[NPM-4291] Add config to exclude subnets from dynamic path #35035

pimlu · 2025-03-11T21:49:41Z

What does this PR do?

This PR moves network_filter into a separate package to be used by both CNM (existing usage) and in network path's dynamic paths collector.

These are set via:

network_path.collector.source_excludes
network_path.collector.dest_excludes

For example:

network_path:
    collector:
        dest_excludes:
            "10.0.0.0/8":
                - "*"

Motivation

We want to allow customers to config CIDR ranges to drop traffic for.

Describe how you validated your changes

New tests added to npcollector:

go test -timeout 30s -tags linux,linux_bpf,npm,process,test github.com/DataDog/datadog-agent/comp/networkpath/npcollector/npcollectorimpl

Possible Drawbacks / Trade-offs

Additional Notes

cit-pr-commenter · 2025-03-11T21:52:51Z

Go Package Import Differences

Baseline: 18bdd73
Comparison: bfdca43

binary	os	arch	change
agent	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
agent	linux	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
agent	windows	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
agent	darwin	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
agent	darwin	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
iot-agent	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
iot-agent	linux	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
heroku-agent	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
process-agent	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
process-agent	linux	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
process-agent	windows	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
process-agent	darwin	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
process-agent	darwin	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
heroku-process-agent	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
system-probe	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
system-probe	linux	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter
system-probe	windows	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/network/tracer/networkfilter

pkg/network/tracer/connection/ebpfless/tcp_processor_retransmit_test.go

comp/networkpath/npcollector/npcollectorimpl/npcollector.go

buraizu

Approving with a minor punctuation suggestion

releasenotes/notes/netpath-cidr-excludes-006cfccd06c6fde6.yaml

comp/networkpath/npcollector/npcollectorimpl/npcollector.go

agent-platform-auto-pr · 2025-03-13T18:11:28Z

Test changes on VM

Use this command from test-infra-definitions to manually test this PR changes on a VM:

dda inv aws.create-vm --pipeline-id=58784379 --os-family=ubuntu

Note: This applies to commit bfdca43

agent-platform-auto-pr · 2025-03-13T18:13:46Z

Uncompressed package size comparison

Comparison with ancestor 18bdd73bac208887c150e30f1cafe0f6f8710dab

Diff per package

package	diff	status	size	ancestor	threshold
datadog-agent-amd64-deb	0.02MB	⚠️	808.79MB	808.76MB	0.50MB
datadog-agent-x86_64-rpm	0.02MB	⚠️	818.58MB	818.56MB	0.50MB
datadog-agent-x86_64-suse	0.02MB	⚠️	818.58MB	818.56MB	0.50MB
datadog-agent-arm64-deb	0.02MB	⚠️	799.78MB	799.76MB	0.50MB
datadog-agent-aarch64-rpm	0.02MB	⚠️	809.56MB	809.54MB	0.50MB
datadog-heroku-agent-amd64-deb	0.02MB	⚠️	441.27MB	441.25MB	0.50MB
datadog-iot-agent-amd64-deb	0.01MB	⚠️	62.19MB	62.18MB	0.50MB
datadog-iot-agent-x86_64-rpm	0.01MB	⚠️	62.26MB	62.25MB	0.50MB
datadog-iot-agent-x86_64-suse	0.01MB	⚠️	62.26MB	62.25MB	0.50MB
datadog-iot-agent-arm64-deb	0.01MB	⚠️	59.42MB	59.41MB	0.50MB
datadog-iot-agent-aarch64-rpm	0.01MB	⚠️	59.49MB	59.48MB	0.50MB
datadog-dogstatsd-amd64-deb	0.00MB	✅	39.33MB	39.33MB	0.50MB
datadog-dogstatsd-x86_64-rpm	0.00MB	✅	39.41MB	39.41MB	0.50MB
datadog-dogstatsd-x86_64-suse	0.00MB	✅	39.41MB	39.41MB	0.50MB
datadog-dogstatsd-arm64-deb	0.00MB	✅	37.86MB	37.86MB	0.50MB

Decision

⚠️ Warning

agent-platform-auto-pr · 2025-03-13T18:18:28Z

Static quality checks ✅

Please find below the results from static quality gates

Successful checks

Info

Result	Quality gate	On disk size	On disk size limit	On wire size	On wire size limit
✅	static_quality_gate_agent_deb_amd64	782.76 MiB	801.8 MiB	190.95 MiB	202.62 MiB
✅	static_quality_gate_agent_deb_arm64	774.12 MiB	793.14 MiB	172.52 MiB	184.51 MiB
✅	static_quality_gate_agent_rpm_amd64	782.75 MiB	801.79 MiB	193.29 MiB	205.03 MiB
✅	static_quality_gate_agent_rpm_arm64	774.22 MiB	793.09 MiB	174.84 MiB	186.44 MiB
✅	static_quality_gate_agent_suse_amd64	782.72 MiB	801.81 MiB	193.29 MiB	205.03 MiB
✅	static_quality_gate_agent_suse_arm64	774.18 MiB	793.14 MiB	174.84 MiB	186.44 MiB
✅	static_quality_gate_dogstatsd_deb_amd64	37.59 MiB	47.67 MiB	9.74 MiB	19.78 MiB
✅	static_quality_gate_dogstatsd_deb_arm64	36.18 MiB	46.27 MiB	8.45 MiB	18.49 MiB
✅	static_quality_gate_dogstatsd_rpm_amd64	37.59 MiB	47.67 MiB	9.75 MiB	19.79 MiB
✅	static_quality_gate_dogstatsd_suse_amd64	37.59 MiB	47.67 MiB	9.75 MiB	19.79 MiB
✅	static_quality_gate_iot_agent_deb_amd64	59.38 MiB	69.0 MiB	14.92 MiB	24.8 MiB
✅	static_quality_gate_iot_agent_deb_arm64	56.74 MiB	66.4 MiB	12.87 MiB	22.8 MiB
✅	static_quality_gate_iot_agent_rpm_amd64	59.38 MiB	69.0 MiB	14.94 MiB	24.8 MiB
✅	static_quality_gate_iot_agent_rpm_arm64	56.74 MiB	66.4 MiB	12.88 MiB	22.8 MiB
✅	static_quality_gate_iot_agent_suse_amd64	59.38 MiB	69.0 MiB	14.94 MiB	24.8 MiB
✅	static_quality_gate_docker_agent_amd64	867.47 MiB	886.12 MiB	291.72 MiB	304.21 MiB
✅	static_quality_gate_docker_agent_arm64	882.14 MiB	900.79 MiB	278.13 MiB	290.47 MiB
✅	static_quality_gate_docker_agent_jmx_amd64	1.04 GiB	1.06 GiB	366.83 MiB	379.33 MiB
✅	static_quality_gate_docker_agent_jmx_arm64	1.04 GiB	1.06 GiB	349.2 MiB	361.55 MiB
✅	static_quality_gate_docker_dogstatsd_amd64	45.73 MiB	55.78 MiB	17.25 MiB	27.28 MiB
✅	static_quality_gate_docker_dogstatsd_arm64	44.36 MiB	54.45 MiB	16.12 MiB	26.16 MiB
✅	static_quality_gate_docker_cluster_agent_amd64	264.87 MiB	274.78 MiB	106.3 MiB	116.28 MiB
✅	static_quality_gate_docker_cluster_agent_arm64	280.81 MiB	290.82 MiB	101.13 MiB	111.12 MiB

cit-pr-commenter · 2025-03-13T18:35:52Z

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 57841346-821e-45d0-927e-2a7bbeefbb2f

Baseline: 18bdd73
Comparison: bfdca43
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	tcp_syslog_to_blackhole	ingress throughput	+0.41	[+0.34, +0.47]	1	Logs
➖	file_to_blackhole_500ms_latency	egress throughput	+0.04	[-0.74, +0.81]	1	Logs
➖	quality_gate_idle_all_features	memory utilization	+0.03	[-0.03, +0.09]	1	Logs bounds checks dashboard
➖	file_to_blackhole_100ms_latency	egress throughput	+0.00	[-0.72, +0.72]	1	Logs
➖	tcp_dd_logs_filter_exclude	ingress throughput	-0.00	[-0.03, +0.03]	1	Logs
➖	file_to_blackhole_300ms_latency	egress throughput	-0.01	[-0.63, +0.62]	1	Logs
➖	uds_dogstatsd_to_api	ingress throughput	-0.01	[-0.33, +0.32]	1	Logs
➖	file_to_blackhole_0ms_latency_http2	egress throughput	-0.02	[-0.81, +0.77]	1	Logs
➖	file_to_blackhole_0ms_latency_http1	egress throughput	-0.03	[-0.86, +0.81]	1	Logs
➖	file_to_blackhole_0ms_latency	egress throughput	-0.04	[-0.89, +0.81]	1	Logs
➖	file_to_blackhole_1000ms_latency_linear_load	egress throughput	-0.15	[-0.62, +0.32]	1	Logs
➖	file_to_blackhole_1000ms_latency	egress throughput	-0.21	[-0.98, +0.56]	1	Logs
➖	uds_dogstatsd_20mb_12k_contexts_20_senders	memory utilization	-0.23	[-0.27, -0.19]	1	Logs
➖	quality_gate_idle	memory utilization	-0.49	[-0.59, -0.40]	1	Logs bounds checks dashboard
➖	file_tree	memory utilization	-1.24	[-1.37, -1.10]	1	Logs
➖	quality_gate_logs	% cpu utilization	-1.26	[-4.04, +1.53]	1	Logs
➖	uds_dogstatsd_to_api_cpu	% cpu utilization	-1.70	[-2.54, -0.87]	1	Logs

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	links
✅	file_to_blackhole_0ms_latency	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency	memory_usage	10/10
✅	file_to_blackhole_0ms_latency_http1	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency_http1	memory_usage	10/10
✅	file_to_blackhole_0ms_latency_http2	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency_http2	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency_linear_load	memory_usage	10/10
✅	file_to_blackhole_100ms_latency	lost_bytes	10/10
✅	file_to_blackhole_100ms_latency	memory_usage	10/10
✅	file_to_blackhole_300ms_latency	lost_bytes	10/10
✅	file_to_blackhole_300ms_latency	memory_usage	10/10
✅	file_to_blackhole_500ms_latency	lost_bytes	10/10
✅	file_to_blackhole_500ms_latency	memory_usage	10/10
✅	quality_gate_idle	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_idle	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_idle_all_features	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_logs	intake_connections	10/10
✅	quality_gate_logs	lost_bytes	10/10
✅	quality_gate_logs	memory_usage	10/10

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

✅ = significantly better comparison variant performance
❌ = significantly worse comparison variant performance
➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.

Co-authored-by: Bryce Eadie <[email protected]>

pimlu · 2025-03-14T00:19:37Z

/merge

dd-devflow · 2025-03-14T00:19:40Z

View all feedbacks in Devflow UI.
2025-03-14 00:19:40 UTC ℹ️ Start processing command /merge

2025-03-14 00:19:43 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 41m (p90).

2025-03-14 00:55:51 UTC ℹ️ MergeQueue: This merge request was merged

…5035) Co-authored-by: Bryce Eadie <[email protected]> 1a4e43d

Co-authored-by: Bryce Eadie <[email protected]>

github-actions bot added component/system-probe medium review PR review might take time team/networks labels Mar 11, 2025

github-actions bot added long review PR is complex, plan time to review it and removed medium review PR review might take time labels Mar 11, 2025

pimlu added the qa/done QA done before merge and regressions are covered by tests label Mar 11, 2025

pimlu marked this pull request as ready for review March 11, 2025 21:59

pimlu requested review from a team as code owners March 11, 2025 21:59

pimlu requested review from charan-manjunath and hush-hush March 11, 2025 21:59

hush-hush approved these changes Mar 12, 2025

View reviewed changes

hmahmood reviewed Mar 12, 2025

View reviewed changes

pkg/network/tracer/connection/ebpfless/tcp_processor_retransmit_test.go Outdated Show resolved Hide resolved

hmahmood reviewed Mar 12, 2025

View reviewed changes

comp/networkpath/npcollector/npcollectorimpl/npcollector.go Outdated Show resolved Hide resolved

github-actions bot added medium review PR review might take time and removed long review PR is complex, plan time to review it labels Mar 12, 2025

buraizu approved these changes Mar 12, 2025

View reviewed changes

releasenotes/notes/netpath-cidr-excludes-006cfccd06c6fde6.yaml Outdated Show resolved Hide resolved

AlexandreYang reviewed Mar 12, 2025

View reviewed changes

comp/networkpath/npcollector/npcollectorimpl/npcollector.go Outdated Show resolved Hide resolved

AlexandreYang reviewed Mar 12, 2025

View reviewed changes

comp/networkpath/npcollector/npcollectorimpl/npcollector.go Show resolved Hide resolved

AlexandreYang approved these changes Mar 12, 2025

View reviewed changes

github-actions bot added long review PR is complex, plan time to review it and removed medium review PR review might take time labels Mar 13, 2025

hmahmood approved these changes Mar 13, 2025

View reviewed changes

pimlu force-pushed the sgeipel/netpath-exclude-cidr branch from 3e61752 to 586318e Compare March 13, 2025 16:55

alexn-dd approved these changes Mar 13, 2025

View reviewed changes

pimlu added this to the 7.65.0 milestone Mar 13, 2025

pimlu and others added 7 commits March 13, 2025 14:42

[NPM-4291] Add config to exclude subnets from dynamic path

cff8b91

remove comment

0992e37

add changelog

714afe1

remove stuff that is unrelated to this PR

f73a6b3

feedback

b30155f

Update releasenotes/notes/netpath-cidr-excludes-006cfccd06c6fde6.yaml

5039833

Co-authored-by: Bryce Eadie <[email protected]>

fix build

bfdca43

pimlu force-pushed the sgeipel/netpath-exclude-cidr branch from 0145714 to bfdca43 Compare March 13, 2025 21:44

dd-mergequeue bot merged commit 1a4e43d into main Mar 14, 2025
319 checks passed

dd-mergequeue bot deleted the sgeipel/netpath-exclude-cidr branch March 14, 2025 00:55

github-actions bot pushed a commit to mamebb2023/datadog-agent that referenced this pull request Mar 14, 2025

[NPM-4291] Add config to exclude subnets from dynamic path (DataDog#3…

92061b1

…5035) Co-authored-by: Bryce Eadie <[email protected]> 1a4e43d

arbll pushed a commit that referenced this pull request Mar 19, 2025

[NPM-4291] Add config to exclude subnets from dynamic path (#35035)

f2b0ba1

Co-authored-by: Bryce Eadie <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[NPM-4291] Add config to exclude subnets from dynamic path #35035

[NPM-4291] Add config to exclude subnets from dynamic path #35035

pimlu commented Mar 11, 2025 •

edited

Loading

cit-pr-commenter bot commented Mar 11, 2025 •

edited

Loading

buraizu left a comment

agent-platform-auto-pr bot commented Mar 13, 2025 •

edited

Loading

agent-platform-auto-pr bot commented Mar 13, 2025 •

edited

Loading

agent-platform-auto-pr bot commented Mar 13, 2025 •

edited

Loading

Info

cit-pr-commenter bot commented Mar 13, 2025 •

edited

Loading

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

pimlu commented Mar 14, 2025

dd-devflow bot commented Mar 14, 2025 •

edited

Loading

[NPM-4291] Add config to exclude subnets from dynamic path #35035

[NPM-4291] Add config to exclude subnets from dynamic path #35035

Conversation

pimlu commented Mar 11, 2025 • edited Loading

What does this PR do?

Motivation

Describe how you validated your changes

Possible Drawbacks / Trade-offs

Additional Notes

cit-pr-commenter bot commented Mar 11, 2025 • edited Loading

Go Package Import Differences

buraizu left a comment

Choose a reason for hiding this comment

agent-platform-auto-pr bot commented Mar 13, 2025 • edited Loading

Test changes on VM

agent-platform-auto-pr bot commented Mar 13, 2025 • edited Loading

Uncompressed package size comparison

Decision

agent-platform-auto-pr bot commented Mar 13, 2025 • edited Loading

Static quality checks ✅

Info

cit-pr-commenter bot commented Mar 13, 2025 • edited Loading

Regression Detector

Regression Detector Results

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

CI Pass/Fail Decision

pimlu commented Mar 14, 2025

dd-devflow bot commented Mar 14, 2025 • edited Loading

pimlu commented Mar 11, 2025 •

edited

Loading

cit-pr-commenter bot commented Mar 11, 2025 •

edited

Loading

agent-platform-auto-pr bot commented Mar 13, 2025 •

edited

Loading

agent-platform-auto-pr bot commented Mar 13, 2025 •

edited

Loading

agent-platform-auto-pr bot commented Mar 13, 2025 •

edited

Loading

cit-pr-commenter bot commented Mar 13, 2025 •

edited

Loading

dd-devflow bot commented Mar 14, 2025 •

edited

Loading