platform_default:
           windows: \\.\pipe\dd-par-executor
           other: ${run_path}/par-executor.sock
+  executor_process_name:
+    node_type: setting
+    type: string
+    default: datadog-agent-action-executor
+  heartbeat_interval_seconds:
+    node_type: setting
+    type: integer
+    default: 20
   identity_file_path:
     node_type: setting
     type: string
@@ -139,6 +147,13 @@ properties:
     node_type: setting
     type: string
     default: ''
+  procmgr_socket_path:
+    node_type: setting
+    type: string
+    platform_default:
+      windows: \\.\pipe\datadog-procmgrd
+      other: /var/run/datadog-procmgrd/dd-procmgrd.sock
+    comment: Control-plane settings consumed by par-control.
   restricted_shell:
     node_type: section
     type: object

MODULE.bazel.lock

@@ -1,4 +1,7 @@
 load("@rules_rust//rust:defs.bzl", "rust_binary", "rust_library", "rust_test")
+load(":version.bzl", "par_control_agent_version")
+
+_RUSTC_ENV = {"DD_AGENT_VERSION": par_control_agent_version()}
 
 _LINUX_OR_WINDOWS = select({
     "@platforms//os:linux": [],
@@ -9,21 +12,27 @@ _LINUX_OR_WINDOWS = select({
 rust_library(
     name = "par-control-lib",
     srcs = [
+        "src/bootstrap.rs",
         "src/config.rs",
+        "src/identity.rs",
         "src/lib.rs",
         "src/platform.rs",
         "src/procmgr.rs",
         "src/test_support.rs",
     ],
     crate_name = "par_control",
     edition = "2024",
+    rustc_env = _RUSTC_ENV,
+    rustc_flags = ["--cfg=bazel"],
     target_compatible_with = _LINUX_OR_WINDOWS,
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/procmgr/rust/client:dd-procmgr-client",
         "@crates//:anyhow",
         "@crates//:log",
+        "@crates//:reqwest",
         "@crates//:serde",
+        "@crates//:serde_json",
         "@crates//:serde_yaml",
         "@crates//:tokio",
         "@crates//:tonic",
@@ -56,6 +65,8 @@ rust_test(
     name = "par-control_test",
     crate = ":par-control-lib",
     edition = "2024",
+    rustc_env = _RUSTC_ENV,
+    rustc_flags = ["--cfg=bazel"],
     target_compatible_with = _LINUX_OR_WINDOWS,
     deps = [
         "@crates//:tempfile",

pkg/config/schema/yaml/private_action_runner.yaml

@@ -21,7 +21,9 @@ clap = { workspace = true, features = ["derive"] }
 dd-agent-log.workspace = true
 dd-procmgr-client.workspace = true
 log.workspace = true
+reqwest.workspace = true
 serde = { workspace = true, features = ["derive"] }
+serde_json.workspace = true
 serde_yaml.workspace = true
 tokio = { workspace = true, features = [
   "macros",

pkg/privateactionrunner/par-control/BUILD.bazel

@@ -0,0 +1,8 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2026-present Datadog, Inc.
+
+fn main() {
+    println!("cargo::rustc-check-cfg=cfg(bazel)");
+}

pkg/privateactionrunner/par-control/Cargo.toml

@@ -3,8 +3,11 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2026-present Datadog, Inc.
 
+//! par-control installation, configuration, and executor-lifecycle scaffold.
+
 use anyhow::Result;
 use clap::Parser;
+use par_control::bootstrap;
 use par_control::config::Launch;
 use par_control::platform;
 use std::path::PathBuf;
@@ -15,6 +18,15 @@ use std::process::ExitCode;
 struct Cli {
     #[arg(short = 'c', long, default_value_os_t = platform::default_config_path())]
     config: PathBuf,
+
+    /// Go one-shot command that validates or creates the runner identity. Must
+    /// be the last option because it consumes all remaining arguments.
+    #[arg(
+        long = "ensure-enrollment-command",
+        num_args = 1..,
+        allow_hyphen_values = true
+    )]
+    ensure_enrollment_command: Vec<String>,
 }
 
 #[tokio::main]
@@ -53,6 +65,9 @@ async fn run() -> Result<()> {
         return Ok(());
     }
 
+    let _config =
+        bootstrap::load_config_with_bootstrap(&cli.config, &cli.ensure_enrollment_command)?;
+
     log::info!("par-control started");
     shutdown_signal().await;
     log::info!("par-control is exiting");

pkg/privateactionrunner/par-control/build.rs

@@ -0,0 +1,52 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2026-present Datadog, Inc.
+
+//! Identity bootstrap. Before its first OPMS call, par-control runs the Go
+//! ensure-enrollment one-shot. Go owns hostname resolution, enrollment, and
+//! persistence; Rust then loads ordinary operational configuration and the
+//! persisted or configured identity directly.
+
+use crate::config::Config;
+use anyhow::{Context, Result, bail};
+use log::info;
+use std::path::Path;
+use std::process::Command;
+
+/// Run the Go ensure-enrollment one-shot, then load the control-plane config
+/// directly from local YAML, environment, and Fleet policy.
+///
+/// `ensure_enrollment_command` is the complete argv configured by the installed
+/// process definition, normally `privateactionrunner ensure-enrollment --cfgpath
+/// <datadog.yaml>`. It runs on every split-mode startup so the hostname decision
+/// exactly matches the Go Agent. The command itself applies persisted identity,
+/// inline identity, and `self_enroll` precedence.
+pub fn load_config_with_bootstrap(
+    config_path: &Path,
+    ensure_enrollment_command: &[String],
+) -> Result<Config> {
+    if ensure_enrollment_command.is_empty() {
+        bail!(
+            "no ensure-enrollment command is configured; set \
+             --ensure-enrollment-command"
+        );
+    }
+
+    info!("ensuring runner enrollment: {ensure_enrollment_command:?}");
+    run_ensure_enrollment(ensure_enrollment_command)?;
+
+    Config::try_from_yaml_file(config_path)?
+        .context("runner has no usable identity after ensure-enrollment completed")
+}
+
+fn run_ensure_enrollment(argv: &[String]) -> Result<()> {
+    let status = Command::new(&argv[0])
+        .args(&argv[1..])
+        .status()
+        .with_context(|| format!("failed to run ensure-enrollment command {argv:?}"))?;
+    if !status.success() {
+        bail!("ensure-enrollment command {argv:?} exited with status {status}");
+    }
+    Ok(())
+}