Skip to content

Support ubuntu 26 and update installer test to test on it, temporary disable ubuntu 24 - #55600

Draft
KevinFairise2 wants to merge 4 commits into
mainfrom
kfairise/ubuntu-26
Draft

Support ubuntu 26 and update installer test to test on it, temporary disable ubuntu 24#55600
KevinFairise2 wants to merge 4 commits into
mainfrom
kfairise/ubuntu-26

Conversation

@KevinFairise2

@KevinFairise2 KevinFairise2 commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

…

What does this PR do?

Add ubuntu 26-04 target on arm64. And replace tests using ubuntu 24-04 with 26-04.
Ideally we should enable the 24-04 target again in the future, but for now there is a bug in APT that causes jobs to timeout: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/2003851

Motivation

Describe how you validated your changes

Additional Notes

@KevinFairise2
KevinFairise2 requested review from a team as code owners August 28, 2026 15:57
@KevinFairise2
KevinFairise2 requested a review from sar-shah August 28, 2026 15:57
@KevinFairise2
KevinFairise2 marked this pull request as draft August 28, 2026 15:57
@github-actions github-actions Bot added the medium review PR review might take time label Aug 28, 2026
github-actions[bot]
github-actions Bot reviewed Aug 28, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review by Codex (OpenAI) - workflow run

Patch is incorrect: Ubuntu 26.04 is added to the package suite without updating its Ubuntu 24.04-specific AppArmor checks.

Comment thread test/new-e2e/tests/installer/unix/all_packages_test.go
}
arm64Flavors = []e2eos.Descriptor{
e2eos.Ubuntu2404,
e2eos.Ubuntu2604,

@github-actions github-actions Bot Aug 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P2] Update the AppArmor guards for Ubuntu 26.04. package_apm_inject_test.go only recognizes Ubuntu2404 and Debian 12 as AppArmor-enabled, so replacing the ARM64 flavor here causes TestAppArmor to skip and omits the profile assertions in install/uninstrument tests on the new target. Include Ubuntu 26.04 in those checks (ideally via a capability helper).

@dd-octo-sts

dd-octo-sts Bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Gitlab CI Configuration Changes

Modified Jobs

.new-e2e_ubuntu_a7_arm64 
  .new-e2e_ubuntu_a7_arm64:
    needs:
    - go_e2e_deps
    - artifacts: false
      job: go_e2e_test_binaries
    - job: new-e2e-base-coverage
      optional: true
    - job: publish_fakeintake
      optional: true
    - job: publish_fakeintake_pinned
      optional: true
    - deploy_deb_testing-a7_arm64
    variables:
      E2E_BRANCH_DESCRIPTORS: ubuntu/arm64/20-04
      E2E_CWS_SUPPORTED_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04
-     E2E_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04,ubuntu/arm64/24-04
?                                                                          ^
+     E2E_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04,ubuntu/arm64/26-04
?                                                                          ^
new-e2e-agent-platform-ddot-ubuntu-a7-arm64 
  new-e2e-agent-platform-ddot-ubuntu-a7-arm64:
    after_script:
    - CODECOV_TOKEN=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $CODECOV token) || exit
      $?; export CODECOV_TOKEN
    - $CI_PROJECT_DIR/tools/ci/junit_upload.sh "junit-${CI_JOB_ID}.tgz" "$E2E_RESULT_JSON"
    - "if [ -d \"$E2E_COVERAGE_OUT_DIR\" ]; then\n  dda inv -- -e coverage.process-e2e-coverage-folders\
      \ $E2E_COVERAGE_OUT_DIR\n  dda inv -- -e dyntest.compute-and-upload-job-index\
      \ --bucket-uri $S3_PERMANENT_ARTIFACTS_URI --coverage-folder $E2E_COVERAGE_OUT_DIR\
      \ --commit-sha $CI_COMMIT_SHA --job-id $CI_JOB_ID\nfi\n"
    - "if [ -d \"$E2E_COVERAGE_OUT_DIR\" ]; then\n  DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh\
      \ $AGENT_API_KEY_ORG2 token) || exit $?; export DD_API_KEY\n  for coverage in\
      \ \"$E2E_COVERAGE_OUT_DIR\"/*/coverage.txt; do\n    datadog-ci coverage upload\
      \ --format=go-coverprofile \"$coverage\" || true\n  done\nfi\n"
    artifacts:
      expire_in: 2 weeks
      paths:
      - $E2E_OUTPUT_DIR
      - $E2E_RESULT_JSON
      - junit-*.tgz
      - $E2E_COVERAGE_OUT_DIR
      reports:
        annotations:
        - $EXTERNAL_LINKS_PATH
      when: always
    before_script:
    - mkdir -p $GOPATH/pkg/mod/cache && zstd -dc modcache_e2e.tar.zst | tar xf - -C
      $GOPATH/pkg/mod/cache
    - rm -f modcache_e2e.tar.zst
    - mkdir -p ~/.pulumi && zstd -dc pulumi_plugins.tar.zst | tar xf - -C ~/.pulumi
    - rm -f pulumi_plugins.tar.zst
    - mkdir -p ~/.aws
    - "if [ -n \"$E2E_USE_AWS_PROFILE\" ]; then\n  echo Using agent-qa-ci aws profile\n\
      \  $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config\
      \ || exit $?\n  # Now all `aws` commands target the agent-qa profile\n  export\
      \ AWS_PROFILE=agent-qa-ci\nelse\n  # Assume role to fetch only once credentials\
      \ and avoid rate limits\n  echo Assuming ddbuild-agent-ci role\n  roleoutput=\"\
      $(aws sts assume-role --role-arn arn:aws:iam::669783387624:role/ddbuild-agent-ci\
      \ --external-id ddbuild-agent-ci --role-session-name RoleSession)\"\n  export\
      \ AWS_ACCESS_KEY_ID=\"$(echo \"$roleoutput\" | jq -r '.Credentials.AccessKeyId')\"\
      \n  export AWS_SECRET_ACCESS_KEY=\"$(echo \"$roleoutput\" | jq -r '.Credentials.SecretAccessKey')\"\
      \n  export AWS_SESSION_TOKEN=\"$(echo \"$roleoutput\" | jq -r '.Credentials.SessionToken')\"\
      \nfi\n"
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AWS_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_AWS_PRIVATE_KEY_PATH && chmod 600 $E2E_AWS_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
      $AGENT_QA_E2E ssh_key_rsa > $E2E_AWS_PRIVATE_KEY_PATH || exit $?
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AZURE_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_AZURE_PRIVATE_KEY_PATH && chmod 600 $E2E_AZURE_PRIVATE_KEY_PATH &&
      $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key_rsa > $E2E_AZURE_PRIVATE_KEY_PATH
      || exit $?
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_GCP_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_GCP_PRIVATE_KEY_PATH && chmod 600 $E2E_GCP_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
      $AGENT_QA_E2E ssh_key_rsa > $E2E_GCP_PRIVATE_KEY_PATH || exit $?
    - pulumi login "s3://dd-pulumi-state?region=us-east-1&awssdk=v2&profile=$AWS_PROFILE"
    - ARM_CLIENT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE client_id)
      || exit $?; export ARM_CLIENT_ID
    - ARM_CLIENT_SECRET=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE token)
      || exit $?; export ARM_CLIENT_SECRET
    - ARM_TENANT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE tenant_id)
      || exit $?; export ARM_TENANT_ID
    - ARM_SUBSCRIPTION_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE subscription_id)
      || exit $?; export ARM_SUBSCRIPTION_ID
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_json > ~/gcp-credentials.json
      || exit $?
    - export GOOGLE_APPLICATION_CREDENTIALS=~/gcp-credentials.json
    - 'gcp_acr_key=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_acr_readonly)
      || exit $?
  
      export E2E_GCP_IMAGE_PULL_PASSWORD="b64=$(printf ''%s'' "$gcp_acr_key" | base64
      -w 0)"
  
      '
    - dda inv -- -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
    - export DD_ENV=nativetest
    - export DD_CIVISIBILITY_ENABLED=true
    - export DD_CIVISIBILITY_AGENTLESS_ENABLED=true
    - export DD_CIVISIBILITY_FLAKY_RETRY_ENABLED=false
    - export DD_TAGS="gitlab.pipeline_source:${CI_PIPELINE_SOURCE}"
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - export WINDOWS_DDNPM_DRIVER=${WINDOWS_DDNPM_DRIVER:-$(dda inv release.get-release-json-value
      "dependencies::WINDOWS_DDNPM_DRIVER" --no-worktree)}
    - export WINDOWS_DDPROCMON_DRIVER=${WINDOWS_DDPROCMON_DRIVER:-$(dda inv release.get-release-json-value
      "dependencies::WINDOWS_DDPROCMON_DRIVER" --no-worktree)}
    cache:
    - key:
        files:
        - .bazelversion
        prefix: bazelversion-$CI_RUNNER_DESCRIPTION
      paths:
      - .cache/bazelisk
      - .cache/bazel/*/install
      policy: pull$BAZEL_CACHE_POLICY_SUFFIX
      when: on_success
    - key:
        files:
        - MODULE.bazel.lock
        prefix: bazel-$CI_JOB_NAME
      paths:
      - .cache/bazel/*/cache
      - .cache/go
      - .cache/golangci-lint
      - .cache/ms-go
      - .cache/pip
      policy: pull$BAZEL_CACHE_POLICY_SUFFIX
      when: on_success
    id_tokens:
      BUILDBARN_ID_TOKEN:
        aud: buildbarn.us1.ddbuild.io
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/linux$CI_IMAGE_LINUX_SUFFIX:$CI_IMAGE_LINUX
    needs:
    - go_e2e_deps
    - artifacts: false
      job: go_e2e_test_binaries
    - job: new-e2e-base-coverage
      optional: true
    - job: publish_fakeintake
      optional: true
    - job: publish_fakeintake_pinned
      optional: true
    - deploy_deb_testing-a7_arm64
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - if: $RUN_E2E_TESTS == "off"
      when: never
    - if: ($CI_COMMIT_BRANCH == "main"  || $DEPLOY_AGENT == "true" || $RUN_E2E_TESTS
        == "on" || $DDR_WORKFLOW_ID != null) && $RUN_E2E_TESTS != "off"
    - changes:
        compare_to: $COMPARE_TO_BRANCH
        paths:
        - omnibus/**/*
    - changes:
        paths:
        - test/new-e2e/tests/agent-platform/tests/ddot*
        - test/e2e-framework/**/*
    script:
    - export IS_DEV_BRANCH="$(dda inv -- -e pipeline.is-dev-branch)"
    - DYNAMIC_TESTS_BREAKGLASS=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $DYNAMIC_TESTS_BREAKGLASS
      value) || exit $?; export DYNAMIC_TESTS_BREAKGLASS
    - "if [ \"$DYNAMIC_TESTS_BREAKGLASS\" == \"true\" ] || [ \"$IS_DEV_BRANCH\" == \"\
      false\" ] || [ \"$RUN_E2E_TESTS\" == \"on\" ]; then\n  export DYNAMIC_TESTS_FLAG=\"\
      \"\nfi\n"
    - export E2E_IMAGE_PULL_PASSWORD=$(aws ecr get-login-password),$E2E_GCP_IMAGE_PULL_PASSWORD
    - dda inv -- -e new-e2e-tests.run $DYNAMIC_TESTS_FLAG $PRE_BUILT_BINARIES_FLAG $MAX_RETRIES_FLAG
      --local-package $CI_PROJECT_DIR/$OMNIBUS_BASE_DIR --result-json $E2E_RESULT_JSON
      --targets $TARGETS --junit-tar junit-${CI_JOB_ID}.tgz ${EXTRA_PARAMS} --test-washer
      --logs-folder=$E2E_OUTPUT_DIR/logs --logs-post-processing --logs-post-processing-test-depth=$E2E_LOGS_PROCESSING_TEST_DEPTH
    stage: e2e_install_packages
    tags:
    - arch:amd64
    - specific:true
    variables:
      BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
      DYNAMIC_TESTS_FLAG: --impacted
      E2E_AWS_PRIVATE_KEY_PATH: /tmp/agent-qa-aws-ssh-key
      E2E_AWS_PUBLIC_KEY_PATH: /tmp/agent-qa-aws-ssh-key.pub
      E2E_AZURE_PRIVATE_KEY_PATH: /tmp/agent-qa-azure-ssh-key
      E2E_AZURE_PUBLIC_KEY_PATH: /tmp/agent-qa-azure-ssh-key.pub
      E2E_BRANCH_DESCRIPTORS: ubuntu/arm64/20-04
      E2E_COMMIT_SHA: $CI_COMMIT_SHORT_SHA
      E2E_COVERAGE_OUT_DIR: $CI_PROJECT_DIR/coverage
      E2E_CWS_SUPPORTED_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04
-     E2E_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04,ubuntu/arm64/24-04
?                                                                          ^
+     E2E_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04,ubuntu/arm64/26-04
?                                                                          ^
      E2E_GCP_PRIVATE_KEY_PATH: /tmp/agent-qa-gcp-ssh-key
      E2E_GCP_PUBLIC_KEY_PATH: /tmp/agent-qa-gcp-ssh-key.pub
      E2E_IMAGE_PULL_REGISTRY: 669783387624.dkr.ecr.us-east-1.amazonaws.com,us-central1-docker.pkg.dev
      E2E_IMAGE_PULL_USERNAME: AWS,_json_key
      E2E_KEY_PAIR_NAME: datadog-agent-ci-rsa
      E2E_LOGS_PROCESSING_TEST_DEPTH: 2
      E2E_OUTPUT_DIR: $CI_PROJECT_DIR/e2e-output
      E2E_PIPELINE_ID: $CI_PIPELINE_ID
      E2E_PREBUILD_S3_URI: $S3_PERMANENT_ARTIFACTS_URI/e2e-pre-build/$CI_PIPELINE_ID
      E2E_RESULT_JSON: $CI_PROJECT_DIR/e2e_test_output.json
      E2E_SKIP_WINDOWS: $SKIP_WINDOWS
      E2E_USE_AWS_PROFILE: 'true'
      EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
      EXTRA_PARAMS: --osdescriptors $E2E_DESCRIPTORS --run TestDDOTInstallScript
      FLAKY_PATTERNS_CONFIG: $CI_PROJECT_DIR/flaky-patterns-runtime.yaml
      GIT_DEPTH: 0
      GIT_STRATEGY: clone
      KUBERNETES_CPU_REQUEST: 6
      KUBERNETES_MEMORY_LIMIT: 16Gi
      KUBERNETES_MEMORY_REQUEST: 12Gi
      MAX_RETRIES_FLAG: ''
      PRE_BUILT_BINARIES_FLAG: --use-prebuilt-binaries
      REMOTE_STACK_CLEANING: 'true'
      SHOULD_RUN_IN_FLAKES_FINDER: 'true'
      TARGETS: ./tests/agent-platform/tests
      TEAM: agent-delivery
      XDG_CACHE_HOME: $CI_PROJECT_DIR/.cache
new-e2e-agent-platform-install-script-ubuntu-a7-arm64 
  new-e2e-agent-platform-install-script-ubuntu-a7-arm64:
    after_script:
    - CODECOV_TOKEN=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $CODECOV token) || exit
      $?; export CODECOV_TOKEN
    - $CI_PROJECT_DIR/tools/ci/junit_upload.sh "junit-${CI_JOB_ID}.tgz" "$E2E_RESULT_JSON"
    - "if [ -d \"$E2E_COVERAGE_OUT_DIR\" ]; then\n  dda inv -- -e coverage.process-e2e-coverage-folders\
      \ $E2E_COVERAGE_OUT_DIR\n  dda inv -- -e dyntest.compute-and-upload-job-index\
      \ --bucket-uri $S3_PERMANENT_ARTIFACTS_URI --coverage-folder $E2E_COVERAGE_OUT_DIR\
      \ --commit-sha $CI_COMMIT_SHA --job-id $CI_JOB_ID\nfi\n"
    - "if [ -d \"$E2E_COVERAGE_OUT_DIR\" ]; then\n  DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh\
      \ $AGENT_API_KEY_ORG2 token) || exit $?; export DD_API_KEY\n  for coverage in\
      \ \"$E2E_COVERAGE_OUT_DIR\"/*/coverage.txt; do\n    datadog-ci coverage upload\
      \ --format=go-coverprofile \"$coverage\" || true\n  done\nfi\n"
    artifacts:
      expire_in: 2 weeks
      paths:
      - $E2E_OUTPUT_DIR
      - $E2E_RESULT_JSON
      - junit-*.tgz
      - $E2E_COVERAGE_OUT_DIR
      reports:
        annotations:
        - $EXTERNAL_LINKS_PATH
      when: always
    before_script:
    - mkdir -p $GOPATH/pkg/mod/cache && zstd -dc modcache_e2e.tar.zst | tar xf - -C
      $GOPATH/pkg/mod/cache
    - rm -f modcache_e2e.tar.zst
    - mkdir -p ~/.pulumi && zstd -dc pulumi_plugins.tar.zst | tar xf - -C ~/.pulumi
    - rm -f pulumi_plugins.tar.zst
    - mkdir -p ~/.aws
    - "if [ -n \"$E2E_USE_AWS_PROFILE\" ]; then\n  echo Using agent-qa-ci aws profile\n\
      \  $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config\
      \ || exit $?\n  # Now all `aws` commands target the agent-qa profile\n  export\
      \ AWS_PROFILE=agent-qa-ci\nelse\n  # Assume role to fetch only once credentials\
      \ and avoid rate limits\n  echo Assuming ddbuild-agent-ci role\n  roleoutput=\"\
      $(aws sts assume-role --role-arn arn:aws:iam::669783387624:role/ddbuild-agent-ci\
      \ --external-id ddbuild-agent-ci --role-session-name RoleSession)\"\n  export\
      \ AWS_ACCESS_KEY_ID=\"$(echo \"$roleoutput\" | jq -r '.Credentials.AccessKeyId')\"\
      \n  export AWS_SECRET_ACCESS_KEY=\"$(echo \"$roleoutput\" | jq -r '.Credentials.SecretAccessKey')\"\
      \n  export AWS_SESSION_TOKEN=\"$(echo \"$roleoutput\" | jq -r '.Credentials.SessionToken')\"\
      \nfi\n"
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AWS_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_AWS_PRIVATE_KEY_PATH && chmod 600 $E2E_AWS_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
      $AGENT_QA_E2E ssh_key_rsa > $E2E_AWS_PRIVATE_KEY_PATH || exit $?
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AZURE_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_AZURE_PRIVATE_KEY_PATH && chmod 600 $E2E_AZURE_PRIVATE_KEY_PATH &&
      $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key_rsa > $E2E_AZURE_PRIVATE_KEY_PATH
      || exit $?
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_GCP_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_GCP_PRIVATE_KEY_PATH && chmod 600 $E2E_GCP_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
      $AGENT_QA_E2E ssh_key_rsa > $E2E_GCP_PRIVATE_KEY_PATH || exit $?
    - pulumi login "s3://dd-pulumi-state?region=us-east-1&awssdk=v2&profile=$AWS_PROFILE"
    - ARM_CLIENT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE client_id)
      || exit $?; export ARM_CLIENT_ID
    - ARM_CLIENT_SECRET=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE token)
      || exit $?; export ARM_CLIENT_SECRET
    - ARM_TENANT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE tenant_id)
      || exit $?; export ARM_TENANT_ID
    - ARM_SUBSCRIPTION_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE subscription_id)
      || exit $?; export ARM_SUBSCRIPTION_ID
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_json > ~/gcp-credentials.json
      || exit $?
    - export GOOGLE_APPLICATION_CREDENTIALS=~/gcp-credentials.json
    - 'gcp_acr_key=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_acr_readonly)
      || exit $?
  
      export E2E_GCP_IMAGE_PULL_PASSWORD="b64=$(printf ''%s'' "$gcp_acr_key" | base64
      -w 0)"
  
      '
    - dda inv -- -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
    - export DD_ENV=nativetest
    - export DD_CIVISIBILITY_ENABLED=true
    - export DD_CIVISIBILITY_AGENTLESS_ENABLED=true
    - export DD_CIVISIBILITY_FLAKY_RETRY_ENABLED=false
    - export DD_TAGS="gitlab.pipeline_source:${CI_PIPELINE_SOURCE}"
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - export WINDOWS_DDNPM_DRIVER=${WINDOWS_DDNPM_DRIVER:-$(dda inv release.get-release-json-value
      "dependencies::WINDOWS_DDNPM_DRIVER" --no-worktree)}
    - export WINDOWS_DDPROCMON_DRIVER=${WINDOWS_DDPROCMON_DRIVER:-$(dda inv release.get-release-json-value
      "dependencies::WINDOWS_DDPROCMON_DRIVER" --no-worktree)}
    cache:
    - key:
        files:
        - .bazelversion
        prefix: bazelversion-$CI_RUNNER_DESCRIPTION
      paths:
      - .cache/bazelisk
      - .cache/bazel/*/install
      policy: pull$BAZEL_CACHE_POLICY_SUFFIX
      when: on_success
    - key:
        files:
        - MODULE.bazel.lock
        prefix: bazel-$CI_JOB_NAME
      paths:
      - .cache/bazel/*/cache
      - .cache/go
      - .cache/golangci-lint
      - .cache/ms-go
      - .cache/pip
      policy: pull$BAZEL_CACHE_POLICY_SUFFIX
      when: on_success
    id_tokens:
      BUILDBARN_ID_TOKEN:
        aud: buildbarn.us1.ddbuild.io
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/linux$CI_IMAGE_LINUX_SUFFIX:$CI_IMAGE_LINUX
    needs:
    - go_e2e_deps
    - artifacts: false
      job: go_e2e_test_binaries
    - job: new-e2e-base-coverage
      optional: true
    - job: publish_fakeintake
      optional: true
    - job: publish_fakeintake_pinned
      optional: true
    - deploy_deb_testing-a7_arm64
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - if: $RUN_E2E_TESTS == "off"
      when: never
    - if: ($CI_COMMIT_BRANCH == "main"  || $DEPLOY_AGENT == "true" || $RUN_E2E_TESTS
        == "on" || $DDR_WORKFLOW_ID != null) && $RUN_E2E_TESTS != "off"
    - changes:
        compare_to: $COMPARE_TO_BRANCH
        paths:
        - omnibus/**/*
    - changes:
        compare_to: $COMPARE_TO_BRANCH
        paths:
        - pkg/fleet/installer/packages/**/*
        - omnibus/package-scripts/agent-*/**/*
      when: on_success
    script:
    - export IS_DEV_BRANCH="$(dda inv -- -e pipeline.is-dev-branch)"
    - DYNAMIC_TESTS_BREAKGLASS=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $DYNAMIC_TESTS_BREAKGLASS
      value) || exit $?; export DYNAMIC_TESTS_BREAKGLASS
    - "if [ \"$DYNAMIC_TESTS_BREAKGLASS\" == \"true\" ] || [ \"$IS_DEV_BRANCH\" == \"\
      false\" ] || [ \"$RUN_E2E_TESTS\" == \"on\" ]; then\n  export DYNAMIC_TESTS_FLAG=\"\
      \"\nfi\n"
    - export E2E_IMAGE_PULL_PASSWORD=$(aws ecr get-login-password),$E2E_GCP_IMAGE_PULL_PASSWORD
    - dda inv -- -e new-e2e-tests.run $DYNAMIC_TESTS_FLAG $PRE_BUILT_BINARIES_FLAG $MAX_RETRIES_FLAG
      --local-package $CI_PROJECT_DIR/$OMNIBUS_BASE_DIR --result-json $E2E_RESULT_JSON
      --targets $TARGETS --junit-tar junit-${CI_JOB_ID}.tgz ${EXTRA_PARAMS} --test-washer
      --logs-folder=$E2E_OUTPUT_DIR/logs --logs-post-processing --logs-post-processing-test-depth=$E2E_LOGS_PROCESSING_TEST_DEPTH
    stage: e2e_install_packages
    tags:
    - arch:amd64
    - specific:true
    variables:
      AGENT_MAJOR_VERSION: 7
      BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
      DYNAMIC_TESTS_FLAG: --impacted
      E2E_AWS_PRIVATE_KEY_PATH: /tmp/agent-qa-aws-ssh-key
      E2E_AWS_PUBLIC_KEY_PATH: /tmp/agent-qa-aws-ssh-key.pub
      E2E_AZURE_PRIVATE_KEY_PATH: /tmp/agent-qa-azure-ssh-key
      E2E_AZURE_PUBLIC_KEY_PATH: /tmp/agent-qa-azure-ssh-key.pub
      E2E_BRANCH_DESCRIPTORS: ubuntu/arm64/20-04
      E2E_COMMIT_SHA: $CI_COMMIT_SHORT_SHA
      E2E_COVERAGE_OUT_DIR: $CI_PROJECT_DIR/coverage
      E2E_CWS_SUPPORTED_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04
-     E2E_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04,ubuntu/arm64/24-04
?                                                                          ^
+     E2E_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04,ubuntu/arm64/26-04
?                                                                          ^
      E2E_GCP_PRIVATE_KEY_PATH: /tmp/agent-qa-gcp-ssh-key
      E2E_GCP_PUBLIC_KEY_PATH: /tmp/agent-qa-gcp-ssh-key.pub
      E2E_IMAGE_PULL_REGISTRY: 669783387624.dkr.ecr.us-east-1.amazonaws.com,us-central1-docker.pkg.dev
      E2E_IMAGE_PULL_USERNAME: AWS,_json_key
      E2E_KEY_PAIR_NAME: datadog-agent-ci-rsa
      E2E_LOGS_PROCESSING_TEST_DEPTH: 2
      E2E_OUTPUT_DIR: $CI_PROJECT_DIR/e2e-output
      E2E_PIPELINE_ID: $CI_PIPELINE_ID
      E2E_PREBUILD_S3_URI: $S3_PERMANENT_ARTIFACTS_URI/e2e-pre-build/$CI_PIPELINE_ID
      E2E_RESULT_JSON: $CI_PROJECT_DIR/e2e_test_output.json
      E2E_SKIP_WINDOWS: $SKIP_WINDOWS
      E2E_USE_AWS_PROFILE: 'true'
      EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
      EXTRA_PARAMS: --cws-supported-osdescriptors $E2E_CWS_SUPPORTED_DESCRIPTORS --flavor
        $FLAVOR --osdescriptors $E2E_DESCRIPTORS --run TestInstallScript
      FLAKY_PATTERNS_CONFIG: $CI_PROJECT_DIR/flaky-patterns-runtime.yaml
      FLAVOR: datadog-agent
      GIT_DEPTH: 0
      GIT_STRATEGY: clone
      KUBERNETES_CPU_REQUEST: 6
      KUBERNETES_MEMORY_LIMIT: 16Gi
      KUBERNETES_MEMORY_REQUEST: 12Gi
      MAX_RETRIES_FLAG: ''
      PRE_BUILT_BINARIES_FLAG: --use-prebuilt-binaries
      REMOTE_STACK_CLEANING: 'true'
      SHOULD_RUN_IN_FLAKES_FINDER: 'true'
      TARGETS: ./tests/agent-platform/tests
      TEAM: agent-delivery
      XDG_CACHE_HOME: $CI_PROJECT_DIR/.cache
new-e2e-agent-platform-step-by-step-ubuntu-a7-arm64 
  new-e2e-agent-platform-step-by-step-ubuntu-a7-arm64:
    after_script:
    - CODECOV_TOKEN=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $CODECOV token) || exit
      $?; export CODECOV_TOKEN
    - $CI_PROJECT_DIR/tools/ci/junit_upload.sh "junit-${CI_JOB_ID}.tgz" "$E2E_RESULT_JSON"
    - "if [ -d \"$E2E_COVERAGE_OUT_DIR\" ]; then\n  dda inv -- -e coverage.process-e2e-coverage-folders\
      \ $E2E_COVERAGE_OUT_DIR\n  dda inv -- -e dyntest.compute-and-upload-job-index\
      \ --bucket-uri $S3_PERMANENT_ARTIFACTS_URI --coverage-folder $E2E_COVERAGE_OUT_DIR\
      \ --commit-sha $CI_COMMIT_SHA --job-id $CI_JOB_ID\nfi\n"
    - "if [ -d \"$E2E_COVERAGE_OUT_DIR\" ]; then\n  DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh\
      \ $AGENT_API_KEY_ORG2 token) || exit $?; export DD_API_KEY\n  for coverage in\
      \ \"$E2E_COVERAGE_OUT_DIR\"/*/coverage.txt; do\n    datadog-ci coverage upload\
      \ --format=go-coverprofile \"$coverage\" || true\n  done\nfi\n"
    artifacts:
      expire_in: 2 weeks
      paths:
      - $E2E_OUTPUT_DIR
      - $E2E_RESULT_JSON
      - junit-*.tgz
      - $E2E_COVERAGE_OUT_DIR
      reports:
        annotations:
        - $EXTERNAL_LINKS_PATH
      when: always
    before_script:
    - mkdir -p $GOPATH/pkg/mod/cache && zstd -dc modcache_e2e.tar.zst | tar xf - -C
      $GOPATH/pkg/mod/cache
    - rm -f modcache_e2e.tar.zst
    - mkdir -p ~/.pulumi && zstd -dc pulumi_plugins.tar.zst | tar xf - -C ~/.pulumi
    - rm -f pulumi_plugins.tar.zst
    - mkdir -p ~/.aws
    - "if [ -n \"$E2E_USE_AWS_PROFILE\" ]; then\n  echo Using agent-qa-ci aws profile\n\
      \  $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E profile >> ~/.aws/config\
      \ || exit $?\n  # Now all `aws` commands target the agent-qa profile\n  export\
      \ AWS_PROFILE=agent-qa-ci\nelse\n  # Assume role to fetch only once credentials\
      \ and avoid rate limits\n  echo Assuming ddbuild-agent-ci role\n  roleoutput=\"\
      $(aws sts assume-role --role-arn arn:aws:iam::669783387624:role/ddbuild-agent-ci\
      \ --external-id ddbuild-agent-ci --role-session-name RoleSession)\"\n  export\
      \ AWS_ACCESS_KEY_ID=\"$(echo \"$roleoutput\" | jq -r '.Credentials.AccessKeyId')\"\
      \n  export AWS_SECRET_ACCESS_KEY=\"$(echo \"$roleoutput\" | jq -r '.Credentials.SecretAccessKey')\"\
      \n  export AWS_SESSION_TOKEN=\"$(echo \"$roleoutput\" | jq -r '.Credentials.SessionToken')\"\
      \nfi\n"
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AWS_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_AWS_PRIVATE_KEY_PATH && chmod 600 $E2E_AWS_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
      $AGENT_QA_E2E ssh_key_rsa > $E2E_AWS_PRIVATE_KEY_PATH || exit $?
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_AZURE_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_AZURE_PRIVATE_KEY_PATH && chmod 600 $E2E_AZURE_PRIVATE_KEY_PATH &&
      $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_key_rsa > $E2E_AZURE_PRIVATE_KEY_PATH
      || exit $?
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_QA_E2E ssh_public_key_rsa > $E2E_GCP_PUBLIC_KEY_PATH
      || exit $?
    - touch $E2E_GCP_PRIVATE_KEY_PATH && chmod 600 $E2E_GCP_PRIVATE_KEY_PATH && $CI_PROJECT_DIR/tools/ci/fetch_secret.sh
      $AGENT_QA_E2E ssh_key_rsa > $E2E_GCP_PRIVATE_KEY_PATH || exit $?
    - pulumi login "s3://dd-pulumi-state?region=us-east-1&awssdk=v2&profile=$AWS_PROFILE"
    - ARM_CLIENT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE client_id)
      || exit $?; export ARM_CLIENT_ID
    - ARM_CLIENT_SECRET=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE token)
      || exit $?; export ARM_CLIENT_SECRET
    - ARM_TENANT_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE tenant_id)
      || exit $?; export ARM_TENANT_ID
    - ARM_SUBSCRIPTION_ID=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_AZURE subscription_id)
      || exit $?; export ARM_SUBSCRIPTION_ID
    - $CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_json > ~/gcp-credentials.json
      || exit $?
    - export GOOGLE_APPLICATION_CREDENTIALS=~/gcp-credentials.json
    - 'gcp_acr_key=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $E2E_GCP credentials_acr_readonly)
      || exit $?
  
      export E2E_GCP_IMAGE_PULL_PASSWORD="b64=$(printf ''%s'' "$gcp_acr_key" | base64
      -w 0)"
  
      '
    - dda inv -- -e gitlab.generate-ci-visibility-links --output=$EXTERNAL_LINKS_PATH
    - export DD_ENV=nativetest
    - export DD_CIVISIBILITY_ENABLED=true
    - export DD_CIVISIBILITY_AGENTLESS_ENABLED=true
    - export DD_CIVISIBILITY_FLAKY_RETRY_ENABLED=false
    - export DD_TAGS="gitlab.pipeline_source:${CI_PIPELINE_SOURCE}"
    - DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $AGENT_API_KEY_ORG2 token)
      || exit $?; export DD_API_KEY
    - export WINDOWS_DDNPM_DRIVER=${WINDOWS_DDNPM_DRIVER:-$(dda inv release.get-release-json-value
      "dependencies::WINDOWS_DDNPM_DRIVER" --no-worktree)}
    - export WINDOWS_DDPROCMON_DRIVER=${WINDOWS_DDPROCMON_DRIVER:-$(dda inv release.get-release-json-value
      "dependencies::WINDOWS_DDPROCMON_DRIVER" --no-worktree)}
    cache:
    - key:
        files:
        - .bazelversion
        prefix: bazelversion-$CI_RUNNER_DESCRIPTION
      paths:
      - .cache/bazelisk
      - .cache/bazel/*/install
      policy: pull$BAZEL_CACHE_POLICY_SUFFIX
      when: on_success
    - key:
        files:
        - MODULE.bazel.lock
        prefix: bazel-$CI_JOB_NAME
      paths:
      - .cache/bazel/*/cache
      - .cache/go
      - .cache/golangci-lint
      - .cache/ms-go
      - .cache/pip
      policy: pull$BAZEL_CACHE_POLICY_SUFFIX
      when: on_success
    id_tokens:
      BUILDBARN_ID_TOKEN:
        aud: buildbarn.us1.ddbuild.io
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/linux$CI_IMAGE_LINUX_SUFFIX:$CI_IMAGE_LINUX
    needs:
    - go_e2e_deps
    - artifacts: false
      job: go_e2e_test_binaries
    - job: new-e2e-base-coverage
      optional: true
    - job: publish_fakeintake
      optional: true
    - job: publish_fakeintake_pinned
      optional: true
    - deploy_deb_testing-a7_arm64
    rules:
    - if: $DEPLOY_AGENT == "true" || $DDR_WORKFLOW_ID != null
    script:
    - export IS_DEV_BRANCH="$(dda inv -- -e pipeline.is-dev-branch)"
    - DYNAMIC_TESTS_BREAKGLASS=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh $DYNAMIC_TESTS_BREAKGLASS
      value) || exit $?; export DYNAMIC_TESTS_BREAKGLASS
    - "if [ \"$DYNAMIC_TESTS_BREAKGLASS\" == \"true\" ] || [ \"$IS_DEV_BRANCH\" == \"\
      false\" ] || [ \"$RUN_E2E_TESTS\" == \"on\" ]; then\n  export DYNAMIC_TESTS_FLAG=\"\
      \"\nfi\n"
    - export E2E_IMAGE_PULL_PASSWORD=$(aws ecr get-login-password),$E2E_GCP_IMAGE_PULL_PASSWORD
    - dda inv -- -e new-e2e-tests.run $DYNAMIC_TESTS_FLAG $PRE_BUILT_BINARIES_FLAG $MAX_RETRIES_FLAG
      --local-package $CI_PROJECT_DIR/$OMNIBUS_BASE_DIR --result-json $E2E_RESULT_JSON
      --targets $TARGETS --junit-tar junit-${CI_JOB_ID}.tgz ${EXTRA_PARAMS} --test-washer
      --logs-folder=$E2E_OUTPUT_DIR/logs --logs-post-processing --logs-post-processing-test-depth=$E2E_LOGS_PROCESSING_TEST_DEPTH
    stage: e2e_install_packages
    tags:
    - arch:amd64
    - specific:true
    variables:
      AGENT_MAJOR_VERSION: 7
      BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
      DYNAMIC_TESTS_FLAG: --impacted
      E2E_AWS_PRIVATE_KEY_PATH: /tmp/agent-qa-aws-ssh-key
      E2E_AWS_PUBLIC_KEY_PATH: /tmp/agent-qa-aws-ssh-key.pub
      E2E_AZURE_PRIVATE_KEY_PATH: /tmp/agent-qa-azure-ssh-key
      E2E_AZURE_PUBLIC_KEY_PATH: /tmp/agent-qa-azure-ssh-key.pub
      E2E_BRANCH_DESCRIPTORS: ubuntu/arm64/20-04
      E2E_COMMIT_SHA: $CI_COMMIT_SHORT_SHA
      E2E_COVERAGE_OUT_DIR: $CI_PROJECT_DIR/coverage
      E2E_CWS_SUPPORTED_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04
-     E2E_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04,ubuntu/arm64/24-04
?                                                                          ^
+     E2E_DESCRIPTORS: ubuntu/arm64/18-04,ubuntu/arm64/20-04,ubuntu/arm64/26-04
?                                                                          ^
      E2E_GCP_PRIVATE_KEY_PATH: /tmp/agent-qa-gcp-ssh-key
      E2E_GCP_PUBLIC_KEY_PATH: /tmp/agent-qa-gcp-ssh-key.pub
      E2E_IMAGE_PULL_REGISTRY: 669783387624.dkr.ecr.us-east-1.amazonaws.com,us-central1-docker.pkg.dev
      E2E_IMAGE_PULL_USERNAME: AWS,_json_key
      E2E_KEY_PAIR_NAME: datadog-agent-ci-rsa
      E2E_LOGS_PROCESSING_TEST_DEPTH: 2
      E2E_OUTPUT_DIR: $CI_PROJECT_DIR/e2e-output
      E2E_PIPELINE_ID: $CI_PIPELINE_ID
      E2E_PREBUILD_S3_URI: $S3_PERMANENT_ARTIFACTS_URI/e2e-pre-build/$CI_PIPELINE_ID
      E2E_RESULT_JSON: $CI_PROJECT_DIR/e2e_test_output.json
      E2E_SKIP_WINDOWS: $SKIP_WINDOWS
      E2E_USE_AWS_PROFILE: 'true'
      EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
      EXTRA_PARAMS: --cws-supported-osdescriptors $E2E_CWS_SUPPORTED_DESCRIPTORS --flavor
        $FLAVOR --osdescriptors $E2E_DESCRIPTORS --run TestStepByStepScript
      FLAKY_PATTERNS_CONFIG: $CI_PROJECT_DIR/flaky-patterns-runtime.yaml
      FLAVOR: datadog-agent
      GIT_DEPTH: 0
      GIT_STRATEGY: clone
      KUBERNETES_CPU_REQUEST: 6
      KUBERNETES_MEMORY_LIMIT: 16Gi
      KUBERNETES_MEMORY_REQUEST: 12Gi
      MAX_RETRIES_FLAG: ''
      PRE_BUILT_BINARIES_FLAG: --use-prebuilt-binaries
      REMOTE_STACK_CLEANING: 'true'
      SHOULD_RUN_IN_FLAKES_FINDER: 'true'
      TARGETS: ./tests/agent-platform/tests
      TEAM: agent-delivery
      XDG_CACHE_HOME: $CI_PROJECT_DIR/.cache

Changes Summary

Removed Modified Added Renamed
0 4 0 0

ℹ️ Diff available in the job log.

@datadog-prod-us1-5

datadog-prod-us1-5 Bot commented Aug 28, 2026 •
edited by datadog-official Bot
Loading

Copy link
Copy Markdown
Contributor

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 52.73% (-0.00%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 700f0e9 | Docs | View more details | Give us feedback!

@dd-octo-sts

dd-octo-sts Bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Files inventory check summary

File checks results against ancestor ad97d80a:

Results for datadog-agent_7.84.0~devel.git.572.700f0e9.pipeline.134016881-1_amd64.deb:

No change detected

Results for datadog-iot-agent_7.84.0~devel.git.572.700f0e9.pipeline.134016881-1_amd64.deb:

No change detected

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments
@sar-shah sar-shah Awaiting requested review from sar-shah sar-shah is a code owner automatically assigned from DataDog/windows-products

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

internal Identify a non-fork PR medium review PR review might take time team/agent-devx team/windows-products

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@KevinFairise2