Add config provider based security controls for agent checks by NouemanKHAL · Pull Request #44544 · DataDog/datadog-agent

NouemanKHAL · 2025-12-22T19:59:14Z

What does this PR do?

Adds provider parameter to check configuration to track which config provider (kubernetes, file, etcd, etc.) issued the check config and allow for secure mode when dealing with agent python integrations/checks.

Changes:

Add provider parameter to Check.Configure() method
Add ConfigProvider() method to Check interface
Update CheckBase to store the provider value
Update all check implementations to pass the parameter through

Configuration Changes

Adds new integration security properties:

integration_ignore_untrusted_file_params: When enabled, integrations ignore file path parameters from untrusted providers
integration_file_paths_allowlist: Allowlist of file paths integrations can access even from untrusted providers
integration_trusted_providers: List of trusted providers (defaults to ["file", "remote-config"])
integration_security_excluded_checks: Integration names excluded from security restrictions

These settings enable security controls based on the config provider. Untrusted providers (container labels, pod annotations,

Motivation

Need to track where check configs come from to support provider-based security controls in the agent checks.

RFC: https://datadoghq.atlassian.net/wiki/spaces/AI/pages/5802623155/RFC+Remediate+untrusted+checks+configs+in+Integrations

Jira: https://datadoghq.atlassian.net/browse/AI-5322

Describe how you validated your changes

Updated all check implementations and tests to pass the provider parameter
Added tests in checkbase_test.go to verify provider is stored and returned correctly
Existing tests pass with empty string or "provider" placeholder values
Testing in a kubernetes lab environment using both an existing agent docker image and a pipeline docker image from this [DO NOT MERGE] Testing Config Provider Integrations Security #47971 where I update the release.json ints core hash to target the latest commit on this branch, and have a http_check configured via pod annotation and testing for the expected output. (currently waiting for CI to redeploy the environment with the new agent docker image from the pipeline)

Here is a report detailing the experiment: https://datadoghq.atlassian.net/wiki/spaces/~550367931/pages/6428329336/DEMO+Remediate+untrusted+checks+configs+in+Integrations

Additional Notes

Relates to: DataDog/integrations-core#22226

Update (2026-03-19)

Addressed review feedback:

Assert provider in CGo test mocks: Added get_check_provider and get_check_deprecated_provider globals with strdup/reset/assertions in testConfigure and testConfigureDeprecated, matching the pattern used for other parameters
Add ConfigProvider() to check.Info interface: For symmetry with ConfigSource(), so consumers operating on Info references don't need a type assertion to Check to read the provider. Updated MockInfo accordingly.
Move source/provider out of handleConf closure: Assignments were redundantly written twice (once per handleConf call). Moved them after both calls alongside initConfig/instanceConfig.

agent-platform-auto-pr · 2025-12-23T14:21:46Z

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor 6d7bc6d
📊 Static Quality Gates Dashboard
🔗 SQG Job

Successful checks

Info

	Quality gate	Change	Size (prev → curr → max)
✅	agent_deb_amd64	+20.24 KiB (0.00% increase)	751.636 → 751.655 → 753.380
✅	agent_deb_amd64_fips	+16.24 KiB (0.00% increase)	708.599 → 708.615 → 713.900
✅	agent_heroku_amd64	+12.24 KiB (0.00% increase)	313.141 → 313.153 → 320.580
✅	agent_msi	+24.5 KiB (0.00% increase)	604.615 → 604.639 → 1062.520
✅	agent_rpm_amd64	+20.24 KiB (0.00% increase)	751.619 → 751.639 → 753.350
✅	agent_rpm_amd64_fips	+16.24 KiB (0.00% increase)	708.583 → 708.598 → 713.880
✅	agent_rpm_arm64	+4.24 KiB (0.00% increase)	730.015 → 730.019 → 735.290
✅	agent_rpm_arm64_fips	+8.24 KiB (0.00% increase)	689.992 → 690.000 → 696.840
✅	agent_suse_amd64	+20.24 KiB (0.00% increase)	751.619 → 751.639 → 753.350
✅	agent_suse_amd64_fips	+16.24 KiB (0.00% increase)	708.583 → 708.598 → 713.880
✅	agent_suse_arm64	+4.24 KiB (0.00% increase)	730.015 → 730.019 → 735.290
✅	agent_suse_arm64_fips	+8.24 KiB (0.00% increase)	689.992 → 690.000 → 696.840
✅	docker_agent_amd64	+20.25 KiB (0.00% increase)	811.942 → 811.962 → 815.700
✅	docker_agent_arm64	+4.24 KiB (0.00% increase)	815.101 → 815.105 → 821.970
✅	docker_agent_jmx_amd64	+20.24 KiB (0.00% increase)	1002.858 → 1002.878 → 1006.580
✅	docker_agent_jmx_arm64	+4.24 KiB (0.00% increase)	994.795 → 994.799 → 1001.570
✅	iot_agent_deb_amd64	+8.0 KiB (0.02% increase)	43.254 → 43.262 → 43.290
✅	iot_agent_deb_arm64	+4.0 KiB (0.01% increase)	40.305 → 40.309 → 40.920
✅	iot_agent_rpm_amd64	+8.0 KiB (0.02% increase)	43.255 → 43.262 → 43.290
✅	iot_agent_suse_amd64	+8.0 KiB (0.02% increase)	43.255 → 43.262 → 43.290

11 successful checks with minimal change (< 2 KiB)

	Quality gate	Current Size
✅	docker_cluster_agent_amd64	205.320 MiB
✅	docker_cluster_agent_arm64	219.677 MiB
✅	docker_cws_instrumentation_amd64	7.142 MiB
✅	docker_cws_instrumentation_arm64	6.689 MiB
✅	docker_dogstatsd_amd64	39.230 MiB
✅	docker_dogstatsd_arm64	37.445 MiB
✅	dogstatsd_deb_amd64	29.874 MiB
✅	dogstatsd_deb_arm64	28.026 MiB
✅	dogstatsd_rpm_amd64	29.874 MiB
✅	dogstatsd_suse_amd64	29.874 MiB
✅	iot_agent_deb_armhf	41.052 MiB

On-wire sizes (compressed)

	Quality gate	Change	Size (prev → curr → max)
✅	agent_deb_amd64	+16.01 KiB (0.01% increase)	174.776 → 174.791 → 178.360
✅	agent_deb_amd64_fips	+23.09 KiB (0.01% increase)	165.380 → 165.403 → 172.790
✅	agent_heroku_amd64	+5.94 KiB (0.01% increase)	74.975 → 74.981 → 79.970
✅	agent_msi	+4.0 KiB (0.00% increase)	138.211 → 138.215 → 146.220
✅	agent_rpm_amd64	+16.65 KiB (0.01% increase)	177.599 → 177.616 → 181.830
✅	agent_rpm_amd64_fips	+3.72 KiB (0.00% increase)	167.627 → 167.630 → 173.370
✅	agent_rpm_arm64	-35.57 KiB (0.02% reduction)	159.603 → 159.568 → 163.060
✅	agent_rpm_arm64_fips	+49.56 KiB (0.03% increase)	151.420 → 151.468 → 156.170
✅	agent_suse_amd64	+16.65 KiB (0.01% increase)	177.599 → 177.616 → 181.830
✅	agent_suse_amd64_fips	+3.72 KiB (0.00% increase)	167.627 → 167.630 → 173.370
✅	agent_suse_arm64	-35.57 KiB (0.02% reduction)	159.603 → 159.568 → 163.060
✅	agent_suse_arm64_fips	+49.56 KiB (0.03% increase)	151.420 → 151.468 → 156.170
✅	docker_agent_amd64	+2.51 KiB (0.00% increase)	268.130 → 268.132 → 272.480
✅	docker_agent_arm64	-6.86 KiB (0.00% reduction)	255.342 → 255.335 → 261.060
✅	docker_agent_jmx_amd64	+7.14 KiB (0.00% increase)	336.777 → 336.784 → 341.100
✅	docker_agent_jmx_arm64	-2.35 KiB (0.00% reduction)	319.981 → 319.978 → 325.620
✅	docker_cluster_agent_amd64	neutral	71.929 MiB → 72.920
✅	docker_cluster_agent_arm64	+5.52 KiB (0.01% increase)	67.506 → 67.512 → 68.220
✅	docker_cws_instrumentation_amd64	neutral	2.999 MiB → 3.330
✅	docker_cws_instrumentation_arm64	neutral	2.729 MiB → 3.090
✅	docker_dogstatsd_amd64	neutral	15.169 MiB → 15.820
✅	docker_dogstatsd_arm64	-4.36 KiB (0.03% reduction)	14.488 → 14.484 → 14.830
✅	dogstatsd_deb_amd64	neutral	7.890 MiB → 8.790
✅	dogstatsd_deb_arm64	neutral	6.776 MiB → 7.710
✅	dogstatsd_rpm_amd64	neutral	7.902 MiB → 8.800
✅	dogstatsd_suse_amd64	neutral	7.902 MiB → 8.800
✅	iot_agent_deb_amd64	neutral	11.397 MiB → 12.040
✅	iot_agent_deb_arm64	neutral	9.700 MiB → 10.450
✅	iot_agent_deb_armhf	neutral	9.934 MiB → 10.620
✅	iot_agent_rpm_amd64	neutral	11.413 MiB → 12.060
✅	iot_agent_suse_amd64	neutral	11.413 MiB → 12.060

cit-pr-commenter · 2025-12-23T14:46:52Z

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 8ec1551b-40c7-4025-b14b-79164f7b2fea

Baseline: 2d981c3
Comparison: 07b2c8d
Diff

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Regressions in experiments with settings containing erratic: true are ignored.

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	docker_containers_cpu	% cpu utilization	+1.60	[-1.46, +4.67]	1	Logs

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	docker_containers_cpu	% cpu utilization	+1.60	[-1.46, +4.67]	1	Logs
➖	docker_containers_memory	memory utilization	+1.57	[+1.41, +1.72]	1	Logs
➖	quality_gate_metrics_logs	memory utilization	+1.55	[+1.31, +1.79]	1	Logs bounds checks dashboard
➖	tcp_syslog_to_blackhole	ingress throughput	+0.51	[+0.35, +0.67]	1	Logs
➖	ddot_metrics_sum_cumulative	memory utilization	+0.36	[+0.22, +0.50]	1	Logs
➖	file_tree	memory utilization	+0.12	[+0.06, +0.18]	1	Logs
➖	file_to_blackhole_1000ms_latency	egress throughput	+0.06	[-0.37, +0.49]	1	Logs
➖	quality_gate_idle_all_features	memory utilization	+0.04	[+0.00, +0.07]	1	Logs bounds checks dashboard
➖	file_to_blackhole_100ms_latency	egress throughput	+0.03	[-0.05, +0.10]	1	Logs
➖	file_to_blackhole_500ms_latency	egress throughput	+0.01	[-0.37, +0.39]	1	Logs
➖	uds_dogstatsd_to_api_v3	ingress throughput	+0.00	[-0.20, +0.21]	1	Logs
➖	uds_dogstatsd_to_api	ingress throughput	+0.00	[-0.20, +0.20]	1	Logs
➖	tcp_dd_logs_filter_exclude	ingress throughput	-0.00	[-0.11, +0.10]	1	Logs
➖	quality_gate_idle	memory utilization	-0.01	[-0.06, +0.04]	1	Logs bounds checks dashboard
➖	file_to_blackhole_0ms_latency	egress throughput	-0.04	[-0.52, +0.44]	1	Logs
➖	ddot_logs	memory utilization	-0.08	[-0.13, -0.02]	1	Logs
➖	ddot_metrics_sum_delta	memory utilization	-0.09	[-0.27, +0.08]	1	Logs
➖	ddot_metrics	memory utilization	-0.29	[-0.47, -0.10]	1	Logs
➖	ddot_metrics_sum_cumulativetodelta_exporter	memory utilization	-0.40	[-0.62, -0.17]	1	Logs
➖	otlp_ingest_metrics	memory utilization	-0.48	[-0.64, -0.32]	1	Logs
➖	otlp_ingest_logs	memory utilization	-0.53	[-0.63, -0.43]	1	Logs
➖	quality_gate_logs	% cpu utilization	-0.56	[-2.15, +1.02]	1	Logs bounds checks dashboard
➖	uds_dogstatsd_20mb_12k_contexts_20_senders	memory utilization	-0.64	[-0.70, -0.58]	1	Logs

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	observed_value	links
✅	docker_containers_cpu	simple_check_run	10/10	737 ≥ 26
✅	docker_containers_memory	memory_usage	10/10	272.21MiB ≤ 370MiB
✅	docker_containers_memory	simple_check_run	10/10	723 ≥ 26
✅	file_to_blackhole_0ms_latency	memory_usage	10/10	0.19GiB ≤ 1.20GiB
✅	file_to_blackhole_0ms_latency	missed_bytes	10/10	0B = 0B
✅	file_to_blackhole_1000ms_latency	memory_usage	10/10	0.23GiB ≤ 1.20GiB
✅	file_to_blackhole_1000ms_latency	missed_bytes	10/10	0B = 0B
✅	file_to_blackhole_100ms_latency	memory_usage	10/10	0.19GiB ≤ 1.20GiB
✅	file_to_blackhole_100ms_latency	missed_bytes	10/10	0B = 0B
✅	file_to_blackhole_500ms_latency	memory_usage	10/10	0.22GiB ≤ 1.20GiB
✅	file_to_blackhole_500ms_latency	missed_bytes	10/10	0B = 0B
✅	quality_gate_idle	intake_connections	10/10	3 = 3	bounds checks dashboard
✅	quality_gate_idle	memory_usage	10/10	174.76MiB ≤ 175MiB	bounds checks dashboard
✅	quality_gate_idle_all_features	intake_connections	10/10	2 ≤ 3	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	494.00MiB ≤ 550MiB	bounds checks dashboard
✅	quality_gate_logs	intake_connections	10/10	3 ≤ 6	bounds checks dashboard
✅	quality_gate_logs	memory_usage	10/10	201.70MiB ≤ 220MiB	bounds checks dashboard
✅	quality_gate_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard
✅	quality_gate_metrics_logs	cpu_usage	10/10	342.18 ≤ 2000	bounds checks dashboard
✅	quality_gate_metrics_logs	intake_connections	10/10	4 ≤ 6	bounds checks dashboard
✅	quality_gate_metrics_logs	memory_usage	10/10	405.93MiB ≤ 475MiB	bounds checks dashboard
✅	quality_gate_metrics_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

✅ = significantly better comparison variant performance
❌ = significantly worse comparison variant performance
➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.

…d-provider-base-check

NouemanKHAL · 2026-03-23T08:12:03Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-03-23T08:12:08Z

View all feedbacks in Devflow UI.

2026-03-23 08:12:07 UTC ℹ️ Start processing command /merge

2026-03-23 08:12:12 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 2h (p90).

2026-03-23 08:35:49 UTC ❌ MergeQueue: The build pipeline contains failing jobs for this merge request

Build pipeline has failing jobs for 791f5c8:

lint_flavor_iot_linux-x64

⚠️ Do NOT retry failed jobs directly (why?).

What to do next?

Investigate the failures and when ready, re-add your pull request to the queue!
If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
Any question, go check the FAQ.

Details

Since those jobs are not marked as being allowed to fail, the pipeline will most likely fail.
Therefore, and to allow other builds to be processed, this merge request has been rejected and the pipeline got canceled.

… ### What does this PR do? Adds `provider` parameter to check configuration to track which config provider (kubernetes, file, etcd, etc.) issued the check config and allow for secure mode when dealing with agent python integrations/checks. Changes: - Add `provider` parameter to `Check.Configure()` method - Add `ConfigProvider()` method to `Check` interface - Update `CheckBase` to store the provider value - Update all check implementations to pass the parameter through #### Configuration Changes Adds new integration security properties: - `integration_ignore_untrusted_file_params`: When enabled, integrations ignore file path parameters from untrusted providers - `integration_file_paths_allowlist`: Allowlist of file paths integrations can access even from untrusted providers - `integration_trusted_providers`: List of trusted providers (defaults to `["file", "remote-config"]`) - `integration_security_excluded_checks`: Integration names excluded from security restrictions These settings enable security controls based on the config provider. Untrusted providers (container labels, pod annotations, ### Motivation Need to track where check configs come from to support provider-based security controls in the agent checks. RFC: https://datadoghq.atlassian.net/wiki/spaces/AI/pages/5802623155/RFC+Remediate+untrusted+checks+configs+in+Integrations Jira: https://datadoghq.atlassian.net/browse/AI-5322 ### Describe how you validated your changes - Updated all check implementations and tests to pass the provider parameter - Added tests in `checkbase_test.go` to verify provider is stored and returned correctly - Existing tests pass with empty string or "provider" placeholder values - Testing in a kubernetes lab environment using both an existing agent docker image and a pipeline docker image from this #47971 where I update the release.json ints core hash to target the latest commit on this branch, and have a http_check configured via pod annotation and testing for the expected output. (currently waiting for CI to redeploy the environment with the new agent docker image from the pipeline) Here is a report detailing the experiment: https://datadoghq.atlassian.net/wiki/spaces/~550367931/pages/6428329336/DEMO+Remediate+untrusted+checks+configs+in+Integrations ### Additional Notes Relates to: DataDog/integrations-core#22226 ### Update (2026-03-19) Addressed review feedback: - **Assert provider in CGo test mocks**: Added `get_check_provider` and `get_check_deprecated_provider` globals with `strdup`/reset/assertions in `testConfigure` and `testConfigureDeprecated`, matching the pattern used for other parameters - **Add `ConfigProvider()` to `check.Info` interface**: For symmetry with `ConfigSource()`, so consumers operating on `Info` references don't need a type assertion to `Check` to read the provider. Updated `MockInfo` accordingly. - **Move `source`/`provider` out of `handleConf` closure**: Assignments were redundantly written twice (once per `handleConf` call). Moved them after both calls alongside `initConfig`/`instanceConfig`. Co-authored-by: noueman.khalikine <[email protected]> (cherry picked from commit 07b2c8d) ___ Co-authored-by: NouemanKHAL <[email protected]>

…nt checks (#48225) Backport 07b2c8d from #44544. ___ ### What does this PR do? Adds `provider` parameter to check configuration to track which config provider (kubernetes, file, etcd, etc.) issued the check config and allow for secure mode when dealing with agent python integrations/checks. Changes: - Add `provider` parameter to `Check.Configure()` method - Add `ConfigProvider()` method to `Check` interface - Update `CheckBase` to store the provider value - Update all check implementations to pass the parameter through #### Configuration Changes Adds new integration security properties: - `integration_ignore_untrusted_file_params`: When enabled, integrations ignore file path parameters from untrusted providers - `integration_file_paths_allowlist`: Allowlist of file paths integrations can access even from untrusted providers - `integration_trusted_providers`: List of trusted providers (defaults to `["file", "remote-config"]`) - `integration_security_excluded_checks`: Integration names excluded from security restrictions These settings enable security controls based on the config provider. Untrusted providers (container labels, pod annotations, ### Motivation Need to track where check configs come from to support provider-based security controls in the agent checks. RFC: https://datadoghq.atlassian.net/wiki/spaces/AI/pages/5802623155/RFC+Remediate+untrusted+checks+configs+in+Integrations Jira: https://datadoghq.atlassian.net/browse/AI-5322 ### Describe how you validated your changes - Updated all check implementations and tests to pass the provider parameter - Added tests in `checkbase_test.go` to verify provider is stored and returned correctly - Existing tests pass with empty string or "provider" placeholder values - Testing in a kubernetes lab environment using both an existing agent docker image and a pipeline docker image from this #47971 where I update the release.json ints core hash to target the latest commit on this branch, and have a http_check configured via pod annotation and testing for the expected output. (currently waiting for CI to redeploy the environment with the new agent docker image from the pipeline) Here is a report detailing the experiment: https://datadoghq.atlassian.net/wiki/spaces/~550367931/pages/6428329336/DEMO+Remediate+untrusted+checks+configs+in+Integrations ### Additional Notes Relates to: DataDog/integrations-core#22226 ### Update (2026-03-19) Addressed review feedback: - **Assert provider in CGo test mocks**: Added `get_check_provider` and `get_check_deprecated_provider` globals with `strdup`/reset/assertions in `testConfigure` and `testConfigureDeprecated`, matching the pattern used for other parameters - **Add `ConfigProvider()` to `check.Info` interface**: For symmetry with `ConfigSource()`, so consumers operating on `Info` references don't need a type assertion to `Check` to read the provider. Updated `MockInfo` accordingly. - **Move `source`/`provider` out of `handleConf` closure**: Assignments were redundantly written twice (once per `handleConf` call). Moved them after both calls alongside `initConfig`/`instanceConfig`. Co-authored-by: ali.benabdallah <[email protected]>

NouemanKHAL added 4 commits December 22, 2025 15:59

pass config provider to checks

bdff717

update provider value in test and assert it

02daa42

pass provider to checks

3eab7f7

update integration_core pin to target dev branch

d8e0dbc

github-actions Bot added component/system-probe long review PR is complex, plan time to review it team/agent-runtimes labels Dec 22, 2025

NouemanKHAL added 3 commits December 22, 2025 23:44

Merge branch 'main' into noueman/add-source-and-provider-base-check

ae30360

run rtloader.format

5e86e59

update integrations_core pin

663f227

NouemanKHAL added 3 commits December 23, 2025 16:03

stop using kwargs and inject provider property similar to check_id

c03e715

update integration_core pin

66ef2b9

add integration security configuration options

575be6d

NouemanKHAL changed the title ~~Pass config provider to checks~~ Add config provider based security controls for agent checks Feb 4, 2026

NouemanKHAL added 6 commits February 4, 2026 02:01

Merge branch 'main' into noueman/add-source-and-provider-base-check

87b981c

target latest commit of custom branhc in ints-core for testing

e7ee7a9

fix tests and gofmt

77155da

fix missing provider arg in gpu-test

f18079d

Merge branch 'main' into noueman/add-source-and-provider-base-check

5755fd4

Merge remote-tracking branch 'origin/main' into noueman/add-source-an…

0f1bcc7

…d-provider-base-check

dd-octo-sts Bot added internal Identify a non-fork PR team/windows-products team/kubernetes-experiences team/ndm-integrations team/ebpf-platform team/network-device-monitoring-core team/agent-discovery team/agent-integrations labels Mar 11, 2026

fix linter

9aaca9f

NouemanKHAL mentioned this pull request Mar 19, 2026

Add security config validation based on configuration provider DataDog/integrations-core#22226

Merged

3 tasks

sarah-witt approved these changes Mar 19, 2026

View reviewed changes

NouemanKHAL added ask-review Ask in slack required teams to review this PR short review PR is simple enough to be reviewed quickly backport/7.78.x and removed ask-review Ask in slack required teams to review this PR labels Mar 19, 2026

ichinaski approved these changes Mar 20, 2026

View reviewed changes

Pierre-L42 approved these changes Mar 20, 2026

View reviewed changes

FlorianVeaux approved these changes Mar 20, 2026

View reviewed changes

triviajon approved these changes Mar 20, 2026

View reviewed changes

jack0x2 approved these changes Mar 20, 2026

View reviewed changes

dd-octo-sts Bot mentioned this pull request Mar 20, 2026

[Backport 7.78.x] Add security config validation based on configuration provider DataDog/integrations-core#23000

Merged

3 tasks

dplepage-dd approved these changes Mar 20, 2026

View reviewed changes

AlexandreYang approved these changes Mar 22, 2026

View reviewed changes

Merge branch 'main' into noueman/add-source-and-provider-base-check

0bc4c58

github-actions Bot removed the short review PR is simple enough to be reviewed quickly label Mar 23, 2026

NouemanKHAL added 2 commits March 23, 2026 10:52

fix broken Configure calls in networkv2 corecheck

585049d

Merge branch 'main' into noueman/add-source-and-provider-base-check

ed0e8b3

gh-worker-dd-mergequeue-cf854d Bot merged commit 07b2c8d into main Mar 23, 2026
370 checks passed

gh-worker-dd-mergequeue-cf854d Bot deleted the noueman/add-source-and-provider-base-check branch March 23, 2026 15:45

github-actions Bot added this to the 7.79.0 milestone Mar 23, 2026

dd-octo-sts Bot mentioned this pull request Mar 23, 2026

[Backport 7.78.x] Add config provider based security controls for agent checks #48225

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add config provider based security controls for agent checks#44544

Add config provider based security controls for agent checks#44544
gh-worker-dd-mergequeue-cf854d[bot] merged 33 commits into
mainfrom
noueman/add-source-and-provider-base-check

NouemanKHAL commented Dec 22, 2025 •

edited

Loading

Uh oh!

agent-platform-auto-pr Bot commented Dec 23, 2025 •

edited

Loading

Info

Uh oh!

cit-pr-commenter Bot commented Dec 23, 2025 •

edited by cit-pr-commenter-54b7da Bot

Loading

Experiments ignored for regressions

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

Uh oh!

NouemanKHAL commented Mar 23, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Mar 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

19 participants

Uh oh!

Conversation

NouemanKHAL commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Configuration Changes

Motivation

Describe how you validated your changes

Additional Notes

Update (2026-03-19)

Uh oh!

agent-platform-auto-pr Bot commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Static quality checks

Info

Uh oh!

cit-pr-commenter Bot commented Dec 23, 2025 • edited by cit-pr-commenter-54b7da Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Regression Detector

Regression Detector Results

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

CI Pass/Fail Decision

Uh oh!

NouemanKHAL commented Mar 23, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What to do next?

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

19 participants

NouemanKHAL commented Dec 22, 2025 •

edited

Loading

agent-platform-auto-pr Bot commented Dec 23, 2025 •

edited

Loading

cit-pr-commenter Bot commented Dec 23, 2025 •

edited by cit-pr-commenter-54b7da Bot

Loading

gh-worker-devflow-routing-ef8351 Bot commented Mar 23, 2026 •

edited

Loading