Skip to content

[ACTP] Extend PAR k8s RBAC in DCA for kubetray use cases#3222

Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 3 commits into
mainfrom
merchristk-ACTP-extend-par-dca-rbac-for-kubetray
Jul 8, 2026
Merged

[ACTP] Extend PAR k8s RBAC in DCA for kubetray use cases#3222
gh-worker-dd-mergequeue-cf854d[bot] merged 3 commits into
mainfrom
merchristk-ACTP-extend-par-dca-rbac-for-kubetray

Conversation

@merchristK

@merchristK merchristK commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

Extends the Kubernetes RBAC permissions for the Private Action Runner (PAR) running inside the Datadog Cluster Agent (DCA) to unblock kubetray use cases.

Motivation

Kubetray requires two operations not previously supported by PAR-in-DCA:

  • Pod delete: needed for pod restart flows; safe because pods managed by a Deployment/StatefulSet are recreated automatically by their controller.
  • StatefulSet patch: enables restart, rollback, and scale operations on StatefulSets (analogous to how Deployment restart/scale is already done via patch).

Additional Notes

StatefulSet get/list/watch was already present in the read rule; this PR adds patch in a separate write rule, keeping read and write rules distinct. The permissions are within the maximum set the DCA itself can have when all features are enabled.

Minimum Agent Versions

N/A — operator-side RBAC change only.

Describe your test plan

Deployed the operator on a local cluster and then ran k get clusterrole datadog-private-action-runner -o yaml and verified we have the new permissions.

cd ~/dd/datadog-operator
# Make sure you are using the right ns
kubens datadog-operator-test

# Build the operator image
make docker-build IMG=datadog-test/operator:local

# Install the operator
helm install datadog-operator datadog/datadog-operator \
    --set image.repository=datadog-test/operator \
    --set image.tag=local \
    --set image.doNotCheckTag=true

# Install the DatadogAgent crd
kubectl apply -k ./manifests

kubectl get clusterrole datadog-private-action-runner -o yaml

Checklist

  • PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
  • PR has a milestone or the qa/skip-qa label
  • All commits are signed (see: signing commits)

@datadog-datadog-prod-us1-2

datadog-datadog-prod-us1-2 Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Code Coverage

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 46.36% (+0.09%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 1107985 | Docs | Datadog PR Page | Give us feedback!

@merchristK merchristK added this to the v1.30.0 milestone Jul 6, 2026
@merchristK merchristK added the enhancement New feature or request label Jul 6, 2026
@merchristK
merchristK marked this pull request as ready for review July 6, 2026 13:18
@merchristK
merchristK requested a review from a team July 6, 2026 13:18
@merchristK
merchristK requested a review from a team as a code owner July 6, 2026 13:18
@merchristK
merchristK requested review from maddiefranke and removed request for a team July 6, 2026 13:18
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Jul 6, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: acf7bc61ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread internal/controller/datadogagent/feature/privateactionrunner/rbac.go
Comment on lines +58 to +59
Resources: []string{rbac.StatefulsetsResource},
Verbs: []string{rbac.PatchVerb},

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Grant ControllerRevision reads for StatefulSet rollback

For the new StatefulSet rollback use case, patching statefulsets is not enough: the standard Kubernetes rollback path first lists apps/controllerrevisions owned by the StatefulSet and only then patches the StatefulSet. This remediation ClusterRole still omits controllerrevisions (repo-wide search only finds that resource in other feature RBAC), so PAR-in-DCA rollback attempts will continue to be forbidden unless another unrelated feature happens to grant that permission.

Useful? React with 👍 / 👎.

@merchristK merchristK Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👀 looking into it

@merchristK merchristK Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Legit but I think it depends on the implementation. I'd like the kubeactions implementation to confirm this first. And we might not need it https://github.com/DataDog/datadog-operator/pull/3099/changes#diff-212b7de7fc8880b2b8472458adefcf33da1ac04535df6dc55d5a4e053f90af4f

@merchristK
merchristK force-pushed the merchristk-ACTP-extend-par-dca-rbac-for-kubetray branch from acf7bc6 to 76722a0 Compare July 6, 2026 15:38
@merchristK Graphite App

merchristK commented Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

@merchristK
merchristK force-pushed the merchristk-ACTP-extend-par-dca-rbac-for-kubetray branch 2 times, most recently from 80ff10f to c8cfed8 Compare July 7, 2026 15:30
merchristK and others added 2 commits July 8, 2026 12:00
@merchristK @claude
Extend PAR k8s RBAC in DCA for kubetray use cases
a0c99a9 
Add pod delete and statefulset patch permissions to the PAR-in-DCA
remediation ClusterRole, as decided in ADRAP-43.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
@merchristK
add tests
6f5b596
@merchristK
merchristK force-pushed the merchristk-ACTP-extend-par-dca-rbac-for-kubetray branch from c8cfed8 to 6f5b596 Compare July 8, 2026 10:00
tbavelier
tbavelier approved these changes Jul 8, 2026
View reviewed changes

@tbavelier tbavelier left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit comments

Comment thread internal/controller/datadogagent/feature/privateactionrunner/rbac.go Outdated
Comment thread internal/controller/datadogagent/feature/privateactionrunner/rbac.go Outdated
Comment thread internal/controller/datadogagent/feature/privateactionrunner/rbac.go Outdated
@gh-worker-dd-mergequeue-cf854d
gh-worker-dd-mergequeue-cf854d Bot merged commit 91c31b5 into main Jul 8, 2026
66 checks passed
@gh-worker-dd-mergequeue-cf854d
gh-worker-dd-mergequeue-cf854d Bot deleted the merchristk-ACTP-extend-par-dca-rbac-for-kubetray branch July 8, 2026 14:07
@khewonc khewonc modified the milestones: v1.30.0, v1.29.0 Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@tbavelier tbavelier tbavelier approved these changes
@maddiefranke maddiefranke maddiefranke approved these changes

Assignees

No one assigned

Labels

enhancement New feature or request mergequeue-status: done team/action-platform

Projects

None yet

Milestone

v1.29.0

Development

Successfully merging this pull request may close these issues.

4 participants

@merchristK @tbavelier @maddiefranke @khewonc