Skip to content

Commit d9c6ac1

Browse files
fabbingfabbing
authored
[ARUN-988] Relax endpoints validation (#44974)
### What does this PR do? This PR is a continuation of #43038 and also relax endpoints validation for `ddog-gov.com` URL. ### Motivation https://datadoghq.atlassian.net/browse/AGENTRUN-988 ### Describe how you validated your changes Updated unit tests, CI. ### Additional Notes Co-authored-by: fabrice.buoro <fabrice.buoro@datadoghq.com>
1 parent d7e1264 commit d9c6ac1

9 files changed

Lines changed: 76 additions & 22 deletions

File tree

‎cmd/agent/install_script.sh‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,10 +106,12 @@ Troubleshooting and basic usage information for the %s are available at:
106106
exit 1;
107107
fi
108108

109-
if [ "$site" == "ddog-gov.com" ]; then
110-
fallback_msg
111-
exit 1;
112-
fi
109+
case $site in
110+
*"ddog-gov.com")
111+
fallback_msg
112+
exit 1;
113+
;;
114+
esac
113115

114116
while true; do
115117
read -t 60 -p "Do you want to send a failure report to Datadog (including $logfile)? (y/[n]) " -r yn || on_read_error

‎comp/core/agenttelemetry/impl/agenttelemetry_test.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -442,6 +442,16 @@ agent_telemetry:
442442
assert.False(t, a.enabled)
443443
}
444444

445+
func TestDisableIfLongGovCloud(t *testing.T) {
446+
c := `
447+
site: "xxxx99.ddog-gov.com"
448+
agent_telemetry:
449+
enabled: true
450+
`
451+
a := getTestAtel(t, nil, c, nil, nil, nil)
452+
assert.False(t, a.enabled)
453+
}
454+
445455
func TestEnableIfNotGovCloud(t *testing.T) {
446456
c := `
447457
site: "datadoghq.eu"

‎comp/forwarder/defaultforwarder/forwarder_health_test.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,11 @@ func TestComputeDomainsURL(t *testing.T) {
7171
"https://app.xxxx99.datadoghq.com": {utils.NewAPIKeys("path", "api_key5")},
7272
"https://custom.agent.us2.datadoghq.com": {utils.NewAPIKeys("path", "api_key6")},
7373
// debatable whether the next one should be changed to `api.`, preserve pre-existing behavior for now
74-
"https://app.datadoghq.internal": {utils.NewAPIKeys("path", "api_key7")},
75-
"https://app.myproxy.com": {utils.NewAPIKeys("path", "api_key8")},
76-
"https://app.ddog-gov.com": {utils.NewAPIKeys("path", "api_key9")},
77-
"https://custom.ddog-gov.com": {utils.NewAPIKeys("path", "api_key10")},
74+
"https://app.datadoghq.internal": {utils.NewAPIKeys("path", "api_key7")},
75+
"https://app.myproxy.com": {utils.NewAPIKeys("path", "api_key8")},
76+
"https://app.ddog-gov.com": {utils.NewAPIKeys("path", "api_key9")},
77+
"https://custom.ddog-gov.com": {utils.NewAPIKeys("path", "api_key10")},
78+
"https://app.xxxx99.ddog-gov.com": {utils.NewAPIKeys("path", "api_key11")},
7879
}
7980

8081
expectedMap := map[string][]string{
@@ -86,6 +87,7 @@ func TestComputeDomainsURL(t *testing.T) {
8687
"https://api.datadoghq.internal": {"api_key7"},
8788
"https://app.myproxy.com": {"api_key8"},
8889
"https://api.ddog-gov.com": {"api_key9", "api_key10"},
90+
"https://api.xxxx99.ddog-gov.com": {"api_key11"},
8991
}
9092

9193
// just sort the expected map for easy comparison

‎pkg/config/remote/meta/meta.go‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,11 @@ package meta
99
import (
1010
_ "embed"
1111
"encoding/json"
12+
"strings"
1213

13-
"github.com/DataDog/datadog-agent/pkg/util/log"
1414
"github.com/DataDog/go-tuf/data"
15+
16+
"github.com/DataDog/datadog-agent/pkg/util/log"
1517
)
1618

1719
var (
@@ -54,14 +56,14 @@ func RootsDirector(site string, directorRootOverride string) EmbeddedRoot {
5456
if directorRootOverride != "" {
5557
return NewEmbeddedRoot([]byte(directorRootOverride))
5658
}
57-
switch site {
58-
case "datad0g.com":
59+
60+
if site == "datad0g.com" {
5961
return NewEmbeddedRoot(stagingRootDirector)
60-
case "ddog-gov.com":
62+
} else if site == "ddog-gov.com" || strings.HasSuffix(site, ".ddog-gov.com") {
6163
return NewEmbeddedRoot(govRootDirector)
62-
default:
63-
return NewEmbeddedRoot(prodRootDirector)
6464
}
65+
return NewEmbeddedRoot(prodRootDirector)
66+
6567
}
6668

6769
// RootsConfig returns all the roots of the director repo
@@ -70,14 +72,12 @@ func RootsConfig(site string, configRootOverride string) EmbeddedRoot {
7072
return NewEmbeddedRoot([]byte(configRootOverride))
7173
}
7274

73-
switch site {
74-
case "datad0g.com":
75+
if site == "datad0g.com" {
7576
return NewEmbeddedRoot(stagingRootConfig)
76-
case "ddog-gov.com":
77+
} else if site == "ddog-gov.com" || strings.HasSuffix(site, ".ddog-gov.com") {
7778
return NewEmbeddedRoot(govRootConfig)
78-
default:
79-
return NewEmbeddedRoot(prodRootConfig)
8079
}
80+
return NewEmbeddedRoot(prodRootConfig)
8181
}
8282

8383
// Root returns the last root the EmbeddedRoots

‎pkg/config/utils/endpoints_test.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -451,6 +451,11 @@ func TestAddAgentVersionToDomain(t *testing.T) {
451451
".ddog-gov.com",
452452
true,
453453
},
454+
{ // Gov long-named
455+
"https://app.xxxx99.ddog-gov.com",
456+
".xxxx99.ddog-gov.com",
457+
true,
458+
},
454459
{ // Additional site
455460
"https://app.us2.datadoghq.com",
456461
".us2.datadoghq.com",

‎pkg/config/utils/miscellaneous.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ package utils
88

99
import (
1010
"path/filepath"
11+
"regexp"
1112
"strings"
1213

1314
pkgconfigmodel "github.com/DataDog/datadog-agent/pkg/config/model"
@@ -71,8 +72,11 @@ func IsRemoteConfigEnabled(cfg pkgconfigmodel.Reader) bool {
7172

7273
// IsFed returns true if the Agent is running in a gov environment
7374
func IsFed(cfg pkgconfigmodel.Reader) bool {
75+
reSite := regexp.MustCompile(`(.+\.)?ddog-gov\.com`)
76+
reURL := regexp.MustCompile(`https://.+\.ddog-gov\.com`)
7477
isFipsAgent, _ := pkgfips.Enabled()
75-
return cfg.GetBool("fips.enabled") || isFipsAgent || cfg.GetString("site") == "ddog-gov.com" || cfg.GetString("dd_url") == "https://app.ddog-gov.com"
78+
return cfg.GetBool("fips.enabled") || isFipsAgent ||
79+
reSite.MatchString(cfg.GetString("site")) || reURL.MatchString(cfg.GetString("dd_url"))
7680
}
7781

7882
// IsCloudProviderEnabled checks the cloud provider family provided in

‎pkg/config/utils/miscellaneous_test.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,29 @@ func TestIsRemoteConfigEnabled(t *testing.T) {
175175
m.SetWithoutSource("remote_configuration.enabled", false)
176176
},
177177
},
178+
{
179+
name: "gov via long site and not explicitly enabled",
180+
expected: false,
181+
setConfig: func(m model.BuildableConfig) {
182+
m.SetWithoutSource("site", "xxxx99.ddog-gov.com")
183+
},
184+
},
185+
{
186+
name: "gov via long site and explicitly enabled",
187+
expected: true,
188+
setConfig: func(m model.BuildableConfig) {
189+
m.SetWithoutSource("site", "xxxx99.ddog-gov.com")
190+
m.SetWithoutSource("remote_configuration.enabled", true)
191+
},
192+
},
193+
{
194+
name: "gov via long site and explicitly disabled",
195+
expected: false,
196+
setConfig: func(m model.BuildableConfig) {
197+
m.SetWithoutSource("site", "xxxx99.ddog-gov.com")
198+
m.SetWithoutSource("remote_configuration.enabled", false)
199+
},
200+
},
178201
}
179202

180203
for _, test := range tests {

‎pkg/config/utils/telemetry.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
package utils
77

88
import (
9+
"regexp"
10+
911
pkgconfigmodel "github.com/DataDog/datadog-agent/pkg/config/model"
1012
)
1113

@@ -43,8 +45,9 @@ func IsTelemetryEnabled(cfg pkgconfigmodel.Reader) bool {
4345

4446
// IsAgentTelemetryEnabled returns true if Agent Telemetry is enabled
4547
func IsAgentTelemetryEnabled(cfg pkgconfigmodel.Reader) bool {
48+
reSite := regexp.MustCompile(`(.+\.)?ddog-gov\.com`)
4649
// Disable Agent Telemetry for GovCloud
47-
if cfg.GetBool("fips.enabled") || cfg.GetString("site") == "ddog-gov.com" {
50+
if cfg.GetBool("fips.enabled") || reSite.MatchString(cfg.GetString("site")) {
4851
return false
4952
}
5053
return cfg.GetBool("agent_telemetry.enabled")

‎pkg/config/utils/telemetry_test.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@ package utils
88
import (
99
"testing"
1010

11-
configmock "github.com/DataDog/datadog-agent/pkg/config/mock"
1211
"github.com/stretchr/testify/assert"
12+
13+
configmock "github.com/DataDog/datadog-agent/pkg/config/mock"
1314
)
1415

1516
func TestIsCheckTelemetryEnabled(t *testing.T) {
@@ -50,4 +51,8 @@ func TestIsCheckTelemetryEnabled(t *testing.T) {
5051

5152
assert.True(IsCheckTelemetryEnabled("cpu", mockConfig))
5253
assert.True(IsCheckTelemetryEnabled("disk", mockConfig))
54+
55+
mockConfig.SetWithoutSource("agent_telemetry.enabled", true)
56+
mockConfig.SetWithoutSource("site", "xx.ddog-gov.com")
57+
assert.False(IsAgentTelemetryEnabled(mockConfig))
5358
}

0 commit comments

Comments
 (0)