Feature/d4c poc

[biscout42]

This PR adds a new Elastic package, cloud_defend_otel, that ports part of the
classic cloud_defend integration to the OpenTelemetry model.

See packages/cloud_defend_otel/plan.md for details.

The change in PoC state to verify, if we can pass an integration policy to a service consumed by OTEL collector.

🤖 Created with cluade-code.

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 warning, 1 suggestion found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/cloud_defend_otel/manifest.yml	54	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

💡 Suggestions (1): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/cloud_defend_otel/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

Changelog link mismatch — expected https://github.com/elastic/integrations/pull/19989 in the following file(s):

• packages/cloud_defend_otel/changelog.yml

Tip

If expected, add the changelog-link-check:skip label to skip this check. Or, if an issue link was intended, use .../issues/<n> instead.

View Buildkite build
@biscout42

[infra-vault-gh-plugin-prod]

💔 Build Failed

• Buildkite Build
• Commit: 814a534

Failed CI Steps

• 📜 Check changelog PR links
• Check integrations cloud_defend_otel

History

cc @biscout42

[github-actions]

TL;DR

CI is failing for two separate reasons: the changelog entry points at PR 19734 instead of this PR (19989), and the cloud_defend_otel package check reaches package tests but fails before producing a system-test JUnit report. Fix the changelog link first, then rerun/inspect the package system-test output for the missing assertion detail.

Remediation

• In packages/cloud_defend_otel/changelog.yml, change the entry link from https://github.com/elastic/integrations/pull/19734 to https://github.com/elastic/integrations/pull/19989 (or use an issue URL if that was intended).
• For the package-test failure, inspect the Buildkite uploaded artifacts/logs for the cloud_defend_otel system test. The prefetched job log only includes teardown and artifact upload lines; the uploaded files show policy artifacts were produced, but no cloud_defend_otel-system-*.xml report was uploaded, so the failure likely occurred when system tests started or before they could write their report.
• After changes, rerun .buildkite/scripts/test_one_package.sh packages/cloud_defend_otel origin/main 814a53497832eec6ea469bf97afd0ffe1251f9eb in CI (local reproduction needs a running Elastic Package stack/Docker).

Investigation details

Root Cause

The changelog check is a configuration/content failure in packages/cloud_defend_otel/changelog.yml: the PR diff adds line 6 as link: https://github.com/elastic/integrations/pull/19734, while this build is for PR 19989. Buildkite expected https://github.com/elastic/integrations/pull/19989.

For Check integrations cloud_defend_otel, the available log does not include the actual test assertion. It only shows teardown plus artifact upload. The artifact list includes cloud_defend_otel-asset-*.xml, cloud_defend_otel-pipeline-*.xml, and cloud_defend_otel-policy-*.xml, but no system-test XML, even though the PR adds _dev/test/system/test-logs-config.yml and _dev/test/system/test-file-config.yml. That points to the package failure happening in or just before system tests rather than in the already-reported changelog step.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/45523
• Job/step: :scroll: Check changelog PR links
• Key log excerpt:

ERROR: unexpected link: 'https://github.com/elastic/integrations/pull/19734'
       expected:         'https://github.com/elastic/integrations/pull/19989'
--- 1 changelog link(s) do not match this PR
- `packages/cloud_defend_otel/changelog.yml`

• Job/step: Check integrations cloud_defend_otel
• Key log excerpt:

--- [cloud_defend_otel] failed
Uploading ... build/test-results/cloud_defend_otel-pipeline-*.xml
Uploading ... build/test-results/cloud_defend_otel-policy-*.xml
Uploading ... build/test-results/cloud_defend_otel-asset-*.xml

Verification

• Built the pinned elastic-package v0.125.0 from this repository and attempted elastic-package test policy against a temporary checkout of PR 19989. Local execution could not proceed because this environment has no Docker-backed Elastic Package stack, matching the workflow limitation rather than adding a new package failure.
• Checked PR comments: the changelog bot already reported the changelog mismatch; no prior detective comment covered the package-test artifact gap.

Follow-up

If the rerun still fails after fixing the changelog, the next useful artifact is the full cloud_defend_otel system-test output or the missing system JUnit report; the current prefetched Buildkite log is truncated to teardown/upload output.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.