Lazy load validation package on import of datadog_checks.checks (DataDog#23936)

* Load the security module only when a check needs it

Importing datadog_checks.checks always pulls in the security module
(datadog_checks.base.utils.models.validation.security), which accounts for about
1 MiB of memory, even for checks that never use it. Now it's lazy loaded, so the
security module is only loaded on use. That saves about 1 MiB for checks that
don't need it, with no change for the ones that do.

* Add changelog entry for PR

Author: jinh-labs

datadog_checks_base/changelog.d/23936.added

@@ -0,0 +1 @@
+Lazy load the validation package (core, security, utils) on import of datadog_checks.checks.

datadog_checks_base/datadog_checks/base/checks/base.py

@@ -28,11 +28,7 @@
 from datadog_checks.base.utils.common import ensure_bytes, to_native_string
 from datadog_checks.base.utils.fips import enable_fips
 from datadog_checks.base.utils.format import json
-from datadog_checks.base.utils.models.validation.security import (
-    DEFAULT_TRUSTED_PROVIDERS,
-    SecurityConfig,
-    check_field_trusted_provider,
-)
+from datadog_checks.base.utils.models import validation
 from datadog_checks.base.utils.tagging import GENERIC_TAGS
 from datadog_checks.base.utils.tracing import traced_class
 
@@ -431,22 +427,22 @@ def logs_enabled(self):
         return self.__logs_enabled
 
     @property
-    def security_config(self) -> SecurityConfig:
+    def security_config(self) -> "validation.security.SecurityConfig":
         """
         Returns the integration security configuration, loaded once and cached.
 
         The security config controls file path validation for untrusted providers.
         """
         if self.__security_config is None:
             trusted_providers = datadog_agent.get_config('integration_trusted_providers')
-            self.__security_config = SecurityConfig(
+            self.__security_config = validation.security.SecurityConfig(
                 check_name=self.name,
                 provider=self.provider,
                 ignore_untrusted_file_params=bool(datadog_agent.get_config('integration_ignore_untrusted_file_params')),
                 file_paths_allowlist=datadog_agent.get_config('integration_file_paths_allowlist') or [],
                 trusted_providers=trusted_providers
                 if trusted_providers is not None
-                else list(DEFAULT_TRUSTED_PROVIDERS),
+                else list(validation.security.DEFAULT_TRUSTED_PROVIDERS),
                 excluded_checks=datadog_agent.get_config('integration_security_excluded_checks') or [],
             )
 
@@ -689,7 +685,7 @@ def load_configuration_model(import_path, model_name, config, context):
                     for field_name in GLOBAL_SECURE_FIELDS & configured_fields:
                         value = config.get(field_name)
                         if value is not None:
-                            check_field_trusted_provider(field_name, value, security_config)
+                            validation.security.check_field_trusted_provider(field_name, value, security_config)
                 except ValueError as e:
                     raise ConfigurationError(str(e)) from None
                 return config_model

datadog_checks_base/datadog_checks/base/utils/models/validation/__init__.py

@@ -1,4 +1,6 @@
 # (C) Datadog, Inc. 2021-present
 # All rights reserved
 # Licensed under a 3-clause BSD style license (see LICENSE)
-from . import core, security, utils
+import lazy_loader
+
+__getattr__, __dir__, __all__ = lazy_loader.attach_stub(__name__, __file__)

datadog_checks_base/datadog_checks/base/utils/models/validation/__init__.pyi

@@ -0,0 +1,6 @@
+# (C) Datadog, Inc. 2021-present
+# All rights reserved
+# Licensed under a 3-clause BSD style license (see LICENSE)
+from . import core, security, utils
+
+__all__ = ['core', 'security', 'utils']