[ACTP] wire split runner ownership

Author: embeaken

cmd/privateactionrunner/subcommands/run/command.go

@@ -130,7 +130,7 @@ func runPrivateActionRunner(ctx context.Context, confPath string, extraConfFiles
 	}
 
 	err := fxutil.Run(fxOptions...)
-	if errors.Is(err, privateactionrunner.ErrNotEnabled) {
+	if errors.Is(err, privateactionrunner.ErrNotEnabled) || errors.Is(err, privateactionrunner.ErrSplitDeployment) {
 		return nil
 	}
 	return err

comp/privateactionrunner/def/component.go

@@ -14,12 +14,9 @@ import "errors"
 type Component interface {
 }
 
-// ErrNotEnabled is returned when the private action runner is not enabled
 var ErrNotEnabled = errors.New("private action runner is not enabled")
+var ErrSplitDeployment = errors.New("private action runner is running in split deployment mode")
 
-// Configuration keys for the private action runner.
-// Duplicated from pkg/config/setup/privateactionrunner.go because comp/
-// packages cannot import pkg/config/setup (depguard rule).
 const (
 	PAREnabled                = "private_action_runner.enabled"
 	PARSelfEnroll             = "private_action_runner.self_enroll"
@@ -32,4 +29,5 @@ const (
 	PARIdleTimeoutSeconds     = "private_action_runner.idle_timeout_seconds"
 
 	PARExecutorSocketPath = "private_action_runner.executor.socket_path"
+	PARSplitEnabled       = "private_action_runner.split_enabled"
 )

comp/privateactionrunner/impl/BUILD.bazel

@@ -21,6 +21,7 @@ go_library(
         "//comp/networkpath/traceroute/def",
         "//comp/privateactionrunner/def",
         "//comp/remote-config/rcclient/def",
+        "//pkg/config/env",
         "//pkg/config/model",
         "//pkg/config/utils",
         "//pkg/fleet/installer/telemetry",

comp/privateactionrunner/impl/privateactionrunner.go

@@ -12,6 +12,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"runtime"
 	"sync"
 	"time"
 
@@ -20,7 +21,7 @@ import (
 
 	"github.com/DataDog/datadog-agent/comp/core/config"
 	"github.com/DataDog/datadog-agent/comp/core/hostname"
-	"github.com/DataDog/datadog-agent/comp/core/hostname/hostnameinterface/def"
+	hostnameinterface "github.com/DataDog/datadog-agent/comp/core/hostname/hostnameinterface/def"
 	ipc "github.com/DataDog/datadog-agent/comp/core/ipc/def"
 	log "github.com/DataDog/datadog-agent/comp/core/log/def"
 	tagger "github.com/DataDog/datadog-agent/comp/core/tagger/def"
@@ -32,6 +33,7 @@ import (
 	traceroute "github.com/DataDog/datadog-agent/comp/networkpath/traceroute/def"
 	privateactionrunner "github.com/DataDog/datadog-agent/comp/privateactionrunner/def"
 	rcclient "github.com/DataDog/datadog-agent/comp/remote-config/rcclient/def"
+	configenv "github.com/DataDog/datadog-agent/pkg/config/env"
 	"github.com/DataDog/datadog-agent/pkg/config/model"
 	configutils "github.com/DataDog/datadog-agent/pkg/config/utils"
 	"github.com/DataDog/datadog-agent/pkg/fleet/installer/telemetry"
@@ -60,6 +62,19 @@ func isEnabled(cfg config.Component) bool {
 	return cfg.GetBool(privateactionrunner.PAREnabled)
 }
 
+func splitDeploymentSupported(goos string, containerized bool) bool {
+	if containerized {
+		return false
+	}
+
+	switch goos {
+	case "linux", "windows":
+		return true
+	default:
+		return false
+	}
+}
+
 // Requires defines the dependencies for the privateactionrunner component
 type Requires struct {
 	Config        config.Component
@@ -121,6 +136,14 @@ func NewComponent(reqs Requires) (Provides, error) {
 		reqs.Log.Flush()
 		return Provides{}, privateactionrunner.ErrNotEnabled
 	}
+	if reqs.Config.GetBool(privateactionrunner.PARSplitEnabled) {
+		if splitDeploymentSupported(runtime.GOOS, configenv.IsContainerized()) {
+			reqs.Log.Info("Split deployment is enabled; the monolithic PAR is standing down")
+			reqs.Log.Flush()
+			return Provides{}, privateactionrunner.ErrSplitDeployment
+		}
+		reqs.Log.Warn("Split deployment is not supported in this environment; continuing with the monolithic PAR")
+	}
 
 	// The standalone runner sends metrics over a DogStatsD socket/UDP, built from
 	// the Agent's configured endpoint (it runs alongside a node Agent listener).

comp/privateactionrunner/impl/privateactionrunner_test.go

@@ -70,6 +70,27 @@ func TestGetRunnerConfigDiscardsCorruptIdentity(t *testing.T) {
 	assert.Equal(t, urn, cfg.Urn)
 }
 
+func TestSplitDeploymentSupported(t *testing.T) {
+	tests := []struct {
+		name          string
+		goos          string
+		containerized bool
+		want          bool
+	}{
+		{name: "linux host", goos: "linux", want: true},
+		{name: "windows host", goos: "windows", want: true},
+		{name: "linux container", goos: "linux", containerized: true},
+		{name: "windows container", goos: "windows", containerized: true},
+		{name: "unsupported host platform", goos: "darwin"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, splitDeploymentSupported(tt.goos, tt.containerized))
+		})
+	}
+}
+
 func TestStopCleansUpMetricsClient(t *testing.T) {
 	tests := []struct {
 		name           string

pkg/config/schema/yaml/private_action_runner.yaml

@@ -195,7 +195,7 @@ properties:
     node_type: setting
     type: boolean
     default: false
-    comment: Enables split runner mode.
+    comment: Enables split runner mode on supported Linux and Windows hosts.
   urn:
     node_type: setting
     type: string