Backport d09fcb3 from #2889.

What does this PR do?

reported in #2886

Fix similar to #2793 for configmaps

• Don't start CM watch in helm metadata forwarder if Operator doesn't have list/watch RBAC.

Motivation

What inspired you to submit this pull request?

Additional Notes

Anything else we should know when reviewing?

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

• Agent: vX.Y.Z
• Cluster Agent: vX.Y.Z

Describe your test plan

1. install Operator

❯ helm install operator datadog/datadog-operator \
--set datadogMonitor.enabled=true \
--set datadogAgent.enabled=false \
--set datadogAgentInternal.enabled=false

2. Update rbac to drop secret watch, list permissions, restart operator pod.

kubectl get clusterrole operator-datadog-operator -o json \
    | jq '
        .rules |= map(
          if (.resources // [] | index("configmaps")) != null
          then .resources |= map(select(. != "configmaps"))
          else .
          end
        )
        | .rules += [{"apiGroups":[""],"resources":["configmaps"],"verbs":["create","delete","get","patch","update"]}]
      ' \
    | kubectl apply -f -

kubectl rollout restart deployment/operator-datadog-operator

4. Observer errors
   {"level":"ERROR","ts":"2026-04-10T14:22:21.312Z","logger":"controller-runtime.cache.UnhandledError","msg":"Failed to watch","reflector":"pkg/mod/k8s.io/[email protected]/tools/cache/reflector.go:289","type":"*v1.ConfigMap","error":"failed to list *v1.ConfigMap: configmaps is forbidden: User "system:serviceaccount:default:operator-datadog-operator" cannot list resource "configmaps" in API group "" in the namespace "default"","stacktrace":"k8s.io/apimachinery/pkg/util/runtime.logError\n\t/go/pkg/mod/k8s.io/[email protected]/pkg/util/runtime/runtime.go:221\n

5. Update to fixed image; after restart Operator should log
   {"level":"INFO","ts":"2026-04-10T14:18:38.100Z","logger":"metadata.helm","msg":"No permission to list/watch ConfigMaps, Helm metadata collection from ConfigMaps will be disabled"}

Checklist

• PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
• PR has a milestone or the qa/skip-qa label
• All commits are signed (see: signing commits)