Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CWS] add rocky_9.4 to CWS KMT tested platforms #31886

Merged
merged 2 commits into from
Dec 10, 2024
Merged

[CWS] add rocky_9.4 to CWS KMT tested platforms #31886

merged 2 commits into from
Dec 10, 2024

Conversation

paulcacheux
Copy link
Contributor

@paulcacheux paulcacheux commented Dec 9, 2024 •
edited
Loading

What does this PR do?

Add rocky 9.4 to the list of platforms tested in KMT for CWS tests.

Motivation

Describe how you validated your changes

Possible Drawbacks / Trade-offs

Additional Notes

@paulcacheux paulcacheux added changelog/no-changelog team/agent-security qa/no-code-change No code change in Agent code requiring validation labels Dec 9, 2024
@github-actions github-actions bot added the short review PR is simple enough to be reviewed quickly label Dec 9, 2024
@paulcacheux paulcacheux marked this pull request as ready for review December 9, 2024 14:50
@paulcacheux paulcacheux requested a review from a team as a code owner December 9, 2024 14:50
@paulcacheux paulcacheux force-pushed the paulcacheux/cws-rocky9.4-kmt branch 2 times, most recently from ad6cabd to f220e2a Compare December 9, 2024 16:02
@agent-platform-auto-pr
Copy link
Contributor

agent-platform-auto-pr bot commented Dec 9, 2024 •
edited
Loading

Gitlab CI Configuration Changes

Modified Jobs

kmt_run_secagent_tests_arm64 
  kmt_run_secagent_tests_arm64:
    after_script:
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - export MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
    - mkdir -p $CI_PROJECT_DIR/logs
    - ssh metal_instance "ssh ${MICRO_VM_IP} \"journalctl -u setup-ddvm.service\"" >
      $CI_PROJECT_DIR/logs/setup-ddvm.log || true
    - cat $CI_PROJECT_DIR/logs/setup-ddvm.log || true
    - ssh metal_instance "ssh ${MICRO_VM_IP} \"systemctl is-active setup-ddvm.service\""
      | tee $CI_PROJECT_DIR/logs/setup-ddvm.status || true
    - ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/junit.tar.gz /home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
      || true
    - scp "metal_instance:/home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
      || true
    - ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/testjson.tar.gz /home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
      || true
    - scp "metal_instance:/home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
      || true
    - ssh metal_instance "scp -r ${MICRO_VM_IP}:/tmp/test_pcaps /home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
      || true
    - mkdir -p "$CI_PROJECT_DIR/pcaps" && scp -r "metal_instance:/home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
      "$CI_PROJECT_DIR/pcaps/test_pcaps-${ARCH}-${TAG}-${TEST_SET}" || true
    - PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
      opensuse_15.3 suse_12.5 fedora_38"
    - "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
      \ | grep -qw \"${TAG}\" ; then\n  export COLLECT_COMPLEXITY=yes\nfi\n"
    - echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
    - "if [ \"${COLLECT_COMPLEXITY}\" = \"yes\" ]; then\n  ssh metal_instance \"scp\
      \ ${MICRO_VM_IP}:/verifier-complexity.tar.gz /home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
      \ || true\n  scp \"metal_instance:/home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
      \ $DD_AGENT_TESTING_DIR/ || true\nfi\n"
    - inv -e kmt.tag-ci-job
    - $CI_PROJECT_DIR/tools/ci/junit_upload.sh "$DD_AGENT_TESTING_DIR/junit-*.tar.gz"
    allow_failure: true
    artifacts:
      expire_in: 2 weeks
      paths:
      - $DD_AGENT_TESTING_DIR/junit-$ARCH-$TAG-$TEST_SET.tar.gz
      - $DD_AGENT_TESTING_DIR/testjson-$ARCH-$TAG-$TEST_SET.tar.gz
      - $DD_AGENT_TESTING_DIR/verifier-complexity-$ARCH-$TAG-${TEST_COMPONENT}.tar.gz
      - $CI_PROJECT_DIR/logs
      - $CI_PROJECT_DIR/pcaps
      - $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log
      reports:
        annotations:
        - $EXTERNAL_LINKS_PATH
      when: always
    before_script:
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - mkdir -p ~/.aws
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
      || exit $?
    - export AWS_PROFILE=agent-qa-ci
    - touch $AWS_EC2_SSH_KEY_FILE && chmod 600 $AWS_EC2_SSH_KEY_FILE
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key > $AWS_EC2_SSH_KEY_FILE
      || exit $?
    - echo "" >> $AWS_EC2_SSH_KEY_FILE
    - chmod 600 $AWS_EC2_SSH_KEY_FILE
    - echo "CI_JOB_URL=${CI_JOB_URL}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_ID=${CI_JOB_ID}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_NAME=${CI_JOB_NAME}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_STAGE=${CI_JOB_STAGE}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - inv -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
    - PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
      opensuse_15.3 suse_12.5 fedora_38"
    - "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
      \ | grep -qw \"${TAG}\" ; then\n  export COLLECT_COMPLEXITY=yes\nfi\n"
    - echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_arm64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
    needs:
    - kmt_setup_env_secagent_arm64
    - upload_dependencies_secagent_arm64
    - upload_secagent_tests_arm64
    parallel:
      matrix:
      - TAG:
        - ubuntu_22.04
        - ubuntu_24.04
        - ubuntu_24.10
        - amazon_5.4
        - amazon_5.10
        - amazon_2023
        - fedora_37
        - fedora_38
        - debian_11
        - debian_12
        - oracle_8.9
        - oracle_9.3
        - rocky_8.5
        - rocky_9.3
+       - rocky_9.4
        - opensuse_15.5
        TEST_SET:
        - cws_host
    retry:
      exit_codes:
      - 42
      max: 2
      when:
      - job_execution_timeout
      - runner_system_failure
      - stuck_or_timeout_failure
      - unknown_failure
      - api_failure
      - scheduler_failure
      - stale_schedule
      - data_integrity_failure
    rules:
    - allow_failure: true
      if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - if: $RUN_KMT_TESTS == 'on'
    - changes:
        compare_to: main
        paths:
        - pkg/ebpf/**/*
        - pkg/security/**/*
        - pkg/eventmonitor/**/*
        - .gitlab/kernel_matrix_testing/security_agent.yml
        - .gitlab/kernel_matrix_testing/common.yml
        - .gitlab/source_test/ebpf.yml
        - test/new-e2e/tests/cws/**/*
        - test/new-e2e/system-probe/**/*
        - test/new-e2e/scenarios/system-probe/**/*
        - test/new-e2e/pkg/runner/**/*
        - test/new-e2e/pkg/utils/**/*
        - test/new-e2e/go.mod
        - tasks/security_agent.py
        - tasks/kmt.py
        - tasks/kernel_matrix_testing/*
    - allow_failure: true
      when: manual
    script:
    - INSTANCE_IP=$(jq --exit-status --arg ARCH $ARCH -r '.[$ARCH].ip' $CI_PROJECT_DIR/stack.output)
    - FILTER_TEAM="Name=tag:team,Values=ebpf-platform"
    - FILTER_MANAGED="Name=tag:managed-by,Values=pulumi"
    - FILTER_STATE="Name=instance-state-name,Values=running"
    - FILTER_PIPELINE="Name=tag:pipeline-id,Values=${CI_PIPELINE_ID}"
    - FILTER_ARCH="Name=tag:arch,Values=${ARCH}"
    - FILTER_INSTANCE_TYPE="Name=tag:instance-type,Values=${INSTANCE_TYPE}"
    - FILTER_TEST_COMPONENT="Name=tag:test-component,Values=${TEST_COMPONENT}"
    - QUERY_INSTANCE_IDS='Reservations[*].Instances[*].InstanceId'
    - QUERY_PRIVATE_IPS='Reservations[*].Instances[*].PrivateIpAddress'
    - RUNNING_INSTANCES=$(aws ec2 describe-instances --filters $FILTER_TEAM $FILTER_MANAGED
      $FILTER_PIPELINE $FILTER_TEST_COMPONENT "Name=private-ip-address,Values=$INSTANCE_IP"
      --output text --query $QUERY_INSTANCE_IDS | wc -l )
    - "if [ $RUNNING_INSTANCES -eq \"0\" ]; then\n  echo \"These jobs do not permit\
      \ retries. The go tests are retried a user-specified number of times automatically.\
      \ In order to re-run the tests, you must trigger the pipeline again\"\n  'false'\n\
      fi\n"
    - MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
    - MICRO_VM_NAME=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].id' $CI_PROJECT_DIR/stack.output)
    - GO_VERSION=$(inv go-version)
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - echo -e "Host metal_instance\nHostname $INSTANCE_IP\nUser ubuntu\nStrictHostKeyChecking
      no\nIdentityFile $AWS_EC2_SSH_KEY_FILE\n" | tee -a ~/.ssh/config
    - chmod 600 ~/.ssh/config
    - scp "$DD_AGENT_TESTING_DIR/job_env.txt" "metal_instance:/home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt"
    - ssh metal_instance "scp /home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt ${MICRO_VM_IP}:/job_env.txt"
    - NESTED_VM_CMD="/home/ubuntu/connector -host ${MICRO_VM_IP} -user root -ssh-file
      /home/kernel-version-testing/ddvm_rsa -vm-cmd 'CI=true /root/fetch_dependencies.sh
      ${ARCH} && COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY} /opt/micro-vm-init.sh -test-tools
      /opt/testing-tools -retry ${RETRY} -test-root /opt/${TEST_COMPONENT}-tests -packages-run-config
      /opt/${TEST_SET}.json'"
    - $CI_PROJECT_DIR/connector-$ARCH -host $INSTANCE_IP -user ubuntu -ssh-file $AWS_EC2_SSH_KEY_FILE
      -vm-cmd "${NESTED_VM_CMD}" -send-env-vars DD_API_KEY
    - ssh metal_instance "ssh ${MICRO_VM_IP} '/opt/testing-tools/test-json-review -flakes
      /opt/testing-tools/flakes.yaml -codeowners /opt/testing-tools/CODEOWNERS -test-root
      /opt/${TEST_COMPONENT}-tests'"
    - '[ ! -f $CI_PROJECT_DIR/daemon-${ARCH}.log ] && scp metal_instance:/home/ubuntu/daemon.log
      $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log'
    stage: kernel_matrix_testing_security_agent
    tags:
    - arch:arm64
    timeout: 1h 30m
    variables:
      ARCH: arm64
      AWS_EC2_SSH_KEY_FILE: $CI_PROJECT_DIR/ssh_key
      EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
      RETRY: 2
      TEST_COMPONENT: security-agent
kmt_run_secagent_tests_arm64_docker 
  kmt_run_secagent_tests_arm64_docker:
    after_script:
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - export MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
    - mkdir -p $CI_PROJECT_DIR/logs
    - ssh metal_instance "ssh ${MICRO_VM_IP} \"journalctl -u setup-ddvm.service\"" >
      $CI_PROJECT_DIR/logs/setup-ddvm.log || true
    - cat $CI_PROJECT_DIR/logs/setup-ddvm.log || true
    - ssh metal_instance "ssh ${MICRO_VM_IP} \"systemctl is-active setup-ddvm.service\""
      | tee $CI_PROJECT_DIR/logs/setup-ddvm.status || true
    - ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/junit.tar.gz /home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
      || true
    - scp "metal_instance:/home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
      || true
    - ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/testjson.tar.gz /home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
      || true
    - scp "metal_instance:/home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
      || true
    - ssh metal_instance "scp -r ${MICRO_VM_IP}:/tmp/test_pcaps /home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
      || true
    - mkdir -p "$CI_PROJECT_DIR/pcaps" && scp -r "metal_instance:/home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
      "$CI_PROJECT_DIR/pcaps/test_pcaps-${ARCH}-${TAG}-${TEST_SET}" || true
    - PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
      opensuse_15.3 suse_12.5 fedora_38"
    - "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
      \ | grep -qw \"${TAG}\" ; then\n  export COLLECT_COMPLEXITY=yes\nfi\n"
    - echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
    - "if [ \"${COLLECT_COMPLEXITY}\" = \"yes\" ]; then\n  ssh metal_instance \"scp\
      \ ${MICRO_VM_IP}:/verifier-complexity.tar.gz /home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
      \ || true\n  scp \"metal_instance:/home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
      \ $DD_AGENT_TESTING_DIR/ || true\nfi\n"
    - inv -e kmt.tag-ci-job
    - $CI_PROJECT_DIR/tools/ci/junit_upload.sh "$DD_AGENT_TESTING_DIR/junit-*.tar.gz"
    allow_failure: true
    artifacts:
      expire_in: 2 weeks
      paths:
      - $DD_AGENT_TESTING_DIR/junit-$ARCH-$TAG-$TEST_SET.tar.gz
      - $DD_AGENT_TESTING_DIR/testjson-$ARCH-$TAG-$TEST_SET.tar.gz
      - $DD_AGENT_TESTING_DIR/verifier-complexity-$ARCH-$TAG-${TEST_COMPONENT}.tar.gz
      - $CI_PROJECT_DIR/logs
      - $CI_PROJECT_DIR/pcaps
      - $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log
      reports:
        annotations:
        - $EXTERNAL_LINKS_PATH
      when: always
    before_script:
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - mkdir -p ~/.aws
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
      || exit $?
    - export AWS_PROFILE=agent-qa-ci
    - touch $AWS_EC2_SSH_KEY_FILE && chmod 600 $AWS_EC2_SSH_KEY_FILE
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key > $AWS_EC2_SSH_KEY_FILE
      || exit $?
    - echo "" >> $AWS_EC2_SSH_KEY_FILE
    - chmod 600 $AWS_EC2_SSH_KEY_FILE
    - echo "CI_JOB_URL=${CI_JOB_URL}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_ID=${CI_JOB_ID}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_NAME=${CI_JOB_NAME}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_STAGE=${CI_JOB_STAGE}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - inv -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
    - PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
      opensuse_15.3 suse_12.5 fedora_38"
    - "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
      \ | grep -qw \"${TAG}\" ; then\n  export COLLECT_COMPLEXITY=yes\nfi\n"
    - echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_arm64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
    needs:
    - kmt_setup_env_secagent_arm64
    - upload_dependencies_secagent_arm64
    - upload_secagent_tests_arm64
    parallel:
      matrix:
      - TAG:
        - ubuntu_22.04
        - ubuntu_24.04
        - ubuntu_24.10
        - amazon_5.4
        - amazon_5.10
        - amazon_2023
        - fedora_37
        - fedora_38
        - debian_11
        - debian_12
        - oracle_8.9
        - oracle_9.3
        - rocky_8.5
        - rocky_9.3
+       - rocky_9.4
        TEST_SET:
        - cws_docker
    retry:
      exit_codes:
      - 42
      max: 2
      when:
      - job_execution_timeout
      - runner_system_failure
      - stuck_or_timeout_failure
      - unknown_failure
      - api_failure
      - scheduler_failure
      - stale_schedule
      - data_integrity_failure
    rules:
    - allow_failure: true
      if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - if: $RUN_KMT_TESTS == 'on'
    - changes:
        compare_to: main
        paths:
        - pkg/ebpf/**/*
        - pkg/security/**/*
        - pkg/eventmonitor/**/*
        - .gitlab/kernel_matrix_testing/security_agent.yml
        - .gitlab/kernel_matrix_testing/common.yml
        - .gitlab/source_test/ebpf.yml
        - test/new-e2e/tests/cws/**/*
        - test/new-e2e/system-probe/**/*
        - test/new-e2e/scenarios/system-probe/**/*
        - test/new-e2e/pkg/runner/**/*
        - test/new-e2e/pkg/utils/**/*
        - test/new-e2e/go.mod
        - tasks/security_agent.py
        - tasks/kmt.py
        - tasks/kernel_matrix_testing/*
    - allow_failure: true
      when: manual
    script:
    - INSTANCE_IP=$(jq --exit-status --arg ARCH $ARCH -r '.[$ARCH].ip' $CI_PROJECT_DIR/stack.output)
    - FILTER_TEAM="Name=tag:team,Values=ebpf-platform"
    - FILTER_MANAGED="Name=tag:managed-by,Values=pulumi"
    - FILTER_STATE="Name=instance-state-name,Values=running"
    - FILTER_PIPELINE="Name=tag:pipeline-id,Values=${CI_PIPELINE_ID}"
    - FILTER_ARCH="Name=tag:arch,Values=${ARCH}"
    - FILTER_INSTANCE_TYPE="Name=tag:instance-type,Values=${INSTANCE_TYPE}"
    - FILTER_TEST_COMPONENT="Name=tag:test-component,Values=${TEST_COMPONENT}"
    - QUERY_INSTANCE_IDS='Reservations[*].Instances[*].InstanceId'
    - QUERY_PRIVATE_IPS='Reservations[*].Instances[*].PrivateIpAddress'
    - RUNNING_INSTANCES=$(aws ec2 describe-instances --filters $FILTER_TEAM $FILTER_MANAGED
      $FILTER_PIPELINE $FILTER_TEST_COMPONENT "Name=private-ip-address,Values=$INSTANCE_IP"
      --output text --query $QUERY_INSTANCE_IDS | wc -l )
    - "if [ $RUNNING_INSTANCES -eq \"0\" ]; then\n  echo \"These jobs do not permit\
      \ retries. The go tests are retried a user-specified number of times automatically.\
      \ In order to re-run the tests, you must trigger the pipeline again\"\n  'false'\n\
      fi\n"
    - MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
    - MICRO_VM_NAME=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].id' $CI_PROJECT_DIR/stack.output)
    - GO_VERSION=$(inv go-version)
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - echo -e "Host metal_instance\nHostname $INSTANCE_IP\nUser ubuntu\nStrictHostKeyChecking
      no\nIdentityFile $AWS_EC2_SSH_KEY_FILE\n" | tee -a ~/.ssh/config
    - chmod 600 ~/.ssh/config
    - scp "$DD_AGENT_TESTING_DIR/job_env.txt" "metal_instance:/home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt"
    - ssh metal_instance "scp /home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt ${MICRO_VM_IP}:/job_env.txt"
    - NESTED_VM_CMD="/home/ubuntu/connector -host ${MICRO_VM_IP} -user root -ssh-file
      /home/kernel-version-testing/ddvm_rsa -vm-cmd 'CI=true /root/fetch_dependencies.sh
      ${ARCH} && COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY} /opt/micro-vm-init.sh -test-tools
      /opt/testing-tools -retry ${RETRY} -test-root /opt/${TEST_COMPONENT}-tests -packages-run-config
      /opt/${TEST_SET}.json'"
    - $CI_PROJECT_DIR/connector-$ARCH -host $INSTANCE_IP -user ubuntu -ssh-file $AWS_EC2_SSH_KEY_FILE
      -vm-cmd "${NESTED_VM_CMD}" -send-env-vars DD_API_KEY
    - ssh metal_instance "ssh ${MICRO_VM_IP} '/opt/testing-tools/test-json-review -flakes
      /opt/testing-tools/flakes.yaml -codeowners /opt/testing-tools/CODEOWNERS -test-root
      /opt/${TEST_COMPONENT}-tests'"
    - '[ ! -f $CI_PROJECT_DIR/daemon-${ARCH}.log ] && scp metal_instance:/home/ubuntu/daemon.log
      $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log'
    stage: kernel_matrix_testing_security_agent
    tags:
    - arch:arm64
    timeout: 1h 30m
    variables:
      ARCH: arm64
      AWS_EC2_SSH_KEY_FILE: $CI_PROJECT_DIR/ssh_key
      EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
      RETRY: 2
      TEST_COMPONENT: security-agent
kmt_run_secagent_tests_x64 
  kmt_run_secagent_tests_x64:
    after_script:
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - export MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
    - mkdir -p $CI_PROJECT_DIR/logs
    - ssh metal_instance "ssh ${MICRO_VM_IP} \"journalctl -u setup-ddvm.service\"" >
      $CI_PROJECT_DIR/logs/setup-ddvm.log || true
    - cat $CI_PROJECT_DIR/logs/setup-ddvm.log || true
    - ssh metal_instance "ssh ${MICRO_VM_IP} \"systemctl is-active setup-ddvm.service\""
      | tee $CI_PROJECT_DIR/logs/setup-ddvm.status || true
    - ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/junit.tar.gz /home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
      || true
    - scp "metal_instance:/home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
      || true
    - ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/testjson.tar.gz /home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
      || true
    - scp "metal_instance:/home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
      || true
    - ssh metal_instance "scp -r ${MICRO_VM_IP}:/tmp/test_pcaps /home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
      || true
    - mkdir -p "$CI_PROJECT_DIR/pcaps" && scp -r "metal_instance:/home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
      "$CI_PROJECT_DIR/pcaps/test_pcaps-${ARCH}-${TAG}-${TEST_SET}" || true
    - PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
      opensuse_15.3 suse_12.5 fedora_38"
    - "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
      \ | grep -qw \"${TAG}\" ; then\n  export COLLECT_COMPLEXITY=yes\nfi\n"
    - echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
    - "if [ \"${COLLECT_COMPLEXITY}\" = \"yes\" ]; then\n  ssh metal_instance \"scp\
      \ ${MICRO_VM_IP}:/verifier-complexity.tar.gz /home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
      \ || true\n  scp \"metal_instance:/home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
      \ $DD_AGENT_TESTING_DIR/ || true\nfi\n"
    - inv -e kmt.tag-ci-job
    - $CI_PROJECT_DIR/tools/ci/junit_upload.sh "$DD_AGENT_TESTING_DIR/junit-*.tar.gz"
    allow_failure: true
    artifacts:
      expire_in: 2 weeks
      paths:
      - $DD_AGENT_TESTING_DIR/junit-$ARCH-$TAG-$TEST_SET.tar.gz
      - $DD_AGENT_TESTING_DIR/testjson-$ARCH-$TAG-$TEST_SET.tar.gz
      - $DD_AGENT_TESTING_DIR/verifier-complexity-$ARCH-$TAG-${TEST_COMPONENT}.tar.gz
      - $CI_PROJECT_DIR/logs
      - $CI_PROJECT_DIR/pcaps
      - $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log
      reports:
        annotations:
        - $EXTERNAL_LINKS_PATH
      when: always
    before_script:
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - mkdir -p ~/.aws
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
      || exit $?
    - export AWS_PROFILE=agent-qa-ci
    - touch $AWS_EC2_SSH_KEY_FILE && chmod 600 $AWS_EC2_SSH_KEY_FILE
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key > $AWS_EC2_SSH_KEY_FILE
      || exit $?
    - echo "" >> $AWS_EC2_SSH_KEY_FILE
    - chmod 600 $AWS_EC2_SSH_KEY_FILE
    - echo "CI_JOB_URL=${CI_JOB_URL}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_ID=${CI_JOB_ID}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_NAME=${CI_JOB_NAME}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_STAGE=${CI_JOB_STAGE}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - inv -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
    - PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
      opensuse_15.3 suse_12.5 fedora_38"
    - "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
      \ | grep -qw \"${TAG}\" ; then\n  export COLLECT_COMPLEXITY=yes\nfi\n"
    - echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_x64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
    needs:
    - kmt_setup_env_secagent_x64
    - upload_dependencies_secagent_x64
    - upload_secagent_tests_x64
    parallel:
      matrix:
      - TAG:
        - ubuntu_18.04
        - ubuntu_20.04
        - ubuntu_22.04
        - ubuntu_24.04
        - ubuntu_24.10
        - amazon_4.14
        - amazon_5.4
        - amazon_5.10
        - amazon_2023
        - fedora_37
        - fedora_38
        - debian_10
        - debian_11
        - debian_12
        - centos_7.9
        - oracle_8.9
        - oracle_9.3
        - rocky_8.5
        - rocky_9.3
+       - rocky_9.4
        - opensuse_15.3
        - opensuse_15.5
        - suse_12.5
        TEST_SET:
        - cws_host
    retry:
      exit_codes:
      - 42
      max: 2
      when:
      - job_execution_timeout
      - runner_system_failure
      - stuck_or_timeout_failure
      - unknown_failure
      - api_failure
      - scheduler_failure
      - stale_schedule
      - data_integrity_failure
    rules:
    - allow_failure: true
      if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - if: $RUN_KMT_TESTS == 'on'
    - changes:
        compare_to: main
        paths:
        - pkg/ebpf/**/*
        - pkg/security/**/*
        - pkg/eventmonitor/**/*
        - .gitlab/kernel_matrix_testing/security_agent.yml
        - .gitlab/kernel_matrix_testing/common.yml
        - .gitlab/source_test/ebpf.yml
        - test/new-e2e/tests/cws/**/*
        - test/new-e2e/system-probe/**/*
        - test/new-e2e/scenarios/system-probe/**/*
        - test/new-e2e/pkg/runner/**/*
        - test/new-e2e/pkg/utils/**/*
        - test/new-e2e/go.mod
        - tasks/security_agent.py
        - tasks/kmt.py
        - tasks/kernel_matrix_testing/*
    - allow_failure: true
      when: manual
    script:
    - INSTANCE_IP=$(jq --exit-status --arg ARCH $ARCH -r '.[$ARCH].ip' $CI_PROJECT_DIR/stack.output)
    - FILTER_TEAM="Name=tag:team,Values=ebpf-platform"
    - FILTER_MANAGED="Name=tag:managed-by,Values=pulumi"
    - FILTER_STATE="Name=instance-state-name,Values=running"
    - FILTER_PIPELINE="Name=tag:pipeline-id,Values=${CI_PIPELINE_ID}"
    - FILTER_ARCH="Name=tag:arch,Values=${ARCH}"
    - FILTER_INSTANCE_TYPE="Name=tag:instance-type,Values=${INSTANCE_TYPE}"
    - FILTER_TEST_COMPONENT="Name=tag:test-component,Values=${TEST_COMPONENT}"
    - QUERY_INSTANCE_IDS='Reservations[*].Instances[*].InstanceId'
    - QUERY_PRIVATE_IPS='Reservations[*].Instances[*].PrivateIpAddress'
    - RUNNING_INSTANCES=$(aws ec2 describe-instances --filters $FILTER_TEAM $FILTER_MANAGED
      $FILTER_PIPELINE $FILTER_TEST_COMPONENT "Name=private-ip-address,Values=$INSTANCE_IP"
      --output text --query $QUERY_INSTANCE_IDS | wc -l )
    - "if [ $RUNNING_INSTANCES -eq \"0\" ]; then\n  echo \"These jobs do not permit\
      \ retries. The go tests are retried a user-specified number of times automatically.\
      \ In order to re-run the tests, you must trigger the pipeline again\"\n  'false'\n\
      fi\n"
    - MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
    - MICRO_VM_NAME=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].id' $CI_PROJECT_DIR/stack.output)
    - GO_VERSION=$(inv go-version)
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - echo -e "Host metal_instance\nHostname $INSTANCE_IP\nUser ubuntu\nStrictHostKeyChecking
      no\nIdentityFile $AWS_EC2_SSH_KEY_FILE\n" | tee -a ~/.ssh/config
    - chmod 600 ~/.ssh/config
    - scp "$DD_AGENT_TESTING_DIR/job_env.txt" "metal_instance:/home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt"
    - ssh metal_instance "scp /home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt ${MICRO_VM_IP}:/job_env.txt"
    - NESTED_VM_CMD="/home/ubuntu/connector -host ${MICRO_VM_IP} -user root -ssh-file
      /home/kernel-version-testing/ddvm_rsa -vm-cmd 'CI=true /root/fetch_dependencies.sh
      ${ARCH} && COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY} /opt/micro-vm-init.sh -test-tools
      /opt/testing-tools -retry ${RETRY} -test-root /opt/${TEST_COMPONENT}-tests -packages-run-config
      /opt/${TEST_SET}.json'"
    - $CI_PROJECT_DIR/connector-$ARCH -host $INSTANCE_IP -user ubuntu -ssh-file $AWS_EC2_SSH_KEY_FILE
      -vm-cmd "${NESTED_VM_CMD}" -send-env-vars DD_API_KEY
    - ssh metal_instance "ssh ${MICRO_VM_IP} '/opt/testing-tools/test-json-review -flakes
      /opt/testing-tools/flakes.yaml -codeowners /opt/testing-tools/CODEOWNERS -test-root
      /opt/${TEST_COMPONENT}-tests'"
    - '[ ! -f $CI_PROJECT_DIR/daemon-${ARCH}.log ] && scp metal_instance:/home/ubuntu/daemon.log
      $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log'
    stage: kernel_matrix_testing_security_agent
    tags:
    - arch:amd64
    timeout: 1h 30m
    variables:
      ARCH: x86_64
      AWS_EC2_SSH_KEY_FILE: $CI_PROJECT_DIR/ssh_key
      EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
      RETRY: 2
      TEST_COMPONENT: security-agent
kmt_run_secagent_tests_x64_docker 
  kmt_run_secagent_tests_x64_docker:
    after_script:
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - export MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
    - mkdir -p $CI_PROJECT_DIR/logs
    - ssh metal_instance "ssh ${MICRO_VM_IP} \"journalctl -u setup-ddvm.service\"" >
      $CI_PROJECT_DIR/logs/setup-ddvm.log || true
    - cat $CI_PROJECT_DIR/logs/setup-ddvm.log || true
    - ssh metal_instance "ssh ${MICRO_VM_IP} \"systemctl is-active setup-ddvm.service\""
      | tee $CI_PROJECT_DIR/logs/setup-ddvm.status || true
    - ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/junit.tar.gz /home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
      || true
    - scp "metal_instance:/home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
      || true
    - ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/testjson.tar.gz /home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
      || true
    - scp "metal_instance:/home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
      || true
    - ssh metal_instance "scp -r ${MICRO_VM_IP}:/tmp/test_pcaps /home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
      || true
    - mkdir -p "$CI_PROJECT_DIR/pcaps" && scp -r "metal_instance:/home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
      "$CI_PROJECT_DIR/pcaps/test_pcaps-${ARCH}-${TAG}-${TEST_SET}" || true
    - PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
      opensuse_15.3 suse_12.5 fedora_38"
    - "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
      \ | grep -qw \"${TAG}\" ; then\n  export COLLECT_COMPLEXITY=yes\nfi\n"
    - echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
    - "if [ \"${COLLECT_COMPLEXITY}\" = \"yes\" ]; then\n  ssh metal_instance \"scp\
      \ ${MICRO_VM_IP}:/verifier-complexity.tar.gz /home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
      \ || true\n  scp \"metal_instance:/home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
      \ $DD_AGENT_TESTING_DIR/ || true\nfi\n"
    - inv -e kmt.tag-ci-job
    - $CI_PROJECT_DIR/tools/ci/junit_upload.sh "$DD_AGENT_TESTING_DIR/junit-*.tar.gz"
    allow_failure: true
    artifacts:
      expire_in: 2 weeks
      paths:
      - $DD_AGENT_TESTING_DIR/junit-$ARCH-$TAG-$TEST_SET.tar.gz
      - $DD_AGENT_TESTING_DIR/testjson-$ARCH-$TAG-$TEST_SET.tar.gz
      - $DD_AGENT_TESTING_DIR/verifier-complexity-$ARCH-$TAG-${TEST_COMPONENT}.tar.gz
      - $CI_PROJECT_DIR/logs
      - $CI_PROJECT_DIR/pcaps
      - $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log
      reports:
        annotations:
        - $EXTERNAL_LINKS_PATH
      when: always
    before_script:
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - mkdir -p ~/.aws
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
      || exit $?
    - export AWS_PROFILE=agent-qa-ci
    - touch $AWS_EC2_SSH_KEY_FILE && chmod 600 $AWS_EC2_SSH_KEY_FILE
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key > $AWS_EC2_SSH_KEY_FILE
      || exit $?
    - echo "" >> $AWS_EC2_SSH_KEY_FILE
    - chmod 600 $AWS_EC2_SSH_KEY_FILE
    - echo "CI_JOB_URL=${CI_JOB_URL}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_ID=${CI_JOB_ID}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_NAME=${CI_JOB_NAME}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - echo "CI_JOB_STAGE=${CI_JOB_STAGE}" >> $DD_AGENT_TESTING_DIR/job_env.txt
    - inv -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
    - PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
      opensuse_15.3 suse_12.5 fedora_38"
    - "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
      \ | grep -qw \"${TAG}\" ; then\n  export COLLECT_COMPLEXITY=yes\nfi\n"
    - echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_x64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
    needs:
    - kmt_setup_env_secagent_x64
    - upload_dependencies_secagent_x64
    - upload_secagent_tests_x64
    parallel:
      matrix:
      - TAG:
        - ubuntu_18.04
        - ubuntu_20.04
        - ubuntu_22.04
        - ubuntu_24.04
        - ubuntu_24.10
        - amazon_4.14
        - amazon_5.4
        - amazon_5.10
        - amazon_2023
        - fedora_37
        - fedora_38
        - debian_10
        - debian_11
        - debian_12
        - centos_7.9
        - oracle_8.9
        - oracle_9.3
        - rocky_8.5
        - rocky_9.3
+       - rocky_9.4
        TEST_SET:
        - cws_docker
    retry:
      exit_codes:
      - 42
      max: 2
      when:
      - job_execution_timeout
      - runner_system_failure
      - stuck_or_timeout_failure
      - unknown_failure
      - api_failure
      - scheduler_failure
      - stale_schedule
      - data_integrity_failure
    rules:
    - allow_failure: true
      if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - if: $RUN_KMT_TESTS == 'on'
    - changes:
        compare_to: main
        paths:
        - pkg/ebpf/**/*
        - pkg/security/**/*
        - pkg/eventmonitor/**/*
        - .gitlab/kernel_matrix_testing/security_agent.yml
        - .gitlab/kernel_matrix_testing/common.yml
        - .gitlab/source_test/ebpf.yml
        - test/new-e2e/tests/cws/**/*
        - test/new-e2e/system-probe/**/*
        - test/new-e2e/scenarios/system-probe/**/*
        - test/new-e2e/pkg/runner/**/*
        - test/new-e2e/pkg/utils/**/*
        - test/new-e2e/go.mod
        - tasks/security_agent.py
        - tasks/kmt.py
        - tasks/kernel_matrix_testing/*
    - allow_failure: true
      when: manual
    script:
    - INSTANCE_IP=$(jq --exit-status --arg ARCH $ARCH -r '.[$ARCH].ip' $CI_PROJECT_DIR/stack.output)
    - FILTER_TEAM="Name=tag:team,Values=ebpf-platform"
    - FILTER_MANAGED="Name=tag:managed-by,Values=pulumi"
    - FILTER_STATE="Name=instance-state-name,Values=running"
    - FILTER_PIPELINE="Name=tag:pipeline-id,Values=${CI_PIPELINE_ID}"
    - FILTER_ARCH="Name=tag:arch,Values=${ARCH}"
    - FILTER_INSTANCE_TYPE="Name=tag:instance-type,Values=${INSTANCE_TYPE}"
    - FILTER_TEST_COMPONENT="Name=tag:test-component,Values=${TEST_COMPONENT}"
    - QUERY_INSTANCE_IDS='Reservations[*].Instances[*].InstanceId'
    - QUERY_PRIVATE_IPS='Reservations[*].Instances[*].PrivateIpAddress'
    - RUNNING_INSTANCES=$(aws ec2 describe-instances --filters $FILTER_TEAM $FILTER_MANAGED
      $FILTER_PIPELINE $FILTER_TEST_COMPONENT "Name=private-ip-address,Values=$INSTANCE_IP"
      --output text --query $QUERY_INSTANCE_IDS | wc -l )
    - "if [ $RUNNING_INSTANCES -eq \"0\" ]; then\n  echo \"These jobs do not permit\
      \ retries. The go tests are retried a user-specified number of times automatically.\
      \ In order to re-run the tests, you must trigger the pipeline again\"\n  'false'\n\
      fi\n"
    - MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
    - MICRO_VM_NAME=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
      $TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
      | map(select(.tag==$TAG)) | .[].id' $CI_PROJECT_DIR/stack.output)
    - GO_VERSION=$(inv go-version)
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - echo -e "Host metal_instance\nHostname $INSTANCE_IP\nUser ubuntu\nStrictHostKeyChecking
      no\nIdentityFile $AWS_EC2_SSH_KEY_FILE\n" | tee -a ~/.ssh/config
    - chmod 600 ~/.ssh/config
    - scp "$DD_AGENT_TESTING_DIR/job_env.txt" "metal_instance:/home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt"
    - ssh metal_instance "scp /home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt ${MICRO_VM_IP}:/job_env.txt"
    - NESTED_VM_CMD="/home/ubuntu/connector -host ${MICRO_VM_IP} -user root -ssh-file
      /home/kernel-version-testing/ddvm_rsa -vm-cmd 'CI=true /root/fetch_dependencies.sh
      ${ARCH} && COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY} /opt/micro-vm-init.sh -test-tools
      /opt/testing-tools -retry ${RETRY} -test-root /opt/${TEST_COMPONENT}-tests -packages-run-config
      /opt/${TEST_SET}.json'"
    - $CI_PROJECT_DIR/connector-$ARCH -host $INSTANCE_IP -user ubuntu -ssh-file $AWS_EC2_SSH_KEY_FILE
      -vm-cmd "${NESTED_VM_CMD}" -send-env-vars DD_API_KEY
    - ssh metal_instance "ssh ${MICRO_VM_IP} '/opt/testing-tools/test-json-review -flakes
      /opt/testing-tools/flakes.yaml -codeowners /opt/testing-tools/CODEOWNERS -test-root
      /opt/${TEST_COMPONENT}-tests'"
    - '[ ! -f $CI_PROJECT_DIR/daemon-${ARCH}.log ] && scp metal_instance:/home/ubuntu/daemon.log
      $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log'
    stage: kernel_matrix_testing_security_agent
    tags:
    - arch:amd64
    timeout: 1h 30m
    variables:
      ARCH: x86_64
      AWS_EC2_SSH_KEY_FILE: $CI_PROJECT_DIR/ssh_key
      EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
      RETRY: 2
      TEST_COMPONENT: security-agent
kmt_secagent_cleanup_arm64 
  kmt_secagent_cleanup_arm64:
    after_script:
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - inv -e kmt.tag-ci-job
    before_script:
    - GITLAB_TOKEN=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $GITLAB_TOKEN read_api)
      || exit $?; export GITLAB_TOKEN
    - mkdir -p ~/.aws
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
      || exit $?
    - export AWS_PROFILE=agent-qa-ci
    image: registry.ddbuild.io/ci/test-infra-definitions/runner$TEST_INFRA_DEFINITIONS_BUILDIMAGES_SUFFIX:$TEST_INFRA_DEFINITIONS_BUILDIMAGES
    needs:
    - kmt_setup_env_secagent_arm64
-   - kmt_run_secagent_tests_arm64
?        ----
+   - kmt_secagent_tests_join_arm64
?                        +++++
-   - kmt_run_secagent_tests_arm64_ad
-   - kmt_run_secagent_tests_arm64_ebpfless
-   - kmt_run_secagent_tests_arm64_fentry
-   - kmt_run_secagent_tests_arm64_docker
-   - upload_dependencies_secagent_arm64
    - upload_secagent_tests_arm64
    rules:
    - allow_failure: true
      if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - if: $RUN_KMT_TESTS == 'on'
    - changes:
        compare_to: main
        paths:
        - pkg/ebpf/**/*
        - pkg/security/**/*
        - pkg/eventmonitor/**/*
        - .gitlab/kernel_matrix_testing/security_agent.yml
        - .gitlab/kernel_matrix_testing/common.yml
        - .gitlab/source_test/ebpf.yml
        - test/new-e2e/tests/cws/**/*
        - test/new-e2e/system-probe/**/*
        - test/new-e2e/scenarios/system-probe/**/*
        - test/new-e2e/pkg/runner/**/*
        - test/new-e2e/pkg/utils/**/*
        - test/new-e2e/go.mod
        - tasks/security_agent.py
        - tasks/kmt.py
        - tasks/kernel_matrix_testing/*
    - allow_failure: true
      when: manual
    script:
    - FILTER_TEAM="Name=tag:team,Values=ebpf-platform"
    - FILTER_MANAGED="Name=tag:managed-by,Values=pulumi"
    - FILTER_STATE="Name=instance-state-name,Values=running"
    - FILTER_PIPELINE="Name=tag:pipeline-id,Values=${CI_PIPELINE_ID}"
    - FILTER_ARCH="Name=tag:arch,Values=${ARCH}"
    - FILTER_INSTANCE_TYPE="Name=tag:instance-type,Values=${INSTANCE_TYPE}"
    - FILTER_TEST_COMPONENT="Name=tag:test-component,Values=${TEST_COMPONENT}"
    - QUERY_INSTANCE_IDS='Reservations[*].Instances[*].InstanceId'
    - QUERY_PRIVATE_IPS='Reservations[*].Instances[*].PrivateIpAddress'
    - inv kmt.wait-for-setup-job --pipeline-id $CI_PIPELINE_ID --arch $ARCH --component
      $TEST_COMPONENT
    - aws ec2 describe-instances --filters $FILTER_TEAM $FILTER_MANAGED $FILTER_PIPELINE
      $FILTER_ARCH $FILTER_INSTANCE_TYPE $FILTER_TEST_COMPONENT --output json --query
      $QUERY_INSTANCE_IDS | tee -a instance.json
    - INSTANCE_ID="$(jq -r '.[0][0]' < instance.json)"
    - echo ${INSTANCE_ID}
    - "if [[ \"${INSTANCE_ID}\" != \"\" ]] && [[ \"${INSTANCE_ID}\" != \"null\" ]];\
      \ then\n  aws ec2 terminate-instances --instance-ids \"${INSTANCE_ID}\"\nfi\n"
    stage: kernel_matrix_testing_cleanup
    tags:
    - arch:amd64
    variables:
      ARCH: arm64
      INSTANCE_TYPE: m6gd.metal
      TEST_COMPONENT: security-agent
    when: always
kmt_secagent_cleanup_x64 
  kmt_secagent_cleanup_x64:
    after_script:
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - inv -e kmt.tag-ci-job
    before_script:
    - GITLAB_TOKEN=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $GITLAB_TOKEN read_api)
      || exit $?; export GITLAB_TOKEN
    - mkdir -p ~/.aws
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
      || exit $?
    - export AWS_PROFILE=agent-qa-ci
    image: registry.ddbuild.io/ci/test-infra-definitions/runner$TEST_INFRA_DEFINITIONS_BUILDIMAGES_SUFFIX:$TEST_INFRA_DEFINITIONS_BUILDIMAGES
    needs:
    - kmt_setup_env_secagent_x64
-   - kmt_run_secagent_tests_x64
?        ----
+   - kmt_secagent_tests_join_x64
?                        +++++
-   - kmt_run_secagent_tests_x64_required
-   - kmt_run_secagent_tests_x64_ad
-   - kmt_run_secagent_tests_x64_ebpfless
-   - kmt_run_secagent_tests_x64_fentry
-   - kmt_run_secagent_tests_x64_docker
    - upload_dependencies_secagent_x64
    - upload_secagent_tests_x64
    rules:
    - allow_failure: true
      if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - if: $RUN_KMT_TESTS == 'on'
    - changes:
        compare_to: main
        paths:
        - pkg/ebpf/**/*
        - pkg/security/**/*
        - pkg/eventmonitor/**/*
        - .gitlab/kernel_matrix_testing/security_agent.yml
        - .gitlab/kernel_matrix_testing/common.yml
        - .gitlab/source_test/ebpf.yml
        - test/new-e2e/tests/cws/**/*
        - test/new-e2e/system-probe/**/*
        - test/new-e2e/scenarios/system-probe/**/*
        - test/new-e2e/pkg/runner/**/*
        - test/new-e2e/pkg/utils/**/*
        - test/new-e2e/go.mod
        - tasks/security_agent.py
        - tasks/kmt.py
        - tasks/kernel_matrix_testing/*
    - allow_failure: true
      when: manual
    script:
    - FILTER_TEAM="Name=tag:team,Values=ebpf-platform"
    - FILTER_MANAGED="Name=tag:managed-by,Values=pulumi"
    - FILTER_STATE="Name=instance-state-name,Values=running"
    - FILTER_PIPELINE="Name=tag:pipeline-id,Values=${CI_PIPELINE_ID}"
    - FILTER_ARCH="Name=tag:arch,Values=${ARCH}"
    - FILTER_INSTANCE_TYPE="Name=tag:instance-type,Values=${INSTANCE_TYPE}"
    - FILTER_TEST_COMPONENT="Name=tag:test-component,Values=${TEST_COMPONENT}"
    - QUERY_INSTANCE_IDS='Reservations[*].Instances[*].InstanceId'
    - QUERY_PRIVATE_IPS='Reservations[*].Instances[*].PrivateIpAddress'
    - inv kmt.wait-for-setup-job --pipeline-id $CI_PIPELINE_ID --arch $ARCH --component
      $TEST_COMPONENT
    - aws ec2 describe-instances --filters $FILTER_TEAM $FILTER_MANAGED $FILTER_PIPELINE
      $FILTER_ARCH $FILTER_INSTANCE_TYPE $FILTER_TEST_COMPONENT --output json --query
      $QUERY_INSTANCE_IDS | tee -a instance.json
    - INSTANCE_ID="$(jq -r '.[0][0]' < instance.json)"
    - echo ${INSTANCE_ID}
    - "if [[ \"${INSTANCE_ID}\" != \"\" ]] && [[ \"${INSTANCE_ID}\" != \"null\" ]];\
      \ then\n  aws ec2 terminate-instances --instance-ids \"${INSTANCE_ID}\"\nfi\n"
    stage: kernel_matrix_testing_cleanup
    tags:
    - arch:amd64
    variables:
      ARCH: x86_64
      INSTANCE_TYPE: m5d.metal
      TEST_COMPONENT: security-agent
    when: always

Added Jobs

.kmt_secagent_tests_join 
.kmt_secagent_tests_join:
  image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_arm64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
  rules:
  - allow_failure: true
    if: $CI_COMMIT_BRANCH == "main"
  - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
    when: never
  - if: $RUN_KMT_TESTS == 'on'
  - changes:
      compare_to: main
      paths:
      - pkg/ebpf/**/*
      - pkg/security/**/*
      - pkg/eventmonitor/**/*
      - .gitlab/kernel_matrix_testing/security_agent.yml
      - .gitlab/kernel_matrix_testing/common.yml
      - .gitlab/source_test/ebpf.yml
      - test/new-e2e/tests/cws/**/*
      - test/new-e2e/system-probe/**/*
      - test/new-e2e/scenarios/system-probe/**/*
      - test/new-e2e/pkg/runner/**/*
      - test/new-e2e/pkg/utils/**/*
      - test/new-e2e/go.mod
      - tasks/security_agent.py
      - tasks/kmt.py
      - tasks/kernel_matrix_testing/*
  - allow_failure: true
    when: manual
  script:
  - echo "nothing to do here"
  stage: kernel_matrix_testing_cleanup
  tags:
  - arch:arm64
kmt_secagent_tests_join_arm64 
kmt_secagent_tests_join_arm64:
  image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_arm64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
  needs:
  - kmt_run_secagent_tests_arm64
  - kmt_run_secagent_tests_arm64_ad
  - kmt_run_secagent_tests_arm64_ebpfless
  - kmt_run_secagent_tests_arm64_fentry
  - kmt_run_secagent_tests_arm64_docker
  rules:
  - allow_failure: true
    if: $CI_COMMIT_BRANCH == "main"
  - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
    when: never
  - if: $RUN_KMT_TESTS == 'on'
  - changes:
      compare_to: main
      paths:
      - pkg/ebpf/**/*
      - pkg/security/**/*
      - pkg/eventmonitor/**/*
      - .gitlab/kernel_matrix_testing/security_agent.yml
      - .gitlab/kernel_matrix_testing/common.yml
      - .gitlab/source_test/ebpf.yml
      - test/new-e2e/tests/cws/**/*
      - test/new-e2e/system-probe/**/*
      - test/new-e2e/scenarios/system-probe/**/*
      - test/new-e2e/pkg/runner/**/*
      - test/new-e2e/pkg/utils/**/*
      - test/new-e2e/go.mod
      - tasks/security_agent.py
      - tasks/kmt.py
      - tasks/kernel_matrix_testing/*
  - allow_failure: true
    when: manual
  script:
  - echo "nothing to do here"
  stage: kernel_matrix_testing_cleanup
  tags:
  - arch:arm64
kmt_secagent_tests_join_x64 
kmt_secagent_tests_join_x64:
  image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_arm64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
  needs:
  - kmt_run_secagent_tests_x64
  - kmt_run_secagent_tests_x64_required
  - kmt_run_secagent_tests_x64_ad
  - kmt_run_secagent_tests_x64_ebpfless
  - kmt_run_secagent_tests_x64_fentry
  - kmt_run_secagent_tests_x64_docker
  rules:
  - allow_failure: true
    if: $CI_COMMIT_BRANCH == "main"
  - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
    when: never
  - if: $RUN_KMT_TESTS == 'on'
  - changes:
      compare_to: main
      paths:
      - pkg/ebpf/**/*
      - pkg/security/**/*
      - pkg/eventmonitor/**/*
      - .gitlab/kernel_matrix_testing/security_agent.yml
      - .gitlab/kernel_matrix_testing/common.yml
      - .gitlab/source_test/ebpf.yml
      - test/new-e2e/tests/cws/**/*
      - test/new-e2e/system-probe/**/*
      - test/new-e2e/scenarios/system-probe/**/*
      - test/new-e2e/pkg/runner/**/*
      - test/new-e2e/pkg/utils/**/*
      - test/new-e2e/go.mod
      - tasks/security_agent.py
      - tasks/kmt.py
      - tasks/kernel_matrix_testing/*
  - allow_failure: true
    when: manual
  script:
  - echo "nothing to do here"
  stage: kernel_matrix_testing_cleanup
  tags:
  - arch:arm64

Changes Summary

Removed Modified Added Renamed
0 6 3 0

ℹ️ Diff available in the job log.

@paulcacheux paulcacheux force-pushed the paulcacheux/cws-rocky9.4-kmt branch from f220e2a to d6cc1ec Compare December 9, 2024 16:57
@cit-pr-commenter cit-pr-commenter
Copy link

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 5cf73502-fd83-4de2-8fcd-d3f3728859c5

Baseline: 40a840d
Comparison: d6cc1ec
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
➖ quality_gate_idle_all_features memory utilization +1.63 [+1.51, +1.75] 1 Logs bounds checks dashboard
➖ tcp_syslog_to_blackhole ingress throughput +1.15 [+1.09, +1.22] 1 Logs
➖ file_to_blackhole_1000ms_latency_linear_load egress throughput +0.13 [-0.33, +0.59] 1 Logs
➖ file_tree memory utilization +0.05 [-0.08, +0.18] 1 Logs
➖ file_to_blackhole_500ms_latency egress throughput +0.05 [-0.72, +0.81] 1 Logs
➖ file_to_blackhole_0ms_latency egress throughput +0.03 [-0.79, +0.85] 1 Logs
➖ uds_dogstatsd_to_api ingress throughput +0.01 [-0.08, +0.11] 1 Logs
➖ file_to_blackhole_0ms_latency_http1 egress throughput +0.01 [-0.87, +0.89] 1 Logs
➖ tcp_dd_logs_filter_exclude ingress throughput +0.00 [-0.01, +0.01] 1 Logs
➖ file_to_blackhole_300ms_latency egress throughput -0.03 [-0.66, +0.60] 1 Logs
➖ file_to_blackhole_0ms_latency_http2 egress throughput -0.04 [-0.91, +0.82] 1 Logs
➖ file_to_blackhole_100ms_latency egress throughput -0.08 [-0.79, +0.62] 1 Logs
➖ quality_gate_idle memory utilization -0.51 [-0.56, -0.46] 1 Logs bounds checks dashboard
➖ file_to_blackhole_1000ms_latency egress throughput -0.74 [-1.53, +0.05] 1 Logs
➖ otel_to_otel_logs ingress throughput -0.90 [-1.60, -0.21] 1 Logs
➖ quality_gate_logs % cpu utilization -1.15 [-4.08, +1.78] 1 Logs
➖ uds_dogstatsd_to_api_cpu % cpu utilization -1.59 [-2.31, -0.86] 1 Logs

Bounds Checks: ❌ Failed

perf experiment bounds_check_name replicates_passed links
❌ file_to_blackhole_100ms_latency lost_bytes 9/10
✅ file_to_blackhole_0ms_latency lost_bytes 10/10
✅ file_to_blackhole_0ms_latency memory_usage 10/10
✅ file_to_blackhole_0ms_latency_http1 lost_bytes 10/10
✅ file_to_blackhole_0ms_latency_http1 memory_usage 10/10
✅ file_to_blackhole_0ms_latency_http2 lost_bytes 10/10
✅ file_to_blackhole_0ms_latency_http2 memory_usage 10/10
✅ file_to_blackhole_1000ms_latency memory_usage 10/10
✅ file_to_blackhole_1000ms_latency_linear_load memory_usage 10/10
✅ file_to_blackhole_100ms_latency memory_usage 10/10
✅ file_to_blackhole_300ms_latency lost_bytes 10/10
✅ file_to_blackhole_300ms_latency memory_usage 10/10
✅ file_to_blackhole_500ms_latency lost_bytes 10/10
✅ file_to_blackhole_500ms_latency memory_usage 10/10
✅ quality_gate_idle memory_usage 10/10 bounds checks dashboard
✅ quality_gate_idle_all_features memory_usage 10/10 bounds checks dashboard
✅ quality_gate_logs lost_bytes 10/10
✅ quality_gate_logs memory_usage 10/10

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

  • quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.

@github-actions github-actions bot added component/system-probe medium review PR review might take time and removed short review PR is simple enough to be reviewed quickly labels Dec 9, 2024
@agent-platform-auto-pr
Copy link
Contributor

Test changes on VM

Use this command from test-infra-definitions to manually test this PR changes on a VM:

inv aws.create-vm --pipeline-id=50628234 --os-family=ubuntu

Note: This applies to commit 72bc4e0

@paulcacheux paulcacheux force-pushed the paulcacheux/cws-rocky9.4-kmt branch from 72bc4e0 to 3bc9e51 Compare December 9, 2024 20:45
@github-actions github-actions bot added short review PR is simple enough to be reviewed quickly and removed component/system-probe medium review PR review might take time labels Dec 9, 2024
@agent-platform-auto-pr
Copy link
Contributor

[Fast Unit Tests Report]

On pipeline 50636677 (CI Visibility). The following jobs did not run any unit tests:

Jobs:
  • tests_deb-arm64-py3
  • tests_deb-x64-py3
  • tests_flavor_dogstatsd_deb-x64
  • tests_flavor_heroku_deb-x64
  • tests_flavor_iot_deb-x64
  • tests_rpm-arm64-py3
  • tests_rpm-x64-py3
  • tests_windows-x64

If you modified Go files and expected unit tests to run in these jobs, please double check the job logs. If you think tests should have been executed reach out to #agent-devx-help

@agent-platform-auto-pr
Copy link
Contributor

Package size comparison

Comparison with ancestor b2fbed91df80d72c08950b8433e6981c3bc660b0

Diff per package
package diff status size ancestor threshold
datadog-agent-amd64-deb 0.00MB ✅ 1270.96MB 1270.96MB 140.00MB
datadog-iot-agent-amd64-deb 0.00MB ✅ 113.20MB 113.20MB 10.00MB
datadog-dogstatsd-amd64-deb 0.00MB ✅ 78.32MB 78.32MB 10.00MB
datadog-heroku-agent-amd64-deb 0.00MB ✅ 526.45MB 526.45MB 70.00MB
datadog-agent-x86_64-rpm 0.00MB ✅ 1280.20MB 1280.20MB 140.00MB
datadog-agent-x86_64-suse 0.00MB ✅ 1280.20MB 1280.20MB 140.00MB
datadog-iot-agent-x86_64-rpm 0.00MB ✅ 113.26MB 113.26MB 10.00MB
datadog-iot-agent-x86_64-suse 0.00MB ✅ 113.26MB 113.26MB 10.00MB
datadog-dogstatsd-x86_64-rpm 0.00MB ✅ 78.40MB 78.40MB 10.00MB
datadog-dogstatsd-x86_64-suse 0.00MB ✅ 78.40MB 78.40MB 10.00MB
datadog-agent-arm64-deb 0.00MB ✅ 1005.13MB 1005.13MB 140.00MB
datadog-iot-agent-arm64-deb 0.00MB ✅ 108.67MB 108.67MB 10.00MB
datadog-dogstatsd-arm64-deb 0.00MB ✅ 55.59MB 55.59MB 10.00MB
datadog-agent-aarch64-rpm 0.00MB ✅ 1014.35MB 1014.35MB 140.00MB
datadog-iot-agent-aarch64-rpm 0.00MB ✅ 108.74MB 108.74MB 10.00MB

Decision

✅ Passed

@paulcacheux
Copy link
Contributor Author

/merge

@dd-devflow
Copy link

dd-devflow bot commented Dec 10, 2024 •
edited
Loading

Devflow running: /merge

View all feedbacks in Devflow UI.

2024-12-10 07:05:57 UTC ℹ️ MergeQueue: waiting for PR to be ready

This merge request is not mergeable yet, because of pending checks/missing approvals. It will be added to the queue as soon as checks pass and/or get approvals.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.

2024-12-10 07:23:17 UTC ℹ️ MergeQueue: merge request added to the queue

The median merge time in main is 24m.

@dd-mergequeue dd-mergequeue bot merged commit 6615d8d into main Dec 10, 2024
238 checks passed
@dd-mergequeue dd-mergequeue bot deleted the paulcacheux/cws-rocky9.4-kmt branch December 10, 2024 07:56
@github-actions github-actions bot added this to the 7.62.0 milestone Dec 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@spikat spikat spikat approved these changes

Assignees
No one assigned
Labels
changelog/no-changelog qa/no-code-change No code change in Agent code requiring validation short review PR is simple enough to be reviewed quickly team/agent-security
Projects
None yet
Milestone
7.62.0
Development

Successfully merging this pull request may close these issues.
2 participants
@paulcacheux @spikat