feat: ECS Fargate APM Profiling (#19)

* Fix outdated example for secret arn

* Add profiling into terraform interface

* Make examples more clear that dummy apps are not datadog

* Update smoke tests

Author: gabedos

examples/ecs_fargate/main.tf

@@ -32,7 +32,8 @@ module "datadog_ecs_fargate_task" {
   }
 
   dd_apm = {
-    enabled = true,
+    enabled   = true,
+    profiling = true,
   }
 
   dd_log_collection = {
@@ -44,20 +45,20 @@ module "datadog_ecs_fargate_task" {
   }
 
   # Configure Task Definition
-  family = "datadog-terraform-app"
+  family = "dummy-terraform-app"
   container_definitions = jsonencode([
     {
-      name      = "datadog-dogstatsd-app",
+      name      = "dummy-dogstatsd-app",
       image     = "ghcr.io/datadog/apps-dogstatsd:main",
       essential = false,
     },
     {
-      name      = "datadog-apm-app",
+      name      = "dummy-apm-app",
       image     = "ghcr.io/datadog/apps-tracegen:main",
       essential = true,
     },
     {
-      name      = "datadog-cws-app",
+      name      = "dummy-cws-app",
       image     = "public.ecr.aws/ubuntu/ubuntu:22.04_stable",
       essential = false,
       entryPoint = [

modules/ecs_fargate/README.md

@@ -22,8 +22,10 @@ module "ecs_fargate_task" {
   version = "1.0.0"
 
   # Datadog Configuration
-  dd_api_key_secret_arn = "arn:aws:secretsmanager:us-east-1:0000000000:secret:example-secret"
-  dd_tags               = "team:cont-p, owner:container-monitoring"
+  dd_api_key_secret = {
+    arn = "arn:aws:secretsmanager:us-east-1:0000000000:secret:example-secret"
+  }
+  dd_tags = "team:cont-p, owner:container-monitoring"
 
   dd_dogstatsd = {
     enabled = true
@@ -227,7 +229,7 @@ No modules.
 | <a name="input_cpu"></a> [cpu](#input\_cpu) | Number of cpu units used by the task. If the `requires_compatibilities` is `FARGATE` this field is required | `number` | `256` | no |
 | <a name="input_dd_api_key"></a> [dd\_api\_key](#input\_dd\_api\_key) | Datadog API Key | `string` | `null` | no |
 | <a name="input_dd_api_key_secret"></a> [dd\_api\_key\_secret](#input\_dd\_api\_key\_secret) | Datadog API Key Secret ARN | <pre>object({<br/>    arn = string<br/>  })</pre> | `null` | no |
-| <a name="input_dd_apm"></a> [dd\_apm](#input\_dd\_apm) | Configuration for Datadog APM | <pre>object({<br/>    enabled        = optional(bool, true)<br/>    socket_enabled = optional(bool, true)<br/>  })</pre> | <pre>{<br/>  "enabled": true,<br/>  "socket_enabled": true<br/>}</pre> | no |
+| <a name="input_dd_apm"></a> [dd\_apm](#input\_dd\_apm) | Configuration for Datadog APM | <pre>object({<br/>    enabled        = optional(bool, true)<br/>    socket_enabled = optional(bool, true)<br/>    profiling      = optional(bool, false)<br/>  })</pre> | <pre>{<br/>  "enabled": true,<br/>  "profiling": false,<br/>  "socket_enabled": true<br/>}</pre> | no |
 | <a name="input_dd_checks_cardinality"></a> [dd\_checks\_cardinality](#input\_dd\_checks\_cardinality) | Datadog Agent checks cardinality | `string` | `null` | no |
 | <a name="input_dd_cluster_name"></a> [dd\_cluster\_name](#input\_dd\_cluster\_name) | Datadog cluster name | `string` | `null` | no |
 | <a name="input_dd_cpu"></a> [dd\_cpu](#input\_dd\_cpu) | Datadog Agent container CPU units | `number` | `null` | no |

modules/ecs_fargate/datadog.tf

@@ -118,6 +118,15 @@ locals {
     ] : [],
   )
 
+  application_env_vars = concat(
+    var.dd_apm.profiling != null ? [
+      {
+        name  = "DD_PROFILING_ENABLED"
+        value = tostring(var.dd_apm.profiling)
+      }
+    ] : [],
+  )
+
   agent_dependency = var.dd_is_datadog_dependency_enabled && try(var.dd_health_check.command != null, false) ? [
     {
       containerName = "datadog-agent"
@@ -151,6 +160,7 @@ locals {
           local.apm_socket_var,
           local.dsd_port_var,
           local.ust_env_vars,
+          local.application_env_vars,
         ),
         # Append new volume mounts to any existing mountPoints.
         mountPoints = concat(
@@ -238,7 +248,7 @@ locals {
       { key = "DD_SITE", value = var.dd_site },
       { key = "DD_DOGSTATSD_TAG_CARDINALITY", value = var.dd_dogstatsd.dogstatsd_cardinality },
       { key = "DD_TAGS", value = var.dd_tags },
-      { key = "DD_CLUSTER_NAME", value = var.dd_cluster_name }
+      { key = "DD_CLUSTER_NAME", value = var.dd_cluster_name },
     ] : { name = pair.key, value = pair.value } if pair.value != null
   ]
 

modules/ecs_fargate/variables.tf

@@ -165,10 +165,12 @@ variable "dd_apm" {
   type = object({
     enabled        = optional(bool, true)
     socket_enabled = optional(bool, true)
+    profiling      = optional(bool, false)
   })
   default = {
     enabled        = true
     socket_enabled = true
+    profiling      = false
   }
   validation {
     condition     = var.dd_apm != null

smoke_tests/ecs_fargate/all-dd-inputs.tf

@@ -35,6 +35,7 @@ module "dd_task_all_dd_inputs" {
   dd_apm = {
     enabled        = true,
     socket_enabled = true,
+    profiling      = true,
   }
 
   dd_log_collection = {

tests/all_dd_inputs_test.go

@@ -115,9 +115,10 @@ func (s *ECSFargateSuite) TestAllDDInputs() {
 	s.True(found, "Container datadog-apm-app not found in definitions")
 	s.Equal("ghcr.io/datadog/apps-tracegen:main", *apmAppContainer.Image)
 	expectedApmDsdEnvVars := map[string]string{
-		"DD_SERVICE":         "test-service",
-		"DD_TRACE_AGENT_URL": "unix:///var/run/datadog/apm.socket",
-		"DD_AGENT_HOST":      "127.0.0.1",
+		"DD_SERVICE":           "test-service",
+		"DD_TRACE_AGENT_URL":   "unix:///var/run/datadog/apm.socket",
+		"DD_AGENT_HOST":        "127.0.0.1",
+		"DD_PROFILING_ENABLED": "true",
 	}
 	AssertEnvVars(s.T(), apmAppContainer, expectedApmDsdEnvVars)
 	AssertMountPoint(s.T(), apmAppContainer, MountDdSocket)