.gitlab-ci.yml

image: registry.ddbuild.io/images/mirror/golang:1.22.7
variables:
  PROJECTNAME: "datadog-operator"
  PROJECTNAME_CHECK: "datadog-operator-check"
  GOPATH: "$CI_PROJECT_DIR/.cache"
  BUILD_DOCKER_REGISTRY: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci"
  E2E_DOCKER_REGISTRY: "669783387624.dkr.ecr.us-east-1.amazonaws.com/operator"
  JOB_DOCKER_IMAGE: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci-containers-project:v2.0.0"
  DOCKER_REGISTRY_LOGIN_SSM_KEY: docker_hub_login
  DOCKER_REGISTRY_PWD_SSM_KEY: docker_hub_pwd
  DOCKER_REGISTRY_URL: docker.io
  RH_PARTNER_REGISTRY: "quay.io/redhat-isv-containers"
  RH_PARTNER_PROJECT_ID: "5e7c8ebc1c86a3163d1a69be"
  RH_PARTNER_REGISTRY_USER: "redhat-isv-containers+5e7c8ebc1c86a3163d1a69be-robot"
  RH_PARTNER_REGISTRY_KEY_SSM_KEY: redhat_registry_key
  RH_PARTNER_API_KEY_SSM_KEY: redhat_api_key
  TEST_INFRA_DEFINITIONS_BUILDIMAGES: 3c7d2dc2d3dd
  PUSH_IMAGES_TO_STAGING:
    description: "Set PUSH_IMAGE_TO_STAGING to 'true' if you want to push the operator to internal staging registry."

cache: &global_cache
  key: ${CI_COMMIT_REF_SLUG}
  paths:
    - .cache
  policy: pull-push

stages:
  - build
  - test
  - image
  - test-image
  - release
  - e2e
  - post-release
  - deploy

.new_e2e_template:
  stage: e2e
  image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/test-infra-definitions/runner:$TEST_INFRA_DEFINITIONS_BUILDIMAGES
  tags: ["arch:amd64"]
  before_script:
    # Setup AWS Credentials
    - mkdir -p ~/.aws
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.agent-qa-profile --with-decryption --query "Parameter.Value" --out text >> ~/.aws/config
    - export AWS_PROFILE=agent-qa-ci
    # Now all `aws` commands target the agent-qa profile
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.ssh_public_key --with-decryption --query "Parameter.Value" --out text > $E2E_PUBLIC_KEY_PATH
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.ssh_private_key --with-decryption --query "Parameter.Value" --out text > $E2E_PRIVATE_KEY_PATH
    # Use S3 backend to store stack status
    - pulumi login "s3://dd-pulumi-state?region=us-east-1&awssdk=v2&profile=$AWS_PROFILE"
  variables:
    E2E_PUBLIC_KEY_PATH: /tmp/agent-qa-ssh-key.pub
    E2E_PRIVATE_KEY_PATH: /tmp/agent-qa-ssh-key
    E2E_KEY_PAIR_NAME: ci.datadog-operator
    KUBERNETES_MEMORY_REQUEST: 12Gi
    KUBERNETES_MEMORY_LIMIT: 16Gi

.on_run_e2e:
  - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "main"'
    when: always
  - if: $CI_COMMIT_BRANCH
    changes:
      paths:
        - "*.md"
      compare_to: "refs/heads/main"
    when: never
  - if: '$CI_COMMIT_BRANCH =~ /^mq-working-branch-/'
    when: never
  # Temporarily disable on Conductor-triggered jobs
  - if: '$DDR != "true"'
    when: manual
  - when: never

.on_build_images:
  - if: '$CI_COMMIT_BRANCH =~ /^mq-working-branch-/'
    when: never
  - when: always

build:
  stage: build
  tags: ["runner:main", "size:large"]
  before_script:
    - mkdir -p .cache
    - make install-tools
  script:
    - make build

unit_tests:
  stage: test
  tags: ["runner:main", "size:large"]
  rules:
    - if: '$DDR == "true"'
      when: never
    - when: on_success
  before_script:
    - mkdir -p .cache
    - make install-tools
  script:
    - make test

generate_code:
  stage: test
  tags: ["runner:main", "size:large"]
  rules:
    - if: '$DDR == "true"'
      when: never
    - when: on_success
  before_script:
    - mkdir -p .cache
    - make install-tools
  script:
    - make generate manifests
    - git diff --exit-code

build_operator_image_amd64:
  stage: image
  rules: !reference [.on_build_images]
  tags:
    - "arch:amd64"
  image: $JOB_DOCKER_IMAGE
  variables:
    GOARCH: amd64
    TARGET_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-amd64
    RELEASE_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64
  script:
    # DockerHub login for build to limit rate limit when pulling base images
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_LOGIN_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_PWD_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin "$DOCKER_REGISTRY_URL"
    - IMG=$TARGET_IMAGE make docker-build-push-ci
    - if [ -n "$CI_COMMIT_TAG" ]; then docker buildx imagetools create $TARGET_IMAGE --tag $RELEASE_IMAGE; fi

build_operator_image_arm64:
  stage: image
  rules: !reference [.on_build_images]
  tags:
    - "arch:arm64"
  image: $JOB_DOCKER_IMAGE
  variables:
    GOARCH: arm64
    TARGET_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-arm64
    RELEASE_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-arm64
  script:
    # DockerHub login for build to limit rate limit when pulling base images
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_LOGIN_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_PWD_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin "$DOCKER_REGISTRY_URL"
    - IMG=$TARGET_IMAGE make docker-build-push-ci
    - if [ -n "$CI_COMMIT_TAG" ]; then docker buildx imagetools create $TARGET_IMAGE --tag $RELEASE_IMAGE; fi

build_operator_check_image_amd64:
  stage: image
  rules: !reference [.on_build_images]
  tags:
    - "arch:amd64"
  image: $JOB_DOCKER_IMAGE
  variables:
    GOARCH: amd64
    TARGET_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME_CHECK:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-amd64
    RELEASE_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME_CHECK:$CI_COMMIT_TAG-amd64
  script:
    # DockerHub login for build to limit rate limit when pulling base images
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_LOGIN_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_PWD_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin "$DOCKER_REGISTRY_URL"
    - IMG_CHECK=$TARGET_IMAGE make docker-build-push-check-ci
    - if [ -n "$CI_COMMIT_TAG" ]; then docker buildx imagetools create $TARGET_IMAGE --tag $RELEASE_IMAGE; fi

build_operator_check_image_arm64:
  stage: image
  rules: !reference [.on_build_images]
  tags:
    - "arch:arm64"
  image: $JOB_DOCKER_IMAGE
  variables:
    GOARCH: arm64
    TARGET_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME_CHECK:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-arm64
    RELEASE_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME_CHECK:$CI_COMMIT_TAG-arm64
  script:
    # DockerHub login for build to limit rate limit when pulling base images
    - DOCKER_REGISTRY_LOGIN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_LOGIN_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$DOCKER_REGISTRY_PWD_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$DOCKER_REGISTRY_LOGIN" --password-stdin "$DOCKER_REGISTRY_URL"
    - IMG_CHECK=$TARGET_IMAGE make docker-build-push-check-ci
    - if [ -n "$CI_COMMIT_TAG" ]; then docker buildx imagetools create $TARGET_IMAGE --tag $RELEASE_IMAGE; fi


build_bundle_image:
  stage: image
  tags:
    - "arch:amd64"
  image: $JOB_DOCKER_IMAGE
  variables:
    TARGET_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-bundle
    RELEASE_IMAGE: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-bundle
  script:
    - BUNDLE_IMG=$TARGET_IMAGE make bundle-build-push
    - if [ -n "$CI_COMMIT_TAG" ]; then docker buildx imagetools create $TARGET_IMAGE --tag $RELEASE_IMAGE; fi


publish_public_main:
  stage: release
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" && $DDR != "true"'
      when: on_success
    - when: never
  trigger:
    project: DataDog/public-images
    branch: main
    strategy: depend
  variables:
    IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-amd64,$BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-arm64
    IMG_DESTINATIONS: operator:main
    IMG_SIGNING: "false"

publish_public_tag:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
    - when: never
  trigger:
    project: DataDog/public-images
    branch: main
    strategy: depend
  variables:
    IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64,$BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-arm64
    IMG_DESTINATIONS: operator:$CI_COMMIT_TAG
    IMG_DESTINATIONS_REGEX: ':v'
    IMG_DESTINATIONS_REGEX_REPL: ':'
    IMG_SIGNING: "false"

publish_redhat_public_tag:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
    - when: never
  trigger:
    project: DataDog/public-images
    branch: main
    strategy: depend
  variables:
    IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64,$BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-arm64
    IMG_DESTINATIONS: $RH_PARTNER_PROJECT_ID:$CI_COMMIT_TAG
    IMG_DESTINATIONS_REGEX: ':v'
    IMG_DESTINATIONS_REGEX_REPL: ':'
    IMG_REGISTRIES: redhat-operator
    IMG_SIGNING: "false"

publish_public_latest:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
    - when: never
  trigger:
    project: DataDog/public-images
    branch: main
    strategy: depend
  variables:
    IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64,$BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-arm64
    IMG_DESTINATIONS: operator:latest
    IMG_SIGNING: "false"

publish_redhat_public_latest:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
    - when: never
  trigger:
    project: DataDog/public-images
    branch: main
    strategy: depend
  variables:
    IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64,$BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-arm64
    IMG_DESTINATIONS: $RH_PARTNER_PROJECT_ID:latest
    IMG_REGISTRIES: redhat-operator
    IMG_SIGNING: "false"

trigger_internal_operator_image:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    RELEASE_TAG: ${CI_COMMIT_REF_SLUG}
    BUILD_TAG: ${CI_COMMIT_REF_SLUG}
    RELEASE_STAGING: "true"
    RELEASE_PROD: "true"

trigger_internal_operator_check_image:
  stage: release
  rules:
    - if: $CI_COMMIT_TAG
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME_CHECK
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    RELEASE_TAG: ${CI_COMMIT_REF_SLUG}
    BUILD_TAG: ${CI_COMMIT_REF_SLUG}
    RELEASE_STAGING: "true"
    RELEASE_PROD: "true"

trigger_internal_operator_nightly_image:
  stage: release
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" && $DDR == "true" && $CONDUCTOR_TARGET == "nightly-build"'
      when: on_success
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    # Trigger a nightly images build that sets the RELEASE_TAG and BUILD_TAG
    BUILD_NIGHTLY: "true"
    RELEASE_STAGING: "true"
    RELEASE_PROD: "false"

trigger_internal_operator_check_nightly_image:
  stage: release
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" && $DDR == "true" && $CONDUCTOR_TARGET == "nightly-build"'
      when: on_success
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME_CHECK
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    # Trigger a nightly images build that sets the RELEASE_TAG and BUILD_TAG
    BUILD_NIGHTLY: "true"
    RELEASE_STAGING: "true"
    RELEASE_PROD: "false"

trigger_custom_operator_image_staging:
  stage: release
  rules:
    - if: $PUSH_IMAGES_TO_STAGING == 'true'
      when: manual
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    RELEASE_TAG: ${CI_COMMIT_REF_SLUG}-${CI_COMMIT_SHORT_SHA}
    BUILD_TAG: ${CI_COMMIT_REF_SLUG}-${CI_COMMIT_SHORT_SHA}
    RELEASE_STAGING: "true"
    RELEASE_PROD: "false"

trigger_custom_operator_check_image_staging:
  stage: release
  rules:
    - if: $PUSH_IMAGES_TO_STAGING == 'true'
      when: manual
    - when: never
  trigger:
    project: DataDog/images
    branch: master
    strategy: depend
  variables:
    IMAGE_VERSION: tmpl-v1
    IMAGE_NAME: $PROJECTNAME_CHECK
    TMPL_SRC_IMAGE: v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    RELEASE_TAG: ${CI_COMMIT_REF_SLUG}-${CI_COMMIT_SHORT_SHA}
    BUILD_TAG: ${CI_COMMIT_REF_SLUG}-${CI_COMMIT_SHORT_SHA}
    RELEASE_STAGING: "true"
    RELEASE_PROD: "false"

trigger_e2e_operator_image:
  stage: release
  rules: !reference [.on_run_e2e]
  trigger:
    project: DataDog/public-images
    branch: main
    strategy: depend
  variables:
    IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-amd64
    IMG_DESTINATIONS: operator:${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
    IMG_REGISTRIES: agent-qa

e2e:
  extends: .new_e2e_template
  variables:
    TARGET_IMAGE: $E2E_DOCKER_REGISTRY:${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}
  needs:
    - "trigger_e2e_operator_image"
  rules: !reference [.on_run_e2e]
  parallel:
    matrix:
      - K8S_VERSION:
          - "1.19"
          - "1.22"
          - "1.24"
          - "1.25"
          - "1.26"
  script:
    - IMAGE_PULL_PASSWORD=$(aws ecr get-login-password) IMG=$TARGET_IMAGE make e2e-tests


# Preflight now supports multiarch image checks
submit_preflight_redhat_image:
  stage: post-release
  rules:
    - if: $CI_COMMIT_TAG
      when: manual
    - when: never
  needs:
    - "publish_redhat_public_tag"
  tags: ["runner:docker", "size:large"]
  image: $JOB_DOCKER_IMAGE
  script:
    - apt-get update && apt-get -y install --no-install-recommends build-essential git awscli && apt-get -y clean && rm -rf /var/lib/apt/lists/*
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$RH_PARTNER_REGISTRY_KEY_SSM_KEY --with-decryption --query "Parameter.Value" --out text | docker login --username "$RH_PARTNER_REGISTRY_USER" --password-stdin "$RH_PARTNER_REGISTRY"
    - export RH_PARTNER_API_TOKEN=$(aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.$RH_PARTNER_API_KEY_SSM_KEY --with-decryption --query "Parameter.Value" --out text)
    - export IMG=$RH_PARTNER_REGISTRY/$RH_PARTNER_PROJECT_ID:${CI_COMMIT_TAG:1}
    - make preflight-redhat-container-submit

publish_community_operators:
  stage: post-release
  rules:
      - if: $CI_COMMIT_TAG
        when: manual
      - when: never
  needs:
    - "submit_preflight_redhat_image"
  tags: [ "runner:docker", "size:large" ]
  image: $JOB_DOCKER_IMAGE
  before_script:
    - mkdir -p .cache
    - make install-tools
  script:
    # Set version
    - export VERSION=${CI_COMMIT_TAG:1} # vX.Y.Z => X.Y.Z
    # Install github-cli and skopeo deps
    - curl -fsSL "https://cli.github.com/packages/githubcli-archive-keyring.gpg" -o /usr/share/keyrings/githubcli-archive-keyring.gpg
    - echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list
    - apt-get update -y
    - apt-get install -y gh libgpgme-dev libassuan-dev libbtrfs-dev libdevmapper-dev pkg-config
    - rm -rf /var/lib/apt/lists/*
    # Build skopeo and install (needed for make bundle-redhat)
    # Note: skopeo apt package is only available in for ubuntu 20.10+
    # https://github.com/containers/skopeo/blob/main/install.md#ubuntu
    # TODO: use apt-get when gitlab runner image base is updated to use ubuntu 20.10+
    - git clone https://github.com/containers/skopeo $GOPATH/src/github.com/containers/skopeo
    - cd $GOPATH/src/github.com/containers/skopeo && DISABLE_DOCS=1 make bin/skopeo
    - DISABLE_DOCS=1 make install
    # Set up redhat registry access to generate bundle-redhat
    - mkdir ~/.redhat
    - aws ssm get-parameter --region us-east-1 --name
      ci.datadog-operator.redhat-registry-token --with-decryption --query "Parameter.Value" --out text > ~/.redhat/auths.json
    - cd $CI_PROJECT_DIR
    - make bundle-redhat
    # configure git and github-cli
    - git config --global user.email $GITLAB_USER_EMAIL
    - git config --global user.name $GITLAB_USER_NAME
    - aws ssm get-parameter --region us-east-1 --name ci.datadog-operator.github-robot-token --with-decryption --query "Parameter.Value" --out text > git-token.txt
    - gh auth login --with-token < git-token.txt
    - gh auth setup-git
    # create pull request for each marketplace repo
    - make publish-community-bundles


# On success, this will cause Conductor to trigger a Deployment to nightly clusters in SDP
publish_nightly_workflow:
  stage: deploy
  rules:
    - if: '$CI_COMMIT_BRANCH == "main" && $CONDUCTOR_TARGET == "nightly-build"'
      when: on_success
    - when: never
  needs:
    - trigger_internal_operator_nightly_image
    - trigger_internal_operator_check_nightly_image
  trigger:
    project: DataDog/k8s-datadog-agent-ops
    branch: main
    strategy: depend
    forward:
      pipeline_variables: true
  variables:
    OPERATOR_NIGHTLY: "true"
    SKIP_PLAN_CHECK: "true"
    ENVIRONMENTS: "experimental"
    CHART: "datadog-operator"
    OPTION_AUTOMATIC_ROLLOUT: "true"
    EXPLICIT_WORKFLOWS: "//workflows:deploy_operator.operator_nightly.publish"
    BAZEL_TARGET: $BAZEL_TARGET
    DDR: $DDR
    TARGET_ENV: $TARGET_ENV
    CONDUCTOR_TARGET: $CONDUCTOR_TARGET
    DDR_WORKFLOW_ID: $DDR_WORKFLOW_ID