[Backport v1.28] [CONTP-1709] Support enabling datadoginstrumentation crd controller by dd-octo-sts[bot] · Pull Request #3125 · DataDog/datadog-operator

dd-octo-sts · 2026-06-10T20:09:41Z

Backport 25a5943 from #3002.

What does this PR do?

Enables the DatadogInstrumentation CRD controller in the cluster agent, when the cluster agent version meets the minimum requirement (>= 7.81.0). Users can opt in via the agent.datadoghq.com/instrumentation-crd-enabled: "false" annotation on the DatadogAgent resource.

Necessary RBACs for the controller to operate are automatically added when the feature is enabled.

Motivation

Previously, enabling the instrumentation CRD controller required manually adding DD_INSTRUMENTATION_CRD_CONTROLLER_ENABLED to both cluster and node agents. There was also no enforcement of the admission controller or RBAC prerequisites. This PR wires it up automatically for users meeting the version threshold.

Describe how you validated your changes

Added unit tests in instrumentationcrd/feature_test.go.

Manual QA

Deploy custom operator
Deploy DDA (no extra config needed — feature is on by default):

apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: datadog
spec:
  global:
    logLevel: &quot;info&quot;
    clusterName: &lt;YOUR_CLUSTER_NAME&gt;
    credentials:
      apiSecret:
        secretName: datadog-secret
        keyName: api-key
      appSecret:
        secretName: datadog-secret
        keyName: app-key
    kubelet:
      tlsVerify: false
  features:
    apm:
      instrumentation:
        enabled: true

Check that DCA and node agents have DD_INSTRUMENTATION_CRD_CONTROLLER_ENABLED: "true"
<img width="511" height="61" alt="image" src="https://github.com/user-attachments/assets/997d5648-2fd7-4e40-aabe-962ebbb95df8" />
A cluster role and binding created with necessary datadoginstrumentation RBACs.
<img width="1301" height="111" alt="image" src="https://github.com/user-attachments/assets/b7210b81-b862-43ae-9f86-56f60b48227b" />

Checklist

PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
PR has a milestone or the qa/skip-qa label
All commits are signed (see: signing commits)

…3002) feat: add instrumentation controller crd feature fix: remove default rbac test chore: add instrumentation env var to single container chore: change rbac name Merge branch 'main' into mathew.estafanous/instrumentation-crd-feature switch to annotation (#3080) * switch to annotation * fix linter instrumentation crd feature on by default minimum required version is 7.81 enable feature with annotation switch to disable by default Co-authored-by: levan-m <[email protected]> Co-authored-by: mathew.estafanous <[email protected]> (cherry picked from commit 25a5943)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 90be8d0bf1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-06-10T20:12:57Z

+	managers.EnvVar().AddEnvVarToContainer(
+		apicommon.UnprivilegedSingleAgentContainerName,
+		&corev1.EnvVar{
+			Name:  DDInstrumentationCRDControllerEnabled,
+			Value: "true",


Do not enable the DCA controller on node agents

The DDAI agent reconciler calls ManageSingleContainerNodeAgent/ManageNodeAgent for every enabled feature while building the node-agent DaemonSet, so enabling the annotation also injects DD_INSTRUMENTATION_CRD_CONTROLLER_ENABLED=true into node-agent pods (and the multi-container method below does the same). This variable is the cluster-agent controller switch, while the RBAC added by this feature is bound only to the cluster-agent ServiceAccount, so node agents can start the controller without the permissions it needs; these NodeAgent methods should no-op.

Useful? React with 👍 / 👎.

codecov-commenter · 2026-06-10T20:22:58Z

Codecov Report

❌ Patch coverage is 62.85714% with 26 lines in your changes missing coverage. Please review.
✅ Project coverage is 43.31%. Comparing base (ad3447a) to head (90be8d0).

Files with missing lines	Patch %	Lines
...datadogagent/feature/instrumentationcrd/feature.go	61.76%	25 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##            v1.28    #3125      +/-   ##
==========================================
- Coverage   43.44%   43.31%   -0.14%     
==========================================
  Files         350      352       +2     
  Lines       29994    30049      +55     
==========================================
- Hits        13031    13015      -16     
- Misses      16091    16161      +70     
- Partials      872      873       +1

Flag	Coverage Δ
unittests	`43.31% <62.85%> (-0.14%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...roller/datadogagent/component/clusteragent/rbac.go	`22.88% <ø> (-42.54%)`	⬇️
internal/controller/datadogagent/controller.go	`48.00% <ø> (ø)`
...r/datadogagent/feature/instrumentationcrd/const.go	`100.00% <100.00%> (ø)`
...nal/controller/datadogagent/feature/utils/utils.go	`0.00% <ø> (ø)`
...datadogagent/feature/instrumentationcrd/feature.go	`61.76% <61.76%> (ø)`

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ad3447a...90be8d0. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

datadog-datadog-prod-us1-2 · 2026-06-10T20:22:58Z

✨ Fix all issues with BitsAI

🛑 Gate Violations

🎯 1 Code Coverage issue detected

A Patch coverage percentage gate may be blocking this PR.

• Patch coverage: 63.64% (threshold: 80.00%)

ℹ️ Info

🎯 Code Coverage (details)
• Patch Coverage: 63.64%
• Overall Coverage: 43.59% (-0.15%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 90be8d0 | Docs | Datadog PR Page | Give us feedback!}

dd-octo-sts Bot requested a review from a team as a code owner June 10, 2026 20:09

dd-octo-sts Bot added enhancement New feature or request mergequeue-status: done backport label added by backport action bot label added by backport bot team/container-platform labels Jun 10, 2026

dd-octo-sts Bot added this to the v1.28.0 milestone Jun 10, 2026

chatgpt-codex-connector Bot reviewed Jun 10, 2026

View reviewed changes

Mathew-Estafanous approved these changes Jun 11, 2026

View reviewed changes

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: queued mergequeue-status: in_progress and removed mergequeue-status: done mergequeue-status: queued labels Jun 11, 2026

Mathew-Estafanous merged commit 68d9802 into v1.28 Jun 11, 2026
82 of 83 checks passed

Mathew-Estafanous deleted the backport-3002-to-v1.28 branch June 11, 2026 12:35

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: done and removed mergequeue-status: in_progress labels Jun 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Backport v1.28] [CONTP-1709] Support enabling datadoginstrumentation crd controller#3125

[Backport v1.28] [CONTP-1709] Support enabling datadoginstrumentation crd controller#3125
Mathew-Estafanous merged 1 commit into
v1.28from
backport-3002-to-v1.28

dd-octo-sts Bot commented Jun 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jun 10, 2026

Uh oh!

codecov-commenter commented Jun 10, 2026 •

edited

Loading

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Jun 10, 2026 •

edited by datadog-prod-us1-4 Bot

Loading

🎯 1 Code Coverage issue detected

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dd-octo-sts Bot commented Jun 10, 2026

What does this PR do?

Motivation

Describe how you validated your changes

Manual QA

Checklist

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Jun 10, 2026 • edited by datadog-prod-us1-4 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛑 Gate Violations

🎯 1 Code Coverage issue detected

ℹ️ Info

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov-commenter commented Jun 10, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 Bot commented Jun 10, 2026 •

edited by datadog-prod-us1-4 Bot

Loading