Skip to content

test(ffe): enable PHP agentless EVP egress coverage #8476

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
leoromanovsky wants to merge 2 commits into
base: leo/php-agentless-activation-20261112
Choose a base branch
from
Draft

test(ffe): enable PHP agentless EVP egress coverage #8476

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b1ba1b6
test(ffe): enable PHP agentless EVP egress coverage
leoromanovsky Nov 12, 2026
7f153aa
test(ffe): correct PHP activation gates and Apache runtime setup
leoromanovsky Nov 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 31 additions & 3 deletions manifests/php.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1306,9 +1306,17 @@ manifest:
"*": v1.21.0-dev
laravel11x: incomplete_test_app
symfony7x: incomplete_test_app
tests/ffe/test_exposure_egress.py::Test_FFE_Exposure_Egress_Agentless_Direct: missing_feature (Not yet implemented)
tests/ffe/test_exposure_egress.py::Test_FFE_Exposure_Egress_Agentless_Direct:
- weblog_declaration:
"*": v1.28.0-dev
laravel11x: incomplete_test_app
symfony7x: incomplete_test_app
tests/ffe/test_exposure_egress.py::Test_FFE_Exposure_Egress_Agentless_Direct_Shutdown: missing_feature (Not yet implemented)
tests/ffe/test_exposure_egress.py::Test_FFE_Exposure_Egress_Agentless_Sidecar: missing_feature (Not yet implemented)
tests/ffe/test_exposure_egress.py::Test_FFE_Exposure_Egress_Agentless_Sidecar:
- weblog_declaration:
"*": v1.28.0-dev
laravel11x: incomplete_test_app
symfony7x: incomplete_test_app
tests/ffe/test_exposures_datadog_agent.py:
- weblog_declaration:
"*": v1.21.0-dev
Expand Down Expand Up @@ -1339,9 +1347,29 @@ manifest:
weblog: [apache-mod-8.0-zts, apache-mod-7.1-zts, apache-mod-8.0, apache-mod-7.4, php-fpm-7.2, php-fpm-8.1, apache-mod-7.0, apache-mod-7.0-zts, php-fpm-7.0, php-fpm-8.0, php-fpm-8.2, apache-mod-7.2-zts, apache-mod-8.1-zts, apache-mod-7.1, php-fpm-8.5, php-fpm-8.6, apache-mod-8.2-zts, php-fpm-7.3, php-fpm-7.4, apache-mod-7.2, apache-mod-7.4-zts, apache-mod-8.2, apache-mod-7.3, apache-mod-8.1, php-fpm-7.1, apache-mod-7.3-zts]
- declaration: missing_feature (EX-3425)
excluded_weblog: [apache-mod-8.0-zts, apache-mod-7.1-zts, apache-mod-8.0, apache-mod-7.4, php-fpm-7.2, php-fpm-8.1, apache-mod-7.0, apache-mod-7.0-zts, php-fpm-7.0, php-fpm-8.0, php-fpm-8.2, apache-mod-7.2-zts, apache-mod-8.1-zts, apache-mod-7.1, php-fpm-8.5, php-fpm-8.6, apache-mod-8.2-zts, php-fpm-7.3, php-fpm-7.4, apache-mod-7.2, apache-mod-7.4-zts, apache-mod-8.2, apache-mod-7.3, apache-mod-8.1, php-fpm-7.1, apache-mod-7.3-zts]
tests/ffe/test_flag_eval_evp.py: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_Basic: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_Burst_Aggregation: bug (FFL-2676)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_Context_Bounds: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_Count: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_Egress_Agentless_Direct:
- weblog_declaration:
"*": v1.28.0-dev
laravel11x: incomplete_test_app
symfony7x: incomplete_test_app
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_Egress_Agentless_Sidecar:
- weblog_declaration:
"*": v1.28.0-dev
laravel11x: incomplete_test_app
symfony7x: incomplete_test_app
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_Egress_Datadog_Agent: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_High_Cardinality_Accounting: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_High_Cardinality_Aggregation: bug (FFL-2676)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_Load_Aggregation: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_ObserveFullData_Absent_Hashed: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_ObserveFullData_False_Hashed: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_ObserveFullData_True_Unhashed: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_Runtime_Default: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_evp.py::Test_FFE_EVP_Flagevaluation_SDK_Identity: missing_feature (FFL-2446)
tests/ffe/test_flag_eval_metrics.py:
- weblog_declaration:
"*": v1.21.0-dev
Expand Down
1 change: 1 addition & 0 deletions tests/ffe/utils/evp.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
"golang": {"weblog"},
"java": {"java"},
"nodejs": {"node"},
"php": {"apache2", "php-fpm:"},
"python": {"gunicorn", "python", "python3", "uwsgi"},
"ruby": {"puma", "ruby"},
}
Expand Down
24 changes: 24 additions & 0 deletions tests/test_the_test/test_ffe_tests.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@ def _direct_runtime_evidence(library_name: str = "nodejs") -> dict[str, Any]:
"golang": "weblog",
"java": "java",
"nodejs": "node",
"php": "apache2",
"python": "python",
"ruby": "ruby",
}[library_name]
Expand Down Expand Up @@ -413,6 +414,29 @@ def test_feature_flagging_direct_runtime_evidence_accepts_live_minimal_topology(
assert_direct_evp_runtime_evidence(_direct_runtime_evidence(), library_name="nodejs")


@pytest.mark.parametrize(
"command", ["apache2 -D FOREGROUND", "php-fpm: master process (/etc/php/8.2/fpm/php-fpm.conf)"]
)
@scenarios.test_the_test
def test_feature_flagging_direct_runtime_evidence_accepts_php_servers(command: str) -> None:
evidence = _direct_runtime_evidence("php")
evidence["containers"][1]["pid1_command"] = command
evidence["containers"][1]["processes"][0]["command"] = command

assert_direct_evp_runtime_evidence(evidence, library_name="php")


@pytest.mark.parametrize("command", ["tail -f /var/log/php.log", "bash /entrypoint.sh", "apache2-wrapper app"])
@scenarios.test_the_test
def test_feature_flagging_direct_runtime_evidence_rejects_php_wrappers(command: str) -> None:
evidence = _direct_runtime_evidence("php")
evidence["containers"][1]["pid1_command"] = command
evidence["containers"][1]["processes"][0]["command"] = command

with pytest.raises(AssertionError, match="expected one of"):
assert_direct_evp_runtime_evidence(evidence, library_name="php")


@pytest.mark.parametrize("executable", ["python3.11", "python3.12"])
@scenarios.test_the_test
def test_feature_flagging_direct_runtime_evidence_accepts_versioned_python(executable: str) -> None:
Expand Down
6 changes: 6 additions & 0 deletions utils/_context/_scenarios/agentless_endtoend.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,6 +227,12 @@ def _set_containers_dependancies(self) -> None:
self.serverless_init_container.depends_on.append(self.mocked_backend_container)
self.weblog_infra.library_container.depends_on.append(self.serverless_init_container)

def configure(self, config: pytest.Config) -> None:
super().configure(config)
if self.exposure_egress == "direct" and self.weblog_infra.library_name == "php":
# Bypass app.sh's dumb-init wrapper so the foreground PHP server owns PID 1.
self.weblog_infra.library_container.command = "/entrypoint.sh"

def _set_components(self) -> None:
super()._set_components()
if self.serverless_init_container is not None:
Expand Down
8 changes: 8 additions & 0 deletions utils/build/docker/php/apache-mod/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,14 @@ export _DD_DEBUG_SIDECAR_LOG_METHOD="file://$SYSTEM_TESTS_LOGS/sidecar.log"
export _DD_SHARED_LIB_DEBUG=0
export -p | sed 's@declare -x@export@' | tee /dev/stderr >> /etc/apache2/envvars

if [[ "${SYSTEM_TESTS_FFE_SHUTDOWN_FLUSH_ENABLED:-}" == "true" ]]; then
# The direct-EVP scenario inspects the server as PID 1, without an init wrapper.
# shellcheck disable=SC1091
source /etc/apache2/envvars
install -d -o "$APACHE_RUN_USER" -g "$APACHE_RUN_GROUP" "$APACHE_RUN_DIR" "$APACHE_LOCK_DIR"
exec apache2 -D FOREGROUND
fi

service apache2 start

exec tail -f "${LOGS_PHP[@]}" "${LOGS_APACHE[@]}" "$SYSTEM_TESTS_LOGS/appsec.log" "$SYSTEM_TESTS_LOGS/helper.log" "$SYSTEM_TESTS_LOGS/php_error.log"
4 changes: 4 additions & 0 deletions utils/build/docker/php/php-fpm/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,10 @@ env | sed -rn 's#^([^=]+)=([^=]+)$#env[\1] = "\2"#p' | tee /dev/stderr >> /etc/p
sed -i "s/;clear_env = no/clear_env = no/" /etc/php/PHP_VERSION/fpm/pool.d/www.conf

service apache2 start
if [[ "${SYSTEM_TESTS_FFE_SHUTDOWN_FLUSH_ENABLED:-}" == "true" ]]; then
# The direct-EVP scenario inspects the PHP server as PID 1.
exec /usr/sbin/php-fpmPHP_VERSION --nodaemonize
fi
# Use init script to preserve environment
/etc/init.d/phpPHP_VERSION-fpm start

Expand Down
Loading