Resolve several GKE Autopilot gaps with Helm by levan-m · Pull Request #3234 · DataDog/datadog-operator

levan-m · 2026-07-07T20:02:40Z

What does this PR do?

CONTP-1802

a838981 — Set DD_PROVIDER_KIND=gke-autopilot env var and env.datadoghq.com/kind pod label on node agent for GKE Autopilot
3095018 — Suppress ~~GPU pod-resources, SBOM host volumes,~~ and FIPS sidecar on GKE Autopilot via provider capabilities.
- GPU, SBOM dropped in favor of reconcile hard fail validation.
d5d9a35 — ~~Add autopilot.gke.io/no-connect: "true" annotation to the agent DaemonSet on GKE Autopilot~~
- dropped as this was needed on small version range approaching support end.
4e34d92 — Enable CCR in the comprehensive golden test fixture so all comprehensive variants include a CCR Deployment
c40c15f — Set DD_CLOUD_PROVIDER_METADATA on DCA and both DD_PROVIDER_KIND + DD_CLOUD_PROVIDER_METADATA on CCR for GKE Autopilot

Motivation

What inspired you to submit this pull request?

Additional Notes

Anything else we should know when reviewing?

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

Agent: vX.Y.Z
Cluster Agent: vX.Y.Z

Describe your test plan

Apply

apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: datadog
  annotations:
    datadoghq.com/provider: gke-autopilot
spec:
  global:
    credentials:
      apiSecret:
        secretName: datadog-secret
        keyName: api-key
    fips:
      enabled: true
  features:
    clusterChecks:
      enabled: true
      useClusterChecksRunners: true

Verify:

Agent DS
- Pod template env.datadoghq.com/kind: gke-autopilot
- Env DD_PROVIDER_KIND: gke-autopilot, DD_CLOUD_PROVIDER_METADATA: [gcp]
- FIPS - no fips-proxy container.
DCA
- added env var DD_CLOUD_PROVIDER_METADATA: [gcp]
CLC
- added env var DD_CLOUD_PROVIDER_METADATA: [gcp], DD_PROVIDER_KIND: gke-autopilot

--

Checklist

PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
PR has a milestone or the qa/skip-qa label
All commits are signed (see: signing commits)

Enable clusterChecks.useClusterChecksRunners in the comprehensive DDA so the CCR Deployment appears in all comprehensive golden variants. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

datadog-prod-us1-5 · 2026-07-07T20:02:49Z

✨ Fix all issues with BitsAI

🛑 Gate Violations

🎯 1 Code Coverage issue detected

A Patch coverage percentage gate may be blocking this PR.

• Patch coverage: 16.67% (threshold: 80.00%)

⚠️ Warnings

🚦 1 Pipeline job failed

DataDog/datadog-operator | e2e: [1.22]

ℹ️ Info

🎯 Code Coverage (details)
• Patch Coverage: 16.67%
• Overall Coverage: 46.42% (-0.00%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: eddef3b | Docs | Datadog PR Page | Give us feedback!}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c40c15f085

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-07-07T20:09:56Z

+				containerdDirVolumeName,
+				criDirVolumeName,
+			},
+			RemoveEnvVars: []string{common.DDHostRootEnvVar},


Disable SBOM modes when removing their required mounts

On GKE Autopilot with features.sbom.host.enabled or containerImage.uncompressedLayersSupport, this provider cap removes the host/container runtime mounts and DD_HOST_ROOT, but ManageNodeAgent still leaves DD_SBOM_HOST_ENABLED=true and DD_SBOM_CONTAINER_USE_MOUNT=true in the agent env before this runs. The resulting pod schedules without the required host paths but still tells the agent to perform those scans, which can produce failed or incorrect SBOM results instead of actually suppressing the unsupported modes.

Useful? React with 👍 / 👎.

tbavelier

Everything looks good to me but d5d9a35: I don't understand the comment nor the intent. This annotation is automatically injected by Autopilot on the pods at admission time. From my understanding, it has no effect/need on the daemonset itself directly and daemonset remains managed by the operator ? I commented on a local build this change and had no issues in my cluster, so curious to understand further

…ion" This reverts commit 3b0f2fd. GPU and SBOM suppressions are kept; F4 validation will handle user-facing errors for unsupported features. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Resolved conflicts in golden files by regenerating with our code changes applied on top of main's renderer updates. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Drop the misleading cafeb8c (which accidentally reverted the GPU/SBOM suppression drop instead of the no-connect annotation commit). Revert d5d9a35: the autopilot.gke.io/no-connect annotation belongs on the pod template, not the DaemonSet object metadata, and requires a narrower version range than an unconditional apply. Removing ApplyProviderObjectAnnotations and its two call sites from controller_reconcile_agent.go. GPU and SBOM provider suppressions are restored as-is (they were correctly dropped in 3b0f2fd since Helm hard-fails on those features for Autopilot; partial suppression is misleading). Golden files regenerated. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

# Conflicts: # internal/controller/testutils/renderer/testdata/golden/comprehensive-aks.golden.yaml # internal/controller/testutils/renderer/testdata/golden/comprehensive-autopilot.golden.yaml # internal/controller/testutils/renderer/testdata/golden/comprehensive-baseline.golden.yaml # internal/controller/testutils/renderer/testdata/golden/comprehensive-eks-hostname-from-file.golden.yaml

dd-octo-sts · 2026-07-10T15:57:55Z

The backport to v1.29 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-v1.29 v1.29
# Navigate to the new working tree
cd .worktrees/backport-v1.29
# Create a new branch
git switch --create backport-3234-to-v1.29
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 84a47fdc34c9e9d4bc027f2b73c88ef2f751947d
# Push it to GitHub
git push --set-upstream origin backport-3234-to-v1.29
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-v1.29

Then, create a pull request where the base branch is v1.29 and the compare/head branch is backport-3234-to-v1.29.

* set DD_PROVIDER_KIND en and env.datadoghq.com/kind annotation in agent * Step 2: feature supressions, FIPS proxy * Add no-connect annotation to agent DS * add CCR to comprehensive golden test fixture Enable clusterChecks.useClusterChecksRunners in the comprehensive DDA so the CCR Deployment appears in all comprehensive golden variants. * set DD_PROVIDER_KIND in CRC, DCA; DD_CLOUD_PROVIDER_METADATA in DCA * Drop GPU and SBOM supression to be handled by feature validation * Fix golden test * Revert "Drop GPU and SBOM supression to be handled by feature validation" This reverts commit 3b0f2fd. GPU and SBOM suppressions are kept; F4 validation will handle user-facing errors for unsupported features. * Revert no-connect annotation (d5d9a35); restore GPU/SBOM drop Drop the misleading cafeb8c (which accidentally reverted the GPU/SBOM suppression drop instead of the no-connect annotation commit). Revert d5d9a35: the autopilot.gke.io/no-connect annotation belongs on the pod template, not the DaemonSet object metadata, and requires a narrower version range than an unconditional apply. Removing ApplyProviderObjectAnnotations and its two call sites from controller_reconcile_agent.go. GPU and SBOM provider suppressions are restored as-is (they were correctly dropped in 3b0f2fd since Helm hard-fails on those features for Autopilot; partial suppression is misleading). Golden files regenerated. --------- (cherry picked from commit 84a47fd) Co-authored-by: Claude Sonnet 4.6 <[email protected]> Co-authored-by: Timothée Bavelier <[email protected]>

levan-m and others added 5 commits July 7, 2026 15:02

set DD_PROVIDER_KIND en and env.datadoghq.com/kind annotation in agent

a838981

Step 2: feature supressions, FIPS proxy

3095018

Add no-connect annotation to agent DS

d5d9a35

add CCR to comprehensive golden test fixture

4e34d92

Enable clusterChecks.useClusterChecksRunners in the comprehensive DDA so the CCR Deployment appears in all comprehensive golden variants. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

set DD_PROVIDER_KIND in CRC, DCA; DD_CLOUD_PROVIDER_METADATA in DCA

c40c15f

levan-m added this to the v1.29.0 milestone Jul 7, 2026

levan-m requested a review from a team July 7, 2026 20:02

levan-m added the enhancement New feature or request label Jul 7, 2026

levan-m requested review from a team as code owners July 7, 2026 20:02

github-actions Bot added team/agent-security team/container-platform team/ebpf-platform labels Jul 7, 2026

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

levan-m force-pushed the levan-m/autopilot-gaps branch from 70ff427 to cc1b297 Compare July 7, 2026 20:24

Drop GPU and SBOM supression to be handled by feature validation

3b0f2fd

levan-m force-pushed the levan-m/autopilot-gaps branch from cc1b297 to 3b0f2fd Compare July 7, 2026 20:29

gh-worker-ownership-write-b05516 Bot removed the request for review from a team July 7, 2026 20:29

github-actions Bot removed the team/agent-security label Jul 7, 2026

zhuminyi modified the milestones: v1.29.0, v1.30.0 Jul 8, 2026

tbavelier modified the milestones: v1.30.0, v1.29.0 Jul 8, 2026

tbavelier added 2 commits July 9, 2026 10:44

Merge branch 'main' into levan-m/autopilot-gaps

6b09bce

Fix golden test

a22e7f4

tbavelier requested changes Jul 9, 2026

View reviewed changes

levan-m and others added 2 commits July 9, 2026 21:29

Revert "Drop GPU and SBOM supression to be handled by feature validat…

cafeb8c

…ion" This reverts commit 3b0f2fd. GPU and SBOM suppressions are kept; F4 validation will handle user-facing errors for unsupported features. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Merge main into levan-m/autopilot-gaps

7f3585c

Resolved conflicts in golden files by regenerating with our code changes applied on top of main's renderer updates. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

github-actions Bot added the team/agent-security label Jul 9, 2026

github-actions Bot removed the team/agent-security label Jul 10, 2026

tbavelier approved these changes Jul 10, 2026

View reviewed changes

levan-m merged commit 84a47fd into main Jul 10, 2026
36 of 38 checks passed

levan-m deleted the levan-m/autopilot-gaps branch July 10, 2026 15:57

levan-m added the backport/v1.29 label Jul 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Resolve several GKE Autopilot gaps with Helm#3234

Resolve several GKE Autopilot gaps with Helm#3234
levan-m merged 12 commits into
mainfrom
levan-m/autopilot-gaps

levan-m commented Jul 7, 2026 •

edited

Loading

Uh oh!

datadog-prod-us1-5 Bot commented Jul 7, 2026 •

edited by datadog-official Bot

Loading

🎯 1 Code Coverage issue detected

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 7, 2026

Uh oh!

tbavelier left a comment

Uh oh!

Uh oh!

dd-octo-sts Bot commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

levan-m commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Additional Notes

Minimum Agent Versions

Describe your test plan

Checklist

Uh oh!

datadog-prod-us1-5 Bot commented Jul 7, 2026 • edited by datadog-official Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛑 Gate Violations

🎯 1 Code Coverage issue detected

⚠️ Warnings

ℹ️ Info

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

tbavelier left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dd-octo-sts Bot commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

levan-m commented Jul 7, 2026 •

edited

Loading

datadog-prod-us1-5 Bot commented Jul 7, 2026 •

edited by datadog-official Bot

Loading