[procmgr] Supervise process-agent on Windows via dd-procmgr - #54735
[procmgr] Supervise process-agent on Windows via dd-procmgr#54735jose-manuel-almaza wants to merge 5 commits into
Conversation
jose-manuel-almaza
added
the
qa/done
dd-octo-sts
Bot
added
team/windows-products
team/agent-build
team/agent-runtimes
labels
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7a9ca39dfe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| startServices(independent, false) | ||
| startServices(gated, <-procmgrWait) |
There was a problem hiding this comment.
When the Agent is stopped while dd-procmgr-service is still in the newly added startup wait, stopDependentServices can stop procmgr and the already-launched goroutine then receives false here and starts the gated legacy process/PAR/DDOT services after their shutdown pass has completed. This can race or prolong Windows service shutdown and leave dependent workloads starting as the core service exits; tie this work to the Agent lifecycle or wait for the starter before stopping dependents.
AGENTS.md reference: AGENTS.md:L190-L192
Useful? React with 👍 / 👎.
| func run[Env any](t *testing.T, s e2e.Suite[Env], systemProbeConfig string, agentConfig string, securityAgentConfig string) { | ||
| opts := []e2e.SuiteOption{e2e.WithProvisioner(awsHostWindows.ProvisionerNoFakeIntake( | ||
| awsHostWindows.WithRunOptions(runOpts...), | ||
| awsHostWindows.WithRunOptions( |
There was a problem hiding this comment.
In the checked new-e2e-windows-service-test matrix, all six Driver Verifier entries now reach this helper without the former t3.xlarge run option because the helper no longer accepts extra options. They therefore fall back to the framework's t3.large Windows default, undoing the explicit 4-vCPU mitigation for Driver Verifier's kernel overhead and making SCM deadline failures and CI flakes likely; retain the per-test instance override while keeping ordinary suites on the default.
AGENTS.md reference: test/new-e2e/tests/windows/service-test/AGENTS.md:L18-L21
Useful? React with 👍 / 👎.
This comment has been minimized.
This comment has been minimized.
![datadog-prod-us1-4[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
The Windows supervision changes keep legacy fallback behavior tied to a successful dd-procmgr startup, add the process-agent definition and preserve the existing configuration gate inputs. No reproducible diff-only behavioral regression was found; Windows-specific execution remains unvalidated because the sandbox lacks the required toolchain and cannot download it.
🤖 Datadog Autotest · Commit 7a9ca39 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest
7a9ca39 to
98a223d
Compare
33449de to
43513c9
Compare
43513c9 to
13decb9
Compare
13decb9 to
3b5bc84
Compare
3b5bc84 to
7adf791
Compare
7adf791 to
67034f9
Compare
2855d38 to
b2a9ee3
Compare
b2a9ee3 to
a1a89c1
Compare
a1a89c1 to
c241a83
Compare
Agent-profile spawn needs dd-procmgr-service as LocalSystem to read the agent password from LSA. Re-add the test in #54735 with the Wix change.
Agent-profile spawn needs dd-procmgr-service as LocalSystem to read the agent password from LSA. Re-add the test in #54735 with the Wix change.
a03bf2d to
0961a62
Compare
…les PR Restore procmgr_win_test.go to main and drop the extracted helpers file. The only E2E delta on this PR is removing the PAR test for #54735.
0961a62 to
433e146
Compare
…it PR 4/4) Wire dual-mode agent startup, fleet processes.d install for process-agent, dd-procmgr-service LocalSystem credentials, and Windows E2E coverage. Completes the process-agent migration off legacy SCM when procmgr owns supervision.
Add process-agent to COAT adoption telemetry alongside the Windows dual-mode processes.d integration so management_mode and procmgr_process_running gauges reflect process-agent supervision once fleet installer wiring is active.
Assert dd-procmgr-service runs as LocalSystem and agent-profile children run as the agent user with a loaded user profile. Requires the MSI installer to register dd-procmgr-service as LocalSystem (ServiceCustomAction in this PR).
Match process-agent and system-probe: the Wix service installer now uses LocalSystem instead of ddagentuser. ServiceCustomAction already sets LocalSystem at install time; this closes the initial-registration gap.
Re-add the test dropped from #54731. Agent-profile spawn for PAR requires dd-procmgr-service as LocalSystem (Wix change in this PR) to read the agent password from LSA.
433e146 to
b982f1b
Compare
3 participants
What does this PR do?
Moves Windows process-agent supervision to dd-procmgr using the same dual-mode pattern as PAR:
processes.d/datadog-agent-process.yaml(Privileged spawn profile)datadog-process-agentSCM service is suppressed when procmgr owns process-agentdd-procmgr-servicebefore starting gated legacy children; independent services (sysprobe, security-agent, installer) start without blocking on procmgrAlso runs dd-procmgr-service as LocalSystem (MSI service custom action) so the supervisor can spawn Privileged children while agent-profile processes still spawn as
ddagentuser.Stack context: PR 4/4 split from #53249. Builds on #54734 → #54732 → #54731. Spawn profiles, config gates, and secret backend resolution land in those PRs.
Motivation
We want subservices on dd-procmgr instead of SCM. Process-agent needs LocalSystem on Windows; other agent children should stay on the agent user. This PR wires the product integration once the procmgr foundation (PRs 1–3) is in place.
Describe how you validated your changes
dependent_services_windows_test.go)processmanager/...)Additional Notes
processes.dconfig uses the sharedinstall_roothelper (same as PAR/ADP). MSIRemoveFolderExhandles uninstall/rollback cleanup; no per-file MSI rollback custom actions.windows-process-procmgr-dual-mode-b7d2e4a1c8f03962.yaml.