Conditionally grant CSI driver RBAC to DCA#3270
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 22050162f5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| if f.csiDriverEnabled { | ||
| clusterPolicyRules = append(clusterPolicyRules, |
There was a problem hiding this comment.
When spec.global.csi.enabled=true but the CSI driver is installed externally, --datadogCSIDriverEnabled intentionally remains false—the supported behavior is documented in internal/controller/datadogagent/ddcsi.go:46-48. This condition therefore removes the Cluster Agent admission controller's permissions to discover that external CSIDriver, breaking CSI-based library injection in that configuration. Gate these rules on whether the DatadogAgent uses CSI (or otherwise preserve them for external installations), rather than on whether this operator manages the driver.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
no issue, when the flag is false Operator won't have sufficient RBAC to grant to DCA anyway.
🛑 Gate Violations
ℹ️ Info🎯 Code Coverage (details) Useful? React with 👍 / 👎 This comment will be updated automatically if new data arrives.🔗 Commit SHA: 2205016 | Docs | Datadog PR Page | Give us feedback! |
levan-m
added
backport
|
The backport to To backport manually, run these commands in your terminal: # Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-v1.29 v1.29
# Navigate to the new working tree
cd .worktrees/backport-v1.29
# Create a new branch
git switch --create backport-3270-to-v1.29
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 df5dfe5200339065772acdadc3b6f4a9ef662789
# Push it to GitHub
git push --set-upstream origin backport-3270-to-v1.29
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-v1.29Then, create a pull request where the |
2 participants
What does this PR do?
If user doesn't have CSI driver enabled (operator arg
datadogCSIDriverEnabled, helm valuedatadogCSIDriver.enabled) Helm doesn't grant CSI-related RBAC to Operator but Operator still tries to grant it DCA leading to reconciler errorsMotivation
What inspired you to submit this pull request?
Additional Notes
Anything else we should know when reviewing?
Minimum Agent Versions
Are there minimum versions of the Datadog Agent and/or Cluster Agent required?
Describe your test plan
Install using helm and apply minimal DDA
Operator 1.28.0 will log above error. Version with a fix should not.
Checklist
bug,enhancement,refactoring,documentation,tooling, and/ordependenciesqa/skip-qalabel