Skip to content

Document Agent v7.80 windows_certificate tag flags#23774

Open
mrafi97 wants to merge 1 commit into
masterfrom
mrafi/wincert-tags
Open

Document Agent v7.80 windows_certificate tag flags#23774
mrafi97 wants to merge 1 commit into
masterfrom
mrafi/wincert-tags

Conversation

@mrafi97
Copy link
Copy Markdown
Contributor

@mrafi97 mrafi97 commented May 20, 2026

What does this PR do?

Expands the Tags section of windows_certificate/README.md to describe the six opt-in flags added to the Windows Certificate Store integration in Agent v7.80 (datadog-agent#49740) and the per-certificate tags each flag emits:

Flag Tags emitted
certificate_template_tag certificate_template, certificate_template_oid, certificate_template_major_version, certificate_template_minor_version
enhanced_key_usage_tag enhanced_key_usage
friendly_name_tag friendly_name
subject_alternative_names_tag subject_alt_name_dns, subject_alt_name_ip, subject_alt_name_email, subject_alt_name_uri
issuer_tag issuer_CN, issuer_O, issuer_OU, and other issuer DN components when present
signature_algorithm_tag signature_algorithm

All flags default to false.

Motivation

Customers want to slice expiration metrics by additional certificate metadata (template, issuer, EKU, SAN, etc.). The agent-side work landed in datadog-agent#49740 and ships in Agent v7.80; this PR updates the public-facing docs to match. Tracked in WINA-2619 / WINA-2719.

Review checklist (to be filled by reviewers)

  • Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
  • Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
  • If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

Expand the Tags section of the windows_certificate README to describe the
six opt-in flags added in Agent v7.80 (datadog-agent#49740) and the tags
each flag emits.
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ab2fd73e72

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".


| Flag | Tags emitted |
| --- | --- |
| `certificate_template_tag` | `certificate_template`, `certificate_template_oid`, `certificate_template_major_version`, `certificate_template_minor_version` |
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Document the emitted template-name tag

When certificate_template_tag is enabled, the Agent v7.80 implementation emits certificate_template_name for the template display/name value, not certificate_template; certificate_template_oid is only the V2 OID tag. Users following this table would group/filter on a tag that never appears and miss the name tag that is actually emitted.

Useful? React with 👍 / 👎.

@drichards-87 drichards-87 self-assigned this May 20, 2026
Copy link
Copy Markdown
Contributor

@drichards-87 drichards-87 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a suggestion from Docs and approved the PR.


The integration automatically tags all metrics and service checks with the name of the store in the `certificate_store:<STORE>` tag. Certificate metrics and service checks are tagged with the certificate's subjects, thumbprints and serial numbers. CRL metrics and service checks are tagged with the CRL's issuer and thumbprint.

Beginning with Agent v7.80, six opt-in flags expose additional certificate metadata as tags on per-certificate metrics and service checks. Each flag defaults to `false`; set it to `true` in your instance configuration to emit the corresponding tags.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Beginning with Agent v7.80, six opt-in flags expose additional certificate metadata as tags on per-certificate metrics and service checks. Each flag defaults to `false`; set it to `true` in your instance configuration to emit the corresponding tags.
Beginning with Agent v7.80, six opt-in flags expose additional certificate metadata as tags on per-certificate metrics and service checks. Each flag defaults to `false`. Set the value to `true` in your instance configuration to emit the corresponding tags.

@dd-octo-sts
Copy link
Copy Markdown
Contributor

dd-octo-sts Bot commented May 20, 2026

Validation Report

All 20 validations passed.

Show details
Validation Description Status
agent-reqs Verify check versions match the Agent requirements file
ci Validate CI configuration and Codecov settings
codeowners Validate every integration has a CODEOWNERS entry
config Validate default configuration files against spec.yaml
dep Verify dependency pins are consistent and Agent-compatible
http Validate integrations use the HTTP wrapper correctly
imports Validate check imports do not use deprecated modules
integration-style Validate check code style conventions
jmx-metrics Validate JMX metrics definition files and config
labeler Validate PR labeler config matches integration directories
legacy-signature Validate no integration uses the legacy Agent check signature
license-headers Validate Python files have proper license headers
licenses Validate third-party license attribution list
metadata Validate metadata.csv metric definitions
models Validate configuration data models match spec.yaml
openmetrics Validate OpenMetrics integrations disable the metric limit
package Validate Python package metadata and naming
readmes Validate README files have required sections
saved-views Validate saved view JSON file structure and fields
version Validate version consistency between package and changelog

View full run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants