[Backport 7.62.x] workloadmeta: add missing runtime and state fields …

…in container parsed from ECS v1 (#32748)

Co-authored-by: Paul Cacheux <[email protected]>

comp/core/workloadmeta/collectors/internal/ecs/v1parser.go

@@ -102,9 +102,14 @@ func (c *collector) parseTaskContainers(
 			Type:   workloadmeta.EventTypeSet,
 			Entity: &workloadmeta.Container{
 				EntityID: entityID,
+				Runtime:  workloadmeta.ContainerRuntimeDocker,
 				EntityMeta: workloadmeta.EntityMeta{
 					Name: container.DockerName,
 				},
+				State: workloadmeta.ContainerState{
+					Status: workloadmeta.ContainerStatusUnknown,
+					Health: workloadmeta.ContainerHealthUnknown,
+				},
 			},
 		})
 	}

comp/core/workloadmeta/def/merge.go

@@ -22,6 +22,7 @@ var (
 	timeType            = reflect.TypeOf(time.Time{})
 	portSliceType       = reflect.TypeOf([]ContainerPort{})
 	containerHealthType = reflect.TypeOf(ContainerHealthUnknown)
+	containerStatusType = reflect.TypeOf(ContainerStatusUnknown)
 	mergerInstance      = merger{}
 )
 
@@ -34,6 +35,9 @@ func (merger) Transformer(typ reflect.Type) func(dst, src reflect.Value) error {
 	// Even though Health is string alias, the matching only matches actual Health
 	case containerHealthType:
 		return healthMerge
+	// Even though Status is string alias, the matching only matches actual Status
+	case containerStatusType:
+		return statusMerge
 	}
 
 	return nil
@@ -54,6 +58,21 @@ func healthMerge(dst, src reflect.Value) error {
 	return nil
 }
 
+func statusMerge(dst, src reflect.Value) error {
+	if !dst.CanSet() {
+		return nil
+	}
+
+	srcStatus := src.Interface().(ContainerStatus)
+	dstStatus := dst.Interface().(ContainerStatus)
+
+	if srcStatus != "" && srcStatus != ContainerStatusUnknown && (dstStatus == "" || dstStatus == ContainerStatusUnknown) {
+		dst.Set(src)
+	}
+
+	return nil
+}
+
 func timeMerge(dst, src reflect.Value) error {
 	if !dst.CanSet() {
 		return nil

releasenotes/notes/cws-fix-containers-billing-19580e6f968dd79a.yaml

@@ -0,0 +1,13 @@
+# Each section from every release note are combined when the
+# CHANGELOG.rst is rendered. So the text needs to be worded so that
+# it does not depend on any information only available in another
+# section. This may mean repeating some details, but each section
+# must be readable independently of the other.
+#
+# Each section note must be formatted as reStructuredText.
+---
+fixes:
+  - |
+    Fix an issue where the remote workloadmeta was not receiving some unset
+    events for ECS containers, causing incorrect billing in CWS, CSPM, CSM Pro, CSM
+    Enterprise, and DevSecOps Enterprise Containers.