Enable API Security by default and make it lazy loading #9009
+89
−61
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
smola
force-pushed
the
smola/api-security-startup-time
branch
from
33d425a to
bc849b6
Compare
smola
commented
Jun 19, 2025
| @@ -258,8 +258,9 @@ class GatewayBridgeSpecification extends DDSpecification { | |||
| ctx.data.rawURI = '/' | |||
| ctx.data.peerAddress = '0.0.0.0' | |||
| eventDispatcher.getDataSubscribers(_) >> nonEmptyDsInfo | |||
| eventDispatcher.publishDataEvent(nonEmptyDsInfo, ctx.data, _ as DataBundle, _ as GatewayContext) >> | |||
| { bundle = it[2]; NoopFlow.INSTANCE } | |||
| eventDispatcher.publishDataEvent(nonEmptyDsInfo, ctx.data, _ as DataBundle, _ as GatewayContext) >> { | |||
There was a problem hiding this comment.
From here onwards, this is just spotless being funny.
There was a problem hiding this comment.
Let it have its fun then 😓
BenchmarksStartupParameters
See matching parameters
SummaryFound 1 performance improvements and 0 performance regressions! Performance is the same for 40 metrics, 12 unstable metrics.
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.50.0-SNAPSHOT~ba6bea4fa9, baseline=1.50.0-SNAPSHOT~f47ab3945d
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.029 s) : 0, 1029298
Total [baseline] (8.548 s) : 0, 8547935
Agent [candidate] (1.025 s) : 0, 1025049
Total [candidate] (8.565 s) : 0, 8564893
section iast
Agent [baseline] (1.153 s) : 0, 1152828
Total [baseline] (9.191 s) : 0, 9190826
Agent [candidate] (1.156 s) : 0, 1155699
Total [candidate] (9.184 s) : 0, 9184397
gantt
title insecure-bank - break down per module: candidate=1.50.0-SNAPSHOT~ba6bea4fa9, baseline=1.50.0-SNAPSHOT~f47ab3945d
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (686.403 ms) : 0, 686403
BytebuddyAgent [candidate] (683.385 ms) : 0, 683385
GlobalTracer [baseline] (242.662 ms) : 0, 242662
GlobalTracer [candidate] (241.147 ms) : 0, 241147
AppSec [baseline] (56.448 ms) : 0, 56448
AppSec [candidate] (56.563 ms) : 0, 56563
Debugger [baseline] (9.132 ms) : 0, 9132
Debugger [candidate] (7.024 ms) : 0, 7024
Remote Config [baseline] (750.422 µs) : 0, 750
Remote Config [candidate] (720.53 µs) : 0, 721
Telemetry [baseline] (10.406 ms) : 0, 10406
Telemetry [candidate] (12.759 ms) : 0, 12759
section iast
BytebuddyAgent [baseline] (804.652 ms) : 0, 804652
BytebuddyAgent [candidate] (805.932 ms) : 0, 805932
GlobalTracer [baseline] (231.155 ms) : 0, 231155
GlobalTracer [candidate] (231.733 ms) : 0, 231733
IAST [baseline] (26.022 ms) : 0, 26022
IAST [candidate] (26.934 ms) : 0, 26934
AppSec [baseline] (52.213 ms) : 0, 52213
AppSec [candidate] (53.055 ms) : 0, 53055
Debugger [baseline] (5.94 ms) : 0, 5940
Debugger [candidate] (5.983 ms) : 0, 5983
Remote Config [baseline] (594.555 µs) : 0, 595
Remote Config [candidate] (616.79 µs) : 0, 617
Telemetry [baseline] (7.919 ms) : 0, 7919
Telemetry [candidate] (8.015 ms) : 0, 8015
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.50.0-SNAPSHOT~ba6bea4fa9, baseline=1.50.0-SNAPSHOT~f47ab3945d
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.02 s) : 0, 1020153
Total [baseline] (10.512 s) : 0, 10512201
Agent [candidate] (1.03 s) : 0, 1029927
Total [candidate] (10.509 s) : 0, 10509131
section appsec
Agent [baseline] (1.185 s) : 0, 1184695
Total [baseline] (10.722 s) : 0, 10722031
Agent [candidate] (1.187 s) : 0, 1187242
Total [candidate] (10.71 s) : 0, 10710376
section iast
Agent [baseline] (1.17 s) : 0, 1169770
Total [baseline] (10.88 s) : 0, 10880316
Agent [candidate] (1.155 s) : 0, 1155382
Total [candidate] (10.897 s) : 0, 10897440
section profiling
Agent [baseline] (1.263 s) : 0, 1263151
Total [baseline] (10.864 s) : 0, 10864275
Agent [candidate] (1.279 s) : 0, 1278612
Total [candidate] (10.96 s) : 0, 10959991
gantt
title petclinic - break down per module: candidate=1.50.0-SNAPSHOT~ba6bea4fa9, baseline=1.50.0-SNAPSHOT~f47ab3945d
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (681.63 ms) : 0, 681630
BytebuddyAgent [candidate] (688.058 ms) : 0, 688058
GlobalTracer [baseline] (240.128 ms) : 0, 240128
GlobalTracer [candidate] (242.307 ms) : 0, 242307
AppSec [baseline] (56.968 ms) : 0, 56968
AppSec [candidate] (59.4 ms) : 0, 59400
Debugger [baseline] (8.367 ms) : 0, 8367
Debugger [candidate] (6.913 ms) : 0, 6913
Remote Config [baseline] (736.338 µs) : 0, 736
Remote Config [candidate] (666.291 µs) : 0, 666
Telemetry [baseline] (8.95 ms) : 0, 8950
Telemetry [candidate] (8.968 ms) : 0, 8968
section appsec
BytebuddyAgent [baseline] (712.243 ms) : 0, 712243
BytebuddyAgent [candidate] (711.891 ms) : 0, 711891
GlobalTracer [baseline] (236.988 ms) : 0, 236988
GlobalTracer [candidate] (236.594 ms) : 0, 236594
IAST [baseline] (22.239 ms) : 0, 22239
IAST [candidate] (21.925 ms) : 0, 21925
AppSec [baseline] (175.796 ms) : 0, 175796
AppSec [candidate] (179.496 ms) : 0, 179496
Debugger [baseline] (5.929 ms) : 0, 5929
Debugger [candidate] (5.813 ms) : 0, 5813
Remote Config [baseline] (616.017 µs) : 0, 616
Remote Config [candidate] (629.553 µs) : 0, 630
Telemetry [baseline] (7.276 ms) : 0, 7276
Telemetry [candidate] (7.3 ms) : 0, 7300
section iast
BytebuddyAgent [baseline] (816.885 ms) : 0, 816885
BytebuddyAgent [candidate] (805.719 ms) : 0, 805719
GlobalTracer [baseline] (234.199 ms) : 0, 234199
GlobalTracer [candidate] (231.645 ms) : 0, 231645
IAST [baseline] (27.556 ms) : 0, 27556
IAST [candidate] (26.03 ms) : 0, 26030
AppSec [baseline] (52.613 ms) : 0, 52613
AppSec [candidate] (53.883 ms) : 0, 53883
Debugger [baseline] (6.018 ms) : 0, 6018
Debugger [candidate] (5.956 ms) : 0, 5956
Remote Config [baseline] (618.105 µs) : 0, 618
Remote Config [candidate] (600.737 µs) : 0, 601
Telemetry [baseline] (8.088 ms) : 0, 8088
Telemetry [candidate] (8.02 ms) : 0, 8020
section profiling
BytebuddyAgent [baseline] (673.298 ms) : 0, 673298
BytebuddyAgent [candidate] (680.44 ms) : 0, 680440
GlobalTracer [baseline] (359.223 ms) : 0, 359223
GlobalTracer [candidate] (362.728 ms) : 0, 362728
AppSec [baseline] (61.94 ms) : 0, 61940
AppSec [candidate] (62.8 ms) : 0, 62800
Debugger [baseline] (6.078 ms) : 0, 6078
Debugger [candidate] (6.172 ms) : 0, 6172
Remote Config [baseline] (656.775 µs) : 0, 657
Remote Config [candidate] (670.803 µs) : 0, 671
Telemetry [baseline] (8.123 ms) : 0, 8123
Telemetry [candidate] (8.322 ms) : 0, 8322
ProfilingAgent [baseline] (103.127 ms) : 0, 103127
ProfilingAgent [candidate] (106.267 ms) : 0, 106267
Profiling [baseline] (103.151 ms) : 0, 103151
Profiling [candidate] (106.292 ms) : 0, 106292
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 4 performance regressions! Performance is the same for 8 metrics, 12 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.50.0-SNAPSHOT~ba6bea4fa9, baseline=1.50.0-SNAPSHOT~f47ab3945d
dateFormat X
axisFormat %s
section baseline
no_agent (35.985 ms) : 35693, 36278
. : milestone, 35985,
appsec (46.953 ms) : 46529, 47377
. : milestone, 46953,
code_origins (44.545 ms) : 44192, 44898
. : milestone, 44545,
iast (44.947 ms) : 44555, 45340
. : milestone, 44947,
profiling (47.736 ms) : 47234, 48239
. : milestone, 47736,
tracing (43.47 ms) : 43094, 43845
. : milestone, 43470,
section candidate
no_agent (37.295 ms) : 36996, 37594
. : milestone, 37295,
appsec (46.394 ms) : 45982, 46807
. : milestone, 46394,
code_origins (44.35 ms) : 43994, 44706
. : milestone, 44350,
iast (46.497 ms) : 46096, 46899
. : milestone, 46497,
profiling (47.729 ms) : 47252, 48206
. : milestone, 47729,
tracing (45.992 ms) : 45605, 46379
. : milestone, 45992,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.50.0-SNAPSHOT~ba6bea4fa9, baseline=1.50.0-SNAPSHOT~f47ab3945d
dateFormat X
axisFormat %s
section baseline
no_agent (4.396 ms) : 4340, 4452
. : milestone, 4396,
iast (9.021 ms) : 8860, 9183
. : milestone, 9021,
iast_FULL (13.642 ms) : 13368, 13917
. : milestone, 13642,
iast_GLOBAL (10.448 ms) : 10265, 10632
. : milestone, 10448,
profiling (8.885 ms) : 8724, 9046
. : milestone, 8885,
tracing (7.27 ms) : 7162, 7378
. : milestone, 7270,
section candidate
no_agent (4.295 ms) : 4247, 4344
. : milestone, 4295,
iast (9.163 ms) : 9010, 9315
. : milestone, 9163,
iast_FULL (13.598 ms) : 13328, 13869
. : milestone, 13598,
iast_GLOBAL (10.053 ms) : 9874, 10232
. : milestone, 10053,
profiling (8.883 ms) : 8743, 9024
. : milestone, 8883,
tracing (7.623 ms) : 7510, 7736
. : milestone, 7623,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics. Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.50.0-SNAPSHOT~ba6bea4fa9, baseline=1.50.0-SNAPSHOT~f47ab3945d
dateFormat X
axisFormat %s
section baseline
no_agent (1.478 ms) : 1466, 1490
. : milestone, 1478,
appsec (2.405 ms) : 2357, 2454
. : milestone, 2405,
iast (2.185 ms) : 2124, 2246
. : milestone, 2185,
iast_GLOBAL (2.238 ms) : 2177, 2300
. : milestone, 2238,
profiling (2.02 ms) : 1972, 2069
. : milestone, 2020,
tracing (2.002 ms) : 1955, 2049
. : milestone, 2002,
section candidate
no_agent (1.477 ms) : 1466, 1489
. : milestone, 1477,
appsec (2.398 ms) : 2350, 2446
. : milestone, 2398,
iast (2.187 ms) : 2126, 2248
. : milestone, 2187,
iast_GLOBAL (2.231 ms) : 2170, 2293
. : milestone, 2231,
profiling (2.034 ms) : 1985, 2083
. : milestone, 2034,
tracing (2.005 ms) : 1958, 2053
. : milestone, 2005,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.50.0-SNAPSHOT~ba6bea4fa9, baseline=1.50.0-SNAPSHOT~f47ab3945d
dateFormat X
axisFormat %s
section baseline
no_agent (15.245 s) : 15245000, 15245000
. : milestone, 15245000,
appsec (14.818 s) : 14818000, 14818000
. : milestone, 14818000,
iast (18.365 s) : 18365000, 18365000
. : milestone, 18365000,
iast_GLOBAL (17.726 s) : 17726000, 17726000
. : milestone, 17726000,
profiling (14.974 s) : 14974000, 14974000
. : milestone, 14974000,
tracing (14.596 s) : 14596000, 14596000
. : milestone, 14596000,
section candidate
no_agent (15.589 s) : 15589000, 15589000
. : milestone, 15589000,
appsec (15.032 s) : 15032000, 15032000
. : milestone, 15032000,
iast (18.956 s) : 18956000, 18956000
. : milestone, 18956000,
iast_GLOBAL (18.096 s) : 18096000, 18096000
. : milestone, 18096000,
profiling (15.83 s) : 15830000, 15830000
. : milestone, 15830000,
tracing (15.027 s) : 15027000, 15027000
. : milestone, 15027000,
|
smola
force-pushed
the
smola/api-security-startup-time
branch
from
bc849b6 to
9ad217d
Compare
smola
changed the title
smola
force-pushed
the
smola/api-security-startup-time
branch
from
9ad217d to
744ce49
Compare
smola
force-pushed
the
smola/api-security-startup-time
branch
from
744ce49 to
ba6bea4
Compare
|
Hi! 👋 Thanks for your pull request! 🎉 To help us review it, please make sure to:
If you need help, please check our contributing guidelines. |
sezen-datadog
approved these changes
Jun 20, 2025
| // We initialize API Security the first time AppSec becomes active. | ||
| // We never de-initialize it, as that could lead to a leak of open WAF contexts in-flight. | ||
| if (API_SECURITY_INITIALIZED.compareAndSet(false, true)) { | ||
| if (SpanPostProcessor.Holder.INSTANCE == SpanPostProcessor.Holder.NOOP) { |
There was a problem hiding this comment.
Correctly if I'm wrong, but this should also have a positive effect on span processing overhead when appsec is disabled right? (I'm asking because of the regressions in the high_load benchmarks, that might be spurious)
There was a problem hiding this comment.
Yes, this should ensure that the post-processor is always no-op unless enabled.
manuel-alvarez-alvarez
approved these changes
Jun 20, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
Bring back #8511
Original attempt was reverted because of a regression in startup time. This PR brings back the feature, but with lazy loading of the sampling, which removes the startup overhead when AppSec is not enabled.
Change
DD_API_SECURITY_ENABLED=trueby default. This should have impact only when AppSec is enabled.This feature es effectively enabled only if AppSec is also enabled.
Motivation
API Security is now core functionality to the App & API Protection (AppSec), so we want it to be available by default to all AppSec customers.
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any usefull labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: APPSEC-57850