Skip to content

Run SSI e2e tests on openshift#47637

Draft
iamluc wants to merge 4 commits intomainfrom
luc/e2e-ssi-openshift
Draft

Run SSI e2e tests on openshift#47637
iamluc wants to merge 4 commits intomainfrom
luc/e2e-ssi-openshift

Conversation

@iamluc
Copy link
Contributor

@iamluc iamluc commented Mar 10, 2026

What does this PR do?

Run SSI e2e tests on openshift

Motivation

https://datadoghq.atlassian.net/browse/INPLAT-917

Testing on OpenShift provides confidence that the admission controller injection works correctl.

Describe how you validated your changes

New OpenShift CI jobs are passing

Additional Notes

@agent-platform-auto-pr
Copy link
Contributor

agent-platform-auto-pr bot commented Mar 10, 2026 •
edited
Loading

Gitlab CI Configuration Changes

Added Jobs

new-e2e-ssi-openshift 
new-e2e-ssi-openshift:
  after_script:
  - CODECOV_TOKEN=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $CODECOV token) || exit
    $?; export CODECOV_TOKEN
  - $CI_PROJECT_DIR/tools/ci/junit_upload.sh "junit-${CI_JOB_ID}.tgz" "$E2E_RESULT_JSON"
  - "if [ -d \"$E2E_COVERAGE_OUT_DIR\" ]; then\n  dda inv -- -e coverage.process-e2e-coverage-folders\
    \ $E2E_COVERAGE_OUT_DIR\n  dda inv -- -e dyntest.compute-and-upload-job-index\
    \ --bucket-uri $S3_PERMANENT_ARTIFACTS_URI --coverage-folder $E2E_COVERAGE_OUT_DIR\
    \ --commit-sha $CI_COMMIT_SHA --job-id $CI_JOB_ID\nfi\n"
  artifacts:
    expire_in: 2 weeks
    paths:
    - $E2E_OUTPUT_DIR
    - $E2E_RESULT_JSON
    - junit-*.tgz
    - $E2E_COVERAGE_OUT_DIR
    reports:
      annotations:
      - $EXTERNAL_LINKS_PATH
    when: always
  before_script:
  - mkdir -p $GOPATH/pkg/mod/cache && tar xJf modcache_e2e.tar.xz -C $GOPATH/pkg/mod/cache
  - rm -f modcache_e2e.tar.xz
  - mkdir -p ~/.pulumi && tar xJf pulumi_plugins.tar.xz -C ~/.pulumi
  - rm -f pulumi_plugins.tar.xz
  - mkdir -p $GOPATH/bin $GOPATH/pkg/mod/cache && tar xJf modcache_tools.tar.xz -C
    $GOPATH
  - rm -f modcache_tools.tar.xz
  - export PATH=$PATH:$GOPATH/bin
  - mkdir -p ~/.aws
  - "if [ -n \"$E2E_USE_AWS_PROFILE\" ]; then\n  echo Using agent-qa-ci aws profile\n\
    \  $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config\
    \ || exit $?\n  # Now all `aws` commands target the agent-qa profile\n  export\
    \ AWS_PROFILE=agent-qa-ci\nelse\n  # Assume role to fetch only once credentials\
    \ and avoid rate limits\n  echo Assuming ddbuild-agent-ci role\n  roleoutput=\"\
    $(aws sts assume-role --role-arn arn:aws:iam::669783387624:role/ddbuild-agent-ci\
    \ --external-id ddbuild-agent-ci --role-session-name RoleSession)\"\n  export\
    \ AWS_ACCESS_KEY_ID=\"$(echo \"$roleoutput\" | jq -r '.Credentials.AccessKeyId')\"\
    \n  export AWS_SECRET_ACCESS_KEY=\"$(echo \"$roleoutput\" | jq -r '.Credentials.SecretAccessKey')\"\
    \n  export AWS_SESSION_TOKEN=\"$(echo \"$roleoutput\" | jq -r '.Credentials.SessionToken')\"\
    \nfi\n"
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AWS_PUBLIC_KEY_PATH
    || exit $?
  - touch $E2E_AWS_PRIVATE_KEY_PATH && chmod 600 $E2E_AWS_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
    $AGENT_QA_E2E ssh_key_rsa > $E2E_AWS_PRIVATE_KEY_PATH || exit $?
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AZURE_PUBLIC_KEY_PATH
    || exit $?
  - touch $E2E_AZURE_PRIVATE_KEY_PATH && chmod 600 $E2E_AZURE_PRIVATE_KEY_PATH &&
    $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key_rsa > $E2E_AZURE_PRIVATE_KEY_PATH
    || exit $?
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_GCP_PUBLIC_KEY_PATH
    || exit $?
  - touch $E2E_GCP_PRIVATE_KEY_PATH && chmod 600 $E2E_GCP_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
    $AGENT_QA_E2E ssh_key_rsa > $E2E_GCP_PRIVATE_KEY_PATH || exit $?
  - pulumi login "s3://dd-pulumi-state?region=us-east-1&awssdk=v2&profile=$AWS_PROFILE"
  - ARM_CLIENT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE client_id)
    || exit $?; export ARM_CLIENT_ID
  - ARM_CLIENT_SECRET=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE token)
    || exit $?; export ARM_CLIENT_SECRET
  - ARM_TENANT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE tenant_id)
    || exit $?; export ARM_TENANT_ID
  - ARM_SUBSCRIPTION_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE subscription_id)
    || exit $?; export ARM_SUBSCRIPTION_ID
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_json > ~/gcp-credentials.json
    || exit $?
  - export GOOGLE_APPLICATION_CREDENTIALS=~/gcp-credentials.json
  - 'gcp_acr_key=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_acr_readonly)
    || exit $?

    export E2E_GCP_IMAGE_PULL_PASSWORD="b64=$(printf ''%s'' "$gcp_acr_key" | base64
    -w 0)"

    '
  - dda inv -- -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
  - export DD_ENV=nativetest
  - export DD_CIVISIBILITY_ENABLED=true
  - export DD_CIVISIBILITY_AGENTLESS_ENABLED=true
  - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
    || exit $?; export DD_API_KEY
  - export WINDOWS_DDNPM_DRIVER=${WINDOWS_DDNPM_DRIVER:-$(dda inv release.get-release-json-value
    "dependencies::WINDOWS_DDNPM_DRIVER" --no-worktree)}
  - export WINDOWS_DDPROCMON_DRIVER=${WINDOWS_DDPROCMON_DRIVER:-$(dda inv release.get-release-json-value
    "dependencies::WINDOWS_DDPROCMON_DRIVER" --no-worktree)}
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $CRC_PULL_SECRET > /tmp/crc-pull-secret.json
    || exit $?
  image: registry.ddbuild.io/ci/datadog-agent-buildimages/linux$CI_IMAGE_LINUX_SUFFIX:$CI_IMAGE_LINUX
  needs:
  - go_e2e_deps
  - go_e2e_test_binaries
  - go_tools_deps
  - job: new-e2e-base-coverage
    optional: true
  - qa_dca
  - qa_agent_linux
  - new-e2e-ssi-openshift-init
  rules:
  - if: $RUN_E2E_TESTS == "off"
    when: never
  - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
    when: never
  - if: $RUN_E2E_TESTS == "on"
    when: on_success
  - if: $CI_COMMIT_BRANCH == "main"
    when: on_success
  - if: $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
    when: on_success
  - if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
    when: on_success
  - changes:
      compare_to: $COMPARE_TO_BRANCH
      paths:
      - .gitlab/test/e2e/e2e.yml
      - test/e2e-framework/**/*
      - test/new-e2e/go.mod
      - go.mod
      - flakes.yaml
      - release.json
  - changes:
      compare_to: $COMPARE_TO_BRANCH
      paths:
      - test/new-e2e/tests/ssi/**/*
  - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
    when: never
  - allow_failure: true
    when: manual
  script:
  - export IS_DEV_BRANCH="$(dda inv -- -e pipeline.is-dev-branch)"
  - DYNAMIC_TESTS_BREAKGLASS=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $DYNAMIC_TESTS_BREAKGLASS
    value) || exit $?; export DYNAMIC_TESTS_BREAKGLASS
  - "if [ \"$DYNAMIC_TESTS_BREAKGLASS\" == \"true\" ] || [ \"$IS_DEV_BRANCH\" == \"\
    false\" ] || [ \"$RUN_E2E_TESTS\" == \"on\" ]; then\n  export DYNAMIC_TESTS_FLAG=\"\
    \"\nfi\n"
  - dda inv -- -e new-e2e-tests.run $DYNAMIC_TESTS_FLAG $PRE_BUILT_BINARIES_FLAG $MAX_RETRIES_FLAG
    --local-package $CI_PROJECT_DIR/$OMNIBUS_BASE_DIR --result-json $E2E_RESULT_JSON
    --targets $TARGETS -c ddagent:imagePullRegistry=669783387624.dkr.ecr.us-east-1.amazonaws.com,us-central1-docker.pkg.dev
    -c ddagent:imagePullUsername=AWS,_json_key -c ddagent:imagePullPassword=$(aws
    ecr get-login-password),$E2E_GCP_IMAGE_PULL_PASSWORD --junit-tar junit-${CI_JOB_ID}.tgz
    ${EXTRA_PARAMS} --test-washer --logs-folder=$E2E_OUTPUT_DIR/logs --logs-post-processing
    --logs-post-processing-test-depth=$E2E_LOGS_PROCESSING_TEST_DEPTH
  stage: e2e
  tags:
  - arch:amd64
  - specific:true
  variables:
    DYNAMIC_TESTS_FLAG: --impacted
    E2E_AWS_PRIVATE_KEY_PATH: /tmp/agent-qa-aws-ssh-key
    E2E_AWS_PUBLIC_KEY_PATH: /tmp/agent-qa-aws-ssh-key.pub
    E2E_AZURE_PRIVATE_KEY_PATH: /tmp/agent-qa-azure-ssh-key
    E2E_AZURE_PUBLIC_KEY_PATH: /tmp/agent-qa-azure-ssh-key.pub
    E2E_COMMIT_SHA: $CI_COMMIT_SHORT_SHA
    E2E_COVERAGE_OUT_DIR: $CI_PROJECT_DIR/coverage
    E2E_GCP_PRIVATE_KEY_PATH: /tmp/agent-qa-gcp-ssh-key
    E2E_GCP_PUBLIC_KEY_PATH: /tmp/agent-qa-gcp-ssh-key.pub
    E2E_KEY_PAIR_NAME: datadog-agent-ci-rsa
    E2E_LOGS_PROCESSING_TEST_DEPTH: 1
    E2E_OUTPUT_DIR: $CI_PROJECT_DIR/e2e-output
    E2E_PIPELINE_ID: $CI_PIPELINE_ID
    E2E_PRE_INITIALIZED: 'true'
    E2E_PROVISIONER: openshift
    E2E_RESULT_JSON: $CI_PROJECT_DIR/e2e_test_output.json
    E2E_SKIP_WINDOWS: $SKIP_WINDOWS
    E2E_STACK_NAME_SUFFIX: openshift
    E2E_USE_AWS_PROFILE: 'true'
    EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
    EXTRA_PARAMS: -c ddinfra:gcp/openshift/pullSecretPath=/tmp/crc-pull-secret.json
    FLAKY_PATTERNS_CONFIG: $CI_PROJECT_DIR/flaky-patterns-runtime.yaml
    GIT_STRATEGY: clone
    KUBERNETES_CPU_REQUEST: 6
    KUBERNETES_MEMORY_LIMIT: 16Gi
    KUBERNETES_MEMORY_REQUEST: 12Gi
    MAX_RETRIES_FLAG: ''
    PRE_BUILT_BINARIES_FLAG: --use-prebuilt-binaries
    REMOTE_STACK_CLEANING: 'true'
    SHOULD_RUN_IN_FLAKES_FINDER: 'true'
    TARGETS: ./tests/ssi
    TEAM: injection-platform
new-e2e-ssi-openshift-init 
new-e2e-ssi-openshift-init:
  after_script:
  - CODECOV_TOKEN=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $CODECOV token) || exit
    $?; export CODECOV_TOKEN
  - $CI_PROJECT_DIR/tools/ci/junit_upload.sh "junit-${CI_JOB_ID}.tgz" "$E2E_RESULT_JSON"
  - "if [ -d \"$E2E_COVERAGE_OUT_DIR\" ]; then\n  dda inv -- -e coverage.process-e2e-coverage-folders\
    \ $E2E_COVERAGE_OUT_DIR\n  dda inv -- -e dyntest.compute-and-upload-job-index\
    \ --bucket-uri $S3_PERMANENT_ARTIFACTS_URI --coverage-folder $E2E_COVERAGE_OUT_DIR\
    \ --commit-sha $CI_COMMIT_SHA --job-id $CI_JOB_ID\nfi\n"
  allow_failure: true
  artifacts:
    expire_in: 2 weeks
    paths:
    - $E2E_OUTPUT_DIR
    - $E2E_RESULT_JSON
    - junit-*.tgz
    - $E2E_COVERAGE_OUT_DIR
    reports:
      annotations:
      - $EXTERNAL_LINKS_PATH
    when: always
  before_script:
  - mkdir -p $GOPATH/pkg/mod/cache && tar xJf modcache_e2e.tar.xz -C $GOPATH/pkg/mod/cache
  - rm -f modcache_e2e.tar.xz
  - mkdir -p ~/.pulumi && tar xJf pulumi_plugins.tar.xz -C ~/.pulumi
  - rm -f pulumi_plugins.tar.xz
  - mkdir -p $GOPATH/bin $GOPATH/pkg/mod/cache && tar xJf modcache_tools.tar.xz -C
    $GOPATH
  - rm -f modcache_tools.tar.xz
  - export PATH=$PATH:$GOPATH/bin
  - mkdir -p ~/.aws
  - "if [ -n \"$E2E_USE_AWS_PROFILE\" ]; then\n  echo Using agent-qa-ci aws profile\n\
    \  $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config\
    \ || exit $?\n  # Now all `aws` commands target the agent-qa profile\n  export\
    \ AWS_PROFILE=agent-qa-ci\nelse\n  # Assume role to fetch only once credentials\
    \ and avoid rate limits\n  echo Assuming ddbuild-agent-ci role\n  roleoutput=\"\
    $(aws sts assume-role --role-arn arn:aws:iam::669783387624:role/ddbuild-agent-ci\
    \ --external-id ddbuild-agent-ci --role-session-name RoleSession)\"\n  export\
    \ AWS_ACCESS_KEY_ID=\"$(echo \"$roleoutput\" | jq -r '.Credentials.AccessKeyId')\"\
    \n  export AWS_SECRET_ACCESS_KEY=\"$(echo \"$roleoutput\" | jq -r '.Credentials.SecretAccessKey')\"\
    \n  export AWS_SESSION_TOKEN=\"$(echo \"$roleoutput\" | jq -r '.Credentials.SessionToken')\"\
    \nfi\n"
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AWS_PUBLIC_KEY_PATH
    || exit $?
  - touch $E2E_AWS_PRIVATE_KEY_PATH && chmod 600 $E2E_AWS_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
    $AGENT_QA_E2E ssh_key_rsa > $E2E_AWS_PRIVATE_KEY_PATH || exit $?
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AZURE_PUBLIC_KEY_PATH
    || exit $?
  - touch $E2E_AZURE_PRIVATE_KEY_PATH && chmod 600 $E2E_AZURE_PRIVATE_KEY_PATH &&
    $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key_rsa > $E2E_AZURE_PRIVATE_KEY_PATH
    || exit $?
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_GCP_PUBLIC_KEY_PATH
    || exit $?
  - touch $E2E_GCP_PRIVATE_KEY_PATH && chmod 600 $E2E_GCP_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
    $AGENT_QA_E2E ssh_key_rsa > $E2E_GCP_PRIVATE_KEY_PATH || exit $?
  - pulumi login "s3://dd-pulumi-state?region=us-east-1&awssdk=v2&profile=$AWS_PROFILE"
  - ARM_CLIENT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE client_id)
    || exit $?; export ARM_CLIENT_ID
  - ARM_CLIENT_SECRET=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE token)
    || exit $?; export ARM_CLIENT_SECRET
  - ARM_TENANT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE tenant_id)
    || exit $?; export ARM_TENANT_ID
  - ARM_SUBSCRIPTION_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE subscription_id)
    || exit $?; export ARM_SUBSCRIPTION_ID
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_json > ~/gcp-credentials.json
    || exit $?
  - export GOOGLE_APPLICATION_CREDENTIALS=~/gcp-credentials.json
  - 'gcp_acr_key=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_acr_readonly)
    || exit $?

    export E2E_GCP_IMAGE_PULL_PASSWORD="b64=$(printf ''%s'' "$gcp_acr_key" | base64
    -w 0)"

    '
  - dda inv -- -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
  - export DD_ENV=nativetest
  - export DD_CIVISIBILITY_ENABLED=true
  - export DD_CIVISIBILITY_AGENTLESS_ENABLED=true
  - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
    || exit $?; export DD_API_KEY
  - export WINDOWS_DDNPM_DRIVER=${WINDOWS_DDNPM_DRIVER:-$(dda inv release.get-release-json-value
    "dependencies::WINDOWS_DDNPM_DRIVER" --no-worktree)}
  - export WINDOWS_DDPROCMON_DRIVER=${WINDOWS_DDPROCMON_DRIVER:-$(dda inv release.get-release-json-value
    "dependencies::WINDOWS_DDPROCMON_DRIVER" --no-worktree)}
  - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $CRC_PULL_SECRET > /tmp/crc-pull-secret.json
    || exit $?
  image: registry.ddbuild.io/ci/datadog-agent-buildimages/linux$CI_IMAGE_LINUX_SUFFIX:$CI_IMAGE_LINUX
  needs:
  - go_e2e_deps
  - go_tools_deps
  retry:
    exit_codes:
    - 42
    max: 2
    when:
    - runner_system_failure
    - stuck_or_timeout_failure
    - unknown_failure
    - api_failure
    - scheduler_failure
    - stale_schedule
    - data_integrity_failure
  rules:
  - if: $RUN_E2E_TESTS == "off"
    when: never
  - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
    when: never
  - if: $RUN_E2E_TESTS == "on"
    when: on_success
  - if: $CI_COMMIT_BRANCH == "main"
    when: on_success
  - if: $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
    when: on_success
  - if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
    when: on_success
  - changes:
      compare_to: $COMPARE_TO_BRANCH
      paths:
      - .gitlab/test/e2e/e2e.yml
      - test/e2e-framework/**/*
      - test/new-e2e/go.mod
      - go.mod
      - flakes.yaml
      - release.json
  - changes:
      compare_to: $COMPARE_TO_BRANCH
      paths:
      - test/new-e2e/tests/ssi/**/*
  - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
    when: never
  - allow_failure: true
    when: manual
  script:
  - export IS_DEV_BRANCH="$(dda inv -- -e pipeline.is-dev-branch)"
  - DYNAMIC_TESTS_BREAKGLASS=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $DYNAMIC_TESTS_BREAKGLASS
    value) || exit $?; export DYNAMIC_TESTS_BREAKGLASS
  - "if [ \"$DYNAMIC_TESTS_BREAKGLASS\" == \"true\" ] || [ \"$IS_DEV_BRANCH\" == \"\
    false\" ] || [ \"$RUN_E2E_TESTS\" == \"on\" ]; then\n  export DYNAMIC_TESTS_FLAG=\"\
    \"\nfi\n"
  - dda inv -- -e new-e2e-tests.run $DYNAMIC_TESTS_FLAG $PRE_BUILT_BINARIES_FLAG $MAX_RETRIES_FLAG
    --local-package $CI_PROJECT_DIR/$OMNIBUS_BASE_DIR --result-json $E2E_RESULT_JSON
    --targets $TARGETS -c ddagent:imagePullRegistry=669783387624.dkr.ecr.us-east-1.amazonaws.com,us-central1-docker.pkg.dev
    -c ddagent:imagePullUsername=AWS,_json_key -c ddagent:imagePullPassword=$(aws
    ecr get-login-password),$E2E_GCP_IMAGE_PULL_PASSWORD --junit-tar junit-${CI_JOB_ID}.tgz
    ${EXTRA_PARAMS} --test-washer --logs-folder=$E2E_OUTPUT_DIR/logs --logs-post-processing
    --logs-post-processing-test-depth=$E2E_LOGS_PROCESSING_TEST_DEPTH
  stage: e2e_init
  tags:
  - arch:amd64
  - specific:true
  variables:
    DYNAMIC_TESTS_FLAG: --impacted
    E2E_AWS_PRIVATE_KEY_PATH: /tmp/agent-qa-aws-ssh-key
    E2E_AWS_PUBLIC_KEY_PATH: /tmp/agent-qa-aws-ssh-key.pub
    E2E_AZURE_PRIVATE_KEY_PATH: /tmp/agent-qa-azure-ssh-key
    E2E_AZURE_PUBLIC_KEY_PATH: /tmp/agent-qa-azure-ssh-key.pub
    E2E_COMMIT_SHA: $CI_COMMIT_SHORT_SHA
    E2E_COVERAGE_OUT_DIR: $CI_PROJECT_DIR/coverage
    E2E_GCP_PRIVATE_KEY_PATH: /tmp/agent-qa-gcp-ssh-key
    E2E_GCP_PUBLIC_KEY_PATH: /tmp/agent-qa-gcp-ssh-key.pub
    E2E_INIT_ONLY: 'true'
    E2E_KEY_PAIR_NAME: datadog-agent-ci-rsa
    E2E_LOGS_PROCESSING_TEST_DEPTH: 1
    E2E_OUTPUT_DIR: $CI_PROJECT_DIR/e2e-output
    E2E_PIPELINE_ID: $CI_PIPELINE_ID
    E2E_PROVISIONER: openshift
    E2E_RESULT_JSON: $CI_PROJECT_DIR/e2e_test_output.json
    E2E_SKIP_WINDOWS: $SKIP_WINDOWS
    E2E_STACK_NAME_SUFFIX: openshift
    E2E_USE_AWS_PROFILE: 'true'
    EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
    EXTRA_PARAMS: -c ddinfra:gcp/openshift/pullSecretPath=/tmp/crc-pull-secret.json
    FLAKY_PATTERNS_CONFIG: $CI_PROJECT_DIR/flaky-patterns-runtime.yaml
    GIT_STRATEGY: clone
    KUBERNETES_CPU_REQUEST: 6
    KUBERNETES_MEMORY_LIMIT: 16Gi
    KUBERNETES_MEMORY_REQUEST: 12Gi
    MAX_RETRIES_FLAG: ''
    PRE_BUILT_BINARIES_FLAG: --use-prebuilt-binaries
    REMOTE_STACK_CLEANING: 'true'
    SHOULD_RUN_IN_FLAKES_FINDER: 'false'
    TARGETS: ./tests/ssi
    TEAM: injection-platform

Changes Summary

Removed Modified Added Renamed
0 0 2 0

ℹ️ Diff available in the job log.

@agent-platform-auto-pr
Copy link
Contributor

agent-platform-auto-pr bot commented Mar 10, 2026 •
edited
Loading

Files inventory check summary

File checks results against ancestor 7ab624e4:

Results for datadog-agent_7.78.0~devel.git.648.979e81a.pipeline.103282588-1_amd64.deb:

No change detected

@agent-platform-auto-pr
Copy link
Contributor

agent-platform-auto-pr bot commented Mar 10, 2026 •
edited
Loading

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor 2dbfdef
📊 Static Quality Gates Dashboard
🔗 SQG Job

Successful checks

Info

Quality gate Change Size (prev → curr → max)
✅ docker_agent_amd64 +10.3 KiB (0.00% increase) 807.202 → 807.212 → 813.040
✅ docker_agent_arm64 +11.7 KiB (0.00% increase) 809.888 → 809.900 → 819.570
✅ docker_agent_jmx_amd64 +10.3 KiB (0.00% increase) 998.118 → 998.128 → 1003.920
✅ docker_agent_jmx_arm64 +11.7 KiB (0.00% increase) 989.583 → 989.594 → 999.170
27 successful checks with minimal change (< 2 KiB)
Quality gate Current Size
✅ agent_deb_amd64 746.880 MiB
✅ agent_deb_amd64_fips 705.212 MiB
✅ agent_heroku_amd64 311.746 MiB
✅ agent_msi 609.827 MiB
✅ agent_rpm_amd64 746.864 MiB
✅ agent_rpm_amd64_fips 705.196 MiB
✅ agent_rpm_arm64 724.746 MiB
✅ agent_rpm_arm64_fips 686.083 MiB
✅ agent_suse_amd64 746.864 MiB
✅ agent_suse_amd64_fips 705.196 MiB
✅ agent_suse_arm64 724.746 MiB
✅ agent_suse_arm64_fips 686.083 MiB
✅ docker_cluster_agent_amd64 203.674 MiB
✅ docker_cluster_agent_arm64 218.101 MiB
✅ docker_cws_instrumentation_amd64 7.138 MiB
✅ docker_cws_instrumentation_arm64 6.689 MiB
✅ docker_dogstatsd_amd64 38.635 MiB
✅ docker_dogstatsd_arm64 36.939 MiB
✅ dogstatsd_deb_amd64 29.859 MiB
✅ dogstatsd_deb_arm64 28.008 MiB
✅ dogstatsd_rpm_amd64 29.859 MiB
✅ dogstatsd_suse_amd64 29.859 MiB
✅ iot_agent_deb_amd64 43.072 MiB
✅ iot_agent_deb_arm64 40.130 MiB
✅ iot_agent_deb_armhf 40.874 MiB
✅ iot_agent_rpm_amd64 43.072 MiB
✅ iot_agent_suse_amd64 43.072 MiB
On-wire sizes (compressed)
Quality gate Change Size (prev → curr → max)
✅ agent_deb_amd64 -2.69 KiB (0.00% reduction) 174.432 → 174.429 → 177.700
✅ agent_deb_amd64_fips -5.69 KiB (0.00% reduction) 165.390 → 165.384 → 172.230
✅ agent_heroku_amd64 +8.54 KiB (0.01% increase) 75.170 → 75.178 → 79.970
✅ agent_msi +36.0 KiB (0.03% increase) 138.031 → 138.066 → 146.220
✅ agent_rpm_amd64 +21.76 KiB (0.01% increase) 176.438 → 176.460 → 180.780
✅ agent_rpm_amd64_fips +26.82 KiB (0.02% increase) 168.111 → 168.137 → 173.370
✅ agent_rpm_arm64 -16.25 KiB (0.01% reduction) 159.315 → 159.299 → 161.610
✅ agent_rpm_arm64_fips +37.01 KiB (0.02% increase) 151.409 → 151.445 → 155.910
✅ agent_suse_amd64 +21.76 KiB (0.01% increase) 176.438 → 176.460 → 180.780
✅ agent_suse_amd64_fips +26.82 KiB (0.02% increase) 168.111 → 168.137 → 173.370
✅ agent_suse_arm64 -16.25 KiB (0.01% reduction) 159.315 → 159.299 → 161.610
✅ agent_suse_arm64_fips +37.01 KiB (0.02% increase) 151.409 → 151.445 → 155.910
✅ docker_agent_amd64 -20.2 KiB (0.01% reduction) 267.125 → 267.106 → 271.240
✅ docker_agent_arm64 -7.85 KiB (0.00% reduction) 254.429 → 254.422 → 259.800
✅ docker_agent_jmx_amd64 -16.16 KiB (0.00% reduction) 335.768 → 335.752 → 339.870
✅ docker_agent_jmx_arm64 -17.28 KiB (0.01% reduction) 319.075 → 319.058 → 324.390
✅ docker_cluster_agent_amd64 -9.41 KiB (0.01% reduction) 71.286 → 71.277 → 72.920
✅ docker_cluster_agent_arm64 neutral 66.924 MiB → 68.220
✅ docker_cws_instrumentation_amd64 neutral 2.997 MiB → 3.330
✅ docker_cws_instrumentation_arm64 neutral 2.728 MiB → 3.090
✅ docker_dogstatsd_amd64 neutral 14.950 MiB → 15.820
✅ docker_dogstatsd_arm64 neutral 14.280 MiB → 14.830
✅ dogstatsd_deb_amd64 neutral 7.889 MiB → 8.790
✅ dogstatsd_deb_arm64 neutral 6.773 MiB → 7.710
✅ dogstatsd_rpm_amd64 neutral 7.899 MiB → 8.800
✅ dogstatsd_suse_amd64 neutral 7.899 MiB → 8.800
✅ iot_agent_deb_amd64 neutral 11.355 MiB → 12.040
✅ iot_agent_deb_arm64 neutral 9.669 MiB → 10.450
✅ iot_agent_deb_armhf neutral 9.896 MiB → 10.620
✅ iot_agent_rpm_amd64 neutral 11.374 MiB → 12.060
✅ iot_agent_suse_amd64 neutral 11.374 MiB → 12.060

@cit-pr-commenter-54b7da
Copy link

cit-pr-commenter-54b7da bot commented Mar 10, 2026 •
edited
Loading

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: f2028385-a723-4f21-aa59-ec049d10e8da

Baseline: 2dbfdef
Comparison: d91bf83
Diff

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Regressions in experiments with settings containing erratic: true are ignored.

perf experiment goal Δ mean % Δ mean % CI trials links
➖ docker_containers_cpu % cpu utilization +2.33 [-0.69, +5.36] 1 Logs

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
➖ docker_containers_cpu % cpu utilization +2.33 [-0.69, +5.36] 1 Logs
➖ docker_containers_memory memory utilization +0.47 [+0.37, +0.58] 1 Logs
➖ tcp_syslog_to_blackhole ingress throughput +0.37 [+0.25, +0.49] 1 Logs
➖ file_tree memory utilization +0.27 [+0.21, +0.33] 1 Logs
➖ ddot_logs memory utilization +0.21 [+0.14, +0.27] 1 Logs
➖ ddot_metrics_sum_cumulativetodelta_exporter memory utilization +0.17 [-0.06, +0.40] 1 Logs
➖ ddot_metrics memory utilization +0.12 [-0.05, +0.30] 1 Logs
➖ file_to_blackhole_500ms_latency egress throughput +0.10 [-0.28, +0.48] 1 Logs
➖ quality_gate_idle memory utilization +0.10 [+0.05, +0.15] 1 Logs bounds checks dashboard
➖ file_to_blackhole_100ms_latency egress throughput +0.04 [-0.04, +0.11] 1 Logs
➖ uds_dogstatsd_20mb_12k_contexts_20_senders memory utilization +0.03 [-0.03, +0.09] 1 Logs
➖ tcp_dd_logs_filter_exclude ingress throughput +0.01 [-0.09, +0.10] 1 Logs
➖ uds_dogstatsd_to_api ingress throughput +0.00 [-0.18, +0.19] 1 Logs
➖ uds_dogstatsd_to_api_v3 ingress throughput +0.00 [-0.16, +0.17] 1 Logs
➖ quality_gate_metrics_logs memory utilization -0.00 [-0.25, +0.24] 1 Logs bounds checks dashboard
➖ file_to_blackhole_1000ms_latency egress throughput -0.01 [-0.43, +0.42] 1 Logs
➖ quality_gate_idle_all_features memory utilization -0.04 [-0.07, +0.00] 1 Logs bounds checks dashboard
➖ otlp_ingest_logs memory utilization -0.04 [-0.15, +0.07] 1 Logs
➖ file_to_blackhole_0ms_latency egress throughput -0.06 [-0.56, +0.44] 1 Logs
➖ ddot_metrics_sum_delta memory utilization -0.19 [-0.36, -0.03] 1 Logs
➖ otlp_ingest_metrics memory utilization -0.22 [-0.38, -0.06] 1 Logs
➖ ddot_metrics_sum_cumulative memory utilization -0.50 [-0.64, -0.36] 1 Logs
➖ quality_gate_logs % cpu utilization -1.14 [-2.66, +0.38] 1 Logs bounds checks dashboard

Bounds Checks: ✅ Passed

perf experiment bounds_check_name replicates_passed observed_value links
✅ docker_containers_cpu simple_check_run 10/10 715 ≥ 26
✅ docker_containers_memory memory_usage 10/10 274.41MiB ≤ 370MiB
✅ docker_containers_memory simple_check_run 10/10 708 ≥ 26
✅ file_to_blackhole_0ms_latency memory_usage 10/10 0.19GiB ≤ 1.20GiB
✅ file_to_blackhole_0ms_latency missed_bytes 10/10 0B = 0B
✅ file_to_blackhole_1000ms_latency memory_usage 10/10 0.23GiB ≤ 1.20GiB
✅ file_to_blackhole_1000ms_latency missed_bytes 10/10 0B = 0B
✅ file_to_blackhole_100ms_latency memory_usage 10/10 0.20GiB ≤ 1.20GiB
✅ file_to_blackhole_100ms_latency missed_bytes 10/10 0B = 0B
✅ file_to_blackhole_500ms_latency memory_usage 10/10 0.21GiB ≤ 1.20GiB
✅ file_to_blackhole_500ms_latency missed_bytes 10/10 0B = 0B
✅ quality_gate_idle intake_connections 10/10 3 = 3 bounds checks dashboard
✅ quality_gate_idle memory_usage 10/10 174.30MiB ≤ 175MiB bounds checks dashboard
✅ quality_gate_idle_all_features intake_connections 10/10 3 = 3 bounds checks dashboard
✅ quality_gate_idle_all_features memory_usage 10/10 492.34MiB ≤ 550MiB bounds checks dashboard
✅ quality_gate_logs intake_connections 10/10 4 ≤ 6 bounds checks dashboard
✅ quality_gate_logs memory_usage 10/10 200.25MiB ≤ 220MiB bounds checks dashboard
✅ quality_gate_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
✅ quality_gate_metrics_logs cpu_usage 10/10 354.31 ≤ 2000 bounds checks dashboard
✅ quality_gate_metrics_logs intake_connections 10/10 4 ≤ 6 bounds checks dashboard
✅ quality_gate_metrics_logs memory_usage 10/10 403.79MiB ≤ 475MiB bounds checks dashboard
✅ quality_gate_metrics_logs missed_bytes 10/10 0B = 0B bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

  • quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.

Base automatically changed from mtoff/e2e-ssi-imgvol-3 to main March 13, 2026 08:36
@iamluc iamluc force-pushed the luc/e2e-ssi-openshift branch from d91bf83 to 1ff5244 Compare March 17, 2026 14:57
@github-actions github-actions bot added the medium review PR review might take time label Mar 17, 2026
@iamluc iamluc force-pushed the luc/e2e-ssi-openshift branch from 3bda634 to 979e81a Compare March 18, 2026 14:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

internal Identify a non-fork PR medium review PR review might take time team/agent-devx team/injection-platform

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@iamluc