test(ffe): validate Java agentless exposure egress by leoromanovsky · Pull Request #7494 · DataDog/system-tests

leoromanovsky · 2026-08-11T23:59:46Z

Motivation

Java agentless Feature Flags can deliver exposures through a local EVP proxy or authenticated direct intake. System tests must validate each supported route without changing unrelated Java weblog startup.

Changes and Decisions

Enable direct and serverless-init exposure validation for Java.
Keep one exposure contract for Agent, direct, and serverless-init routes.
Capture intake requests through the controlled system-tests proxy.
Apply the proxy trust-store wrapper only to the supported Spring Boot weblog.
Keep native, Payara, Play, UDS, and non-Java startup scripts unchanged.

Validation

Tested dd-trace-java 9b8d7589aa with the Spring Boot weblog.
Agent, direct, and serverless-init routes each passed.
Five evaluations produced one exposure on each route.
No exposure appeared on an unused route.

github-actions · 2026-08-12T00:00:21Z

CODEOWNERS have been resolved as:

utils/build/docker/java/app-with-proxy-ca.sh                            @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
manifests/java.yml                                                      @DataDog/asm-java @DataDog/apm-java
tests/ffe/test_exposure_egress.py                                       @DataDog/feature-flagging-and-experimentation-sdk @DataDog/system-tests-core
tests/test_the_test/test_mock_ffe_agentless_backend.py                  @DataDog/feature-flagging-and-experimentation-sdk @DataDog/system-tests-core
utils/_context/_scenarios/agentless_endtoend.py                         @DataDog/system-tests-core

datadog-datadog-prod-us1 · 2026-08-12T00:46:25Z

⚠️ Warnings

🚦 3 Pipeline jobs failed

Testing the test | System Tests (java, prod) / End-to-end #2 / spring-boot 2 — ❌ 1 test failed · 🔧 Needs a code fix, caused by this PR

View in Datadog · View in GitHub Actions

1 failed test. AssertionError: Timed out waiting for exposure event for 'empty-targeting-key-flag' and 'exposure-egress-user' in tests/ffe/utils/exposures.py:66.
Showing tests most relevant to this failure.
❌ tests.ffe.test_exposure_egress.Test_FFE_Exposure_Egress_Agentless_Sidecar.test_exposure_egress[spring-boot] from system_tests_suite
AssertionError: Timed out waiting for exposure event for &#39;empty-targeting-key-flag&#39; and &#39;exposure-egress-user&#39;

self = &lt;tests.ffe.test_exposure_egress.Test_FFE_Exposure_Egress_Agentless_Sidecar object at 0x7fe060fcdb50&gt;

    def test_exposure_egress(self) -&gt; None:
        egress = exposure_egress()
&gt;       matching_requests = assert_exposure_side_effects_contract(
            egress.interface,
            self.responses,
            flag_key=self.flag_key,
...
Testing the test | System Tests (java, dev) / Build end-to-end (spring-boot-payara)

View in Datadog · View in GitHub Actions

Could not transfer artifact org.springframework.boot:spring-boot-starter-parent:pom:2.6.0 due to HTTP status code 429: Too Many Requests. Parent.relativePath points at wrong local POM at line 10, column 13.

Testing the test | all-jobs-are-green

View in Datadog · View in GitHub Actions

Multiple check runs failed during CI process.
📋 Copy prompt for your agent
CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Branch: agent/java-agentless-serverless-exposures-java

Testing the test | System Tests (java, prod) / End-to-end #2 / spring-boot 2
Commit: c1bf36a6df801c53bf48cd01c5e7411bdbc96b61
Error (code / test):
1 failed test. AssertionError: Timed out waiting for exposure event for 'empty-targeting-key-flag' and 'exposure-egress-user' in tests/ffe/utils/exposures.py:66.
CI job: https://github.com/DataDog/system-tests/actions/runs/32223468875/job/95980200820

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: be5a4bf | Docs | View more details | Give us feedback!}

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds support for capturing agentless Java Spring Boot exposure egress through the HTTPS proxy by injecting the proxy CA into the JVM trust store and tightening/streamlining exposure-event synchronization in tests.

Changes:

Introduces a Java startup wrapper that imports the mitmproxy CA into a temporary truststore and points the JVM at it.
Updates the agentless end-to-end scenario to mount the wrapper + CA cert only for the Java spring-boot variant and set HTTPS proxy JVM properties.
Refactors exposure tests/utilities to wait explicitly for exposure events and updates manifest gating for Java tracer versions.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
utils/build/docker/java/app-with-proxy-ca.sh	New Java entrypoint wrapper that installs proxy CA into a temp truststore and starts the Spring Boot app.
utils/_context/_scenarios/agentless_endtoend.py	Configures the Java Spring Boot container to use the wrapper + proxy CA when exposure egress is enabled.
tests/test_the_test/test_mock_ffe_agentless_backend.py	Adds a regression test ensuring only the standard Java Spring Boot variant is modified by the wrapper logic.
tests/ffe/utils/exposures.py	Extracts “wait for exposure event” into a reusable helper used by contract assertions.
tests/ffe/test_exposure_egress.py	Adjusts UFC fixture/expectations and adds an explicit wait for the exposure event during setup.
manifests/java.yml	Updates the Java manifest to gate agentless direct exposure egress on tracer version.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+        library_container.environment["JAVA_OPTS"] = (
+            f"-Dhttps.proxyHost=proxy -Dhttps.proxyPort={ProxyPorts.datadog_direct}"


+  -keystore "${trust_store}" \
+  -storepass changeit
+
+JAVA_OPTS="${JAVA_OPTS:-} -Djavax.net.ssl.trustStore=${trust_store} -Djavax.net.ssl.trustStorePassword=changeit"


+# shellcheck disable=SC2086
+exec java -Xmx362m ${JAVA_OPTS} -javaagent:/app/dd-java-agent.jar -jar /app/app.jar ${APP_EXTRA_ARGS:-}


+        egress = exposure_egress()
+        wait_for_exposure_event(
+            egress.interface,
+            flag_key=self.flag_key,
+            targeting_key=self.targeting_key,
+        )


This was referenced Aug 12, 2026

Prototype SSI OpenFeature provider injection DataDog/dd-trace-java#12192

Draft

Send agentless Feature Flags exposures directly to EVP DataDog/dd-trace-java#12195

Merged

leoromanovsky changed the title ~~test(ffe): enable Java agentless exposure egress [java@agent/ssi-openfeature-provider-spike]~~ test(ffe): enable Java agentless exposure egress [java@agent/java-direct-exposure-egress] Aug 12, 2026

leoromanovsky changed the title ~~test(ffe): enable Java agentless exposure egress [java@agent/java-direct-exposure-egress]~~ test(ffe): enable Java agentless exposure egress [java@agent/java-direct-flagevaluation-egress] Aug 14, 2026

Base automatically changed from agent/nodejs-agentless-serverless-exposures to main August 18, 2026 04:44

test(ffe): enable Java agentless exposure egress

366ac3b

leoromanovsky force-pushed the agent/java-agentless-serverless-exposures-java branch from 21c6a56 to 366ac3b Compare August 18, 2026 21:38

leoromanovsky changed the title ~~test(ffe): enable Java agentless exposure egress [java@agent/java-direct-flagevaluation-egress]~~ test(ffe): enable Java agentless exposure egress Aug 18, 2026

fix(ffe): scope Java exposure startup wrapper

5dccf84

leoromanovsky changed the title ~~test(ffe): enable Java agentless exposure egress~~ test(ffe): validate Java agentless exposure egress Aug 18, 2026

leoromanovsky added 2 commits August 18, 2026 15:56

fix(ffe): type exposure weblog fixture

93cea77

fix(ffe): gate direct Java exposures by version

63c14c4

leoromanovsky requested a lite review from Copilot August 19, 2026 04:28

Copilot AI reviewed Aug 19, 2026

View reviewed changes

fix(ffe): address Java exposure review

be5a4bf

Navigation Menu

Uh oh!

test(ffe): validate Java agentless exposure egress - #7494

test(ffe): validate Java agentless exposure egress#7494
leoromanovsky wants to merge 5 commits into
mainfrom
agent/java-agentless-serverless-exposures-java

leoromanovsky commented Aug 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 12, 2026 •

edited

Loading

Uh oh!

datadog-datadog-prod-us1 Bot commented Aug 12, 2026 •

edited by datadog-prod-us1-4 Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		library_container.environment["JAVA_OPTS"] = (
		f"-Dhttps.proxyHost=proxy -Dhttps.proxyPort={ProxyPorts.datadog_direct}"

		# shellcheck disable=SC2086
		exec java -Xmx362m ${JAVA_OPTS} -javaagent:/app/dd-java-agent.jar -jar /app/app.jar ${APP_EXTRA_ARGS:-}

Uh oh!

Conversation

leoromanovsky commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Changes and Decisions

Validation

Uh oh!

github-actions Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

datadog-datadog-prod-us1 Bot commented Aug 12, 2026 • edited by datadog-prod-us1-4 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

leoromanovsky commented Aug 11, 2026 •

edited

Loading

github-actions Bot commented Aug 12, 2026 •

edited

Loading

datadog-datadog-prod-us1 Bot commented Aug 12, 2026 •

edited by datadog-prod-us1-4 Bot

Loading