Skip to content

Conversation

@khewonc
Copy link
Contributor

@khewonc khewonc commented Dec 30, 2025

What does this PR do?

Add preprocessing for store objects and add normalization for rbac

Motivation

https://datadoghq.atlassian.net/browse/AGENTONB-2643

Additional Notes

Anything else we should know when reviewing?

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

  • Agent: vX.Y.Z
  • Cluster Agent: vX.Y.Z

Describe your test plan

Using a prior operator version, check clusterroles and roles for their permissions. Update the operator and check that the permissions are equivalent. This can be done using orchestrator explorer compare for simpler rbac or by comparing the describe output of the two different operator versions:

# run with prior operator version and operator version with this pr and compare outputs
$ kubectl describe clusterrole datadog-agent-cluster-agent
Name:         datadog-agent-cluster-agent
Labels:       app.kubernetes.io/instance=datadog-agent
              app.kubernetes.io/managed-by=datadog-operator
              app.kubernetes.io/name=datadog-agent-deployment
              app.kubernetes.io/part-of=default-datadog--agent
              app.kubernetes.io/version=
              operator.datadoghq.com/managed-by-store=true
Annotations:  <none>
PolicyRule:
  Resources                                                     Non-Resource URLs  Resource Names                        Verbs
  ---------                                                     -----------------  --------------                        -----
  datadogmetrics.datadoghq.com                                  []                 []                                    [create delete list watch]
  events                                                        []                 []                                    [create get list watch]
  subjectaccessreviews.authorization.k8s.io                     []                 []                                    [create get]
  mutatingwebhookconfigurations.admissionregistration.k8s.io    []                 []                                    [create]
  validatingwebhookconfigurations.admissionregistration.k8s.io  []                 []                                    [create]
  mutatingwebhookconfigurations.admissionregistration.k8s.io    []                 [datadog-webhook]                     [delete get list update watch]
  validatingwebhookconfigurations.admissionregistration.k8s.io  []                 [datadog-webhook]                     [delete get list update watch]
  componentstatuses                                             []                 []                                    [get list watch]
  configmaps                                                    []                 []                                    [get list watch]
  configmaps                                                    []                 [extension-apiserver-authentication]  [get list watch]
  endpoints                                                     []                 []                                    [get list watch]
  namespaces                                                    []                 []                                    [get list watch]
  nodes                                                         []                 []                                    [get list watch]
  pods                                                          []                 []                                    [get list watch]
  services                                                      []                 []                                    [get list watch]
  cronjobs.batch                                                []                 []                                    [get list watch]
  jobs.batch                                                    []                 []                                    [get list watch]
  clusterresourcequotas.quota.openshift.io                      []                 []                                    [get list]
  configmaps                                                    []                 [datadog-custom-metrics]              [get update]
                                                                [/healthz]         []                                    [get]
                                                                [/metrics]         []                                    [get]
                                                                [/version]         []                                    [get]
  namespaces                                                    []                 [kube-system]                         [get]
  replicationcontrollers                                        []                 []                                    [get]
  daemonsets.apps                                               []                 []                                    [get]
  deployments.apps                                              []                 []                                    [get]
  replicasets.apps                                              []                 []                                    [get]
  statefulsets.apps                                             []                 []                                    [get]
  extendeddaemonsetreplicasets.datadoghq.com                    []                 []                                    [get]
  horizontalpodautoscalers.autoscaling                          []                 []                                    [list watch]
  datadogmetrics.datadoghq.com/status                           []                 []                                    [update]

Checklist

  • PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
  • PR has a milestone or the qa/skip-qa label

@khewonc khewonc added this to the v1.23.0 milestone Dec 30, 2025
@khewonc khewonc requested review from a team as code owners December 30, 2025 17:34
@codecov-commenter
Copy link

codecov-commenter commented Dec 30, 2025

Codecov Report

❌ Patch coverage is 75.97403% with 37 lines in your changes missing coverage. Please review.
✅ Project coverage is 37.36%. Comparing base (bfa35f2) to head (fc359b1).

Files with missing lines Patch % Lines
...ternal/controller/datadogagent/store/preprocess.go 5.55% 33 Missing and 1 partial ⚠️
internal/controller/datadogagent/store/store.go 66.66% 2 Missing and 1 partial ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #2439      +/-   ##
==========================================
+ Coverage   37.32%   37.36%   +0.04%     
==========================================
  Files         290      292       +2     
  Lines       24724    24787      +63     
==========================================
+ Hits         9228     9262      +34     
- Misses      14783    14813      +30     
+ Partials      713      712       -1     
Flag Coverage Δ
unittests 37.36% <75.97%> (+0.04%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
...r/datadogagent/feature/kubernetesstatecore/rbac.go 100.00% <100.00%> (ø)
.../datadogagent/feature/orchestratorexplorer/rbac.go 100.00% <100.00%> (+1.98%) ⬆️
...nal/controller/datadogagent/feature/utils/utils.go 0.00% <ø> (-65.16%) ⬇️
internal/controller/datadogagent/merger/rbac.go 36.76% <ø> (-10.15%) ⬇️
pkg/kubernetes/rbac/normalize.go 100.00% <100.00%> (ø)
internal/controller/datadogagent/store/store.go 66.96% <66.66%> (+1.35%) ⬆️
...ternal/controller/datadogagent/store/preprocess.go 5.55% <5.55%> (ø)

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bfa35f2...fc359b1. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants