verify-ssi
Verify Single Step Instrumentation (SSI) is working end-to-end on Kubernetes — SSI automatically instruments applications for APM without code changes. Only use after enable-ssi has run.
- Installs
- 428
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/datadog-labs/agent-skills --skill verify-ssi- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads verify-ssi automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Verify APM SSI on Kubernetes
Before doing anything else: Fully resolve all variables in
## Context to resolve before acting. Do not begin Step 1 until every variable has a concrete value.
Triggers
Invoke this skill when the user expresses intent to:
- Confirm SSI is working after enabling APM
- Check whether pods are being instrumented
- Verify the tracer is running and reporting telemetry
- Confirm tracer config is applied correctly
Do NOT invoke this skill if:
- SSI has not been enabled yet — run
enable-ssifirst - Pods are not being instrumented at all — use
troubleshoot-ssi
Prerequisites
-
enable-ssiis complete - Application pods have been restarted since SSI was enabled
pup-cli: check, install, and authenticate
Claude runs
pup --version
If not found:
Claude runs
brew tap datadog-labs/pack
brew install pup
Check auth:
pup auth status --site <DD_SITE>
If not authenticated:
Claude runs
pup auth login --site <DD_SITE>
This opens a browser tab for OAuth. Complete the login there — Claude will continue once the command exits.
If valid token — proceed.
ERROR: No browser available — use API key fallback: export DD_APP_KEY=<your-app-key>
Context to resolve before acting
| Variable | How to resolve |
|---|---|
CLUSTER_NAME | Check spec.global.clusterName in datadog-agent.yaml, or kubectl config current-context |
ENV | Check tags.datadoghq.com/env label on the application Deployment |
SERVICE_NAME | Check tags.datadoghq.com/service label on the application Deployment |
Step 1: Confirm Pods are Instrumented
Claude runs
kubectl get pod -l app=<APP_LABEL> -n <APP_NAMESPACE> \
-o jsonpath='{.items[0].spec.initContainers[*].name}'
If the output includes datadog-lib-<language>-init and datadog-init-apm-inject — SSI init containers are injected.
ERROR: Init containers missing — pod was not restarted after SSI was enabled, or namespace targeting is not matching. Restart the pod and recheck.
Step 2: Confirm the Tracer is Reporting Telemetry
Claude runs
DD_SITE=<DD_SITE> pup apm services list --env <ENV> --from 1h
If <SERVICE_NAME> appears in the services list with isTraced: true — continue to Step 3.
ERROR: Service missing — send some traffic to the app first, then retry:
Claude runs
# Port-forward and send test traffic
kubectl port-forward deployment/<DEPLOYMENT_NAME> 8099:8000 -n <APP_NAMESPACE> &
sleep 2 && for i in $(seq 1 10); do curl -s -o /dev/null http://localhost:8099/; done
sleep 30 && kill %1 2>/dev/null
DD_SITE=<DD_SITE> pup apm services list --env <ENV> --from 10m
ERROR: Still missing after traffic — check the agent's trace receiver: kubectl exec -n <AGENT_NAMESPACE> <AGENT_POD> -c agent -- agent status | grep -A 10 "Receiver (previous minute)". If receiver shows 0 traces, go to troubleshoot-ssi.
Step 3: Confirm Tracer Configuration
Only run this step if ddTraceConfigs was explicitly configured in enable-ssi (e.g. profiling, AppSec, Data Streams). If basic SSI was set up without ddTraceConfigs, skip this step. No ddTraceConfigs means there is nothing to check.
The pod spec is the source of truth for whether ddTraceConfigs reached the workload. SSI adds each entry as an env var on the pod's containers.
Run this for a pod in each target that has ddTraceConfigs. For Data Streams, run it once per Deployment in DSM_SERVICES, in that Deployment's namespace, with <LABEL_KEY> set to DSM_LABEL_KEY and <APP_LABEL> to that Deployment's value (both from enable-dsm). Otherwise <LABEL_KEY> is app. A pod matched only by a target without ddTraceConfigs (such as the catch-all default target) should not carry these variables. That is expected, not a failure.
Claude runs
kubectl get pod -l <LABEL_KEY>=<APP_LABEL> -n <APP_NAMESPACE> --sort-by=.metadata.creationTimestamp \
-o jsonpath='{range .items[-1:].spec.containers[*]}{.name}{":"}{"\n"}{range .env[*]}{" "}{.name}={.value}{.valueFrom}{"\n"}{end}{end}' | grep -E '^[^ ].*:$|^ DD_'
To see which target the pod matched:
kubectl get pod -l <LABEL_KEY>=<APP_LABEL> -n <APP_NAMESPACE> --sort-by=.metadata.creationTimestamp \
-o jsonpath='{.items[-1:].metadata.annotations.internal\.apm\.datadoghq\.com/applied-target}'
If every ddTraceConfigs variable for that target appears in the application container with the configured value, the config reached the pod. This confirms delivery, not that the SDK acted on it; onboarding-summary checks the product data. Continue.
ERROR: A variable is missing or has a different value.
- Different value: the Deployment sets that variable itself, and SSI never overwrites an existing variable. Remove it from the Deployment or align it.
- Missing: check it is present in the
DatadogAgentmanifest under the target that matches this pod, and that the pod was restarted after the Cluster Agent finished rolling out.
Then check what the tracer reports at runtime. This output is informational; do not fail Step 3 on it.
Claude runs
pup apm service-library-config get \
--service-name <SERVICE_NAME> \
--env <ENV>
This view does not list every setting for every SDK. For example, DD_DATA_STREAMS_ENABLED does not show for Java, Python, Ruby, or Go services even when DSM is on. A setting missing here is not a failure when it is present in the pod env. For Data Streams, onboarding-summary confirms data with data_streams.latency (or enable-dsm Step 3 when it was run standalone).
Done
Exit when ALL of the following are true:
- Step 1: target pods have SSI init containers injected (
datadog-lib-<language>-initanddatadog-init-apm-inject) - Step 2: service appears in
pup apm services listwithisTraced: true - Step 3 (only if
ddTraceConfigswas set): eachddTraceConfigsvariable appears in the env of pods in its target with the configured value. A setting missing frompup apm service-library-config getis not a failure
If any check fails, go to troubleshoot-ssi.
When all steps pass, automatically proceed to onboarding-summary now — do not ask the user for permission.
Security constraints
- Never write a raw API key into any file or chat message
- Never run
kubectl deletewithout user confirmation
FAQ
What does the verify-ssi skill do?
Verify Single Step Instrumentation (SSI) is working end-to-end on Kubernetes — SSI automatically instruments applications for APM without code changes. Only use after enable-ssi has run.
How do I install verify-ssi?
Run npx skills add https://github.com/datadog-labs/agent-skills --skill verify-ssi in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/verify-ssi/ (personal) or .claude/skills/verify-ssi/ (project).
Which AI agents can use verify-ssi?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is verify-ssi safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains verify-ssi?
It is published by datadog-labs in datadog-labs/agent-skills, and it is an official skill from the maker of the technology it covers. It has 428 recorded installs.
More from datadog-labs/agent-skills
dd-pup
datadog-labs/agent-skills
Datadog CLI (Rust). OAuth2 auth with token refresh.
agent-skills
datadog-labs/agent-skills
Datadog skills for AI agents. Essential monitoring, logging, tracing and observability.
dd-logs
datadog-labs/agent-skills
Log management - search, archives, metrics, and cost control.
dd-apm
datadog-labs/agent-skills
APM - install, onboard, instrument, enable, set up, configure, traces, services, dependencies, performance analysis, Data Streams Monitoring (DSM), queue lag, pipeline latency. Use for any request involving Datadog APM setup, instrumentation (SSI, ddtrace, agent install), or analysis.
dd-monitors
datadog-labs/agent-skills
Monitor management - list, search, file-based create, and alerting best practices.
dd-docs
datadog-labs/agent-skills
Datadog docs lookup using docs.datadoghq.com/llms.txt and linked Markdown pages.
Popular devops & cloud skills
microsoft-foundry
microsoft/azure-skills
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent create, managed harness agent create, GitHub Copilot harness agent, create agent, update agent, add tool to agent, invoke agent, agent insights, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure
azure-diagnostics
microsoft/azure-skills
Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.
azure-prepare
microsoft/azure-skills
Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.
azure-ai
microsoft/azure-skills
Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.
azure-deploy
microsoft/azure-skills
Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.
azure-validate
microsoft/azure-skills
Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.