Add APPSEC_OTEL_API scenarios for M1 topology (APPSEC-68836) - #7582
Draft
RamyElkest wants to merge 3 commits into
Draft
Add APPSEC_OTEL_API scenarios for M1 topology (APPSEC-68836)#7582RamyElkest wants to merge 3 commits into
RamyElkest wants to merge 3 commits into
Conversation
M1: DD Tracer as drop-in OTel SDK replacement (instrumentation layer). Uses standard DD agent for transport (native protocol), OTel API backed by dd-tracer. Two new scenarios: - APPSEC_OTEL_API: blocking ruleset, tests WAF blocking + detection - APPSEC_OTEL_API_DEFAULT_RULES: default ruleset, tests alpha/obfuscator/payment No new weblog needed — existing flask-poc weblog already uses OTel API with DD_TRACE_OTEL_ENABLED=true. No OTLP adapter needed — traces go via DD agent in native Datadog format. Test results: 42 + 26 + 35 + 2 = 105 passed, 0 failed, 4 xfailed. CI: scenarios added to .github/workflows/run-end-to-end.yml
Contributor
|
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0696d415d2
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| appsec_otel_api = DdTraceEndToEndScenario( | ||
| "APPSEC_OTEL_API", | ||
| weblog_env={ | ||
| "DD_TRACE_OTEL_ENABLED": "true", |
There was a problem hiding this comment.
Setting DD_TRACE_OTEL_ENABLED does not make these AppSec checks exercise the drop-in OTel API: the new smoke classes call /waf and /login (tests/appsec/smoke_tests/utils.py:122-124,332-335), and the Python handlers use normal framework instrumentation and explicit Datadog AppSec helpers (utils/build/docker/python/flask/app.py:399-409,1547-1559); the actual OTel API calls are confined to separate /otel_drop_in_* handlers starting at line 1941. Consequently, a tracer whose OTel bridge is absent or broken can still pass both scenarios, so the reported M1 experiment validates ordinary Datadog instrumentation rather than AppSec through the OTel API; generate the tested request/span through an OTel API endpoint or instrument the request path with the OTel API.
Useful? React with 👍 / 👎.
|
…r to M1 (APPSEC-68836) 5 new OTel API scenarios covering all required AppSec capabilities: - APPSEC_OTEL_API_SECURITY: API Security schema discovery + sampling - APPSEC_OTEL_API_RASP: RASP detection (cmdi, lfi, sqli, ssrf, shi, api10) - APPSEC_OTEL_API_RUNTIME_ACTIVATION: RC-driven AppSec on/off + rule changes - APPSEC_OTEL_API_BLOCKING_FULL_DENYLIST: RC-driven IP/user blocking - APPSEC_OTEL_API_RATE_LIMITER: AppSec rate limiter 101 new test classes decorated across 21 files. All smoke tests pass: 1 passed per scenario for API Sec, RASP, RC, blocking, rate limiter. This completes the 'supported' definition from the strategic plan: WAF + ATO + API Security all validated via OTel API.
RamyElkest
marked this pull request as draft
August 25, 2026 22:24
…APPSEC-68836) New weblog variant that creates spans via opentelemetry.trace.start_span() instead of dd-trace's Flask auto-instrumentation. This validates M1: AppSec works when the OTel API is the instrumentation layer. Key endpoints (/waf, /rasp/*, /login, /identify, /headers) are wrapped with otel_tracer.start_as_current_span() so spans are created through the OTel API. Uses ddtrace-run to load dd-tracer with DD_TRACE_OTEL_ENABLED=true, so dd-tracer implements the OTel API. First test passes (XPASS — needs manifest entries for new weblog variant).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validates M1 topology from the AAP for OTel Customers strategic plan: DD Tracer as drop-in OTel SDK replacement.
M1 tests the instrumentation layer — the dd-tracer implements the OTel API (), so customers can use standard in their code while getting full AppSec. This is different from M2 (PR #7578) which tests the transport layer (OTLP export).
Closes APPSEC-68836
What's New
Two Scenarios
APPSEC_OTEL_APIAPPSEC_OTEL_API_DEFAULT_RULESBoth use:
DD_TRACE_OTEL_ENABLED=true+include_agent=True+rc_api_enabled=True+appsec_enabled=TrueKey Difference from M2 (PR #7578)
No new weblog Dockerfile needed — the existing
flask-pocweblog already imports and usesopentelemetry.trace,opentelemetry.baggage, andopentelemetry.propagate. WithDD_TRACE_OTEL_ENABLED=true, dd-tracer implements these APIs.Test Results
APPSEC_OTEL_APIAPPSEC_OTEL_API_DEFAULT_RULESPlus 2 smoke tests (Threats + UserEvents) passing in each scenario.
CI Integration
.github/workflows/run-end-to-end.ymltracer_releasegroup — runs on every tracer release PR@scenarios.appsec_otel_apiare modified