Skip to content

Commit a82c61a

Browse files
mbotarrotruthbk
mbotarro
authored and
truthbk
committed
Moises.botarro/adding new config fields for process agent scrubbing (#426)
* Added default values for scrub_args and custom_sensitive_words; updated hashmap to configure yaml file; added datadog_process_footer.conf.erb to handle datadog.conf generation; updated README.md with new fields * Added test for conf and yaml files * Format changes * Fixed regex patterns on data scrubbing tests * [process][spec] address test-case conflict - `enabled` not `process_enabled`
1 parent 5a38c82 commit a82c61a

File tree

5 files changed

+141
-20
lines changed

5 files changed

+141
-20
lines changed

‎README.md

+2
Original file line numberDiff line numberDiff line change
@@ -290,6 +290,8 @@ Here are some of the other variables that be set in the datadog_agent class to c
290290
| agent5_enable | boolean to install agent5 and override agent6 default |
291291
| apm_enabled | boolean to enable the APM agent; defaults to true |
292292
| process_enabled | boolean to enable the process agent; defaults to true |
293+
| scrub_args | boolean to enable the process cmdline scrubbing; defaults to true |
294+
| custom_sensitive_words| an array to add more words beyond the default ones used by the scrubbing feature; defaults to [] |
293295
| agent6_extra_options | hash to provide additional configuration options to agent6. |
294296

295297
_NOTE: `agent6_extra_options` may be used to provide a fine grain control of additional agent6 config options. A deep merge is performed that may override options provided in the `datadog_agent` class parameters_

‎manifests/init.pp

+23-1
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,12 @@
166166
# $process_enabled
167167
# String to enable the process/container agent
168168
# Boolean. Default: false
169+
# $scrub_args
170+
# Boolean to enable or disable the process cmdline scrubbing by the process-agent
171+
# Boolean. Default: true
172+
# $custom_sensitive_words
173+
# Array to add more words to be used on the process cdmline scrubbing by the process-agent
174+
# Array. Default: []
169175
#
170176
# Actions:
171177
#
@@ -262,6 +268,8 @@
262268
$apm_enabled = $datadog_agent::params::apm_default_enabled,
263269
$apm_env = '',
264270
$process_enabled = $datadog_agent::params::process_default_enabled,
271+
$scrub_args = $datadog_agent::params::process_default_scrub_args,
272+
$custom_sensitive_words = $datadog_agent::params::process_default_custom_words,
265273
Hash[String[1], Data] $agent6_extra_options = {},
266274
$agent5_repo_uri = $datadog_agent::params::agent5_default_repo,
267275
$agent6_repo_uri = $datadog_agent::params::agent6_default_repo,
@@ -341,6 +349,8 @@
341349
validate_legacy(Boolean, 'validate_bool', $agent5_enable)
342350
validate_legacy(String, 'validate_string', $apm_env)
343351
validate_legacy(Boolean, 'validate_bool', $process_enabled)
352+
validate_legacy(Boolean, 'validate_bool', $scrub_args)
353+
validate_legacy(Array, 'validate_array', $custom_sensitive_words)
344354
validate_legacy(String, 'validate_string', $agent5_repo_uri)
345355
validate_legacy(String, 'validate_string', $agent6_repo_uri)
346356
validate_legacy(String, 'validate_string', $apt_release)
@@ -490,14 +500,26 @@
490500
order => '07',
491501
}
492502
}
503+
504+
if ($process_enabled == true) {
505+
concat::fragment{ 'datadog process agent footer':
506+
target => '/etc/dd-agent/datadog.conf',
507+
content => template('datadog_agent/datadog_process_footer.conf.erb'),
508+
order => '08',
509+
}
510+
}
493511
} else {
494512

495513
# lint:ignore:quoted_booleans
496514
$process_enabled_str = $process_enabled ? { true => 'true' , default => 'disabled' }
497515
# lint:endignore
498516
$base_extra_config = {
499517
'apm_config' => { 'apm_enabled' => $apm_enabled },
500-
'process_config' => { 'enabled' => $process_enabled_str },
518+
'process_config' => {
519+
'enabled' => $process_enabled_str,
520+
'scrub_args' => $scrub_args,
521+
'custom_sensitive_words' => $custom_sensitive_words,
522+
},
501523
}
502524
$extra_config = deep_merge($base_extra_config, $agent6_extra_options)
503525

‎manifests/params.pp

+15-13
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,21 @@
1515
# Sample Usage:
1616
#
1717
class datadog_agent::params {
18-
$agent5_enable = false
19-
$conf_dir = '/etc/dd-agent/conf.d'
20-
$conf6_dir = '/etc/datadog-agent/conf.d'
21-
$dd_user = 'dd-agent'
22-
$dd_group = 'root'
23-
$dd_groups = undef
24-
$package_name = 'datadog-agent'
25-
$service_name = 'datadog-agent'
26-
$dogapi_version = 'installed'
27-
$conf_dir_purge = false
28-
$apt_default_release = 'stable'
29-
$apm_default_enabled = false
30-
$process_default_enabled = false
18+
$agent5_enable = false
19+
$conf_dir = '/etc/dd-agent/conf.d'
20+
$conf6_dir = '/etc/datadog-agent/conf.d'
21+
$dd_user = 'dd-agent'
22+
$dd_group = 'root'
23+
$dd_groups = undef
24+
$package_name = 'datadog-agent'
25+
$service_name = 'datadog-agent'
26+
$dogapi_version = 'installed'
27+
$conf_dir_purge = false
28+
$apt_default_release = 'stable'
29+
$apm_default_enabled = false
30+
$process_default_enabled = false
31+
$process_default_scrub_args = true
32+
$process_default_custom_words = []
3133

3234
case $::operatingsystem {
3335
'Ubuntu','Debian' : {

‎spec/classes/datadog_agent_spec.rb

+96-6
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@
308308
)}
309309
end
310310
context 'with skip_ssl_validation set to true' do
311-
let(:params) {{ :skip_ssl_validation => true,
311+
let(:params) {{ :skip_ssl_validation => true,
312312
:agent5_enable => true,
313313
}}
314314
it { should contain_concat__fragment('datadog header').with(
@@ -556,7 +556,7 @@
556556
)}
557557
end
558558
context 'with ganglia_host set to localhost and ganglia_port set to 12345' do
559-
let(:params) {{ :ganglia_host => 'testhost',
559+
let(:params) {{ :ganglia_host => 'testhost',
560560
:ganglia_port => '12345',
561561
:agent5_enable => true,
562562
}}
@@ -691,10 +691,10 @@
691691
)}
692692
end
693693
context 'with service_discovery enabled' do
694-
let(:params) {{ :service_discovery_backend => 'docker',
695-
:sd_config_backend => 'etcd',
696-
:sd_backend_host => 'localhost',
697-
:sd_backend_port => '8080',
694+
let(:params) {{ :service_discovery_backend => 'docker',
695+
:sd_config_backend => 'etcd',
696+
:sd_backend_host => 'localhost',
697+
:sd_backend_port => '8080',
698698
:sd_jmx_enable => true,
699699
:agent5_enable => true,
700700
}}
@@ -773,7 +773,47 @@
773773
)}
774774
end
775775

776+
context 'with data scrubbing disabled' do
777+
let(:params) {{
778+
:process_enabled => true,
779+
:agent5_enable => true,
780+
:scrub_args => false
781+
}}
782+
it { should contain_concat__fragment('datadog footer').with(
783+
'content' => /^process_agent_enabled: true\n/,
784+
)}
785+
it { should contain_concat__fragment('datadog process agent footer').with(
786+
'content' => /^\[process.config\]\n/,
787+
)}
788+
it { should contain_concat__fragment('datadog process agent footer').with(
789+
'content' => /^scrub_args: false\n/,
790+
)}
791+
it { should contain_concat__fragment('datadog process agent footer').with(
792+
'content' => /^custom_sensitive_words: \n/,
793+
)}
794+
end
795+
796+
context 'with data scrubbing enabled with custom sensitive_words' do
797+
let(:params) {{
798+
:process_enabled => true,
799+
:agent5_enable => true,
800+
:custom_sensitive_words => ['consul_token','dd_key']
801+
}}
802+
it { should contain_concat__fragment('datadog footer').with(
803+
'content' => /^process_agent_enabled: true\n/,
804+
)}
805+
it { should contain_concat__fragment('datadog process agent footer').with(
806+
'content' => /^\[process.config\]\n/,
807+
)}
808+
it { should contain_concat__fragment('datadog process agent footer').with(
809+
'content' => /^scrub_args: true\n/,
810+
)}
811+
it { should contain_concat__fragment('datadog process agent footer').with(
812+
'content' => /^custom_sensitive_words: consul_token,dd_key\n/,
813+
)}
776814
end
815+
816+
end
777817
end
778818

779819
if DEBIAN_OS.include?(operatingsystem)
@@ -848,6 +888,12 @@
848888
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
849889
'content' => /^\ \ enabled: disabled\n/,
850890
)}
891+
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
892+
'content' => /^\ \ scrub_args: true\n/,
893+
)}
894+
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
895+
'content' => /^\ \ custom_sensitive_words: \[\]\n/,
896+
)}
851897
end
852898
end
853899

@@ -931,6 +977,50 @@
931977
)}
932978
end
933979
end
980+
981+
context 'with data scrubbing custom options' do
982+
context 'with data scrubbing disabled' do
983+
let(:params) {{
984+
:process_enabled => true,
985+
:scrub_args => false
986+
}}
987+
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
988+
'content' => /^process_config:\n/,
989+
)}
990+
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
991+
'content' => /^\ \ enabled: 'true'\n/,
992+
)}
993+
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
994+
'content' => /^\ \ scrub_args: false\n/,
995+
)}
996+
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
997+
'content' => /^\ \ custom_sensitive_words: \[\]\n/,
998+
)}
999+
end
1000+
1001+
context 'with data scrubbing enabled with custom sensitive_words' do
1002+
let(:params) {{
1003+
:process_enabled => true,
1004+
:custom_sensitive_words => ['consul_token','dd_key']
1005+
}}
1006+
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
1007+
'content' => /^process_config:\n/,
1008+
)}
1009+
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
1010+
'content' => /^\ \ enabled: 'true'\n/,
1011+
)}
1012+
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
1013+
'content' => /^\ \ scrub_args: true\n/,
1014+
)}
1015+
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
1016+
'content' => /^\ \ -\ consul_token\n/,
1017+
)}
1018+
it { should contain_file('/etc/datadog-agent/datadog.yaml').with(
1019+
'content' => /^\ \ -\ dd_key\n/,
1020+
)}
1021+
1022+
end
1023+
end
9341024
end
9351025
end
9361026
end

‎templates/datadog_process_footer.conf.erb

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<% if @process_enabled -%>
2+
[process.config]
3+
scrub_args: <%= @scrub_args %>
4+
custom_sensitive_words: <%= @custom_sensitive_words.join(',') %>
5+
<% end -%>

0 commit comments

Comments
 (0)