Merge branch 'main' into romain.marcadier/log-to-debug

Author: RomainMuller

.gitlab/templates/pipeline.yaml.tpl

@@ -324,6 +324,49 @@ signed layer bundle:
     - mkdir -p datadog_extension-signed-bundle-${CI_JOB_ID}
     - cp .layers/datadog_extension-*.zip datadog_extension-signed-bundle-${CI_JOB_ID}
 
+# Integration Tests - Build Java Lambda function
+build java lambda:
+  stage: integration-tests
+  image: registry.ddbuild.io/images/docker:27.3.1
+  tags: ["docker-in-docker:arm64"]
+  rules:
+    - when: on_success
+  needs: []
+  artifacts:
+    expire_in: 1 hour
+    paths:
+      - integration-tests/lambda/base-java/target/
+  script:
+    - cd integration-tests/lambda/base-java
+    - docker run --rm --platform linux/arm64
+        -v "$(pwd)":/workspace
+        -w /workspace
+        maven:3.9-eclipse-temurin-21-alpine
+        mvn clean package
+
+# Integration Tests - Build .NET Lambda function
+build dotnet lambda:
+  stage: integration-tests
+  image: registry.ddbuild.io/images/docker:27.3.1
+  tags: ["docker-in-docker:arm64"]
+  rules:
+    - when: on_success
+  needs: []
+  artifacts:
+    expire_in: 1 hour
+    paths:
+      - integration-tests/lambda/base-dotnet/bin/
+  script:
+    - cd integration-tests/lambda/base-dotnet
+    - docker run --rm --platform linux/arm64
+        -v "$(pwd)":/workspace
+        -w /workspace
+        mcr.microsoft.com/dotnet/sdk:8.0-alpine
+        sh -c "apk add --no-cache zip &&
+               dotnet tool install -g Amazon.Lambda.Tools || true &&
+               export PATH=\"\$PATH:/root/.dotnet/tools\" &&
+               dotnet lambda package -o bin/function.zip --function-architecture arm64"
+
 # Integration Tests - Publish arm64 layer with integration test prefix
 publish integration layer (arm64):
   stage: integration-tests
@@ -362,6 +405,11 @@ integration-deploy:
     - when: on_success
   needs:
     - publish integration layer (arm64)
+    - build java lambda
+    - build dotnet lambda
+  dependencies:
+    - build java lambda
+    - build dotnet lambda
   variables:
     IDENTIFIER: ${CI_COMMIT_SHORT_SHA}
     AWS_DEFAULT_REGION: us-east-1
@@ -418,35 +466,55 @@ integration-cleanup-stacks:
   stage: integration-tests
   tags: ["arch:amd64"]
   image: ${CI_DOCKER_TARGET_IMAGE}:${CI_DOCKER_TARGET_VERSION}
-  when: always
   rules:
     - when: always
   needs:
-    - integration-test
+    - job: integration-test
+      optional: false
   variables:
     IDENTIFIER: ${CI_COMMIT_SHORT_SHA}
   {{ with $environment := (ds "environments").environments.sandbox }}
   before_script:
     - EXTERNAL_ID_NAME={{ $environment.external_id }} ROLE_TO_ASSUME={{ $environment.role_to_assume }} AWS_ACCOUNT={{ $environment.account }} source .gitlab/scripts/get_secrets.sh
-    - curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
-    - apt-get install -y nodejs
-    - cd integration-tests
-    - npm ci
   {{ end }}
   script:
     - echo "Destroying CDK stacks with identifier ${IDENTIFIER}..."
-    - npx cdk destroy "integ-$IDENTIFIER-*" --force || echo "Failed to destroy some stacks, but continuing..."
+    - |
+      # Find all stacks matching the pattern using CloudFormation API
+      STACKS=$(aws cloudformation list-stacks \
+        --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE UPDATE_ROLLBACK_COMPLETE \
+        --query "StackSummaries[?starts_with(StackName, 'integ-${IDENTIFIER}-')].StackName" \
+        --output text --region us-east-1)
+
+      if [ -z "$STACKS" ]; then
+        echo "No stacks found matching pattern integ-${IDENTIFIER}-*"
+      else
+        echo "Found stacks to delete: ${STACKS}"
+        for STACK in $STACKS; do
+          echo "Deleting stack ${STACK}..."
+          aws cloudformation delete-stack --stack-name "${STACK}" --region us-east-1 || echo "Failed to delete ${STACK}, continuing..."
+        done
+
+        # Wait for all deletions to complete
+        echo "Waiting for stack deletions to complete..."
+        for STACK in $STACKS; do
+          echo "Waiting for ${STACK}..."
+          aws cloudformation wait stack-delete-complete --stack-name "${STACK}" --region us-east-1 || echo "Stack ${STACK} deletion did not complete cleanly, continuing..."
+        done
+
+        echo "All stacks deleted successfully"
+      fi
 
 # Integration Tests - Cleanup layer
 integration-cleanup-layer:
   stage: integration-tests
   tags: ["arch:amd64"]
   image: ${CI_DOCKER_TARGET_IMAGE}:${CI_DOCKER_TARGET_VERSION}
-  when: always
   rules:
     - when: always
   needs:
-    - integration-cleanup-stacks
+    - job: integration-cleanup-stacks
+      optional: false
   variables:
     IDENTIFIER: ${CI_COMMIT_SHORT_SHA}
   {{ with $environment := (ds "environments").environments.sandbox }}
@@ -456,7 +524,7 @@ integration-cleanup-layer:
   script:
     - echo "Deleting integration test layer with identifier ${IDENTIFIER}..."
     - |
-      LAYER_NAME="Datadog-Extension-${IDENTIFIER}"
+      LAYER_NAME="Datadog-Extension-ARM-${IDENTIFIER}"
       echo "Looking for layer: ${LAYER_NAME}"
 
       # Get all versions of the layer

bottlecap/src/appsec/processor/response.rs

@@ -1,10 +1,10 @@
 use std::collections::HashMap;
 use std::io::Cursor;
 
-use serde::Deserialize;
+use serde::{Deserialize, Deserializer};
 
 use crate::appsec::processor::InvocationPayload;
-use crate::lifecycle::invocation::triggers::{body::Body, lowercase_key};
+use crate::lifecycle::invocation::triggers::body::Body;
 
 /// The expected payload of a response. This is different from trigger to trigger.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -50,9 +50,9 @@ impl Default for ExpectedResponseFormat {
 #[serde(rename_all = "camelCase")]
 struct ApiGatewayResponse {
     status_code: i64,
-    #[serde(deserialize_with = "lowercase_key", default)]
+    #[serde(deserialize_with = "nullable_lowercase_key", default)]
     headers: HashMap<String, String>,
-    #[serde(deserialize_with = "lowercase_key", default)]
+    #[serde(deserialize_with = "nullable_lowercase_key", default)]
     multi_value_headers: HashMap<String, Vec<String>>,
     #[serde(flatten)]
     body: Body,
@@ -101,3 +101,39 @@ impl InvocationPayload for RawPayload {
         Some(Box::new(Cursor::new(&self.data)))
     }
 }
+
+fn nullable_lowercase_key<'de, D, V>(deserializer: D) -> Result<HashMap<String, V>, D::Error>
+where
+    D: Deserializer<'de>,
+    V: Deserialize<'de>,
+{
+    let Some(map) = Option::<HashMap<String, V>>::deserialize(deserializer)? else {
+        return Ok(HashMap::default());
+    };
+    Ok(map
+        .into_iter()
+        .map(|(key, value)| (key.to_lowercase(), value))
+        .collect())
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+
+    #[test]
+    fn test_null_fields_in_apigw_response() {
+        let response = r#"{
+            "statusCode": 0,
+            "headers": null,
+            "multiValueHeaders": null,
+            "body": null
+        }"#;
+        let response = ExpectedResponseFormat::ApiGatewayResponse
+            .parse(response.as_bytes())
+            .expect("response should have parsed cleanly")
+            .expect("response should have been Some");
+        assert!(response.response_body().is_none());
+        assert!(response.response_headers_no_cookies().is_empty());
+        assert_eq!(response.response_status_code(), Some(0));
+    }
+}

bottlecap/src/logs/agent.rs

@@ -1,4 +1,5 @@
 use std::sync::Arc;
+use std::time::{Duration, Instant};
 use tokio::sync::mpsc::{self, Sender};
 use tokio_util::sync::CancellationToken;
 use tracing::debug;
@@ -9,6 +10,8 @@ use crate::logs::{aggregator_service::AggregatorHandle, processor::LogsProcessor
 use crate::tags;
 use crate::{LAMBDA_RUNTIME_SLUG, config};
 
+const DRAIN_LOG_INTERVAL: Duration = Duration::from_millis(100);
+
 #[allow(clippy::module_name_repetitions)]
 pub struct LogsAgent {
     rx: mpsc::Receiver<TelemetryEvent>,
@@ -57,6 +60,7 @@ impl LogsAgent {
                     debug!("LOGS_AGENT | Received shutdown signal, draining remaining events");
 
                     // Drain remaining events
+                    let mut last_drain_log_time = Instant::now().checked_sub(DRAIN_LOG_INTERVAL).expect("Failed to subtract interval from now");
                     'drain_logs_loop: loop {
                         match self.rx.try_recv() {
                             Ok(event) => {
@@ -68,7 +72,12 @@ impl LogsAgent {
                             },
                             // Empty signals there are still outstanding senders
                             Err(tokio::sync::mpsc::error::TryRecvError::Empty) => {
-                                debug!("LOGS_AGENT | No more events to process but still have senders, continuing to drain...");
+                                // Log at most once every 100ms to avoid spamming the logs
+                                let now = Instant::now();
+                                if now.duration_since(last_drain_log_time) >= DRAIN_LOG_INTERVAL {
+                                    debug!("LOGS_AGENT | No more events to process but still have senders, continuing to drain...");
+                                    last_drain_log_time = now;
+                                }
                             },
                         }
                     }

integration-tests/README.md

@@ -8,7 +8,40 @@ The general flow is:
 3. Wait for data to propagate to Datadog.
 4. Call Datadog to get telemetry data and check the data based on test requirements.
 
-For simplicity, integraiton tests are setup to only test against ARM runtimes.
+For simplicity, integration tests are setup to only test against ARM runtimes.
+
+## Test Suites
+
+### Base Tests
+
+The base test suite provides basic functionality tests across all supported Lambda runtimes. Also serves as an example for other tests.
+
+The base tests verify the extension can:
+- Collect and forward logs to Datadog
+- Generate and send traces with proper span structure
+- Detect cold starts
+
+**Test Coverage:**
+- Lambda invocation succeeds (200 status code)
+- "Hello world!" log message is sent to Datadog
+- One trace is sent to Datadog
+- `aws.lambda` span exists with correct properties including `cold_start: 'true'`
+- `aws.lambda.cold_start` span is created
+- `aws.lambda.load` spand is created for python and node.
+
+**Build Requirements:**
+
+For Java and .NET tests, Lambda functions must be built before deployment:
+
+```bash
+# Build Java Lambda (uses Docker)
+cd lambda/base-java && ./build.sh
+
+# Build .NET Lambda (uses Docker)
+cd lambda/base-dotnet && ./build.sh
+```
+
+These builds use Docker to ensure cross-platform compatibility and do not require local Maven or .NET SDK installation.
 
 ## Guidelines
 

integration-tests/bin/app.ts

@@ -1,25 +1,37 @@
 #!/usr/bin/env node
 import 'source-map-support/register';
 import * as cdk from 'aws-cdk-lib';
-import { BaseNodeStack } from '../lib/stacks/base-node-stack';
-import { BasePythonStack } from '../lib/stacks/base-python-stack';
-import { getIdentifier } from '../tests/utils/config';
+import {BaseNodeStack} from '../lib/stacks/base-node-stack';
+import {BasePythonStack} from '../lib/stacks/base-python-stack';
+import {BaseJavaStack} from '../lib/stacks/base-java-stack';
+import {BaseDotnetStack} from '../lib/stacks/base-dotnet-stack';
+import {getIdentifier} from '../tests/utils/config';
 
 const app = new cdk.App();
 
 const env = {
-  account: process.env.CDK_DEFAULT_ACCOUNT || process.env.AWS_ACCOUNT_ID,
-  region: process.env.CDK_DEFAULT_REGION || process.env.AWS_REGION || 'us-east-1',
+    account: process.env.CDK_DEFAULT_ACCOUNT || process.env.AWS_ACCOUNT_ID,
+    region: process.env.CDK_DEFAULT_REGION || process.env.AWS_REGION || 'us-east-1',
 };
 
 const identifier = getIdentifier();
 
-new BaseNodeStack(app, `integ-${identifier}-base-node`, {
-  env,
-});
+const stacks = [
+    new BaseNodeStack(app, `integ-${identifier}-base-node`, {
+        env,
+    }),
+    new BasePythonStack(app, `integ-${identifier}-base-python`, {
+        env,
+    }),
+    new BaseJavaStack(app, `integ-${identifier}-base-java`, {
+        env,
+    }),
+    new BaseDotnetStack(app, `integ-${identifier}-base-dotnet`, {
+        env,
+    }),
+]
 
-new BasePythonStack(app, `integ-${identifier}-base-python`, {
-  env,
-});
+// Tag all stacks so we can easily clean them up
+stacks.forEach(stack => stack.addStackTag("extension_integration_test", "true"))
 
 app.synth();

integration-tests/lambda/base-dotnet/.gitignore

@@ -0,0 +1,4 @@
+bin/
+obj/
+*.user
+*.suo

integration-tests/lambda/base-dotnet/Function.cs

@@ -0,0 +1,19 @@
+using Amazon.Lambda.Core;
+using System.Collections.Generic;
+
+[assembly: LambdaSerializer(typeof(Amazon.Lambda.Serialization.SystemTextJson.DefaultLambdaJsonSerializer))]
+
+namespace Function
+{
+    public class Handler
+    {
+        public Dictionary<string, object> FunctionHandler(Dictionary<string, object> input, ILambdaContext context)
+        {
+            context.Logger.LogLine("Hello world!");
+            return new Dictionary<string, object>
+            {
+                { "statusCode", 200 }
+            };
+        }
+    }
+}

integration-tests/lambda/base-dotnet/Function.csproj

@@ -0,0 +1,14 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <GenerateRuntimeConfigurationFiles>true</GenerateRuntimeConfigurationFiles>
+    <AWSProjectType>Lambda</AWSProjectType>
+    <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
+    <PublishReadyToRun>true</PublishReadyToRun>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Amazon.Lambda.Core" Version="2.2.0" />
+    <PackageReference Include="Amazon.Lambda.Serialization.SystemTextJson" Version="2.4.0" />
+  </ItemGroup>
+</Project>