Merge branch 'main' of github.com:DataDog/datadog-agent into olivierg…

…/use-fct-for-module-bundle

.gitlab-ci.yml

@@ -84,9 +84,9 @@ stages:
   - dev_container_deploy
   - deploy_containers
   - deploy_packages
-  - trigger_release
   - deploy_cws_instrumentation
   - deploy_dca
+  - trigger_release
   - choco_build
   - choco_deploy
   - internal_image_deploy

.gitlab/e2e_test_junit_upload.yml

@@ -35,6 +35,10 @@ e2e_test_junit_upload:
     - new-e2e-agent-platform-install-script-centos-iot-agent-a7-x86_64
     - new-e2e-agent-platform-install-script-centos-dogstatsd-a7-x86_64
     - new-e2e-agent-platform-install-script-centos-a6-x86_64
+    - new-e2e-agent-platform-install-script-centos-fips-a6-x86_64
+    - new-e2e-agent-platform-install-script-centos-fips-a7-x86_64
+    - new-e2e-agent-platform-install-script-centos-fips-iot-agent-a7-x86_64
+    - new-e2e-agent-platform-install-script-centos-fips-dogstatsd-a7-x86_64
     - new-e2e-npm-main
     - new-e2e-process-main
     - new-e2e-cws-main

.gitlab/kitchen_testing/centos.yml

@@ -96,35 +96,6 @@
 # Kitchen: final test matrix (tests * scenarios)
 # ----------------------------------------------
 
-# We do install_script, step_by_step, upgrade6, upgrade7 and upgrade7_iot
-# with FIPS on for CentOS/RHEL 8, while we do these with FIPS off
-# for CentOS/RHEL 6/7.
-
-kitchen_centos_fips_install_script_agent-a6:
-  extends:
-    - .kitchen_os_with_cws
-    - .kitchen_scenario_centos_with_fips_a6
-    - .kitchen_test_install_script_agent
-
-kitchen_centos_fips_install_script_agent-a7:
-  # Run install script test on branches, on a reduced number of platforms
-  rules:
-    !reference [.on_default_kitchen_tests_a7]
-  extends:
-    - .kitchen_os_with_cws
-    - .kitchen_scenario_centos_with_fips_a7
-    - .kitchen_test_install_script_agent
-
-kitchen_centos_fips_install_script_iot_agent-a7:
-  extends:
-    - .kitchen_scenario_centos_with_fips_a7
-    - .kitchen_test_install_script_iot_agent
-
-kitchen_centos_fips_install_script_dogstatsd-a7:
-  extends:
-    - .kitchen_scenario_centos_with_fips_a7
-    - .kitchen_test_install_script_dogstatsd
-
 # We only want to run step-by-step tests on deploy pipelines,
 # which is why they have a different rule (if_deploy_6/7)
 

.gitlab/kitchen_tests_upload.yml

@@ -7,10 +7,6 @@ kitchen_tests_upload_common:
     - !reference [.except_mergequeue]
     - when: always
   dependencies:
-    - kitchen_centos_fips_install_script_agent-a6
-    - kitchen_centos_fips_install_script_agent-a7
-    - kitchen_centos_fips_install_script_dogstatsd-a7
-    - kitchen_centos_fips_install_script_iot_agent-a7
     - kitchen_centos_fips_upgrade6_agent-a6
     - kitchen_centos_fips_upgrade6_agent-a7
     - kitchen_centos_fips_upgrade7_agent-a7

.gitlab/new-e2e_testing/centos.yml

@@ -21,6 +21,22 @@
     E2E_OVERRIDE_INSTANCE_TYPE: "t2.medium" # CentOS 6 does not support ENA, so we cannot use t3 instances
   needs: ["deploy_rpm_testing-a7_x64"]
 
+.new-e2e_centos-fips_a7_x86_64:
+  variables:
+    E2E_ARCH: x86_64
+    E2E_OSVERS: "rhel-86-fips"
+    E2E_CWS_SUPPORTED_OSVERS: "rhel-86-fips"
+    E2E_BRANCH_OSVERS: "rhel-86-fips"
+  needs: ["deploy_rpm_testing-a7_x64"]
+
+.new-e2e_centos-fips_a6_x86_64:
+  variables:
+    E2E_ARCH: x86_64
+    E2E_OSVERS: "rhel-86-fips"
+    E2E_CWS_SUPPORTED_OSVERS: "rhel-86-fips"
+    E2E_BRANCH_OSVERS: "rhel-86-fips"
+  needs: ["deploy_rpm_testing-a7_x64"]
+
 new-e2e-agent-platform-install-script-centos-a6-x86_64:
   stage: kitchen_testing
   extends: 
@@ -68,3 +84,51 @@ new-e2e-agent-platform-install-script-centos-dogstatsd-a7-x86_64:
     - .new-e2e_agent_a7
   variables:
     FLAVOR: datadog-dogstatsd
+
+new-e2e-agent-platform-install-script-centos-fips-a6-x86_64:
+  stage: kitchen_testing
+  extends: 
+    - .new_e2e_template
+    - .new-e2e_install_script
+    - .new-e2e_os_centos
+    - .new-e2e_centos-fips_a6_x86_64
+    - .new-e2e_agent_a6
+  variables:
+    FLAVOR: datadog-agent
+
+new-e2e-agent-platform-install-script-centos-fips-a7-x86_64:
+  stage: kitchen_testing
+  extends: 
+    - .new_e2e_template
+    - .new-e2e_install_script
+    - .new-e2e_os_centos
+    - .new-e2e_centos-fips_a7_x86_64
+    - .new-e2e_agent_a7
+  rules:
+    !reference [.on_default_new-e2e_tests_a7]
+  variables:
+    FLAVOR: datadog-agent
+
+new-e2e-agent-platform-install-script-centos-fips-iot-agent-a7-x86_64:
+  stage: kitchen_testing
+  extends: 
+    - .new_e2e_template
+    - .new-e2e_install_script
+    - .new-e2e_os_centos
+    - .new-e2e_centos-fips_a7_x86_64
+    - .new-e2e_agent_a7
+  rules:
+    !reference [.on_default_new-e2e_tests_a7]
+  variables:
+    FLAVOR: datadog-iot-agent
+
+new-e2e-agent-platform-install-script-centos-fips-dogstatsd-a7-x86_64:
+  stage: kitchen_testing
+  extends: 
+    - .new_e2e_template
+    - .new-e2e_install_script
+    - .new-e2e_os_centos
+    - .new-e2e_centos-fips_a7_x86_64
+    - .new-e2e_agent_a7
+  variables:
+    FLAVOR: datadog-dogstatsd

.gitlab/trigger_release.yml

@@ -20,7 +20,8 @@
     # when triggered with major version 7
     - source /root/.bashrc
     - export RELEASE_VERSION=$(inv agent.version --major-version 7 --url-safe --omnibus-format)-1
-    - inv pipeline.trigger-child-pipeline --no-follow --project-name "DataDog/agent-release-management" --git-ref "main" --variables "ACTION,AUTO_RELEASE,BUILD_PIPELINE_ID,RELEASE_PRODUCT,RELEASE_VERSION,TARGET_REPO,TARGET_REPO_BRANCH"
+    - export GITLAB_TOKEN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-agent.gitlab_pipelines_scheduler_token --with-decryption --query "Parameter.Value" --out text)
+    - inv pipeline.trigger-child-pipeline --project-name "DataDog/agent-release-management" --git-ref "main" --variables "ACTION,AUTO_RELEASE,BUILD_PIPELINE_ID,RELEASE_PRODUCT,RELEASE_VERSION,TARGET_REPO,TARGET_REPO_BRANCH"
   dependencies: []
 
 trigger_auto_staging_release:

cmd/system-probe/modules/compliance.go

@@ -67,7 +67,9 @@ func (m *complianceModule) Register(router *module.Router) error {
 
 func (m *complianceModule) handleError(writer http.ResponseWriter, request *http.Request, status int, err error) {
 	_ = log.Errorf("module compliance: failed to properly handle %s request: %s", request.URL.Path, err)
+	writer.Header().Set("Content-Type", "text/plain")
 	writer.WriteHeader(status)
+	writer.Write([]byte(err.Error()))
 }
 
 func (m *complianceModule) handleScanDBConfig(writer http.ResponseWriter, request *http.Request) {
@@ -78,7 +80,7 @@ func (m *complianceModule) handleScanDBConfig(writer http.ResponseWriter, reques
 	qs := request.URL.Query()
 	pid, err := strconv.ParseInt(qs.Get("pid"), 10, 32)
 	if err != nil {
-		m.handleError(writer, request, http.StatusBadRequest, fmt.Errorf("pid query paramater is not an integer: %w", err))
+		m.handleError(writer, request, http.StatusBadRequest, fmt.Errorf("pid query parameter is not an integer: %w", err))
 		return
 	}
 

cmd/system-probe/modules/compliance_test.go

@@ -28,15 +28,15 @@ func TestComplianceModuleNoProcess(t *testing.T) {
 	{
 		url := "/dbconfig"
 		statusCode, _, respBody := doDBConfigRequest(t, url)
+		require.Contains(t, string(respBody), "pid query parameter is not an integer")
 		require.Equal(t, http.StatusBadRequest, statusCode)
-		require.Len(t, respBody, 0)
 	}
 
 	{
 		url := "/dbconfig?pid=0"
 		statusCode, _, respBody := doDBConfigRequest(t, url)
+		require.Contains(t, "resource not found for pid=0", string(respBody))
 		require.Equal(t, http.StatusNotFound, statusCode)
-		require.Len(t, respBody, 0)
 	}
 }
 
@@ -55,25 +55,29 @@ func TestComplianceCheckModuleWithProcess(t *testing.T) {
 	if err := json.Unmarshal(respBody, &resource); err != nil {
 		t.Fatal(err)
 	}
-	require.Nil(t, resource)
+	require.Equal(t, "db_postgresql", resource.Type)
+	require.Equal(t, "postgres", resource.Config.ProcessName)
+	require.NotEmpty(t, resource.Config.ProcessUser)
+	require.Equal(t, filepath.Join(tmp, "postgresql.conf"), resource.Config.ConfigFilePath)
+	require.NotEmpty(t, resource.Config.ConfigFileUser)
+	require.NotEmpty(t, resource.Config.ConfigFileGroup)
+	require.Equal(t, uint32(0600), resource.Config.ConfigFileMode)
+	require.Equal(t, map[string]interface{}{"foo": "bar"}, resource.Config.ConfigData)
 }
 
 func launchFakeProcess(ctx context.Context, t *testing.T, tmp, procname string) int {
-	// creates a symlink to /usr/bin/sleep to be able to create a fake
-	// postgres process.
-	sleepPath, err := exec.LookPath("sleep")
-	if err != nil {
-		t.Skipf("could not find sleep util")
-	}
-	fakePgPath := filepath.Join(tmp, procname)
-	if err := os.Symlink(sleepPath, fakePgPath); err != nil {
-		t.Fatalf("could not create fake process symlink: %v", err)
+	fakePgBinPath := filepath.Join(tmp, "postgres")
+	fakePgConfPath := filepath.Join(tmp, "postgresql.conf")
+
+	if err := os.WriteFile(fakePgBinPath, []byte("#!/bin/bash\nsleep 10"), 0700); err != nil {
+		t.Fatal(err)
 	}
-	if err := os.Chmod(fakePgPath, 0700); err != nil {
-		t.Fatalf("could not chmod fake process symlink: %v", err)
+
+	if err := os.WriteFile(fakePgConfPath, []byte(`foo = 'bar'`), 0600); err != nil {
+		t.Fatal(err)
 	}
 
-	cmd := exec.CommandContext(ctx, fakePgPath, "5")
+	cmd := exec.CommandContext(ctx, fakePgBinPath, fmt.Sprintf("--config-file=%s", fakePgConfPath))
 	if err := cmd.Start(); err != nil {
 		t.Fatalf("could not start fake process %q: %v", procname, err)
 	}