feat(profiling)!: TlsConfig for reusable TLS init#1619
Draft
morrisonlevi wants to merge 4 commits intomainfrom
Draft
feat(profiling)!: TlsConfig for reusable TLS init#1619morrisonlevi wants to merge 4 commits intomainfrom
morrisonlevi wants to merge 4 commits intomainfrom
Conversation
📚 Documentation Check Results📦
|
🔒 Cargo Deny Results📦
|
ProfileExporter::new() initializes TLS on every call, which on Linux involves expensive disk I/O to load the system certificate store. Add TlsConfig (wrapping rustls::ClientConfig with the platform verifier) and ProfileExporter::new_with_tls() so callers can initialize TLS once and reuse it across exporter instances. FFI: adds ddog_prof_TlsConfig_new, TlsConfig_try_clone, TlsConfig_drop, and Exporter_new_with_tls via ArcHandle<TlsConfig> for shared ownership. Co-authored-by: Cursor <cursoragent@cursor.com>
Clippy Allow Annotation ReportComparing clippy allow annotations between branches:
Summary by Rule
Annotation Counts by File
Annotation Stats by Crate
About This ReportThis report tracks Clippy allow annotations for specific rules, showing how they've changed in this PR. Decreasing the number of these annotations generally improves code quality. |
morrisonlevi
force-pushed
the
PROF-13824-ProfileExporter-new-creates-TLS-config-every-time
branch
from
c58ab33 to
eb5eef9
Compare
Co-authored-by: Cursor <cursoragent@cursor.com>
2 tasks
BenchmarksComparisonBenchmark execution time: 2026-02-24 14:03:07 Comparing candidate commit 31ed060 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 57 metrics, 2 unstable metrics. CandidateCandidate benchmark detailsGroup 1
Group 2
Group 3
Group 4
Group 5
Group 6
Group 7
Group 8
Group 9
Group 10
Group 11
Group 12
Group 13
Group 14
Group 15
Group 16
Group 17
Group 18
Group 19
BaselineOmitted due to size. |
Contributor
Artifact Size Benchmark Reportaarch64-alpine-linux-musl
aarch64-unknown-linux-gnu
libdatadog-x64-windows
libdatadog-x86-windows
x86_64-alpine-linux-musl
x86_64-unknown-linux-gnu
|
|
✅ Tests 🎉 All green!❄️ No new flaky tests detected 🔗 Commit SHA: 31ed060 | Docs | Datadog PR Page | Was this helpful? Give us feedback! |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #1619 +/- ##
==========================================
- Coverage 71.07% 71.04% -0.03%
==========================================
Files 423 424 +1
Lines 62491 62558 +67
==========================================
+ Hits 44413 44445 +32
- Misses 18078 18113 +35
🚀 New features to boost your workflow:
|
gyuheon0h
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds a
TlsConfigtype that wraps arustls::ClientConfigpre-configuredwith the platform certificate verifier. Callers create a
TlsConfigonceand pass it to the new
ProfileExporter::new_with_tls()constructor,which injects it via
reqwest::ClientBuilder::tls_backend_preconfigured().The old
ProfileExporter::new()and its FFI counterpartddog_prof_Exporter_neware marked#[deprecated].FFI surface:
ddog_prof_TlsConfig_new— creates a ref-counted TLS config handleddog_prof_TlsConfig_try_clone— bumps the ref countddog_prof_TlsConfig_drop— decrements the ref countddog_prof_Exporter_new_with_tls— creates an exporter using apre-built TLS config
Motivation
ProfileExporter::new()callsreqwest::ClientBuilder::build(), whichinitializes TLS from scratch every time. On Linux this means loading and
parsing the system certificate store from disk on every exporter creation
— an expensive operation that was identified as a performance regression
when upgrading libdatadog from v25 to v28.
Additional Notes
TlsConfigisClone(cheap — innerArc), and exposed viaArcHandle<TlsConfig>in FFI for shared, ref-counted ownership.ProfileExporter::new()now delegates toTlsConfig::new()+new_with_tls()internally.Note that in v25, this config caching was done implicitly. I'm not a big fan of statics hidden away in libraries, though, so I'm seeing how a new API goes.
How to test the change?
Linux performance: Create a
TlsConfigonce, then create multipleexporters with
new_with_tls. Verify that only the firstTlsConfig::new()call incurs the certificate loading cost.Backwards compatibility: The old
ddog_prof_Exporter_newcontinuesto work (it creates a
TlsConfiginternally). Callers see adeprecation warning guiding them to the new API.