Build krb5 with bazel (take 2) by chouquette · Pull Request #44739 · DataDog/datadog-agent

chouquette · 2026-01-05T10:06:06Z

What does this PR do?

Reintroduce the change from #44326 and fix it to install kinit in addition from the lib

Motivation

kinit is needed by some integrations

Describe how you validated your changes

Additional Notes

agent-platform-auto-pr · 2026-01-05T12:53:34Z

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor fefe0ae
📊 Static Quality Gates Dashboard

Successful checks

Info

	Quality gate	Change	Size (prev → curr → max)
✅	agent_deb_amd64	-613.81 KiB (0.08% reduction)	747.595 → 746.995 → 754.830
✅	agent_deb_amd64_fips	-613.81 KiB (0.08% reduction)	707.612 → 707.012 → 715.320
✅	agent_rpm_amd64	-613.81 KiB (0.08% reduction)	747.578 → 746.979 → 754.800
✅	agent_rpm_amd64_fips	-613.81 KiB (0.08% reduction)	707.595 → 706.996 → 715.310
✅	agent_rpm_arm64	-400.27 KiB (0.05% reduction)	726.543 → 726.152 → 737.340
✅	agent_rpm_arm64_fips	-400.27 KiB (0.06% reduction)	689.056 → 688.665 → 698.930
✅	agent_suse_amd64	-613.81 KiB (0.08% reduction)	747.578 → 746.979 → 754.800
✅	agent_suse_amd64_fips	-613.81 KiB (0.08% reduction)	707.595 → 706.996 → 715.310
✅	agent_suse_arm64	-400.27 KiB (0.05% reduction)	726.543 → 726.152 → 737.340
✅	agent_suse_arm64_fips	-400.27 KiB (0.06% reduction)	689.056 → 688.665 → 698.930
✅	docker_agent_amd64	-613.85 KiB (0.07% reduction)	810.071 → 809.471 → 817.140
✅	docker_agent_arm64	-400.3 KiB (0.05% reduction)	813.629 → 813.238 → 824.020
✅	docker_agent_jmx_amd64	-613.84 KiB (0.06% reduction)	1000.949 → 1000.350 → 1008.020
✅	docker_agent_jmx_arm64	-400.3 KiB (0.04% reduction)	993.227 → 992.836 → 1003.620

17 successful checks with minimal change (< 2 KiB)

	Quality gate	Current Size
✅	agent_heroku_amd64	325.023 MiB
✅	agent_msi	658.944 MiB
✅	docker_cluster_agent_amd64	180.824 MiB
✅	docker_cluster_agent_arm64	196.670 MiB
✅	docker_cws_instrumentation_amd64	7.135 MiB
✅	docker_cws_instrumentation_arm64	6.689 MiB
✅	docker_dogstatsd_amd64	38.445 MiB
✅	docker_dogstatsd_arm64	36.812 MiB
✅	dogstatsd_deb_amd64	29.665 MiB
✅	dogstatsd_deb_arm64	27.833 MiB
✅	dogstatsd_rpm_amd64	29.665 MiB
✅	dogstatsd_suse_amd64	29.665 MiB
✅	iot_agent_deb_amd64	42.766 MiB
✅	iot_agent_deb_arm64	39.880 MiB
✅	iot_agent_deb_armhf	40.450 MiB
✅	iot_agent_rpm_amd64	42.767 MiB
✅	iot_agent_suse_amd64	42.767 MiB

On-wire sizes (compressed)

	Quality gate	Change	Size (prev → curr → max)
✅	agent_deb_amd64	-266.89 KiB (0.14% reduction)	182.942 → 182.681 → 184.810
✅	agent_deb_amd64_fips	-325.59 KiB (0.18% reduction)	174.460 → 174.142 → 177.560
✅	agent_heroku_amd64	+3.12 KiB (0.00% increase)	87.222 → 87.225 → 88.450
✅	agent_msi	-40.0 KiB (0.03% reduction)	142.484 → 142.445 → 143.300
✅	agent_rpm_amd64	-356.24 KiB (0.19% reduction)	186.051 → 185.703 → 188.160
✅	agent_rpm_amd64_fips	-252.3 KiB (0.14% reduction)	176.771 → 176.524 → 178.900
✅	agent_rpm_arm64	-297.11 KiB (0.17% reduction)	168.562 → 168.272 → 169.930
✅	agent_rpm_arm64_fips	-308.26 KiB (0.19% reduction)	160.895 → 160.594 → 163.120
✅	agent_suse_amd64	-356.24 KiB (0.19% reduction)	186.051 → 185.703 → 188.160
✅	agent_suse_amd64_fips	-252.3 KiB (0.14% reduction)	176.771 → 176.524 → 178.900
✅	agent_suse_arm64	-297.11 KiB (0.17% reduction)	168.562 → 168.272 → 169.930
✅	agent_suse_arm64_fips	-308.26 KiB (0.19% reduction)	160.895 → 160.594 → 163.120
✅	docker_agent_amd64	-390.26 KiB (0.14% reduction)	275.155 → 274.774 → 277.400
✅	docker_agent_arm64	-411.71 KiB (0.15% reduction)	262.713 → 262.311 → 266.040
✅	docker_agent_jmx_amd64	-390.09 KiB (0.11% reduction)	343.789 → 343.408 → 346.020
✅	docker_agent_jmx_arm64	-426.1 KiB (0.13% reduction)	327.338 → 326.921 → 330.660
✅	docker_cluster_agent_amd64	neutral	63.871 MiB → 64.510
✅	docker_cluster_agent_arm64	neutral	60.150 MiB → 61.170
✅	docker_cws_instrumentation_amd64	neutral	2.994 MiB → 3.330
✅	docker_cws_instrumentation_arm64	neutral	2.726 MiB → 3.090
✅	docker_dogstatsd_amd64	neutral	14.876 MiB → 15.820
✅	docker_dogstatsd_arm64	neutral	14.216 MiB → 14.830
✅	dogstatsd_deb_amd64	neutral	7.839 MiB → 8.790
✅	dogstatsd_deb_arm64	neutral	6.726 MiB → 7.710
✅	dogstatsd_rpm_amd64	neutral	7.849 MiB → 8.800
✅	dogstatsd_suse_amd64	neutral	7.849 MiB → 8.800
✅	iot_agent_deb_amd64	neutral	11.214 MiB → 12.040
✅	iot_agent_deb_arm64	neutral	9.589 MiB → 10.450
✅	iot_agent_deb_armhf	-2.37 KiB (0.02% reduction)	9.784 → 9.781 → 10.620
✅	iot_agent_rpm_amd64	neutral	11.231 MiB → 12.060
✅	iot_agent_suse_amd64	neutral	11.231 MiB → 12.060

cit-pr-commenter · 2026-01-05T13:08:55Z

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 5f4c2202-0a42-4a60-ab19-537f7218d192

Baseline: fefe0ae
Comparison: fc3fa1d
Diff

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Regressions in experiments with settings containing erratic: true are ignored.

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	docker_containers_cpu	% cpu utilization	+1.22	[-1.91, +4.35]	1	Logs

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	quality_gate_logs	% cpu utilization	+2.11	[+0.60, +3.61]	1	Logs bounds checks dashboard
➖	tcp_syslog_to_blackhole	ingress throughput	+1.47	[+1.39, +1.55]	1	Logs
➖	docker_containers_cpu	% cpu utilization	+1.22	[-1.91, +4.35]	1	Logs
➖	otlp_ingest_logs	memory utilization	+0.45	[+0.36, +0.55]	1	Logs
➖	uds_dogstatsd_20mb_12k_contexts_20_senders	memory utilization	+0.33	[+0.27, +0.39]	1	Logs
➖	ddot_metrics	memory utilization	+0.30	[+0.09, +0.51]	1	Logs
➖	file_tree	memory utilization	+0.23	[+0.18, +0.28]	1	Logs
➖	docker_containers_memory	memory utilization	+0.20	[+0.12, +0.28]	1	Logs
➖	otlp_ingest_metrics	memory utilization	+0.16	[+0.01, +0.30]	1	Logs
➖	quality_gate_idle	memory utilization	+0.08	[+0.04, +0.12]	1	Logs bounds checks dashboard
➖	file_to_blackhole_500ms_latency	egress throughput	+0.05	[-0.34, +0.44]	1	Logs
➖	file_to_blackhole_0ms_latency	egress throughput	+0.04	[-0.49, +0.56]	1	Logs
➖	uds_dogstatsd_to_api	ingress throughput	+0.03	[-0.11, +0.16]	1	Logs
➖	file_to_blackhole_1000ms_latency	egress throughput	+0.03	[-0.40, +0.45]	1	Logs
➖	quality_gate_idle_all_features	memory utilization	+0.02	[-0.02, +0.06]	1	Logs bounds checks dashboard
➖	file_to_blackhole_100ms_latency	egress throughput	+0.00	[-0.04, +0.05]	1	Logs
➖	uds_dogstatsd_to_api_v3	ingress throughput	+0.00	[-0.12, +0.12]	1	Logs
➖	tcp_dd_logs_filter_exclude	ingress throughput	-0.00	[-0.09, +0.09]	1	Logs
➖	ddot_metrics_sum_delta	memory utilization	-0.08	[-0.27, +0.12]	1	Logs
➖	ddot_logs	memory utilization	-0.08	[-0.14, -0.01]	1	Logs
➖	ddot_metrics_sum_cumulative	memory utilization	-0.10	[-0.26, +0.05]	1	Logs
➖	ddot_metrics_sum_cumulativetodelta_exporter	memory utilization	-0.28	[-0.52, -0.05]	1	Logs
➖	quality_gate_metrics_logs	memory utilization	-1.92	[-2.14, -1.69]	1	Logs bounds checks dashboard

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	links
✅	docker_containers_cpu	simple_check_run	10/10
✅	docker_containers_memory	memory_usage	10/10
✅	docker_containers_memory	simple_check_run	10/10
✅	file_to_blackhole_0ms_latency	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency	lost_bytes	10/10
✅	file_to_blackhole_1000ms_latency	memory_usage	10/10
✅	file_to_blackhole_100ms_latency	lost_bytes	10/10
✅	file_to_blackhole_100ms_latency	memory_usage	10/10
✅	file_to_blackhole_500ms_latency	lost_bytes	10/10
✅	file_to_blackhole_500ms_latency	memory_usage	10/10
✅	quality_gate_idle	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_idle	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_idle_all_features	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_logs	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_logs	lost_bytes	10/10	bounds checks dashboard
✅	quality_gate_logs	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_metrics_logs	cpu_usage	10/10	bounds checks dashboard
✅	quality_gate_metrics_logs	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_metrics_logs	lost_bytes	10/10	bounds checks dashboard
✅	quality_gate_metrics_logs	memory_usage	10/10	bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

✅ = significantly better comparison variant performance
❌ = significantly worse comparison variant performance
➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.

chouquette · 2026-01-27T09:39:01Z

/trigger-ci --variable RUN_ALL_BUILDS=true --variable RUN_KITCHEN_TESTS=true --variable RUN_E2E_TESTS=on --variable DEPLOY_AGENT=true --variable RUN_UNIT_TESTS=on --variable RUN_KMT_TESTS=on

gh-worker-devflow-routing-ef8351 · 2026-01-27T09:39:04Z

View all feedbacks in Devflow UI.

2026-01-27 09:39:03 UTC ℹ️ Start processing command /trigger-ci --variable RUN_ALL_BUILDS=true --variable RUN_KITCHEN_TESTS=true --variable RUN_E2E_TESTS=on --variable DEPLOY_AGENT=true --variable RUN_UNIT_TESTS=on --variable RUN_KMT_TESTS=on

2026-01-27 09:39:22 UTC ℹ️ Branch synced on Gitlab

Branch chouquette/bazel/kerberos was out-of-sync on Gitlab - it has been resynced

2026-01-27 09:40:52 UTC ℹ️ Gitlab pipeline started

Started pipeline #92996179

rdesgroppes · 2026-01-28T15:49:29Z

bazel/patches/rules_foreign_cc/0001-include-out_data_dirs-to-the-output-groups.patch

+
+--


trailng whitespaces removed by your IDE?

Most likely, even though I'm surprised I edited the patch manually.

I'll revert that change right away

aiuto

The autoconf is the only serious question. I don't trust autoconf not to rewrite configure in a way that doesn't make it mutate.

aiuto · 2026-01-29T15:17:32Z

deps/krb5/krb5.BUILD.bazel

+    ],
+    lib_source = ":all_srcs",
+    deps = [
+        "@openssl//:openssl",


This might have to change to @openssl//:openssl_static. Look in the rpm or freetds thing.

aiuto · 2026-01-29T15:17:39Z

deps/krb5/krb5.BUILD.bazel

+    args = [
+        "-j 16",
+    ],
+    autoreconf = True,


IIUC, this rebuilds configure from the .ac files.
We shouldn't have to do that since they include src/configure in the distribution.

Your understanding is correct, and this is indeed not needed.
No idea why I included it in the first place, but it's now removed locally

aiuto · 2026-01-29T15:19:12Z

deps/krb5/krb5.BUILD.bazel

+    srcs = glob(["src/**/*"])
+)
+
+SHARED_LIBS = {


Wow. they like fine grained stuff. I'll bet we don't use half of it.
But that's for another day.

aiuto · 2026-01-29T15:26:58Z

deps/krb5/krb5.BUILD.bazel

+    attributes = pkg_attributes("0755"),
+)
+
+pkg_install(


Can you create an "all_files" pkg_filegroup and then use that as srcs in this rule. That makes it easy to continue to eliminate running the install target in ruby scripts and folding them into other rules in packaging. A pkg_deb can depend on "all_files" decoupled from the giant list of libraries.

Example:

datadog-agent/deps/bzip2/overlay.BUILD.bazel

Line 170 in a41bbbb

pkg_filegroup(

This reverts commit e6c2352.

chouquette · 2026-02-03T07:14:38Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-02-03T07:14:42Z

View all feedbacks in Devflow UI.

2026-02-03 07:14:41 UTC ℹ️ Start processing command /merge

2026-02-03 07:14:46 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 1h (p90).

2026-02-03 07:46:39 UTC ℹ️ MergeQueue: This merge request was merged

### What does this PR do? Reintroduce the change from DataDog#44326 and fix it to install `kinit` in addition from the lib ### Motivation `kinit` is needed by some integrations ### Describe how you validated your changes ### Additional Notes Co-authored-by: hugo.beauzee <hugo.beauzee@datadoghq.com> 45cdc09

### What does this PR do? Reintroduce the change from #44326 and fix it to install `kinit` in addition from the lib ### Motivation `kinit` is needed by some integrations ### Describe how you validated your changes ### Additional Notes Co-authored-by: hugo.beauzee <hugo.beauzee@datadoghq.com>

chouquette added changelog/no-changelog No changelog entry needed qa/no-code-change No code change in Agent code requiring validation labels Jan 5, 2026

github-actions bot added medium review PR review might take time team/agent-build labels Jan 5, 2026

chouquette force-pushed the chouquette/bazel/kerberos branch from 4425e6d to 7c1bb61 Compare January 5, 2026 12:08

chouquette force-pushed the chouquette/bazel/kerberos branch 2 times, most recently from 7c1bb61 to 2254475 Compare January 14, 2026 08:56

chouquette force-pushed the chouquette/bazel/kerberos branch from 2254475 to 3a76b4e Compare January 27, 2026 09:38

chouquette marked this pull request as ready for review January 28, 2026 08:08

chouquette requested a review from a team as a code owner January 28, 2026 08:08

rdesgroppes reviewed Jan 28, 2026

View reviewed changes

chouquette force-pushed the chouquette/bazel/kerberos branch from 6ba1e4f to d24bb88 Compare January 29, 2026 10:44

chouquette added the ask-review Ask required teams to review this PR label Jan 29, 2026

aiuto approved these changes Jan 29, 2026

View reviewed changes

chouquette added 9 commits February 2, 2026 16:51

Reapply "build krb5 with bazel (#44326)" (#44639)

5909568

This reverts commit e6c2352.

also install kinit binary

4c81fa1

patch binaries rpath

f4e6002

fix binaries permissions

50ad280

buildifier

5524f6b

don't regenerate configure

2cbc226

dynamically link with openssl

6235c17

expose an all_libs target

9bbb72a

remove unused load

fc3fa1d

chouquette force-pushed the chouquette/bazel/kerberos branch from d24bb88 to fc3fa1d Compare February 2, 2026 15:59

gh-worker-dd-mergequeue-cf854d bot merged commit 45cdc09 into main Feb 3, 2026
440 checks passed

gh-worker-dd-mergequeue-cf854d bot deleted the chouquette/bazel/kerberos branch February 3, 2026 07:46

github-actions bot added this to the 7.77.0 milestone Feb 3, 2026

KevinFairise2 restored the chouquette/bazel/kerberos branch February 3, 2026 08:34

Conversation

chouquette commented Jan 5, 2026

What does this PR do?

Motivation

Describe how you validated your changes

Additional Notes

Uh oh!

agent-platform-auto-pr bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Static quality checks

Info

Uh oh!

cit-pr-commenter bot commented Jan 5, 2026 • edited by cit-pr-commenter-54b7da bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Regression Detector

Regression Detector Results

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

CI Pass/Fail Decision

Uh oh!

chouquette commented Jan 27, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 bot commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rdesgroppes Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

chouquette Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

aiuto left a comment

Choose a reason for hiding this comment

Uh oh!

aiuto Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

aiuto Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

chouquette Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

aiuto Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

aiuto Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

chouquette commented Feb 3, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 bot commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

agent-platform-auto-pr bot commented Jan 5, 2026 •

edited

Loading

cit-pr-commenter bot commented Jan 5, 2026 •

edited by cit-pr-commenter-54b7da bot

Loading

gh-worker-devflow-routing-ef8351 bot commented Jan 27, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 bot commented Feb 3, 2026 •

edited

Loading