config: add additional endpoints secret ARN environment variables - #171
Merged
shreyamalpani merged 2 commits intoSep 24, 2026
Merged
shreyamalpani merged 2 commits into
shreyamalpani merged 2 commits into
Conversation
cargo-audit CI check flagged rustls 0.23.37 for a TLS 1.3 handshake encryption-level advisory; the patched version is 0.23.45. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
shreyamalpani
marked this pull request as ready for review
September 23, 2026 22:05
shreyamalpani
requested review from
Lewis-E and
litianningdatadog
and
a lite review from Copilot
and removed request for
a team
September 23, 2026 22:05
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
No unresolved review issues were identified.
Review effort: Lite
Findings: None
What changed in this PR
Adds AWS Secrets Manager ARN environment-variable support for additional endpoints and updates Rustls dependencies.
Changes:
- Adds three secret ARN configuration fields with parsing, defaults, merging, and tests.
- Updates YAML fixtures.
- Bumps Rustls and related dependencies.
| File | Description |
|---|---|
crates/datadog-agent-config/src/sources/yaml.rs |
Updates expected configuration fixtures. |
crates/datadog-agent-config/src/sources/env.rs |
Parses, merges, and tests new environment variables. |
crates/datadog-agent-config/src/lib.rs |
Adds configuration fields and defaults. |
Cargo.lock |
Updates Rustls and transitive dependencies. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
litianningdatadog
approved these changes
Sep 24, 2026
shreyamalpani
deleted the
shreya.malpani/support-secrets-manager-arn-additional-endpoints
branch
September 24, 2026 14:48
shreyamalpani
added a commit
to DataDog/datadog-lambda-extension
that referenced
this pull request
Sep 25, 2026
…ipping additional endpoints (#1391) ## Summary Adds support for sourcing dual-shipping to additional endpoints (across metrics, traces, and logs) from an AWS Secrets Manager secret ARN, instead of requiring the endpoints/keys to be embedded as plaintext env vars. This mirrors the existing pattern for resolving the primary `DD_API_KEY` from Secrets Manager. Three new env vars are read at startup and, if set, resolved and merged into the existing plaintext additional-endpoints config: - `DD_ADDITIONAL_ENDPOINTS_SECRET_ARN` → merges into `DD_ADDITIONAL_ENDPOINTS` (metrics) - `DD_APM_ADDITIONAL_ENDPOINTS_SECRET_ARN` → merges into `DD_APM_ADDITIONAL_ENDPOINTS` (traces) - `DD_LOGS_CONFIG_ADDITIONAL_ENDPOINTS_SECRET_ARN` → merges into `DD_LOGS_CONFIG_ADDITIONAL_ENDPOINTS` (logs) Secret content uses the same JSON shape as the corresponding plaintext env var as defined in [docs](https://docs.datadoghq.com/serverless/aws_lambda/configuration/?tab=awssecretsmanager#send-telemetry-to-multiple-datadog-organizations). ## Motivation GitHub issue #1370 ## Design - Resolution is done synchronously at startup, not lazily on first flush. Since a non-empty ARN means the fetch will happen unconditionally, there's no benefit to deferring it, and doing it eagerly avoids adding latency to flush-time paths. - Resolved secrets overwrite the corresponding plaintext additional-endpoints config, when the secret's ARN is set and resolves successfully. If the ARN is unset, the fetch fails, or the secret fails to parse, the plaintext value is left untouched — it's not merged with the resolved value. - No changes to the existing primary `DD_API_KEY` resolution path (`create_api_key_factory`/`resolve_secrets`) — this is a separate, additive resolution step. - Also bumps the pinned `serverless-components` git rev to `8156757` to pick up the corresponding `datadog-agent-config` schema changes (new `*_secret_arn` fields) from DataDog/serverless-components#171 ## Testing - Manually tested and verified dual shipping works for metrics, logs, and traces to an additional endpoint sourced from a Secrets Manager ARN
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds support for three new environment variables that let the agent config load
additional_endpoints-style values from an AWS Secrets Manager secret ARN instead of (or in addition to) inline JSON:DD_ADDITIONAL_ENDPOINTS_SECRET_ARNDD_LOGS_CONFIG_ADDITIONAL_ENDPOINTS_SECRET_ARNDD_APM_ADDITIONAL_ENDPOINTS_SECRET_ARNEach new field mirrors the shape of its corresponding existing
*_ADDITIONAL_ENDPOINTSfield (additional_endpoints_secret_arn,logs_config_additional_endpoints_secret_arn,apm_additional_endpoints_secret_arn) onConfig, defaults to an empty string, and is wired through env parsing and config merging.Also bumps
rustlsto 0.23.45 to fix RUSTSEC-2026-0285.Motivation
Supports sending telemetry to multiple Datadog organizations via AWS Secrets Manager, per the serverless multi-org dual-shipping docs, so credentials for additional endpoints don't need to be set as plaintext env vars. SVLS-9800
Describe how to test/QA your changes
crates/datadog-agent-config/src/sources/env.rscovering: default (empty) values when the new env vars are unset, and correct parsing/merging when they are set.