Skip to content

Add a lightweight gate for prepared Agent rollouts - #54832

Closed
AliDatadog wants to merge 17 commits into
mainfrom
ali.b/prepared-agent-surge
Closed

Add a lightweight gate for prepared Agent rollouts#54832
AliDatadog wants to merge 17 commits into
mainfrom
ali.b/prepared-agent-surge

Conversation

@AliDatadog

@AliDatadog AliDatadog commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Why

A DaemonSet update can delete a working Agent before Kubernetes pulls and starts its replacement. A slow or failed pull can therefore leave a node without an Agent.

What does this PR do?

This PR adds an experimental Linux agent-rollout-gate binary to the node Agent images.

The Operator starts this binary before each Agent component. The gate waits for a component-specific host lock before it starts the real process. Kubernetes can therefore pull and create a replacement Pod while the old Agent still serves. Each component changes ownership independently, so a slow system-probe shutdown does not block the core Agent or trace Agent.

The gate keeps the startup probe unsuccessful while it waits. After it gets the lock, the gate starts the Agent and forwards the original health check. An unhealthy process releases its lock after the original startup failure budget. Failure-state I/O also fails safe by terminating the active process.

The waiting gate exits on Pod termination. FIPS packages build it with the required system-crypto CGO mode; other packages keep the static build.

This mechanism does not transfer Agent queues, caches, Cluster Agent assignments, metadata, or process state.

Validation

  • Focused DDA tests: 9 passed.
  • Focused Go lint: 0 issues.
  • The development build produced verified Linux amd64 and arm64 gate binaries.
  • The Agent pre-push Go tests and linters passed on the final branch commit.

Experimental-cluster validation starts after the three PoC PRs are reviewed.

Related PRs

Deploy the gate-capable Agent image with the ordinary rollout before you enable prepared mode.

@github-actions

github-actions Bot commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

@codex review

@AliDatadog AliDatadog mentioned this pull request Aug 13, 2026
Draft
@dd-octo-sts dd-octo-sts Bot added the internal Identify a non-fork PR label Aug 13, 2026
@github-actions github-actions Bot added the long review PR is complex, plan time to review it label Aug 13, 2026
@AliDatadog AliDatadog added the changelog/no-changelog No changelog entry needed label Aug 13, 2026 — with ddtool CLI
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Aug 13, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3f10665ecd

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread cmd/agent-rollout-gate/main_test.go Outdated
t.Setenv(activePathEnv, filepath.Join(dir, "trace-agent.active"))
t.Setenv(podUIDEnv, "pod-uid")

opts, err := parseOptions([]string{"--component", "trace-agent", "--wait-file", "/etc/datadog-agent/auth/token", "--", "trace-agent", "--config", "/etc/datadog-agent/datadog.yaml"}, io.Discard)

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Make parse test portable on Windows

When this test target is run on Windows, main_test.go is still included because it has no Linux build tag, but this case passes a Unix-style wait-file path into parseOptions; parseOptions checks filepath.IsAbs, which rejects /etc/datadog-agent/auth/token on Windows, so the new test target fails before it reaches the unsupported-platform stubs. Use a path derived from t.TempDir() or mark the test Linux-only.

AGENTS.md reference: AGENTS.md:L177-L178

Useful? React with 👍 / 👎.

Comment thread Dockerfiles/otel-agent/Dockerfile Outdated
# Copy the built OTel agent from the builder stage
COPY --from=builder /workspace/datadog-agent/bin/otel-agent/otel-agent /opt/datadog-agent/embedded/bin/otel-agent
COPY --from=builder /workspace/datadog-agent/bin/otel-agent/dist/otel-config.yaml /etc/datadog-agent/otel-config.yaml
COPY agent-rollout-gate /opt/datadog-agent/embedded/bin/agent-rollout-gate

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Build the gate in the OTel Docker self-build path

The GitLab OTel image jobs add agent-rollout-gate to BUILD_CONTEXT, but the Dockerfile also has a self-build path where the builder clones the repo and only runs invoke otel-agent.build; in that path there is no build-context file named agent-rollout-gate, so this release-stage COPY fails before producing the standalone image. Build the gate in the builder stage and copy it from there, or make this copy conditional on the CI-prepared context.

Useful? React with 👍 / 👎.

@dd-octo-sts

dd-octo-sts Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Gitlab CI Configuration Changes

Modified Jobs
.build_host_profiler_binary_common 
  .build_host_profiler_binary_common:
    artifacts:
      expire_in: 1 day
      paths:
      - $CI_PROJECT_DIR/bin/host-profiler/host-profiler
+     - $CI_PROJECT_DIR/bin/agent-rollout-gate/agent-rollout-gate
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/linux$CI_IMAGE_LINUX_SUFFIX:$CI_IMAGE_LINUX
    needs:
    - go_deps
    rules:
    - when: on_success
    script:
    - . tools/ci/sanitize-goproxy.sh
    - mkdir -p $GOPATH/pkg/mod/cache && zstd -dc modcache.tar.zst | tar xf - -C $GOPATH/pkg/mod/cache
    - rm -f modcache.tar.zst
    - dda inv -- -e host-profiler.build
+   - dda inv -- -e agent-rollout-gate.build
    stage: binary_build
    timeout: 25m
    variables:
      GIT_DEPTH: 0
      KUBERNETES_MEMORY_LIMIT: 16Gi
      KUBERNETES_MEMORY_REQUEST: 16Gi
.docker_build_host_profiler_standalone 
  .docker_build_host_profiler_standalone:
    before_script:
    - cp bin/host-profiler/host-profiler $BUILD_CONTEXT/
+   - cp bin/agent-rollout-gate/agent-rollout-gate $BUILD_CONTEXT/
    - cp cmd/host-profiler/dist/host-profiler-config.yaml $BUILD_CONTEXT/
    - cp cmd/host-profiler/deploy/seccomp-profile.json $BUILD_CONTEXT/
    - 'jq ''. + {flags: ["SECCOMP_FILTER_FLAG_LOG"]}'' cmd/host-profiler/deploy/seccomp-profile.json
      > $BUILD_CONTEXT/logging-seccomp.json'
    - ls -l $BUILD_CONTEXT/
    retry: 2
    rules:
    - when: on_success
    script:
    - TAG_SUFFIX=${TAG_SUFFIX:-}
    - BUILD_ARG=${BUILD_ARG:-}
    - EXTRA_BUILD_CONTEXT=${ARTIFACTS_BUILD_CONTEXT:+"--build-context artifacts=$ARTIFACTS_BUILD_CONTEXT"}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" && ( \"$IMAGE\" =~ \"ci/datadog-agent/agent\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/cluster-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/cws-instrumentation\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/secret-generic-connector\" || \"$IMAGE\"\
      \ =~ \"ci/datadog-agent/otel-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/ddot-ebpf\"\
      \ ) ]]; then\n  export ECR_RELEASE_SUFFIX=\"-nightly\"\nelse\n  export ECR_RELEASE_SUFFIX=${CI_COMMIT_TAG+-release}\n\
      fi\n"
    - AGENT_BASE_IMAGE_TAG=registry.ddbuild.io/ci/datadog-agent/${BASE_IMAGE_NAME:-agent-base-image}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${BASE_IMAGE_TAG_SUFFIX:-}-$ARCH
    - TARGET_TAG=${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}$TAG_SUFFIX-$ARCH
    - DOCKER_CACHE_REGISTRY_TARGET="${IMAGE}${TAG_SUFFIX}-${ARCH}:cache"
    - CACHE_SOURCE="--cache-from type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET}"
    - CACHE_TO=""
    - CACHE_TARGET=${CACHE_TARGET:-}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\n  CACHE_TO=\"--cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\
      \nfi\nif [[ \"$CI_COMMIT_BRANCH\" == \"$CI_DEFAULT_BRANCH\" ]]; then\n  CACHE_TO=\"\
      --cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\nfi\n"
    - "if [[ \"$DEPLOY_AGENT\" == \"true\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\nfi\n"
    - "if [[ -n \"${CACHE_TO}\" && -n \"${CACHE_TARGET}\" ]]; then\n  # Build cacheable\
      \ target to only export certain steps to registry.\n  # Doing this first build\
      \ separately lets us avoid uploading heavy artifacts (such as Agent packages),\n\
      \  # that can't be usefully cached, to the remote cache.\n  echo \"Building ${CACHE_TARGET}\
      \ for cache\"\n  # We accept failures on this build, because the build can still\
      \ succeed, and the only consequence of\n  # failure is that the cache doesn't\
      \ get updated, which is not critical.\n  # We do send an event to DD to be able\
      \ to monitor it.\n\n  send_docker_export_failure_event() {\n    DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh\
      \ $AGENT_API_KEY_ORG2 token) && \\\n    curl -X POST \"https://api.datadoghq.com/api/v1/events\"\
      \ \\\n         -H \"Content-Type: application/json\" \\\n         -H \"DD-API-KEY:\
      \ ${DD_API_KEY}\" \\\n         -d '{\n          \"title\": \"docker cache export\
      \ failure\",\n          \"text\": \"An Agent docker build failed to export the\
      \ cache to the remote registry\",\n          \"alert_type\": \"error\",\n    \
      \      \"date_happened\": '\"$(date +%s)\"',\n          \"tags\": [\"team:agent-build\"\
      , \"pipeline:'${CI_PIPELINE_ID}'\", \"job:'${CI_JOB_NAME}'\", \"job-id:'${CI_JOB_ID}'\"\
      ]\n        }'\n  }\n\n  docker buildx build --pull --platform linux/$ARCH \\\n\
      \    ${CACHE_SOURCE} \\\n    ${CACHE_TO} \\\n    ${DOCKER_NO_CACHE} \\\n    --build-arg\
      \ AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG} \\\n    --build-arg CI \\\n   \
      \ --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n    --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n    --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n    --build-arg BASE_IMAGE_REGISTRY\
      \ \\\n    $BUILD_ARG \\\n    ${EXTRA_BUILD_CONTEXT} \\\n    --file $BUILD_CONTEXT/Dockerfile\
      \ \\\n    --target ${CACHE_TARGET} \\\n    $BUILD_CONTEXT \\\n    || send_docker_export_failure_event\
      \ \\\n    || true\n\n  # On non-deploy pipelines we're fine with relying on the\
      \ cache from this point on\n  DOCKER_NO_CACHE=\"\"\nfi\n"
    - "docker buildx build --push --pull --platform linux/$ARCH \\\n  ${CACHE_SOURCE}\
      \ \\\n  ${DOCKER_NO_CACHE} \\\n  --build-arg AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG}\
      \ \\\n  --build-arg CI \\\n  --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n  --build-arg BASE_IMAGE_REGISTRY \\\n  $BUILD_ARG \\\n  $TARGET_ARG \\\n\
      \  --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n  --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n  ${EXTRA_BUILD_CONTEXT}\
      \ \\\n  --file $BUILD_CONTEXT/Dockerfile \\\n  --tag ${TARGET_TAG} \\\n  --label\
      \ \"org.opencontainers.image.created=$(date --rfc-3339=seconds)\" \\\n  --label\
      \ \"org.opencontainers.image.authors=Datadog <package@datadoghq.com>\" \\\n  --label\
      \ \"org.opencontainers.image.source=https://github.com/DataDog/datadog-agent\"\
      \ \\\n  --label \"org.opencontainers.image.version=$(dda inv agent.version)\"\
      \ \\\n  --label \"org.opencontainers.image.revision=${CI_COMMIT_SHA}\" \\\n  --label\
      \ \"org.opencontainers.image.vendor=Datadog, Inc.\" \\\n  --label \"target=none\"\
      \ \\\n  $BUILD_CONTEXT"
    - FLATTEN_IMAGE=${FLATTEN_IMAGE:-true}
    - "if [[ \"$FLATTEN_IMAGE\" == \"true\" ]]; then\n  crane flatten -t ${TARGET_TAG}\
      \ ${TARGET_TAG}\nfi\n"
    - "# Measure Docker image size and generate in-place report\n# This runs after the\
      \ main script and won't fail the job if there are issues.\n# This is common for\
      \ all Docker image builds\n\nif [[ -n \"$STATIC_QUALITY_GATE_NAME\" ]]; then\n\
      \  echo \"\U0001F4CA Starting Docker image measurement...\"\n\n  # Construct the\
      \ built image reference from build variables\n  # This follows the same pattern\
      \ used in docker build jobs\n  ECR_RELEASE_SUFFIX=${ECR_RELEASE_SUFFIX:-}\n  TAG_SUFFIX=${TAG_SUFFIX:-}\n\
      \  IMAGE_REF=\"${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-$ARCH\"\
      \n  \n  echo \"\U0001F50D Measuring Docker image: $IMAGE_REF\"\n\n  # Extract\
      \ report prefix from gate name (e.g. static_quality_gate_docker_agent_amd64 ->\
      \ docker_agent_amd64)\n  REPORT_PREFIX=\"${STATIC_QUALITY_GATE_NAME#static_quality_gate_}\"\
      \n\n  # Generate measurement report using STATIC_QUALITY_GATE_NAME variable\n\
      \  dda inv quality-gates.measure-image-local \\\n    --image-ref \"$IMAGE_REF\"\
      \ \\\n    --gate-name \"$STATIC_QUALITY_GATE_NAME\" \\\n    --build-job-name \"\
      $CI_JOB_NAME\" \\\n    --output-path \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    --debug || { echo \"\u26A0\uFE0F  Docker image measurement failed for\
      \ $IMAGE_REF\"; exit 0; }\n\n  echo \"\u2705 Docker image measurement completed\"\
      \n\n  # Upload the report to S3 (same bucket structure as packages)\n  BUCKET_BASE_PATH=\"\
      s3://dd-ci-artefacts-build-stable/datadog-agent/static_quality_gates/GATE_REPORTS/${CI_COMMIT_SHA}\"\
      \n  echo \"Uploading report to ${BUCKET_BASE_PATH}\"\n  aws s3 cp --only-show-errors\
      \ --region us-east-1 --sse AES256 \\\n    \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    \"${BUCKET_BASE_PATH}/${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \nelse\n  echo \"\u2139\uFE0F  Skipping Docker image measurement (no STATIC_QUALITY_GATE_NAME\
      \ defined)\"\nfi\n"
    stage: container_build
    timeout: 30m
    variables:
      BASE_IMAGE_REGISTRY: registry.ddbuild.io/images/mirror
      BUILD_ARG: --target release
      BUILD_CONTEXT: Dockerfiles/ddot-ebpf
      FLATTEN_IMAGE: false
      IMAGE: registry.ddbuild.io/ci/datadog-agent/ddot-ebpf
      TAG_SUFFIX: -7
.docker_build_ot_agent_standalone 
  .docker_build_ot_agent_standalone:
    before_script:
    - mkdir /tmp/otel
    - ARCHIVE_NAME=$(find . -name "datadog-*agent-ddot-7*.tar.xz" | head -1)
    - 'tar --extract --xz --file $ARCHIVE_NAME \
  
      --verbose \
  
      --directory $BUILD_CONTEXT \
  
      --strip-components 4 \
  
-     opt/datadog-agent/embedded/bin/otel-agent
+     opt/datadog-agent/embedded/bin/otel-agent \
?                                              ++
+ 
+     opt/datadog-agent/embedded/bin/agent-rollout-gate
  
      '
+   - mv $BUILD_CONTEXT/agent-rollout-gate $BUILD_CONTEXT/otel-agent-rollout-gate
    - 'tar --extract --xz --file $ARCHIVE_NAME \
  
      --verbose \
  
      --directory $BUILD_CONTEXT \
  
      --strip-components 2 \
  
      --transform ''s|\.example||'' \
  
      etc/datadog-agent/otel-config.yaml.example
  
      '
    retry: 2
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - TAG_SUFFIX=${TAG_SUFFIX:-}
    - BUILD_ARG=${BUILD_ARG:-}
    - EXTRA_BUILD_CONTEXT=${ARTIFACTS_BUILD_CONTEXT:+"--build-context artifacts=$ARTIFACTS_BUILD_CONTEXT"}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" && ( \"$IMAGE\" =~ \"ci/datadog-agent/agent\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/cluster-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/cws-instrumentation\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/secret-generic-connector\" || \"$IMAGE\"\
      \ =~ \"ci/datadog-agent/otel-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/ddot-ebpf\"\
      \ ) ]]; then\n  export ECR_RELEASE_SUFFIX=\"-nightly\"\nelse\n  export ECR_RELEASE_SUFFIX=${CI_COMMIT_TAG+-release}\n\
      fi\n"
    - AGENT_BASE_IMAGE_TAG=registry.ddbuild.io/ci/datadog-agent/${BASE_IMAGE_NAME:-agent-base-image}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${BASE_IMAGE_TAG_SUFFIX:-}-$ARCH
    - TARGET_TAG=${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}$TAG_SUFFIX-$ARCH
    - DOCKER_CACHE_REGISTRY_TARGET="${IMAGE}${TAG_SUFFIX}-${ARCH}:cache"
    - CACHE_SOURCE="--cache-from type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET}"
    - CACHE_TO=""
    - CACHE_TARGET=${CACHE_TARGET:-}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\n  CACHE_TO=\"--cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\
      \nfi\nif [[ \"$CI_COMMIT_BRANCH\" == \"$CI_DEFAULT_BRANCH\" ]]; then\n  CACHE_TO=\"\
      --cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\nfi\n"
    - "if [[ \"$DEPLOY_AGENT\" == \"true\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\nfi\n"
    - "if [[ -n \"${CACHE_TO}\" && -n \"${CACHE_TARGET}\" ]]; then\n  # Build cacheable\
      \ target to only export certain steps to registry.\n  # Doing this first build\
      \ separately lets us avoid uploading heavy artifacts (such as Agent packages),\n\
      \  # that can't be usefully cached, to the remote cache.\n  echo \"Building ${CACHE_TARGET}\
      \ for cache\"\n  # We accept failures on this build, because the build can still\
      \ succeed, and the only consequence of\n  # failure is that the cache doesn't\
      \ get updated, which is not critical.\n  # We do send an event to DD to be able\
      \ to monitor it.\n\n  send_docker_export_failure_event() {\n    DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh\
      \ $AGENT_API_KEY_ORG2 token) && \\\n    curl -X POST \"https://api.datadoghq.com/api/v1/events\"\
      \ \\\n         -H \"Content-Type: application/json\" \\\n         -H \"DD-API-KEY:\
      \ ${DD_API_KEY}\" \\\n         -d '{\n          \"title\": \"docker cache export\
      \ failure\",\n          \"text\": \"An Agent docker build failed to export the\
      \ cache to the remote registry\",\n          \"alert_type\": \"error\",\n    \
      \      \"date_happened\": '\"$(date +%s)\"',\n          \"tags\": [\"team:agent-build\"\
      , \"pipeline:'${CI_PIPELINE_ID}'\", \"job:'${CI_JOB_NAME}'\", \"job-id:'${CI_JOB_ID}'\"\
      ]\n        }'\n  }\n\n  docker buildx build --pull --platform linux/$ARCH \\\n\
      \    ${CACHE_SOURCE} \\\n    ${CACHE_TO} \\\n    ${DOCKER_NO_CACHE} \\\n    --build-arg\
      \ AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG} \\\n    --build-arg CI \\\n   \
      \ --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n    --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n    --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n    --build-arg BASE_IMAGE_REGISTRY\
      \ \\\n    $BUILD_ARG \\\n    ${EXTRA_BUILD_CONTEXT} \\\n    --file $BUILD_CONTEXT/Dockerfile\
      \ \\\n    --target ${CACHE_TARGET} \\\n    $BUILD_CONTEXT \\\n    || send_docker_export_failure_event\
      \ \\\n    || true\n\n  # On non-deploy pipelines we're fine with relying on the\
      \ cache from this point on\n  DOCKER_NO_CACHE=\"\"\nfi\n"
    - "docker buildx build --push --pull --platform linux/$ARCH \\\n  ${CACHE_SOURCE}\
      \ \\\n  ${DOCKER_NO_CACHE} \\\n  --build-arg AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG}\
      \ \\\n  --build-arg CI \\\n  --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n  --build-arg BASE_IMAGE_REGISTRY \\\n  $BUILD_ARG \\\n  $TARGET_ARG \\\n\
      \  --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n  --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n  ${EXTRA_BUILD_CONTEXT}\
      \ \\\n  --file $BUILD_CONTEXT/Dockerfile \\\n  --tag ${TARGET_TAG} \\\n  --label\
      \ \"org.opencontainers.image.created=$(date --rfc-3339=seconds)\" \\\n  --label\
      \ \"org.opencontainers.image.authors=Datadog <package@datadoghq.com>\" \\\n  --label\
      \ \"org.opencontainers.image.source=https://github.com/DataDog/datadog-agent\"\
      \ \\\n  --label \"org.opencontainers.image.version=$(dda inv agent.version)\"\
      \ \\\n  --label \"org.opencontainers.image.revision=${CI_COMMIT_SHA}\" \\\n  --label\
      \ \"org.opencontainers.image.vendor=Datadog, Inc.\" \\\n  --label \"target=none\"\
      \ \\\n  $BUILD_CONTEXT"
    - FLATTEN_IMAGE=${FLATTEN_IMAGE:-true}
    - "if [[ \"$FLATTEN_IMAGE\" == \"true\" ]]; then\n  crane flatten -t ${TARGET_TAG}\
      \ ${TARGET_TAG}\nfi\n"
    - "# Measure Docker image size and generate in-place report\n# This runs after the\
      \ main script and won't fail the job if there are issues.\n# This is common for\
      \ all Docker image builds\n\nif [[ -n \"$STATIC_QUALITY_GATE_NAME\" ]]; then\n\
      \  echo \"\U0001F4CA Starting Docker image measurement...\"\n\n  # Construct the\
      \ built image reference from build variables\n  # This follows the same pattern\
      \ used in docker build jobs\n  ECR_RELEASE_SUFFIX=${ECR_RELEASE_SUFFIX:-}\n  TAG_SUFFIX=${TAG_SUFFIX:-}\n\
      \  IMAGE_REF=\"${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-$ARCH\"\
      \n  \n  echo \"\U0001F50D Measuring Docker image: $IMAGE_REF\"\n\n  # Extract\
      \ report prefix from gate name (e.g. static_quality_gate_docker_agent_amd64 ->\
      \ docker_agent_amd64)\n  REPORT_PREFIX=\"${STATIC_QUALITY_GATE_NAME#static_quality_gate_}\"\
      \n\n  # Generate measurement report using STATIC_QUALITY_GATE_NAME variable\n\
      \  dda inv quality-gates.measure-image-local \\\n    --image-ref \"$IMAGE_REF\"\
      \ \\\n    --gate-name \"$STATIC_QUALITY_GATE_NAME\" \\\n    --build-job-name \"\
      $CI_JOB_NAME\" \\\n    --output-path \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    --debug || { echo \"\u26A0\uFE0F  Docker image measurement failed for\
      \ $IMAGE_REF\"; exit 0; }\n\n  echo \"\u2705 Docker image measurement completed\"\
      \n\n  # Upload the report to S3 (same bucket structure as packages)\n  BUCKET_BASE_PATH=\"\
      s3://dd-ci-artefacts-build-stable/datadog-agent/static_quality_gates/GATE_REPORTS/${CI_COMMIT_SHA}\"\
      \n  echo \"Uploading report to ${BUCKET_BASE_PATH}\"\n  aws s3 cp --only-show-errors\
      \ --region us-east-1 --sse AES256 \\\n    \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    \"${BUCKET_BASE_PATH}/${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \nelse\n  echo \"\u2139\uFE0F  Skipping Docker image measurement (no STATIC_QUALITY_GATE_NAME\
      \ defined)\"\nfi\n"
    stage: container_build
    timeout: 30m
    variables:
      BASE_IMAGE_REGISTRY: registry.ddbuild.io/images/mirror
      BUILD_ARG: --target release
      BUILD_CONTEXT: Dockerfiles/otel-agent
      FLATTEN_IMAGE: false
      IMAGE: registry.ddbuild.io/ci/datadog-agent/otel-agent
      TAG_SUFFIX: -7
build_host_profiler_binary_arm64 
  build_host_profiler_binary_arm64:
    artifacts:
      expire_in: 1 day
      paths:
      - $CI_PROJECT_DIR/bin/host-profiler/host-profiler
+     - $CI_PROJECT_DIR/bin/agent-rollout-gate/agent-rollout-gate
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/linux$CI_IMAGE_LINUX_SUFFIX:$CI_IMAGE_LINUX
    needs:
    - go_deps
    rules:
    - when: on_success
    script:
    - . tools/ci/sanitize-goproxy.sh
    - mkdir -p $GOPATH/pkg/mod/cache && zstd -dc modcache.tar.zst | tar xf - -C $GOPATH/pkg/mod/cache
    - rm -f modcache.tar.zst
    - dda inv -- -e host-profiler.build
+   - dda inv -- -e agent-rollout-gate.build
    stage: binary_build
    tags:
    - arch:arm64
    - specific:true
    timeout: 25m
    variables:
      GIT_DEPTH: 0
      KUBERNETES_MEMORY_LIMIT: 16Gi
      KUBERNETES_MEMORY_REQUEST: 16Gi
build_host_profiler_binary_x64 
  build_host_profiler_binary_x64:
    artifacts:
      expire_in: 1 day
      paths:
      - $CI_PROJECT_DIR/bin/host-profiler/host-profiler
+     - $CI_PROJECT_DIR/bin/agent-rollout-gate/agent-rollout-gate
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/linux$CI_IMAGE_LINUX_SUFFIX:$CI_IMAGE_LINUX
    needs:
    - go_deps
    rules:
    - when: on_success
    script:
    - . tools/ci/sanitize-goproxy.sh
    - mkdir -p $GOPATH/pkg/mod/cache && zstd -dc modcache.tar.zst | tar xf - -C $GOPATH/pkg/mod/cache
    - rm -f modcache.tar.zst
    - dda inv -- -e host-profiler.build
+   - dda inv -- -e agent-rollout-gate.build
    stage: binary_build
    tags:
    - arch:amd64
    - specific:true
    timeout: 25m
    variables:
      GIT_DEPTH: 0
      KUBERNETES_MEMORY_LIMIT: 16Gi
      KUBERNETES_MEMORY_REQUEST: 16Gi
docker_build_host_profiler_standalone_amd64 
  docker_build_host_profiler_standalone_amd64:
    before_script:
    - cp bin/host-profiler/host-profiler $BUILD_CONTEXT/
+   - cp bin/agent-rollout-gate/agent-rollout-gate $BUILD_CONTEXT/
    - cp cmd/host-profiler/dist/host-profiler-config.yaml $BUILD_CONTEXT/
    - cp cmd/host-profiler/deploy/seccomp-profile.json $BUILD_CONTEXT/
    - 'jq ''. + {flags: ["SECCOMP_FILTER_FLAG_LOG"]}'' cmd/host-profiler/deploy/seccomp-profile.json
      > $BUILD_CONTEXT/logging-seccomp.json'
    - ls -l $BUILD_CONTEXT/
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/docker_x64$CI_IMAGE_DOCKER_X64_SUFFIX:$CI_IMAGE_DOCKER_X64
    needs:
    - job: docker_build_base_image_amd64
    - job: build_host_profiler_binary_x64
    retry: 2
    rules:
    - when: on_success
    script:
    - TAG_SUFFIX=${TAG_SUFFIX:-}
    - BUILD_ARG=${BUILD_ARG:-}
    - EXTRA_BUILD_CONTEXT=${ARTIFACTS_BUILD_CONTEXT:+"--build-context artifacts=$ARTIFACTS_BUILD_CONTEXT"}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" && ( \"$IMAGE\" =~ \"ci/datadog-agent/agent\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/cluster-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/cws-instrumentation\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/secret-generic-connector\" || \"$IMAGE\"\
      \ =~ \"ci/datadog-agent/otel-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/ddot-ebpf\"\
      \ ) ]]; then\n  export ECR_RELEASE_SUFFIX=\"-nightly\"\nelse\n  export ECR_RELEASE_SUFFIX=${CI_COMMIT_TAG+-release}\n\
      fi\n"
    - AGENT_BASE_IMAGE_TAG=registry.ddbuild.io/ci/datadog-agent/${BASE_IMAGE_NAME:-agent-base-image}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${BASE_IMAGE_TAG_SUFFIX:-}-$ARCH
    - TARGET_TAG=${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}$TAG_SUFFIX-$ARCH
    - DOCKER_CACHE_REGISTRY_TARGET="${IMAGE}${TAG_SUFFIX}-${ARCH}:cache"
    - CACHE_SOURCE="--cache-from type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET}"
    - CACHE_TO=""
    - CACHE_TARGET=${CACHE_TARGET:-}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\n  CACHE_TO=\"--cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\
      \nfi\nif [[ \"$CI_COMMIT_BRANCH\" == \"$CI_DEFAULT_BRANCH\" ]]; then\n  CACHE_TO=\"\
      --cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\nfi\n"
    - "if [[ \"$DEPLOY_AGENT\" == \"true\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\nfi\n"
    - "if [[ -n \"${CACHE_TO}\" && -n \"${CACHE_TARGET}\" ]]; then\n  # Build cacheable\
      \ target to only export certain steps to registry.\n  # Doing this first build\
      \ separately lets us avoid uploading heavy artifacts (such as Agent packages),\n\
      \  # that can't be usefully cached, to the remote cache.\n  echo \"Building ${CACHE_TARGET}\
      \ for cache\"\n  # We accept failures on this build, because the build can still\
      \ succeed, and the only consequence of\n  # failure is that the cache doesn't\
      \ get updated, which is not critical.\n  # We do send an event to DD to be able\
      \ to monitor it.\n\n  send_docker_export_failure_event() {\n    DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh\
      \ $AGENT_API_KEY_ORG2 token) && \\\n    curl -X POST \"https://api.datadoghq.com/api/v1/events\"\
      \ \\\n         -H \"Content-Type: application/json\" \\\n         -H \"DD-API-KEY:\
      \ ${DD_API_KEY}\" \\\n         -d '{\n          \"title\": \"docker cache export\
      \ failure\",\n          \"text\": \"An Agent docker build failed to export the\
      \ cache to the remote registry\",\n          \"alert_type\": \"error\",\n    \
      \      \"date_happened\": '\"$(date +%s)\"',\n          \"tags\": [\"team:agent-build\"\
      , \"pipeline:'${CI_PIPELINE_ID}'\", \"job:'${CI_JOB_NAME}'\", \"job-id:'${CI_JOB_ID}'\"\
      ]\n        }'\n  }\n\n  docker buildx build --pull --platform linux/$ARCH \\\n\
      \    ${CACHE_SOURCE} \\\n    ${CACHE_TO} \\\n    ${DOCKER_NO_CACHE} \\\n    --build-arg\
      \ AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG} \\\n    --build-arg CI \\\n   \
      \ --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n    --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n    --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n    --build-arg BASE_IMAGE_REGISTRY\
      \ \\\n    $BUILD_ARG \\\n    ${EXTRA_BUILD_CONTEXT} \\\n    --file $BUILD_CONTEXT/Dockerfile\
      \ \\\n    --target ${CACHE_TARGET} \\\n    $BUILD_CONTEXT \\\n    || send_docker_export_failure_event\
      \ \\\n    || true\n\n  # On non-deploy pipelines we're fine with relying on the\
      \ cache from this point on\n  DOCKER_NO_CACHE=\"\"\nfi\n"
    - "docker buildx build --push --pull --platform linux/$ARCH \\\n  ${CACHE_SOURCE}\
      \ \\\n  ${DOCKER_NO_CACHE} \\\n  --build-arg AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG}\
      \ \\\n  --build-arg CI \\\n  --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n  --build-arg BASE_IMAGE_REGISTRY \\\n  $BUILD_ARG \\\n  $TARGET_ARG \\\n\
      \  --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n  --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n  ${EXTRA_BUILD_CONTEXT}\
      \ \\\n  --file $BUILD_CONTEXT/Dockerfile \\\n  --tag ${TARGET_TAG} \\\n  --label\
      \ \"org.opencontainers.image.created=$(date --rfc-3339=seconds)\" \\\n  --label\
      \ \"org.opencontainers.image.authors=Datadog <package@datadoghq.com>\" \\\n  --label\
      \ \"org.opencontainers.image.source=https://github.com/DataDog/datadog-agent\"\
      \ \\\n  --label \"org.opencontainers.image.version=$(dda inv agent.version)\"\
      \ \\\n  --label \"org.opencontainers.image.revision=${CI_COMMIT_SHA}\" \\\n  --label\
      \ \"org.opencontainers.image.vendor=Datadog, Inc.\" \\\n  --label \"target=none\"\
      \ \\\n  $BUILD_CONTEXT"
    - FLATTEN_IMAGE=${FLATTEN_IMAGE:-true}
    - "if [[ \"$FLATTEN_IMAGE\" == \"true\" ]]; then\n  crane flatten -t ${TARGET_TAG}\
      \ ${TARGET_TAG}\nfi\n"
    - "# Measure Docker image size and generate in-place report\n# This runs after the\
      \ main script and won't fail the job if there are issues.\n# This is common for\
      \ all Docker image builds\n\nif [[ -n \"$STATIC_QUALITY_GATE_NAME\" ]]; then\n\
      \  echo \"\U0001F4CA Starting Docker image measurement...\"\n\n  # Construct the\
      \ built image reference from build variables\n  # This follows the same pattern\
      \ used in docker build jobs\n  ECR_RELEASE_SUFFIX=${ECR_RELEASE_SUFFIX:-}\n  TAG_SUFFIX=${TAG_SUFFIX:-}\n\
      \  IMAGE_REF=\"${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-$ARCH\"\
      \n  \n  echo \"\U0001F50D Measuring Docker image: $IMAGE_REF\"\n\n  # Extract\
      \ report prefix from gate name (e.g. static_quality_gate_docker_agent_amd64 ->\
      \ docker_agent_amd64)\n  REPORT_PREFIX=\"${STATIC_QUALITY_GATE_NAME#static_quality_gate_}\"\
      \n\n  # Generate measurement report using STATIC_QUALITY_GATE_NAME variable\n\
      \  dda inv quality-gates.measure-image-local \\\n    --image-ref \"$IMAGE_REF\"\
      \ \\\n    --gate-name \"$STATIC_QUALITY_GATE_NAME\" \\\n    --build-job-name \"\
      $CI_JOB_NAME\" \\\n    --output-path \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    --debug || { echo \"\u26A0\uFE0F  Docker image measurement failed for\
      \ $IMAGE_REF\"; exit 0; }\n\n  echo \"\u2705 Docker image measurement completed\"\
      \n\n  # Upload the report to S3 (same bucket structure as packages)\n  BUCKET_BASE_PATH=\"\
      s3://dd-ci-artefacts-build-stable/datadog-agent/static_quality_gates/GATE_REPORTS/${CI_COMMIT_SHA}\"\
      \n  echo \"Uploading report to ${BUCKET_BASE_PATH}\"\n  aws s3 cp --only-show-errors\
      \ --region us-east-1 --sse AES256 \\\n    \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    \"${BUCKET_BASE_PATH}/${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \nelse\n  echo \"\u2139\uFE0F  Skipping Docker image measurement (no STATIC_QUALITY_GATE_NAME\
      \ defined)\"\nfi\n"
    stage: container_build
    tags:
    - arch:amd64
    - specific:true
    timeout: 30m
    variables:
      ARCH: amd64
      BASE_IMAGE_REGISTRY: registry.ddbuild.io/images/mirror
      BUILD_ARG: --target release
      BUILD_CONTEXT: Dockerfiles/ddot-ebpf
      FLATTEN_IMAGE: false
      IMAGE: registry.ddbuild.io/ci/datadog-agent/ddot-ebpf
      STATIC_QUALITY_GATE_NAME: static_quality_gate_docker_host_profiler_amd64
      TAG_SUFFIX: -7
docker_build_host_profiler_standalone_arm64 
  docker_build_host_profiler_standalone_arm64:
    before_script:
    - cp bin/host-profiler/host-profiler $BUILD_CONTEXT/
+   - cp bin/agent-rollout-gate/agent-rollout-gate $BUILD_CONTEXT/
    - cp cmd/host-profiler/dist/host-profiler-config.yaml $BUILD_CONTEXT/
    - cp cmd/host-profiler/deploy/seccomp-profile.json $BUILD_CONTEXT/
    - 'jq ''. + {flags: ["SECCOMP_FILTER_FLAG_LOG"]}'' cmd/host-profiler/deploy/seccomp-profile.json
      > $BUILD_CONTEXT/logging-seccomp.json'
    - ls -l $BUILD_CONTEXT/
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/docker_arm64$CI_IMAGE_DOCKER_ARM64_SUFFIX:$CI_IMAGE_DOCKER_ARM64
    needs:
    - job: docker_build_base_image_arm64
    - job: build_host_profiler_binary_arm64
    retry: 2
    rules:
    - when: on_success
    script:
    - TAG_SUFFIX=${TAG_SUFFIX:-}
    - BUILD_ARG=${BUILD_ARG:-}
    - EXTRA_BUILD_CONTEXT=${ARTIFACTS_BUILD_CONTEXT:+"--build-context artifacts=$ARTIFACTS_BUILD_CONTEXT"}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" && ( \"$IMAGE\" =~ \"ci/datadog-agent/agent\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/cluster-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/cws-instrumentation\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/secret-generic-connector\" || \"$IMAGE\"\
      \ =~ \"ci/datadog-agent/otel-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/ddot-ebpf\"\
      \ ) ]]; then\n  export ECR_RELEASE_SUFFIX=\"-nightly\"\nelse\n  export ECR_RELEASE_SUFFIX=${CI_COMMIT_TAG+-release}\n\
      fi\n"
    - AGENT_BASE_IMAGE_TAG=registry.ddbuild.io/ci/datadog-agent/${BASE_IMAGE_NAME:-agent-base-image}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${BASE_IMAGE_TAG_SUFFIX:-}-$ARCH
    - TARGET_TAG=${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}$TAG_SUFFIX-$ARCH
    - DOCKER_CACHE_REGISTRY_TARGET="${IMAGE}${TAG_SUFFIX}-${ARCH}:cache"
    - CACHE_SOURCE="--cache-from type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET}"
    - CACHE_TO=""
    - CACHE_TARGET=${CACHE_TARGET:-}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\n  CACHE_TO=\"--cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\
      \nfi\nif [[ \"$CI_COMMIT_BRANCH\" == \"$CI_DEFAULT_BRANCH\" ]]; then\n  CACHE_TO=\"\
      --cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\nfi\n"
    - "if [[ \"$DEPLOY_AGENT\" == \"true\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\nfi\n"
    - "if [[ -n \"${CACHE_TO}\" && -n \"${CACHE_TARGET}\" ]]; then\n  # Build cacheable\
      \ target to only export certain steps to registry.\n  # Doing this first build\
      \ separately lets us avoid uploading heavy artifacts (such as Agent packages),\n\
      \  # that can't be usefully cached, to the remote cache.\n  echo \"Building ${CACHE_TARGET}\
      \ for cache\"\n  # We accept failures on this build, because the build can still\
      \ succeed, and the only consequence of\n  # failure is that the cache doesn't\
      \ get updated, which is not critical.\n  # We do send an event to DD to be able\
      \ to monitor it.\n\n  send_docker_export_failure_event() {\n    DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh\
      \ $AGENT_API_KEY_ORG2 token) && \\\n    curl -X POST \"https://api.datadoghq.com/api/v1/events\"\
      \ \\\n         -H \"Content-Type: application/json\" \\\n         -H \"DD-API-KEY:\
      \ ${DD_API_KEY}\" \\\n         -d '{\n          \"title\": \"docker cache export\
      \ failure\",\n          \"text\": \"An Agent docker build failed to export the\
      \ cache to the remote registry\",\n          \"alert_type\": \"error\",\n    \
      \      \"date_happened\": '\"$(date +%s)\"',\n          \"tags\": [\"team:agent-build\"\
      , \"pipeline:'${CI_PIPELINE_ID}'\", \"job:'${CI_JOB_NAME}'\", \"job-id:'${CI_JOB_ID}'\"\
      ]\n        }'\n  }\n\n  docker buildx build --pull --platform linux/$ARCH \\\n\
      \    ${CACHE_SOURCE} \\\n    ${CACHE_TO} \\\n    ${DOCKER_NO_CACHE} \\\n    --build-arg\
      \ AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG} \\\n    --build-arg CI \\\n   \
      \ --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n    --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n    --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n    --build-arg BASE_IMAGE_REGISTRY\
      \ \\\n    $BUILD_ARG \\\n    ${EXTRA_BUILD_CONTEXT} \\\n    --file $BUILD_CONTEXT/Dockerfile\
      \ \\\n    --target ${CACHE_TARGET} \\\n    $BUILD_CONTEXT \\\n    || send_docker_export_failure_event\
      \ \\\n    || true\n\n  # On non-deploy pipelines we're fine with relying on the\
      \ cache from this point on\n  DOCKER_NO_CACHE=\"\"\nfi\n"
    - "docker buildx build --push --pull --platform linux/$ARCH \\\n  ${CACHE_SOURCE}\
      \ \\\n  ${DOCKER_NO_CACHE} \\\n  --build-arg AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG}\
      \ \\\n  --build-arg CI \\\n  --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n  --build-arg BASE_IMAGE_REGISTRY \\\n  $BUILD_ARG \\\n  $TARGET_ARG \\\n\
      \  --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n  --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n  ${EXTRA_BUILD_CONTEXT}\
      \ \\\n  --file $BUILD_CONTEXT/Dockerfile \\\n  --tag ${TARGET_TAG} \\\n  --label\
      \ \"org.opencontainers.image.created=$(date --rfc-3339=seconds)\" \\\n  --label\
      \ \"org.opencontainers.image.authors=Datadog <package@datadoghq.com>\" \\\n  --label\
      \ \"org.opencontainers.image.source=https://github.com/DataDog/datadog-agent\"\
      \ \\\n  --label \"org.opencontainers.image.version=$(dda inv agent.version)\"\
      \ \\\n  --label \"org.opencontainers.image.revision=${CI_COMMIT_SHA}\" \\\n  --label\
      \ \"org.opencontainers.image.vendor=Datadog, Inc.\" \\\n  --label \"target=none\"\
      \ \\\n  $BUILD_CONTEXT"
    - FLATTEN_IMAGE=${FLATTEN_IMAGE:-true}
    - "if [[ \"$FLATTEN_IMAGE\" == \"true\" ]]; then\n  crane flatten -t ${TARGET_TAG}\
      \ ${TARGET_TAG}\nfi\n"
    - "# Measure Docker image size and generate in-place report\n# This runs after the\
      \ main script and won't fail the job if there are issues.\n# This is common for\
      \ all Docker image builds\n\nif [[ -n \"$STATIC_QUALITY_GATE_NAME\" ]]; then\n\
      \  echo \"\U0001F4CA Starting Docker image measurement...\"\n\n  # Construct the\
      \ built image reference from build variables\n  # This follows the same pattern\
      \ used in docker build jobs\n  ECR_RELEASE_SUFFIX=${ECR_RELEASE_SUFFIX:-}\n  TAG_SUFFIX=${TAG_SUFFIX:-}\n\
      \  IMAGE_REF=\"${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-$ARCH\"\
      \n  \n  echo \"\U0001F50D Measuring Docker image: $IMAGE_REF\"\n\n  # Extract\
      \ report prefix from gate name (e.g. static_quality_gate_docker_agent_amd64 ->\
      \ docker_agent_amd64)\n  REPORT_PREFIX=\"${STATIC_QUALITY_GATE_NAME#static_quality_gate_}\"\
      \n\n  # Generate measurement report using STATIC_QUALITY_GATE_NAME variable\n\
      \  dda inv quality-gates.measure-image-local \\\n    --image-ref \"$IMAGE_REF\"\
      \ \\\n    --gate-name \"$STATIC_QUALITY_GATE_NAME\" \\\n    --build-job-name \"\
      $CI_JOB_NAME\" \\\n    --output-path \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    --debug || { echo \"\u26A0\uFE0F  Docker image measurement failed for\
      \ $IMAGE_REF\"; exit 0; }\n\n  echo \"\u2705 Docker image measurement completed\"\
      \n\n  # Upload the report to S3 (same bucket structure as packages)\n  BUCKET_BASE_PATH=\"\
      s3://dd-ci-artefacts-build-stable/datadog-agent/static_quality_gates/GATE_REPORTS/${CI_COMMIT_SHA}\"\
      \n  echo \"Uploading report to ${BUCKET_BASE_PATH}\"\n  aws s3 cp --only-show-errors\
      \ --region us-east-1 --sse AES256 \\\n    \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    \"${BUCKET_BASE_PATH}/${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \nelse\n  echo \"\u2139\uFE0F  Skipping Docker image measurement (no STATIC_QUALITY_GATE_NAME\
      \ defined)\"\nfi\n"
    stage: container_build
    tags:
    - arch:arm64
    - specific:true
    timeout: 30m
    variables:
      ARCH: arm64
      BASE_IMAGE_REGISTRY: registry.ddbuild.io/images/mirror
      BUILD_ARG: --target release
      BUILD_CONTEXT: Dockerfiles/ddot-ebpf
      FLATTEN_IMAGE: false
      IMAGE: registry.ddbuild.io/ci/datadog-agent/ddot-ebpf
      STATIC_QUALITY_GATE_NAME: static_quality_gate_docker_host_profiler_arm64
      TAG_SUFFIX: -7
docker_build_ot_agent_standalone_amd64 
  docker_build_ot_agent_standalone_amd64:
    before_script:
    - mkdir /tmp/otel
    - ARCHIVE_NAME=$(find . -name "datadog-*agent-ddot-7*.tar.xz" | head -1)
    - 'tar --extract --xz --file $ARCHIVE_NAME \
  
      --verbose \
  
      --directory $BUILD_CONTEXT \
  
      --strip-components 4 \
  
-     opt/datadog-agent/embedded/bin/otel-agent
+     opt/datadog-agent/embedded/bin/otel-agent \
?                                              ++
+ 
+     opt/datadog-agent/embedded/bin/agent-rollout-gate
  
      '
+   - mv $BUILD_CONTEXT/agent-rollout-gate $BUILD_CONTEXT/otel-agent-rollout-gate
    - 'tar --extract --xz --file $ARCHIVE_NAME \
  
      --verbose \
  
      --directory $BUILD_CONTEXT \
  
      --strip-components 2 \
  
      --transform ''s|\.example||'' \
  
      etc/datadog-agent/otel-config.yaml.example
  
      '
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/docker_x64$CI_IMAGE_DOCKER_X64_SUFFIX:$CI_IMAGE_DOCKER_X64
    needs:
    - job: docker_build_base_image_amd64
    - job: datadog-otel-agent-x64
    retry: 2
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - TAG_SUFFIX=${TAG_SUFFIX:-}
    - BUILD_ARG=${BUILD_ARG:-}
    - EXTRA_BUILD_CONTEXT=${ARTIFACTS_BUILD_CONTEXT:+"--build-context artifacts=$ARTIFACTS_BUILD_CONTEXT"}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" && ( \"$IMAGE\" =~ \"ci/datadog-agent/agent\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/cluster-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/cws-instrumentation\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/secret-generic-connector\" || \"$IMAGE\"\
      \ =~ \"ci/datadog-agent/otel-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/ddot-ebpf\"\
      \ ) ]]; then\n  export ECR_RELEASE_SUFFIX=\"-nightly\"\nelse\n  export ECR_RELEASE_SUFFIX=${CI_COMMIT_TAG+-release}\n\
      fi\n"
    - AGENT_BASE_IMAGE_TAG=registry.ddbuild.io/ci/datadog-agent/${BASE_IMAGE_NAME:-agent-base-image}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${BASE_IMAGE_TAG_SUFFIX:-}-$ARCH
    - TARGET_TAG=${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}$TAG_SUFFIX-$ARCH
    - DOCKER_CACHE_REGISTRY_TARGET="${IMAGE}${TAG_SUFFIX}-${ARCH}:cache"
    - CACHE_SOURCE="--cache-from type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET}"
    - CACHE_TO=""
    - CACHE_TARGET=${CACHE_TARGET:-}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\n  CACHE_TO=\"--cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\
      \nfi\nif [[ \"$CI_COMMIT_BRANCH\" == \"$CI_DEFAULT_BRANCH\" ]]; then\n  CACHE_TO=\"\
      --cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\nfi\n"
    - "if [[ \"$DEPLOY_AGENT\" == \"true\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\nfi\n"
    - "if [[ -n \"${CACHE_TO}\" && -n \"${CACHE_TARGET}\" ]]; then\n  # Build cacheable\
      \ target to only export certain steps to registry.\n  # Doing this first build\
      \ separately lets us avoid uploading heavy artifacts (such as Agent packages),\n\
      \  # that can't be usefully cached, to the remote cache.\n  echo \"Building ${CACHE_TARGET}\
      \ for cache\"\n  # We accept failures on this build, because the build can still\
      \ succeed, and the only consequence of\n  # failure is that the cache doesn't\
      \ get updated, which is not critical.\n  # We do send an event to DD to be able\
      \ to monitor it.\n\n  send_docker_export_failure_event() {\n    DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh\
      \ $AGENT_API_KEY_ORG2 token) && \\\n    curl -X POST \"https://api.datadoghq.com/api/v1/events\"\
      \ \\\n         -H \"Content-Type: application/json\" \\\n         -H \"DD-API-KEY:\
      \ ${DD_API_KEY}\" \\\n         -d '{\n          \"title\": \"docker cache export\
      \ failure\",\n          \"text\": \"An Agent docker build failed to export the\
      \ cache to the remote registry\",\n          \"alert_type\": \"error\",\n    \
      \      \"date_happened\": '\"$(date +%s)\"',\n          \"tags\": [\"team:agent-build\"\
      , \"pipeline:'${CI_PIPELINE_ID}'\", \"job:'${CI_JOB_NAME}'\", \"job-id:'${CI_JOB_ID}'\"\
      ]\n        }'\n  }\n\n  docker buildx build --pull --platform linux/$ARCH \\\n\
      \    ${CACHE_SOURCE} \\\n    ${CACHE_TO} \\\n    ${DOCKER_NO_CACHE} \\\n    --build-arg\
      \ AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG} \\\n    --build-arg CI \\\n   \
      \ --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n    --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n    --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n    --build-arg BASE_IMAGE_REGISTRY\
      \ \\\n    $BUILD_ARG \\\n    ${EXTRA_BUILD_CONTEXT} \\\n    --file $BUILD_CONTEXT/Dockerfile\
      \ \\\n    --target ${CACHE_TARGET} \\\n    $BUILD_CONTEXT \\\n    || send_docker_export_failure_event\
      \ \\\n    || true\n\n  # On non-deploy pipelines we're fine with relying on the\
      \ cache from this point on\n  DOCKER_NO_CACHE=\"\"\nfi\n"
    - "docker buildx build --push --pull --platform linux/$ARCH \\\n  ${CACHE_SOURCE}\
      \ \\\n  ${DOCKER_NO_CACHE} \\\n  --build-arg AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG}\
      \ \\\n  --build-arg CI \\\n  --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n  --build-arg BASE_IMAGE_REGISTRY \\\n  $BUILD_ARG \\\n  $TARGET_ARG \\\n\
      \  --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n  --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n  ${EXTRA_BUILD_CONTEXT}\
      \ \\\n  --file $BUILD_CONTEXT/Dockerfile \\\n  --tag ${TARGET_TAG} \\\n  --label\
      \ \"org.opencontainers.image.created=$(date --rfc-3339=seconds)\" \\\n  --label\
      \ \"org.opencontainers.image.authors=Datadog <package@datadoghq.com>\" \\\n  --label\
      \ \"org.opencontainers.image.source=https://github.com/DataDog/datadog-agent\"\
      \ \\\n  --label \"org.opencontainers.image.version=$(dda inv agent.version)\"\
      \ \\\n  --label \"org.opencontainers.image.revision=${CI_COMMIT_SHA}\" \\\n  --label\
      \ \"org.opencontainers.image.vendor=Datadog, Inc.\" \\\n  --label \"target=none\"\
      \ \\\n  $BUILD_CONTEXT"
    - FLATTEN_IMAGE=${FLATTEN_IMAGE:-true}
    - "if [[ \"$FLATTEN_IMAGE\" == \"true\" ]]; then\n  crane flatten -t ${TARGET_TAG}\
      \ ${TARGET_TAG}\nfi\n"
    - "# Measure Docker image size and generate in-place report\n# This runs after the\
      \ main script and won't fail the job if there are issues.\n# This is common for\
      \ all Docker image builds\n\nif [[ -n \"$STATIC_QUALITY_GATE_NAME\" ]]; then\n\
      \  echo \"\U0001F4CA Starting Docker image measurement...\"\n\n  # Construct the\
      \ built image reference from build variables\n  # This follows the same pattern\
      \ used in docker build jobs\n  ECR_RELEASE_SUFFIX=${ECR_RELEASE_SUFFIX:-}\n  TAG_SUFFIX=${TAG_SUFFIX:-}\n\
      \  IMAGE_REF=\"${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-$ARCH\"\
      \n  \n  echo \"\U0001F50D Measuring Docker image: $IMAGE_REF\"\n\n  # Extract\
      \ report prefix from gate name (e.g. static_quality_gate_docker_agent_amd64 ->\
      \ docker_agent_amd64)\n  REPORT_PREFIX=\"${STATIC_QUALITY_GATE_NAME#static_quality_gate_}\"\
      \n\n  # Generate measurement report using STATIC_QUALITY_GATE_NAME variable\n\
      \  dda inv quality-gates.measure-image-local \\\n    --image-ref \"$IMAGE_REF\"\
      \ \\\n    --gate-name \"$STATIC_QUALITY_GATE_NAME\" \\\n    --build-job-name \"\
      $CI_JOB_NAME\" \\\n    --output-path \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    --debug || { echo \"\u26A0\uFE0F  Docker image measurement failed for\
      \ $IMAGE_REF\"; exit 0; }\n\n  echo \"\u2705 Docker image measurement completed\"\
      \n\n  # Upload the report to S3 (same bucket structure as packages)\n  BUCKET_BASE_PATH=\"\
      s3://dd-ci-artefacts-build-stable/datadog-agent/static_quality_gates/GATE_REPORTS/${CI_COMMIT_SHA}\"\
      \n  echo \"Uploading report to ${BUCKET_BASE_PATH}\"\n  aws s3 cp --only-show-errors\
      \ --region us-east-1 --sse AES256 \\\n    \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    \"${BUCKET_BASE_PATH}/${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \nelse\n  echo \"\u2139\uFE0F  Skipping Docker image measurement (no STATIC_QUALITY_GATE_NAME\
      \ defined)\"\nfi\n"
    stage: container_build
    tags:
    - arch:amd64
    - specific:true
    timeout: 30m
    variables:
      ARCH: amd64
      BASE_IMAGE_REGISTRY: registry.ddbuild.io/images/mirror
      BUILD_ARG: --target release
      BUILD_CONTEXT: Dockerfiles/otel-agent
      FLATTEN_IMAGE: false
      IMAGE: registry.ddbuild.io/ci/datadog-agent/otel-agent
      TAG_SUFFIX: -7
docker_build_ot_agent_standalone_arm64 
  docker_build_ot_agent_standalone_arm64:
    before_script:
    - mkdir /tmp/otel
    - ARCHIVE_NAME=$(find . -name "datadog-*agent-ddot-7*.tar.xz" | head -1)
    - 'tar --extract --xz --file $ARCHIVE_NAME \
  
      --verbose \
  
      --directory $BUILD_CONTEXT \
  
      --strip-components 4 \
  
-     opt/datadog-agent/embedded/bin/otel-agent
+     opt/datadog-agent/embedded/bin/otel-agent \
?                                              ++
+ 
+     opt/datadog-agent/embedded/bin/agent-rollout-gate
  
      '
+   - mv $BUILD_CONTEXT/agent-rollout-gate $BUILD_CONTEXT/otel-agent-rollout-gate
    - 'tar --extract --xz --file $ARCHIVE_NAME \
  
      --verbose \
  
      --directory $BUILD_CONTEXT \
  
      --strip-components 2 \
  
      --transform ''s|\.example||'' \
  
      etc/datadog-agent/otel-config.yaml.example
  
      '
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/docker_arm64$CI_IMAGE_DOCKER_ARM64_SUFFIX:$CI_IMAGE_DOCKER_ARM64
    needs:
    - job: docker_build_base_image_arm64
    - job: datadog-otel-agent-arm64
    retry: 2
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - TAG_SUFFIX=${TAG_SUFFIX:-}
    - BUILD_ARG=${BUILD_ARG:-}
    - EXTRA_BUILD_CONTEXT=${ARTIFACTS_BUILD_CONTEXT:+"--build-context artifacts=$ARTIFACTS_BUILD_CONTEXT"}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" && ( \"$IMAGE\" =~ \"ci/datadog-agent/agent\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/cluster-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/cws-instrumentation\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/secret-generic-connector\" || \"$IMAGE\"\
      \ =~ \"ci/datadog-agent/otel-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/ddot-ebpf\"\
      \ ) ]]; then\n  export ECR_RELEASE_SUFFIX=\"-nightly\"\nelse\n  export ECR_RELEASE_SUFFIX=${CI_COMMIT_TAG+-release}\n\
      fi\n"
    - AGENT_BASE_IMAGE_TAG=registry.ddbuild.io/ci/datadog-agent/${BASE_IMAGE_NAME:-agent-base-image}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${BASE_IMAGE_TAG_SUFFIX:-}-$ARCH
    - TARGET_TAG=${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}$TAG_SUFFIX-$ARCH
    - DOCKER_CACHE_REGISTRY_TARGET="${IMAGE}${TAG_SUFFIX}-${ARCH}:cache"
    - CACHE_SOURCE="--cache-from type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET}"
    - CACHE_TO=""
    - CACHE_TARGET=${CACHE_TARGET:-}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\n  CACHE_TO=\"--cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\
      \nfi\nif [[ \"$CI_COMMIT_BRANCH\" == \"$CI_DEFAULT_BRANCH\" ]]; then\n  CACHE_TO=\"\
      --cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\nfi\n"
    - "if [[ \"$DEPLOY_AGENT\" == \"true\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\nfi\n"
    - "if [[ -n \"${CACHE_TO}\" && -n \"${CACHE_TARGET}\" ]]; then\n  # Build cacheable\
      \ target to only export certain steps to registry.\n  # Doing this first build\
      \ separately lets us avoid uploading heavy artifacts (such as Agent packages),\n\
      \  # that can't be usefully cached, to the remote cache.\n  echo \"Building ${CACHE_TARGET}\
      \ for cache\"\n  # We accept failures on this build, because the build can still\
      \ succeed, and the only consequence of\n  # failure is that the cache doesn't\
      \ get updated, which is not critical.\n  # We do send an event to DD to be able\
      \ to monitor it.\n\n  send_docker_export_failure_event() {\n    DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh\
      \ $AGENT_API_KEY_ORG2 token) && \\\n    curl -X POST \"https://api.datadoghq.com/api/v1/events\"\
      \ \\\n         -H \"Content-Type: application/json\" \\\n         -H \"DD-API-KEY:\
      \ ${DD_API_KEY}\" \\\n         -d '{\n          \"title\": \"docker cache export\
      \ failure\",\n          \"text\": \"An Agent docker build failed to export the\
      \ cache to the remote registry\",\n          \"alert_type\": \"error\",\n    \
      \      \"date_happened\": '\"$(date +%s)\"',\n          \"tags\": [\"team:agent-build\"\
      , \"pipeline:'${CI_PIPELINE_ID}'\", \"job:'${CI_JOB_NAME}'\", \"job-id:'${CI_JOB_ID}'\"\
      ]\n        }'\n  }\n\n  docker buildx build --pull --platform linux/$ARCH \\\n\
      \    ${CACHE_SOURCE} \\\n    ${CACHE_TO} \\\n    ${DOCKER_NO_CACHE} \\\n    --build-arg\
      \ AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG} \\\n    --build-arg CI \\\n   \
      \ --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n    --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n    --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n    --build-arg BASE_IMAGE_REGISTRY\
      \ \\\n    $BUILD_ARG \\\n    ${EXTRA_BUILD_CONTEXT} \\\n    --file $BUILD_CONTEXT/Dockerfile\
      \ \\\n    --target ${CACHE_TARGET} \\\n    $BUILD_CONTEXT \\\n    || send_docker_export_failure_event\
      \ \\\n    || true\n\n  # On non-deploy pipelines we're fine with relying on the\
      \ cache from this point on\n  DOCKER_NO_CACHE=\"\"\nfi\n"
    - "docker buildx build --push --pull --platform linux/$ARCH \\\n  ${CACHE_SOURCE}\
      \ \\\n  ${DOCKER_NO_CACHE} \\\n  --build-arg AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG}\
      \ \\\n  --build-arg CI \\\n  --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n  --build-arg BASE_IMAGE_REGISTRY \\\n  $BUILD_ARG \\\n  $TARGET_ARG \\\n\
      \  --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n  --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n  ${EXTRA_BUILD_CONTEXT}\
      \ \\\n  --file $BUILD_CONTEXT/Dockerfile \\\n  --tag ${TARGET_TAG} \\\n  --label\
      \ \"org.opencontainers.image.created=$(date --rfc-3339=seconds)\" \\\n  --label\
      \ \"org.opencontainers.image.authors=Datadog <package@datadoghq.com>\" \\\n  --label\
      \ \"org.opencontainers.image.source=https://github.com/DataDog/datadog-agent\"\
      \ \\\n  --label \"org.opencontainers.image.version=$(dda inv agent.version)\"\
      \ \\\n  --label \"org.opencontainers.image.revision=${CI_COMMIT_SHA}\" \\\n  --label\
      \ \"org.opencontainers.image.vendor=Datadog, Inc.\" \\\n  --label \"target=none\"\
      \ \\\n  $BUILD_CONTEXT"
    - FLATTEN_IMAGE=${FLATTEN_IMAGE:-true}
    - "if [[ \"$FLATTEN_IMAGE\" == \"true\" ]]; then\n  crane flatten -t ${TARGET_TAG}\
      \ ${TARGET_TAG}\nfi\n"
    - "# Measure Docker image size and generate in-place report\n# This runs after the\
      \ main script and won't fail the job if there are issues.\n# This is common for\
      \ all Docker image builds\n\nif [[ -n \"$STATIC_QUALITY_GATE_NAME\" ]]; then\n\
      \  echo \"\U0001F4CA Starting Docker image measurement...\"\n\n  # Construct the\
      \ built image reference from build variables\n  # This follows the same pattern\
      \ used in docker build jobs\n  ECR_RELEASE_SUFFIX=${ECR_RELEASE_SUFFIX:-}\n  TAG_SUFFIX=${TAG_SUFFIX:-}\n\
      \  IMAGE_REF=\"${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-$ARCH\"\
      \n  \n  echo \"\U0001F50D Measuring Docker image: $IMAGE_REF\"\n\n  # Extract\
      \ report prefix from gate name (e.g. static_quality_gate_docker_agent_amd64 ->\
      \ docker_agent_amd64)\n  REPORT_PREFIX=\"${STATIC_QUALITY_GATE_NAME#static_quality_gate_}\"\
      \n\n  # Generate measurement report using STATIC_QUALITY_GATE_NAME variable\n\
      \  dda inv quality-gates.measure-image-local \\\n    --image-ref \"$IMAGE_REF\"\
      \ \\\n    --gate-name \"$STATIC_QUALITY_GATE_NAME\" \\\n    --build-job-name \"\
      $CI_JOB_NAME\" \\\n    --output-path \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    --debug || { echo \"\u26A0\uFE0F  Docker image measurement failed for\
      \ $IMAGE_REF\"; exit 0; }\n\n  echo \"\u2705 Docker image measurement completed\"\
      \n\n  # Upload the report to S3 (same bucket structure as packages)\n  BUCKET_BASE_PATH=\"\
      s3://dd-ci-artefacts-build-stable/datadog-agent/static_quality_gates/GATE_REPORTS/${CI_COMMIT_SHA}\"\
      \n  echo \"Uploading report to ${BUCKET_BASE_PATH}\"\n  aws s3 cp --only-show-errors\
      \ --region us-east-1 --sse AES256 \\\n    \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    \"${BUCKET_BASE_PATH}/${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \nelse\n  echo \"\u2139\uFE0F  Skipping Docker image measurement (no STATIC_QUALITY_GATE_NAME\
      \ defined)\"\nfi\n"
    stage: container_build
    tags:
    - arch:arm64
    - specific:true
    timeout: 30m
    variables:
      ARCH: arm64
      BASE_IMAGE_REGISTRY: registry.ddbuild.io/images/mirror
      BUILD_ARG: --target release
      BUILD_CONTEXT: Dockerfiles/otel-agent
      FLATTEN_IMAGE: false
      IMAGE: registry.ddbuild.io/ci/datadog-agent/otel-agent
      TAG_SUFFIX: -7
docker_build_ot_agent_standalone_fips_amd64 
  docker_build_ot_agent_standalone_fips_amd64:
    before_script:
    - mkdir /tmp/otel
    - ARCHIVE_NAME=$(find . -name "datadog-*agent-ddot-7*.tar.xz" | head -1)
    - 'tar --extract --xz --file $ARCHIVE_NAME \
  
      --verbose \
  
      --directory $BUILD_CONTEXT \
  
      --strip-components 4 \
  
-     opt/datadog-agent/embedded/bin/otel-agent
+     opt/datadog-agent/embedded/bin/otel-agent \
?                                              ++
+ 
+     opt/datadog-agent/embedded/bin/agent-rollout-gate
  
      '
+   - mv $BUILD_CONTEXT/agent-rollout-gate $BUILD_CONTEXT/otel-agent-rollout-gate
    - 'tar --extract --xz --file $ARCHIVE_NAME \
  
      --verbose \
  
      --directory $BUILD_CONTEXT \
  
      --strip-components 2 \
  
      --transform ''s|\.example||'' \
  
      etc/datadog-agent/otel-config.yaml.example
  
      '
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/docker_x64$CI_IMAGE_DOCKER_X64_SUFFIX:$CI_IMAGE_DOCKER_X64
    needs:
    - job: docker_build_fips_agent7
    - job: datadog-otel-agent-x64-fips
    retry: 2
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - TAG_SUFFIX=${TAG_SUFFIX:-}
    - BUILD_ARG=${BUILD_ARG:-}
    - EXTRA_BUILD_CONTEXT=${ARTIFACTS_BUILD_CONTEXT:+"--build-context artifacts=$ARTIFACTS_BUILD_CONTEXT"}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" && ( \"$IMAGE\" =~ \"ci/datadog-agent/agent\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/cluster-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/cws-instrumentation\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/secret-generic-connector\" || \"$IMAGE\"\
      \ =~ \"ci/datadog-agent/otel-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/ddot-ebpf\"\
      \ ) ]]; then\n  export ECR_RELEASE_SUFFIX=\"-nightly\"\nelse\n  export ECR_RELEASE_SUFFIX=${CI_COMMIT_TAG+-release}\n\
      fi\n"
    - AGENT_BASE_IMAGE_TAG=registry.ddbuild.io/ci/datadog-agent/${BASE_IMAGE_NAME:-agent-base-image}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${BASE_IMAGE_TAG_SUFFIX:-}-$ARCH
    - TARGET_TAG=${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}$TAG_SUFFIX-$ARCH
    - DOCKER_CACHE_REGISTRY_TARGET="${IMAGE}${TAG_SUFFIX}-${ARCH}:cache"
    - CACHE_SOURCE="--cache-from type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET}"
    - CACHE_TO=""
    - CACHE_TARGET=${CACHE_TARGET:-}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\n  CACHE_TO=\"--cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\
      \nfi\nif [[ \"$CI_COMMIT_BRANCH\" == \"$CI_DEFAULT_BRANCH\" ]]; then\n  CACHE_TO=\"\
      --cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\nfi\n"
    - "if [[ \"$DEPLOY_AGENT\" == \"true\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\nfi\n"
    - "if [[ -n \"${CACHE_TO}\" && -n \"${CACHE_TARGET}\" ]]; then\n  # Build cacheable\
      \ target to only export certain steps to registry.\n  # Doing this first build\
      \ separately lets us avoid uploading heavy artifacts (such as Agent packages),\n\
      \  # that can't be usefully cached, to the remote cache.\n  echo \"Building ${CACHE_TARGET}\
      \ for cache\"\n  # We accept failures on this build, because the build can still\
      \ succeed, and the only consequence of\n  # failure is that the cache doesn't\
      \ get updated, which is not critical.\n  # We do send an event to DD to be able\
      \ to monitor it.\n\n  send_docker_export_failure_event() {\n    DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh\
      \ $AGENT_API_KEY_ORG2 token) && \\\n    curl -X POST \"https://api.datadoghq.com/api/v1/events\"\
      \ \\\n         -H \"Content-Type: application/json\" \\\n         -H \"DD-API-KEY:\
      \ ${DD_API_KEY}\" \\\n         -d '{\n          \"title\": \"docker cache export\
      \ failure\",\n          \"text\": \"An Agent docker build failed to export the\
      \ cache to the remote registry\",\n          \"alert_type\": \"error\",\n    \
      \      \"date_happened\": '\"$(date +%s)\"',\n          \"tags\": [\"team:agent-build\"\
      , \"pipeline:'${CI_PIPELINE_ID}'\", \"job:'${CI_JOB_NAME}'\", \"job-id:'${CI_JOB_ID}'\"\
      ]\n        }'\n  }\n\n  docker buildx build --pull --platform linux/$ARCH \\\n\
      \    ${CACHE_SOURCE} \\\n    ${CACHE_TO} \\\n    ${DOCKER_NO_CACHE} \\\n    --build-arg\
      \ AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG} \\\n    --build-arg CI \\\n   \
      \ --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n    --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n    --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n    --build-arg BASE_IMAGE_REGISTRY\
      \ \\\n    $BUILD_ARG \\\n    ${EXTRA_BUILD_CONTEXT} \\\n    --file $BUILD_CONTEXT/Dockerfile\
      \ \\\n    --target ${CACHE_TARGET} \\\n    $BUILD_CONTEXT \\\n    || send_docker_export_failure_event\
      \ \\\n    || true\n\n  # On non-deploy pipelines we're fine with relying on the\
      \ cache from this point on\n  DOCKER_NO_CACHE=\"\"\nfi\n"
    - "docker buildx build --push --pull --platform linux/$ARCH \\\n  ${CACHE_SOURCE}\
      \ \\\n  ${DOCKER_NO_CACHE} \\\n  --build-arg AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG}\
      \ \\\n  --build-arg CI \\\n  --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n  --build-arg BASE_IMAGE_REGISTRY \\\n  $BUILD_ARG \\\n  $TARGET_ARG \\\n\
      \  --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n  --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n  ${EXTRA_BUILD_CONTEXT}\
      \ \\\n  --file $BUILD_CONTEXT/Dockerfile \\\n  --tag ${TARGET_TAG} \\\n  --label\
      \ \"org.opencontainers.image.created=$(date --rfc-3339=seconds)\" \\\n  --label\
      \ \"org.opencontainers.image.authors=Datadog <package@datadoghq.com>\" \\\n  --label\
      \ \"org.opencontainers.image.source=https://github.com/DataDog/datadog-agent\"\
      \ \\\n  --label \"org.opencontainers.image.version=$(dda inv agent.version)\"\
      \ \\\n  --label \"org.opencontainers.image.revision=${CI_COMMIT_SHA}\" \\\n  --label\
      \ \"org.opencontainers.image.vendor=Datadog, Inc.\" \\\n  --label \"target=none\"\
      \ \\\n  $BUILD_CONTEXT"
    - FLATTEN_IMAGE=${FLATTEN_IMAGE:-true}
    - "if [[ \"$FLATTEN_IMAGE\" == \"true\" ]]; then\n  crane flatten -t ${TARGET_TAG}\
      \ ${TARGET_TAG}\nfi\n"
    - "# Measure Docker image size and generate in-place report\n# This runs after the\
      \ main script and won't fail the job if there are issues.\n# This is common for\
      \ all Docker image builds\n\nif [[ -n \"$STATIC_QUALITY_GATE_NAME\" ]]; then\n\
      \  echo \"\U0001F4CA Starting Docker image measurement...\"\n\n  # Construct the\
      \ built image reference from build variables\n  # This follows the same pattern\
      \ used in docker build jobs\n  ECR_RELEASE_SUFFIX=${ECR_RELEASE_SUFFIX:-}\n  TAG_SUFFIX=${TAG_SUFFIX:-}\n\
      \  IMAGE_REF=\"${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-$ARCH\"\
      \n  \n  echo \"\U0001F50D Measuring Docker image: $IMAGE_REF\"\n\n  # Extract\
      \ report prefix from gate name (e.g. static_quality_gate_docker_agent_amd64 ->\
      \ docker_agent_amd64)\n  REPORT_PREFIX=\"${STATIC_QUALITY_GATE_NAME#static_quality_gate_}\"\
      \n\n  # Generate measurement report using STATIC_QUALITY_GATE_NAME variable\n\
      \  dda inv quality-gates.measure-image-local \\\n    --image-ref \"$IMAGE_REF\"\
      \ \\\n    --gate-name \"$STATIC_QUALITY_GATE_NAME\" \\\n    --build-job-name \"\
      $CI_JOB_NAME\" \\\n    --output-path \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    --debug || { echo \"\u26A0\uFE0F  Docker image measurement failed for\
      \ $IMAGE_REF\"; exit 0; }\n\n  echo \"\u2705 Docker image measurement completed\"\
      \n\n  # Upload the report to S3 (same bucket structure as packages)\n  BUCKET_BASE_PATH=\"\
      s3://dd-ci-artefacts-build-stable/datadog-agent/static_quality_gates/GATE_REPORTS/${CI_COMMIT_SHA}\"\
      \n  echo \"Uploading report to ${BUCKET_BASE_PATH}\"\n  aws s3 cp --only-show-errors\
      \ --region us-east-1 --sse AES256 \\\n    \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    \"${BUCKET_BASE_PATH}/${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \nelse\n  echo \"\u2139\uFE0F  Skipping Docker image measurement (no STATIC_QUALITY_GATE_NAME\
      \ defined)\"\nfi\n"
    stage: container_build
    tags:
    - arch:amd64
    - specific:true
    timeout: 30m
    variables:
      ARCH: amd64
      BASE_IMAGE_NAME: agent
      BASE_IMAGE_REGISTRY: registry.ddbuild.io/images/mirror
      BASE_IMAGE_TAG_SUFFIX: -7-fips
      BUILD_ARG: --target release
      BUILD_CONTEXT: Dockerfiles/otel-agent
      FLATTEN_IMAGE: false
      IMAGE: registry.ddbuild.io/ci/datadog-agent/otel-agent
      TAG_SUFFIX: -7-fips
docker_build_ot_agent_standalone_fips_arm64 
  docker_build_ot_agent_standalone_fips_arm64:
    before_script:
    - mkdir /tmp/otel
    - ARCHIVE_NAME=$(find . -name "datadog-*agent-ddot-7*.tar.xz" | head -1)
    - 'tar --extract --xz --file $ARCHIVE_NAME \
  
      --verbose \
  
      --directory $BUILD_CONTEXT \
  
      --strip-components 4 \
  
-     opt/datadog-agent/embedded/bin/otel-agent
+     opt/datadog-agent/embedded/bin/otel-agent \
?                                              ++
+ 
+     opt/datadog-agent/embedded/bin/agent-rollout-gate
  
      '
+   - mv $BUILD_CONTEXT/agent-rollout-gate $BUILD_CONTEXT/otel-agent-rollout-gate
    - 'tar --extract --xz --file $ARCHIVE_NAME \
  
      --verbose \
  
      --directory $BUILD_CONTEXT \
  
      --strip-components 2 \
  
      --transform ''s|\.example||'' \
  
      etc/datadog-agent/otel-config.yaml.example
  
      '
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/docker_arm64$CI_IMAGE_DOCKER_ARM64_SUFFIX:$CI_IMAGE_DOCKER_ARM64
    needs:
    - job: docker_build_fips_agent7_arm64
    - job: datadog-otel-agent-arm64-fips
    retry: 2
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - TAG_SUFFIX=${TAG_SUFFIX:-}
    - BUILD_ARG=${BUILD_ARG:-}
    - EXTRA_BUILD_CONTEXT=${ARTIFACTS_BUILD_CONTEXT:+"--build-context artifacts=$ARTIFACTS_BUILD_CONTEXT"}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" && ( \"$IMAGE\" =~ \"ci/datadog-agent/agent\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/cluster-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/cws-instrumentation\"\
      \ || \"$IMAGE\" =~ \"ci/datadog-agent/secret-generic-connector\" || \"$IMAGE\"\
      \ =~ \"ci/datadog-agent/otel-agent\" || \"$IMAGE\" =~ \"ci/datadog-agent/ddot-ebpf\"\
      \ ) ]]; then\n  export ECR_RELEASE_SUFFIX=\"-nightly\"\nelse\n  export ECR_RELEASE_SUFFIX=${CI_COMMIT_TAG+-release}\n\
      fi\n"
    - AGENT_BASE_IMAGE_TAG=registry.ddbuild.io/ci/datadog-agent/${BASE_IMAGE_NAME:-agent-base-image}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${BASE_IMAGE_TAG_SUFFIX:-}-$ARCH
    - TARGET_TAG=${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}$TAG_SUFFIX-$ARCH
    - DOCKER_CACHE_REGISTRY_TARGET="${IMAGE}${TAG_SUFFIX}-${ARCH}:cache"
    - CACHE_SOURCE="--cache-from type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET}"
    - CACHE_TO=""
    - CACHE_TARGET=${CACHE_TARGET:-}
    - "if [[ \"$BUCKET_BRANCH\" == \"nightly\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\n  CACHE_TO=\"--cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\
      \nfi\nif [[ \"$CI_COMMIT_BRANCH\" == \"$CI_DEFAULT_BRANCH\" ]]; then\n  CACHE_TO=\"\
      --cache-to type=registry,ref=${DOCKER_CACHE_REGISTRY_TARGET},mode=max\"\nfi\n"
    - "if [[ \"$DEPLOY_AGENT\" == \"true\" ]]; then\n  DOCKER_NO_CACHE=\"--no-cache\"\
      \n  CACHE_SOURCE=\"\"\nfi\n"
    - "if [[ -n \"${CACHE_TO}\" && -n \"${CACHE_TARGET}\" ]]; then\n  # Build cacheable\
      \ target to only export certain steps to registry.\n  # Doing this first build\
      \ separately lets us avoid uploading heavy artifacts (such as Agent packages),\n\
      \  # that can't be usefully cached, to the remote cache.\n  echo \"Building ${CACHE_TARGET}\
      \ for cache\"\n  # We accept failures on this build, because the build can still\
      \ succeed, and the only consequence of\n  # failure is that the cache doesn't\
      \ get updated, which is not critical.\n  # We do send an event to DD to be able\
      \ to monitor it.\n\n  send_docker_export_failure_event() {\n    DD_API_KEY=$($CI_PROJECT_DIR/tools/ci/fetch_secret.sh\
      \ $AGENT_API_KEY_ORG2 token) && \\\n    curl -X POST \"https://api.datadoghq.com/api/v1/events\"\
      \ \\\n         -H \"Content-Type: application/json\" \\\n         -H \"DD-API-KEY:\
      \ ${DD_API_KEY}\" \\\n         -d '{\n          \"title\": \"docker cache export\
      \ failure\",\n          \"text\": \"An Agent docker build failed to export the\
      \ cache to the remote registry\",\n          \"alert_type\": \"error\",\n    \
      \      \"date_happened\": '\"$(date +%s)\"',\n          \"tags\": [\"team:agent-build\"\
      , \"pipeline:'${CI_PIPELINE_ID}'\", \"job:'${CI_JOB_NAME}'\", \"job-id:'${CI_JOB_ID}'\"\
      ]\n        }'\n  }\n\n  docker buildx build --pull --platform linux/$ARCH \\\n\
      \    ${CACHE_SOURCE} \\\n    ${CACHE_TO} \\\n    ${DOCKER_NO_CACHE} \\\n    --build-arg\
      \ AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG} \\\n    --build-arg CI \\\n   \
      \ --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n    --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n    --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n    --build-arg BASE_IMAGE_REGISTRY\
      \ \\\n    $BUILD_ARG \\\n    ${EXTRA_BUILD_CONTEXT} \\\n    --file $BUILD_CONTEXT/Dockerfile\
      \ \\\n    --target ${CACHE_TARGET} \\\n    $BUILD_CONTEXT \\\n    || send_docker_export_failure_event\
      \ \\\n    || true\n\n  # On non-deploy pipelines we're fine with relying on the\
      \ cache from this point on\n  DOCKER_NO_CACHE=\"\"\nfi\n"
    - "docker buildx build --push --pull --platform linux/$ARCH \\\n  ${CACHE_SOURCE}\
      \ \\\n  ${DOCKER_NO_CACHE} \\\n  --build-arg AGENT_BASE_IMAGE_TAG=${AGENT_BASE_IMAGE_TAG}\
      \ \\\n  --build-arg CI \\\n  --build-arg GENERAL_ARTIFACTS_CACHE_BUCKET_URL=${GENERAL_ARTIFACTS_CACHE_BUCKET_URL}\
      \ \\\n  --build-arg BASE_IMAGE_REGISTRY \\\n  $BUILD_ARG \\\n  $TARGET_ARG \\\n\
      \  --build-arg DD_GIT_REPOSITORY_URL=https://github.com/DataDog/datadog-agent\
      \ \\\n  --build-arg DD_GIT_COMMIT_SHA=${CI_COMMIT_SHA} \\\n  ${EXTRA_BUILD_CONTEXT}\
      \ \\\n  --file $BUILD_CONTEXT/Dockerfile \\\n  --tag ${TARGET_TAG} \\\n  --label\
      \ \"org.opencontainers.image.created=$(date --rfc-3339=seconds)\" \\\n  --label\
      \ \"org.opencontainers.image.authors=Datadog <package@datadoghq.com>\" \\\n  --label\
      \ \"org.opencontainers.image.source=https://github.com/DataDog/datadog-agent\"\
      \ \\\n  --label \"org.opencontainers.image.version=$(dda inv agent.version)\"\
      \ \\\n  --label \"org.opencontainers.image.revision=${CI_COMMIT_SHA}\" \\\n  --label\
      \ \"org.opencontainers.image.vendor=Datadog, Inc.\" \\\n  --label \"target=none\"\
      \ \\\n  $BUILD_CONTEXT"
    - FLATTEN_IMAGE=${FLATTEN_IMAGE:-true}
    - "if [[ \"$FLATTEN_IMAGE\" == \"true\" ]]; then\n  crane flatten -t ${TARGET_TAG}\
      \ ${TARGET_TAG}\nfi\n"
    - "# Measure Docker image size and generate in-place report\n# This runs after the\
      \ main script and won't fail the job if there are issues.\n# This is common for\
      \ all Docker image builds\n\nif [[ -n \"$STATIC_QUALITY_GATE_NAME\" ]]; then\n\
      \  echo \"\U0001F4CA Starting Docker image measurement...\"\n\n  # Construct the\
      \ built image reference from build variables\n  # This follows the same pattern\
      \ used in docker build jobs\n  ECR_RELEASE_SUFFIX=${ECR_RELEASE_SUFFIX:-}\n  TAG_SUFFIX=${TAG_SUFFIX:-}\n\
      \  IMAGE_REF=\"${IMAGE}${ECR_RELEASE_SUFFIX}:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}${TAG_SUFFIX}-$ARCH\"\
      \n  \n  echo \"\U0001F50D Measuring Docker image: $IMAGE_REF\"\n\n  # Extract\
      \ report prefix from gate name (e.g. static_quality_gate_docker_agent_amd64 ->\
      \ docker_agent_amd64)\n  REPORT_PREFIX=\"${STATIC_QUALITY_GATE_NAME#static_quality_gate_}\"\
      \n\n  # Generate measurement report using STATIC_QUALITY_GATE_NAME variable\n\
      \  dda inv quality-gates.measure-image-local \\\n    --image-ref \"$IMAGE_REF\"\
      \ \\\n    --gate-name \"$STATIC_QUALITY_GATE_NAME\" \\\n    --build-job-name \"\
      $CI_JOB_NAME\" \\\n    --output-path \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    --debug || { echo \"\u26A0\uFE0F  Docker image measurement failed for\
      \ $IMAGE_REF\"; exit 0; }\n\n  echo \"\u2705 Docker image measurement completed\"\
      \n\n  # Upload the report to S3 (same bucket structure as packages)\n  BUCKET_BASE_PATH=\"\
      s3://dd-ci-artefacts-build-stable/datadog-agent/static_quality_gates/GATE_REPORTS/${CI_COMMIT_SHA}\"\
      \n  echo \"Uploading report to ${BUCKET_BASE_PATH}\"\n  aws s3 cp --only-show-errors\
      \ --region us-east-1 --sse AES256 \\\n    \"${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \ \\\n    \"${BUCKET_BASE_PATH}/${REPORT_PREFIX}_size_report_${CI_PIPELINE_ID}_${CI_COMMIT_SHA:0:8}.yml\"\
      \nelse\n  echo \"\u2139\uFE0F  Skipping Docker image measurement (no STATIC_QUALITY_GATE_NAME\
      \ defined)\"\nfi\n"
    stage: container_build
    tags:
    - arch:arm64
    - specific:true
    timeout: 30m
    variables:
      ARCH: arm64
      BASE_IMAGE_NAME: agent
      BASE_IMAGE_REGISTRY: registry.ddbuild.io/images/mirror
      BASE_IMAGE_TAG_SUFFIX: -7-fips
      BUILD_ARG: --target release
      BUILD_CONTEXT: Dockerfiles/otel-agent
      FLATTEN_IMAGE: false
      IMAGE: registry.ddbuild.io/ci/datadog-agent/otel-agent
      TAG_SUFFIX: -7-fips

Changes Summary

Removed Modified Added Renamed
0 11 0 0

ℹ️ Diff available in the job log.

@datadog-datadog-prod-us1

This comment has been minimized.

Sign in to view
@dd-octo-sts

dd-octo-sts Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Files inventory check summary

File checks results against ancestor 99f14942:

Results for datadog-agent_7.84.0~devel.git.426.5eb946f.pipeline.132756131-1_amd64.deb:

No change detected

Results for datadog-iot-agent_7.84.0~devel.git.426.5eb946f.pipeline.132756131-1_amd64.deb:

No change detected

@cit-pr-commenter-54b7da

cit-pr-commenter-54b7da Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Job ID: cc80afcf-092e-4e28-a734-ae72d3badbab

Baseline: 99f1494
Comparison: 6e32552
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
➖ quality_gate_idle_all_features memory utilization +0.54 [+0.50, +0.58] 1 Logs bounds checks dashboard
➖ quality_gate_metrics_logs memory utilization +0.50 [+0.27, +0.72] 1 Logs bounds checks dashboard
➖ dsd_uds_10mb_3k_timestamped_contexts_cpu % cpu utilization +0.35 [+0.10, +0.60] 1 Logs
➖ quality_gate_security_no_fs_load memory utilization +0.33 [+0.24, +0.42] 1 Logs bounds checks dashboard
➖ quality_gate_private_action_runner memory utilization +0.11 [-0.01, +0.23] 1 Logs bounds checks dashboard
➖ quality_gate_idle memory utilization +0.11 [+0.06, +0.15] 1 Logs bounds checks dashboard
➖ quality_gate_security_mean_fs_load memory utilization -0.02 [-0.06, +0.01] 1 Logs bounds checks dashboard
➖ quality_gate_security_idle memory utilization -0.25 [-0.29, -0.20] 1 Logs bounds checks dashboard
➖ quality_gate_logs % cpu utilization -0.59 [-1.44, +0.27] 1 Logs bounds checks dashboard
➖ dsd_uds_10mb_3k_timestamped_contexts_memory memory utilization -0.77 [-0.98, -0.56] 1 Logs

Bounds Checks: ✅ Passed

perf experiment bounds_check_name replicates_passed observed_value links
✅ quality_gate_idle intake_connections 10/10 4 = 4 bounds checks dashboard
✅ quality_gate_idle memory_usage 10/10 172.46MiB ≤ 178MiB bounds checks dashboard
✅ quality_gate_idle total_bytes_received 10/10 747.54KiB ≤ 819.20KiB bounds checks dashboard
✅ quality_gate_idle_all_features intake_connections 10/10 4 = 4 bounds checks dashboard
✅ quality_gate_idle_all_features memory_usage 10/10 515.09MiB ≤ 538MiB bounds checks dashboard
✅ quality_gate_idle_all_features total_bytes_received 10/10 1.14MiB ≤ 1.25MiB bounds checks dashboard
✅ quality_gate_logs intake_connections 10/10 18 ≤ 40 bounds checks dashboard
✅ quality_gate_logs memory_usage 10/10 210.99MiB ≤ 229MiB bounds checks dashboard
✅ quality_gate_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
✅ quality_gate_logs total_bytes_received 10/10 263.37MiB ≤ 292MiB bounds checks dashboard
✅ quality_gate_metrics_logs cpu_usage 10/10 358.24 ≤ 2000 bounds checks dashboard
✅ quality_gate_metrics_logs intake_connections 10/10 20 ≤ 40 bounds checks dashboard
✅ quality_gate_metrics_logs memory_usage 10/10 421.17MiB ≤ 453MiB bounds checks dashboard
✅ quality_gate_metrics_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
✅ quality_gate_metrics_logs total_bytes_received 10/10 0.94GiB ≤ 1.04GiB bounds checks dashboard
✅ quality_gate_private_action_runner memory_usage 10/10 72.45MiB ≤ 76MiB bounds checks dashboard
✅ quality_gate_security_idle cpu_usage 10/10 29.05 ≤ 100 bounds checks dashboard
✅ quality_gate_security_idle memory_usage 10/10 328.95MiB ≤ 335MiB bounds checks dashboard
✅ quality_gate_security_mean_fs_load cpu_usage 10/10 58.07 ≤ 200 bounds checks dashboard
✅ quality_gate_security_mean_fs_load memory_usage 10/10 298.69MiB ≤ 314MiB bounds checks dashboard
✅ quality_gate_security_no_fs_load cpu_usage 10/10 22.09 ≤ 100 bounds checks dashboard
✅ quality_gate_security_no_fs_load memory_usage 10/10 314.77MiB ≤ 343MiB bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

  • quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.

@AliDatadog AliDatadog added the qa/done QA done before merge and regressions are covered by tests label Aug 21, 2026 — with ddtool CLI
@dd-octo-sts

dd-octo-sts Bot commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Static quality checks

❌ Please find below the results from static quality gates
Comparison made with ancestor 99f1494
📊 Static Quality Gates Dashboard
🔗 SQG Job

Error

Quality gate Change Size (prev → curr → max)
❌ agent_deb_amd64 (per-PR threshold) +2.5 MiB (0.33% increase, -66.42% of buffer) 760.836 → 763.336 → 764.600
❌ agent_deb_amd64_fips (on disk) +2.87 MiB (0.40% increase, -129.36% of buffer) 713.618 → 716.492 → 715.840
❌ agent_heroku_amd64 (per-PR threshold) +2.5 MiB (0.80% increase, -39.82% of buffer) 312.802 → 315.302 → 319.080
❌ agent_rpm_amd64 (per-PR threshold) +2.5 MiB (0.33% increase, -66.67% of buffer) 760.820 → 763.320 → 764.570
❌ agent_rpm_amd64_fips (on disk) +2.87 MiB (0.40% increase, -128.42% of buffer) 713.602 → 716.476 → 715.840
❌ agent_rpm_arm64 (on disk) +2.37 MiB (0.32% increase, -617.04% of buffer) 736.746 → 739.117 → 737.130
❌ agent_rpm_arm64_fips (on disk) +2.81 MiB (0.41% increase, -283.13% of buffer) 692.826 → 695.640 → 693.820
❌ agent_suse_amd64 (per-PR threshold) +2.5 MiB (0.33% increase, -66.67% of buffer) 760.820 → 763.320 → 764.570
❌ agent_suse_amd64_fips (on disk) +2.87 MiB (0.40% increase, -128.42% of buffer) 713.602 → 716.476 → 715.840
❌ agent_suse_arm64 (on disk) +2.37 MiB (0.32% increase, -617.04% of buffer) 736.746 → 739.117 → 737.130
❌ agent_suse_arm64_fips (on disk) +2.81 MiB (0.41% increase, -283.13% of buffer) 692.826 → 695.640 → 693.820
❌ docker_agent_amd64 (on disk) +2.5 MiB (0.31% increase, -362.91% of buffer) 819.451 → 821.951 → 820.140
❌ docker_agent_arm64 (on disk) +2.37 MiB (0.29% increase, -500.21% of buffer) 820.416 → 822.787 → 820.890
❌ docker_agent_jmx_amd64 (on disk) +2.5 MiB (0.25% increase, -453.46% of buffer) 1010.349 → 1012.849 → 1010.900
❌ docker_agent_jmx_arm64 (on disk) +2.37 MiB (0.24% increase, -392.54% of buffer) 999.966 → 1002.337 → 1000.570
Gate failure full details
Quality gate Error type Error message
agent_deb_amd64 PerPRThresholdExceeded On-disk size increase of 2.5 MiB exceeds the per-PR threshold of 600.0 KiB
agent_deb_amd64_fips AbsoluteLimitExceeded static_quality_gate_agent_deb_amd64_fips failed!
Disk size 716.5 MB exceeds limit of 715.8 MB by 668.0 KB
agent_heroku_amd64 PerPRThresholdExceeded On-disk size increase of 2.5 MiB exceeds the per-PR threshold of 600.0 KiB
agent_rpm_amd64 PerPRThresholdExceeded On-disk size increase of 2.5 MiB exceeds the per-PR threshold of 600.0 KiB
agent_rpm_amd64_fips AbsoluteLimitExceeded static_quality_gate_agent_rpm_amd64_fips failed!
Disk size 716.5 MB exceeds limit of 715.8 MB by 651.4 KB
agent_rpm_arm64 AbsoluteLimitExceeded static_quality_gate_agent_rpm_arm64 failed!
Disk size 739.1 MB exceeds limit of 737.1 MB by 2.0 MB
agent_rpm_arm64_fips AbsoluteLimitExceeded static_quality_gate_agent_rpm_arm64_fips failed!
Disk size 695.6 MB exceeds limit of 693.8 MB by 1.8 MB
agent_suse_amd64 PerPRThresholdExceeded On-disk size increase of 2.5 MiB exceeds the per-PR threshold of 600.0 KiB
agent_suse_amd64_fips AbsoluteLimitExceeded static_quality_gate_agent_suse_amd64_fips failed!
Disk size 716.5 MB exceeds limit of 715.8 MB by 651.4 KB
agent_suse_arm64 AbsoluteLimitExceeded static_quality_gate_agent_suse_arm64 failed!
Disk size 739.1 MB exceeds limit of 737.1 MB by 2.0 MB
agent_suse_arm64_fips AbsoluteLimitExceeded static_quality_gate_agent_suse_arm64_fips failed!
Disk size 695.6 MB exceeds limit of 693.8 MB by 1.8 MB
docker_agent_amd64 AbsoluteLimitExceeded static_quality_gate_docker_agent_amd64 failed!
Disk size 822.0 MB exceeds limit of 820.1 MB by 1.8 MB
docker_agent_arm64 AbsoluteLimitExceeded static_quality_gate_docker_agent_arm64 failed!
Disk size 822.8 MB exceeds limit of 820.9 MB by 1.9 MB
docker_agent_jmx_amd64 AbsoluteLimitExceeded static_quality_gate_docker_agent_jmx_amd64 failed!
Disk size 1012.8 MB exceeds limit of 1010.9 MB by 1.9 MB
docker_agent_jmx_arm64 AbsoluteLimitExceeded static_quality_gate_docker_agent_jmx_arm64 failed!
Disk size 1002.3 MB exceeds limit of 1000.6 MB by 1.8 MB

Static quality gate failures prevent this PR from merging!
You can check the static quality gates runbooks page for guidance and tools. Please either fix the size violation or request an exception.

Successful checks

Info

Quality gate Change Size (prev → curr → max)
✅ docker_host_profiler_amd64 +2.5 MiB (0.82% increase, -22.94% of buffer) 306.802 → 309.302 → 317.700
✅ docker_host_profiler_arm64 +2.38 MiB (0.75% increase, -21.74% of buffer) 318.045 → 320.420 → 328.970
16 successful checks with minimal change (< 2 KiB)
Quality gate Current Size
✅ agent_msi 647.641 MiB
✅ docker_cluster_agent_amd64 211.352 MiB
✅ docker_cluster_agent_arm64 224.395 MiB
✅ docker_cws_instrumentation_amd64 7.443 MiB
✅ docker_cws_instrumentation_arm64 6.877 MiB
✅ docker_dogstatsd_amd64 39.467 MiB
✅ docker_dogstatsd_arm64 37.560 MiB
✅ dogstatsd_deb_amd64 30.212 MiB
✅ dogstatsd_deb_arm64 28.240 MiB
✅ dogstatsd_rpm_amd64 30.212 MiB
✅ dogstatsd_suse_amd64 30.212 MiB
✅ iot_agent_deb_amd64 46.503 MiB
✅ iot_agent_deb_arm64 43.159 MiB
✅ iot_agent_deb_armhf 43.950 MiB
✅ iot_agent_rpm_amd64 46.503 MiB
✅ iot_agent_suse_amd64 46.502 MiB

@AliDatadog AliDatadog closed this Aug 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

changelog/no-changelog No changelog entry needed internal Identify a non-fork PR long review PR is complex, plan time to review it qa/done QA done before merge and regressions are covered by tests team/agent-build team/agent-devx team/agent-runtimes team/container-platform The Container Platform Team team/fleet-remediation team/profiling-full-host

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@AliDatadog