Merge branch 'main' into levan-m/conductor_testing_branch

.github/workflows/pr-linter.yml

@@ -15,11 +15,12 @@ jobs:
     - name: Check out code into the Go module directory
       uses: actions/checkout@v1
     - name: Verify Pull Request Labels
-      uses: jesusvasquez333/verify-pr-label-action@v1.3.1
+      uses: jesusvasquez333/verify-pr-label-action@v1.4.0
       with:
         github-token: '${{ secrets.GITHUB_TOKEN }}'
         valid-labels: 'bug, enhancement, refactoring, documentation, tooling, dependencies'
         pull-request-number: '${{ github.event.pull_request.number }}'
+        disable-reviews: true
   check-milestone:
     name: Check Milestone
     runs-on: ubuntu-latest

.github/workflows/release.yaml

@@ -42,6 +42,7 @@ jobs:
           owner: ${{ github.repository_owner }}
           repo: datadog-operator
           excludes: prerelease, draft
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v3
         with:
@@ -83,6 +84,7 @@ jobs:
           owner: ${{ github.repository_owner }}
           repo: datadog-operator
           excludes: prerelease, draft
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Build
         uses: goreleaser/goreleaser-action@v3
         with:
@@ -122,6 +124,7 @@ jobs:
           owner: ${{ github.repository_owner }}
           repo: datadog-operator
           excludes: prerelease, draft
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Build
         uses: goreleaser/goreleaser-action@v3
         with:

.gitlab-ci.yml

@@ -529,12 +529,11 @@ publish_nightly_workflow:
     CONDUCTOR_TARGET: $CONDUCTOR_TARGET
     DDR_WORKFLOW_ID: $DDR_WORKFLOW_ID
 
-# On success, this will cause CNAB to trigger a Deployment to Release Candidate clusters
+# On success, this will cause CNAB to trigger a Deployment to Release Candidate clusters and open a corresponding pull request
 publish_release_candidate_workflow:
   stage: deploy
   rules:
     - if: $CI_COMMIT_TAG
-      when: manual # TODO: change this to on_success when feeling confident
     - when: never
   needs:
     - trigger_internal_operator_image

Makefile

@@ -152,7 +152,7 @@ generate: $(CONTROLLER_GEN) generate-openapi generate-docs ## Generate code
 
 .PHONY: generate-docs
 generate-docs: manifests
-	go run ./hack/generate-docs.go
+	go run ./hack/generate-docs/generate-docs.go
 
 # Build the docker images, for local use
 .PHONY: docker-build

api/datadoghq/common/envvar.go

@@ -19,6 +19,8 @@ const (
 	DDAdmissionControllerAgentSidecarSelectors           = "DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_SELECTORS"
 	DDAdmissionControllerAgentSidecarProfiles            = "DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_PROFILES"
 	DDAdmissionControllerEnabled                         = "DD_ADMISSION_CONTROLLER_ENABLED"
+	DDAdmissionControllerValidationEnabled               = "DD_ADMISSION_CONTROLLER_VALIDATION_ENABLED"
+	DDAdmissionControllerMutationEnabled                 = "DD_ADMISSION_CONTROLLER_MUTATION_ENABLED"
 	DDAdmissionControllerInjectConfig                    = "DD_ADMISSION_CONTROLLER_INJECT_CONFIG_ENABLED"
 	DDAdmissionControllerInjectConfigMode                = "DD_ADMISSION_CONTROLLER_INJECT_CONFIG_MODE"
 	DDAdmissionControllerInjectTags                      = "DD_ADMISSION_CONTROLLER_INJECT_TAGS_ENABLED"
@@ -47,6 +49,7 @@ const (
 	DDAPMInstrumentationLibVersions                      = "DD_APM_INSTRUMENTATION_LIB_VERSIONS"
 	DDAppKey                                             = "DD_APP_KEY"
 	DDAuthTokenFilePath                                  = "DD_AUTH_TOKEN_FILE_PATH"
+	DDChecksTagCardinality                               = "DD_CHECKS_TAG_CARDINALITY"
 	DDClcRunnerEnabled                                   = "DD_CLC_RUNNER_ENABLED"
 	DDClcRunnerHost                                      = "DD_CLC_RUNNER_HOST"
 	DDClcRunnerID                                        = "DD_CLC_RUNNER_ID"
@@ -154,6 +157,7 @@ const (
 	DDSecretBackendCommand                               = "DD_SECRET_BACKEND_COMMAND"
 	DDSecretBackendArguments                             = "DD_SECRET_BACKEND_ARGUMENTS"
 	DDSecretBackendTimeout                               = "DD_SECRET_BACKEND_TIMEOUT"
+	DDServiceDiscoveryEnabled                            = "DD_DISCOVERY_ENABLED"
 	DDSite                                               = "DD_SITE"
 	DDSystemProbeAgentEnabled                            = "DD_SYSTEM_PROBE_ENABLED"
 	DDSystemProbeBPFDebugEnabled                         = DDSystemProbeEnvPrefix + "BPF_DEBUG"

api/datadoghq/common/types.go

@@ -60,11 +60,12 @@ const (
 	SystemProbeContainerName AgentContainerName = "system-probe"
 	// OtelAgent is the name of the OTel container
 	OtelAgent AgentContainerName = "otel-agent"
+	// AgentDataPlaneContainerName is the name of the Agent Data Plane container
+	AgentDataPlaneContainerName AgentContainerName = "agent-data-plane"
 	// AllContainers is used internally to reference all containers in the pod
 	AllContainers AgentContainerName = "all"
 	// ClusterAgentContainerName is the name of the Cluster Agent container
 	ClusterAgentContainerName AgentContainerName = "cluster-agent"
-
 	// ClusterChecksRunnersContainerName is the name of the Agent container in Cluster Checks Runners
 	ClusterChecksRunnersContainerName AgentContainerName = "agent"
 

api/datadoghq/v1alpha1/datadogpodautoscaler_types.go

@@ -385,6 +385,9 @@ const (
 
 	// DatadogPodAutoscalerManualValueSource is a recommendation that comes from manually applying a recommendation.
 	DatadogPodAutoscalerManualValueSource DatadogPodAutoscalerValueSource = "Manual"
+
+	// DatadogPodAutoscalerLocalValueSource is a recommendation that comes from local fallback.
+	DatadogPodAutoscalerLocalValueSource DatadogPodAutoscalerValueSource = "Local"
 )
 
 // DatadogPodAutoscalerHorizontalStatus defines the status of the horizontal scaling

api/datadoghq/v2alpha1/const.go

@@ -52,6 +52,21 @@ const (
 	DefaultStartupProbeFailureThreshold    int32 = 6
 	DefaultStartupProbeHTTPPath                  = "/startup"
 
+	// Agent Data plane default liveness/readiness probe configs
+	DefaultADPLivenessProbeInitialDelaySeconds int32 = 5
+	DefaultADPLivenessProbePeriodSeconds       int32 = 5
+	DefaultADPLivenessProbeTimeoutSeconds      int32 = 5
+	DefaultADPLivenessProbeSuccessThreshold    int32 = 1
+	DefaultADPLivenessProbeFailureThreshold    int32 = 12
+
+	DefaultADPReadinessProbeInitialDelaySeconds int32 = 5
+	DefaultADPReadinessProbePeriodSeconds       int32 = 5
+	DefaultADPReadinessProbeTimeoutSeconds      int32 = 5
+	DefaultADPReadinessProbeSuccessThreshold    int32 = 1
+	DefaultADPReadinessProbeFailureThreshold    int32 = 12
+
+	DefaultADPHealthPort = 5100
+
 	// DefaultApmPort default apm port
 	DefaultApmPort = 8126
 	// DefaultApmPortName default apm port name

api/datadoghq/v2alpha1/datadogagent_default.go

@@ -29,12 +29,15 @@ const (
 	defaultLiveProcessCollectionEnabled   bool = false
 	defaultLiveContainerCollectionEnabled bool = true
 	defaultProcessDiscoveryEnabled        bool = true
+	defaultRunProcessChecksInCoreAgent    bool = false
 
 	defaultOOMKillEnabled        bool = false
 	defaultTCPQueueLengthEnabled bool = false
 
 	defaultEBPFCheckEnabled bool = false
 
+	defaultServiceDiscoveryEnabled bool = false
+
 	defaultAPMEnabled                 bool   = true
 	defaultAPMHostPortEnabled         bool   = false
 	defaultAPMHostPort                int32  = 8126
@@ -73,6 +76,8 @@ const (
 
 	defaultAdmissionControllerAgentSidecarClusterAgentEnabled bool   = true
 	defaultAdmissionControllerEnabled                         bool   = true
+	defaultAdmissionControllerValidationEnabled               bool   = true
+	defaultAdmissionControllerMutationEnabled                 bool   = true
 	defaultAdmissionControllerMutateUnlabelled                bool   = false
 	defaultAdmissionServiceName                               string = "datadog-admission-controller"
 	// DefaultAdmissionControllerCWSInstrumentationEnabled default CWS Instrumentation enabled value
@@ -180,6 +185,8 @@ func defaultGlobalConfig(ddaSpec *DatadogAgentSpec) {
 		apiutils.DefaultInt32IfUnset(&ddaSpec.Global.FIPS.PortRange, defaultFIPSPortRange)
 		apiutils.DefaultBooleanIfUnset(&ddaSpec.Global.FIPS.UseHTTPS, defaultFIPSUseHTTPS)
 	}
+
+	apiutils.DefaultBooleanIfUnset(&ddaSpec.Global.RunProcessChecksInCoreAgent, defaultRunProcessChecksInCoreAgent)
 }
 
 // defaultFeaturesConfig sets default values in DatadogAgentSpec.Features.
@@ -243,6 +250,11 @@ func defaultFeaturesConfig(ddaSpec *DatadogAgentSpec) {
 	}
 	apiutils.DefaultBooleanIfUnset(&ddaSpec.Features.EBPFCheck.Enabled, defaultEBPFCheckEnabled)
 
+	if ddaSpec.Features.ServiceDiscovery == nil {
+		ddaSpec.Features.ServiceDiscovery = &ServiceDiscoveryFeatureConfig{}
+	}
+	apiutils.DefaultBooleanIfUnset(&ddaSpec.Features.ServiceDiscovery.Enabled, defaultServiceDiscoveryEnabled)
+
 	// APM Feature
 	// APM is enabled by default
 	if ddaSpec.Features.APM == nil {
@@ -465,21 +477,23 @@ func defaultFeaturesConfig(ddaSpec *DatadogAgentSpec) {
 		apiutils.DefaultBooleanIfUnset(&ddaSpec.Features.AdmissionController.Enabled, defaultAdmissionControllerEnabled)
 		apiutils.DefaultBooleanIfUnset(&ddaSpec.Features.AdmissionController.MutateUnlabelled, defaultAdmissionControllerMutateUnlabelled)
 		apiutils.DefaultStringIfUnset(&ddaSpec.Features.AdmissionController.ServiceName, defaultAdmissionServiceName)
-
 	}
-	agentSidecarInjection := ddaSpec.Features.AdmissionController.AgentSidecarInjection
-	if agentSidecarInjection != nil && agentSidecarInjection.Enabled != nil && *agentSidecarInjection.Enabled {
-		apiutils.DefaultBooleanIfUnset(&agentSidecarInjection.ClusterAgentCommunicationEnabled, defaultAdmissionControllerAgentSidecarClusterAgentEnabled)
+
+	// AdmissionControllerValidation Feature
+	if ddaSpec.Features.AdmissionController.Validation == nil {
+		ddaSpec.Features.AdmissionController.Validation = &AdmissionControllerValidationConfig{}
 	}
+	apiutils.DefaultBooleanIfUnset(&ddaSpec.Features.AdmissionController.Validation.Enabled, defaultAdmissionControllerValidationEnabled)
 
-	// CWS Instrumentation in AdmissionController Feature
-	if ddaSpec.Features.AdmissionController.CWSInstrumentation == nil {
-		ddaSpec.Features.AdmissionController.CWSInstrumentation = &CWSInstrumentationConfig{}
+	// AdmissionControllerMutation Feature
+	if ddaSpec.Features.AdmissionController.Mutation == nil {
+		ddaSpec.Features.AdmissionController.Mutation = &AdmissionControllerMutationConfig{}
 	}
-	apiutils.DefaultBooleanIfUnset(&ddaSpec.Features.AdmissionController.CWSInstrumentation.Enabled, DefaultAdmissionControllerCWSInstrumentationEnabled)
+	apiutils.DefaultBooleanIfUnset(&ddaSpec.Features.AdmissionController.Mutation.Enabled, defaultAdmissionControllerMutationEnabled)
 
-	if *ddaSpec.Features.AdmissionController.CWSInstrumentation.Enabled {
-		apiutils.DefaultStringIfUnset(&ddaSpec.Features.AdmissionController.CWSInstrumentation.Mode, DefaultAdmissionControllerCWSInstrumentationMode)
+	agentSidecarInjection := ddaSpec.Features.AdmissionController.AgentSidecarInjection
+	if agentSidecarInjection != nil && agentSidecarInjection.Enabled != nil && *agentSidecarInjection.Enabled {
+		apiutils.DefaultBooleanIfUnset(&agentSidecarInjection.ClusterAgentCommunicationEnabled, defaultAdmissionControllerAgentSidecarClusterAgentEnabled)
 	}
 
 	// CWS Instrumentation in AdmissionController Feature