Merge branch 'main' into main-to-serverless

Author: fr4nc1sc0-r4m0n

.github/dependabot.yml

@@ -9,6 +9,7 @@ updates:
       - automation
       - skip-changelog
       - Team:Elastic-Agent-Control-Plane
+      - backport-active-all
     allow:
       # Only update internal dependencies for now while we evaluate this workflow.
       - dependency-name: "github.com/elastic/*"
@@ -29,4 +30,5 @@ updates:
       - automation
       - skip-changelog
       - Team:Elastic-Agent-Control-Plane
+      - backport-active-all
     open-pull-requests-limit: 10

.package-version

@@ -1,8 +1,8 @@
 {
   "version": "9.2.0-SNAPSHOT",
-  "build_id": "9.2.0-021aded8",
-  "manifest_url": "https://snapshots.elastic.co/9.2.0-021aded8/manifest-9.2.0-SNAPSHOT.json",
-  "summary_url": "https://snapshots.elastic.co/9.2.0-021aded8/summary-9.2.0-SNAPSHOT.html",
+  "build_id": "9.2.0-0df011a0",
+  "manifest_url": "https://snapshots.elastic.co/9.2.0-0df011a0/manifest-9.2.0-SNAPSHOT.json",
+  "summary_url": "https://snapshots.elastic.co/9.2.0-0df011a0/summary-9.2.0-SNAPSHOT.html",
   "core_version": "9.2.0",
-  "stack_build_id": "9.2.0-021aded8-SNAPSHOT"
+  "stack_build_id": "9.2.0-0df011a0-SNAPSHOT"
 }

NOTICE-fips.txt

@@ -0,0 +1,32 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: feature
+
+# Change summary; a 80ish characters long description of the change.
+summary: Add the dockerstats OpenTelemetry receiver
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+#description:
+
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: elastic-agent
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+#pr: https://github.com/owner/repo/1234
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: https://github.com/owner/repo/1234

NOTICE.txt

@@ -0,0 +1,32 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: security
+
+# Change summary; a 80ish characters long description of the change.
+summary: redact secrets from pre-config, computed-config, components-expected, and components-actual files in diagnostics archive
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+#description:
+
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: elastic-agent
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+pr: https://github.com/elastic/elastic-agent/pull/9560
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: https://github.com/owner/repo/1234

changelog/fragments/1755168462-add_dockerstats_receiver.yaml

@@ -14,7 +14,7 @@ require (
 	github.com/docker/docker v28.2.2+incompatible
 	github.com/docker/go-units v0.5.0
 	github.com/dolmen-go/contextio v0.0.0-20200217195037-68fc5150bcd5
-	github.com/elastic/beats/v7 v7.0.0-alpha2.0.20250822231535-5c4aea744997
+	github.com/elastic/beats/v7 v7.0.0-alpha2.0.20250826200704-344c05cb956d
 	github.com/elastic/cloud-on-k8s/v2 v2.0.0-20250327073047-b624240832ae
 	github.com/elastic/elastic-agent-autodiscover v0.10.0
 	github.com/elastic/elastic-agent-client/v7 v7.17.2
@@ -31,7 +31,7 @@ require (
 	github.com/elastic/opentelemetry-collector-components/extension/apmconfigextension v0.5.0
 	github.com/elastic/opentelemetry-collector-components/processor/elasticinframetricsprocessor v0.16.0
 	github.com/elastic/opentelemetry-collector-components/processor/elastictraceprocessor v0.9.0
-	github.com/elastic/opentelemetry-collector-components/receiver/elasticapmintakereceiver v0.2.0
+	github.com/elastic/opentelemetry-collector-components/receiver/elasticapmintakereceiver v0.2.1
 	github.com/fatih/color v1.18.0
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/go-viper/mapstructure/v2 v2.3.0
@@ -128,6 +128,7 @@ require (
 	github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor v0.130.0
 	github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourceprocessor v0.130.0
 	github.com/open-telemetry/opentelemetry-collector-contrib/processor/transformprocessor v0.130.0
+	github.com/open-telemetry/opentelemetry-collector-contrib/receiver/dockerstatsreceiver v0.130.0
 	github.com/open-telemetry/opentelemetry-collector-contrib/receiver/filelogreceiver v0.130.0
 	github.com/open-telemetry/opentelemetry-collector-contrib/receiver/hostmetricsreceiver v0.130.0
 	github.com/open-telemetry/opentelemetry-collector-contrib/receiver/httpcheckreceiver v0.130.0
@@ -505,7 +506,6 @@ require (
 	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/go-archive v0.1.0 // indirect
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
@@ -528,6 +528,7 @@ require (
 	github.com/open-telemetry/opentelemetry-collector-contrib/internal/aws/ecsutil v0.130.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/internal/common v0.130.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/internal/coreinternal v0.130.0 // indirect
+	github.com/open-telemetry/opentelemetry-collector-contrib/internal/docker v0.130.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/internal/exp/metrics v0.130.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/internal/filter v0.130.0 // indirect
 	github.com/open-telemetry/opentelemetry-collector-contrib/internal/gopsutilenv v0.130.0 // indirect

changelog/fragments/1756122869-update-secret-redaction-in-diagnostics.yaml

@@ -487,8 +487,8 @@ github.com/elastic/azure-sdk-for-go/sdk/resourcemanager/consumption/armconsumpti
 github.com/elastic/azure-sdk-for-go/sdk/resourcemanager/consumption/armconsumption v1.1.0-elastic/go.mod h1:0vCBR1wgGwZeGmloJ+eCWIZF2S47grTXRzj2mftg2Nk=
 github.com/elastic/bayeux v1.0.5 h1:UceFq01ipmT3S8DzFK+uVAkbCdiPR0Bqei8qIGmUeY0=
 github.com/elastic/bayeux v1.0.5/go.mod h1:CSI4iP7qeo5MMlkznGvYKftp8M7qqP/3nzmVZoXHY68=
-github.com/elastic/beats/v7 v7.0.0-alpha2.0.20250822231535-5c4aea744997 h1:v5Hc8SkU9N+HCGx+G2nfvfeFZpuK/KovAQ8kScsQBKs=
-github.com/elastic/beats/v7 v7.0.0-alpha2.0.20250822231535-5c4aea744997/go.mod h1:pkd9sbgefnW9S/YlGBo79EoWZiohxbECjHE35fpUf94=
+github.com/elastic/beats/v7 v7.0.0-alpha2.0.20250826200704-344c05cb956d h1:B26iRJoWBd3LcKWXDfJfY8/X1CevgbH7Dt/0wLU1WN4=
+github.com/elastic/beats/v7 v7.0.0-alpha2.0.20250826200704-344c05cb956d/go.mod h1:IThpxJYXUYsJZ/XjllGJ1rUp64/c6ii/sM1FE+G2ieI=
 github.com/elastic/cloud-on-k8s/v2 v2.0.0-20250327073047-b624240832ae h1:OiShmbWAyGU0MS0ADJWr1/QgeLIZliMk9xsrFicR3/s=
 github.com/elastic/cloud-on-k8s/v2 v2.0.0-20250327073047-b624240832ae/go.mod h1:D2IckZVXARugvikE4fv1glvaJMohKSZRzrPsxCjo9O0=
 github.com/elastic/elastic-agent-autodiscover v0.10.0 h1:WJ4zl9uSfk1kHmn2B/0byQBLIL607Zt4LNfOgV7+XN0=
@@ -557,8 +557,8 @@ github.com/elastic/opentelemetry-collector-components/processor/elastictraceproc
 github.com/elastic/opentelemetry-collector-components/processor/elastictraceprocessor v0.9.0/go.mod h1:abeJCmXXWoNdCqyIFkzgZAnvK9QkxAqyBLMonlKxAZ0=
 github.com/elastic/opentelemetry-collector-components/processor/lsmintervalprocessor v0.8.0 h1:m2RieHXVTRykAd7VdpryuAV56Ia/eidgtlEutnG/m5w=
 github.com/elastic/opentelemetry-collector-components/processor/lsmintervalprocessor v0.8.0/go.mod h1:uQHpGpKwGHhdO5fm2hx1mthiPMiScmFOp5XNwD0EqVw=
-github.com/elastic/opentelemetry-collector-components/receiver/elasticapmintakereceiver v0.2.0 h1:h1gGRol15HQupkhVW+x5GSI9DcZrjEqPlJCTmf5A9kg=
-github.com/elastic/opentelemetry-collector-components/receiver/elasticapmintakereceiver v0.2.0/go.mod h1:6GD6slW/fYTxZkhBfjk2TaSJHmyevZfyuudIyqXAfwc=
+github.com/elastic/opentelemetry-collector-components/receiver/elasticapmintakereceiver v0.2.1 h1:kcwYI2wQVFYnZojkKtFky3lrFZB1BDmw6SivDffP+qs=
+github.com/elastic/opentelemetry-collector-components/receiver/elasticapmintakereceiver v0.2.1/go.mod h1:6GD6slW/fYTxZkhBfjk2TaSJHmyevZfyuudIyqXAfwc=
 github.com/elastic/opentelemetry-lib v0.21.0 h1:aktZQ6hocz/yVMOikDrdcjWtl/qcK/AfMBundZJTCcQ=
 github.com/elastic/opentelemetry-lib v0.21.0/go.mod h1:mNcdHi6ivTn5w4bE18as43gzKt2rVmK4HCeJZ9JmFXk=
 github.com/elastic/pkcs8 v1.0.0 h1:HhitlUKxhN288kcNcYkjW6/ouvuwJWd9ioxpjnD9jVA=
@@ -1218,6 +1218,8 @@ github.com/open-telemetry/opentelemetry-collector-contrib/internal/common v0.130
 github.com/open-telemetry/opentelemetry-collector-contrib/internal/common v0.130.0/go.mod h1:LSII2PtNQrizYmbcpUl8b1zHF3+xPkJL3F+ITZ1j25Y=
 github.com/open-telemetry/opentelemetry-collector-contrib/internal/coreinternal v0.130.0 h1:UoR/xVnYwybPDA4FhJbuPwU7HvP00Tpgu0YaHEPIOaU=
 github.com/open-telemetry/opentelemetry-collector-contrib/internal/coreinternal v0.130.0/go.mod h1:85OEk8e0NURYWjBzmXxoNRlpLTxWA1YwFjcBll1uAFk=
+github.com/open-telemetry/opentelemetry-collector-contrib/internal/docker v0.130.0 h1:wkRGpP4jht7Dmboa/0ZKfVjfYzZU3BsySRfK3vblcUo=
+github.com/open-telemetry/opentelemetry-collector-contrib/internal/docker v0.130.0/go.mod h1:hbeMduPd1RYmljh9Z2/NgbKvFIfp7U4J3IGGOYLZE5c=
 github.com/open-telemetry/opentelemetry-collector-contrib/internal/exp/metrics v0.130.0 h1:uj6ai6KVAY0KFeXn0tTTfvnFCF+WCMM7jfSMk7uZa3g=
 github.com/open-telemetry/opentelemetry-collector-contrib/internal/exp/metrics v0.130.0/go.mod h1:vggHY5WvnwKCuPW0hEIkWtctseFY6MjRLC+x7C2eN4k=
 github.com/open-telemetry/opentelemetry-collector-contrib/internal/filter v0.130.0 h1:imJFA+dRC4qVtza0SL/UuYTrnc68zpt2uvUkh9QAXI4=
@@ -1294,6 +1296,8 @@ github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourceproc
 github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourceprocessor v0.130.0/go.mod h1:wU38xs5JMy8FYLVDw5F1/ShVgN0nYauna5Wj0qyL/Vk=
 github.com/open-telemetry/opentelemetry-collector-contrib/processor/transformprocessor v0.130.0 h1:/UagoKsz1+NAOkNIaoSiE5nW+7OiT/3tG91WsIDuHeU=
 github.com/open-telemetry/opentelemetry-collector-contrib/processor/transformprocessor v0.130.0/go.mod h1:4VAXR5a89aHYFQYvNGkO/5yv1QYfF+sc8+fcMyWdRLE=
+github.com/open-telemetry/opentelemetry-collector-contrib/receiver/dockerstatsreceiver v0.130.0 h1:c4YGI4SI5xZJbW23/SAoclPbpg/0v7qgugOs3rztRfM=
+github.com/open-telemetry/opentelemetry-collector-contrib/receiver/dockerstatsreceiver v0.130.0/go.mod h1:2M2fJOvju5DAPgCceMDrX0xQwMipstgEbW6MrtwadhY=
 github.com/open-telemetry/opentelemetry-collector-contrib/receiver/filelogreceiver v0.130.0 h1:44PeSCFt4J6i84dgB+Elme7YmC2PlL0Os0tMIx1gcFU=
 github.com/open-telemetry/opentelemetry-collector-contrib/receiver/filelogreceiver v0.130.0/go.mod h1:3yzRJ95JrcxqLE9d6HnYIf9ONtTIeUIDP/A9EiKF1h4=
 github.com/open-telemetry/opentelemetry-collector-contrib/receiver/hostmetricsreceiver v0.130.0 h1:OuaYQSPAMuXGPyClRWk044zxQVlzOoAftqJs304vLB4=

go.mod

@@ -357,6 +357,9 @@ type Coordinator struct {
 	// run a ticker that checks to see if we have a new PID.
 	componentPIDTicker         *time.Ticker
 	componentPidRequiresUpdate *atomic.Bool
+
+	// Abstraction for diagnostics AddSecretMarkers function for testability
+	secretMarkerFunc func(*logger.Logger, *config.Config) error
 }
 
 // The channels Coordinator reads to receive updates from the various managers.
@@ -476,7 +479,8 @@ func New(
 		componentPIDTicker:         time.NewTicker(time.Second * 30),
 		componentPidRequiresUpdate: &atomic.Bool{},
 
-		fleetAcker: fleetAcker,
+		fleetAcker:       fleetAcker,
+		secretMarkerFunc: diagnostics.AddSecretMarkers,
 	}
 	// Setup communication channels for any non-nil components. This pattern
 	// lets us transparently accept nil managers / simulated events during
@@ -1475,6 +1479,10 @@ func (c *Coordinator) processConfigAgent(ctx context.Context, cfg *config.Config
 		return err
 	}
 
+	if err = c.secretMarkerFunc(c.logger, cfg); err != nil {
+		c.logger.Errorf("failed to add secret markers: %v", err)
+	}
+
 	// perform and verify ast translation
 	m, err := cfg.ToMapStr()
 	if err != nil {

go.sum

@@ -57,10 +57,16 @@ import (
 	"github.com/elastic/elastic-agent/pkg/component"
 	"github.com/elastic/elastic-agent/pkg/component/runtime"
 	agentclient "github.com/elastic/elastic-agent/pkg/control/v2/client"
+	"github.com/elastic/elastic-agent/pkg/core/logger"
 	"github.com/elastic/elastic-agent/pkg/core/logger/loggertest"
 	"github.com/elastic/elastic-agent/pkg/utils/broadcaster"
 )
 
+var testSecretMarkerFunc = func(*logger.Logger, *config.Config) error {
+	// no-op secret marker function for testing
+	return nil
+}
+
 func TestVarsManagerError(t *testing.T) {
 	// Set a one-second timeout -- nothing here should block, but if it
 	// does let's report a failure instead of timing out the test runner.
@@ -491,6 +497,7 @@ func TestCoordinatorReportsInvalidPolicy(t *testing.T) {
 		vars:               emptyVars(t),
 		ast:                emptyAST(t),
 		componentPIDTicker: time.NewTicker(time.Second * 30),
+		secretMarkerFunc:   testSecretMarkerFunc,
 	}
 
 	// Send an invalid config update and confirm that Coordinator reports
@@ -607,6 +614,7 @@ func TestCoordinatorReportsComponentModelError(t *testing.T) {
 		vars:               emptyVars(t),
 		ast:                emptyAST(t),
 		componentPIDTicker: time.NewTicker(time.Second * 30),
+		secretMarkerFunc:   testSecretMarkerFunc,
 	}
 
 	// This configuration produces a valid AST but its EQL condition is
@@ -675,7 +683,7 @@ func TestCoordinatorPolicyChangeUpdatesMonitorReloader(t *testing.T) {
 	// does let's report a failure instead of timing out the test runner.
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
 	defer cancel()
-	logger := logp.NewLogger("testing")
+	log := logp.NewLogger("testing")
 
 	configChan := make(chan ConfigChange, 1)
 
@@ -690,10 +698,16 @@ func TestCoordinatorPolicyChangeUpdatesMonitorReloader(t *testing.T) {
 	newServerFn := func(*monitoringCfg.MonitoringConfig) (reload.ServerController, error) {
 		return monitoringServer, nil
 	}
-	monitoringReloader := reload.NewServerReloader(newServerFn, logger, monitoringCfg.DefaultConfig())
+	monitoringReloader := reload.NewServerReloader(newServerFn, log, monitoringCfg.DefaultConfig())
+
+	secretMarkerCalled := false
+	mockSecretMarkerFunc := func(*logger.Logger, *config.Config) error {
+		secretMarkerCalled = true
+		return nil
+	}
 
 	coord := &Coordinator{
-		logger:           logger,
+		logger:           log,
 		agentInfo:        &info.AgentInfo{},
 		stateBroadcaster: broadcaster.New(State{}, 0, 0),
 		managerChans: managerChans{
@@ -703,6 +717,7 @@ func TestCoordinatorPolicyChangeUpdatesMonitorReloader(t *testing.T) {
 		otelMgr:            &fakeOTelManager{},
 		vars:               emptyVars(t),
 		componentPIDTicker: time.NewTicker(time.Second * 30),
+		secretMarkerFunc:   mockSecretMarkerFunc,
 	}
 	coord.RegisterMonitoringServer(monitoringReloader)
 
@@ -723,6 +738,8 @@ inputs:
 	coord.runLoopIteration(ctx)
 	assert.True(t, cfgChange.acked, "Coordinator should ACK a successful policy change")
 
+	assert.True(t, secretMarkerCalled, "secret marker should be called")
+
 	// server is started by default
 	assert.True(t, monitoringServer.startTriggered)
 	assert.True(t, monitoringServer.isRunning)
@@ -842,6 +859,7 @@ func TestCoordinatorPolicyChangeUpdatesRuntimeAndOTelManager(t *testing.T) {
 		otelMgr:            otelManager,
 		vars:               emptyVars(t),
 		componentPIDTicker: time.NewTicker(time.Second * 30),
+		secretMarkerFunc:   testSecretMarkerFunc,
 	}
 
 	// Create a policy with one input and one output (no otel configuration)
@@ -1014,6 +1032,7 @@ func TestCoordinatorPolicyChangeUpdatesRuntimeAndOTelManagerWithOtelComponents(t
 		specs:              specs,
 		vars:               emptyVars(t),
 		componentPIDTicker: time.NewTicker(time.Second * 30),
+		secretMarkerFunc:   testSecretMarkerFunc,
 	}
 
 	// Create a policy with one input and one output (no otel configuration)
@@ -1112,6 +1131,7 @@ func TestCoordinatorReportsRuntimeManagerUpdateFailure(t *testing.T) {
 
 		vars:               emptyVars(t),
 		componentPIDTicker: time.NewTicker(time.Second * 30),
+		secretMarkerFunc:   testSecretMarkerFunc,
 	}
 
 	// Send an empty policy which should forward an empty component model to
@@ -1173,6 +1193,7 @@ func TestCoordinatorReportsOTelManagerUpdateFailure(t *testing.T) {
 		otelMgr:            otelManager,
 		vars:               emptyVars(t),
 		componentPIDTicker: time.NewTicker(time.Second * 30),
+		secretMarkerFunc:   testSecretMarkerFunc,
 	}
 
 	// Send an empty policy which should forward an empty component model to
@@ -1237,6 +1258,7 @@ func TestCoordinatorAppliesVarsToPolicy(t *testing.T) {
 		otelMgr:            &fakeOTelManager{},
 		vars:               emptyVars(t),
 		componentPIDTicker: time.NewTicker(time.Second * 30),
+		secretMarkerFunc:   testSecretMarkerFunc,
 	}
 
 	// Create a policy with one input and one output