[CWS] Enable Activity Dump v2 in newer agents#3151
Conversation
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a58f146074
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
|
||
| if apiutils.BoolValue(cwsConfig.SecurityProfiles.V2) { | ||
| if activityDumpV2Supported(ddaSpec) { | ||
| f.activityDumpV2 = true |
There was a problem hiding this comment.
When a user sets features.cws.securityProfiles.v2: true with an Agent tag >= 7.81.0, this branch only sets f.activityDumpV2. That field is never consumed in ManageNodeAgent to add DD_RUNTIME_SECURITY_CONFIG_ACTIVITY_DUMP_V2 to the generated DaemonSet, so Activity Dump v2 remains disabled despite the supported opt-in.
Useful? React with 👍 / 👎.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3151 +/- ##
==========================================
+ Coverage 43.79% 43.81% +0.02%
==========================================
Files 375 375
Lines 30575 30587 +12
==========================================
+ Hits 13390 13402 +12
Misses 16276 16276
Partials 909 909
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
2 participants
What does this PR do?
Gates CWS Activity Dump v2 behind Agent >= 7.81.0; logs a warning when requested on an unverifiable/older Agent instead of enabling it.
Motivation
v2 has no guard against unbounded memory allocation on older Agents, so enabling it there can OOM. Fail closed when the version can't be confirmed.
Additional Notes
Default deployments stay off until images.AgentLatestVersion is bumped to >= 7.81.0 (currently 7.80.1). Unparseable tags (digest-pinned/custom) also fail closed by design.
Minimum Agent Versions
Are there minimum versions of the Datadog Agent and/or Cluster Agent required?
Describe your test plan
Unit tests covers at/above/below min version, unparseable tag, and no-override cases.
Checklist
bug,enhancement,refactoring,documentation,tooling, and/ordependenciesqa/skip-qalabel