Allow HTTPS requests to use tls_ciphers
#20179
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAttention: Patch coverage is
Additional details and impacted files
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
dkirov-dd
force-pushed
the
dk/AGENT-12451/tls-ciphers
branch
2 times, most recently
from
0eeb208 to
63b5b09
Compare
datadog-agent-integrations-bot
bot
added
dev_package
integration/envoy
integration/haproxy
integration/kube_dns
integration/kube_proxy
integration/kubelet
integration/powerdns_recursor
integration/spark
integration/vsphere
integration/vault
integration/kube_controller_manager
integration/twistlock
integration/kube_scheduler
integration/kube_metrics_server
integration/amazon_msk
integration/voltdb
integration/citrix_hypervisor
integration/arangodb
integration/cert_manager
integration/vllm
integration/airflow
integration/tls
labels
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| request_overrides = {} | ||
| if new_options.get('verify') != self.options['verify']: | ||
| if new_options.get('verify') is True: |
Check failure
Code scanning / CodeQL
Use of insecure SSL/TLS version High
Copilot Autofix
AI 22 days ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
iliakur
reviewed
Jul 5, 2025
There was a problem hiding this comment.
@dkirov-dd this turns out to be more involved, I'll do it in a separate PR
iliakur
previously approved these changes
Jul 7, 2025
Co-authored-by: Ilia Kurenkov <ilia.kurenkov@datadoghq.com>
temporal-github-worker-1
bot
dismissed
iliakur’s stale review
Review from iliakur is dismissed. Related teams and files:
- agent-integrations
- datadog_checks_base/datadog_checks/base/utils/http.py
iliakur
previously approved these changes
Jul 8, 2025
nubtron
previously approved these changes
Jul 8, 2025
temporal-github-worker-1
bot
dismissed stale reviews from iliakur and nubtron
Review from iliakur is dismissed. Related teams and files:
- agent-integrations
- datadog_checks_base/datadog_checks/base/utils/http.py
- datadog_checks_base/datadog_checks/base/utils/tls.py
- datadog_checks_dev/datadog_checks/dev/plugin/pytest.py
- harbor/tests/conftest.py
Review from nubtron is dismissed. Related teams and files:
- agent-integrations
- datadog_checks_base/datadog_checks/base/utils/http.py
- datadog_checks_base/datadog_checks/base/utils/tls.py
- datadog_checks_dev/datadog_checks/dev/plugin/pytest.py
- harbor/tests/conftest.py
iliakur
approved these changes
Jul 8, 2025
apiazza-dd
approved these changes
Jul 8, 2025
This was referenced Jul 10, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR modifies the behavior of the
RequestsWrapperto make use ofrequests.Sessionfor all requests.It extends the allowed TLS ciphers to all those that are allowed by the compile-time configuration.
This was achieved using the
Sessionclass's HTTPSAdapter, which passes the customSSLContextto the underlyingurllib3functions.Note
Many unit and integration tests that were previously mocking
requests.getor otherrequestsmethods needed to be modified with these changes in mind.N.B: These test should most likely be rewritten in a subsequent PR to use higher-level mocks. This would prevent future PRs that would change logic inside the
RequestsWrapperto have to fix hundreds of tests.Motivation
The integration config provides a
tls_ciphersparameter that was not utilized uniformly throughout HTTPS requests. Most notably, it had no effect on the requests made through the AgentCheck'shttpattribute.Allowing the modification of cipher suites is essential to support the broadest array of use cases.
For example, some users have endpoints that do not accept any of Python's ssl.SSLCipher default cipher suites, leading to these endpoints being unusable with our checks.
Important
The goal for this PR is to only extend the realm of usable endpoints for end users.
All existing interfaces, inputs, and outputs remain unchanged.
No user action is required to benefit from the improvements.
Review checklist (to be filled by reviewers)
qa/skip-qalabel if the PR doesn't need to be tested during QA.backport/<branch-name>label to the PR and it will automatically open a backport PR once this one is merged