[ACTP] add bootstrap-par-control command by embeaken · Pull Request #54870 · DataDog/datadog-agent

embeaken · 2026-08-13T22:32:26Z

What does this PR do?

Adds privateactionrunner bootstrap-par-control, making Go the configuration and identity authority for split mode.

The command loads canonical Agent configuration and secrets, ensures enrollment, derives the PAR runtime configuration, and emits one PAR_CONTROL_CONFIG= JSON line for par-control. Split mode rejects FIPS, and OPMS endpoint selection is shared with the Go runner.

The payload can contain private keys and proxy credentials, so it is never logged or included in errors.

Validation

bootstrap and identity Bazel tests
PAR OPMS/config Go tests
staging task execution

Stack base: #55401. Followed by #54590.

dd-octo-sts · 2026-08-13T22:40:39Z

Go Package Import Differences

Baseline: cf25466
Comparison: 9b723a6

binary	os	arch	change
agent	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
agent	linux	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
agent	windows	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
agent	darwin	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
agent	darwin	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
agent	aix	ppc64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
iot-agent	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
iot-agent	linux	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
heroku-agent	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
privateactionrunner	linux	amd64	+2, -0 +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/bootstrapparcontrol +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/identity
privateactionrunner	linux	arm64	+2, -0 +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/bootstrapparcontrol +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/identity
privateactionrunner	windows	amd64	+2, -0 +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/bootstrapparcontrol +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/identity
privateactionrunner	darwin	amd64	+2, -0 +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/bootstrapparcontrol +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/identity
privateactionrunner	darwin	arm64	+2, -0 +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/bootstrapparcontrol +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/identity

dd-octo-sts · 2026-08-13T22:59:29Z

Files inventory check summary

File checks results against ancestor cf25466b:

Results for datadog-agent_7.84.0~devel.git.565.9b723a6.pipeline.133819696-1_amd64.deb:

No change detected

Results for datadog-iot-agent_7.84.0~devel.git.565.9b723a6.pipeline.133819696-1_amd64.deb:

No change detected

dd-octo-sts · 2026-08-13T23:08:32Z

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor cf25466
📊 Static Quality Gates Dashboard
🔗 SQG Job

Successful checks

Info

	Quality gate	Change	Size (prev → curr → max)
✅	agent_deb_amd64	+145.51 KiB (0.02% increase, -4.11% of buffer)	761.380 → 761.522 → 764.840
✅	agent_deb_amd64_fips	+125.32 KiB (0.02% increase, -5.63% of buffer)	713.907 → 714.029 → 716.080
✅	agent_heroku_amd64	+40.0 KiB (0.01% increase, -0.64% of buffer)	312.949 → 312.989 → 319.080
✅	agent_msi	+61.2 KiB (0.01% increase, -0.46% of buffer)	648.050 → 648.110 → 661.050
✅	agent_rpm_amd64	+145.51 KiB (0.02% increase, -4.12% of buffer)	761.363 → 761.506 → 764.810
✅	agent_rpm_amd64_fips	+125.32 KiB (0.02% increase, -5.59% of buffer)	713.891 → 714.013 → 716.080
✅	agent_rpm_arm64	+139.31 KiB (0.02% increase, -13.36% of buffer)	737.292 → 737.428 → 738.310
✅	agent_rpm_arm64_fips	+111.12 KiB (0.02% increase, -8.86% of buffer)	693.126 → 693.234 → 694.350
✅	agent_suse_amd64	+145.51 KiB (0.02% increase, -4.12% of buffer)	761.363 → 761.506 → 764.810
✅	agent_suse_amd64_fips	+125.32 KiB (0.02% increase, -5.59% of buffer)	713.891 → 714.013 → 716.080
✅	agent_suse_arm64	+139.31 KiB (0.02% increase, -13.36% of buffer)	737.292 → 737.428 → 738.310
✅	agent_suse_arm64_fips	+111.12 KiB (0.02% increase, -8.86% of buffer)	693.126 → 693.234 → 694.350
✅	docker_agent_amd64	+145.51 KiB (0.02% increase, -22.92% of buffer)	820.380 → 820.522 → 821.000
✅	docker_agent_arm64	+139.31 KiB (0.02% increase, -21.54% of buffer)	821.349 → 821.485 → 821.980
✅	docker_agent_jmx_amd64	+145.51 KiB (0.01% increase, -23.01% of buffer)	1011.292 → 1011.434 → 1011.910
✅	docker_agent_jmx_arm64	+139.31 KiB (0.01% increase, -21.28% of buffer)	1001.041 → 1001.177 → 1001.680

17 successful checks with minimal change (< 2 KiB)

	Quality gate	Current Size
✅	docker_cluster_agent_amd64	211.247 MiB
✅	docker_cluster_agent_arm64	224.396 MiB
✅	docker_cws_instrumentation_amd64	7.439 MiB
✅	docker_cws_instrumentation_arm64	6.877 MiB
✅	docker_dogstatsd_amd64	39.545 MiB
✅	docker_dogstatsd_arm64	37.623 MiB
✅	docker_host_profiler_amd64	306.831 MiB
✅	docker_host_profiler_arm64	318.144 MiB
✅	dogstatsd_deb_amd64	30.290 MiB
✅	dogstatsd_deb_arm64	28.302 MiB
✅	dogstatsd_rpm_amd64	30.290 MiB
✅	dogstatsd_suse_amd64	30.290 MiB
✅	iot_agent_deb_amd64	46.560 MiB
✅	iot_agent_deb_arm64	43.196 MiB
✅	iot_agent_deb_armhf	44.007 MiB
✅	iot_agent_rpm_amd64	46.560 MiB
✅	iot_agent_suse_amd64	46.559 MiB

cit-pr-commenter-54b7da · 2026-08-14T00:38:31Z

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Job ID: 63ca67a4-93c1-4cbb-95e2-ca78321df7dc

Baseline: cf25466
Comparison: 9b723a6
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	quality_gate_logs	% cpu utilization	+3.09	[+2.20, +3.98]	1	Logs bounds checks dashboard
➖	dsd_uds_10mb_3k_timestamped_contexts_memory	memory utilization	+0.31	[+0.10, +0.52]	1	Logs
➖	quality_gate_security_mean_fs_load	memory utilization	+0.27	[+0.23, +0.31]	1	Logs bounds checks dashboard
➖	dsd_uds_10mb_3k_timestamped_contexts_cpu	% cpu utilization	+0.17	[-0.07, +0.41]	1	Logs
➖	quality_gate_idle_all_features	memory utilization	+0.08	[+0.04, +0.11]	1	Logs bounds checks dashboard
➖	quality_gate_security_no_fs_load	memory utilization	+0.07	[-0.01, +0.15]	1	Logs bounds checks dashboard
➖	quality_gate_security_idle	memory utilization	+0.02	[-0.04, +0.07]	1	Logs bounds checks dashboard
➖	quality_gate_private_action_runner	memory utilization	-0.30	[-0.42, -0.18]	1	Logs bounds checks dashboard
➖	quality_gate_idle	memory utilization	-0.38	[-0.43, -0.34]	1	Logs bounds checks dashboard
➖	quality_gate_metrics_logs	memory utilization	-0.41	[-0.63, -0.18]	1	Logs bounds checks dashboard

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	observed_value	links
✅	quality_gate_idle	intake_connections	10/10	4 = 4	bounds checks dashboard
✅	quality_gate_idle	memory_usage	10/10	172.65MiB ≤ 179MiB	bounds checks dashboard
✅	quality_gate_idle	total_bytes_received	10/10	745.41KiB ≤ 819.20KiB	bounds checks dashboard
✅	quality_gate_idle_all_features	intake_connections	10/10	4 = 4	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	514.16MiB ≤ 537MiB	bounds checks dashboard
✅	quality_gate_idle_all_features	total_bytes_received	10/10	1.14MiB ≤ 1.25MiB	bounds checks dashboard
✅	quality_gate_logs	intake_connections	10/10	18 ≤ 40	bounds checks dashboard
✅	quality_gate_logs	memory_usage	10/10	213.49MiB ≤ 220MiB	bounds checks dashboard
✅	quality_gate_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard
✅	quality_gate_logs	total_bytes_received	10/10	263.54MiB ≤ 292MiB	bounds checks dashboard
✅	quality_gate_metrics_logs	cpu_usage	10/10	373.68 ≤ 2000	bounds checks dashboard
✅	quality_gate_metrics_logs	intake_connections	10/10	20 ≤ 40	bounds checks dashboard
✅	quality_gate_metrics_logs	memory_usage	10/10	415.04MiB ≤ 455MiB	bounds checks dashboard
✅	quality_gate_metrics_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard
✅	quality_gate_metrics_logs	total_bytes_received	10/10	0.94GiB ≤ 1.04GiB	bounds checks dashboard
✅	quality_gate_private_action_runner	memory_usage	10/10	73.11MiB ≤ 75MiB	bounds checks dashboard
✅	quality_gate_security_idle	cpu_usage	10/10	29.71 ≤ 100	bounds checks dashboard
✅	quality_gate_security_idle	memory_usage	10/10	325.78MiB ≤ 355MiB	bounds checks dashboard
✅	quality_gate_security_mean_fs_load	cpu_usage	10/10	62.60 ≤ 200	bounds checks dashboard
✅	quality_gate_security_mean_fs_load	memory_usage	10/10	302.22MiB ≤ 335MiB	bounds checks dashboard
✅	quality_gate_security_no_fs_load	cpu_usage	10/10	22.09 ≤ 100	bounds checks dashboard
✅	quality_gate_security_no_fs_load	memory_usage	10/10	307.35MiB ≤ 345MiB	bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

✅ = significantly better comparison variant performance
❌ = significantly worse comparison variant performance
➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.

Make Go the single configuration authority for Private Action Runner split mode. `privateactionrunner bootstrap-par-control` loads the canonical Agent configuration, ensures enrollment, and emits the resolved control-plane configuration as one PAR_CONTROL_CONFIG= prefixed JSON line, so par-control no longer has to independently load or merge Agent configuration. When split mode is disabled the command returns the launch gate and log level and exits successfully, without hostname lookup, identity access, enrollment, or FIPS rejection. When split mode is active it rejects FIPS mode rather than silently consuming FIPS-transformed endpoints; a Gov site is not rejected on its own. OPMS endpoint selection moves to a shared Config.OPMSEndpointURL helper used by both the Go OPMS client and this command, so the Go and Rust runners cannot diverge again, including under the fakeintake test switch. Durations are emitted with explicit _milliseconds units, and the payload is never included in an error because it carries the runner private key and may carry proxy credentials.

This was referenced Aug 13, 2026

[ACTP] add par-control process lifecycle #54589

Merged

[ACTP] parse par-control configuration from Go #54590

Draft

This comment has been minimized.

Sign in to view

embeaken force-pushed the ilya/par-control-lifecycle branch from 6c22069 to cd87d21 Compare August 13, 2026 23:04

embeaken force-pushed the ilya/par-ensure-enrollment branch from 66e117b to e323571 Compare August 13, 2026 23:04

dd-octo-sts Bot added internal Identify a non-fork PR team/action-platform labels Aug 13, 2026

github-actions Bot added the medium review PR review might take time label Aug 13, 2026

dd-octo-sts Bot added the team/agent-build label Aug 13, 2026

embeaken force-pushed the ilya/par-control-lifecycle branch from cd87d21 to 6ba350e Compare August 13, 2026 23:10

embeaken force-pushed the ilya/par-ensure-enrollment branch 2 times, most recently from 1a16146 to 6b010be Compare August 13, 2026 23:48

embeaken force-pushed the ilya/par-control-lifecycle branch from 6ba350e to 481cfaf Compare August 13, 2026 23:48

embeaken force-pushed the ilya/par-ensure-enrollment branch from 6b010be to 00a3402 Compare August 14, 2026 02:43

embeaken force-pushed the ilya/par-control-lifecycle branch from 481cfaf to 9960c56 Compare August 14, 2026 02:43

embeaken force-pushed the ilya/par-ensure-enrollment branch from 00a3402 to ea55c73 Compare August 14, 2026 13:18

embeaken force-pushed the ilya/par-control-lifecycle branch 2 times, most recently from 9c657ce to 50ccce5 Compare August 14, 2026 14:17

embeaken force-pushed the ilya/par-ensure-enrollment branch from ea55c73 to 690bb57 Compare August 14, 2026 14:19

embeaken force-pushed the ilya/par-control-lifecycle branch from 50ccce5 to f7b495c Compare August 14, 2026 16:37

embeaken force-pushed the ilya/par-ensure-enrollment branch from 690bb57 to c2aaa60 Compare August 14, 2026 16:40

embeaken force-pushed the ilya/par-control-lifecycle branch from f7b495c to 787ec32 Compare August 14, 2026 16:48

embeaken force-pushed the ilya/par-ensure-enrollment branch 2 times, most recently from 01b23ab to f821eba Compare August 14, 2026 17:53

embeaken marked this pull request as ready for review August 14, 2026 17:55

embeaken requested a review from a team as a code owner August 14, 2026 17:55

embeaken force-pushed the ilya/par-ensure-enrollment branch from 6e4b0d0 to 29fbee2 Compare August 17, 2026 16:01

embeaken force-pushed the ilya/par-control-lifecycle branch 2 times, most recently from c785c41 to fb58e03 Compare August 17, 2026 17:13

embeaken force-pushed the ilya/par-ensure-enrollment branch from 29fbee2 to 5d08287 Compare August 17, 2026 17:13

embeaken force-pushed the ilya/par-control-lifecycle branch from fb58e03 to 4fdaf12 Compare August 17, 2026 20:01

embeaken force-pushed the ilya/par-ensure-enrollment branch from 5d08287 to efcffd4 Compare August 17, 2026 20:03

hush-hush requested changes Aug 18, 2026

View reviewed changes

Comment thread cmd/privateactionrunner/subcommands/ensureenrollment/command.go Outdated

dd-gplassard approved these changes Aug 18, 2026

View reviewed changes

Base automatically changed from ilya/par-control-lifecycle to main August 18, 2026 14:33

embeaken force-pushed the ilya/par-ensure-enrollment branch from 672b028 to d6f8b60 Compare August 18, 2026 14:43

embeaken requested a review from hush-hush August 18, 2026 14:43

hush-hush approved these changes Aug 18, 2026

View reviewed changes

embeaken force-pushed the ilya/par-ensure-enrollment branch from d6f8b60 to 3c1138d Compare August 18, 2026 18:21

dd-octo-sts Bot added the team/agent-devx label Aug 18, 2026

embeaken force-pushed the ilya/par-ensure-enrollment branch 3 times, most recently from 4673145 to 725764e Compare August 19, 2026 19:11

embeaken marked this pull request as draft August 19, 2026 20:06

embeaken force-pushed the ilya/par-ensure-enrollment branch 3 times, most recently from eff670d to e53fe05 Compare August 21, 2026 22:06

embeaken changed the base branch from main to ilya/par-monolith-e2e August 21, 2026 22:07

embeaken force-pushed the ilya/par-ensure-enrollment branch 2 times, most recently from 0075a35 to f1e6a0d Compare August 21, 2026 23:56

embeaken force-pushed the ilya/par-monolith-e2e branch from b43a153 to 48eda5c Compare August 23, 2026 01:00

embeaken force-pushed the ilya/par-ensure-enrollment branch from f1e6a0d to 8bdfbbc Compare August 23, 2026 01:04

embeaken force-pushed the ilya/par-monolith-e2e branch from 48eda5c to 9a8d25c Compare August 24, 2026 13:59

This was referenced Aug 24, 2026

[ACTP] package and activate par-control #54529

Draft

[ACTP] add par-control executor channel #54591

Open

Navigation Menu

Uh oh!

[ACTP] add bootstrap-par-control command - #54870

[ACTP] add bootstrap-par-control command#54870
embeaken wants to merge 1 commit into
ilya/par-control-opmsfrom
ilya/par-ensure-enrollment

embeaken commented Aug 13, 2026 •

edited

Loading

Uh oh!

dd-octo-sts Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

dd-octo-sts Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

dd-octo-sts Bot commented Aug 13, 2026 •

edited

Loading

Info

Uh oh!

cit-pr-commenter-54b7da Bot commented Aug 14, 2026 •

edited

Loading

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

embeaken commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Validation

Uh oh!

dd-octo-sts Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Go Package Import Differences

Uh oh!

This comment has been minimized.

dd-octo-sts Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Files inventory check summary

Results for datadog-agent_7.84.0~devel.git.565.9b723a6.pipeline.133819696-1_amd64.deb:

Results for datadog-iot-agent_7.84.0~devel.git.565.9b723a6.pipeline.133819696-1_amd64.deb:

Uh oh!

dd-octo-sts Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Static quality checks

Info

Uh oh!

cit-pr-commenter-54b7da Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Regression Detector

Regression Detector Results

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

CI Pass/Fail Decision

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

embeaken commented Aug 13, 2026 •

edited

Loading

dd-octo-sts Bot commented Aug 13, 2026 •

edited

Loading

dd-octo-sts Bot commented Aug 13, 2026 •

edited

Loading

dd-octo-sts Bot commented Aug 13, 2026 •

edited

Loading

cit-pr-commenter-54b7da Bot commented Aug 14, 2026 •

edited

Loading