[ACIX-1891] Explicitly authorize internet access in E2E tests blocked by pipeline 127765169 - #54240
Conversation
![datadog-datadog-prod-us1-2[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
The explicit opt-in is ordered after the host provisioner's deny-by-default option, so each changed startup provisioner resolves to the normal internet-enabled security groups. No clear behavioral regression was identified in the reviewed diff.
🤖 Datadog Autotest · Commit 3b99387 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3b993879e3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // permissions are correct so the agent can create | ||
| // unix sockets for the UDS transport and communicate with the docker socket. | ||
| ec2.WithEC2InstanceOptions(ec2.WithUserData(setupScript)), | ||
| ec2.WithEC2InstanceOptions(ec2.WithUserData(setupScript), ec2.WithInternetAccess()), |
There was a problem hiding this comment.
In this AWS VM suite, the new egress opt-in is needed because SetupSuite pulls ghcr.io/datadog/apps-tracegen directly at line 60. The scoped E2E guidance explicitly requires cached registries and notes that GHCR is unsupported, so opening internet access preserves an external dependency that remains vulnerable to outages and will fail once CI blocks public egress entirely. Publish or mirror tracegen through a supported cached registry and keep this VM isolated.
AGENTS.md reference: test/new-e2e/AGENTS.md:L1-L2
Useful? React with 👍 / 👎.
| e2e.WithProvisioner( | ||
| awshost.Provisioner( | ||
| awshost.WithRunOptions( | ||
| scenec2.WithEC2InstanceOptions(scenec2.WithInternetAccess()), |
There was a problem hiding this comment.
This AWS suite was changed in the parent commit from ProvisionerNoFakeIntake to Provisioner, which wires remote config to the in-account fakeintake, so it no longer needs to contact the public Datadog API. Re-enabling internet access here undoes that isolation without supporting any external operation in the test and needlessly weakens the new security boundary; remove this opt-in and update the now-stale API-key comment instead.
AGENTS.md reference: test/new-e2e/AGENTS.md:L1-L2
Useful? React with 👍 / 👎.
3b99387 to
4a1fddd
Compare
4a1fddd
into
kfairise/acix-1891-disable-vm-internet-access
df28d9b to
26f32ac
Compare
|
🎯 Code Coverage (details) 🔗 Commit SHA: 4a1fddd | Docs | Datadog PR Page | Give us feedback! |
2 participants
What
Opts 41 E2E test suites into explicit internet access via
ec2.WithInternetAccess()/scenec2.WithInternetAccess().Why
These tests were failing in pipeline 127765169 after the parent PR #54158 made internet access off by default in all host provisioners (
awshost.Provisioner).The goal is: internet off by default everywhere, explicitly enabled only where needed. This PR enables it for the tests that legitimately require it (downloading packages from apt/yum, pulling Docker images, reaching Datadog APIs, etc.).
Tests fixed (41 files)
ghcr.io)Remaining jobs not fixed here
A few jobs in 127765169 are failing for non-internet reasons and are excluded:
integration_tests_otel– localhost connection refused / API key (pre-existing)oracle: [21.3.0-xe]– Oracle TNS listener error (pre-existing)new-e2e-ha-agent-failover– uses custom multi-VM provisioner (notawshost.Provisioner)new-e2e-cws: [--run TestKindSuite]– uses Kubernetes provisioner (notawshost.Provisioner)