Skip to content

Commit 9077e9b

Browse files
drichards-87drichards-87
committed
Merge branch 'master' into deforest/cspm-cloud-schemas-single-sourcing
2 parents 821cf17 + 6cee4da commit 9077e9b

File tree

104 files changed

+5148
-904
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

104 files changed

+5148
-904
lines changed

‎.apigentools-info

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
"spec_versions": {
55
"v1": {
66
"apigentools_version": "1.6.4",
7-
"regenerated": "2023-01-06 10:16:54.807506",
8-
"spec_repo_commit": "03622159"
7+
"regenerated": "2023-01-11 12:49:52.610347",
8+
"spec_repo_commit": "c986b09e"
99
},
1010
"v2": {
1111
"apigentools_version": "1.6.4",
12-
"regenerated": "2023-01-06 10:17:01.431045",
13-
"spec_repo_commit": "03622159"
12+
"regenerated": "2023-01-11 12:50:00.910072",
13+
"spec_repo_commit": "c986b09e"
1414
}
1515
}
1616
}

‎assets/scripts/components/dd-browser-logs-rum.js

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
import configDocs from '../config/config-docs';
33
const { env, branch } = document.documentElement.dataset;
44
const lang = document.documentElement.lang || 'en';
5+
56
function getConfig() {
67
if (env === 'live') {
78
return configDocs['live'];
@@ -11,7 +12,9 @@ function getConfig() {
1112
return configDocs['development'];
1213
}
1314
}
15+
1416
const Config = getConfig();
17+
1518
if (window.DD_RUM) {
1619
if (env === 'preview' || env === 'live') {
1720
window.DD_RUM.init({
@@ -22,33 +25,41 @@ if (window.DD_RUM) {
2225
version: CI_COMMIT_SHORT_SHA,
2326
trackInteractions: true,
2427
trackFrustrations: true,
25-
enableExperimentalFeatures: ["frustration-signals","clickmap"],
28+
enableExperimentalFeatures: ["clickmap"],
2629
sampleRate: 50,
27-
premiumSampleRate: 50,
28-
allowedTracingOrigins: [window.location.origin]
30+
sessionReplaySampleRate: 50,
31+
allowedTracingOrigins: [window.location.origin],
32+
internalAnalyticsSubdomain: 'iam-rum-intake'
2933
});
34+
3035
window.DD_RUM.startSessionReplayRecording();
36+
3137
if (branch) {
3238
window.DD_RUM.addRumGlobalContext('branch', branch);
3339
}
3440
}
3541
}
42+
3643
if (window.DD_LOGS) {
3744
// init browser logs
3845
window.DD_LOGS.init({
3946
clientToken: Config.ddClientToken,
4047
forwardErrorsToLogs: true,
4148
env,
4249
service: 'docs',
43-
version: CI_COMMIT_SHORT_SHA
50+
version: CI_COMMIT_SHORT_SHA,
51+
internalAnalyticsSubdomain: 'iam-rum-intake'
4452
});
53+
4554
// global context
4655
window.DD_LOGS.addLoggerGlobalContext('host', window.location.host);
4756
window.DD_LOGS.addLoggerGlobalContext('referrer', document.referrer);
4857
window.DD_LOGS.addLoggerGlobalContext('lang', lang);
58+
4959
if (branch) {
5060
window.DD_LOGS.addLoggerGlobalContext('branch', branch);
5161
}
62+
5263
// Locally log to console
5364
window.DD_LOGS.logger.setHandler(Config.loggingHandler);
5465
}

‎assets/scripts/config/config-docs.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ module.exports = {
1313
gaTag: 'UA-21102638-5'
1414
},
1515
preview: {
16-
ddClientToken: 'pub36877d3864fab670b5ae7e1d5d26cb08',
17-
ddApplicationId: 'c4e83ad8-4eda-4d2e-aae1-d943abce0463',
16+
ddClientToken: 'pub16bb5ef3e9bf55f156338987e27246c7',
17+
ddApplicationId: '3493b4e7-ab12-4852-8836-ba96af7bc745',
1818
loggingHandler: 'http',
1919
algoliaConfig: {
2020
index: 'docsearch_docs_preview',

‎config/_default/menus/menus.en.yaml

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1944,7 +1944,7 @@ main:
19441944
parent: apm_heading
19451945
weight: 145000
19461946
- name: Enabling the Profiler
1947-
url: profiler/enabling/java/
1947+
url: profiler/enabling/
19481948
parent: profiler
19491949
identifier: profiler_enabling
19501950
weight: 1
@@ -1988,26 +1988,31 @@ main:
19881988
parent: profiler_enabling
19891989
identifier: profiler_enabling_linux
19901990
weight: 108
1991+
- name: Profile Types
1992+
url: profiler/profile_types/
1993+
parent: profiler
1994+
identifier: profiler_types
1995+
weight: 2
19911996
- name: Search Profiles
19921997
url: profiler/search_profiles/
19931998
parent: profiler
19941999
identifier: profiler_search_profiles
1995-
weight: 2
2000+
weight: 3
19962001
- name: Investigate Slow Traces or Endpoints
19972002
url: profiler/connect_traces_and_profiles/
19982003
parent: profiler
19992004
identifier: profiler_traces_profiles
2000-
weight: 3
2005+
weight: 4
20012006
- name: Compare Profiles
20022007
url: profiler/compare_profiles
20032008
parent: profiler
20042009
identifier: profiler_compare
2005-
weight: 4
2010+
weight: 5
20062011
- name: Profiler Troubleshooting
20072012
url: profiler/profiler_troubleshooting/
20082013
parent: profiler
20092014
identifier: profiler_profiler_troubleshooting
2010-
weight: 5
2015+
weight: 6
20112016
- name: CI Visibility
20122017
url: continuous_integration/
20132018
pre: ci
@@ -3244,21 +3249,26 @@ main:
32443249
parent: rum_explorer
32453250
identifier: rum_explorer_watchdog_insights
32463251
weight: 908
3252+
- name: Funnel Analysis
3253+
url: real_user_monitoring/funnel_analysis
3254+
parent: rum
3255+
identifier: rum_funnel_analysis
3256+
weight: 10
32473257
- name: Generate Metrics
32483258
url: real_user_monitoring/generate_metrics
32493259
parent: rum
32503260
identifier: rum_generate_metrics
3251-
weight: 10
3261+
weight: 11
32523262
- name: Connect RUM and Traces
32533263
url: real_user_monitoring/connect_rum_and_traces
32543264
parent: rum
32553265
identifier: rum_connect_rum_and_traces
3256-
weight: 11
3266+
weight: 12
32573267
- name: Error Tracking
32583268
url: real_user_monitoring/error_tracking/
32593269
parent: rum
32603270
identifier: rum_error_tracking
3261-
weight: 12
3271+
weight: 13
32623272
- name: Explorer
32633273
url: real_user_monitoring/error_tracking/explorer/
32643274
parent: rum_error_tracking
@@ -3298,7 +3308,7 @@ main:
32983308
url: real_user_monitoring/guide/
32993309
parent: rum
33003310
identifier: rum_guides
3301-
weight: 13
3311+
weight: 14
33023312
- name: Network Monitoring
33033313
url: network_monitoring/
33043314
pre: network

‎config/live/config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ deployment:
1717
targets:
1818
- name: "live"
1919
URL: "s3://datadog-docs-live-hugo?region=us-east-1"
20-
exclude: "**.{go,java,sh,py,rb}"
20+
exclude: "**.{go,java,py,rb}"
2121
# cloudFrontDistributionID: E2B2OODXRYOXSA
2222
- name: "liveAssets"
2323
URL: "s3://origin-static-assets?region=us-east-1&prefix=documentation/"

‎config/preview/config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ deployment:
1717
targets:
1818
- name: "preview"
1919
URL: "s3://datadog-docs-preview?region=us-east-1&prefix=$CI_COMMIT_REF_NAME/"
20-
exclude: "**.{go,java,sh,py,rb}"
20+
exclude: "**.{go,java,py,rb}"
2121
cloudFrontDistributionID: E3EYIYXXL26MK1
2222
- name: "previewAssets"
2323
URL: "s3://dd-staging-static-assets?region=us-east-1&prefix=documentation/"

‎content/en/account_management/billing/_index.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,8 +105,8 @@ Through **Edit Details**, you can add, edit or remove your billing address. You
105105
[1]: https://app.datadoghq.com/account/usage/hourly
106106
[2]: /infrastructure/
107107
[3]: /agent/
108-
[4]: https://docs.datadoghq.com/account_management/billing/pricing/#apm
109-
[5]: https://docs.datadoghq.com/account_management/billing/serverless
108+
[4]: /account_management/billing/pricing/#apm
109+
[5]: /account_management/billing/serverless
110110
[6]: https://www.datadoghq.com/pricing/?product=serverless#serverless
111111
[7]: https://www.datadoghq.com/pricing/
112112
[8]: /account_management/rbac/#datadog-default-roles

‎content/en/account_management/billing/serverless.md

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,30 @@ To control the functions whose invocations Datadog is monitoring, filter out par
2525

2626
### UI
2727

28-
To use the UI to control which AWS Lambda functions Datadog is monitoring, navigate to the [AWS Integration page][5] and add tags as `key:value` sets to the **to Lambdas with tag:** field.
28+
To use the UI to control which AWS Lambda functions Datadog is monitoring, navigate to the [AWS Integration page][5]. From the left sidebar, select the relevant AWS account, and navigate to the **Metric Collection tab**. Scroll down to the **Limit Metric Collection to Specific Resources** heading, and select Lambda from the **Select AWS Service** dropdown. You can then add tags as `key:value` sets to the field to the right.
2929

30-
To exclude functions with a given tag, add a `!` before the tag key. For example:
30+
See the [tags](#Tags) section below for more information about how to use tags in this field.
3131

32-
`!env:staging,!env:test1`
32+
### API
3333

34-
This filter excludes anything that is tagged with `env:staging` or `env:test1`.
34+
To use the API to control which AWS Lambda functions Datadog is monitoring, reference the [API tag filter documentation][6].
3535

36-
### API
36+
### Tags
37+
38+
Datadog accepts a comma-separated list of tags in the form `key:value`. This list defines a filter that is used when collecting metrics from the associated AWS service. These `key:value` pairs can both allow and exclude tags. To indicate an exclusion, add a `!` before the tag key. Wildcards, such as `?` (for single characters) and `*` (for multiple characters), can also be used.
39+
40+
The filter only excludes resources where all allowed tags are missing—that is, where the list of allowed tags forms an "OR" statement.
41+
42+
For example: `datadog:monitored,env:production`
43+
44+
This filter only collects EC2 instances that contain the tag `datadog:monitored` OR the tag `env:production`.
45+
46+
If you add an exclusion tag to the list, it takes precedence—that is, adding an exclusion tag adds an "AND" statement.
47+
48+
For example: `datadog:monitored,env:production,instance-type:c1.*,!region:us-east-1`
3749

38-
To use the API to control limit which AWS Lambda functions Datadog is monitoring, reference the [tag filter documentation][6].
50+
This filter only collects EC2 instances that contain the tag
51+
`datadog:monitored` OR the tag `env:production` OR an instance-type tag with a `c1.*` value AND NOT a `region:us-east-1` tag.
3952

4053
## Troubleshooting
4154

‎content/en/account_management/multi_organization.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Here's a two-minute video walkthrough:
3333

3434
### Create
3535

36-
1. After the feature is enabled, see the [New Account Page][3].
36+
1. After the feature is enabled, see the [New Organization Page][3].
3737
2. Enter the name of the child-organization you wish to create and click the **Create** button. **The child-organization name cannot exceed 32 characters.**
3838

3939
The new child-organization inherits the parent-organization's plan and is added to the parent-organization's billing account. If you want to update the child-organization's billing, [contact your sales representative][4].

‎content/en/agent/faq/circleci-incident-impact-on-datadog-agent.md

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
---
2+
title: Impact of the CircleCI Security Incident on the Datadog Agent
3+
kind: faq
4+
---
5+
6+
On January 4th, 2023, Datadog was notified by CircleCI that they were investigating a [security incident][1] that may have led to leaking stored secrets. Datadog identified a single secret stored in CircleCI that could theoretically be misused by a potential attacker, an old RPM GNU Privacy Guard (GPG) private signing key and its passphrase. This page documents the implications of the potential leak and the measures Datadog is taking to mitigate any risks to our customers.
7+
8+
<div class="alert alert-info">
9+
<strong>Note</strong>: As of January 10th, 2023, Datadog has no indication that the key was actually leaked or misused, but we are still taking the following actions out of an abundance of caution.
10+
</div>
11+
12+
## The affected key
13+
14+
The RPM GPG signing key has fingerprint `60A389A44A0C32BAE3C03F0B069B56F54172A230`, and is accessible in [our signing keys location][2]. This key was historically used to sign Agent 5 releases and Agent 6 releases up to (and including) 6.13.0.
15+
16+
<div class="alert alert-info">
17+
<strong>Note</strong>: Official Datadog repositories were <strong>not</strong> compromised. The signing key, if actually leaked, could be used to construct an RPM package that looks like it's from Datadog.
18+
</div>
19+
20+
## Am I affected?
21+
22+
You don't need to take any action if:
23+
24+
* You're installing Agent with Datadog packages on macOS, Windows, Debian/Ubuntu
25+
* You're using the Container Agent
26+
* You're on an RPM-based Linux distribution (RHEL, CentOS, Rocky Linux, AlmaLinux, Amazon Linux, SUSE/SLES, Fedora), but your system doesn't trust the affected GPG key (see below on how to check)
27+
28+
Datadog recommends you take action if:
29+
* You're on an RPM-based Linux distribution (RHEL, CentOS, Rocky Linux, AlmaLinux, Amazon Linux, SUSE/SLES, Fedora), and your system trusts the affected GPG key
30+
31+
## Does my system trust the affected key?
32+
33+
Two places need to be checked to verify if your system trusts the affected key: the RPM database and the Datadog repofile. If either one of these is identified as trusting the key, we recommend taking the actions listed in the following sections. If neither of these is identified as trusting the key, no further action is needed.
34+
35+
### Verifying if the key is imported in the RPM database
36+
37+
Run the following command:
38+
39+
```bash
40+
$ rpm -q gpg-pubkey-4172a230-55dd14f6
41+
```
42+
43+
If the command exits with 0 and prints `gpg-pubkey-4172a230-55dd14f6`, your system trusts the affected key, otherwise, it doesn't (it will exit with a non-0 exit code and print a message like `package gpg-pubkey-4172a230-55dd14f6 is not installed`).
44+
45+
### Verifying if the key is used in the Datadog repofile
46+
47+
In default installations, the Datadog repofile can be found at:
48+
49+
* `/etc/yum.repos.d/datadog.repo` on RHEL, CentOS, Rocky Linux, AlmaLinux, Amazon Linux and Fedora
50+
* `/etc/zypp/repos.d/datadog.repo` on OpenSUSE and SLES
51+
52+
If the repofile contains a reference to one of these lines under the `gpgkey` entry, your system trusts the affected key:
53+
54+
* `https://s3.amazonaws.com/public-signing-keys/DATADOG_RPM_KEY.public`
55+
* `https://keys.datadoghq.com/DATADOG_RPM_KEY.public`
56+
* `https://s3.amazonaws.com/yum.datadoghq.com/DATADOG_RPM_KEY.public`
57+
* `https://yum.datadoghq.com/DATADOG_RPM_KEY.public`
58+
59+
(The easy way to check is to see if there's an entry that ends with `DATADOG_RPM_KEY.public`).
60+
61+
## Taking action
62+
63+
Datadog recommends that all customers ensure that their systems stop trusting the affected key. If you find out that your system trusts the key based on at least one of the above criteria, here's how you can make your system stop trusting it:
64+
65+
To delete the key from the RPM database, run the following command:
66+
67+
```bash
68+
$ sudo rpm --erase gpg-pubkey-4172a230-55dd14f6
69+
```
70+
71+
To delete the key from the Datadog repofile, remove the `gpgkey` line that ends with `DATADOG_RPM_KEY.public`. If this was the only `gpgkey` entry in your repofile, replace it with `https://keys.datadoghq.com/DATADOG_RPM_KEY_CURRENT.public`. Note that this has implications explained in the section [Implications of no Longer Trusting the Affected Key](#implications-of-no-longer-trusting-the-affected-key).
72+
73+
### Usage of automation tools
74+
75+
Usage of automation tools like the Datadog Ansible role (see the full list in [What Datadog is doing to mitigate the implications](#what-datadog-is-doing-to-mitigate-the-implications)) might reverse the manual changes recommended above. Until we release new versions that fix this, we recommend adding these manual changes to your automation tool runbooks.
76+
77+
### Verifying installed Agent packages
78+
79+
If the GPG key was leaked, it is possible for an attacker to build a package that RPM will verify as coming from Datadog and install it on the system. Out of an abundance of caution, Datadog also recommends that you verify that all packages on your system signed by the affected key were built by Datadog. You can run [this script][3] to verify that:
80+
81+
```bash
82+
$ curl -o /tmp/rpm_check.sh https://docs.datadoghq.com/resources/sh/rpm_check.sh && chmod +x /tmp/rpm_check.sh
83+
$ /tmp/rpm_check.sh
84+
```
85+
86+
The script will:
87+
88+
* Verify that any installed Datadog packages signed by the affected key were indeed built by Datadog by verifying the full GPG signature of RPM headers and payload.
89+
* Search for any packages signed by the affected key that weren't built by Datadog.
90+
91+
Lines starting with `[ ERROR ]` should be reported to [Datadog Support][4] along with the full script output.
92+
93+
## Implications of no longer trusting the affected key
94+
95+
* If your system uses Agent 7, there is no implication. Agent 7 packages were never signed with the affected key.
96+
* Your system will no longer be able to install Agent 6 < 6.14.0. We recommend upgrading to Agent 6 >= 6.14.0 or Agent 7.
97+
* If your system uses Agent 5, you will no longer be able to install any currently released Agent 5 version.
98+
99+
## What Datadog is doing to mitigate the implications
100+
101+
* We're working towards releasing a new Agent 5 version for CentOS/RHEL signed with the [current RPM signing key](https://keys.datadoghq.com/DATADOG_RPM_KEY_CURRENT.public), `C6559B690CA882F023BDF3F63F4D1729FD4BF915`.
102+
* We're working on new releases to Agent installation methods to ensure they make systems safe by explicitly removing the affected key from the RPM database and the Datadog repofile. We will be updating this section as we release the new versions:
103+
* Datadog Ansible role: [https://github.com/DataDog/ansible-datadog/][5]
104+
* Datadog Chef recipe: [https://github.com/DataDog/chef-datadog][6]
105+
* Datadog Puppet module: [https://github.com/DataDog/puppet-datadog-agent][7]
106+
* Datadog Saltstack formula: [https://github.com/DataDog/datadog-formula][8]
107+
* The set of Datadog Agent 6/7 Linux install scripts:
108+
* [https://s3.amazonaws.com/dd-agent/scripts/install_script_agent6.sh][9]
109+
* [https://s3.amazonaws.com/dd-agent/scripts/install_script_agent7.sh][10]
110+
* [https://s3.amazonaws.com/dd-agent/scripts/install_script.sh][11] (this one is deprecated and no longer recommended to use, but we will update it as well)
111+
* The Datadog Agent 5 Linux install script: [https://raw.githubusercontent.com/DataDog/dd-agent/master/packaging/datadog-agent/source/install_agent.sh][12]
112+
113+
[1]: https://circleci.com/blog/january-4-2023-security-alert/
114+
[2]: https://keys.datadoghq.com/DATADOG_RPM_KEY.public
115+
[3]: /resources/sh/rpm_check.sh
116+
[4]: /help/
117+
[5]: https://github.com/DataDog/ansible-datadog/
118+
[6]: https://github.com/DataDog/chef-datadog
119+
[7]: https://github.com/DataDog/puppet-datadog-agent
120+
[8]: https://github.com/DataDog/datadog-formula
121+
[9]: https://s3.amazonaws.com/dd-agent/scripts/install_script_agent6.sh
122+
[10]: https://s3.amazonaws.com/dd-agent/scripts/install_script_agent7.sh
123+
[11]: https://s3.amazonaws.com/dd-agent/scripts/install_script.sh
124+
[12]: https://raw.githubusercontent.com/DataDog/dd-agent/master/packaging/datadog-agent/source/install_agent.sh

0 commit comments

Comments
 (0)