Skip to content

[APPSEC-62377] Collect Datadog request attribution headers#5811

Merged
Strech merged 2 commits into
masterfrom
appsec-62377-add-trace-attribution-for-inventory-enrichment
May 27, 2026
Merged

[APPSEC-62377] Collect Datadog request attribution headers#5811
Strech merged 2 commits into
masterfrom
appsec-62377-add-trace-attribution-for-inventory-enrichment

Conversation

@Strech

@Strech Strech commented May 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What does this PR do?

Add unconditional tagging for requests landing on customer application generated by Datadog, to distinguish them from real traffic.

Motivation:

RFC-1105: Trace Attribution for Inventory Enrichment and Pollution Prevention

Change log entry

Yes. Prevent Datadog-generated traffic from interfering with application metrics.

Additional Notes:

I did it with generalization in mind simply because I can't decouple it now as it should work with AppSec being disabled or configuration missing. Hence - it lives in Tracer codebase.

I'm working on solution to have a better decoupling.

I've also fixed few overlooks with require statements and typing 🙌🏼

Resolves APPSEC-62413

How to test the change?

CI + ST (enforced)

@Strech
Strech requested review from a team as code owners May 26, 2026 14:28
@Strech
Strech requested review from vpellan and wantsui May 26, 2026 14:28
@dd-octo-sts dd-octo-sts Bot added integrations Involves tracing integrations tracing labels May 26, 2026
@datadog-datadog-prod-us1

datadog-datadog-prod-us1 Bot commented May 26, 2026 •
edited by datadog-prod-us1-5 Bot
Loading

Copy link
Copy Markdown
Contributor

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 97.09% (+0.06%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f46b1a1 | Docs | Datadog PR Page | Give us feedback!

@pr-commenter

pr-commenter Bot commented May 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-05-27 19:59:20

Comparing candidate commit f46b1a1 in PR branch appsec-62377-add-trace-attribution-for-inventory-enrichment with baseline commit 51a8437 in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 45 metrics, 1 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

vpellan
vpellan approved these changes May 27, 2026
View reviewed changes
Comment thread sig/datadog/tracing/contrib/rack/header_tagging.rbs Outdated
@Strech
Collect Datadog request attribution headers
cb4ac0e 
Datadog-originated requests use these headers for request attribution.
They are tagged independently of user-configured header tagging so
downstream systems can distinguish them from regular application traffic.
@Strech
Strech force-pushed the appsec-62377-add-trace-attribution-for-inventory-enrichment branch from c0f8247 to cb4ac0e Compare May 27, 2026 09:23
@Strech
Strech enabled auto-merge May 27, 2026 19:33
@Strech
Strech merged commit f87530c into master May 27, 2026
585 checks passed
@Strech
Strech deleted the appsec-62377-add-trace-attribution-for-inventory-enrichment branch May 27, 2026 20:01
@dd-octo-sts dd-octo-sts Bot added this to the 2.35.0 milestone May 27, 2026
@Strech Strech mentioned this pull request Jun 3, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wantsui wantsui wantsui approved these changes
@vpellan vpellan vpellan approved these changes

Assignees

No one assigned

Labels

integrations Involves tracing integrations tracing

Projects

None yet

Milestone

2.35.0

Development

Successfully merging this pull request may close these issues.

3 participants

@Strech @wantsui @vpellan