Add data scrubber config fields for process agent
MODIFY
attributes/default.rb
attributes/default.rb
@@ -367,6 +367,15 @@ default['datadog']['process_agent']['url'] = 'https://process.datadoghq.com'
# Example: ['my-secret-app', 'dbpass']
default['datadog']['process_agent']['blacklist'] = []
+# Controls the behavior of the cmdline data scrubber
+# If enabled, hides every cmdline argument value whose key matches one of the default
+# or custom sensitive words
+# Default sensitive words: ['password', 'passwd', 'mysql_pwd', 'access_token', 'auth_token',
+# 'api_key', 'apikey', 'secret', 'credentials', 'stripetoken']
+default['datadog']['process_agent']['scrub_args'] = true
+# Example for custom sensitive words: ['consul_token', 'token', 'dd_api_key']
+default['datadog']['process_agent']['custom_sensitive_words'] = []
+
# Full path to store process-agent logs to override the default.
default['datadog']['process_agent']['log_file'] = nil

MODIFY
spec/dd-agent_spec.rb
spec/dd-agent_spec.rb
@@ -836,6 +836,8 @@ describe 'datadog::dd-agent' do
process_config:
enabled: "false"
blacklist_patterns: []
+ scrub_args: true
+ custom_sensitive_words: []
intervals: {}
process_dd_url: "https://process.datadoghq.com"
EOF
@@ -885,6 +887,8 @@ describe 'datadog::dd-agent' do
process_config:
enabled: "false"
blacklist_patterns: []
+ scrub_args: true
+ custom_sensitive_words: []
intervals: {}
process_dd_url: "https://process.datadoghq.com"
EOF

MODIFY
templates/default/datadog.conf.erb
templates/default/datadog.conf.erb
@@ -217,6 +217,12 @@ connection_limit: <%= node['datadog']['connection_limit'] %>
<% unless node['datadog']['process_agent']['blacklist'].nil? -%>
blacklist: <%= node['datadog']['process_agent']['blacklist'] %>
<% end -%>
+<% unless node['datadog']['process_agent']['scrub_args'].nil? -%>
+scrub_args: <%= node['datadog']['process_agent']['scrub_args'] %>
+<% end -%>
+<% unless node['datadog']['process_agent']['custom_sensitive_words'].nil? -%>
+custom_sensitive_words: <%= node['datadog']['process_agent']['custom_sensitive_words'].join(',') %>
+<% end -%>
<% unless node['datadog']['process_agent']['process_interval'].nil? -%>
process_interval = <%= node['datadog']['process_agent']['process_interval'] %>
<% end -%>

MODIFY
templates/default/datadog.yaml.erb
templates/default/datadog.yaml.erb
@@ -100,6 +100,8 @@ agent_config = @extra_config.merge({
process_realtime: node['datadog']['process_agent']['rtprocess_interval'],
},
blacklist_patterns: node['datadog']['process_agent']['blacklist'],
+ scrub_args: node['datadog']['process_agent']['scrub_args'],
+ custom_sensitive_words: node['datadog']['process_agent']['custom_sensitive_words'],
process_dd_url: node['datadog']['process_agent']['url']
}
})

Add data scrubber config fields for process agent (#540)