Skip to content

enable secret-backend (SGC) fips for windows #46226

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
s-alad wants to merge 1 commit into
base: main
Choose a base branch
from
Open

enable secret-backend (SGC) fips for windows #46226

s-alad wants to merge 1 commit into from
+3 −8

Conversation

@s-alad
Copy link
Member

@s-alad s-alad commented Feb 10, 2026

What does this PR do?

As the datadog-secret-backend (SGC) is now shipped inside the agent repo and fips is enabled, this TODO should be resolved

Motivation

enable FIPS support

Describe how you validated your changes

Additional Notes

@s-alad s-alad requested review from a team and dustmop February 10, 2026 22:34
@s-alad s-alad changed the title enable fips for windows enable secret-backend (SGC) fips for windows Feb 10, 2026
@s-alad s-alad marked this pull request as ready for review February 10, 2026 22:34
@s-alad s-alad requested review from a team as code owners February 10, 2026 22:34
@github-actions github-actions bot added the short review PR is simple enough to be reviewed quickly label Feb 10, 2026
@agent-platform-auto-pr
Copy link
Contributor

agent-platform-auto-pr bot commented Feb 10, 2026

Gitlab CI Configuration Changes

Modified Jobs

.docker_build_agent7_windows_common 
  .docker_build_agent7_windows_common:
    id_tokens:
      CI_IDENTITY_GITLAB_JWT:
        aud: https://vault.us1.ddbuild.io
    needs:
    - setup_agent_version
    - windows_msi_and_bosh_zip_x64-a7
    - build_windows_container_entrypoint
    retry: 2
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - $ECR_RELEASE_SUFFIX="$(If ($BUCKET_BRANCH -eq `"nightly`") { `"-nightly`" } elseif
      ($CI_COMMIT_TAG) { `"-release`" } else { `"`" })"
    - $TARGET_TAG="${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-win${VARIANT}${SERVERCORE}-amd64"
    - $BUILD_DATE = Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ"
    - $ErrorActionPreference = "Stop"
    - cp ${OMNIBUS_PACKAGE_DIR}/pipeline-${CI_PIPELINE_ID}/${AGENT_ZIP} ${BUILD_CONTEXT}/datadog-agent-latest.amd64.zip
    - cp entrypoint.exe ${BUILD_CONTEXT}/entrypoint.exe
    - pushd ${BUILD_CONTEXT}
    - '& ''C:\Program Files\7-Zip\7z.exe'' x .\datadog-agent-latest.amd64.zip -o"Datadog
      Agent"
  
      '
    - Remove-Item datadog-agent-latest.amd64.zip
    - mv "Datadog Agent\bin\agent\agent.exe" "Datadog Agent\bin\agent.exe" -Force
-   - if (Test-Path "Datadog Agent\bin\agent\secret-generic-connector.exe") { mv "Datadog
-     Agent\bin\agent\secret-generic-connector.exe" "Datadog Agent\bin\secret-generic-connector.exe"
+   - mv "Datadog Agent\bin\agent\secret-generic-connector.exe" "Datadog Agent\bin\secret-generic-connector.exe"
?   + +++++++++++
-     -Force }
?           --
+     -Force
    - popd
    - get-childitem ${BUILD_CONTEXT}
    - 'powershell -Command "$(Get-Location)\tools\ci\retry.ps1 docker build --no-cache
      --build-arg CI --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}
      ${BUILD_ARG} --pull --file ${BUILD_CONTEXT}/windows/amd64/Dockerfile --tag ${TARGET_TAG}
      --label ''org.opencontainers.image.created=${BUILD_DATE}'' --label ''org.opencontainers.image.version=${AGENT_VERSION}''
      --label ''org.opencontainers.image.revision=${CI_COMMIT_SHA}'' ${BUILD_CONTEXT}"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - powershell -Command "$(Get-Location)\tools\ci\retry.ps1 docker push ${TARGET_TAG}"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - docker rmi ${TARGET_TAG}
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: container_build
    timeout: 60m
    variables:
      AGENT_ZIP: datadog-agent-7*-x86_64.zip
      BUILD_ARG: --build-arg BASE_IMAGE=${SERVER_BASE_IMAGE} --build-arg BASE_IMAGE_OS='${OS_DISPLAY_NAME}'
        --build-arg WITH_JMX=${WITH_JMX} --build-arg VARIANT=${VARIANT} --build-arg
        INSTALL_INFO=${OS_TYPE}-${VARIANT}
      BUILD_CONTEXT: Dockerfiles/agent
      CI_IDENTITY_ROLE_NAME_OVERRIDE: windows-ci-tmp-gitlab-id-token-datadog-agent-all-refs
      IMAGE: registry.ddbuild.io/ci/datadog-agent/agent
      SERVERCORE: ''
.docker_build_agent_windows_common 
  .docker_build_agent_windows_common:
    id_tokens:
      CI_IDENTITY_GITLAB_JWT:
        aud: https://vault.us1.ddbuild.io
    script:
    - $ECR_RELEASE_SUFFIX="$(If ($BUCKET_BRANCH -eq `"nightly`") { `"-nightly`" } elseif
      ($CI_COMMIT_TAG) { `"-release`" } else { `"`" })"
    - $TARGET_TAG="${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-win${VARIANT}${SERVERCORE}-amd64"
    - $BUILD_DATE = Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ"
    - $ErrorActionPreference = "Stop"
    - cp ${OMNIBUS_PACKAGE_DIR}/pipeline-${CI_PIPELINE_ID}/${AGENT_ZIP} ${BUILD_CONTEXT}/datadog-agent-latest.amd64.zip
    - cp entrypoint.exe ${BUILD_CONTEXT}/entrypoint.exe
    - pushd ${BUILD_CONTEXT}
    - '& ''C:\Program Files\7-Zip\7z.exe'' x .\datadog-agent-latest.amd64.zip -o"Datadog
      Agent"
  
      '
    - Remove-Item datadog-agent-latest.amd64.zip
    - mv "Datadog Agent\bin\agent\agent.exe" "Datadog Agent\bin\agent.exe" -Force
-   - if (Test-Path "Datadog Agent\bin\agent\secret-generic-connector.exe") { mv "Datadog
-     Agent\bin\agent\secret-generic-connector.exe" "Datadog Agent\bin\secret-generic-connector.exe"
+   - mv "Datadog Agent\bin\agent\secret-generic-connector.exe" "Datadog Agent\bin\secret-generic-connector.exe"
?   + +++++++++++
-     -Force }
?           --
+     -Force
    - popd
    - get-childitem ${BUILD_CONTEXT}
    - 'powershell -Command "$(Get-Location)\tools\ci\retry.ps1 docker build --no-cache
      --build-arg CI --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}
      ${BUILD_ARG} --pull --file ${BUILD_CONTEXT}/windows/amd64/Dockerfile --tag ${TARGET_TAG}
      --label ''org.opencontainers.image.created=${BUILD_DATE}'' --label ''org.opencontainers.image.version=${AGENT_VERSION}''
      --label ''org.opencontainers.image.revision=${CI_COMMIT_SHA}'' ${BUILD_CONTEXT}"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - powershell -Command "$(Get-Location)\tools\ci\retry.ps1 docker push ${TARGET_TAG}"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - docker rmi ${TARGET_TAG}
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: container_build
    timeout: 60m
    variables:
      BUILD_CONTEXT: Dockerfiles/agent
      CI_IDENTITY_ROLE_NAME_OVERRIDE: windows-ci-tmp-gitlab-id-token-datadog-agent-all-refs
      IMAGE: registry.ddbuild.io/ci/datadog-agent/agent
.docker_build_fips_agent7_windows_common 
  .docker_build_fips_agent7_windows_common:
    id_tokens:
      CI_IDENTITY_GITLAB_JWT:
        aud: https://vault.us1.ddbuild.io
    needs:
    - windows_msi_and_bosh_zip_x64-a7-fips
    - build_windows_container_entrypoint
    retry: 2
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - $ECR_RELEASE_SUFFIX="$(If ($BUCKET_BRANCH -eq `"nightly`") { `"-nightly`" } elseif
      ($CI_COMMIT_TAG) { `"-release`" } else { `"`" })"
    - $TARGET_TAG="${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-win${VARIANT}${SERVERCORE}-amd64"
    - $BUILD_DATE = Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ"
    - $ErrorActionPreference = "Stop"
    - cp ${OMNIBUS_PACKAGE_DIR}/pipeline-${CI_PIPELINE_ID}/${AGENT_ZIP} ${BUILD_CONTEXT}/datadog-agent-latest.amd64.zip
    - cp entrypoint.exe ${BUILD_CONTEXT}/entrypoint.exe
    - pushd ${BUILD_CONTEXT}
    - '& ''C:\Program Files\7-Zip\7z.exe'' x .\datadog-agent-latest.amd64.zip -o"Datadog
      Agent"
  
      '
    - Remove-Item datadog-agent-latest.amd64.zip
    - mv "Datadog Agent\bin\agent\agent.exe" "Datadog Agent\bin\agent.exe" -Force
-   - if (Test-Path "Datadog Agent\bin\agent\secret-generic-connector.exe") { mv "Datadog
-     Agent\bin\agent\secret-generic-connector.exe" "Datadog Agent\bin\secret-generic-connector.exe"
+   - mv "Datadog Agent\bin\agent\secret-generic-connector.exe" "Datadog Agent\bin\secret-generic-connector.exe"
?   + +++++++++++
-     -Force }
?           --
+     -Force
    - popd
    - get-childitem ${BUILD_CONTEXT}
    - 'powershell -Command "$(Get-Location)\tools\ci\retry.ps1 docker build --no-cache
      --build-arg CI --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}
      ${BUILD_ARG} --pull --file ${BUILD_CONTEXT}/windows/amd64/Dockerfile --tag ${TARGET_TAG}
      --label ''org.opencontainers.image.created=${BUILD_DATE}'' --label ''org.opencontainers.image.version=${AGENT_VERSION}''
      --label ''org.opencontainers.image.revision=${CI_COMMIT_SHA}'' ${BUILD_CONTEXT}"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - powershell -Command "$(Get-Location)\tools\ci\retry.ps1 docker push ${TARGET_TAG}"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - docker rmi ${TARGET_TAG}
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: container_build
    timeout: 60m
    variables:
      AGENT_ZIP: datadog-fips-agent-7*-x86_64.zip
      BUILD_ARG: --build-arg BASE_IMAGE=${SERVER_BASE_IMAGE} --build-arg BASE_IMAGE_OS='${OS_DISPLAY_NAME}'
        --build-arg WITH_JMX=${WITH_JMX} --build-arg WITH_FIPS=true --build-arg VARIANT=${VARIANT}
        --build-arg INSTALL_INFO=${OS_TYPE}-${VARIANT}-fips
      BUILD_CONTEXT: Dockerfiles/agent
      CI_IDENTITY_ROLE_NAME_OVERRIDE: windows-ci-tmp-gitlab-id-token-datadog-agent-all-refs
      IMAGE: registry.ddbuild.io/ci/datadog-agent/agent
      SERVERCORE: ''
docker_build_agent7_windows 
  docker_build_agent7_windows:
    id_tokens:
      CI_IDENTITY_GITLAB_JWT:
        aud: https://vault.us1.ddbuild.io
    needs:
    - setup_agent_version
    - windows_msi_and_bosh_zip_x64-a7
    - build_windows_container_entrypoint
    parallel:
      matrix:
      - OS_DISPLAY_NAME: windows nanoserver
        OS_TYPE: nano
        SERVER_BASE_IMAGE: mcr.microsoft.com/powershell:lts-nanoserver-1809
        TAG_SUFFIX: '-7'
        VARIANT: '1809'
        WINDOWS_RUNNER: windows-v2:2019
        WITH_JMX: 'false'
      - OS_DISPLAY_NAME: windows nanoserver
        OS_TYPE: nano
        SERVER_BASE_IMAGE: mcr.microsoft.com/powershell:lts-nanoserver-1809
        TAG_SUFFIX: -7-jmx
        VARIANT: '1809'
        WINDOWS_RUNNER: windows-v2:2019
        WITH_JMX: 'true'
      - OS_DISPLAY_NAME: windows nanoserver
        OS_TYPE: nano
        SERVER_BASE_IMAGE: mcr.microsoft.com/dotnet/sdk:9.0-nanoserver-ltsc2022
        TAG_SUFFIX: '-7'
        VARIANT: ltsc2022
        WINDOWS_RUNNER: windows-v2:2022
        WITH_JMX: 'false'
      - OS_DISPLAY_NAME: windows nanoserver
        OS_TYPE: nano
        SERVER_BASE_IMAGE: mcr.microsoft.com/dotnet/sdk:9.0-nanoserver-ltsc2022
        TAG_SUFFIX: -7-jmx
        VARIANT: ltsc2022
        WINDOWS_RUNNER: windows-v2:2022
        WITH_JMX: 'true'
      - OS_DISPLAY_NAME: windows nanoserver
        OS_TYPE: nano
        SERVER_BASE_IMAGE: mcr.microsoft.com/dotnet/sdk:9.0-nanoserver-ltsc2025
        TAG_SUFFIX: '-7'
        VARIANT: ltsc2025
        WINDOWS_RUNNER: windows-v2:2025
        WITH_JMX: 'false'
      - OS_DISPLAY_NAME: windows nanoserver
        OS_TYPE: nano
        SERVER_BASE_IMAGE: mcr.microsoft.com/dotnet/sdk:9.0-nanoserver-ltsc2025
        TAG_SUFFIX: -7-jmx
        VARIANT: ltsc2025
        WINDOWS_RUNNER: windows-v2:2025
        WITH_JMX: 'true'
      - OS_DISPLAY_NAME: windows server core
        OS_TYPE: core
        SERVERCORE: -servercore
        SERVER_BASE_IMAGE: mcr.microsoft.com/powershell:windowsservercore-1809
        TAG_SUFFIX: '-7'
        VARIANT: '1809'
        WINDOWS_RUNNER: windows-v2:2019
        WITH_JMX: 'false'
      - OS_DISPLAY_NAME: windows server core
        OS_TYPE: core
        SERVERCORE: -servercore
        SERVER_BASE_IMAGE: mcr.microsoft.com/powershell:windowsservercore-1809
        TAG_SUFFIX: -7-jmx
        VARIANT: '1809'
        WINDOWS_RUNNER: windows-v2:2019
        WITH_JMX: 'true'
      - OS_DISPLAY_NAME: windows server core
        OS_TYPE: core
        SERVERCORE: -servercore
        SERVER_BASE_IMAGE: mcr.microsoft.com/dotnet/sdk:9.0-windowsservercore-ltsc2022
        TAG_SUFFIX: '-7'
        VARIANT: ltsc2022
        WINDOWS_RUNNER: windows-v2:2022
        WITH_JMX: 'false'
      - OS_DISPLAY_NAME: windows server core
        OS_TYPE: core
        SERVERCORE: -servercore
        SERVER_BASE_IMAGE: mcr.microsoft.com/dotnet/sdk:9.0-windowsservercore-ltsc2022
        TAG_SUFFIX: -7-jmx
        VARIANT: ltsc2022
        WINDOWS_RUNNER: windows-v2:2022
        WITH_JMX: 'true'
      - OS_DISPLAY_NAME: windows server core
        OS_TYPE: core
        SERVERCORE: -servercore
        SERVER_BASE_IMAGE: mcr.microsoft.com/dotnet/sdk:9.0-windowsservercore-ltsc2025
        TAG_SUFFIX: '-7'
        VARIANT: ltsc2025
        WINDOWS_RUNNER: windows-v2:2025
        WITH_JMX: 'false'
      - OS_DISPLAY_NAME: windows server core
        OS_TYPE: core
        SERVERCORE: -servercore
        SERVER_BASE_IMAGE: mcr.microsoft.com/dotnet/sdk:9.0-windowsservercore-ltsc2025
        TAG_SUFFIX: -7-jmx
        VARIANT: ltsc2025
        WINDOWS_RUNNER: windows-v2:2025
        WITH_JMX: 'true'
    retry: 2
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - $ECR_RELEASE_SUFFIX="$(If ($BUCKET_BRANCH -eq `"nightly`") { `"-nightly`" } elseif
      ($CI_COMMIT_TAG) { `"-release`" } else { `"`" })"
    - $TARGET_TAG="${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-win${VARIANT}${SERVERCORE}-amd64"
    - $BUILD_DATE = Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ"
    - $ErrorActionPreference = "Stop"
    - cp ${OMNIBUS_PACKAGE_DIR}/pipeline-${CI_PIPELINE_ID}/${AGENT_ZIP} ${BUILD_CONTEXT}/datadog-agent-latest.amd64.zip
    - cp entrypoint.exe ${BUILD_CONTEXT}/entrypoint.exe
    - pushd ${BUILD_CONTEXT}
    - '& ''C:\Program Files\7-Zip\7z.exe'' x .\datadog-agent-latest.amd64.zip -o"Datadog
      Agent"
  
      '
    - Remove-Item datadog-agent-latest.amd64.zip
    - mv "Datadog Agent\bin\agent\agent.exe" "Datadog Agent\bin\agent.exe" -Force
-   - if (Test-Path "Datadog Agent\bin\agent\secret-generic-connector.exe") { mv "Datadog
-     Agent\bin\agent\secret-generic-connector.exe" "Datadog Agent\bin\secret-generic-connector.exe"
+   - mv "Datadog Agent\bin\agent\secret-generic-connector.exe" "Datadog Agent\bin\secret-generic-connector.exe"
?   + +++++++++++
-     -Force }
?           --
+     -Force
    - popd
    - get-childitem ${BUILD_CONTEXT}
    - 'powershell -Command "$(Get-Location)\tools\ci\retry.ps1 docker build --no-cache
      --build-arg CI --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}
      ${BUILD_ARG} --pull --file ${BUILD_CONTEXT}/windows/amd64/Dockerfile --tag ${TARGET_TAG}
      --label ''org.opencontainers.image.created=${BUILD_DATE}'' --label ''org.opencontainers.image.version=${AGENT_VERSION}''
      --label ''org.opencontainers.image.revision=${CI_COMMIT_SHA}'' ${BUILD_CONTEXT}"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - powershell -Command "$(Get-Location)\tools\ci\retry.ps1 docker push ${TARGET_TAG}"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - docker rmi ${TARGET_TAG}
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: container_build
    tags:
    - $WINDOWS_RUNNER
    timeout: 60m
    variables:
      AGENT_ZIP: datadog-agent-7*-x86_64.zip
      BUILD_ARG: --build-arg BASE_IMAGE=${SERVER_BASE_IMAGE} --build-arg BASE_IMAGE_OS='${OS_DISPLAY_NAME}'
        --build-arg WITH_JMX=${WITH_JMX} --build-arg VARIANT=${VARIANT} --build-arg
        INSTALL_INFO=${OS_TYPE}-${VARIANT}
      BUILD_CONTEXT: Dockerfiles/agent
      CI_IDENTITY_ROLE_NAME_OVERRIDE: windows-ci-tmp-gitlab-id-token-datadog-agent-all-refs
      IMAGE: registry.ddbuild.io/ci/datadog-agent/agent
      OVERRIDE_GIT_STRATEGY: clone
      SERVERCORE: ''
docker_build_fips_agent7_windows 
  docker_build_fips_agent7_windows:
    id_tokens:
      CI_IDENTITY_GITLAB_JWT:
        aud: https://vault.us1.ddbuild.io
    needs:
    - windows_msi_and_bosh_zip_x64-a7-fips
    - build_windows_container_entrypoint
    parallel:
      matrix:
      - OS_DISPLAY_NAME: windows server core
        OS_TYPE: core
        SERVERCORE: -servercore
        SERVER_BASE_IMAGE: mcr.microsoft.com/dotnet/sdk:9.0-windowsservercore-ltsc2022
        TAG_SUFFIX: -7-fips
        VARIANT: ltsc2022
        WINDOWS_RUNNER: windows-v2:2022
        WITH_JMX: 'false'
      - OS_DISPLAY_NAME: windows server core
        OS_TYPE: core
        SERVERCORE: -servercore
        SERVER_BASE_IMAGE: mcr.microsoft.com/dotnet/sdk:9.0-windowsservercore-ltsc2022
        TAG_SUFFIX: -7-fips-jmx
        VARIANT: ltsc2022
        WINDOWS_RUNNER: windows-v2:2022
        WITH_JMX: 'true'
    retry: 2
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - $ECR_RELEASE_SUFFIX="$(If ($BUCKET_BRANCH -eq `"nightly`") { `"-nightly`" } elseif
      ($CI_COMMIT_TAG) { `"-release`" } else { `"`" })"
    - $TARGET_TAG="${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-win${VARIANT}${SERVERCORE}-amd64"
    - $BUILD_DATE = Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ"
    - $ErrorActionPreference = "Stop"
    - cp ${OMNIBUS_PACKAGE_DIR}/pipeline-${CI_PIPELINE_ID}/${AGENT_ZIP} ${BUILD_CONTEXT}/datadog-agent-latest.amd64.zip
    - cp entrypoint.exe ${BUILD_CONTEXT}/entrypoint.exe
    - pushd ${BUILD_CONTEXT}
    - '& ''C:\Program Files\7-Zip\7z.exe'' x .\datadog-agent-latest.amd64.zip -o"Datadog
      Agent"
  
      '
    - Remove-Item datadog-agent-latest.amd64.zip
    - mv "Datadog Agent\bin\agent\agent.exe" "Datadog Agent\bin\agent.exe" -Force
-   - if (Test-Path "Datadog Agent\bin\agent\secret-generic-connector.exe") { mv "Datadog
-     Agent\bin\agent\secret-generic-connector.exe" "Datadog Agent\bin\secret-generic-connector.exe"
+   - mv "Datadog Agent\bin\agent\secret-generic-connector.exe" "Datadog Agent\bin\secret-generic-connector.exe"
?   + +++++++++++
-     -Force }
?           --
+     -Force
    - popd
    - get-childitem ${BUILD_CONTEXT}
    - 'powershell -Command "$(Get-Location)\tools\ci\retry.ps1 docker build --no-cache
      --build-arg CI --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}
      ${BUILD_ARG} --pull --file ${BUILD_CONTEXT}/windows/amd64/Dockerfile --tag ${TARGET_TAG}
      --label ''org.opencontainers.image.created=${BUILD_DATE}'' --label ''org.opencontainers.image.version=${AGENT_VERSION}''
      --label ''org.opencontainers.image.revision=${CI_COMMIT_SHA}'' ${BUILD_CONTEXT}"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - powershell -Command "$(Get-Location)\tools\ci\retry.ps1 docker push ${TARGET_TAG}"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - docker rmi ${TARGET_TAG}
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: container_build
    tags:
    - $WINDOWS_RUNNER
    timeout: 60m
    variables:
      AGENT_ZIP: datadog-fips-agent-7*-x86_64.zip
      BUILD_ARG: --build-arg BASE_IMAGE=${SERVER_BASE_IMAGE} --build-arg BASE_IMAGE_OS='${OS_DISPLAY_NAME}'
        --build-arg WITH_JMX=${WITH_JMX} --build-arg WITH_FIPS=true --build-arg VARIANT=${VARIANT}
        --build-arg INSTALL_INFO=${OS_TYPE}-${VARIANT}-fips
      BUILD_CONTEXT: Dockerfiles/agent
      CI_IDENTITY_ROLE_NAME_OVERRIDE: windows-ci-tmp-gitlab-id-token-datadog-agent-all-refs
      IMAGE: registry.ddbuild.io/ci/datadog-agent/agent
      OVERRIDE_GIT_STRATEGY: clone
      SERVERCORE: ''

Changes Summary

Removed Modified Added Renamed
0 5 0 0

ℹ️ Diff available in the job log.

@cit-pr-commenter-54b7da
Copy link

cit-pr-commenter-54b7da bot commented Feb 10, 2026

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 04b87198-2cfe-4eaf-af3b-49e2ebf5ff57

Baseline: 0134072
Comparison: b4ae9ef
Diff

❌ Experiments with retried target crashes

This is a critical error. One or more replicates failed with a non-zero exit code. These replicates may have been retried. See Replicate Execution Details for more information.

  • quality_gate_idle_all_features

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Regressions in experiments with settings containing erratic: true are ignored.

perf experiment goal Δ mean % Δ mean % CI trials links
➖ docker_containers_cpu % cpu utilization -2.78 [-5.87, +0.31] 1 Logs

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
➖ docker_containers_memory memory utilization +0.48 [+0.41, +0.55] 1 Logs
➖ quality_gate_metrics_logs memory utilization +0.46 [+0.25, +0.68] 1 Logs bounds checks dashboard
➖ uds_dogstatsd_20mb_12k_contexts_20_senders memory utilization +0.36 [+0.31, +0.41] 1 Logs
➖ ddot_metrics_sum_cumulative memory utilization +0.29 [+0.13, +0.46] 1 Logs
➖ file_tree memory utilization +0.19 [+0.14, +0.24] 1 Logs
➖ quality_gate_idle_all_features memory utilization +0.16 [+0.12, +0.20] 1 Logs bounds checks dashboard
➖ ddot_metrics memory utilization +0.11 [-0.12, +0.34] 1 Logs
➖ file_to_blackhole_0ms_latency egress throughput +0.02 [-0.47, +0.51] 1 Logs
➖ file_to_blackhole_100ms_latency egress throughput +0.02 [-0.03, +0.06] 1 Logs
➖ file_to_blackhole_1000ms_latency egress throughput +0.01 [-0.41, +0.43] 1 Logs
➖ uds_dogstatsd_to_api_v3 ingress throughput +0.01 [-0.12, +0.14] 1 Logs
➖ uds_dogstatsd_to_api ingress throughput -0.00 [-0.14, +0.13] 1 Logs
➖ tcp_dd_logs_filter_exclude ingress throughput -0.01 [-0.10, +0.09] 1 Logs
➖ ddot_metrics_sum_cumulativetodelta_exporter memory utilization -0.02 [-0.25, +0.21] 1 Logs
➖ ddot_logs memory utilization -0.05 [-0.11, +0.02] 1 Logs
➖ file_to_blackhole_500ms_latency egress throughput -0.05 [-0.43, +0.34] 1 Logs
➖ quality_gate_idle memory utilization -0.19 [-0.23, -0.15] 1 Logs bounds checks dashboard
➖ otlp_ingest_metrics memory utilization -0.26 [-0.42, -0.10] 1 Logs
➖ otlp_ingest_logs memory utilization -0.48 [-0.56, -0.39] 1 Logs
➖ ddot_metrics_sum_delta memory utilization -0.65 [-0.83, -0.47] 1 Logs
➖ quality_gate_logs % cpu utilization -1.34 [-2.84, +0.16] 1 Logs bounds checks dashboard
➖ tcp_syslog_to_blackhole ingress throughput -2.06 [-2.14, -1.97] 1 Logs
➖ docker_containers_cpu % cpu utilization -2.78 [-5.87, +0.31] 1 Logs

Bounds Checks: ✅ Passed

perf experiment bounds_check_name replicates_passed links
✅ docker_containers_cpu simple_check_run 10/10
✅ docker_containers_memory memory_usage 10/10
✅ docker_containers_memory simple_check_run 10/10
✅ file_to_blackhole_0ms_latency lost_bytes 10/10
✅ file_to_blackhole_0ms_latency memory_usage 10/10
✅ file_to_blackhole_1000ms_latency lost_bytes 10/10
✅ file_to_blackhole_1000ms_latency memory_usage 10/10
✅ file_to_blackhole_100ms_latency lost_bytes 10/10
✅ file_to_blackhole_100ms_latency memory_usage 10/10
✅ file_to_blackhole_500ms_latency lost_bytes 10/10
✅ file_to_blackhole_500ms_latency memory_usage 10/10
✅ quality_gate_idle intake_connections 10/10 bounds checks dashboard
✅ quality_gate_idle memory_usage 10/10 bounds checks dashboard
✅ quality_gate_idle_all_features intake_connections 10/10 bounds checks dashboard
✅ quality_gate_idle_all_features memory_usage 10/10 bounds checks dashboard
✅ quality_gate_logs intake_connections 10/10 bounds checks dashboard
✅ quality_gate_logs lost_bytes 10/10 bounds checks dashboard
✅ quality_gate_logs memory_usage 10/10 bounds checks dashboard
✅ quality_gate_metrics_logs cpu_usage 10/10 bounds checks dashboard
✅ quality_gate_metrics_logs intake_connections 10/10 bounds checks dashboard
✅ quality_gate_metrics_logs lost_bytes 10/10 bounds checks dashboard
✅ quality_gate_metrics_logs memory_usage 10/10 bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

Replicate Execution Details

We run multiple replicates for each experiment/variant. However, we allow replicates to be automatically retried if there are any failures, up to 8 times, at which point the replicate is marked dead and we are unable to run analysis for the entire experiment. We call each of these attempts at running replicates a replicate execution. This section lists all replicate executions that failed due to the target crashing or being oom killed.

Note: In the below tables we bucket failures by experiment, variant, and failure type. For each of these buckets we list out the replicate indexes that failed with an annotation signifying how many times said replicate failed with the given failure mode. In the below example the baseline variant of the experiment named experiment_with_failures had two replicates that failed by oom kills. Replicate 0, which failed 8 executions, and replicate 1 which failed 6 executions, all with the same failure mode.

Experiment Variant Replicates Failure Logs Debug Dashboard
experiment_with_failures baseline 0 (x8) 1 (x6) Oom killed Debug Dashboard

The debug dashboard links will take you to a debugging dashboard specifically designed to investigate replicate execution failures.

❌ Retried Normal Replicate Execution Failures (non-profiling)

Experiment Variant Replicates Failure Debug Dashboard
quality_gate_idle_all_features baseline 8 Crashed (exit code: 0) Debug Dashboard

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

  • quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.

clarkb7
clarkb7 approved these changes Feb 11, 2026
View reviewed changes
omnibus/config/projects/agent.rb
Comment on lines 323 to +326
"#{install_dir}\\datadog-installer.exe"
]

if not fips_mode?
# TODO(AGENTCFG-XXX): SGC is not supported in FIPS mode
GO_BINARIES << "#{install_dir}\\bin\\agent\\secret-generic-connector.exe"
end
GO_BINARIES << "#{install_dir}\\bin\\agent\\secret-generic-connector.exe"
Copy link
Contributor

@clarkb7 clarkb7 Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: could just add to the static list definition now

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@clarkb7 clarkb7 clarkb7 approved these changes

@dustmop dustmop Awaiting requested review from dustmop dustmop was automatically assigned from DataDog/agent-configuration

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

internal Identify a non-fork PR short review PR is simple enough to be reviewed quickly team/agent-build team/windows-products

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@s-alad @clarkb7