Serverless FIPS

[apiarian-datadog]

What does this PR do?

Motivation

Describe how you validated your changes

Possible Drawbacks / Trade-offs

Additional Notes

[bits-bot]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[agent-platform-auto-pr]

Static quality checks ✅

Please find below the results from static quality gates

Info

Result	Quality gate	On disk size	On disk size limit	On wire size	On wire size limit
✅	static_quality_gate_agent_deb_amd64	845.13MiB	858.45MiB	203.62MiB	214.3MiB
✅	static_quality_gate_docker_agent_amd64	929.34MiB	942.69MiB	310.73MiB	321.56MiB

[agent-platform-auto-pr]

Uncompressed package size comparison

Comparison with ancestor a7e58c617398e40e4d9f730f855b5bda963f3d42

Diff per package

package	diff	status	size	ancestor	threshold
datadog-agent-arm64-deb	0.00MB	✅	864.97MB	864.97MB	0.50MB
datadog-agent-aarch64-rpm	0.00MB	✅	874.69MB	874.69MB	0.50MB
datadog-agent-x86_64-rpm	0.00MB	✅	886.92MB	886.92MB	0.50MB
datadog-agent-x86_64-suse	0.00MB	✅	886.92MB	886.92MB	0.50MB
datadog-agent-amd64-deb	0.00MB	✅	877.18MB	877.18MB	0.50MB
datadog-dogstatsd-amd64-deb	0.00MB	✅	59.02MB	59.02MB	0.50MB
datadog-dogstatsd-x86_64-rpm	0.00MB	✅	59.09MB	59.09MB	0.50MB
datadog-dogstatsd-x86_64-suse	0.00MB	✅	59.09MB	59.09MB	0.50MB
datadog-dogstatsd-arm64-deb	0.00MB	✅	56.50MB	56.50MB	0.50MB
datadog-heroku-agent-amd64-deb	0.00MB	✅	456.44MB	456.44MB	0.50MB
datadog-iot-agent-amd64-deb	0.00MB	✅	93.83MB	93.83MB	0.50MB
datadog-iot-agent-x86_64-rpm	0.00MB	✅	93.90MB	93.90MB	0.50MB
datadog-iot-agent-x86_64-suse	0.00MB	✅	93.90MB	93.90MB	0.50MB
datadog-iot-agent-arm64-deb	0.00MB	✅	89.89MB	89.89MB	0.50MB
datadog-iot-agent-aarch64-rpm	0.00MB	✅	89.96MB	89.96MB	0.50MB

Decision

✅ Passed

[cit-pr-commenter]

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 8853d175-6475-4ee6-a298-50bf49d3f065

Baseline: 2d95154
Comparison: a15eadb
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	tcp_syslog_to_blackhole	ingress throughput	+0.60	[+0.53, +0.68]	1	Logs
➖	file_to_blackhole_1000ms_latency_linear_load	egress throughput	+0.35	[-0.13, +0.83]	1	Logs
➖	quality_gate_idle_all_features	memory utilization	+0.31	[+0.24, +0.38]	1	Logs bounds checks dashboard
➖	file_to_blackhole_100ms_latency	egress throughput	+0.10	[-0.61, +0.82]	1	Logs
➖	file_to_blackhole_1000ms_latency	egress throughput	+0.09	[-0.69, +0.86]	1	Logs
➖	file_to_blackhole_0ms_latency_http1	egress throughput	+0.06	[-0.83, +0.94]	1	Logs
➖	file_to_blackhole_0ms_latency_http2	egress throughput	+0.05	[-0.85, +0.95]	1	Logs
➖	file_to_blackhole_300ms_latency	egress throughput	+0.02	[-0.62, +0.66]	1	Logs
➖	tcp_dd_logs_filter_exclude	ingress throughput	+0.00	[-0.02, +0.03]	1	Logs
➖	file_to_blackhole_0ms_latency	egress throughput	-0.00	[-0.86, +0.85]	1	Logs
➖	uds_dogstatsd_to_api	ingress throughput	-0.01	[-0.28, +0.26]	1	Logs
➖	file_to_blackhole_500ms_latency	egress throughput	-0.02	[-0.79, +0.75]	1	Logs
➖	quality_gate_idle	memory utilization	-0.18	[-0.22, -0.15]	1	Logs bounds checks dashboard
➖	file_tree	memory utilization	-0.63	[-0.70, -0.56]	1	Logs
➖	quality_gate_logs	% cpu utilization	-1.72	[-4.76, +1.32]	1	Logs
➖	uds_dogstatsd_to_api_cpu	% cpu utilization	-4.60	[-5.44, -3.76]	1	Logs

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	links
✅	file_to_blackhole_0ms_latency	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency	memory_usage	10/10
✅	file_to_blackhole_0ms_latency_http1	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency_http1	memory_usage	10/10
✅	file_to_blackhole_0ms_latency_http2	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency_http2	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency_linear_load	memory_usage	10/10
✅	file_to_blackhole_100ms_latency	lost_bytes	10/10
✅	file_to_blackhole_100ms_latency	memory_usage	10/10
✅	file_to_blackhole_300ms_latency	lost_bytes	10/10
✅	file_to_blackhole_300ms_latency	memory_usage	10/10
✅	file_to_blackhole_500ms_latency	lost_bytes	10/10
✅	file_to_blackhole_500ms_latency	memory_usage	10/10
✅	quality_gate_idle	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_idle	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_idle_all_features	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_logs	intake_connections	10/10
✅	quality_gate_logs	lost_bytes	10/10
✅	quality_gate_logs	memory_usage	10/10

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

• ✅ = significantly better comparison variant performance
• ❌ = significantly worse comparison variant performance
• ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

3. Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

• quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
• quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
• quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
• quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
• quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
• quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
• quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.

[github-actions]

Serverless Benchmark Results

BenchmarkStartEndInvocation comparison between 8b7083d and aceb7dd.

tl;dr

Use these benchmarks as an insight tool during development.

1. Skim down the vs base column in each chart. If there is a ~, then there was no statistically significant change to the benchmark. Otherwise, ensure the estimated percent change is either negative or very small.

2. The last row of each chart is the geomean. Ensure this percentage is either negative or very small.

What is this benchmarking?

The BenchmarkStartEndInvocation compares the amount of time it takes to call the start-invocation and end-invocation endpoints. For universal instrumentation languages (Dotnet, Golang, Java, Ruby), this represents the majority of the duration overhead added by our tracing layer.

The benchmark is run using a large variety of lambda request payloads. In the charts below, there is one row for each event payload type.

How do I interpret these charts?

The charts below comes from benchstat. They represent the statistical change in duration (sec/op), memory overhead (B/op), and allocations (allocs/op).

The benchstat docs explain how to interpret these charts.

Before the comparison table, we see common file-level configuration. If there are benchmarks with different configuration (for example, from different packages), benchstat will print separate tables for each configuration.

The table then compares the two input files for each benchmark. It shows the median and 95% confidence interval summaries for each benchmark before and after the change, and an A/B comparison under "vs base". ... The p-value measures how likely it is that any differences were due to random chance (i.e., noise). The "~" means benchstat did not detect a statistically significant difference between the two inputs. ...

Note that "statistically significant" is not the same as "large": with enough low-noise data, even very small changes can be distinguished from noise and considered statistically significant. It is, of course, generally easier to distinguish large changes from noise.

Finally, the last row of the table shows the geometric mean of each column, giving an overall picture of how the benchmarks changed. Proportional changes in the geomean reflect proportional changes in the benchmarks. For example, given n benchmarks, if sec/op for one of them increases by a factor of 2, then the sec/op geomean will increase by a factor of ⁿ√2.

I need more help

First off, do not worry if the benchmarks are failing. They are not tests. The intention is for them to be a tool for you to use during development.

If you would like a hand interpreting the results come chat with us in #serverless-agent in the internal DataDog slack or in #serverless in the public DataDog slack. We're happy to help!

Benchmark stats

goos: linux
goarch: amd64
pkg: github.com/DataDog/datadog-agent/pkg/serverless/daemon
cpu: AMD EPYC 7763 64-Core Processor                
                                      │ baseline/benchmark.log │       current/benchmark.log        │
                                      │         sec/op         │   sec/op     vs base               │
api-gateway-appsec.json                            94.18µ ± 2%   87.54µ ± 5%  -7.05% (p=0.002 n=10)
api-gateway-kong-appsec.json                       73.23µ ± 2%   67.99µ ± 5%  -7.15% (p=0.002 n=10)
api-gateway-kong.json                              69.58µ ± 1%   64.83µ ± 1%  -6.82% (p=0.000 n=10)
api-gateway-non-proxy-async.json                   109.5µ ± 2%   102.4µ ± 1%  -6.51% (p=0.000 n=10)
api-gateway-non-proxy.json                         108.4µ ± 1%   101.0µ ± 1%  -6.79% (p=0.000 n=10)
api-gateway-websocket-connect.json                 70.06µ ± 1%   65.88µ ± 1%  -5.97% (p=0.000 n=10)
api-gateway-websocket-default.json                 62.32µ ± 1%   58.55µ ± 2%  -6.05% (p=0.000 n=10)
api-gateway-websocket-disconnect.json              62.11µ ± 1%   58.92µ ± 2%  -5.14% (p=0.000 n=10)
api-gateway.json                                   115.5µ ± 1%   108.8µ ± 2%  -5.75% (p=0.000 n=10)
application-load-balancer.json                     62.12µ ± 1%   59.02µ ± 1%  -4.98% (p=0.000 n=10)
cloudfront.json                                    47.20µ ± 1%   45.00µ ± 2%  -4.66% (p=0.000 n=10)
cloudwatch-events.json                             39.15µ ± 1%   37.82µ ± 1%  -3.40% (p=0.000 n=10)
cloudwatch-logs.json                               65.10µ ± 1%   60.13µ ± 2%  -7.63% (p=0.000 n=10)
custom.json                                        32.50µ ± 0%   31.74µ ± 2%  -2.34% (p=0.000 n=10)
dynamodb.json                                      91.71µ ± 2%   86.62µ ± 1%  -5.54% (p=0.000 n=10)
empty.json                                         31.61µ ± 2%   30.11µ ± 0%  -4.74% (p=0.000 n=10)
eventbridge-custom.json                            48.89µ ± 1%   46.40µ ± 1%  -5.08% (p=0.000 n=10)
eventbridge-no-bus.json                            47.71µ ± 2%   45.18µ ± 1%  -5.30% (p=0.000 n=10)
eventbridge-no-timestamp.json                      48.21µ ± 1%   45.47µ ± 1%  -5.67% (p=0.000 n=10)
eventbridgesns.json                                62.52µ ± 2%   59.76µ ± 1%  -4.41% (p=0.002 n=10)
eventbridgesqs.json                                69.87µ ± 1%   66.55µ ± 1%  -4.76% (p=0.000 n=10)
http-api.json                                      68.61µ ± 1%   65.81µ ± 1%  -4.09% (p=0.000 n=10)
kinesis-batch.json                                 69.39µ ± 3%   66.31µ ± 1%  -4.44% (p=0.000 n=10)
kinesis.json                                       54.64µ ± 2%   53.00µ ± 1%  -3.00% (p=0.001 n=10)
s3.json                                            58.40µ ± 1%   57.02µ ± 1%  -2.37% (p=0.000 n=10)
sns-batch.json                                     88.22µ ± 1%   84.28µ ± 1%  -4.47% (p=0.000 n=10)
sns.json                                           66.42µ ± 2%   64.54µ ± 1%  -2.83% (p=0.000 n=10)
snssqs.json                                        111.3µ ± 1%   106.7µ ± 2%  -4.13% (p=0.000 n=10)
snssqs_no_dd_context.json                         101.95µ ± 2%   97.66µ ± 1%  -4.21% (p=0.001 n=10)
sqs-aws-header.json                                55.24µ ± 2%   53.44µ ± 1%  -3.26% (p=0.000 n=10)
sqs-batch.json                                     91.49µ ± 1%   87.36µ ± 1%  -4.52% (p=0.000 n=10)
sqs.json                                           67.23µ ± 2%   64.93µ ± 1%  -3.43% (p=0.000 n=10)
sqs_no_dd_context.json                             61.31µ ± 1%   59.03µ ± 1%  -3.72% (p=0.000 n=10)
stepfunction.json                                  43.08µ ± 1%   41.58µ ± 1%  -3.50% (p=0.002 n=10)
geomean                                            65.48µ        62.32µ       -4.82%

                                      │ baseline/benchmark.log │        current/benchmark.log        │
                                      │          B/op          │     B/op      vs base               │
api-gateway-appsec.json                           37.32Ki ± 0%   37.32Ki ± 0%       ~ (p=0.066 n=10)
api-gateway-kong-appsec.json                      26.96Ki ± 0%   26.96Ki ± 0%       ~ (p=0.666 n=10)
api-gateway-kong.json                             24.43Ki ± 0%   24.43Ki ± 0%       ~ (p=0.253 n=10)
api-gateway-non-proxy-async.json                  47.96Ki ± 0%   47.96Ki ± 0%       ~ (p=0.239 n=10)
api-gateway-non-proxy.json                        47.15Ki ± 0%   47.14Ki ± 0%       ~ (p=0.238 n=10)
api-gateway-websocket-connect.json                25.37Ki ± 0%   25.36Ki ± 0%       ~ (p=0.872 n=10)
api-gateway-websocket-default.json                21.25Ki ± 0%   21.26Ki ± 0%       ~ (p=0.837 n=10)
api-gateway-websocket-disconnect.json             21.01Ki ± 0%   21.02Ki ± 0%       ~ (p=0.078 n=10)
api-gateway.json                                  49.29Ki ± 0%   49.29Ki ± 0%       ~ (p=0.255 n=10)
application-load-balancer.json                    22.48Ki ± 0%   22.48Ki ± 0%       ~ (p=0.284 n=10)
cloudfront.json                                   17.46Ki ± 0%   17.46Ki ± 0%       ~ (p=0.743 n=10)
cloudwatch-events.json                            11.52Ki ± 0%   11.52Ki ± 0%       ~ (p=0.496 n=10)
cloudwatch-logs.json                              53.07Ki ± 0%   53.07Ki ± 0%       ~ (p=0.137 n=10)
custom.json                                       9.557Ki ± 0%   9.557Ki ± 0%       ~ (p=0.761 n=10)
dynamodb.json                                     40.31Ki ± 0%   40.32Ki ± 0%  +0.02% (p=0.002 n=10)
empty.json                                        9.095Ki ± 0%   9.095Ki ± 0%       ~ (p=0.184 n=10)
eventbridge-custom.json                           14.69Ki ± 0%   14.69Ki ± 0%       ~ (p=0.115 n=10)
eventbridge-no-bus.json                           13.66Ki ± 0%   13.66Ki ± 0%       ~ (p=0.558 n=10)
eventbridge-no-timestamp.json                     13.66Ki ± 0%   13.66Ki ± 0%  +0.02% (p=0.004 n=10)
eventbridgesns.json                               20.46Ki ± 0%   20.47Ki ± 0%  +0.01% (p=0.004 n=10)
eventbridgesqs.json                               24.60Ki ± 0%   24.60Ki ± 0%  +0.01% (p=0.037 n=10)
http-api.json                                     23.27Ki ± 0%   23.27Ki ± 0%  +0.02% (p=0.007 n=10)
kinesis-batch.json                                26.52Ki ± 0%   26.52Ki ± 0%       ~ (p=0.236 n=10)
kinesis.json                                      17.40Ki ± 0%   17.40Ki ± 0%       ~ (p=0.784 n=10)
s3.json                                           19.89Ki ± 0%   19.90Ki ± 0%  +0.01% (p=0.038 n=10)
sns-batch.json                                    39.09Ki ± 0%   39.09Ki ± 0%  +0.01% (p=0.016 n=10)
sns.json                                          24.51Ki ± 0%   24.51Ki ± 0%       ~ (p=0.172 n=10)
snssqs.json                                       52.71Ki ± 0%   52.71Ki ± 0%       ~ (p=0.195 n=10)
snssqs_no_dd_context.json                         46.47Ki ± 0%   46.47Ki ± 0%       ~ (p=0.337 n=10)
sqs-aws-header.json                               18.77Ki ± 0%   18.77Ki ± 0%       ~ (p=0.987 n=10)
sqs-batch.json                                    41.27Ki ± 0%   41.27Ki ± 0%       ~ (p=0.909 n=10)
sqs.json                                          25.40Ki ± 0%   25.41Ki ± 0%  +0.01% (p=0.034 n=10)
sqs_no_dd_context.json                            21.03Ki ± 0%   21.03Ki ± 0%       ~ (p=0.902 n=10)
stepfunction.json                                 13.50Ki ± 0%   13.50Ki ± 0%       ~ (p=0.444 n=10)
geomean                                           24.12Ki        24.12Ki       +0.00%

                                      │ baseline/benchmark.log │        current/benchmark.log        │
                                      │       allocs/op        │ allocs/op   vs base                 │
api-gateway-appsec.json                             627.0 ± 0%   627.0 ± 0%       ~ (p=1.000 n=10) ¹
api-gateway-kong-appsec.json                        485.0 ± 0%   485.0 ± 0%       ~ (p=1.000 n=10) ¹
api-gateway-kong.json                               463.0 ± 0%   463.0 ± 0%       ~ (p=1.000 n=10) ¹
api-gateway-non-proxy-async.json                    720.0 ± 0%   720.0 ± 0%       ~ (p=1.000 n=10) ¹
api-gateway-non-proxy.json                          710.0 ± 0%   710.0 ± 0%       ~ (p=1.000 n=10) ¹
api-gateway-websocket-connect.json                  448.0 ± 0%   448.0 ± 0%       ~ (p=1.000 n=10)
api-gateway-websocket-default.json                  373.0 ± 0%   373.0 ± 0%       ~ (p=1.000 n=10) ¹
api-gateway-websocket-disconnect.json               363.0 ± 0%   363.0 ± 0%       ~ (p=1.000 n=10) ¹
api-gateway.json                                    782.0 ± 0%   782.0 ± 0%       ~ (p=1.000 n=10) ¹
application-load-balancer.json                      347.0 ± 0%   347.0 ± 0%       ~ (p=1.000 n=10) ¹
cloudfront.json                                     278.0 ± 0%   278.0 ± 0%       ~ (p=1.000 n=10) ¹
cloudwatch-events.json                              215.0 ± 0%   215.0 ± 0%       ~ (p=1.000 n=10) ¹
cloudwatch-logs.json                                208.0 ± 0%   208.0 ± 0%       ~ (p=1.000 n=10) ¹
custom.json                                         163.0 ± 0%   163.0 ± 0%       ~ (p=1.000 n=10) ¹
dynamodb.json                                       579.0 ± 0%   579.0 ± 0%       ~ (p=1.000 n=10) ¹
empty.json                                          154.0 ± 0%   154.0 ± 0%       ~ (p=1.000 n=10) ¹
eventbridge-custom.json                             258.0 ± 0%   258.0 ± 0%       ~ (p=1.000 n=10) ¹
eventbridge-no-bus.json                             249.0 ± 0%   249.0 ± 0%       ~ (p=1.000 n=10) ¹
eventbridge-no-timestamp.json                       249.0 ± 0%   249.0 ± 0%       ~ (p=1.000 n=10) ¹
eventbridgesns.json                                 315.0 ± 0%   315.0 ± 0%       ~ (p=1.000 n=10) ¹
eventbridgesqs.json                                 355.0 ± 0%   355.0 ± 0%       ~ (p=1.000 n=10) ¹
http-api.json                                       421.0 ± 0%   421.0 ± 0%       ~ (p=1.000 n=10) ¹
kinesis-batch.json                                  380.0 ± 0%   380.0 ± 0%       ~ (p=1.000 n=10) ¹
kinesis.json                                        276.0 ± 0%   276.0 ± 0%       ~ (p=1.000 n=10) ¹
s3.json                                             348.0 ± 0%   348.0 ± 0%       ~ (p=1.000 n=10) ¹
sns-batch.json                                      462.0 ± 0%   462.0 ± 0%       ~ (p=1.000 n=10) ¹
sns.json                                            333.0 ± 0%   333.0 ± 0%       ~ (p=1.000 n=10) ¹
snssqs.json                                         457.0 ± 0%   457.0 ± 0%       ~ (p=1.000 n=10) ¹
snssqs_no_dd_context.json                           417.0 ± 0%   417.0 ± 0%       ~ (p=1.000 n=10) ¹
sqs-aws-header.json                                 273.0 ± 0%   273.0 ± 0%       ~ (p=1.000 n=10) ¹
sqs-batch.json                                      497.0 ± 0%   497.0 ± 0%       ~ (p=1.000 n=10) ¹
sqs.json                                            348.0 ± 0%   348.0 ± 0%       ~ (p=1.000 n=10) ¹
sqs_no_dd_context.json                              334.0 ± 0%   334.0 ± 0%       ~ (p=1.000 n=10) ¹
stepfunction.json                                   223.0 ± 0%   223.0 ± 0%       ~ (p=1.000 n=10) ¹
geomean                                             356.8        356.8       +0.00%
¹ all samples are equal

[agent-platform-auto-pr]

[Fast Unit Tests Report]

On pipeline 55457256 (CI Visibility). The following jobs did not run any unit tests:

Jobs:

• tests_windows-x64

If you modified Go files and expected unit tests to run in these jobs, please double check the job logs. If you think tests should have been executed reach out to #agent-devx-help

[agent-platform-auto-pr]

Test changes on VM

Use this command from test-infra-definitions to manually test this PR changes on a VM:

inv aws.create-vm --pipeline-id=55457256 --os-family=ubuntu

Note: This applies to commit cdafae7