Fix the omnibus.build-repackaged-agent task#52887
Conversation
ofek
added
changelog/no-changelog
github-actions
Bot
added
the
short review
aiuto
left a comment
aiuto
left a comment
There was a problem hiding this comment.
Does anyone actually use this?
It's not called from gitlab.
If this is related to the "hacky agent build" then it is on my list for removing this quarter.
That aside, this seems fine.
Files inventory check summaryFile checks results against ancestor 60f210fe: Results for datadog-agent_7.83.0~devel.git.197.f270200.pipeline.125426322-1_amd64.deb:No change detected |
Static quality checks✅ Please find below the results from static quality gates 33 successful checks with minimal change (< 2 KiB)
|
Regression DetectorRegression Detector ResultsMetrics dashboard Baseline: 1241668 ❌ Experiments with retried target crashesThis is a critical error. One or more replicates failed with a non-zero exit code. These replicates may have been retried. See Replicate Execution Details for more information.
Optimization Goals: ✅ Improvement(s) detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | quality_gate_idle_all_features | memory utilization | -2.52 | [-2.61, -2.43] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_no_fs_load | memory utilization | -3.21 | [-3.30, -3.12] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_mean_fs_load | memory utilization | -3.43 | [-3.47, -3.40] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_idle | memory utilization | -3.48 | [-3.53, -3.42] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle | memory utilization | -4.07 | [-4.13, -4.02] | 1 | Logs bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | memory utilization | -6.50 | [-6.73, -6.27] | 1 | Logs bounds checks dashboard |
| ✅ | quality_gate_logs | % cpu utilization | -40.61 | [-41.39, -39.83] | 1 | Logs bounds checks dashboard |
Bounds Checks: ✅ Passed
| perf | experiment | bounds_check_name | replicates_passed | observed_value | links |
|---|---|---|---|---|---|
| ✅ | quality_gate_idle | intake_connections | 10/10 | 3 ≤ 4 | bounds checks dashboard |
| ✅ | quality_gate_idle | memory_usage | 10/10 | 147.50MiB ≤ 154MiB | bounds checks dashboard |
| ✅ | quality_gate_idle | total_bytes_received | 10/10 | 729.68KiB ≤ 819.20KiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | intake_connections | 10/10 | 3 ≤ 4 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | memory_usage | 10/10 | 493.50MiB ≤ 495MiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | total_bytes_received | 10/10 | 1.12MiB ≤ 1.25MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | intake_connections | 10/10 | 4 ≤ 6 | bounds checks dashboard |
| ✅ | quality_gate_logs | memory_usage | 10/10 | 183.34MiB ≤ 195MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_logs | total_bytes_received | 10/10 | 264.16MiB ≤ 292MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | cpu_usage | 10/10 | 346.59 ≤ 2000 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | intake_connections | 10/10 | 4 ≤ 6 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | memory_usage | 10/10 | 404.07MiB ≤ 430MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | total_bytes_received | 10/10 | 0.93GiB ≤ 1.04GiB | bounds checks dashboard |
| ✅ | quality_gate_security_idle | cpu_usage | 10/10 | 29.33 ≤ 100 | bounds checks dashboard |
| ✅ | quality_gate_security_idle | memory_usage | 10/10 | 298.83MiB ≤ 330MiB | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | cpu_usage | 10/10 | 63.40 ≤ 200 | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | memory_usage | 10/10 | 275.36MiB ≤ 310MiB | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | cpu_usage | 10/10 | 23.04 ≤ 100 | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | memory_usage | 10/10 | 281.50MiB ≤ 320MiB | bounds checks dashboard |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
Replicate Execution Details
We run multiple replicates for each experiment/variant. However, we allow replicates to be automatically retried if there are any failures, up to 8 times, at which point the replicate is marked dead and we are unable to run analysis for the entire experiment. We call each of these attempts at running replicates a replicate execution. This section lists all replicate executions that failed due to the target crashing or being oom killed.
Note: In the below tables we bucket failures by experiment, variant, and failure type. For each of these buckets we list out the replicate indexes that failed with an annotation signifying how many times said replicate failed with the given failure mode. In the below example the baseline variant of the experiment named experiment_with_failures had two replicates that failed by oom kills. Replicate 0, which failed 8 executions, and replicate 1 which failed 6 executions, all with the same failure mode.
| Experiment | Variant | Replicates | Failure | Logs | Debug Dashboard |
|---|---|---|---|---|---|
| experiment_with_failures | baseline | 0 (x8) 1 (x6) | Oom killed | Debug Dashboard |
The debug dashboard links will take you to a debugging dashboard specifically designed to investigate replicate execution failures.
❌ Retried Normal Replicate Execution Failures (non-profiling)
| Experiment | Variant | Replicates | Failure | Debug Dashboard |
|---|---|---|---|---|
| quality_gate_idle_all_features | baseline | 0 | Oom killed | Debug Dashboard |
| quality_gate_idle_all_features | comparison | 0, 4 | Oom killed | Debug Dashboard |
❌ Retried Profiling Replicate Execution Failures (ddprof)
Note: Profiling replicas may still be executing. See the debug dashboard for up to date status.
| Experiment | Variant | Replicates | Failure | Debug Dashboard |
|---|---|---|---|---|
| quality_gate_idle_all_features | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_logs | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_logs | comparison | 10 | Oom killed | Debug Dashboard |
| quality_gate_metrics_logs | baseline | 10 | Oom killed | Debug Dashboard |
| quality_gate_security_idle | baseline | 10 | Crashed (exit code: 134) | Debug Dashboard |
| quality_gate_security_idle | comparison | 10 | Crashed (exit code: 134) | Debug Dashboard |
| quality_gate_security_no_fs_load | baseline | 10 | Crashed (exit code: 134) | Debug Dashboard |
CI Pass/Fail Decision
✅ Passed. All Quality Gates passed.
- quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
It's an equivalent concept but for package distributions rather than container images. |
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
ofek.lev@datadoghq.com cancelled this merge request build |
|
/merge -c |
|
View all feedbacks in Devflow UI.
|
| "build", | ||
| "agent", | ||
| base_dir=None, | ||
| base_dir=_resolve_omnibus_path_override(None, "OMNIBUS_BASE_DIR"), |
There was a problem hiding this comment.
The initial issue was fixed but then I had to add this because another error occurred further along the build:
cd omnibus && bundle exec omnibus build agent --log-level=info --override=cache_dir:/var/cache/dd/omnibus/cache
[CLI] I | 2026-06-27T19:28:39+00:00 | Using config from 'omnibus.rb'
[2026-06-27T19:28:39+00:00] INFO: The plugin path /etc/chef/ohai/plugins does not exist. Skipping...
Building agent 7.0.0-devel...
[Software: existing-agent-package] I | 2026-06-27T19:28:39+00:00 | Resolving manifest entry for existing-agent-package
[Software: init-scripts-agent] I | 2026-06-27T19:28:39+00:00 | Resolving manifest entry for init-scripts-agent
[NullFetcher: init-scripts-agent] I | 2026-06-27T19:28:39+00:00 | Fetching `init-scripts-agent' (nothing to fetch)
[Software: datadog-agent] I | 2026-06-27T19:28:39+00:00 | Resolving manifest entry for datadog-agent
[Software: datadog-agent-installer-symlinks] I | 2026-06-27T19:28:39+00:00 | Resolving manifest entry for datadog-agent-installer-symlinks
[NullFetcher: datadog-agent-installer-symlinks] I | 2026-06-27T19:28:39+00:00 | Fetching `datadog-agent-installer-symlinks' (nothing to fetch)
[PathFetcher: datadog-agent] I | 2026-06-27T19:28:39+00:00 | Copying from `..'
#<Thread:0x00005775ba9b7e68 /opt/dd/rvm/gems/ruby-2.7.2/bundler/gems/omnibus-ruby-5b00eeae9fa5/lib/omnibus/thread_pool.rb:56 run> terminated with exception (report_on_exception is true):
/opt/dd/rvm/rubies/ruby-2.7.2/lib/ruby/2.7.0/fileutils.rb:250:in `mkdir': Permission denied @ dir_s_mkdir - /var/cache/omnibus (Errno::EACCES)
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
| 'INTEGRATION_WHEELS_SKIP_CACHE_UPLOAD': 'Setting that skips uploading integration wheels to cache', | ||
| 'MY_RUBY_HOME': 'rvm / Ruby stuff to make sure Omnibus itself runs correctly', | ||
| 'OMNIBUS_FORCE_PACKAGES': 'Force Omnibus to build actual packages', | ||
| 'OMNIBUS_BASE_DIR': 'Base directory used by Omnibus for build state and staged filesystem roots', |
There was a problem hiding this comment.
The second issue was fixed but then I had to copy the pattern used here due to another issue:
INFO: Running command line: bazel-bin/packages/agent/linux/install <args omitted>
INFO: Installing to /
Traceback (most recent call last):
File "/var/cache/dd/bazel/_bazel_dd/b7941ad420175bb062a7773daa329dcd/execroot/_main/bazel-out/k8-fastbuild/bin/packages/agent/linux/install.runfiles/_main/packages/agent/linux/_install_stage2_bootstrap.py", line 541, in <module>
main()
File "/var/cache/dd/bazel/_bazel_dd/b7941ad420175bb062a7773daa329dcd/execroot/_main/bazel-out/k8-fastbuild/bin/packages/agent/linux/install.runfiles/_main/packages/agent/linux/_install_stage2_bootstrap.py", line 535, in main
_run_py_path(main_filename, args=sys.argv[1:])
File "/var/cache/dd/bazel/_bazel_dd/b7941ad420175bb062a7773daa329dcd/execroot/_main/bazel-out/k8-fastbuild/bin/packages/agent/linux/install.runfiles/_main/packages/agent/linux/_install_stage2_bootstrap.py", line 323, in _run_py_path
runpy.run_path(main_filename, run_name="__main__")
File "<frozen runpy>", line 287, in run_path
File "<frozen runpy>", line 98, in _run_module_code
File "<frozen runpy>", line 88, in _run_code
File "/var/cache/dd/bazel/_bazel_dd/b7941ad420175bb062a7773daa329dcd/execroot/_main/bazel-out/k8-fastbuild/bin/packages/agent/linux/install.runfiles/_main/packages/agent/linux/install_install_script.py", line 292, in <module>
sys.exit(main(sys.argv))
^^^^^^^^^^^^^^
File "/var/cache/dd/bazel/_bazel_dd/b7941ad420175bb062a7773daa329dcd/execroot/_main/bazel-out/k8-fastbuild/bin/packages/agent/linux/install.runfiles/_main/packages/agent/linux/install_install_script.py", line 288, in main
installer.do_the_thing()
File "/var/cache/dd/bazel/_bazel_dd/b7941ad420175bb062a7773daa329dcd/execroot/_main/bazel-out/k8-fastbuild/bin/packages/agent/linux/install.runfiles/_main/packages/agent/linux/install_install_script.py", line 205, in do_the_thing
self._install_directory(entry)
File "/var/cache/dd/bazel/_bazel_dd/b7941ad420175bb062a7773daa329dcd/execroot/_main/bazel-out/k8-fastbuild/bin/packages/agent/linux/install.runfiles/_main/packages/agent/linux/install_install_script.py", line 132, in _install_directory
self._do_mkdir(entry.dest, entry.mode)
File "/var/cache/dd/bazel/_bazel_dd/b7941ad420175bb062a7773daa329dcd/execroot/_main/bazel-out/k8-fastbuild/bin/packages/agent/linux/install.runfiles/_main/packages/agent/linux/install_install_script.py", line 98, in _do_mkdir
os.makedirs(dirname, int(mode, 8), exist_ok=True)
File "<frozen os>", line 225, in makedirs
PermissionError: [Errno 13] Permission denied: '/opt/datadog-packages'
This comment has been minimized.
This comment has been minimized.
|
/trigger-ci --variable RUN_ALL_BUILDS=true --variable RUN_KITCHEN_TESTS=true --variable RUN_E2E_TESTS=on --variable RUN_UNIT_TESTS=on --variable RUN_KMT_TESTS=on |
|
View all feedbacks in Devflow UI.
Started pipeline #122828810 |
b49c3d8 to
b31e0cc
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b31e0cc291
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
151935b to
f920855
Compare
850398d to
2662cc9
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2662cc93ca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
|
### Motivation
When one has permission to write to `/opt/datadog-agent/` but not `/opt/`, like the new `dd` user in our developer environments, the task fails:
```
❯ dda inv -- -e omnibus.build-repackaged-agent
The Agent installation directory /opt/datadog-agent already exists, and will be overwritten by this build. Continue? [y/N] y
Traceback (most recent call last):
File "<frozen runpy>", line 198, in _run_module_as_main
File "<frozen runpy>", line 88, in _run_code
File "/var/lib/dd/dda/venvs/legacy/lib/python3.12/site-packages/invoke/__main__.py", line 3, in <module>
program.run()
File "/var/lib/dd/dda/venvs/legacy/lib/python3.12/site-packages/invoke/program.py", line 398, in run
self.execute()
File "/var/lib/dd/dda/venvs/legacy/lib/python3.12/site-packages/invoke/program.py", line 583, in execute
executor.execute(*self.tasks)
File "/var/lib/dd/dda/venvs/legacy/lib/python3.12/site-packages/invoke/executor.py", line 140, in execute
result = call.task(*args, **call.kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/repos/datadog-agent/tasks/custom_task/custom_task.py", line 149, in custom__call__
result = self.body(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/repos/datadog-agent/tasks/omnibus.py", line 467, in build_repackaged_agent
shutil.rmtree("/opt/datadog-agent")
File "/usr/lib/python3.12/shutil.py", line 796, in rmtree
onexc(os.rmdir, path, err)
File "/usr/lib/python3.12/shutil.py", line 794, in rmtree
os.rmdir(path, dir_fd=dir_fd)
PermissionError: [Errno 13] Permission denied: '/opt/datadog-agent'
```
Co-authored-by: ofek.lev <ofek.lev@datadoghq.com> 643d479
3 participants
Motivation
When one has permission to write to
/opt/datadog-agent/but not/opt/, like the newdduser in our developer environments, the task fails: