Set CSI driver RBAC in DCA only when enabled (#3270)#3273
Conversation
(cherry picked from commit df5dfe5)
levan-m
added
enhancement
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0f2f1d6f3e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| rbac.WatchVerb, | ||
| } | ||
|
|
||
| if f.csiDriverEnabled { |
There was a problem hiding this comment.
When spec.global.csi.enabled=true but --datadogCSIDriverEnabled=false, this condition removes the Cluster Agent's csidrivers list/watch/get permissions even though this is an explicitly supported external-driver configuration (internal/controller/datadogagent/ddcsi.go:46-48) and DD_CSI_ENABLED=true is still passed to the Cluster Agent (internal/controller/datadogagent/global/global.go:232-237). Consequently, the admission controller cannot inspect the externally installed k8s.csi.datadoghq.com object for CSI-aware injection; the RBAC decision must account for CSI being enabled in the DDA independently of whether the operator manages the driver.
Useful? React with 👍 / 👎.
🛑 Gate Violations
ℹ️ Info🎯 Code Coverage (details) Useful? React with 👍 / 👎 This comment will be updated automatically if new data arrives.🔗 Commit SHA: 0f2f1d6 | Docs | Datadog PR Page | Give us feedback! |
2 participants
(cherry picked from commit df5dfe5)
#3270
What does this PR do?
A brief description of the change being made with this pull request.
Motivation
What inspired you to submit this pull request?
Additional Notes
Anything else we should know when reviewing?
Minimum Agent Versions
Are there minimum versions of the Datadog Agent and/or Cluster Agent required?
Describe your test plan
Write there any instructions and details you may have to test your PR.
Checklist
bug,enhancement,refactoring,documentation,tooling, and/ordependenciesqa/skip-qalabel