test: add ust docker label tests

Author: Mathew-Estafanous

modules/ecs_fargate/datadog.tf

@@ -183,8 +183,9 @@ locals {
         ),
         # Merge UST docker labels with any existing docker labels.
         dockerLabels = merge(
-          lookup(container, "dockerLabels", {}),
           local.ust_docker_labels,
+          // Placing this after local.ust_docker_labels ensures user defined UST labels are not overwritten.
+          lookup(container, "dockerLabels", {}),
         ),
         # Append new volume mounts to any existing mountPoints.
         mountPoints = concat(
@@ -367,10 +368,9 @@ locals {
   dd_log_container = local.is_fluentbit_supported ? [
     merge(
       {
-        name         = "datadog-log-router"
-        image        = "${var.dd_log_collection.fluentbit_config.registry}:${var.dd_log_collection.fluentbit_config.image_version}"
-        essential    = var.dd_log_collection.fluentbit_config.is_log_router_essential
-        dockerLabels = local.ust_docker_labels
+        name      = "datadog-log-router"
+        image     = "${var.dd_log_collection.fluentbit_config.registry}:${var.dd_log_collection.fluentbit_config.image_version}"
+        essential = var.dd_log_collection.fluentbit_config.is_log_router_essential
         firelensConfiguration = {
           type = "fluentbit"
           options = merge(
@@ -386,6 +386,7 @@ locals {
         user             = "0"
         mountPoints      = var.dd_log_collection.fluentbit_config.mountPoints
         environment      = local.dd_log_agent_env
+        dockerLabels     = local.ust_docker_labels
         portMappings     = []
         systemControls   = []
         volumesFrom      = []

smoke_tests/ecs_fargate/outputs.tf

@@ -37,3 +37,7 @@ output "role-parsing-with-path" {
 output "role-parsing-without-path" {
   value = module.dd_task_role_parsing_without_path
 }
+
+output "ust-docker-labels" {
+  value = module.dd_task_ust_docker_labels
+}

smoke_tests/ecs_fargate/ust-docker-labels.tf

@@ -0,0 +1,51 @@
+# Unless explicitly stated otherwise all files in this repository are licensed
+# under the Apache License Version 2.0.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2025-present Datadog, Inc.
+
+################################################################################
+# Task Definition: UST Docker Labels Test
+################################################################################
+
+module "dd_task_ust_docker_labels" {
+  source = "../../modules/ecs_fargate"
+
+  # Configure Datadog with UST tags
+  dd_api_key  = var.dd_api_key
+  dd_site     = var.dd_site
+  dd_service  = "ust-test-service"
+  dd_env      = "ust-test-env"
+  dd_version  = "1.2.3"
+  dd_tags     = "team:test"
+  dd_essential = true
+  dd_is_datadog_dependency_enabled = true
+
+  dd_log_collection = {
+    enabled = true,
+  }
+
+  dd_cws = {
+    enabled = true,
+  }
+
+  # Configure Task Definition with multiple containers
+  family = "${var.test_prefix}-ust-docker-labels"
+  container_definitions = jsonencode([
+    {
+      name      = "dummy-app",
+      image     = "nginx:latest",
+      essential = true,
+    },
+    {
+      name      = "app-overwritten-ust",
+      image     = "nginx:latest",
+      essential = false,
+      dockerLabels = {
+        "com.datadoghq.tags.service": "different_name",
+        "custom.label" = "custom-value"
+      }
+    }
+  ])
+
+  requires_compatibilities = ["FARGATE"]
+}

tests/ust_docker_labels_test.go

@@ -0,0 +1,53 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2025-present Datadog, Inc.
+
+package test
+
+import (
+	"encoding/json"
+	"log"
+
+	"github.com/aws/aws-sdk-go-v2/service/ecs/types"
+	"github.com/gruntwork-io/terratest/modules/terraform"
+)
+
+// TestUSTDockerLabels tests that UST docker labels are propagated to all container definitions
+// when dd_service, dd_env, and dd_version are set
+func (s *ECSFargateSuite) TestUSTDockerLabels() {
+	log.Println("TestUSTDockerLabels: Running test...")
+
+	// Retrieve the task output for the "ust-docker-labels" module
+	var containers []types.ContainerDefinition
+	task := terraform.OutputMap(s.T(), s.terraformOptions, "ust-docker-labels")
+	s.Equal(s.testPrefix+"-ust-docker-labels", task["family"], "Unexpected task family name")
+
+	err := json.Unmarshal([]byte(task["container_definitions"]), &containers)
+	s.NoError(err, "Failed to parse container definitions")
+	s.Equal(5, len(containers), "Expected 4 containers in the task definition (3 app containers + 1 agent)")
+
+	// Expected UST docker labels that should be present on all application containers
+	expectedUSTLabels := map[string]string{
+		"com.datadoghq.tags.service": "ust-test-service",
+		"com.datadoghq.tags.env":     "ust-test-env",
+		"com.datadoghq.tags.version": "1.2.3",
+	}
+
+	dummyApp, found := GetContainer(containers, "dummy-app")
+	s.True(found, "Container dummy-app not found in definitions")
+	AssertDockerLabels(s.T(), dummyApp, expectedUSTLabels)
+
+	datadogContainers := []string{"datadog-agent", "datadog-log-router", "cws-instrumentation-init"}
+	for _, containerName := range datadogContainers {
+		container, found := GetContainer(containers, containerName)
+		s.True(found, "Container %s not found in definitions", containerName)
+		AssertDockerLabels(s.T(), container, expectedUSTLabels)
+	}
+
+	overwrittenLabels, found := GetContainer(containers, "app-overwritten-ust")
+	s.True(found, "Container app-overwritten-ust not found in definitions")
+	expectedUSTLabels["com.datadoghq.tags.service"] = "different_name"
+	AssertDockerLabels(s.T(), overwrittenLabels, expectedUSTLabels)
+
+}

tests/utils.go

@@ -118,3 +118,14 @@ func AssertContainerDependency(t *testing.T, container types.ContainerDefinition
 	assert.True(t, found, "Expected dependency (container:%s, condition:%s) not found in %s container",
 		*expectedDependency.ContainerName, expectedDependency.Condition, *container.Name)
 }
+
+// AssertDockerLabels checks if the expected docker labels are all present in the container
+func AssertDockerLabels(t *testing.T, container types.ContainerDefinition, expectedLabels map[string]string) {
+	assert.NotNil(t, container.Name, "Container name cannot be nil")
+
+	for key, expectedValue := range expectedLabels {
+		value, found := container.DockerLabels[key]
+		assert.True(t, found, "Docker label %s not found in %s container", key, *container.Name)
+		assert.Equal(t, expectedValue, value, "Docker label %s value does not match expected in %s container", key, *container.Name)
+	}
+}