type: user

role: user

content:
You are implementing Task B5 of the "DD Agent Logs via Vector" plan.

## Task Description

Update the DD Agent module's README to document the new `logs_intake_url` variable.

**File to modify:** `/Users/steve.briggs/projects/IAC/terraform/internal-modules/kubernetes/monitoring/datadog-agent/README.md`

Two edits:

### Edit 1: Add `logs_intake_url` to the Inputs table

The Inputs table is around lines 33-58. Locate the row for `log_level` (it should sort alphabetically; the table appears to be roughly alphabetized by name). Insert immediately after the `log_level` row:

```
| <a name="input_logs_intake_url"></a> [logs\_intake\_url](#input\_logs\_intake\_url) | OPW-compatible logs intake URL. When set, the agent ships logs to this endpoint via DD\_OBSERVABILITY\_PIPELINES\_WORKER\_LOGS\_URL. For cluster-internal Vector use module.vector.service\_endpoint\_dd\_agent. When null (default), logs ship direct to Datadog SaaS. | `string` | `null` | no |
```

(Note: keep underscores escaped as `\_` in markdown to match the table's existing style.)

### Edit 2: Append an "OPW Logs Intake" section

At the end of `README.md`, append:

```

## OPW Logs Intake (optional)

By default, the agent ships logs directly to Datadog SaaS over HTTPS. To
redirect logs through a Datadog Observability Pipelines Worker (OPW), or
through a Vector deployment functioning as one, set `logs_intake_url`:

```hcl
module "datadog_agent" {
  # ...
  logs_intake_url = module.vector.service_endpoint_dd_agent
  # e.g. "http://vector.vector.svc.cluster.local:8282"
}
```

This sets two env vars on the agent containers:

- `DD_OBSERVABILITY_PIPELINES_WORKER_LOGS_ENABLED=true`
- `DD_OBSERVABILITY_PIPELINES_WORKER_LOGS_URL=<logs_intake_url>`

Agent-side processing rules (`DD_LOGS_CONFIG_PROCESSING_RULES`) continue to
execute before transmission, regardless of destination. Metrics and APM
(traces) are unaffected and continue shipping direct to Datadog.

When `logs_intake_url` is `null`, the rendered helm values are byte-identical
to the v1.1.x line — there is no behavior change for clusters that do not opt in.

Reference: <https://docs.datadoghq.com/observability_pipelines/sources/datadog_agent/>
```

## Context

Documentation only. No tests.

## CRITICAL — No git operations

Do NOT run any git commands. Sir Charles handles git himself.

## Your Job

1. Read README.md to identify the right insertion points.
2. Make both edits.
3. Self-review by re-reading the file and confirming both edits are present.
4. Report back.

## Report Format

- **Status:** DONE | DONE_WITH_CONCERNS | BLOCKED | NEEDS_CONTEXT
- File modified
- The line numbers where each edit landed
- Any concerns

userType: external

entrypoint: cli

gitBranch: master


type: message

role: assistant

type: text

text: I'll help you update the README for the DD Agent module. Let me start by reading the file to identify the insertion points.

service_tier: standard

attributionAgent: general-purpose

attributionPlugin: superpowers

type: assistant


Read

type: direct


content:
1	## Requirements
2
3	| Name | Version |
4	|------|---------|
5	|  [terraform](#requirement\_terraform) | >= 1.3.0, < 2.0 |
6	|  [helm](#requirement\_helm) | ~> 2.0 |
7	|  [kubernetes](#requirement\_kubernetes) | ~> 2.0 |
8
9	## Providers
10
11	| Name | Version |
12	|------|---------|
13	|  [helm](#provider\_helm) | ~> 2.0 |
14	|  [kubernetes](#provider\_kubernetes) | ~> 2.0 |
15
16	## Modules
17
18	| Name | Source | Version |
19	|------|--------|---------|
20	|  [netpol](#module\_netpol) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/security/network-policy.git | v1.1.0 |
21
22	## Resources
23
24	| Name | Type |
25	|------|------|
26	| [helm_release.this](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
27	| [kubernetes_config_map.datadog_processing_rules](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/config_map) | resource |
28	| [kubernetes_manifest.external-secret](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
29	| [kubernetes_manifest.external-secret-dd-api-key](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
30	| [kubernetes_manifest.external-secret-dd-api-token](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
31	| [kubernetes_namespace.this](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
32
33	## Inputs
34
35	| Name | Description | Type | Default | Required |
36	|------|-------------|------|---------|:--------:|
37	|  [agents\_priority\_class\_name](#input\_agents\_priority\_class\_name) | The priority class name for the Datadog agents. | `string` | `"cloud-ops-system"` | no |
38	|  [apm\_enabled](#input\_apm\_enabled) | Whether to enable APM for the Datadog agent. | `bool` | `true` | no |
39	|  [chart\_version](#input\_chart\_version) | The version of the Datadog Helm chart to use. | `string` | n/a | yes |
40	|  [cluster\_agent\_token\_secret\_name](#input\_cluster\_agent\_token\_secret\_name) | The name of the Kubernetes secret for the cluster agent token. | `string` | `"datadog-clusteragent-token"` | no |
41	|  [cluster\_name](#input\_cluster\_name) | The name of the Kubernetes cluster, to be used for tagging. | `string` | n/a | yes |
42	|  [container\_exclude](#input\_container\_exclude) | A list of container names to exclude from monitoring. | `string` | `"kube_namespace:datadog name:enterprise"` | no |
43	|  [container\_exclude\_logs](#input\_container\_exclude\_logs) | A list of container names to exclude from log collection. | `string` | `"image:registry.k8s.io/autoscaling/cluster-autoscaler image:registry.ic-ops.net/cache-k8s-registry/autoscaling/cluster-autoscaler"` | no |
44	|  [create\_namespace](#input\_create\_namespace) | Whether to create the namespace. Set to false if the namespace already exists. | `bool` | `true` | no |
45	|  [datadog\_api\_key\_secret\_name](#input\_datadog\_api\_key\_secret\_name) | The name of the Kubernetes secret holding the Datadog API key. | `string` | `"datadog-api-key"` | no |
46	|  [datadog\_tags](#input\_datadog\_tags) | A map of global tags to apply to all metrics, traces, and logs. | `list(string)` | `[]` | no |
47	|  [enable\_mrds\_monitoring](#input\_enable\_mrds\_monitoring) | Enable monitoring for MRDS. | `bool` | `false` | no |
48	|  [enable\_now\_obfusicator\_options](#input\_enable\_now\_obfusicator\_options) | Whether to enable the NOWRDS obfuscator options in the Datadog agent configuration. | `bool` | `false` | no |
49	|  [enable\_nowrds\_monitoring](#input\_enable\_nowrds\_monitoring) | Enable monitoring for NOWRDS. | `bool` | `false` | no |
50	|  [env](#input\_env) | The environment that resources are deployed to. i.e. nonprod, prod | `string` | n/a | yes |
51	|  [global\_segment](#input\_global\_segment) | The global segment to use for tagging and other purposes. | `string` | n/a | yes |
52	|  [image\_tag](#input\_image\_tag) | The tag of the Datadog agent image to use. | `string` | n/a | yes |
53	|  [log\_level](#input\_log\_level) | The log level for the Datadog agent. | `string` | `"ERROR"` | no |
54	|  [name](#input\_name) | The name of the Helm release. | `string` | `"immuta-dd"` | no |
55	|  [namespace](#input\_namespace) | The Kubernetes namespace to deploy the Datadog agent into. | `string` | `"datadog"` | no |
56	|  [now\_obfusicator\_options](#input\_now\_obfusicator\_options) | A map of options to configure the NOWRDS obfuscator in the Datadog agent configuration. | `map(string)` |
{
  "replace_digits": "true"
}
 | no |
57	|  [tags](#input\_tags) | A list of global tags to apply to all metrics, traces, and logs. | `map(any)` | `{}` | no |
58
59	## Outputs
60
61	| Name | Description |
62	|------|-------------|
63	|  [helm\_chart\_revision](#output\_helm\_chart\_revision) | Revision of the release |
64	|  [helm\_chart\_status](#output\_helm\_chart\_status) | Status of the release |
65	|  [helm\_chart\_values](#output\_helm\_chart\_values) | Helm Chart values of the chart |
66	|  [helm\_chart\_version](#output\_helm\_chart\_version) | Version of the release |
67


text: Perfect! I can see the Inputs table ends at line 57. The `log_level` row is on line 53, which is where I need to insert the new `logs_intake_url` row. Let me make the first edit now.


Edit

old_string:
|  [log\_level](#input\_log\_level) | The log level for the Datadog agent. | `string` | `"ERROR"` | no |
|  [name](#input\_name) | The name of the Helm release. | `string` | `"immuta-dd"` | no |

new_string:
|  [log\_level](#input\_log\_level) | The log level for the Datadog agent. | `string` | `"ERROR"` | no |
|  [logs\_intake\_url](#input\_logs\_intake\_url) | OPW-compatible logs intake URL. When set, the agent ships logs to this endpoint via DD\_OBSERVABILITY\_PIPELINES\_WORKER\_LOGS\_URL. For cluster-internal Vector use module.vector.service\_endpoint\_dd\_agent. When null (default), logs ship direct to Datadog SaaS. | `string` | `null` | no |
|  [name](#input\_name) | The name of the Helm release. | `string` | `"immuta-dd"` | no |

speed: standard


content: The file /Users/steve.briggs/projects/IAC/terraform/internal-modules/kubernetes/monitoring/datadog-agent/README.md has been updated successfully. (file state is current in your context — no need to Read it back)


text: Great! Now let me read the end of the file to find the right place to append the "OPW Logs Intake" section.


content:
59
60	## Outputs
61
62	| Name | Description |
63	|------|-------------|
64	|  [helm\_chart\_revision](#output\_helm\_chart\_revision) | Revision of the release |
65	|  [helm\_chart\_status](#output\_helm\_chart\_status) | Status of the release |
66	|  [helm\_chart\_values](#output\_helm\_chart\_values) | Helm Chart values of the chart |
67	|  [helm\_chart\_version](#output\_helm\_chart\_version) | Version of the release |
68


text: Perfect! The file ends at line 68. Now I'll append the "OPW Logs Intake" section at the end.


old_string: |  [helm\_chart\_version](#output\_helm\_chart\_version) | Version of the release |

new_string:
|  [helm\_chart\_version](#output\_helm\_chart\_version) | Version of the release |

## OPW Logs Intake (optional)

By default, the agent ships logs directly to Datadog SaaS over HTTPS. To
redirect logs through a Datadog Observability Pipelines Worker (OPW), or
through a Vector deployment functioning as one, set `logs_intake_url`:

```hcl
module "datadog_agent" {
  # ...
  logs_intake_url = module.vector.service_endpoint_dd_agent
  # e.g. "http://vector.vector.svc.cluster.local:8282"
}
```

This sets two env vars on the agent containers:

- `DD_OBSERVABILITY_PIPELINES_WORKER_LOGS_ENABLED=true`
- `DD_OBSERVABILITY_PIPELINES_WORKER_LOGS_URL=<logs_intake_url>`

Agent-side processing rules (`DD_LOGS_CONFIG_PROCESSING_RULES`) continue to
execute before transmission, regardless of destination. Metrics and APM
(traces) are unaffected and continue shipping direct to Datadog.

When `logs_intake_url` is `null`, the rendered helm values are byte-identical
to the v1.1.x line — there is no behavior change for clusters that do not opt in.

Reference: <https://docs.datadoghq.com/observability_pipelines/sources/datadog_agent/>


text: Excellent! Now let me verify both edits by reading the entire file to confirm they're in place correctly.


content:
1	## Requirements
2
3	| Name | Version |
4	|------|---------|
5	|  [terraform](#requirement\_terraform) | >= 1.3.0, < 2.0 |
6	|  [helm](#requirement\_helm) | ~> 2.0 |
7	|  [kubernetes](#requirement\_kubernetes) | ~> 2.0 |
8
9	## Providers
10
11	| Name | Version |
12	|------|---------|
13	|  [helm](#provider\_helm) | ~> 2.0 |
14	|  [kubernetes](#provider\_kubernetes) | ~> 2.0 |
15
16	## Modules
17
18	| Name | Source | Version |
19	|------|--------|---------|
20	|  [netpol](#module\_netpol) | git@gitlab.infrastructure.immuta.io:infrastructure/terraform/internal-modules/kubernetes/security/network-policy.git | v1.1.0 |
21
22	## Resources
23
24	| Name | Type |
25	|------|------|
26	| [helm_release.this](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
27	| [kubernetes_config_map.datadog_processing_rules](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/config_map) | resource |
28	| [kubernetes_manifest.external-secret](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
29	| [kubernetes_manifest.external-secret-dd-api-key](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
30	| [kubernetes_manifest.external-secret-dd-api-token](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
31	| [kubernetes_namespace.this](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
32
33	## Inputs
34
35	| Name | Description | Type | Default | Required |
36	|------|-------------|------|---------|:--------:|
37	|  [agents\_priority\_class\_name](#input\_agents\_priority\_class\_name) | The priority class name for the Datadog agents. | `string` | `"cloud-ops-system"` | no |
38	|  [apm\_enabled](#input\_apm\_enabled) | Whether to enable APM for the Datadog agent. | `bool` | `true` | no |
39	|  [chart\_version](#input\_chart\_version) | The version of the Datadog Helm chart to use. | `string` | n/a | yes |
40	|  [cluster\_agent\_token\_secret\_name](#input\_cluster\_agent\_token\_secret\_name) | The name of the Kubernetes secret for the cluster agent token. | `string` | `"datadog-clusteragent-token"` | no |
41	|  [cluster\_name](#input\_cluster\_name) | The name of the Kubernetes cluster, to be used for tagging. | `string` | n/a | yes |
42	|  [container\_exclude](#input\_container\_exclude) | A list of container names to exclude from monitoring. | `string` | `"kube_namespace:datadog name:enterprise"` | no |
43	|  [container\_exclude\_logs](#input\_container\_exclude\_logs) | A list of container names to exclude from log collection. | `string` | `"image:registry.k8s.io/autoscaling/cluster-autoscaler image:registry.ic-ops.net/cache-k8s-registry/autoscaling/cluster-autoscaler"` | no |
44	|  [create\_namespace](#input\_create\_namespace) | Whether to create the namespace. Set to false if the namespace already exists. | `bool` | `true` | no |
45	|  [datadog\_api\_key\_secret\_name](#input\_datadog\_api\_key\_secret\_name) | The name of the Kubernetes secret holding the Datadog API key. | `string` | `"datadog-api-key"` | no |
46	|  [datadog\_tags](#input\_datadog\_tags) | A map of global tags to apply to all metrics, traces, and logs. | `list(string)` | `[]` | no |
47	|  [enable\_mrds\_monitoring](#input\_enable\_mrds\_monitoring) | Enable monitoring for MRDS. | `bool` | `false` | no |
48	|  [enable\_now\_obfusicator\_options](#input\_enable\_now\_obfusicator\_options) | Whether to enable the NOWRDS obfuscator options in the Datadog agent configuration. | `bool` | `false` | no |
49	|  [enable\_nowrds\_monitoring](#input\_enable\_nowrds\_monitoring) | Enable monitoring for NOWRDS. | `bool` | `false` | no |
50	|  [env](#input\_env) | The environment that resources are deployed to. i.e. nonprod, prod | `string` | n/a | yes |
51	|  [global\_segment](#input\_global\_segment) | The global segment to use for tagging and other purposes. | `string` | n/a | yes |
52	|  [image\_tag](#input\_image\_tag) | The tag of the Datadog agent image to use. | `string` | n/a | yes |
53	|  [log\_level](#input\_log\_level) | The log level for the Datadog agent. | `string` | `"ERROR"` | no |
54	|  [logs\_intake\_url](#input\_logs\_intake\_url) | OPW-compatible logs intake URL. When set, the agent ships logs to this endpoint via DD\_OBSERVABILITY\_PIPELINES\_WORKER\_LOGS\_URL. For cluster-internal Vector use module.vector.service\_endpoint\_dd\_agent. When null (default), logs ship direct to Datadog SaaS. | `string` | `null` | no |
55	|  [name](#input\_name) | The name of the Helm release. | `string` | `"immuta-dd"` | no |
56	|  [namespace](#input\_namespace) | The Kubernetes namespace to deploy the Datadog agent into. | `string` | `"datadog"` | no |
57	|  [now\_obfusicator\_options](#input\_now\_obfusicator\_options) | A map of options to configure the NOWRDS obfuscator in the Datadog agent configuration. | `map(string)` |
{
  "replace_digits": "true"
}
 | no |
58	|  [tags](#input\_tags) | A list of global tags to apply to all metrics, traces, and logs. | `map(any)` | `{}` | no |
59
60	## Outputs
61
62	| Name | Description |
63	|------|-------------|
64	|  [helm\_chart\_revision](#output\_helm\_chart\_revision) | Revision of the release |
65	|  [helm\_chart\_status](#output\_helm\_chart\_status) | Status of the release |
66	|  [helm\_chart\_values](#output\_helm\_chart\_values) | Helm Chart values of the chart |
67	|  [helm\_chart\_version](#output\_helm\_chart\_version) | Version of the release |
68
69	## OPW Logs Intake (optional)
70
71	By default, the agent ships logs directly to Datadog SaaS over HTTPS. To
72	redirect logs through a Datadog Observability Pipelines Worker (OPW), or
73	through a Vector deployment functioning as one, set `logs_intake_url`:
74
75	```hcl
76	module "datadog_agent" {
77	  # ...
78	  logs_intake_url = module.vector.service_endpoint_dd_agent
79	  # e.g. "http://vector.vector.svc.cluster.local:8282"
80	}
81	```
82
83	This sets two env vars on the agent containers:
84
85	- `DD_OBSERVABILITY_PIPELINES_WORKER_LOGS_ENABLED=true`
86	- `DD_OBSERVABILITY_PIPELINES_WORKER_LOGS_URL=<logs_intake_url>`
87
88	Agent-side processing rules (`DD_LOGS_CONFIG_PROCESSING_RULES`) continue to
89	execute before transmission, regardless of destination. Metrics and APM
90	(traces) are unaffected and continue shipping direct to Datadog.
91
92	When `logs_intake_url` is `null`, the rendered helm values are byte-identical
93	to the v1.1.x line — there is no behavior change for clusters that do not opt in.
94
95	Reference: <https://docs.datadoghq.com/observability_pipelines/sources/datadog_agent/>
96


text:
Perfect! Both edits are now in place and correctly formatted. Let me provide you with the final report.

## Report

**Status:** DONE

**File modified:** `/Users/steve.briggs/projects/IAC/terraform/internal-modules/kubernetes/monitoring/datadog-agent/README.md`

### Edit 1: Added `logs_intake_url` to the Inputs table
- **Line 54:** Inserted the new input variable row immediately after the `log_level` row
- Properly alphabetized in the table (logs_intake_url comes after log_level)
- All underscores correctly escaped as `\_` to match the table's existing markdown style
- Includes complete description, type (`string`), default (`null`), and required flag (`no`)

### Edit 2: Appended "OPW Logs Intake" section
- **Lines 69-95:** Added comprehensive documentation section at the end of the file
- Includes explanation of when and how to use the feature
- Provides example Terraform code with cluster-internal Vector reference
- Documents the two environment variables set on agent containers
- Clarifies that agent-side processing rules, metrics, and APM are unaffected
- Notes backward compatibility (byte-identical helm values when null)
- Includes reference link to Datadog observability pipelines documentation

**Concerns:** None. Both edits are complete, properly formatted, and ready for Sir Charles to commit.