feat(infra_mode): add allowlist priority and excluded checks logic (#44740)

### What does this PR do?
Adds support for prioritized allowlists per infrastructure mode and introduces an explicit exclusion list for integrations.

### Motivation
This improves control over which checks are allowed to run in basic and other restricted modes, while keeping configuration flexible and explicit.

### Describe how you validated your changes
CI

### Additional Notes
None


Co-authored-by: louis.coquerelle <louis.coquerelle@datadoghq.com>

Author: louis-cqrl

pkg/collector/infra_mode.go

@@ -15,17 +15,30 @@ import (
 // IsCheckAllowed returns true if the check is allowed.
 // When not in basic mode, all checks are allowed (returns true).
 // When in basic mode, only checks in the allowed list or starting with "custom_" are permitted.
+// Note: Legacy keys (excluded_checks, allowed_additional_checks) are aliased to mode-specific
+// keys in config.go via applyInfrastructureModeOverrides.
 func IsCheckAllowed(checkName string, cfg pkgconfigmodel.Reader) bool {
-	// When not in basic mode, all checks are allowed
-	if cfg.GetString("infrastructure_mode") != "basic" {
-		return true
+	if !cfg.GetBool("integration.enabled") {
+		return false
+	}
+
+	infraMode := cfg.GetString("infrastructure_mode")
+
+	// Check excluded list
+	if slices.Contains(cfg.GetStringSlice("integration.excluded"), checkName) {
+		return false
 	}
 
 	// Allow all custom checks
 	if strings.HasPrefix(checkName, "custom_") {
 		return true
 	}
 
-	// Check if it's in the allowed checks (default + additional)
-	return slices.Contains(append(cfg.GetStringSlice("allowed_checks"), cfg.GetStringSlice("allowed_additional_checks")...), checkName)
+	// If allowed checks is empty, all checks are allowed
+	if allowedChecks := cfg.GetStringSlice("integration." + infraMode + ".allowed"); len(allowedChecks) == 0 || slices.Contains(allowedChecks, checkName) {
+		return true
+	}
+
+	// Check additional list
+	return slices.Contains(cfg.GetStringSlice("integration.additional"), checkName)
 }

pkg/collector/infra_mode_test.go

@@ -0,0 +1,123 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+package collector
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	configmock "github.com/DataDog/datadog-agent/pkg/config/mock"
+	pkgconfigmodel "github.com/DataDog/datadog-agent/pkg/config/model"
+)
+
+func TestIsCheckAllowed(t *testing.T) {
+	tests := []struct {
+		name       string
+		checkName  string
+		setupCfg   func(cfg pkgconfigmodel.Config)
+		wantResult bool
+	}{
+		{
+			name:      "integration disabled returns false",
+			checkName: "cpu",
+			setupCfg: func(cfg pkgconfigmodel.Config) {
+				cfg.Set("integration.enabled", false, pkgconfigmodel.SourceFile)
+			},
+			wantResult: false,
+		},
+		{
+			name:      "check in excluded list returns false",
+			checkName: "disk",
+			setupCfg: func(cfg pkgconfigmodel.Config) {
+				cfg.Set("integration.enabled", true, pkgconfigmodel.SourceFile)
+				cfg.Set("infrastructure_mode", "full", pkgconfigmodel.SourceFile)
+				cfg.Set("integration.excluded", []string{"disk", "memory"}, pkgconfigmodel.SourceFile)
+			},
+			wantResult: false,
+		},
+		{
+			name:      "custom check is always allowed",
+			checkName: "custom_mycheck",
+			setupCfg: func(cfg pkgconfigmodel.Config) {
+				cfg.Set("integration.enabled", true, pkgconfigmodel.SourceFile)
+				cfg.Set("infrastructure_mode", "basic", pkgconfigmodel.SourceFile)
+			},
+			wantResult: true,
+		},
+		{
+			name:      "check in allowed list for basic mode returns true",
+			checkName: "cpu",
+			setupCfg: func(cfg pkgconfigmodel.Config) {
+				cfg.Set("integration.enabled", true, pkgconfigmodel.SourceFile)
+				cfg.Set("infrastructure_mode", "basic", pkgconfigmodel.SourceFile)
+				cfg.Set("integration.basic.allowed", []string{"cpu", "memory"}, pkgconfigmodel.SourceFile)
+			},
+			wantResult: true,
+		},
+		{
+			name:      "check not in allowed list for basic mode returns false",
+			checkName: "postgres",
+			setupCfg: func(cfg pkgconfigmodel.Config) {
+				cfg.Set("integration.enabled", true, pkgconfigmodel.SourceFile)
+				cfg.Set("infrastructure_mode", "basic", pkgconfigmodel.SourceFile)
+				cfg.Set("integration.basic.allowed", []string{"cpu", "memory"}, pkgconfigmodel.SourceFile)
+			},
+			wantResult: false,
+		},
+		{
+			name:      "check in additional list returns true",
+			checkName: "postgres",
+			setupCfg: func(cfg pkgconfigmodel.Config) {
+				cfg.Set("integration.enabled", true, pkgconfigmodel.SourceFile)
+				cfg.Set("infrastructure_mode", "basic", pkgconfigmodel.SourceFile)
+				cfg.Set("integration.basic.allowed", []string{"cpu", "memory"}, pkgconfigmodel.SourceFile)
+				cfg.Set("integration.additional", []string{"postgres"}, pkgconfigmodel.SourceFile)
+			},
+			wantResult: true,
+		},
+		{
+			name:      "excluded check takes precedence over custom prefix",
+			checkName: "custom_excluded",
+			setupCfg: func(cfg pkgconfigmodel.Config) {
+				cfg.Set("integration.enabled", true, pkgconfigmodel.SourceFile)
+				cfg.Set("infrastructure_mode", "full", pkgconfigmodel.SourceFile)
+				cfg.Set("integration.excluded", []string{"custom_excluded"}, pkgconfigmodel.SourceFile)
+			},
+			wantResult: false,
+		},
+		{
+			name:      "end_user_device mode allows all checks",
+			checkName: "any_check",
+			setupCfg: func(cfg pkgconfigmodel.Config) {
+				cfg.Set("integration.enabled", true, pkgconfigmodel.SourceFile)
+				cfg.Set("infrastructure_mode", "end_user_device", pkgconfigmodel.SourceFile)
+			},
+			wantResult: true,
+		},
+		{
+			name:      "excluded takes precedence over allowed",
+			checkName: "disk",
+			setupCfg: func(cfg pkgconfigmodel.Config) {
+				cfg.Set("integration.enabled", true, pkgconfigmodel.SourceFile)
+				cfg.Set("infrastructure_mode", "basic", pkgconfigmodel.SourceFile)
+				cfg.Set("integration.basic.allowed", []string{"cpu", "disk", "memory"}, pkgconfigmodel.SourceFile)
+				cfg.Set("integration.excluded", []string{"disk"}, pkgconfigmodel.SourceFile)
+			},
+			wantResult: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := configmock.New(t)
+			tt.setupCfg(cfg)
+
+			result := IsCheckAllowed(tt.checkName, cfg)
+			assert.Equal(t, tt.wantResult, result)
+		})
+	}
+}

pkg/config/setup/config.go

@@ -1336,14 +1336,26 @@ func agent(config pkgconfigmodel.Setup) {
 	config.BindEnvAndSetDefault("allow_arbitrary_tags", false)
 	config.BindEnvAndSetDefault("use_proxy_for_cloud_metadata", false)
 
+	// Legacy alias for backward compatibility
+	// This applies to the current infrastructure_mode
+	config.BindEnvAndSetDefault("allowed_additional_checks", []string{})
+
+	config.BindEnvAndSetDefault("integration.enabled", true)
+
+	// integration.additional: additional checks to allow beyond the default set (user configured)
+	config.BindEnvAndSetDefault("integration.additional", []string{})
+	// integration.excluded: checks to exclude (user configured)
+	config.BindEnvAndSetDefault("integration.excluded", []string{})
+
 	// Infrastructure mode
 	// The infrastructure mode is used to determine the features that are available to the agent.
 	// The possible values are: full, basic, end_user_device.
 	config.BindEnvAndSetDefault("infrastructure_mode", "full")
 
-	// Infrastructure basic mode - allowed checks (UNDOCUMENTED)
+	// Infrastructure basic mode section [UNDOCUMENTED]
 	// Note: All checks starting with "custom_" are always allowed.
-	config.BindEnvAndSetDefault("allowed_checks", []string{
+	// integration.basic.allowed: default allowed checks (internal, should not need user configuration)
+	config.BindEnvAndSetDefault("integration.basic.allowed", []string{
 		"cpu",
 		"agent_telemetry",
 		"agentcrashdetect",
@@ -1369,11 +1381,6 @@ func agent(config pkgconfigmodel.Setup) {
 		"winproc",
 	})
 
-	// Infrastructure basic mode - additional checks
-	// When infrastructure_mode is set to "basic", only a limited set of checks are allowed to run.
-	// This setting allows customers to add additional checks to the allowlist beyond the default set.
-	config.BindEnvAndSetDefault("allowed_additional_checks", []string{})
-
 	// Configuration for TLS for outgoing connections
 	config.BindEnvAndSetDefault("min_tls_version", "tlsv1.2")
 
@@ -2815,6 +2822,13 @@ func toggleDefaultPayloads(config pkgconfigmodel.Config) {
 func applyInfrastructureModeOverrides(config pkgconfigmodel.Config) {
 	infraMode := config.GetString("infrastructure_mode")
 
+	// Apply legacy alias: copy values from legacy key to integration.additional
+	// Legacy `allowed_additional_checks` -> `integration.additional`
+	if legacyAdditional := config.GetStringSlice("allowed_additional_checks"); len(legacyAdditional) > 0 {
+		combined := append(config.GetStringSlice("integration.additional"), legacyAdditional...)
+		config.Set("integration.additional", combined, pkgconfigmodel.SourceAgentRuntime)
+	}
+
 	if infraMode == "end_user_device" {
 		// Enable features for end_user_device mode
 		config.Set("process_config.process_collection.enabled", true, pkgconfigmodel.SourceInfraMode)

pkg/config/setup/config_test.go

@@ -670,6 +670,24 @@ func TestNetworkPathDefaults(t *testing.T) {
 	assert.Equal(t, false, config.GetBool("network_path.collector.disable_windows_driver"))
 }
 
+func TestInfrastructureModeLegacyAliases(t *testing.T) {
+	// Test that legacy allowed_additional_checks is aliased to mode-specific
+	// key via applyInfrastructureModeOverrides
+	datadogYaml := `
+infrastructure_mode: basic
+allowed_additional_checks:
+  - prometheus
+  - redis
+`
+	config := confFromYAML(t, datadogYaml)
+	applyInfrastructureModeOverrides(config)
+
+	// Legacy allowed_additional_checks should be merged into integration.additional
+	additional := config.GetStringSlice("integration.additional")
+	assert.Contains(t, additional, "prometheus")
+	assert.Contains(t, additional, "redis")
+}
+
 func TestUsePodmanLogsAndDockerPathOverride(t *testing.T) {
 	// If use_podman_logs is true and docker_path_override is set, the config should return an error
 	datadogYaml := `