Redact OTLP header and Datadog key configs in telemetry by bm1549 · Pull Request #11583 · DataDog/dd-trace-java

bm1549 · 2026-06-06T01:14:05Z

What Does This Do

Renders sensitive configuration values as <hidden> in configuration telemetry. This covers the OTLP exporter headers, Datadog API and application keys, profiling and crash-tracking proxy passwords, the RUM client token, and the test-agent session token. Redaction applies only to values that are set.

The supported-config generator builds GeneratedSupportedConfigurations.SENSITIVE_KEYS from the sensitive: true entries in metadata/supported-configurations.json. ConfigSetting canonicalizes each collected key to env-var form before lookup, so redaction works for property names, dd.* system properties, aliases, and raw env vars.

Motivation

Credentials and exporter headers should not be sent in configuration telemetry.

Additional Notes

The registry is the single source of truth for sensitive configurations. This replaces the old manual filter and drift test.
The rebase preserves redaction for DD_TEST_AGENT_SESSION_TOKEN by marking it sensitive in the registry.
Reusing the canonicalization in ConfigSetting.normalizedKey() also corrects malformed DD_DD_* telemetry keys when a setting is collected in env-var form.
Validation:
- ./gradlew spotlessApply
- ./gradlew :utils:config-utils:test --tests datadog.trace.api.ConfigSettingTest --tests datadog.trace.util.ConfigStringsTest
- ./gradlew :internal-api:test --tests datadog.trace.api.ConfigCollectorTest
- ./gradlew :buildSrc:test -PrunBuildSrcTests --tests datadog.gradle.plugin.config.ParseV2SupportedConfigurationsTest

Contributor Checklist

Format the title according to the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any other useful labels
Avoid using close, fix, or any linking keywords when referencing an issue
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, migration, or deletion
Update public documentation with any new configuration flags or behaviors
Once approved, use merge queue to merge the PR

Jira ticket: N/A

dd-octo-sts · 2026-06-06T01:50:47Z

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.85 s	14.80 s	[-0.5%; +1.1%] (no difference)
startup:insecure-bank:tracing:Agent	13.62 s	13.71 s	[-1.3%; +0.0%] (no difference)
startup:petclinic:appsec:Agent	16.79 s	16.48 s	[+0.8%; +2.9%] (maybe worse)
startup:petclinic:iast:Agent	16.82 s	16.99 s	[-1.7%; -0.4%] (maybe better)
startup:petclinic:profiling:Agent	16.79 s	16.72 s	[-0.9%; +1.7%] (no difference)
startup:petclinic:sca:Agent	16.87 s	16.50 s	[+1.1%; +3.4%] (significantly worse)
startup:petclinic:tracing:Agent	16.19 s	15.72 s	[-1.3%; +7.3%] (no difference)

Commit: 75f39488 · CI Pipeline · Benchmarking Platform UI

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

dd-octo-sts · 2026-06-16T08:00:29Z

Hi! 👋 Thanks for your pull request! 🎉

To help us review it, please make sure to:

Add at least one type, and one component or instrumentation label to the pull request

If you need help, please check our contributing guidelines.

PerfectSlayer

Left comment about sensitive config sync mechanism

…telemetry Add the OTLP exporter header configurations and the Datadog API key and application key configurations to the telemetry configuration filter list so their values are reported as "<hidden>" in the configuration telemetry: - OTEL_EXPORTER_OTLP_HEADERS - OTEL_EXPORTER_OTLP_TRACES_HEADERS - OTEL_EXPORTER_OTLP_METRICS_HEADERS - OTEL_EXPORTER_OTLP_LOGS_HEADERS - DD_API_KEY - DD_APPLICATION_KEY (and its DD_APP_KEY alias) For each configuration, every form that can reach ConfigSetting is covered: the dotted configuration names (otlp.traces.headers, otlp.metrics.headers, otlp.logs.headers, application-key, app-key) and the environment-variable names. Mark these configurations, DD_API_KEY, and DD_APPLICATION_KEY with "sensitive: true" in metadata/supported-configurations.json. Migrate ConfigSettingTest to JUnit 5 and extend it to cover the OTLP header and application key configurations, including an assertion that the configured value is not present in the reported telemetry value. Update ConfigCollectorTest so the application key collected through the ConfigCollector pipeline is asserted to render as "<hidden>". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…acted Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…to JUnit, redact api-key/profiling collect-path forms, tighten drift guard Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…onfigs Collect the profiling api key under its property name (single DD_ telemetry name), reduce CONFIG_FILTER_LIST to the property-name forms values are actually collected under, and map OTEL headers to their OTLP collected form in the drift guard. Also mark and redact the remaining collected credential configs: the profiling and crash-tracking proxy passwords and the RUM client token. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… in Groovy Remove redaction of the deprecated profiling.api-key/profiling.apikey fallback env vars (and the getEnvCollectedAs helper they needed). Only redact non-null values, so an unset sensitive config still reports null rather than <hidden>. Revert ConfigCollectorTest from JUnit back to its original Groovy form with minimal redaction edits, and trim the ConfigSettingTest table to a few representative cases. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Replace the hand-maintained CONFIG_FILTER_LIST and its drift-guard test with a SENSITIVE_KEYS set generated from the "sensitive": true entries in metadata/supported-configurations.json, making the registry the single source of truth. ConfigSetting canonicalizes a collected key to env-var form (without double-prefixing an already-DD_-form key) and matches it against the generated set, so redaction fires whether the value arrived as a property name, dd.* system property, alias, or raw env var. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The merge with master switched the generated file to explicit imports, but the initSensitiveKeys() emission still used Set/HashSet/Collections.unmodifiableSet without emitting their imports, breaking compilation of the generated GeneratedSupportedConfigurations. Emit the java.util.Set/HashSet imports and use the unmodifiableSet static import to match the rest of the generated file. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Move the env-var canonicalization out of ConfigSetting's private redactionKey into a reusable ConfigStrings.toCanonicalEnvVar, so the "config key in any form -> canonical DD_ env-var name" logic lives alongside the other key conversions and is unit-tested directly. Behavior is unchanged; normalizedKey() is untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ConfigSetting.normalizedKey() always prepended DD_, so a key already collected in env-var form (e.g. DD_PROFILING_API_KEY / DD_AAS_JAVA_EXTENSION_VERSION read via getEnv) was reported in config telemetry as the malformed DD_DD_PROFILING_API_KEY. Delegate to ConfigStrings.toCanonicalEnvVar, which adds the DD_ namespace only when not already present, fixing the name and collapsing the two near-identical canonicalization helpers into one. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The code and the ConfigStrings.toCanonicalEnvVar javadoc already explain the behavior; remove the restating comments in ConfigSetting, the generator, and the tests. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add comment to clarify sensitive config handling

bm1549 added comp: telemetry Telemetry tag: ai generated Largely based on code generated by an AI or LLM type:chore labels Jun 6, 2026

This comment has been minimized.

Sign in to view

bm1549 force-pushed the brian.marks/omit-sensitive-config-telemetry branch from 6f11563 to 19f31ad Compare June 6, 2026 01:32

bm1549 force-pushed the brian.marks/omit-sensitive-config-telemetry branch 2 times, most recently from 9639e05 to 2c36e1a Compare June 9, 2026 22:21

bm1549 commented Jun 12, 2026

View reviewed changes

Comment thread utils/config-utils/src/main/java/datadog/trace/api/ConfigSetting.java Outdated

bm1549 commented Jun 12, 2026

View reviewed changes

Comment thread utils/config-utils/src/main/java/datadog/trace/api/ConfigSetting.java Outdated

bm1549 marked this pull request as ready for review June 12, 2026 00:15

bm1549 requested review from a team as code owners June 12, 2026 00:15

bm1549 requested review from PerfectSlayer and removed request for a team June 12, 2026 00:15

PerfectSlayer removed the type:chore label Jun 16, 2026

bm1549 added the type: feature Enhancements and improvements label Jun 17, 2026

PerfectSlayer reviewed Jun 18, 2026

View reviewed changes

Comment thread utils/config-utils/src/test/java/datadog/trace/api/SensitiveConfigRedactionTest.java Outdated

bm1549 requested a review from PerfectSlayer June 25, 2026 18:43

bm1549 and others added 10 commits August 5, 2026 11:45

test(telemetry): guard that sensitive-marked configs are actually red…

cdce668

…acted Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Address review: alphabetize filter list, migrate ConfigCollectorTest …

b93242f

…to JUnit, redact api-key/profiling collect-path forms, tighten drift guard Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Apply suggestion from @bm1549

b5ecc94

bm1549 and others added 2 commits August 5, 2026 11:50

Document sensitive config value redaction

75f3948

Add comment to clarify sensitive config handling

bm1549 force-pushed the brian.marks/omit-sensitive-config-telemetry branch from 4e3562e to 75f3948 Compare August 5, 2026 15:55

bm1549 enabled auto-merge August 5, 2026 17:18

Navigation Menu

Uh oh!

Redact OTLP header and Datadog key configs in telemetry - #11583

Redact OTLP header and Datadog key configs in telemetry#11583
bm1549 wants to merge 12 commits into
masterfrom
brian.marks/omit-sensitive-config-telemetry

bm1549 commented Jun 6, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

dd-octo-sts Bot commented Jun 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

dd-octo-sts Bot commented Jun 16, 2026

Uh oh!

PerfectSlayer left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

bm1549 commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

This comment has been minimized.

dd-octo-sts Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🟢 Java Benchmark SLOs — All performance SLOs passed

Uh oh!

Uh oh!

Uh oh!

dd-octo-sts Bot commented Jun 16, 2026

Uh oh!

PerfectSlayer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bm1549 commented Jun 6, 2026 •

edited

Loading

dd-octo-sts Bot commented Jun 6, 2026 •

edited

Loading