[CASCL-1397] datadog: allow cluster-agent to read dd-cluster-info#2677
Draft
L3n41c wants to merge 1 commit into
Draft
[CASCL-1397] datadog: allow cluster-agent to read dd-cluster-info#2677L3n41c wants to merge 1 commit into
dd-cluster-info#2677L3n41c wants to merge 1 commit into
Conversation
Grant the Cluster Agent `get`/`list`/`watch` on the `dd-cluster-info` ConfigMap, gated by `datadog.orchestratorExplorer.enabled`. The Datadog Agent's orchestrator check uses this ConfigMap (written by `kubectl datadog autoscaling cluster install` from the `datadog-operator` repo) to surface per-node management info and autoscaling solutions detected on the cluster to the Datadog back-end. Without this rule the check logs `Forbidden` at debug level and silently leaves the new payload fields unset. Kubernetes ignores `resourceNames` for `list`/`watch` verbs, so the rule grants those verbs cluster-wide on configmaps; the agent narrows the result client-side via the `app.kubernetes.io/managed-by=kubectl-datadog` label and a `metadata.name` field selector. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
L3n41c
force-pushed
the
lenaic/CASCL-1397-cluster-info-rbac
branch
from
74ab96a to
bbf2287
Compare
L3n41c
changed the title
dd-cluster-info
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Grants the Cluster Agent
get/list/watchon thedd-cluster-infoConfigMap (gated bydatadog.orchestratorExplorer.enabled), so it can read the cluster-info snapshot written bykubectl datadog autoscaling cluster install(see DataDog/datadog-operator#2945, #2980).This RBAC rule unblocks the orchestrator-check enhancement tracked in DataDog/datadog-agent#51107, which surfaces per-node management info (Fargate / Karpenter / EKS managed node group / ASG / standalone), the autoscaling solutions detected on the cluster, and the EKS cluster ARN to the Datadog back-end through the synthetic Cluster payload.
Kubernetes ignores
resourceNamesforlist/watchverbs, so the rule effectively grants those verbs cluster-wide onconfigmaps; the agent narrows the result client-side via theapp.kubernetes.io/managed-by=kubectl-datadoglabel and ametadata.namefield selector.The agent degrades gracefully if this rule is absent (logs
Forbiddenat debug level, leaves the new fields unset). So the two PRs can merge in either order.Jira: CASCL-1397.
Which issue this PR fixes
n/a
Special notes for your reviewer:
3.198.0to3.198.1. Thedatadog/patch-versionlabel is applied.make update-test-baselineswas run; 42 baseline manifests now include the new ClusterRole rule.helm-docswas not run locally (would require installing helm-docs); the only README change here is the version badge bump, which I updated manually.Checklist
datadog/patch-version)datadogchart changes, test baselines have been updated (make update-test-baselines)datadogchart changes, received ✅ from a member of your team (pending review)CHANGELOG.mdhas been updatedREADME.md(no new variables — RBAC-only change)🤖 Generated with Claude Code