Merge branch 'master' into zhengda.lu/propagate-tags

.builders/build.py

@@ -121,6 +121,7 @@ def build_macos():
             # Common compilation flags
             'LDFLAGS': f'-L{prefix_path}/lib',
             'CFLAGS': f'-I{prefix_path}/include -O2',
+            'CXXFLAGS': f'-I{prefix_path}/include -O2',
             # Build command for extra platform-specific build steps
             'DD_BUILD_COMMAND': f'bash {build_context_dir}/extra_build.sh'
         }

.builders/images/linux-aarch64/Dockerfile

@@ -9,9 +9,11 @@ ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
 COPY install-from-source.sh /
 
 ENV CFLAGS="-O2"
+ENV CXXFLAGS="${CFLAGS}"
 # Auditwheel will only set RPATH's for copied libs if an existing RPATH is found,
 # so we may as well set it to origin here anyway.
-ENV LDFLAGS="-Wl,-rpath,'\$\$ORIGIN'"
+# --strip-debug reduces binary sizes and improves reproducibility
+ENV LDFLAGS="-Wl,-rpath,'\$\$ORIGIN' -Wl,--strip-debug"
 
 # For Python 2, we get openssl(1) via yum just to get the necessary headers,
 # and we remove the package after compilation to prevent it from interfering
@@ -40,12 +42,9 @@ RUN yum install -y perl-IPC-Cmd && \
  RELATIVE_PATH="openssl-{{version}}" \
  # https://docs.python.org/3/using/unix.html#custom-openssl
  INSTALL_COMMAND="make install_sw" \
- # no-module prevents the creation of dynamically loaded modules that would be problematic to bundle into Python wheels
  CONFIGURE_SCRIPT="./config" \
  bash install-from-source.sh \
- --prefix=/usr/local/ssl \
  --openssldir=/etc/pki/tls \
- --libdir=lib \
  -fPIC shared \
  # This prevents the creation of dynamically loaded modules that would be problematic to bundle into Python wheels
  no-module \
@@ -63,15 +62,12 @@ RUN yum install -y libffi-devel && \
  RELATIVE_PATH="Python-{{version}}" \
  bash install-from-source.sh \
  --prefix=/opt/python/${PYTHON_VERSION} \
- --with-openssl=/usr/local/ssl \
- --with-openssl-rpath=auto \
  --with-ensurepip=yes \
  --enable-ipv6 \
  --with-dbmliborder=
 ENV PATH="/opt/python/${PYTHON_VERSION}/bin:${PATH}"
 # Set up virtual environment for Python 3
-RUN export LD_LIBRARY_PATH="/opt/python/${PYTHON_VERSION}/lib:${LD_LIBRARY_PATH}"; \
- /opt/python/${PYTHON_VERSION}/bin/python3 -m pip install --no-warn-script-location --upgrade pip \
+RUN /opt/python/${PYTHON_VERSION}/bin/python3 -m pip install --no-warn-script-location --upgrade pip \
  && /opt/python/${PYTHON_VERSION}/bin/python3 -m pip install --no-warn-script-location virtualenv \
  && /opt/python/${PYTHON_VERSION}/bin/python3 -m virtualenv /py3
 
@@ -114,7 +110,6 @@ RUN \
  --disable-static
 
 # libpq and pg_config as needed by psycopg2
-RUN yum install openssl-devel -y
 RUN \
  DOWNLOAD_URL="https://ftp.postgresql.org/pub/source/v{{version}}/postgresql-{{version}}.tar.bz2" \
  VERSION="16.0" \
@@ -180,7 +175,7 @@ RUN \
     --without-gnutls \
     --without-librtmp \
     --without-libssh2 \
-    --with-ssl=/usr/local/ssl \
+    --with-ssl=/usr/local \
  && rm /usr/local/bin/curl
 
 # https://doc.rust-lang.org/cargo/reference/config.html#netgit-fetch-with-cli

.builders/images/linux-aarch64/build_script.sh

@@ -25,18 +25,18 @@ if [[ "${DD_BUILD_PYTHON_VERSION}" == "3" ]]; then
         RELATIVE_PATH="librdkafka-{{version}}" \
         bash install-from-source.sh --enable-sasl --enable-curl
     always_build+=("confluent-kafka")
-else
-    echo "CFLAGS=\"-I/usr/local/ssl/include ${CFLAGS}\"" >> $DD_ENV_FILE
-    echo "LDFLAGS=\"-L/usr/local/ssl/lib ${LDFLAGS}\"" >> $DD_ENV_FILE
 
+    # The version of pyodbc is dynamically linked against a version of the odbc which doesn't come included in the wheel
+    # That causes the omnibus' health check to flag it. Forcing the build so that we do include it in the wheel.
+    always_build+=("pyodbc")
+else
     # Not working on Python 2
     sed -i '/aerospike==/d' /home/requirements.in
 fi
 
-# Empty arrays are flagged as unset when using the `-u` flag. This is the safest way to work around that
-# (see https://stackoverflow.com/a/61551944)
-pip_no_binary=${always_build[@]+"${always_build[@]}"}
+# package names passed to PIP_NO_BINARY need to be separated by commas
+pip_no_binary=$(IFS=, ; printf "${always_build[*]-}")
 if [[ "$pip_no_binary" ]]; then
     # If there are any packages that must always be built, inform pip
-    echo "PIP_NO_BINARY=\"${pip_no_binary}\"" >> $DD_ENV_FILE
+    echo "PIP_NO_BINARY=${pip_no_binary}" >> $DD_ENV_FILE
 fi

.builders/images/linux-x86_64/Dockerfile

@@ -9,9 +9,11 @@ ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
 COPY install-from-source.sh /
 
 ENV CFLAGS="-O2"
+ENV CXXFLAGS="${CFLAGS}"
 # Auditwheel will only set RPATH's for copied libs if an existing RPATH is found,
 # so we may as well set it to origin here anyway.
-ENV LDFLAGS="-Wl,-rpath,'\$\$ORIGIN'"
+# --strip-debug reduces binary sizes and improves reproducibility
+ENV LDFLAGS="-Wl,-rpath,'\$\$ORIGIN' -Wl,--strip-debug"
 
 # For Python 2, we get openssl(1) via yum just to get the necessary headers,
 # and we remove the package after compilation to prevent it from interfering

.builders/images/linux-x86_64/build_script.sh

@@ -22,12 +22,15 @@ if [[ "${DD_BUILD_PYTHON_VERSION}" == "3" ]]; then
         RELATIVE_PATH="librdkafka-{{version}}" \
         bash install-from-source.sh --enable-sasl --enable-curl
     always_build+=("confluent-kafka")
+
+    # The version of pyodbc is dynamically linked against a version of the odbc which doesn't come included in the wheel
+    # That causes the omnibus' health check to flag it. Forcing the build so that we do include it in the wheel.
+    always_build+=("pyodbc")
 fi
 
-# Empty arrays are flagged as unset when using the `-u` flag. This is the safest way to work around that
-# (see https://stackoverflow.com/a/61551944)
-pip_no_binary=${always_build[@]+"${always_build[@]}"}
+# package names passed to PIP_NO_BINARY need to be separated by commas
+pip_no_binary=$(IFS=, ; printf "${always_build[*]-}")
 if [[ "$pip_no_binary" ]]; then
     # If there are any packages that must always be built, inform pip
-    echo "PIP_NO_BINARY=\"${pip_no_binary}\"" >> $DD_ENV_FILE
+    echo "PIP_NO_BINARY=${pip_no_binary}" >> $DD_ENV_FILE
 fi

.codecov.yml

@@ -58,6 +58,14 @@ coverage:
         target: 75
         flags:
         - argocd
+      Argo_Rollouts:
+        target: 75
+        flags:
+        - argo_rollouts
+      Argo_Workflows:
+        target: 75
+        flags:
+        - argo_workflows
       Avi_Vantage:
         target: 75
         flags:
@@ -700,6 +708,16 @@ flags:
     paths:
     - arangodb/datadog_checks/arangodb
     - arangodb/tests
+  argo_rollouts:
+    carryforward: true
+    paths:
+    - argo_rollouts/datadog_checks/argo_rollouts
+    - argo_rollouts/tests
+  argo_workflows:
+    carryforward: true
+    paths:
+    - argo_workflows/datadog_checks/argo_workflows
+    - argo_workflows/tests
   argocd:
     carryforward: true
     paths:

.ddev/config.toml

@@ -131,7 +131,12 @@ tuf = 'https://github.com/theupdateframework/python-tuf'
 typing = 'https://github.com/python/typing'
 
 [overrides.validate.openmetrics]
-exclude = ["openmetrics"]
+exclude = [
+    "kube_apiserver_metrics",
+    "kube_controller_manager",
+    "kube_scheduler",
+    "openmetrics",
+]
 
 [overrides.validate.labeler]
 include = ["datadog_checks_tests_helper"]
@@ -150,6 +155,13 @@ exclude = [
     'system_swap',
     'tcp_check',
 ]
+unsorted = [
+    'couch', # tests depend on the order for now
+    'envoy',
+    'ibm_ace',
+    'istio',
+    'otel',
+]
 
 [overrides.dep.updates]
 exclude = [
@@ -158,8 +170,6 @@ exclude = [
     'pyasn1',  # https://github.com/pyasn1/pyasn1/issues/52
     'pysnmp',  # Breaking snmp tests
     'aerospike',  # v8+ breaks agent build.
-    # We need pydantic 2.0.2 for the rpm x64 agent build (see https://github.com/DataDog/datadog-agent/pull/18303)
-    'pydantic',
     # https://github.com/DataDog/integrations-core/pull/16080
     'lxml',
     # We need to keep an `oracledb` version that uses the same version of odpi that is used in godror in the agent repo.
@@ -169,18 +179,8 @@ exclude = [
     # We're not ready to switch to v3 of the postgres library, see:
     # https://github.com/DataDog/integrations-core/pull/15859
     'psycopg2-binary',
-    # orjson ... requires rustc 1.65+, but the latest we can have (thanks CentOS 6) is 1.62.
-    # We get the following error when compiling orjson on Centos 6:
-    # error: package `associative-cache v2.0.0` cannot be built because it requires rustc 1.65 or newer,
-    # while the currently active rustc version is 1.62.0-nightly
-    # Here's orjson switching to rustc 1.65:
-    # https://github.com/ijl/orjson/commit/ce9bae876657ed377d761bf1234b040e2cc13d3c
-    'orjson',
     # 2.4.10 is broken on py2 and they did not yank the version
     'rethinkdb',
-    # cryptography>=42 requires rust>=1.63.0. We have rust 1.62 on centos 6
-    # https://github.com/DataDog/datadog-agent/pull/22268
-    'cryptography',
     # Brings urllib 2.0.7 which breaks `test_uds_request` in the base check
     # https://github.com/kubernetes-client/python/pull/2131
     'kubernetes',

.deps/image_digests.json

@@ -1,5 +1,5 @@
 {
-  "linux-aarch64": "sha256:f43a1ece17685ccdb4598770b77936df78fe3db6ffca00139912a62571521de0",
-  "linux-x86_64": "sha256:a5d28b97412f94d8be1c5d7964259be6f3d7007ff48717cbf1354c6e6ce6367f",
-  "windows-x86_64": "sha256:7b50e0faef6979c1829221034479ec4c27b8db9bd04b5c9a3c9491c3453fb0f8"
+  "linux-aarch64": "sha256:c1de352bb5190af0ca31b97733def61ecac3a5d860ee785a14e4903391f545f3",
+  "linux-x86_64": "sha256:a98d015df794eef51f0dd87902545e63f5d7ade806dcc9d5a12485f35cce5d76",
+  "windows-x86_64": "sha256:b043c0be4a1efef46876ba44f19319cb908f8b33ecf9a8b2c6d554f830d52260"
 }

.deps/metadata.json

@@ -1,3 +1,3 @@
 {
-  "sha256": "cbff574c16bcd0268339269adc7034adcf379eea4dca74635ac49768c669d526"
+  "sha256": "e150e73f7a409b5d98e731e5b73ae4451912c636a1b49d9f888eb3c0609ce015"
 }