Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(asm): standalone asm #9211

Merged
merged 63 commits into from
Jun 4, 2024
Merged

Conversation

gnufede
Copy link
Member

@gnufede gnufede commented May 9, 2024

Description

This PR allows ASM customers to disable APM, and use only ASM features. To have the full picture, see also #9444 and #9445.

Details

It involves changes when opting out from APM with DD_EXPERIMENTAL_APPSEC_STANDALONE_ENABLED=true and DD_APPSEC_ENABLED=true:

  • Doesn't disable Span Processors.
  • Rate limiting of APM traces is reduced to minimal levels (1 trace per minute).
  • Datadog-Client-Computed-Stats header is sent to the agent so it doesn't compute stats on its end, but they aren't computed on the library side either.
  • Disables metric reporting.

Checklist

  • Change(s) are motivated and described in the PR description
  • Testing strategy is described if automated tests are not included in the PR
  • Risks are described (performance impact, potential for breakage, maintainability)
  • Change is maintainable (easy to change, telemetry, documentation)
  • Library release note guidelines are followed or label changelog/no-changelog is set
  • Documentation is included (in-code, generated user docs, public corp docs)
  • Backport labels are set (if applicable)
  • If this PR changes the public interface, I've notified @DataDog/apm-tees.

Reviewer Checklist

  • Title is accurate
  • All changes are related to the pull request's stated goal
  • Description motivates each change
  • Avoids breaking API changes
  • Testing strategy adequately addresses listed risks
  • Change is maintainable (easy to change, telemetry, documentation)
  • Release note makes sense to a user of the library
  • Author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
  • Backport labels are set in a manner that is consistent with the release branch maintenance policy

@datadog-dd-trace-py-rkomorn
Copy link

datadog-dd-trace-py-rkomorn bot commented May 9, 2024

Datadog Report

Branch report: gnufede/APPSEC-53002-standalone-asm-billing
Commit report: 4880e0b
Test service: dd-trace-py

✅ 0 Failed, 134478 Passed, 39173 Skipped, 5h 55m 58.19s Total duration (2h 49m 3.77s time saved)

@pr-commenter
Copy link

pr-commenter bot commented May 9, 2024

Benchmarks

Benchmark execution time: 2024-05-29 12:15:10

Comparing candidate commit f88da3d in PR branch gnufede/APPSEC-53002-standalone-asm-billing with baseline commit 05fb6fb in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 209 metrics, 9 unstable metrics.

@gnufede gnufede changed the title feat(asm): standalone asm billing feat(asm): standalone asm May 9, 2024
@codecov-commenter
Copy link

codecov-commenter commented May 9, 2024

Codecov Report

Attention: Patch coverage is 11.59420% with 61 lines in your changes missing coverage. Please review.

Project coverage is 10.34%. Comparing base (b93575e) to head (4880e0b).

Files Patch % Lines
tests/tracer/test_writer.py 0.00% 15 Missing ⚠️
tests/integration/test_trace_stats.py 0.00% 13 Missing ⚠️
tests/tracer/test_tracer.py 0.00% 13 Missing ⚠️
ddtrace/_trace/tracer.py 27.27% 8 Missing ⚠️
...ests/appsec/integrations/test_gunicorn_handlers.py 0.00% 8 Missing ⚠️
tests/appsec/appsec_utils.py 0.00% 3 Missing ⚠️
ddtrace/internal/writer/writer.py 75.00% 1 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##             main    #9211       +/-   ##
===========================================
- Coverage   75.96%   10.34%   -65.62%     
===========================================
  Files        1303     1273       -30     
  Lines      123882   122094     -1788     
===========================================
- Hits        94101    12631    -81470     
- Misses      29781   109463    +79682     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@gnufede gnufede removed the manual merge Do not automatically merge label Jun 3, 2024
@gnufede gnufede force-pushed the gnufede/APPSEC-53002-standalone-asm-billing branch from 6ee4e75 to efe2fb2 Compare June 3, 2024 11:34
@gnufede gnufede marked this pull request as ready for review June 3, 2024 11:59
@gnufede gnufede enabled auto-merge (squash) June 3, 2024 13:22
tests/integration/test_trace_stats.py Show resolved Hide resolved
ddtrace/propagation/http.py Outdated Show resolved Hide resolved
ddtrace/pin.py Show resolved Hide resolved
ddtrace/_trace/tracer.py Outdated Show resolved Hide resolved
@gnufede gnufede merged commit 0cef208 into main Jun 4, 2024
189 of 193 checks passed
@gnufede gnufede deleted the gnufede/APPSEC-53002-standalone-asm-billing branch June 4, 2024 06:47
gnufede added a commit that referenced this pull request Jun 10, 2024
## Description:
ASM: adds Standalone ASM distributed propagation changes as described in
"RFC: Standalone ASM billing V2".

For the full picture of this feature, see:
#9211 ,
#9444 and
#9445

See also System Tests related changes:
DataDog/system-tests#2522

## Details:
The main change is that if ASM Standalone is enabled, propagation of
distributed spans would reset (from upstream) unless they are part of a
distributed span where there are AppSec events (signaled through the
propagation tag _dd.p.appsec: 1).

It will also cut propagation downstream if there are no appsec events in
the current or upstream spans.

Notice that AppSec events trigger a force keep, and that takes
precedence over the received propagation in this PR.

Also notice that most tests start by creating a first span without an
appsec event. This is due to the fact that ASM Standalone needs to
maintain a minimum rate of 1 trace per minute regardless of upstream
propagation or appsec events present, so that way we are not affected by
that rate in the test.

## Checklist

- [x] Change(s) are motivated and described in the PR description
- [x] Testing strategy is described if automated tests are not included
in the PR
- [x] Risks are described (performance impact, potential for breakage,
maintainability)
- [x] Change is maintainable (easy to change, telemetry, documentation)
- [x] [Library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
are followed or label `changelog/no-changelog` is set
- [x] Documentation is included (in-code, generated user docs, [public
corp docs](https://github.com/DataDog/documentation/))
- [x] Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))
- [x] If this PR changes the public interface, I've notified
`@DataDog/apm-tees`.

## Reviewer Checklist

- [x] Title is accurate
- [x] All changes are related to the pull request's stated goal
- [x] Description motivates each change
- [x] Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- [x] Testing strategy adequately addresses listed risks
- [x] Change is maintainable (easy to change, telemetry, documentation)
- [x] Release note makes sense to a user of the library
- [x] Author has acknowledged and discussed the performance implications
of this PR as reported in the benchmarks PR comment
- [x] Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ASM Application Security Monitoring
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants