Merge branch 'main' into dependabot/github_actions/sigstore/cosign-installer-3.10.0

Author: pducolin

.github/workflows/docker-publish.yml

@@ -110,7 +110,7 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # 5.7.0
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # 5.8.0
         with:
           # Auto-discovery is based on docker image name.
           # That’s why the Redis docker image needs to be named exactly `redis`

.github/workflows/lint.yml

@@ -26,7 +26,8 @@ jobs:
           # Require: The version of golangci-lint to use.
           # When `install-mode` is `binary` (default) the value can be v1.2 or v1.2.3 or `latest` to use the latest version.
           # When `install-mode` is `goinstall` the value can be v1.2.3, `latest`, or the hash of a commit.
-          version: latest
+          # Sync with the version in .pre-commit-config.yaml
+          version: v1.64.8
 
           # Optional: golangci-lint command line arguments.
           args: --timeout=10m

.pre-commit-config.yaml

@@ -1,6 +1,7 @@
 repos:
   - repo: https://github.com/golangci/golangci-lint
-    rev: v1.55.2
+    # Sync with the version in .github/workflows/lint.yml
+    rev: v1.64.8
     hooks:
       - id: golangci-lint
   - repo: local

Dockerfile

@@ -9,7 +9,7 @@ ENV HELM_VERSION=3.12.3
 ENV HELM_SHA=1b2313cd198d45eab00cc37c38f6b1ca0a948ba279c29e322bdf426d406129b5
 ARG CI_UPLOADER_SHA=873976f0f8de1073235cf558ea12c7b922b28e1be22dc1553bf56162beebf09d
 ARG CI_UPLOADER_VERSION=2.30.1
-ARG DDA_VERSION=v0.25.0
+ARG DDA_VERSION=v0.29.0
 ARG CODECOV_VERSION=0.6.1
 ARG CODECOV_SHA=0c9b79119b0d8dbe7aaf460dc3bd7c3094ceda06e5ae32b0d11a8ff56e2cc5c5
 # Skip Pulumi update warning https://www.pulumi.com/docs/cli/environment-variables/

common/config/environment.go

@@ -29,6 +29,7 @@ const (
 	DDInfraKubernetesVersion                = "kubernetesVersion"
 	DDInfraOSDescriptor                     = "osDescriptor" // osDescriptor is expected in the format: <osFamily>:<osVersion>:<osArch>, see components/os/descriptor.go
 	DDInfraOSImageID                        = "osImageID"
+	DDInfraOSImageIDUseLatest               = "osImageIDUseLatest"
 	DDInfraDeployFakeintakeWithLoadBalancer = "deployFakeintakeWithLoadBalancer"
 	DDInfraExtraResourcesTags               = "extraResourcesTags"
 	DDInfraSSHUser                          = "sshUser"
@@ -56,6 +57,8 @@ const (
 	DDAgentAPPKeyParamName               = "appKey"
 	DDAgentFakeintake                    = "fakeintake"
 	DDAgentDualShipping                  = "dualshipping"
+	DDAgentFakeintakeStoreType           = "fakeintakeStoreType"
+	DDAGentFakeintakeRetentionPeriod     = "fakeintakeRetentionPeriod"
 	DDAgentSite                          = "site"
 	DDAgentMajorVersion                  = "majorVersion"
 	DDAgentExtraEnvVars                  = "extraEnvVars" // extraEnvVars is expected in the format: <key1>=<value1>,<key2>=<value2>,...
@@ -68,7 +71,8 @@ const (
 	DDUpdaterParamName = "deploy"
 
 	// Testing workload namerNamespace
-	DDTestingWorkloadDeployParamName = "deploy"
+	DDTestingWorkloadDeployParamName   = "deploy"
+	DDTestingWorkloadDeployArgoRollout = "deployArgoRollout"
 
 	// Dogstatsd namespace
 	DDDogstatsdDeployParamName        = "deploy"
@@ -106,7 +110,7 @@ type Env interface {
 	KubernetesVersion() string
 	DefaultResourceTags() map[string]string
 	ExtraResourcesTags() map[string]string
-	ResourcesTags() pulumi.StringMap
+	ResourcesTags() pulumi.StringMapInput
 	AgentExtraEnvVars() map[string]string
 
 	AgentDeploy() bool
@@ -212,6 +216,10 @@ func (e *CommonEnvironment) InfraOSImageID() string {
 	return e.GetStringWithDefault(e.InfraConfig, DDInfraOSImageID, "")
 }
 
+func (e *CommonEnvironment) InfraOSImageIDUseLatest() bool {
+	return e.GetBoolWithDefault(e.InfraConfig, DDInfraOSImageIDUseLatest, false)
+}
+
 func (e *CommonEnvironment) KubernetesVersion() string {
 	return e.GetStringWithDefault(e.InfraConfig, DDInfraKubernetesVersion, "1.32")
 }
@@ -247,7 +255,7 @@ func EnvVariableResourceTags() map[string]string {
 	return tags
 }
 
-func (e *CommonEnvironment) ResourcesTags() pulumi.StringMap {
+func (e *CommonEnvironment) ResourcesTags() pulumi.StringMapInput {
 	tags := pulumi.StringMap{}
 
 	// default tags
@@ -269,6 +277,10 @@ func (e *CommonEnvironment) AgentDeployWithOperator() bool {
 	return e.GetBoolWithDefault(e.AgentConfig, DDAgentDeployWithOperatorParamName, false)
 }
 
+func (e *CommonEnvironment) AgentDeployArgoRollout() bool {
+	return e.GetBoolWithDefault(e.TestingWorkloadConfig, DDTestingWorkloadDeployArgoRollout, false)
+}
+
 func (e *CommonEnvironment) AgentVersion() string {
 	return e.AgentConfig.Get(DDAgentVersionParamName)
 }
@@ -341,6 +353,14 @@ func (e *CommonEnvironment) AgentUseDualShipping() bool {
 	return e.GetBoolWithDefault(e.AgentConfig, DDAgentDualShipping, false)
 }
 
+func (e *CommonEnvironment) AgentFakeintakeStoreType() string {
+	return e.GetStringWithDefault(e.AgentConfig, DDAgentFakeintakeStoreType, "memory")
+}
+
+func (e *CommonEnvironment) AgentFakeintakeRetentionPeriod() string {
+	return e.AgentConfig.Get(DDAGentFakeintakeRetentionPeriod)
+}
+
 func (e *CommonEnvironment) Site() string {
 	return e.AgentConfig.Get(DDAgentSite)
 }

components/datadog/agent/kubernetes_helm.go

@@ -23,7 +23,7 @@ import (
 )
 
 const (
-	HelmVersion = "3.120.2"
+	HelmVersion = "3.135.4"
 )
 
 // HelmInstallationArgs is the set of arguments for creating a new HelmInstallation component

components/datadog/agentparams/params.go

@@ -283,6 +283,8 @@ network_devices.netflow.forwarder.logs_dd_url: %[1]s:%[2]d
 network_devices.netflow.forwarder.logs_no_ssl: true
 network_path.forwarder.logs_dd_url: %[1]s:%[2]d
 network_path.forwarder.logs_no_ssl: true
+synthetics.forwarder.logs_dd_url: %[1]s:%[2]d
+synthetics.forwarder.logs_no_ssl: true
 container_lifecycle.logs_dd_url: %[1]s:%[2]d
 container_lifecycle.logs_no_ssl: true
 container_image.logs_dd_url: %[1]s:%[2]d
@@ -291,6 +293,8 @@ sbom.logs_dd_url: %[1]s:%[2]d
 sbom.logs_no_ssl: true
 service_discovery.forwarder.logs_dd_url: %[1]s:%[2]d
 service_discovery.forwarder.logs_no_ssl: true
+software_inventory.forwarder.logs_dd_url: %[1]s:%[2]d
+software_inventory.forwarder.logs_no_ssl: true
 `, hostname, port, scheme)
 		p.ExtraAgentConfig = append(p.ExtraAgentConfig, extraConfig)
 		return nil

components/datadog/apps/cpustress/k8s.go

@@ -63,7 +63,9 @@ func K8sAppDefinition(e config.Env, kubeProvider *kubernetes.Provider, namespace
 							Args: pulumi.StringArray{
 								pulumi.String("--cpu=1"),
 								pulumi.String("--cpu-load=15"),
+								pulumi.String("--temp-path=/tmp/"),
 							},
+							WorkingDir: pulumi.String("/tmp"),
 							Resources: &corev1.ResourceRequirementsArgs{
 								Limits: pulumi.StringMap{
 									"cpu":    pulumi.String("200m"),
@@ -74,6 +76,18 @@ func K8sAppDefinition(e config.Env, kubeProvider *kubernetes.Provider, namespace
 									"memory": pulumi.String("64Mi"),
 								},
 							},
+							VolumeMounts: corev1.VolumeMountArray{
+								corev1.VolumeMountArgs{
+									Name:      pulumi.String("temp-dir"),
+									MountPath: pulumi.String("/tmp"),
+								},
+							},
+						},
+					},
+					Volumes: corev1.VolumeArray{
+						corev1.VolumeArgs{
+							Name:     pulumi.String("temp-dir"),
+							EmptyDir: &corev1.EmptyDirVolumeSourceArgs{},
 						},
 					},
 				},

components/datadog/apps/cpustress/openshift.go

@@ -12,6 +12,7 @@ import (
 	appsv1 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/apps/v1"
 	corev1 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/core/v1"
 	metav1 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/meta/v1"
+	rbacv1 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/rbac/v1"
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
 )
 
@@ -36,6 +37,39 @@ func K8sAppDefinition(e config.Env, kubeProvider *kubernetes.Provider, namespace
 
 	opts = append(opts, utils.PulumiDependsOn(ns))
 
+	// openshift requires a non-default service account tighted to the privileged scc
+	sa, err := corev1.NewServiceAccount(e.Ctx(), fmt.Sprintf("dogstatsd-uds-sa-%d", statsdPort), &corev1.ServiceAccountArgs{
+		Metadata: &metav1.ObjectMetaArgs{
+			Name:      pulumi.StringPtr("dogstatsd-uds-sa"),
+			Namespace: pulumi.StringPtr(namespace),
+		},
+	}, opts...)
+	if err != nil {
+		return nil, err
+	}
+
+	// create a clusterRoleBinding to bind the new service account with the existing privileged scc
+	if _, err := rbacv1.NewRoleBinding(e.Ctx(), fmt.Sprintf("dogstatsd-uds-scc-binding-%d", statsdPort), &rbacv1.RoleBindingArgs{
+		Metadata: &metav1.ObjectMetaArgs{
+			Name:      pulumi.String("dogstatsd-scc-binding"),
+			Namespace: pulumi.StringPtr(namespace),
+		},
+		RoleRef: &rbacv1.RoleRefArgs{
+			ApiGroup: pulumi.String("rbac.authorization.k8s.io"),
+			Kind:     pulumi.String("ClusterRole"),
+			Name:     pulumi.String("system:openshift:scc:hostaccess"),
+		},
+		Subjects: rbacv1.SubjectArray{
+			rbacv1.SubjectArgs{
+				Kind:      pulumi.String("ServiceAccount"),
+				Name:      sa.Metadata.Name().Elem(),
+				Namespace: pulumi.String(namespace),
+			},
+		},
+	}, opts...); err != nil {
+		return nil, err
+	}
+
 	if _, err := appsv1.NewDeployment(e.Ctx(), fmt.Sprintf("dogstatsd-uds-with-csi-%d", statsdPort), &appsv1.DeploymentArgs{
 		Metadata: &metav1.ObjectMetaArgs{
 			Name:      pulumi.String("dogstatsd-uds-with-csi"),
@@ -60,6 +94,7 @@ func K8sAppDefinition(e config.Env, kubeProvider *kubernetes.Provider, namespace
 					},
 				},
 				Spec: &corev1.PodSpecArgs{
+					ServiceAccountName: sa.Metadata.Name().Elem(),
 					Containers: corev1.ContainerArray{
 						&corev1.ContainerArgs{
 							Name:  pulumi.String("dogstatsd"),
@@ -106,6 +141,7 @@ func K8sAppDefinition(e config.Env, kubeProvider *kubernetes.Provider, namespace
 					},
 				},
 				Spec: &corev1.PodSpecArgs{
+					ServiceAccountName: sa.Metadata.Name().Elem(),
 					Containers: corev1.ContainerArray{
 						&corev1.ContainerArgs{
 							Name:  pulumi.String("dogstatsd"),