[datadog] bump get-agent-version fallback for latest/7 to 7.78.3#2643
Merged
Conversation
The `get-agent-version` fallback substituted `7.67.0` for the single-component tags `latest` and `7`, which is below the `>=7.78.0` threshold that auto-enables service discovery (introduced in #2598). As a result, users on these floating tags never got a system-probe container or `system-probe-lite`, despite the actual `latest` image supporting it. Bump the fallback to `7.78.0` so the chart treats `latest`/`7` like the current agent and auto-enables discovery with `system-probe-lite`.
github-actions
Bot
added
the
chart/datadog
vitkyrka
changed the title
latest and 7 tagsget-agent-version fallback for latest/7 to 7.78.0
The fallback bump affects several version-gated code paths besides discovery (ADP, -fips-full, standalone DDOT FIPS, DD_USE_DOGSTATSD). Reword the changelog so it matches the release note in the PR description.
# Conflicts: # charts/datadog/CHANGELOG.md
fanny-jiang
approved these changes
May 11, 2026
fanny-jiang
left a comment
fanny-jiang
left a comment
Contributor
There was a problem hiding this comment.
Let's align the helper with the latest pinned image version, otherwise LGTM 👍🏼
| {{- end -}} | ||
| {{- if and (eq $length 1) (or (eq $version "7") (eq $version "latest")) -}} | ||
| {{- $version = "7.67.0" -}} | ||
| {{- $version = "7.78.0" -}} |
Contributor
There was a problem hiding this comment.
Suggested change
| {{- $version = "7.78.0" -}} | |
| {{- $version = "7.78.3" -}} |
To align with the current latest patch version of the agent.
Contributor
Author
There was a problem hiding this comment.
Done in ce18c87 — bumped to 7.78.3 to match the current default agent tag.
# Conflicts: # charts/datadog/CHANGELOG.md # charts/datadog/Chart.yaml # charts/datadog/README.md
vitkyrka
changed the title
get-agent-version fallback for latest/7 to 7.78.0get-agent-version fallback for latest/7 to 7.78.3
gh-worker-dd-devflow-36fce6
Bot
added
mergequeue-status: queued
mergequeue-status: in_progress
and removed
mergequeue-status: queued
labels
gh-worker-dd-devflow-36fce6
Bot
added
mergequeue-status: done
and removed
mergequeue-status: in_progress
labels
gh-worker-dd-mergequeue-cf854d Bot
pushed a commit
to DataDog/datadog-agent
that referenced
this pull request
May 12, 2026
### What does this PR do?
Adds a Kubernetes E2E sanity test for the Datadog Agent's discovery feature, mirroring (in spirit) the existing Linux VM suite in `test/new-e2e/tests/discovery/linux_test.go`. The new suite at `test/new-e2e/tests/discovery/k8s_test.go`:
- Provisions a Kind-on-EC2 cluster (`provkindvm`) with the agent installed via Helm and an `nginx` workload.
- Runs `TestNginxDiscovered` in two sub-tests covering both discovery modes:
- `system-probe-lite` — discovery enabled alone; the agent execs into `system-probe-lite` per `cmd/system-probe/subcommands/run/splite.go`.
- `system-probe` — adds `datadog.systemProbe.enableOOMKill: true` so the agent's `shouldExecSPLite` keeps the full binary running.
- Asserts on the matched nginx process: TCP port 80 listener, `ServiceDiscovery.GeneratedServiceName == {nginx, SOURCE_COMMAND_LINE}`, `ApmInstrumentation == false`, `InjectionState == NOT_INJECTED`, non-empty `ContainerId`.
- Pins the Helm chart version to `3.213.0`; the framework default (`3.155.1`) predates both the discovery template (chart 3.205.0, DataDog/helm-charts#2598) and the `latest`/`7` → `7.78.x` fallback fix (chart 3.213.0, DataDog/helm-charts#2643).
### Motivation
https://datadoghq.atlassian.net/browse/DSCVR-385
There is no k8s e2e for discovery today. DataDog/helm-charts#2634 fixed a bug in discovery on k8s related to the seccomp profile; the change went undetected before merge because nothing exercises the discovery flow on a Helm-installed agent. This suite closes that gap with a smoke-level check that the discovery payload reaches fakeintake in both modes.
The k8s suite is narrower than `linux_test.go` (single workload, smoke-level assertions), at least for now. This is to avoid having to add new app definitions at this point for a basic test. The VM suite continues to be the exhaustive per-language source of truth.
### Describe how you validated your changes
Ran locally against AWS twice with `E2E_DEV_MODE=true dda inv -- -e new-e2e-tests.run --targets ./tests/discovery --run TestK8sTestSuite --stack-name-suffix v2`:
```
--- PASS: TestK8sTestSuite (364.64s)
--- PASS: TestK8sTestSuite/TestNginxDiscovered (...)
--- PASS: TestK8sTestSuite/TestNginxDiscovered/system-probe-lite
--- PASS: TestK8sTestSuite/TestNginxDiscovered/system-probe
```
Lint: `golangci-lint run ./test/new-e2e/tests/discovery/...` clean (0 issues).
### Additional Notes
A few quirks worth flagging for reviewers:
- **Forced DaemonSet rollout via pod annotation.** Toggling `datadog.systemProbe.enableOOMKill` between sub-tests only mutates the chart-rendered configmap; the chart's `daemonset.yaml` has no `checksum/system-probe-yaml` annotation tying the pod template to that configmap, so the existing pod stays alive across the change. The suite writes a `agents.podAnnotations.discovery-e2e-mode: "spl"/"sp"` that intentionally differs per sub-test to bump the pod-template hash and force a rollout.
- **Tracer metadata / language detection out of scope.** Nginx is C/native so `language` and `serviceDiscovery.tracerMetadata` aren't populated. The two natural ways to extend this — switch to (or add) an OTel-instrumented Go server (`apps-calendar-go` — no `K8sAppDefinition` yet) or a `dd-trace-go`-instrumented app (`apps-tracegen` predates the memfd-tracer-metadata feature in `dd-trace-go.v1`) — both require cross-repo work in `test-infra-definitions`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: vincent.whitchurch <[email protected]>
chouetz
pushed a commit
to DataDog/datadog-agent
that referenced
this pull request
May 13, 2026
### What does this PR do?
Adds a Kubernetes E2E sanity test for the Datadog Agent's discovery feature, mirroring (in spirit) the existing Linux VM suite in `test/new-e2e/tests/discovery/linux_test.go`. The new suite at `test/new-e2e/tests/discovery/k8s_test.go`:
- Provisions a Kind-on-EC2 cluster (`provkindvm`) with the agent installed via Helm and an `nginx` workload.
- Runs `TestNginxDiscovered` in two sub-tests covering both discovery modes:
- `system-probe-lite` — discovery enabled alone; the agent execs into `system-probe-lite` per `cmd/system-probe/subcommands/run/splite.go`.
- `system-probe` — adds `datadog.systemProbe.enableOOMKill: true` so the agent's `shouldExecSPLite` keeps the full binary running.
- Asserts on the matched nginx process: TCP port 80 listener, `ServiceDiscovery.GeneratedServiceName == {nginx, SOURCE_COMMAND_LINE}`, `ApmInstrumentation == false`, `InjectionState == NOT_INJECTED`, non-empty `ContainerId`.
- Pins the Helm chart version to `3.213.0`; the framework default (`3.155.1`) predates both the discovery template (chart 3.205.0, DataDog/helm-charts#2598) and the `latest`/`7` → `7.78.x` fallback fix (chart 3.213.0, DataDog/helm-charts#2643).
### Motivation
https://datadoghq.atlassian.net/browse/DSCVR-385
There is no k8s e2e for discovery today. DataDog/helm-charts#2634 fixed a bug in discovery on k8s related to the seccomp profile; the change went undetected before merge because nothing exercises the discovery flow on a Helm-installed agent. This suite closes that gap with a smoke-level check that the discovery payload reaches fakeintake in both modes.
The k8s suite is narrower than `linux_test.go` (single workload, smoke-level assertions), at least for now. This is to avoid having to add new app definitions at this point for a basic test. The VM suite continues to be the exhaustive per-language source of truth.
### Describe how you validated your changes
Ran locally against AWS twice with `E2E_DEV_MODE=true dda inv -- -e new-e2e-tests.run --targets ./tests/discovery --run TestK8sTestSuite --stack-name-suffix v2`:
```
--- PASS: TestK8sTestSuite (364.64s)
--- PASS: TestK8sTestSuite/TestNginxDiscovered (...)
--- PASS: TestK8sTestSuite/TestNginxDiscovered/system-probe-lite
--- PASS: TestK8sTestSuite/TestNginxDiscovered/system-probe
```
Lint: `golangci-lint run ./test/new-e2e/tests/discovery/...` clean (0 issues).
### Additional Notes
A few quirks worth flagging for reviewers:
- **Forced DaemonSet rollout via pod annotation.** Toggling `datadog.systemProbe.enableOOMKill` between sub-tests only mutates the chart-rendered configmap; the chart's `daemonset.yaml` has no `checksum/system-probe-yaml` annotation tying the pod template to that configmap, so the existing pod stays alive across the change. The suite writes a `agents.podAnnotations.discovery-e2e-mode: "spl"/"sp"` that intentionally differs per sub-test to bump the pod-template hash and force a rollout.
- **Tracer metadata / language detection out of scope.** Nginx is C/native so `language` and `serviceDiscovery.tracerMetadata` aren't populated. The two natural ways to extend this — switch to (or add) an OTel-instrumented Go server (`apps-calendar-go` — no `K8sAppDefinition` yet) or a `dd-trace-go`-instrumented app (`apps-tracegen` predates the memfd-tracer-metadata feature in `dd-trace-go.v1`) — both require cross-repo work in `test-infra-definitions`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: vincent.whitchurch <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
The
get-agent-versionhelper substitutes a concrete version for the single-component tagslatestand7so that the chart's version-gated logic has something to compare. The current substitute,7.67.0, is now stale: the actuallatestDatadog Agent image is well past that, and so is the default agent tag shipped by the chart itself (7.78.3). As a result, users who explicitly setagents.image.tag: latest(or"7") get worse behaviour out of the version-gated logic than users on the default tag, even though they are running the same or newer Agent in practice.This PR bumps the fallback to
7.78.3(matching the chart's current default tag, set in #2647) solatest/"7"are treated as a current Agent in every version-gated code path. Concretely this means:system-probe-lite) fortag: latest/"7", matching the default tag and other unparseable tags likemaster-py3that already cross the>= 7.78.0gate.< 7.74.0guard inshould-enable-data-planeno longer fails fortag: latest/"7", so users on those tags can enabledatadog.dataPlane.enabledwithout hitting the version check.-fips-fullimage guard: the< 7.78.0guard foragents.image.tagSuffix: -fips-fullno longer fails fortag: latest/"7".< 7.78.0guard on the standaloneddot-collectorFIPS image no longer fails fortag: latest/"7".DD_USE_DOGSTATSDtoggle for ADP: the^7.75.0-0compatibility branch now matches fortag: latest/"7", so the env var is emitted consistently with newer Agents.All of these match the behaviour users would get if they pinned to the chart's default tag (
7.78.3) instead of using the floating tag.Motivation
Keep the floating tags
latestand7in sync with what those tags actually point to (and with the chart's own default), so version-gated features (discovery, ADP, FIPS image variants) work the same on the floating tags as on the default tag.This is a behaviour change for users on
tag: latest/"7":datadog.discovery.enabledset, they will now get a system-probe container runningsystem-probe-lite.-fips-full, and standalone DDOT FIPS will now pass.Hence the minor version bump.
Release Note