Onboard integrations to security validation#23109
Merged
Conversation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
|
The following files, which will be shipped with the agent, were modified in this PR and You can ignore this if you are sure the changes in this PR do not require QA. Otherwise, consider removing the label. List of modified files that will be shipped with the agent |
Codecov Report❌ Patch coverage is Additional details and impacted files🚀 New features to boost your workflow:
|
…from require_trusted_provider spec fields Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…t state Use module-level SECURE_FIELD_NAMES constant and field-level _validate security check (mode='before'), with require_trusted_providers tracked in ModelInfo. Also restore spec.py validator, template yaml annotations, and changelog. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
NouemanKHAL
changed the title
…e_trusted_provider: true
…with require_trusted_provider fields Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
datadog-agent-integrations-bot
Bot
added
integration/ibm_was
integration/kube_controller_manager
integration/aerospike
integration/jboss_wildfly
integration/kube_scheduler
integration/ambari
integration/kube_metrics_server
integration/hive
integration/kube_apiserver_metrics
integration/harbor
integration/druid
integration/external_dns
integration/cilium
integration/clickhouse
labels
Member
Author
|
|
dkirov-dd
approved these changes
Mar 31, 2026
drichards-87
approved these changes
Mar 31, 2026
mobuchowski
approved these changes
Mar 31, 2026
piochelepiotr
approved these changes
Mar 31, 2026
garrison-stauffer
approved these changes
Mar 31, 2026
TCheruy
approved these changes
Mar 31, 2026
gabedos
approved these changes
Mar 31, 2026
tpoll
approved these changes
Mar 31, 2026
eric-weaver
approved these changes
Mar 31, 2026
Contributor
eric-weaver
left a comment
eric-weaver
left a comment
There was a problem hiding this comment.
lgtm for DBM. Chatted offline and we'll follow up with expanding Mysql ssl config block separately
bitomaxsp
approved these changes
Apr 1, 2026
lli-datadog
reviewed
Apr 1, 2026
| @@ -20,6 +20,9 @@ | |||
| from . import defaults, validators | |||
|
|
|||
|
|
|||
| SECURE_FIELD_NAMES = frozenset(['ocsp_response_cache_filename', 'private_key_path', 'token_path']) | |||
Contributor
There was a problem hiding this comment.
how do we test this? and where are these fields from?
Member
Author
There was a problem hiding this comment.
The fields are from the spec.yaml, for instance:
Member
Author
There was a problem hiding this comment.
The security validation behavior is tested globally in the datadog_checks_base class: https://github.com/DataDog/integrations-core/blob/master/datadog_checks_base/datadog_checks/base/utils/models/validation/security.py
And tested E2E manually, you can find a report here: https://datadoghq.atlassian.net/wiki/spaces/~550367931/pages/6428329336/DEMO+Remediate+untrusted+checks+configs+in+Integrations
apiazza-dd
approved these changes
Apr 1, 2026
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
13 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Motivation
Follow-up for #22226 where we only kept
datadog_checks_baserelated changes.Everything was already reviewed in the PR above, we just separated them as these changes required a minimum_base_check bump. (will be done later in a separate PR)
require_trusted_providerPropertiesShared template properties
These propagate to all integrations that include the respective template.
httpkerberos_cache,kerberos_keytab,auth_token,tls_cert,tls_private_key,tls_ca_certtlstls_ca_cert,tls_cert,tls_private_keyjmxtools_jar_path,java_bin_path,trust_store_path,key_store_pathopenmetrics_legacy_basebearer_token_pathIntegration-specific properties
cactirrd_path,rrd_whitelistcassandra_nodetoolnodetoolcephceph_cmdcisco_acicert_key_pathclickhousetls_ca_certclouderassl_ca_cert,cert_file,key_filediskblkid_cache_filefoundationdbcluster_file,tls_certificate_file,tls_key_file,tls_ca_fileguarddogguarddog_path,dependency_file_pathgunicorngunicorninfinibandinfiniband_pathjboss_wildflycustom_jar_pathskafka_actionsschema_registry_tls_ca_cert,schema_registry_tls_cert,schema_registry_tls_keykafka_consumertls_crlfilekube_apiserver_metricsbearer_token_pathkube_schedulerbearer_token_pathlustrelctl_path,lnetctl_path,lfs_pathmac_audit_logsAUDIT_LOGS_DIR_PATHmaprstream_pathmongotls_certificate_key_file,tls_ca_filemysqlsock,defaults_filenagiosnagios_confnetworkconntrack_pathnfsstatnfsiostat_pathopenstack_controlleropenstack_config_file_pathoraclejdbc_driver_path,jdbc_truststore_pathpostfixdirectory,config_directorypostgresssl_root_cert,ssl_cert,ssl_keyprocessprocfs_path,pid_fileredisdbunix_socket_path,ssl_keyfile,ssl_certfile,ssl_ca_certsslurmslurm_binaries_dir,sinfo_path,sacct_path,sdiag_path,sshare_path,squeue_path,scontrol_pathsnowflakeocsp_response_cache_filename,token_path,private_key_pathssh_checkprivate_key_filetibco_emstibemsadmin,script_pathtlslocal_cert_pathtokumxssl_keyfile,ssl_certfile,ssl_ca_certsvarnishvarnishstat,varnishadm,secretfilevaultclient_token_pathReview checklist (to be filled by reviewers)
qa/skip-qalabel if the PR doesn't need to be tested during QA.backport/<branch-name>label to the PR and it will automatically open a backport PR once this one is merged