[workloadmeta/collectors/ecs] Leave runtime empty

comp/core/workloadmeta/collectors/internal/ecs/v1parser.go

@@ -102,14 +102,42 @@ func (c *collector) parseTaskContainers(
 			Type:   workloadmeta.EventTypeSet,
 			Entity: &workloadmeta.Container{
 				EntityID: entityID,
-				Runtime:  workloadmeta.ContainerRuntimeDocker,
 				EntityMeta: workloadmeta.EntityMeta{
 					Name: container.DockerName,
 				},
 				State: workloadmeta.ContainerState{
 					Status: workloadmeta.ContainerStatusUnknown,
 					Health: workloadmeta.ContainerHealthUnknown,
 				},
+				// Edge Case: Setting the runtime to "docker" causes issues,
+				// although it's correct.
+				//
+				// In ECS, the logs agent assigns the "source" and "service"
+				// tags based on the name of the container image. The ECS v1
+				// collector does not gather container image information; only
+				// the Docker collector does. As a result, the information
+				// becomes complete only after the Docker collector has
+				// processed the container.
+				//
+				// If the runtime is set here and the ECS collector runs before
+				// the Docker collector, and the logs check configuration is
+				// generated before the Docker collector stores the information,
+				// the image details will be missing. As a result, the logs
+				// configuration will have an incorrect "source" and "service"
+				// tags.
+				//
+				// Setting an empty runtime here is a workaround to ensure that
+				// the "source" and "service" tags are correct. The reason is
+				// that autodiscovery is not expecting an empty runtime because
+				// it uses it to generate the AD identifiers and things like the
+				// service ID. Also, the logs agent rejects config with an empty
+				// service ID. As a result, with an empty runtime, the logs
+				// config will not be created until the Docker collector has run
+				// and the image info is available.
+				//
+				// TODO: Remove this workaround when there's a better way of
+				// handling this in AD + logs agent.
+				Runtime: "",
 			},
 		})
 	}

comp/core/workloadmeta/collectors/internal/ecs/v1parser_test.go

@@ -23,6 +23,7 @@ import (
 // which is the default parser when other metadata endpoints are not available.
 func TestPullWithV1Parser(t *testing.T) {
 	entityID := "task1"
+	containerID := "someID"
 	tags := map[string]string{"foo": "bar"}
 
 	tests := []struct {
@@ -55,7 +56,7 @@ func TestPullWithV1Parser(t *testing.T) {
 						{
 							Arn: entityID,
 							Containers: []v1.Container{
-								{DockerID: "foo"},
+								{DockerID: containerID},
 							},
 						},
 					}, nil
@@ -83,6 +84,13 @@ func TestPullWithV1Parser(t *testing.T) {
 
 			taskTags := c.resourceTags[entityID].tags
 			assert.Equal(t, taskTags, test.expectedTags)
+
+			// This is only needed because of the workaround about the empty
+			// runtime documented in the parseTaskContainers function. Remove
+			// this when the workaround is no longer needed.
+			storedContainer, err := c.store.GetContainer(containerID)
+			require.NoError(t, err)
+			assert.Empty(t, storedContainer.Runtime)
 		})
 	}
 

releasenotes/notes/fix-ecs-runtime-3e75bbcb8d328b1d.yaml

@@ -0,0 +1,12 @@
+# Each section from every release note are combined when the
+# CHANGELOG.rst is rendered. So the text needs to be worded so that
+# it does not depend on any information only available in another
+# section. This may mean repeating some details, but each section
+# must be readable independently of the other.
+#
+# Each section note must be formatted as reStructuredText.
+---
+fixes:
+  - |
+    Fixed an issue where the "source" and "service" tags were incorrectly set to
+    "kubernetes" in logs when the Agent runs on ECS EC2.