What does this PR do?

Adds operator support for the new AppSec ingress-nginx admission-controller injection feature introduced in cluster-agent PR #49318 (merged 2026-04-17).

The cluster-agent now supports a third proxy type for AppSec injection (ingress-nginx, alongside Envoy Gateway and Istio). This PR surfaces the new configuration knob and the required RBAC permissions so users deploying the cluster-agent via the datadog-operator can use the feature.

Changes:

• New annotation agent.datadoghq.com/appsec.nginx.module_mount_path — overrides the mount path inside the controller pod where the nginx-datadog module is exposed
• The annotation forwards to the cluster-agent as DD_ADMISSION_CONTROLLER_APPSEC_NGINX_MODULE_MOUNT_PATH env var (only when non-empty; cluster-agent owns the default)
• Two new ClusterRole rules added to the AppSec feature RBAC:
  • networking.k8s.io/ingressclasses [get, list, watch] — for discovering ingress-nginx controllers
  • ""/configmaps [get, list, watch, create, update, delete] — for managing the DD-owned ConfigMaps that prepend the WAF config (cluster-wide, unscoped; see security note in rbac.go)
• "ingress-nginx" added to the allowedProxyValues whitelist

Motivation

Cluster-agent PR #49318 extended AppSec proxy injection to ingress-nginx. Without this operator change, users deploying via the datadog-operator cannot use the feature because:

1. The cluster-agent lacks the RBAC permissions to watch IngressClass resources and manage the DD-owned ConfigMaps
2. There is no way to override the module mount path

Additional Notes

• Annotation-based (not CRD fields): matches the existing AppSec proxy injection pattern — Envoy/Istio sidecar config is already annotation-based via agent.datadoghq.com/appsec.*
• Additive-only RBAC: the existing configmaps [get, update] rule is preserved unchanged; the new wider rule is appended as a separate entry
• No CRD schema changes: make generate && make manifests produces zero diff
• Security note on the new configmaps rule is verbatim from the cluster-agent briefing — the reconciler filters by labels appsec.datadoghq.com/watched-configmap=true and app.kubernetes.io/component=datadog-appsec-injector at runtime
• The init image override (appsec.nginx.init_image) was descoped: the cluster-agent appends the ingress-nginx controller version to the init image reference, making a user-supplied tagged image unsafe to forward. This will be addressed on the cluster-agent side separately.
• Sister change: briefing-datadog-helm-chart-ingress-nginx-appsec.md tracks the corresponding Helm chart update (separate PR)

Minimum Agent Versions

• Agent: N/A (operator-side change only)
• Cluster Agent: v7.76.0 (minimum already enforced by ClusterAgentMinVersion constant; cluster-agent ignores unknown env vars on older versions)

Describe your test plan

Unit tests

Tests added (TDD) covering:

• TestConfigValidate: "ingress-nginx" accepted as valid proxy value
• TestFromAnnotations: happy path, unset annotation, empty-string annotation
• TestAppsecFeature: env var emitted when annotation set; absent when feature disabled, annotation empty, or annotation unset
• TestAppsecRBACPolicyRules: both new rules present; existing [get, update] rule preserved

go test ./internal/controller/datadogagent/feature/appsec/... -v -count=1

QA on kind

Prerequisites:

• A kind cluster: kind create cluster
• The operator built from this branch: make docker-build IMG=datadog/operator:dev
• Load it into kind: kind load docker-image datadog/operator:dev

Step 1 — Deploy the operator with a DatadogAgent that has AppSec injection enabled:

apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: datadog
  annotations:
    agent.datadoghq.com/appsec.injector.enabled: "true"
    agent.datadoghq.com/appsec.injector.autoDetect: "true"
    agent.datadoghq.com/appsec.nginx.module_mount_path: "/custom/modules"
spec:
  global:
    credentials:
      apiKey: <your-api-key>
  features:
    clusterAgent:
      replicas: 1

Step 2 — Verify the ClusterRole includes the new RBAC rules:

# Get the generated ClusterRole name
CR_NAME=$(kubectl get clusterrole -l app.kubernetes.io/managed-by=datadog-operator \
  -o jsonpath='{.items[*].metadata.name}' | tr " " "\n" | grep appsec)

# Verify ingressclasses rule
kubectl get clusterrole "$CR_NAME" -o json \
  | jq '.rules[] | select(.resources[] == "ingressclasses")'
# Expected: apiGroups=["networking.k8s.io"], verbs=["get","list","watch"]

# Verify new configmaps rule (the one with 6 verbs, not the existing 2-verb rule)
kubectl get clusterrole "$CR_NAME" -o json \
  | jq '[.rules[] | select(.resources[] == "configmaps")] | .[] | select(.verbs | length > 2)'
# Expected: apiGroups=[""], verbs=["get","list","watch","create","update","delete"]

# Verify existing configmaps rule still present
kubectl get clusterrole "$CR_NAME" -o json \
  | jq '[.rules[] | select(.resources[] == "configmaps")] | .[] | select(.verbs | length == 2)'
# Expected: apiGroups=[""], verbs=["get","update"]

Step 3 — Verify the cluster-agent container has the env var:

DCA_POD=$(kubectl get pods -l app.kubernetes.io/name=datadog-cluster-agent \
  -o jsonpath='{.items[0].metadata.name}')

# Verify module mount path env var is set
kubectl exec "$DCA_POD" -- env | grep DD_ADMISSION_CONTROLLER_APPSEC_NGINX_MODULE_MOUNT_PATH
# Expected: DD_ADMISSION_CONTROLLER_APPSEC_NGINX_MODULE_MOUNT_PATH=/custom/modules

Step 4 — Verify env var is absent when annotation is not set:

Remove the appsec.nginx.module_mount_path annotation from the DatadogAgent, wait for reconciliation, and verify:

kubectl exec "$DCA_POD" -- env | grep DD_ADMISSION_CONTROLLER_APPSEC_NGINX
# Expected: no output (env var not present — cluster-agent uses its own default)

Checklist

• PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
• PR has a milestone or the qa/skip-qa label
• All commits are signed (see: signing commits)