[pull] master from DataDog:master

config/_default/menus/main.en.yaml

@@ -9720,21 +9720,26 @@ menu:
       parent: product_analytics
       identifier: pa_segmentation
       weight: 3
+    - name: Action Management
+      url: product_analytics/action_management
+      parent: product_analytics
+      identifier: pa_action_management
+      weight: 4
     - name: Managing Profiles
       url: product_analytics/profiles
       parent: product_analytics
       identifier: pa_profiles
-      weight: 4
+      weight: 5
     - name: Identity Resolution
       url: product_analytics/profiles/identity_resolution
       parent: pa_profiles
       identifier: pa_identity_resolution
-      weight: 401
+      weight: 501
     - name: Data Collected
       url: product_analytics/data_collected
       parent: product_analytics
       identifier: pa_data_collected
-      weight: 5
+      weight: 6
     - name: Experiments
       url: experiments/
       pre: experiment-wui

content/en/account_management/scim/entra.md

@@ -78,13 +78,13 @@ When using SAML and SCIM together, Datadog strongly recommends disabling SAML ju
 | `jobTitle`                       | `title`                        |
 | `mail`                           | `emails[type eq "work"].value` |
 | `displayName`                    | `name.formatted`               |
-| `roles`                          | `roles`                        |
+| `AppRoleAssignmentsComplex([appRoleAssignments])` | `roles`               |
 
    {{< img src="/account_management/scim/ad-users-2.png" alt="Attribute mapping configuration, Provision Azure Active Directory Users">}}
 
 7. After you set your mappings, click {{< ui >}}Save{{< /ui >}}.
 
-To provision a user's Datadog role (built-in or custom), map the `roles` attribute as shown above. Roles follow the SCIM multi-valued attribute convention defined in [RFC 7643][9], using the role UUID as `value` and the role name as `display`. If a SCIM request sends multiple roles, Datadog provisions only the roles that match a role in your organization. If none match, the user falls back to the org default role (Standard), and unmatched roles are logged to Audit Trail. For more details, see [SCIM][1].
+To provision a user's Datadog role (built-in or custom), map the `roles` attribute as shown above, using the `AppRoleAssignmentsComplex([appRoleAssignments])` expression for the Microsoft Entra ID attribute. Roles follow the SCIM multi-valued attribute convention defined in [RFC 7643][9]. If a SCIM request sends multiple roles, Datadog provisions only the roles that match a role in your organization. If none match, the user falls back to the org default role (Standard), and unmatched roles are logged to Audit Trail. For more details, see [SCIM][1].
 
 ### Group attributes
 

content/en/account_management/workload_identity_federation.md

@@ -28,8 +28,19 @@ Workload Identity Federation lets you authenticate the Datadog Terraform provide
 AWS is the only supported cloud provider.
 
 Workload Identity Federation is available for the following:
-- **Terraform provider**: Authenticate Terraform operations using AWS credentials mapped to a Datadog user or service account. Available for all customers.
-- **Datadog Agent**: Authenticate the Agent using AWS credentials to receive automatically managed and rotated API keys. Available for Enterprise plans only.
+
+{{< site-region region="us,us3,us5,eu,ap1,ap2" >}}
+<ul>
+<li><b>Terraform provider</b>: Authenticate Terraform operations using AWS credentials mapped to a Datadog user or service account. Available for all customers.</li>
+<li><b>Datadog Agent</b>: Authenticate the Agent using AWS credentials to receive automatically managed and rotated API keys. Available for Enterprise plans only.</li>
+</ul>
+{{< /site-region >}}
+
+{{< site-region region="gov,gov2" >}}
+<ul>
+<li><b>Terraform provider</b>: Authenticate Terraform operations using AWS credentials mapped to a Datadog user or service account. Available for all customers.</li>
+</ul>
+{{< /site-region >}}
 
 ## How it works: AWS authentication process
 

content/en/actions/agents/_index.md

@@ -16,10 +16,6 @@ further_reading:
   text: "AI Credits"
 ---
 
-{{< callout url="#" btn_hidden="true" header="Preview" >}}
-Bits Agent Builder is in Preview.
-{{< /callout >}}
-
 ## Overview
 
 Bits Agent Builder lets you create custom AI agents that use Datadog's tools and integrations to automate operational tasks. Agents can search logs, query metrics, create cases, send messages, or perform any action from the [Action Catalog][7].

content/en/actions/datadog_apps.md

@@ -40,7 +40,7 @@ Choose Apps when you need:
   ```shell
   node --version
   ```
-- A Datadog **API key** and an **application key** with [Actions API Access][5] enabled. For instructions on creating keys, see [API and Application Keys][6].
+- Optional: A Datadog **API key** and an **application key** with [Actions API Access][5] enabled. Required for API-key-backed build telemetry (build metrics and Error Tracking sourcemap uploads) and for CI/CD uploads. For instructions, see [API and Application Keys][6].
 
   To enable Actions API Access on an application key:
 
@@ -69,20 +69,15 @@ The scaffolded project includes:
 
 ## Develop your app locally
 
-1. Set your Datadog credentials as environment variables:
-
-   ```shell
-   export DD_API_KEY="<YOUR_API_KEY>"
-   export DD_APP_KEY="<YOUR_APPLICATION_KEY>"
-   ```
-
-2. Start the development server:
-
+1. Start the development server:
    ```shell
    npm run dev
    ```
+2. Open the URL shown in the terminal (for example, `http://localhost:5173/`) to preview your app.
+
+When the dev server needs to call Datadog, such as when running a backend function locally, it uses OAuth by default. If authorization is required, the command opens a browser prompt. After authorization completes, the token is cached in your operating system credential store.
 
-3. Open the URL shown in the terminal (for example, `http://localhost:5173/`) to preview your app.
+If you set both `DD_API_KEY` and `DD_APP_KEY`, the generated app uses those keys instead of OAuth.
 
 ### Backend functions
 
@@ -150,12 +145,15 @@ Use `npm run upload` to build and upload the app to Datadog. This runs `vite bui
 npm run upload
 ```
 
+Uploads use OAuth by default and may open a browser authorization flow the first time. If you set both `DD_API_KEY` and `DD_APP_KEY`, uploads use API and application key authentication instead.
+
 The following environment variables are available:
 
 | Variable | Description |
 |---|---|
-| `DD_API_KEY` | Datadog API key. |
-| `DD_APP_KEY` | Datadog application key. |
+| `DD_API_KEY` | Optional. Datadog API key used with `DD_APP_KEY` for local development and uploads. Also enables API-key-backed build telemetry, such as build metrics and Error Tracking sourcemap uploads. |
+| `DD_APP_KEY` | Optional. Application key used with `DD_API_KEY` for local development and uploads. |
+| `DD_APPS_AUTH_METHOD` | Optional. Set to `oauth` or `apiKey` to override the generated app's authentication method. |
 | `DD_APPS_VERSION_NAME` | Optional. The version name for the uploaded app version. Must be a unique string per app. If unset, Datadog assigns a version name. |
 | `DD_APPS_UPLOAD_ASSETS` | If set, uploads built assets to Datadog. Set automatically by `npm run upload`. |
 
@@ -185,6 +183,8 @@ To change an app's UI or logic, update the code in your local project and re-upl
 
 To automatically upload your app on every push to the `main` branch, use the [`DataDog/apps-github-action`][11] GitHub Action. This action builds your app and uploads it to Datadog.
 
+CI/CD uploads require API and application key authentication. Create a Datadog API key and an application key with [Actions API Access][5] enabled, then store them as GitHub secrets.
+
 If your organization is not on US1 (`datadoghq.com`), set `auth.site` in `vite.config.ts` to your [Datadog site][15]. The build reads this configuration when uploading the app, so the same setting also applies to local development. Your Datadog site is `{{< region-param key="dd_site" >}}`.
 
 {{< site-region region="us3,us5,eu,ap1,ap2" >}}
@@ -237,15 +237,23 @@ jobs:
 
 ### Authentication errors
 
-Authentication errors (such as 401 or `Missing authentication token`) and backend function call failures usually point to missing or invalid credentials. Verify that `DD_API_KEY` and `DD_APP_KEY` are set, and that the application key has [Actions API Access][5] enabled.
+For local development and uploads, OAuth authentication errors may have one of these causes:
+
+- The OAuth browser flow did not complete.
+- The cached OAuth token is invalid.
+- `auth.site` does not match your Datadog site.
+
+Rerun the command and complete the browser authorization flow.
+
+If you use API and application key authentication, authentication errors usually point to missing or invalid credentials. Backend function call failures can have the same cause. Verify that `DD_API_KEY` and `DD_APP_KEY` are set, and that the application key has [Actions API Access][5] enabled.
 
 ### Build succeeds but nothing uploads
 
 Make sure you ran `npm run upload` (not `npm run build`), and that `dryRun` in `vite.config.ts` is not set to `true`.
 
 ### Node.js version errors during scaffolding
 
-The scaffolding tool requires Node.js 20.12.0 or later. If you see errors even on a supported version, upgrade to v22. Use a version manager such as [nvm][16], [Volta][17], or [fnm][18], or download from [nodejs.org][19].
+The scaffolding tool requires Node.js 20.12.0 or later. If you see errors even on a supported version, upgrade to v22. Use a version manager such as [nvm][16], [Volta][17], or [fnm][18], or download from the [Node.js website][19].
 
 ## Further reading
 

content/en/agent/fleet_automation/_index.md

@@ -39,6 +39,7 @@ With Fleet Automation, you can:
 - **[Configure Datadog Agents][4]** to centralize setup and gain visibility into your environments faster.
 - **[Keep your fleet up to date][5]** by identifying and upgrading outdated Agent and OTel Collector versions.
 - **[Send a support flare remotely][6]**, reducing the time it takes to debug issues on an Agent or DDOT Collector.
+- **[View your fleet by Kubernetes cluster][7]** to inspect and configure Agents grouped by cluster instead of as individual hosts.
 
 ## Fleet Automation API
 
@@ -71,3 +72,4 @@ For information on setting up roles and permissions, see [Access Control][2].
 [4]: /agent/fleet_automation/configure_agents/
 [5]: /agent/fleet_automation/upgrade_agents/
 [6]: /agent/troubleshooting/send_a_flare/#send-a-flare-from-the-datadog-site
+[7]: /agent/fleet_automation/fleet_view/#kubernetes-view

content/en/agent/fleet_automation/fleet_view.md

@@ -8,6 +8,9 @@ further_reading:
 - link: "/agent/troubleshooting/send_a_flare/"
   tag: "Documentation"
   text: "Send a flare"
+- link: "/containers/kubernetes/installation/"
+  tag: "Documentation"
+  text: "Install the Datadog Agent on Kubernetes"
 ---
 
 {{< site-region region="gov,gov2" >}}
@@ -46,6 +49,13 @@ Select a Datadog Agent or OTel Collector to view its configuration, connected in
 
 {{< img src="agent/fleet_automation/fleet-automation-view-config.png" alt="The Agent detail panel showing configuration, connected integrations, and audit events." style="width:100%;" >}}
 
+## Search and filter
+
+Use the search bar at the top of Fleet View to find specific Agents, OTel Collectors, or clusters across your fleet. You can:
+
+- Perform free-text search by hostname or cluster name
+- Filter by host and Agent tags, such as operating system, environment (`env`), team, and enabled products (`products_enabled`)
+
 ## Visualize OTel pipelines
 
 The {{< ui >}}Configuration{{< /ui >}} tab for an OTel Collector includes {{< ui >}}Pipeline{{< /ui >}} and {{< ui >}}Topology{{< /ui >}} views. These views provide end-to-end visibility into how telemetry flows through your OTel pipelines.
@@ -95,10 +105,61 @@ When you contact Datadog Support with Remote Configuration enabled, the Support
 
 {{< img src="agent/fleet_automation/fleet_automation_remote_flare.png" alt="The support tab for an Agent with the Send Flare button." style="width:100%;" >}}
 
+## Kubernetes view
+
+The Kubernetes view lets you see Datadog Agents and OTel Collectors running in Kubernetes environments. It provides a unified view of your fleet across both host-based and containerized infrastructure.
+
+By default, Fleet View lists infrastructure as individual hosts. Use the {{< ui >}}View by infra type{{< /ui >}} toggle to switch to the [Kubernetes view][4], which shows Agents by Kubernetes cluster instead.
+
+Each row is a cluster managed by the [Datadog Operator][5] or Helm chart. The cluster's Node Agents, Cluster Agent, and Cluster Check Runners appear grouped together rather than as individual hosts.
+
+### Prerequisites for Kubernetes view
+
+Most Kubernetes view features are available without version requirements. Specific capabilities require:
+
+| Capability | Requirement |
+|---|---|
+| View `DatadogAgent` configuration | Datadog Operator v1.24 or later |
+| View Helm Chart values | Datadog Helm Chart v3.157.0 or later |
+| Edit configuration | [Remote Configuration][6] enabled and Datadog Operator v1.27 or later |
+| View integrations on a Cluster Agent | Agent v7.72.0 or later |
+| View integration status on a Cluster Agent | Agent v7.79.0 or later |
+
+To edit configuration from Fleet View, also set the following flags in your [Operator configuration][7]: `remoteConfigEnabled`, `remoteUpdatesEnabled`, and `createControllerRevisions`. Editing Helm Chart values from Fleet View is not supported.
+
+### View Kubernetes clusters
+
+Clusters are listed alphabetically by cluster name. The table lists each cluster's name, deployment method (Datadog Operator or Helm), namespace, Agent version, Agent pod status, readiness, age, and number of restarts.
+
+To find a specific cluster, you can [search](#search-and-filter) by cluster name.
+
+Click a cluster to view:
+
+- Cluster details, such as environment and tags
+- Cluster-level Agents (Cluster Agent and Cluster Check Runners)
+- Node Agents
+
+On the {{< ui >}}Configuration{{< /ui >}} tab, you can view configuration:
+
+- **Datadog Operator v1.24 or later**: View the `DatadogAgent` custom resource configuration. With Datadog Operator v1.27 or later, you can also edit the configuration from this tab.
+- **Datadog Helm Chart v3.157.0 or later**: View the Helm Chart values (`values.yaml`).
+
+### Limitations
+
+Compared to the default view, the Kubernetes view has the following limitations:
+
+- You cannot send remote support flares.
+- You can see which OTel Collectors are running, but you cannot view their configuration in the Kubernetes view.
+- Fleet Automation API access is not available.
+
 ## Further Reading
 
 {{< partial name="whats-next/whats-next.html" >}}
 
 [1]: https://app.datadoghq.com/fleet
 [2]: /agent/troubleshooting/send_a_flare/#send-a-flare-from-the-datadog-site
 [3]: /agent/configuration/agent-configuration-files/
+[4]: https://app.datadoghq.com/fleet?view_by=clusters
+[5]: /containers/datadog_operator
+[6]: /agent/guide/setup_remote_config
+[7]: https://github.com/DataDog/datadog-operator/blob/main/docs/configuration.v2alpha1.md

content/en/api/v1/logs-pipelines/request.CreateLogsPipeline_104735144.json

@@ -0,0 +1,26 @@
+{
+  "filter": {
+    "query": "source:python"
+  },
+  "name": "testPipelineArrayMapNoPreserve",
+  "processors": [
+    {
+      "type": "array-map-processor",
+      "is_enabled": true,
+      "name": "map and remove source",
+      "source": "items",
+      "target": "out",
+      "preserve_source": false,
+      "processors": [
+        {
+          "type": "attribute-remapper",
+          "sources": [
+            "$sourceElem.id"
+          ],
+          "target": "$targetElem.uid"
+        }
+      ]
+    }
+  ],
+  "tags": []
+}

content/en/api/v1/logs-pipelines/request.CreateLogsPipeline_1185292896.json

@@ -0,0 +1,36 @@
+{
+  "filter": {
+    "query": "source:python"
+  },
+  "name": "testPipelineArrayMapCategory",
+  "processors": [
+    {
+      "type": "array-map-processor",
+      "is_enabled": true,
+      "name": "categorize items",
+      "source": "items",
+      "target": "out",
+      "processors": [
+        {
+          "type": "category-processor",
+          "target": "$targetElem.level",
+          "categories": [
+            {
+              "filter": {
+                "query": "@$sourceElem.status:error"
+              },
+              "name": "error"
+            },
+            {
+              "filter": {
+                "query": "*"
+              },
+              "name": "info"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "tags": []
+}

content/en/api/v1/logs-pipelines/request.CreateLogsPipeline_2402034476.json

@@ -0,0 +1,23 @@
+{
+  "filter": {
+    "query": "source:python"
+  },
+  "name": "testPipelineArrayMapArithmetic",
+  "processors": [
+    {
+      "type": "array-map-processor",
+      "is_enabled": true,
+      "name": "double counts",
+      "source": "items",
+      "target": "out",
+      "processors": [
+        {
+          "type": "arithmetic-processor",
+          "expression": "$sourceElem.count * 2",
+          "target": "$targetElem.doubled"
+        }
+      ]
+    }
+  ],
+  "tags": []
+}

content/en/api/v1/logs-pipelines/request.CreateLogsPipeline_3996915493.json

@@ -0,0 +1,32 @@
+{
+  "filter": {
+    "query": "source:python"
+  },
+  "name": "testPipelineArrayMap",
+  "processors": [
+    {
+      "type": "array-map-processor",
+      "is_enabled": true,
+      "name": "map items",
+      "source": "items",
+      "target": "out",
+      "preserve_source": true,
+      "processors": [
+        {
+          "type": "attribute-remapper",
+          "sources": [
+            "$sourceElem.id"
+          ],
+          "target": "$targetElem.uid",
+          "preserve_source": true
+        },
+        {
+          "type": "string-builder-processor",
+          "template": "item-%{$sourceElem.id}",
+          "target": "$targetElem.label"
+        }
+      ]
+    }
+  ],
+  "tags": []
+}