[CWS] add kmt test run with just TestEventMonitor
#34767
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Gitlab CI Configuration ChangesModified Jobskmt_run_secagent_tests_x64_required kmt_run_secagent_tests_x64_required:
after_script:
- DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
|| exit $?; export DD_API_KEY
- export MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
$TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
| map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
- mkdir -p $CI_PROJECT_DIR/logs
- ssh metal_instance "ssh ${MICRO_VM_IP} \"journalctl -u setup-ddvm.service\"" >
$CI_PROJECT_DIR/logs/setup-ddvm.log || true
- cat $CI_PROJECT_DIR/logs/setup-ddvm.log || true
- ssh metal_instance "ssh ${MICRO_VM_IP} \"systemctl is-active setup-ddvm.service\""
| tee $CI_PROJECT_DIR/logs/setup-ddvm.status || true
- ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/junit.tar.gz /home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
|| true
- scp "metal_instance:/home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
|| true
- ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/testjson.tar.gz /home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
|| true
- scp "metal_instance:/home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
|| true
- ssh metal_instance "scp -r ${MICRO_VM_IP}:/tmp/test_pcaps /home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
|| true
- mkdir -p "$CI_PROJECT_DIR/pcaps" && scp -r "metal_instance:/home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
"$CI_PROJECT_DIR/pcaps/test_pcaps-${ARCH}-${TAG}-${TEST_SET}" || true
- PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
opensuse_15.3 suse_12.5 fedora_38"
- "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
\ | grep -qw \"${TAG}\" ; then\n export COLLECT_COMPLEXITY=yes\nfi\n"
- echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
- "if [ \"${COLLECT_COMPLEXITY}\" = \"yes\" ]; then\n ssh metal_instance \"scp\
\ ${MICRO_VM_IP}:/verifier-complexity.tar.gz /home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
\ || true\n scp \"metal_instance:/home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
\ $DD_AGENT_TESTING_DIR/ || true\nfi\n"
- inv -e kmt.tag-ci-job
- $CI_PROJECT_DIR/tools/ci/junit_upload.sh "$DD_AGENT_TESTING_DIR/junit-*.tar.gz"
- allow_failure: true
? ^^^
+ allow_failure: false
? ^^^^
artifacts:
expire_in: 2 weeks
paths:
- $DD_AGENT_TESTING_DIR/junit-$ARCH-$TAG-$TEST_SET.tar.gz
- $DD_AGENT_TESTING_DIR/testjson-$ARCH-$TAG-$TEST_SET.tar.gz
- $DD_AGENT_TESTING_DIR/verifier-complexity-$ARCH-$TAG-${TEST_COMPONENT}.tar.gz
- $CI_PROJECT_DIR/logs
- $CI_PROJECT_DIR/pcaps
- $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log
reports:
annotations:
- $EXTERNAL_LINKS_PATH
when: always
before_script:
- DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
|| exit $?; export DD_API_KEY
- mkdir -p ~/.aws
- $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
|| exit $?
- export AWS_PROFILE=agent-qa-ci
- touch $AWS_EC2_SSH_KEY_FILE && chmod 600 $AWS_EC2_SSH_KEY_FILE
- $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key > $AWS_EC2_SSH_KEY_FILE
|| exit $?
- echo "" >> $AWS_EC2_SSH_KEY_FILE
- chmod 600 $AWS_EC2_SSH_KEY_FILE
- echo "CI_JOB_URL=${CI_JOB_URL}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_ID=${CI_JOB_ID}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_NAME=${CI_JOB_NAME}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_STAGE=${CI_JOB_STAGE}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- inv -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
- PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
opensuse_15.3 suse_12.5 fedora_38"
- "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
\ | grep -qw \"${TAG}\" ; then\n export COLLECT_COMPLEXITY=yes\nfi\n"
- echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_x64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
needs:
- kmt_setup_env_secagent_x64
- upload_dependencies_secagent_x64
- upload_secagent_tests_x64
parallel:
matrix:
- TAG:
- ubuntu_24.10
TEST_SET:
- cws_req
retry:
exit_codes:
- 42
max: 2
when:
- job_execution_timeout
- runner_system_failure
- stuck_or_timeout_failure
- unknown_failure
- api_failure
- scheduler_failure
- stale_schedule
- data_integrity_failure
rules:
- allow_failure: true
if: $CI_COMMIT_BRANCH == "main"
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $RUN_KMT_TESTS == 'on'
- changes:
compare_to: main
paths:
- pkg/ebpf/**/*
- pkg/security/**/*
- pkg/eventmonitor/**/*
- .gitlab/kernel_matrix_testing/security_agent.yml
- .gitlab/kernel_matrix_testing/common.yml
- .gitlab/source_test/ebpf.yml
- test/new-e2e/tests/cws/**/*
- test/new-e2e/system-probe/**/*
- test/new-e2e/scenarios/system-probe/**/*
- test/new-e2e/pkg/runner/**/*
- test/new-e2e/pkg/utils/**/*
- test/new-e2e/go.mod
- tasks/security_agent.py
- tasks/kmt.py
- tasks/kernel_matrix_testing/*
- allow_failure: true
when: manual
script:
- INSTANCE_IP=$(jq --exit-status --arg ARCH $ARCH -r '.[$ARCH].ip' $CI_PROJECT_DIR/stack.output)
- FILTER_TEAM="Name=tag:team,Values=ebpf-platform"
- FILTER_MANAGED="Name=tag:managed-by,Values=pulumi"
- FILTER_STATE="Name=instance-state-name,Values=running"
- FILTER_PIPELINE="Name=tag:pipeline-id,Values=${CI_PIPELINE_ID}"
- FILTER_ARCH="Name=tag:arch,Values=${ARCH}"
- FILTER_INSTANCE_TYPE="Name=tag:instance-type,Values=${INSTANCE_TYPE}"
- FILTER_TEST_COMPONENT="Name=tag:test-component,Values=${TEST_COMPONENT}"
- QUERY_INSTANCE_IDS='Reservations[*].Instances[*].InstanceId'
- QUERY_PRIVATE_IPS='Reservations[*].Instances[*].PrivateIpAddress'
- RUNNING_INSTANCES=$(aws ec2 describe-instances --filters $FILTER_TEAM $FILTER_MANAGED
$FILTER_PIPELINE $FILTER_TEST_COMPONENT "Name=private-ip-address,Values=$INSTANCE_IP"
--output text --query $QUERY_INSTANCE_IDS | wc -l )
- "if [ $RUNNING_INSTANCES -eq \"0\" ]; then\n echo \"These jobs do not permit\
\ retries. The go tests are retried a user-specified number of times automatically.\
\ In order to re-run the tests, you must trigger the pipeline again\"\n 'false'\n\
fi\n"
- MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
$TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
| map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
- MICRO_VM_NAME=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
$TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
| map(select(.tag==$TAG)) | .[].id' $CI_PROJECT_DIR/stack.output)
- GO_VERSION=$(inv go-version)
- mkdir -p ~/.ssh && chmod 700 ~/.ssh
- echo -e "Host metal_instance\nHostname $INSTANCE_IP\nUser ubuntu\nStrictHostKeyChecking
no\nIdentityFile $AWS_EC2_SSH_KEY_FILE\n" | tee -a ~/.ssh/config
- chmod 600 ~/.ssh/config
- scp "$DD_AGENT_TESTING_DIR/job_env.txt" "metal_instance:/home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt"
- ssh metal_instance "scp /home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt ${MICRO_VM_IP}:/job_env.txt"
- NESTED_VM_CMD="/home/ubuntu/connector -host ${MICRO_VM_IP} -user root -ssh-file
/home/kernel-version-testing/ddvm_rsa -vm-cmd 'CI=true /root/fetch_dependencies.sh
${ARCH} && COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY} /opt/micro-vm-init.sh -test-tools
/opt/testing-tools -retry ${RETRY} -test-root /opt/${TEST_COMPONENT}-tests -packages-run-config
/opt/${TEST_SET}.json'"
- $CI_PROJECT_DIR/connector-$ARCH -host $INSTANCE_IP -user ubuntu -ssh-file $AWS_EC2_SSH_KEY_FILE
-vm-cmd "${NESTED_VM_CMD}" -send-env-vars DD_API_KEY
- ssh metal_instance "ssh ${MICRO_VM_IP} '/opt/testing-tools/test-json-review -flakes
/opt/testing-tools/flakes.yaml -codeowners /opt/testing-tools/CODEOWNERS -test-root
/opt/${TEST_COMPONENT}-tests'"
- '[ ! -f $CI_PROJECT_DIR/daemon-${ARCH}.log ] && scp metal_instance:/home/ubuntu/daemon.log
$CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log'
stage: kernel_matrix_testing_security_agent
tags:
- arch:amd64
timeout: 1h 30m
variables:
ARCH: x86_64
AWS_EC2_SSH_KEY_FILE: $CI_PROJECT_DIR/ssh_key
EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
RETRY: 2
TEST_COMPONENT: security-agentkmt_secagent_cleanup_x64 kmt_secagent_cleanup_x64:
after_script:
- DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
|| exit $?; export DD_API_KEY
- inv -e kmt.tag-ci-job
allow_failure: true
before_script:
- GITLAB_TOKEN=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $GITLAB_TOKEN read_api)
|| exit $?; export GITLAB_TOKEN
- mkdir -p ~/.aws
- $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
|| exit $?
- export AWS_PROFILE=agent-qa-ci
image: registry.ddbuild.io/ci/test-infra-definitions/runner$TEST_INFRA_DEFINITIONS_BUILDIMAGES_SUFFIX:$TEST_INFRA_DEFINITIONS_BUILDIMAGES
needs:
- kmt_setup_env_secagent_x64
- - kmt_secagent_tests_join_x64
+ - kmt_secagent_tests_join1_x64
? +
+ - kmt_secagent_tests_join2_x64
- upload_dependencies_secagent_x64
- upload_secagent_tests_x64
rules:
- allow_failure: true
if: $CI_COMMIT_BRANCH == "main"
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $RUN_KMT_TESTS == 'on'
- changes:
compare_to: main
paths:
- pkg/ebpf/**/*
- pkg/security/**/*
- pkg/eventmonitor/**/*
- .gitlab/kernel_matrix_testing/security_agent.yml
- .gitlab/kernel_matrix_testing/common.yml
- .gitlab/source_test/ebpf.yml
- test/new-e2e/tests/cws/**/*
- test/new-e2e/system-probe/**/*
- test/new-e2e/scenarios/system-probe/**/*
- test/new-e2e/pkg/runner/**/*
- test/new-e2e/pkg/utils/**/*
- test/new-e2e/go.mod
- tasks/security_agent.py
- tasks/kmt.py
- tasks/kernel_matrix_testing/*
- allow_failure: true
when: manual
script:
- FILTER_TEAM="Name=tag:team,Values=ebpf-platform"
- FILTER_MANAGED="Name=tag:managed-by,Values=pulumi"
- FILTER_STATE="Name=instance-state-name,Values=running"
- FILTER_PIPELINE="Name=tag:pipeline-id,Values=${CI_PIPELINE_ID}"
- FILTER_ARCH="Name=tag:arch,Values=${ARCH}"
- FILTER_INSTANCE_TYPE="Name=tag:instance-type,Values=${INSTANCE_TYPE}"
- FILTER_TEST_COMPONENT="Name=tag:test-component,Values=${TEST_COMPONENT}"
- QUERY_INSTANCE_IDS='Reservations[*].Instances[*].InstanceId'
- QUERY_PRIVATE_IPS='Reservations[*].Instances[*].PrivateIpAddress'
- inv kmt.wait-for-setup-job --pipeline-id $CI_PIPELINE_ID --arch $ARCH --component
$TEST_COMPONENT
- aws ec2 describe-instances --filters $FILTER_TEAM $FILTER_MANAGED $FILTER_PIPELINE
$FILTER_ARCH $FILTER_INSTANCE_TYPE $FILTER_TEST_COMPONENT --output json --query
$QUERY_INSTANCE_IDS | tee -a instance.json
- cat instance.json | jq -r 'map(.[]) | .[]' | grep -v "null" | xargs --no-run-if-empty
-n 1 -t aws ec2 terminate-instances --instance-ids
stage: kernel_matrix_testing_cleanup
tags:
- arch:amd64
variables:
ARCH: x86_64
INSTANCE_TYPE: m5d.metal
TEST_COMPONENT: security-agent
when: alwayskmt_secagent_tests_join_arm64 kmt_secagent_tests_join_arm64:
image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_arm64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
needs:
- kmt_run_secagent_tests_arm64
+ - kmt_run_secagent_tests_arm64_peds
- kmt_run_secagent_tests_arm64_ad
- kmt_run_secagent_tests_arm64_ebpfless
- kmt_run_secagent_tests_arm64_docker
rules:
- allow_failure: true
if: $CI_COMMIT_BRANCH == "main"
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $RUN_KMT_TESTS == 'on'
- changes:
compare_to: main
paths:
- pkg/ebpf/**/*
- pkg/security/**/*
- pkg/eventmonitor/**/*
- .gitlab/kernel_matrix_testing/security_agent.yml
- .gitlab/kernel_matrix_testing/common.yml
- .gitlab/source_test/ebpf.yml
- test/new-e2e/tests/cws/**/*
- test/new-e2e/system-probe/**/*
- test/new-e2e/scenarios/system-probe/**/*
- test/new-e2e/pkg/runner/**/*
- test/new-e2e/pkg/utils/**/*
- test/new-e2e/go.mod
- tasks/security_agent.py
- tasks/kmt.py
- tasks/kernel_matrix_testing/*
- allow_failure: true
when: manual
script:
- echo "nothing to do here"
stage: kernel_matrix_testing_cleanup
tags:
- arch:arm64Added Jobs.kmt_run_secagent_tests_required.kmt_run_secagent_tests_required:
allow_failure: false
artifacts:
expire_in: 2 weeks
paths:
- $DD_AGENT_TESTING_DIR/junit-$ARCH-$TAG-$TEST_SET.tar.gz
- $DD_AGENT_TESTING_DIR/testjson-$ARCH-$TAG-$TEST_SET.tar.gz
- $DD_AGENT_TESTING_DIR/verifier-complexity-$ARCH-$TAG-${TEST_COMPONENT}.tar.gz
- $CI_PROJECT_DIR/logs
- $CI_PROJECT_DIR/pcaps
- $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log
reports:
annotations:
- $EXTERNAL_LINKS_PATH
when: always
before_script:
- DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
|| exit $?; export DD_API_KEY
- mkdir -p ~/.aws
- $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
|| exit $?
- export AWS_PROFILE=agent-qa-ci
- touch $AWS_EC2_SSH_KEY_FILE && chmod 600 $AWS_EC2_SSH_KEY_FILE
- $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key > $AWS_EC2_SSH_KEY_FILE
|| exit $?
- echo "" >> $AWS_EC2_SSH_KEY_FILE
- chmod 600 $AWS_EC2_SSH_KEY_FILE
- echo "CI_JOB_URL=${CI_JOB_URL}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_ID=${CI_JOB_ID}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_NAME=${CI_JOB_NAME}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_STAGE=${CI_JOB_STAGE}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- inv -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
- PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
opensuse_15.3 suse_12.5 fedora_38"
- "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
\ | grep -qw \"${TAG}\" ; then\n export COLLECT_COMPLEXITY=yes\nfi\n"
- echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
retry:
exit_codes: 42
max: 2
when:
- job_execution_timeout
- runner_system_failure
- stuck_or_timeout_failure
- unknown_failure
- api_failure
- scheduler_failure
- stale_schedule
- data_integrity_failure
rules:
- allow_failure: true
if: $CI_COMMIT_BRANCH == "main"
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $RUN_KMT_TESTS == 'on'
- changes:
compare_to: main
paths:
- pkg/ebpf/**/*
- pkg/security/**/*
- pkg/eventmonitor/**/*
- .gitlab/kernel_matrix_testing/security_agent.yml
- .gitlab/kernel_matrix_testing/common.yml
- .gitlab/source_test/ebpf.yml
- test/new-e2e/tests/cws/**/*
- test/new-e2e/system-probe/**/*
- test/new-e2e/scenarios/system-probe/**/*
- test/new-e2e/pkg/runner/**/*
- test/new-e2e/pkg/utils/**/*
- test/new-e2e/go.mod
- tasks/security_agent.py
- tasks/kmt.py
- tasks/kernel_matrix_testing/*
- allow_failure: true
when: manual
script:
- INSTANCE_IP=$(jq --exit-status --arg ARCH $ARCH -r '.[$ARCH].ip' $CI_PROJECT_DIR/stack.output)
- FILTER_TEAM="Name=tag:team,Values=ebpf-platform"
- FILTER_MANAGED="Name=tag:managed-by,Values=pulumi"
- FILTER_STATE="Name=instance-state-name,Values=running"
- FILTER_PIPELINE="Name=tag:pipeline-id,Values=${CI_PIPELINE_ID}"
- FILTER_ARCH="Name=tag:arch,Values=${ARCH}"
- FILTER_INSTANCE_TYPE="Name=tag:instance-type,Values=${INSTANCE_TYPE}"
- FILTER_TEST_COMPONENT="Name=tag:test-component,Values=${TEST_COMPONENT}"
- QUERY_INSTANCE_IDS='Reservations[*].Instances[*].InstanceId'
- QUERY_PRIVATE_IPS='Reservations[*].Instances[*].PrivateIpAddress'
- RUNNING_INSTANCES=$(aws ec2 describe-instances --filters $FILTER_TEAM $FILTER_MANAGED
$FILTER_PIPELINE $FILTER_TEST_COMPONENT "Name=private-ip-address,Values=$INSTANCE_IP"
--output text --query $QUERY_INSTANCE_IDS | wc -l )
- "if [ $RUNNING_INSTANCES -eq \"0\" ]; then\n echo \"These jobs do not permit\
\ retries. The go tests are retried a user-specified number of times automatically.\
\ In order to re-run the tests, you must trigger the pipeline again\"\n 'false'\n\
fi\n"
- MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
$TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
| map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
- MICRO_VM_NAME=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
$TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
| map(select(.tag==$TAG)) | .[].id' $CI_PROJECT_DIR/stack.output)
- GO_VERSION=$(inv go-version)
- mkdir -p ~/.ssh && chmod 700 ~/.ssh
- echo -e "Host metal_instance\nHostname $INSTANCE_IP\nUser ubuntu\nStrictHostKeyChecking
no\nIdentityFile $AWS_EC2_SSH_KEY_FILE\n" | tee -a ~/.ssh/config
- chmod 600 ~/.ssh/config
- scp "$DD_AGENT_TESTING_DIR/job_env.txt" "metal_instance:/home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt"
- ssh metal_instance "scp /home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt ${MICRO_VM_IP}:/job_env.txt"
- NESTED_VM_CMD="/home/ubuntu/connector -host ${MICRO_VM_IP} -user root -ssh-file
/home/kernel-version-testing/ddvm_rsa -vm-cmd 'CI=true /root/fetch_dependencies.sh
${ARCH} && COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY} /opt/micro-vm-init.sh -test-tools
/opt/testing-tools -retry ${RETRY} -test-root /opt/${TEST_COMPONENT}-tests -packages-run-config
/opt/${TEST_SET}.json'"
- $CI_PROJECT_DIR/connector-$ARCH -host $INSTANCE_IP -user ubuntu -ssh-file $AWS_EC2_SSH_KEY_FILE
-vm-cmd "${NESTED_VM_CMD}" -send-env-vars DD_API_KEY
- ssh metal_instance "ssh ${MICRO_VM_IP} '/opt/testing-tools/test-json-review -flakes
/opt/testing-tools/flakes.yaml -codeowners /opt/testing-tools/CODEOWNERS -test-root
/opt/${TEST_COMPONENT}-tests'"
- '[ ! -f $CI_PROJECT_DIR/daemon-${ARCH}.log ] && scp metal_instance:/home/ubuntu/daemon.log
$CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log'
stage: kernel_matrix_testing_security_agent
timeout: 1h 30m
variables:
AWS_EC2_SSH_KEY_FILE: $CI_PROJECT_DIR/ssh_key
EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
RETRY: 2
TEST_COMPONENT: security-agentkmt_run_secagent_tests_arm64_pedskmt_run_secagent_tests_arm64_peds:
after_script:
- DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
|| exit $?; export DD_API_KEY
- export MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
$TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
| map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
- mkdir -p $CI_PROJECT_DIR/logs
- ssh metal_instance "ssh ${MICRO_VM_IP} \"journalctl -u setup-ddvm.service\"" >
$CI_PROJECT_DIR/logs/setup-ddvm.log || true
- cat $CI_PROJECT_DIR/logs/setup-ddvm.log || true
- ssh metal_instance "ssh ${MICRO_VM_IP} \"systemctl is-active setup-ddvm.service\""
| tee $CI_PROJECT_DIR/logs/setup-ddvm.status || true
- ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/junit.tar.gz /home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
|| true
- scp "metal_instance:/home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
|| true
- ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/testjson.tar.gz /home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
|| true
- scp "metal_instance:/home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
|| true
- ssh metal_instance "scp -r ${MICRO_VM_IP}:/tmp/test_pcaps /home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
|| true
- mkdir -p "$CI_PROJECT_DIR/pcaps" && scp -r "metal_instance:/home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
"$CI_PROJECT_DIR/pcaps/test_pcaps-${ARCH}-${TAG}-${TEST_SET}" || true
- PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
opensuse_15.3 suse_12.5 fedora_38"
- "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
\ | grep -qw \"${TAG}\" ; then\n export COLLECT_COMPLEXITY=yes\nfi\n"
- echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
- "if [ \"${COLLECT_COMPLEXITY}\" = \"yes\" ]; then\n ssh metal_instance \"scp\
\ ${MICRO_VM_IP}:/verifier-complexity.tar.gz /home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
\ || true\n scp \"metal_instance:/home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
\ $DD_AGENT_TESTING_DIR/ || true\nfi\n"
- inv -e kmt.tag-ci-job
- $CI_PROJECT_DIR/tools/ci/junit_upload.sh "$DD_AGENT_TESTING_DIR/junit-*.tar.gz"
allow_failure: false
artifacts:
expire_in: 2 weeks
paths:
- $DD_AGENT_TESTING_DIR/junit-$ARCH-$TAG-$TEST_SET.tar.gz
- $DD_AGENT_TESTING_DIR/testjson-$ARCH-$TAG-$TEST_SET.tar.gz
- $DD_AGENT_TESTING_DIR/verifier-complexity-$ARCH-$TAG-${TEST_COMPONENT}.tar.gz
- $CI_PROJECT_DIR/logs
- $CI_PROJECT_DIR/pcaps
- $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log
reports:
annotations:
- $EXTERNAL_LINKS_PATH
when: always
before_script:
- DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
|| exit $?; export DD_API_KEY
- mkdir -p ~/.aws
- $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
|| exit $?
- export AWS_PROFILE=agent-qa-ci
- touch $AWS_EC2_SSH_KEY_FILE && chmod 600 $AWS_EC2_SSH_KEY_FILE
- $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key > $AWS_EC2_SSH_KEY_FILE
|| exit $?
- echo "" >> $AWS_EC2_SSH_KEY_FILE
- chmod 600 $AWS_EC2_SSH_KEY_FILE
- echo "CI_JOB_URL=${CI_JOB_URL}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_ID=${CI_JOB_ID}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_NAME=${CI_JOB_NAME}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_STAGE=${CI_JOB_STAGE}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- inv -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
- PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
opensuse_15.3 suse_12.5 fedora_38"
- "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
\ | grep -qw \"${TAG}\" ; then\n export COLLECT_COMPLEXITY=yes\nfi\n"
- echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_arm64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
needs:
- kmt_setup_env_secagent_arm64
- upload_dependencies_secagent_arm64
- upload_secagent_tests_arm64
parallel:
matrix:
- TAG:
- ubuntu_22.04
- ubuntu_24.04
- ubuntu_24.10
- amazon_5.4
- amazon_5.10
- amazon_2023
- fedora_37
- fedora_38
- debian_11
- debian_12
- oracle_8.9
- oracle_9.3
- rocky_8.5
- rocky_9.3
- rocky_9.4
- opensuse_15.5
TEST_SET:
- cws_peds
retry:
exit_codes:
- 42
max: 2
when:
- job_execution_timeout
- runner_system_failure
- stuck_or_timeout_failure
- unknown_failure
- api_failure
- scheduler_failure
- stale_schedule
- data_integrity_failure
rules:
- allow_failure: true
if: $CI_COMMIT_BRANCH == "main"
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $RUN_KMT_TESTS == 'on'
- changes:
compare_to: main
paths:
- pkg/ebpf/**/*
- pkg/security/**/*
- pkg/eventmonitor/**/*
- .gitlab/kernel_matrix_testing/security_agent.yml
- .gitlab/kernel_matrix_testing/common.yml
- .gitlab/source_test/ebpf.yml
- test/new-e2e/tests/cws/**/*
- test/new-e2e/system-probe/**/*
- test/new-e2e/scenarios/system-probe/**/*
- test/new-e2e/pkg/runner/**/*
- test/new-e2e/pkg/utils/**/*
- test/new-e2e/go.mod
- tasks/security_agent.py
- tasks/kmt.py
- tasks/kernel_matrix_testing/*
- allow_failure: true
when: manual
script:
- INSTANCE_IP=$(jq --exit-status --arg ARCH $ARCH -r '.[$ARCH].ip' $CI_PROJECT_DIR/stack.output)
- FILTER_TEAM="Name=tag:team,Values=ebpf-platform"
- FILTER_MANAGED="Name=tag:managed-by,Values=pulumi"
- FILTER_STATE="Name=instance-state-name,Values=running"
- FILTER_PIPELINE="Name=tag:pipeline-id,Values=${CI_PIPELINE_ID}"
- FILTER_ARCH="Name=tag:arch,Values=${ARCH}"
- FILTER_INSTANCE_TYPE="Name=tag:instance-type,Values=${INSTANCE_TYPE}"
- FILTER_TEST_COMPONENT="Name=tag:test-component,Values=${TEST_COMPONENT}"
- QUERY_INSTANCE_IDS='Reservations[*].Instances[*].InstanceId'
- QUERY_PRIVATE_IPS='Reservations[*].Instances[*].PrivateIpAddress'
- RUNNING_INSTANCES=$(aws ec2 describe-instances --filters $FILTER_TEAM $FILTER_MANAGED
$FILTER_PIPELINE $FILTER_TEST_COMPONENT "Name=private-ip-address,Values=$INSTANCE_IP"
--output text --query $QUERY_INSTANCE_IDS | wc -l )
- "if [ $RUNNING_INSTANCES -eq \"0\" ]; then\n echo \"These jobs do not permit\
\ retries. The go tests are retried a user-specified number of times automatically.\
\ In order to re-run the tests, you must trigger the pipeline again\"\n 'false'\n\
fi\n"
- MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
$TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
| map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
- MICRO_VM_NAME=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
$TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
| map(select(.tag==$TAG)) | .[].id' $CI_PROJECT_DIR/stack.output)
- GO_VERSION=$(inv go-version)
- mkdir -p ~/.ssh && chmod 700 ~/.ssh
- echo -e "Host metal_instance\nHostname $INSTANCE_IP\nUser ubuntu\nStrictHostKeyChecking
no\nIdentityFile $AWS_EC2_SSH_KEY_FILE\n" | tee -a ~/.ssh/config
- chmod 600 ~/.ssh/config
- scp "$DD_AGENT_TESTING_DIR/job_env.txt" "metal_instance:/home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt"
- ssh metal_instance "scp /home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt ${MICRO_VM_IP}:/job_env.txt"
- NESTED_VM_CMD="/home/ubuntu/connector -host ${MICRO_VM_IP} -user root -ssh-file
/home/kernel-version-testing/ddvm_rsa -vm-cmd 'CI=true /root/fetch_dependencies.sh
${ARCH} && COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY} /opt/micro-vm-init.sh -test-tools
/opt/testing-tools -retry ${RETRY} -test-root /opt/${TEST_COMPONENT}-tests -packages-run-config
/opt/${TEST_SET}.json'"
- $CI_PROJECT_DIR/connector-$ARCH -host $INSTANCE_IP -user ubuntu -ssh-file $AWS_EC2_SSH_KEY_FILE
-vm-cmd "${NESTED_VM_CMD}" -send-env-vars DD_API_KEY
- ssh metal_instance "ssh ${MICRO_VM_IP} '/opt/testing-tools/test-json-review -flakes
/opt/testing-tools/flakes.yaml -codeowners /opt/testing-tools/CODEOWNERS -test-root
/opt/${TEST_COMPONENT}-tests'"
- '[ ! -f $CI_PROJECT_DIR/daemon-${ARCH}.log ] && scp metal_instance:/home/ubuntu/daemon.log
$CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log'
stage: kernel_matrix_testing_security_agent
tags:
- arch:arm64
timeout: 1h 30m
variables:
ARCH: arm64
AWS_EC2_SSH_KEY_FILE: $CI_PROJECT_DIR/ssh_key
EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
RETRY: 2
TEST_COMPONENT: security-agentkmt_run_secagent_tests_x64_pedskmt_run_secagent_tests_x64_peds:
after_script:
- DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
|| exit $?; export DD_API_KEY
- export MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
$TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
| map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
- mkdir -p $CI_PROJECT_DIR/logs
- ssh metal_instance "ssh ${MICRO_VM_IP} \"journalctl -u setup-ddvm.service\"" >
$CI_PROJECT_DIR/logs/setup-ddvm.log || true
- cat $CI_PROJECT_DIR/logs/setup-ddvm.log || true
- ssh metal_instance "ssh ${MICRO_VM_IP} \"systemctl is-active setup-ddvm.service\""
| tee $CI_PROJECT_DIR/logs/setup-ddvm.status || true
- ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/junit.tar.gz /home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
|| true
- scp "metal_instance:/home/ubuntu/junit-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
|| true
- ssh metal_instance "scp ${MICRO_VM_IP}:/ci-visibility/testjson.tar.gz /home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz"
|| true
- scp "metal_instance:/home/ubuntu/testjson-${ARCH}-${TAG}-${TEST_SET}.tar.gz" $DD_AGENT_TESTING_DIR/
|| true
- ssh metal_instance "scp -r ${MICRO_VM_IP}:/tmp/test_pcaps /home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
|| true
- mkdir -p "$CI_PROJECT_DIR/pcaps" && scp -r "metal_instance:/home/ubuntu/test_pcaps-${ARCH}-${TAG}-${TEST_SET}"
"$CI_PROJECT_DIR/pcaps/test_pcaps-${ARCH}-${TAG}-${TEST_SET}" || true
- PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
opensuse_15.3 suse_12.5 fedora_38"
- "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
\ | grep -qw \"${TAG}\" ; then\n export COLLECT_COMPLEXITY=yes\nfi\n"
- echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
- "if [ \"${COLLECT_COMPLEXITY}\" = \"yes\" ]; then\n ssh metal_instance \"scp\
\ ${MICRO_VM_IP}:/verifier-complexity.tar.gz /home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
\ || true\n scp \"metal_instance:/home/ubuntu/verifier-complexity-${ARCH}-${TAG}-${TEST_COMPONENT}.tar.gz\"\
\ $DD_AGENT_TESTING_DIR/ || true\nfi\n"
- inv -e kmt.tag-ci-job
- $CI_PROJECT_DIR/tools/ci/junit_upload.sh "$DD_AGENT_TESTING_DIR/junit-*.tar.gz"
allow_failure: false
artifacts:
expire_in: 2 weeks
paths:
- $DD_AGENT_TESTING_DIR/junit-$ARCH-$TAG-$TEST_SET.tar.gz
- $DD_AGENT_TESTING_DIR/testjson-$ARCH-$TAG-$TEST_SET.tar.gz
- $DD_AGENT_TESTING_DIR/verifier-complexity-$ARCH-$TAG-${TEST_COMPONENT}.tar.gz
- $CI_PROJECT_DIR/logs
- $CI_PROJECT_DIR/pcaps
- $CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log
reports:
annotations:
- $EXTERNAL_LINKS_PATH
when: always
before_script:
- DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
|| exit $?; export DD_API_KEY
- mkdir -p ~/.aws
- $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config
|| exit $?
- export AWS_PROFILE=agent-qa-ci
- touch $AWS_EC2_SSH_KEY_FILE && chmod 600 $AWS_EC2_SSH_KEY_FILE
- $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key > $AWS_EC2_SSH_KEY_FILE
|| exit $?
- echo "" >> $AWS_EC2_SSH_KEY_FILE
- chmod 600 $AWS_EC2_SSH_KEY_FILE
- echo "CI_JOB_URL=${CI_JOB_URL}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_ID=${CI_JOB_ID}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_NAME=${CI_JOB_NAME}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- echo "CI_JOB_STAGE=${CI_JOB_STAGE}" >> $DD_AGENT_TESTING_DIR/job_env.txt
- inv -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
- PLATFORMS_FOR_COMPLEXITY_COLLECTION="amazon_5.4 debian_10 ubuntu_18.04 centos_8
opensuse_15.3 suse_12.5 fedora_38"
- "if [ \"${TEST_SET}\" = \"no_usm\" ] && echo \"${PLATFORMS_FOR_COMPLEXITY_COLLECTION}\"\
\ | grep -qw \"${TAG}\" ; then\n export COLLECT_COMPLEXITY=yes\nfi\n"
- echo "COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY}"
image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_x64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
needs:
- kmt_setup_env_secagent_x64
- upload_dependencies_secagent_x64
- upload_secagent_tests_x64
parallel:
matrix:
- TAG:
- ubuntu_18.04
- ubuntu_20.04
- ubuntu_22.04
- ubuntu_24.04
- ubuntu_24.10
- amazon_4.14
- amazon_5.4
- amazon_5.10
- amazon_2023
- fedora_37
- fedora_38
- debian_10
- debian_11
- debian_12
- centos_7.9
- oracle_8.9
- oracle_9.3
- rocky_8.5
- rocky_9.3
- rocky_9.4
- opensuse_15.3
- opensuse_15.5
- suse_12.5
TEST_SET:
- cws_peds
retry:
exit_codes:
- 42
max: 2
when:
- job_execution_timeout
- runner_system_failure
- stuck_or_timeout_failure
- unknown_failure
- api_failure
- scheduler_failure
- stale_schedule
- data_integrity_failure
rules:
- allow_failure: true
if: $CI_COMMIT_BRANCH == "main"
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $RUN_KMT_TESTS == 'on'
- changes:
compare_to: main
paths:
- pkg/ebpf/**/*
- pkg/security/**/*
- pkg/eventmonitor/**/*
- .gitlab/kernel_matrix_testing/security_agent.yml
- .gitlab/kernel_matrix_testing/common.yml
- .gitlab/source_test/ebpf.yml
- test/new-e2e/tests/cws/**/*
- test/new-e2e/system-probe/**/*
- test/new-e2e/scenarios/system-probe/**/*
- test/new-e2e/pkg/runner/**/*
- test/new-e2e/pkg/utils/**/*
- test/new-e2e/go.mod
- tasks/security_agent.py
- tasks/kmt.py
- tasks/kernel_matrix_testing/*
- allow_failure: true
when: manual
script:
- INSTANCE_IP=$(jq --exit-status --arg ARCH $ARCH -r '.[$ARCH].ip' $CI_PROJECT_DIR/stack.output)
- FILTER_TEAM="Name=tag:team,Values=ebpf-platform"
- FILTER_MANAGED="Name=tag:managed-by,Values=pulumi"
- FILTER_STATE="Name=instance-state-name,Values=running"
- FILTER_PIPELINE="Name=tag:pipeline-id,Values=${CI_PIPELINE_ID}"
- FILTER_ARCH="Name=tag:arch,Values=${ARCH}"
- FILTER_INSTANCE_TYPE="Name=tag:instance-type,Values=${INSTANCE_TYPE}"
- FILTER_TEST_COMPONENT="Name=tag:test-component,Values=${TEST_COMPONENT}"
- QUERY_INSTANCE_IDS='Reservations[*].Instances[*].InstanceId'
- QUERY_PRIVATE_IPS='Reservations[*].Instances[*].PrivateIpAddress'
- RUNNING_INSTANCES=$(aws ec2 describe-instances --filters $FILTER_TEAM $FILTER_MANAGED
$FILTER_PIPELINE $FILTER_TEST_COMPONENT "Name=private-ip-address,Values=$INSTANCE_IP"
--output text --query $QUERY_INSTANCE_IDS | wc -l )
- "if [ $RUNNING_INSTANCES -eq \"0\" ]; then\n echo \"These jobs do not permit\
\ retries. The go tests are retried a user-specified number of times automatically.\
\ In order to re-run the tests, you must trigger the pipeline again\"\n 'false'\n\
fi\n"
- MICRO_VM_IP=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
$TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
| map(select(.tag==$TAG)) | .[].ip' $CI_PROJECT_DIR/stack.output)
- MICRO_VM_NAME=$(jq --exit-status --arg TAG $TAG --arg ARCH $ARCH --arg TEST_SET
$TEST_SET -r '.[$ARCH].microvms | map(select(."vmset-tags"| index($TEST_SET)))
| map(select(.tag==$TAG)) | .[].id' $CI_PROJECT_DIR/stack.output)
- GO_VERSION=$(inv go-version)
- mkdir -p ~/.ssh && chmod 700 ~/.ssh
- echo -e "Host metal_instance\nHostname $INSTANCE_IP\nUser ubuntu\nStrictHostKeyChecking
no\nIdentityFile $AWS_EC2_SSH_KEY_FILE\n" | tee -a ~/.ssh/config
- chmod 600 ~/.ssh/config
- scp "$DD_AGENT_TESTING_DIR/job_env.txt" "metal_instance:/home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt"
- ssh metal_instance "scp /home/ubuntu/job_env-${ARCH}-${TAG}-${TEST_SET}.txt ${MICRO_VM_IP}:/job_env.txt"
- NESTED_VM_CMD="/home/ubuntu/connector -host ${MICRO_VM_IP} -user root -ssh-file
/home/kernel-version-testing/ddvm_rsa -vm-cmd 'CI=true /root/fetch_dependencies.sh
${ARCH} && COLLECT_COMPLEXITY=${COLLECT_COMPLEXITY} /opt/micro-vm-init.sh -test-tools
/opt/testing-tools -retry ${RETRY} -test-root /opt/${TEST_COMPONENT}-tests -packages-run-config
/opt/${TEST_SET}.json'"
- $CI_PROJECT_DIR/connector-$ARCH -host $INSTANCE_IP -user ubuntu -ssh-file $AWS_EC2_SSH_KEY_FILE
-vm-cmd "${NESTED_VM_CMD}" -send-env-vars DD_API_KEY
- ssh metal_instance "ssh ${MICRO_VM_IP} '/opt/testing-tools/test-json-review -flakes
/opt/testing-tools/flakes.yaml -codeowners /opt/testing-tools/CODEOWNERS -test-root
/opt/${TEST_COMPONENT}-tests'"
- '[ ! -f $CI_PROJECT_DIR/daemon-${ARCH}.log ] && scp metal_instance:/home/ubuntu/daemon.log
$CI_PROJECT_DIR/vm-metrics-daemon-${ARCH}.log'
stage: kernel_matrix_testing_security_agent
tags:
- arch:amd64
timeout: 1h 30m
variables:
ARCH: x86_64
AWS_EC2_SSH_KEY_FILE: $CI_PROJECT_DIR/ssh_key
EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
RETRY: 2
TEST_COMPONENT: security-agentkmt_secagent_tests_join1_x64kmt_secagent_tests_join1_x64:
image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_arm64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
needs:
- kmt_run_secagent_tests_x64
- kmt_run_secagent_tests_x64_ad
- kmt_run_secagent_tests_x64_ebpfless
- kmt_run_secagent_tests_x64_docker
rules:
- allow_failure: true
if: $CI_COMMIT_BRANCH == "main"
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $RUN_KMT_TESTS == 'on'
- changes:
compare_to: main
paths:
- pkg/ebpf/**/*
- pkg/security/**/*
- pkg/eventmonitor/**/*
- .gitlab/kernel_matrix_testing/security_agent.yml
- .gitlab/kernel_matrix_testing/common.yml
- .gitlab/source_test/ebpf.yml
- test/new-e2e/tests/cws/**/*
- test/new-e2e/system-probe/**/*
- test/new-e2e/scenarios/system-probe/**/*
- test/new-e2e/pkg/runner/**/*
- test/new-e2e/pkg/utils/**/*
- test/new-e2e/go.mod
- tasks/security_agent.py
- tasks/kmt.py
- tasks/kernel_matrix_testing/*
- allow_failure: true
when: manual
script:
- echo "nothing to do here"
stage: kernel_matrix_testing_cleanup
tags:
- arch:arm64kmt_secagent_tests_join2_x64kmt_secagent_tests_join2_x64:
image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_arm64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
needs:
- kmt_run_secagent_tests_x64_peds
- kmt_run_secagent_tests_x64_required
rules:
- allow_failure: true
if: $CI_COMMIT_BRANCH == "main"
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $RUN_KMT_TESTS == 'on'
- changes:
compare_to: main
paths:
- pkg/ebpf/**/*
- pkg/security/**/*
- pkg/eventmonitor/**/*
- .gitlab/kernel_matrix_testing/security_agent.yml
- .gitlab/kernel_matrix_testing/common.yml
- .gitlab/source_test/ebpf.yml
- test/new-e2e/tests/cws/**/*
- test/new-e2e/system-probe/**/*
- test/new-e2e/scenarios/system-probe/**/*
- test/new-e2e/pkg/runner/**/*
- test/new-e2e/pkg/utils/**/*
- test/new-e2e/go.mod
- tasks/security_agent.py
- tasks/kmt.py
- tasks/kernel_matrix_testing/*
- allow_failure: true
when: manual
script:
- echo "nothing to do here"
stage: kernel_matrix_testing_cleanup
tags:
- arch:arm64Removed Jobs
Changes Summary
ℹ️ Diff available in the job log. |
gjulianm
approved these changes
Mar 5, 2025
spikat
approved these changes
Mar 5, 2025
9376730 to
0f7a506
Compare
|
/merge |
|
View all feedbacks in Devflow UI.
This merge request is not mergeable yet, because of pending checks/missing approvals. It will be added to the queue as soon as checks pass and/or get approvals.
The median merge time in
|
|
[Fast Unit Tests Report] On pipeline 57782089 (CI Visibility). The following jobs did not run any unit tests: Jobs:
If you modified Go files and expected unit tests to run in these jobs, please double check the job logs. If you think tests should have been executed reach out to #agent-devx-help |
Uncompressed package size comparisonComparison with ancestor Diff per package
Decision✅ Passed |
Static quality checks ✅Please find below the results from static quality gates Successful checksInfo
|
Regression DetectorRegression Detector ResultsMetrics dashboard Baseline: a49890c Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | tcp_syslog_to_blackhole | ingress throughput | +0.27 | [+0.21, +0.32] | 1 | Logs |
| ➖ | file_to_blackhole_1000ms_latency_linear_load | egress throughput | +0.07 | [-0.40, +0.54] | 1 | Logs |
| ➖ | file_to_blackhole_0ms_latency_http1 | egress throughput | +0.02 | [-0.74, +0.77] | 1 | Logs |
| ➖ | file_to_blackhole_300ms_latency | egress throughput | +0.02 | [-0.61, +0.65] | 1 | Logs |
| ➖ | file_to_blackhole_100ms_latency | egress throughput | +0.01 | [-0.68, +0.70] | 1 | Logs |
| ➖ | file_to_blackhole_0ms_latency_http2 | egress throughput | +0.01 | [-0.76, +0.78] | 1 | Logs |
| ➖ | tcp_dd_logs_filter_exclude | ingress throughput | +0.01 | [-0.02, +0.03] | 1 | Logs |
| ➖ | file_to_blackhole_0ms_latency | egress throughput | +0.00 | [-0.73, +0.74] | 1 | Logs |
| ➖ | uds_dogstatsd_to_api | ingress throughput | -0.02 | [-0.31, +0.27] | 1 | Logs |
| ➖ | file_to_blackhole_500ms_latency | egress throughput | -0.04 | [-0.83, +0.75] | 1 | Logs |
| ➖ | quality_gate_idle | memory utilization | -0.06 | [-0.11, -0.01] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle_all_features | memory utilization | -0.32 | [-0.36, -0.29] | 1 | Logs bounds checks dashboard |
| ➖ | file_tree | memory utilization | -0.37 | [-0.43, -0.31] | 1 | Logs |
| ➖ | file_to_blackhole_1000ms_latency | egress throughput | -0.71 | [-1.50, +0.08] | 1 | Logs |
| ➖ | uds_dogstatsd_to_api_cpu | % cpu utilization | -1.22 | [-2.11, -0.33] | 1 | Logs |
| ➖ | quality_gate_logs | % cpu utilization | -1.53 | [-4.39, +1.33] | 1 | Logs |
Bounds Checks: ✅ Passed
| perf | experiment | bounds_check_name | replicates_passed | links |
|---|---|---|---|---|
| ✅ | file_to_blackhole_0ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency_http1 | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency_http1 | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency_http2 | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency_http2 | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_1000ms_latency | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_1000ms_latency_linear_load | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_100ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_100ms_latency | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_300ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_300ms_latency | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_500ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_500ms_latency | memory_usage | 10/10 | |
| ✅ | quality_gate_idle | intake_connections | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_idle | memory_usage | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | intake_connections | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | memory_usage | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_logs | intake_connections | 10/10 | |
| ✅ | quality_gate_logs | lost_bytes | 10/10 | |
| ✅ | quality_gate_logs | memory_usage | 10/10 |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
CI Pass/Fail Decision
✅ Passed. All Quality Gates passed.
- quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR adds a new KMT test run, that runs only the
TestEventMonitortests. The goal with this is to guarantee that the process event data stream is working correctly.The rest of the changes are related to the amount of jobs requirement that needed to split the join into 2.
Motivation
Describe how you validated your changes
Possible Drawbacks / Trade-offs
Additional Notes