Add APPSEC_OTEL_COLLECTOR scenario — DD tracer + OTel Collector, no DD Agent (APPSEC-68836) - #7586
Draft
RamyElkest wants to merge 6 commits into
Conversation
… Agent for RC) New scenario: APPSEC_OTEL_COLLECTOR and APPSEC_OTEL_COLLECTOR_DEFAULT_RULES - DD Tracer exports via OTLP to OTel Collector (datadog exporter) - DD Agent included for /info only (tracer needs agent to initialize) - No Remote Config (no rc_api_enabled) Key finding: weblog image needs opentelemetry-exporter-otlp-proto-http installed for OTLP export to work. Currently only opentelemetry-api is installed. The flask-poc base image does not include the OTLP exporter package. Test decorators added to existing appsec test files for both scenarios.
The tracer initializes AppSec with DD_AGENT_HOST="" and WAF blocking works without any DD Agent. The OTel Collector handles the data plane (traces via OTLP → datadog exporter), and static rules don't need RC. Test results: 85 passed, 4 failed (missing_feature for Python), 30 deselected — same as with the agent included.
Contributor
|
|
🎉 All green!❄️ No new flaky tests detected 🔗 Commit SHA: 81dd36d | Docs | View more details | Give us feedback! |
…pport (APPSEC-68836) - Fix mypy dict invariance: cast base_env to dict[str, str | None] - Add weblog_categories=[WeblogCategory.dd_trace] to scenario - Add APPSEC_OTEL_COLLECTOR scenarios to _is_supported_legacy in test_ci_orchestrator - Add scenarios to test_group_rules exclusion list - Fix ruff: move imports to top level, add noqa for private access - Format with ruff
RamyElkest
changed the base branch from
main
to
ramy.elkest/add-appsec-otlp-export-scenarios-APPSEC-68836
August 25, 2026 23:53
…n list (APPSEC-68836)
New scenarios: - APPSEC_OTEL_COLLECTOR_RASP: RASP with rasp_ruleset.json, no RC needed - APPSEC_OTEL_COLLECTOR_API_SECURITY: API Security with DD_API_SECURITY_ENABLED=true Test decorators added: - 60 RASP test classes across 6 files (test_cmdi, test_lfi, test_sqli, test_ssrf, test_shi, test_api10) - 16 API Security test classes across 4 files (test_schemas, test_schemas_auth, test_endpoint_discovery, test_apisecurity_telemetry) RASP results: 30 passed, 30 failed (StackTrace/Telemetry tests need adapter fixes, API10 needs InternalServerContainer) API Security: tests running, some schema assertion failures Added all new scenarios to test_group_rules exclusion list.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Tests the DDOT topology: DD Tracer exporting via OTLP to an OTel Collector (with datadog exporter), no DD Agent, no Remote Config.
Related: #7578 (M2 — OTLP export via DD agent)
Architecture
No DD Agent. No Remote Config. Static rules only.
What's New
New Scenario
APPSEC_OTEL_COLLECTOR— DD tracer + OTel Collector (data plane), no DD Agent:AppSecOtelCollectorScenarioclass inutils/_context/_scenarios/appsec_otel_collector.pyOpenTelemetryCollectorContainerwith existingotelcol-config.ymlrc_api_enabled— no Remote ConfigTest Decorators
Added
@scenarios.appsec_otel_collectorto existing appsec test classes (same set as PR #7578, minus RC-dependent tests).Key Findings
DD_AGENT_HOST=""lets the tracer initialize AppSec with static rules onlyopentelemetry-exporter-otlp-proto-httpinstalled (already in Dockerfile but image needed rebuild)DataDogLibraryTraceOTLPadapter works for collector pathTest Results
The 4 failures are
missing_featurefor Python (body filenames/files content) — manifest doesn't skip them due tootel-apiversion parsing issue withDD_TRACE_OTEL_ENABLED=true.What's NOT Tested (no RC)
Files Changed
utils/_context/_scenarios/appsec_otel_collector.py— scenario classutils/_context/_scenarios/__init__.py— scenario registrationtests/appsec/—@scenariosdecorators