[CONTP-1596]Improve GKE Autopilot support by tbavelier · Pull Request #3013 · DataDog/datadog-operator

tbavelier · 2026-05-13T14:01:39Z

What does this PR do?

Updates GKE Autopilot support for DatadogAgent reconciliation and the GKE WorkloadAllowlist synchronizer.

Commit breakdown:

972a0b2
- Bumps the default WorkloadAllowlist version to v1.0.5.
- Adds the experimental.agent.datadoghq.com/autopilot-allowlist-version override.
- Replaces Helm hook annotations on the AllowlistSynchronizer with operator ownership labels, including the DatadogAgent app.kubernetes.io/part-of value.
- Applies the AllowlistSynchronizer with server-side apply so existing datadog-synchronizer objects are updated when the desired allowlist path or labels change.
- Adds RBAC permission to patch allowlistsynchronizers.auto.gke.io for server-side apply.
- Logs successful reconciled applies at verbose level to avoid reconcile spam while keeping errors surfaced.
e7042a2
- Sets DD_KUBELET_USE_API_SERVER=true for Autopilot.
- Enables fine-grained kubelet authorization by default on Autopilot.
- Adds pods get/list RBAC when API-server pod discovery is required.
0a9040e
- Removes auth-token env and mounts that are not allowed on Autopilot.
- Expands Autopilot mount cleanup across additional containers.
- Keeps NPM/system-probe volumes and mounts that are covered by the WorkloadAllowlist.
7dce32e
- Makes the seccomp security mount read-only and verifies it in Autopilot reconciler tests.
4d41757
- Rewrites the log collection run-path hostPath to the Autopilot-approved log storage path.
a1ae71b
- Restricts cloud provider metadata collection to GCP on Autopilot.

Motivation

The existing Autopilot overrides were out of date with current GKE Autopilot allowlist behavior and left several generated pod specs with resources, mounts, or discovery settings that are not valid on Autopilot.

This also makes the WorkloadAllowlist version explicit and overrideable, so future allowlist bumps do not require changing the synchronizer logic.

Additional Notes

The clean branch was rebuilt from main with the Autopilot work grouped into reviewable commits. Two unrelated unused helper functions from the original branch history were intentionally left out of controller_v2_test.go.
This requires the v1.0.5 Datadog WorkloadAllowlist.

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

Agent: N/A
Cluster Agent: N/A

Describe your test plan

Verified on v1.35.3-gke.1737000

go test ./pkg/allowlistsynchronizer

Checklist

PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
PR has a milestone or the qa/skip-qa label
All commits are signed (see: signing commits)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7d80ce13ee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codecov-commenter · 2026-05-13T14:13:38Z

Codecov Report

❌ Patch coverage is 73.72881% with 31 lines in your changes missing coverage. Please review.
✅ Project coverage is 42.68%. Comparing base (b2a60a9) to head (a1ae71b).

Files with missing lines	Patch %	Lines
.../controller/datadogagent/experimental/autopilot.go	68.83%	20 Missing and 4 partials ⚠️
pkg/allowlistsynchronizer/allowlistsynchronizer.go	82.14%	5 Missing ⚠️
internal/controller/datadogagent/common/volumes.go	0.00%	1 Missing ⚠️
...nal/controller/datadogagent/global/dependencies.go	75.00%	0 Missing and 1 partial ⚠️

❌ Your patch status has failed because the patch coverage (73.72%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3013      +/-   ##
==========================================
+ Coverage   42.24%   42.68%   +0.44%     
==========================================
  Files         337      337              
  Lines       28951    29046      +95     
==========================================
+ Hits        12230    12399     +169     
+ Misses      15916    15830      -86     
- Partials      805      817      +12

Flag	Coverage Δ
unittests	`42.68% <73.72%> (+0.44%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...al/controller/datadogagent/component/agent/rbac.go	`81.48% <100.00%> (+81.48%)`	⬆️
internal/controller/datadogagent_controller.go	`62.12% <ø> (ø)`
internal/controller/datadogagent/common/volumes.go	`0.00% <0.00%> (ø)`
...nal/controller/datadogagent/global/dependencies.go	`19.52% <75.00%> (+0.64%)`	⬆️
pkg/allowlistsynchronizer/allowlistsynchronizer.go	`70.96% <82.14%> (+70.96%)`	⬆️
.../controller/datadogagent/experimental/autopilot.go	`60.76% <68.83%> (+60.76%)`	⬆️

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b2a60a9...a1ae71b. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

datadog-datadog-prod-us1-2 · 2026-05-13T14:28:09Z

✨ Fix all issues with BitsAI

🛑 Gate Violations

🎯 1 Code Coverage issue detected

A Patch coverage percentage gate may be blocking this PR.

• Patch coverage: 72.97% (threshold: 80.00%)

ℹ️ Info

🎯 Code Coverage (details)
• Patch Coverage: 72.97%
• Overall Coverage: 43.03% (+0.44%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: a1ae71b | Docs | Datadog PR Page | Give us feedback!}

tbavelier · 2026-05-20T15:17:09Z

Botched rebase, ignore the pings, sorry for that!

github-actions Bot added the team/container-platform label May 13, 2026

tbavelier added the enhancement New feature or request label May 13, 2026 — with ChatGPT Codex Connector

tbavelier added this to the v1.28.0 milestone May 13, 2026

tbavelier marked this pull request as ready for review May 13, 2026 14:08

tbavelier requested a review from a team May 13, 2026 14:08

tbavelier mentioned this pull request May 13, 2026

Tbavelier/contp 1596 autopilot #2983

Closed

3 tasks

tbavelier changed the title ~~Improve GKE Autopilot support~~ [CONTP-1596]Improve GKE Autopilot support May 13, 2026

chatgpt-codex-connector Bot reviewed May 13, 2026

View reviewed changes

Comment thread pkg/allowlistsynchronizer/allowlistsynchronizer.go Outdated

tbavelier force-pushed the tbavelier/contp-1596-autopilot-clean branch from 7d80ce1 to 5f79f93 Compare May 13, 2026 14:22

tbavelier force-pushed the tbavelier/contp-1596-autopilot-clean branch 2 times, most recently from 1e614a8 to 7cf3137 Compare May 13, 2026 14:54

tbavelier mentioned this pull request May 18, 2026

[OTAGENT-980] Reference v1.0.5 WorkloadAllowlist exemption when OTel collector is enabled #3022

Closed

4 tasks

tbavelier requested review from a team as code owners May 20, 2026 15:15

tbavelier requested review from RiantZ and charan-manjunath May 20, 2026 15:15

github-actions Bot added team/cloud-network-monitoring team/container-autoscaling team/documentation team/fleet team/opentelemetry-agent team/profiling-full-host team/universal-service-monitoring labels May 20, 2026

github-actions Bot removed team/cloud-network-monitoring team/profiling-full-host team/container-autoscaling team/documentation team/universal-service-monitoring team/fleet team/opentelemetry-agent labels May 20, 2026

tbavelier force-pushed the tbavelier/contp-1596-autopilot-clean branch from 51f1b85 to 5c6d883 Compare May 20, 2026 15:21

drichards-87 self-assigned this May 20, 2026

drichards-87 approved these changes May 20, 2026

View reviewed changes

drichards-87 removed their assignment May 20, 2026

tbavelier added 6 commits May 26, 2026 10:54

autopilot: support WorkloadAllowlist version override

972a0b2

autopilot: use API server for pod discovery

e7042a2

Remove auth-token on GKE Autopilot - not in allowlist

0a9040e

autopilot make seccomp-setup readonly=true

7dce32e

Set Autopilot log storage hostPath

4d41757

Set GCP cloud metadata on Autopilot

a1ae71b

tbavelier force-pushed the tbavelier/contp-1596-autopilot-clean branch from 5c6d883 to a1ae71b Compare May 26, 2026 08:55

levan-m approved these changes May 27, 2026

View reviewed changes

tbavelier merged commit 6b4b5f7 into main May 28, 2026
37 of 38 checks passed

tbavelier deleted the tbavelier/contp-1596-autopilot-clean branch May 28, 2026 06:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[CONTP-1596]Improve GKE Autopilot support#3013

[CONTP-1596]Improve GKE Autopilot support#3013
tbavelier merged 6 commits into
mainfrom
tbavelier/contp-1596-autopilot-clean

tbavelier commented May 13, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

codecov-commenter commented May 13, 2026 •

edited

Loading

Uh oh!

datadog-datadog-prod-us1-2 Bot commented May 13, 2026 •

edited by datadog-prod-us1-6 Bot

Loading

🎯 1 Code Coverage issue detected

Uh oh!

tbavelier commented May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

tbavelier commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Additional Notes

Minimum Agent Versions

Describe your test plan

Checklist

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

codecov-commenter commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

datadog-datadog-prod-us1-2 Bot commented May 13, 2026 • edited by datadog-prod-us1-6 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛑 Gate Violations

🎯 1 Code Coverage issue detected

ℹ️ Info

Uh oh!

tbavelier commented May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tbavelier commented May 13, 2026 •

edited

Loading

codecov-commenter commented May 13, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 Bot commented May 13, 2026 •

edited by datadog-prod-us1-6 Bot

Loading