From bf2e1ef63a543b32023e19b240b368252987c18e Mon Sep 17 00:00:00 2001 From: Fanny Jiang Date: Thu, 16 Jul 2026 12:17:22 -0400 Subject: [PATCH 1/3] Add EKS add-on lifecycle chart contract --- .../charts/operator-eks-addon/README.md | 23 +++- .../aws_mp_configuration_schema.json | 118 +++++++++++++++++- .../templates/lifecycle.yaml | 39 ++++++ .../charts/operator-eks-addon/values.yaml | 2 + 4 files changed, 180 insertions(+), 2 deletions(-) create mode 100644 marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml diff --git a/marketplaces/charts/operator-eks-addon/README.md b/marketplaces/charts/operator-eks-addon/README.md index 3ca882a2e5..ebb7df7da7 100644 --- a/marketplaces/charts/operator-eks-addon/README.md +++ b/marketplaces/charts/operator-eks-addon/README.md @@ -1,6 +1,27 @@ # Operator EKS Add-on -This is a wrapper chart for installing EKS add-on. Charts required for the add-on are added as a dependency to this chart. Chart itself doesn't contain any templates or configurable properties. +This is a wrapper chart for installing the EKS add-on. The Datadog Operator chart is included as a dependency, and the wrapper renders the lifecycle bridge resources when lifecycle values are present. + +## Instrumenter lifecycle bridge + +The optional `lifecycle` value renders the add-on-owned command ConfigMap consumed by an Operator started with `DD_EKS_ADDON_LIFECYCLE_ENABLED=true`. The caller must send the complete value on every EKS add-on update and reuse the operation ID for retries of the same transition. + +Lifecycle configuration does not change the wrapper's defaults. The instrumenter's complete add-on configuration also enables the DatadogAgentProfile CRD/controller, Remote Configuration, Remote Updates, controller revisions, and `DD_CREATE_STRATEGY_ENABLED` for this installation. + +```yaml +lifecycle: + version: v1 + installationID: 123e4567-e89b-42d3-a456-426614174000 + eksARNSHA256: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef + operationID: 123e4567-e89b-42d3-a456-426614174010 + desiredState: installed + acknowledgedOperationID: "" + bootstrap: + clusterName: example-cluster + site: datadoghq.com +``` + +The lifecycle specification does not accept credentials or cluster topology. Credential material is supplied separately through `datadog/datadog-secret[api-key]`. Retries reuse the complete request and operation ID; acknowledgement is the only permitted change to an install request. ## Version Mapping | `operator-addon-chart` | `datadog-operator` | `datadog-crds` | Operator | Agent | Cluster Agent | diff --git a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json index 880afe4e2c..a8f18b9274 100644 --- a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json +++ b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json @@ -110,6 +110,49 @@ "collectOperatorMetrics": { "type": "boolean" }, + "apiKeyExistingSecret": { + "type": "string" + }, + "datadogCRDs": { + "type": "object", + "properties": { + "crds": { + "type": "object", + "properties": { + "datadogAgentProfiles": { + "type": "boolean" + } + } + } + } + }, + "datadogAgentProfile": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "remoteConfiguration": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "remoteUpdates": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "createControllerRevisions": { + "type": "boolean" + }, "watchNamespaces": { "type": "array", "items": {} @@ -118,6 +161,79 @@ "type": "object" } } + }, + "lifecycle": { + "type": [ + "object", + "null" + ], + "properties": { + "version": { + "type": "string", + "enum": [ + "v1" + ] + }, + "installationID": { + "type": "string", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" + }, + "eksARNSHA256": { + "type": "string", + "pattern": "^[0-9a-f]{64}$" + }, + "operationID": { + "type": "string", + "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" + }, + "desiredState": { + "type": "string", + "enum": [ + "installed", + "absent" + ] + }, + "acknowledgedOperationID": { + "type": "string", + "pattern": "^$|^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" + }, + "bootstrap": { + "type": "object", + "properties": { + "clusterName": { + "type": "string", + "minLength": 1, + "maxLength": 100 + }, + "site": { + "type": "string", + "enum": [ + "datadoghq.com", + "datadoghq.eu", + "us3.datadoghq.com", + "us5.datadoghq.com", + "ddog-gov.com", + "ap1.datadoghq.com", + "ap2.datadoghq.com" + ] + } + }, + "required": [ + "clusterName", + "site" + ], + "additionalProperties": false + } + }, + "required": [ + "version", + "installationID", + "eksARNSHA256", + "operationID", + "desiredState", + "bootstrap" + ], + "additionalProperties": false } } -} \ No newline at end of file +} diff --git a/marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml b/marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml new file mode 100644 index 0000000000..8204a34350 --- /dev/null +++ b/marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml @@ -0,0 +1,39 @@ +{{- with .Values.lifecycle }} +{{- $intent := dict + "version" .version + "installationID" .installationID + "eksARNSHA256" .eksARNSHA256 + "operationID" .operationID + "desiredState" .desiredState + "bootstrap" .bootstrap +-}} +{{- with .acknowledgedOperationID }} +{{- $_ := set $intent "acknowledgedOperationID" . -}} +{{- end }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: datadog-agent-lifecycle-intent + namespace: datadog + labels: + app.kubernetes.io/managed-by: eks-addon +data: + intent.json: |- + {{ $intent | toJson }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: datadog-agent-lifecycle-runtime + namespace: {{ $.Release.Namespace }} + labels: + app.kubernetes.io/managed-by: eks-addon +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: datadog-agent-lifecycle-runtime + labels: + app.kubernetes.io/managed-by: eks-addon +rules: [] +{{- end }} diff --git a/marketplaces/charts/operator-eks-addon/values.yaml b/marketplaces/charts/operator-eks-addon/values.yaml index 2ff26d5f4f..c699d6da34 100644 --- a/marketplaces/charts/operator-eks-addon/values.yaml +++ b/marketplaces/charts/operator-eks-addon/values.yaml @@ -7,3 +7,5 @@ datadog-operator: repository: 709825985650.dkr.ecr.us-east-1.amazonaws.com/datadog/operator tag: 1.28.0 operatorMetricsEnabled: false + +lifecycle: null From 623ecc111d33ca66f99202269734ccdab47d9ab9 Mon Sep 17 00:00:00 2001 From: Fanny Jiang Date: Thu, 16 Jul 2026 18:17:31 -0400 Subject: [PATCH 2/3] Rename managed installation chart values --- marketplaces/charts/operator-eks-addon/README.md | 12 ++++++------ .../aws_mp_configuration_schema.json | 2 +- ...ifecycle.yaml => managed_agent_installation.yaml} | 8 ++++---- marketplaces/charts/operator-eks-addon/values.yaml | 2 +- 4 files changed, 12 insertions(+), 12 deletions(-) rename marketplaces/charts/operator-eks-addon/templates/{lifecycle.yaml => managed_agent_installation.yaml} (79%) diff --git a/marketplaces/charts/operator-eks-addon/README.md b/marketplaces/charts/operator-eks-addon/README.md index ebb7df7da7..da8cdc056c 100644 --- a/marketplaces/charts/operator-eks-addon/README.md +++ b/marketplaces/charts/operator-eks-addon/README.md @@ -1,15 +1,15 @@ # Operator EKS Add-on -This is a wrapper chart for installing the EKS add-on. The Datadog Operator chart is included as a dependency, and the wrapper renders the lifecycle bridge resources when lifecycle values are present. +This is a wrapper chart for installing the EKS add-on. The Datadog Operator chart is included as a dependency, and the wrapper renders the managed Agent installation bridge resources when managed Agent installation values are present. -## Instrumenter lifecycle bridge +## Instrumenter managed Agent installation bridge -The optional `lifecycle` value renders the add-on-owned command ConfigMap consumed by an Operator started with `DD_EKS_ADDON_LIFECYCLE_ENABLED=true`. The caller must send the complete value on every EKS add-on update and reuse the operation ID for retries of the same transition. +The optional `managedAgentInstallation` value renders the add-on-owned command ConfigMap consumed by an Operator started with `DD_EKS_MANAGED_AGENT_INSTALLATION_ENABLED=true`. The caller must send the complete value on every EKS add-on update and reuse the operation ID for retries of the same transition. -Lifecycle configuration does not change the wrapper's defaults. The instrumenter's complete add-on configuration also enables the DatadogAgentProfile CRD/controller, Remote Configuration, Remote Updates, controller revisions, and `DD_CREATE_STRATEGY_ENABLED` for this installation. +Managed Agent installation configuration does not change the wrapper's defaults. The instrumenter's complete add-on configuration also enables the DatadogAgentProfile CRD/controller, Remote Configuration, Remote Updates, controller revisions, and `DD_CREATE_STRATEGY_ENABLED` for this installation. ```yaml -lifecycle: +managedAgentInstallation: version: v1 installationID: 123e4567-e89b-42d3-a456-426614174000 eksARNSHA256: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef @@ -21,7 +21,7 @@ lifecycle: site: datadoghq.com ``` -The lifecycle specification does not accept credentials or cluster topology. Credential material is supplied separately through `datadog/datadog-secret[api-key]`. Retries reuse the complete request and operation ID; acknowledgement is the only permitted change to an install request. +The managed Agent installation specification does not accept credentials or cluster topology. Credential material is supplied separately through `datadog/datadog-secret[api-key]`. Retries reuse the complete request and operation ID; acknowledgement is the only permitted change to an install request. ## Version Mapping | `operator-addon-chart` | `datadog-operator` | `datadog-crds` | Operator | Agent | Cluster Agent | diff --git a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json index a8f18b9274..45239050e9 100644 --- a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json +++ b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json @@ -162,7 +162,7 @@ } } }, - "lifecycle": { + "managedAgentInstallation": { "type": [ "object", "null" diff --git a/marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml similarity index 79% rename from marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml rename to marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml index 8204a34350..b4099d3709 100644 --- a/marketplaces/charts/operator-eks-addon/templates/lifecycle.yaml +++ b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml @@ -1,4 +1,4 @@ -{{- with .Values.lifecycle }} +{{- with .Values.managedAgentInstallation }} {{- $intent := dict "version" .version "installationID" .installationID @@ -13,7 +13,7 @@ apiVersion: v1 kind: ConfigMap metadata: - name: datadog-agent-lifecycle-intent + name: datadog-agent-managed-installation-intent namespace: datadog labels: app.kubernetes.io/managed-by: eks-addon @@ -24,7 +24,7 @@ data: apiVersion: v1 kind: ConfigMap metadata: - name: datadog-agent-lifecycle-runtime + name: datadog-agent-managed-installation-runtime namespace: {{ $.Release.Namespace }} labels: app.kubernetes.io/managed-by: eks-addon @@ -32,7 +32,7 @@ metadata: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: datadog-agent-lifecycle-runtime + name: datadog-agent-managed-installation-runtime labels: app.kubernetes.io/managed-by: eks-addon rules: [] diff --git a/marketplaces/charts/operator-eks-addon/values.yaml b/marketplaces/charts/operator-eks-addon/values.yaml index c699d6da34..0aceed94b0 100644 --- a/marketplaces/charts/operator-eks-addon/values.yaml +++ b/marketplaces/charts/operator-eks-addon/values.yaml @@ -8,4 +8,4 @@ datadog-operator: tag: 1.28.0 operatorMetricsEnabled: false -lifecycle: null +managedAgentInstallation: null From 3c792a1def53cd6f20d9595a0114ebc4a5099699 Mon Sep 17 00:00:00 2001 From: Fanny Jiang Date: Tue, 21 Jul 2026 10:43:30 -0400 Subject: [PATCH 3/3] Support managed installation credentials in EKS add-on --- .../aws_mp_configuration_schema.json | 36 +++++++++++++------ .../templates/managed_agent_installation.yaml | 18 +--------- ...anaged_agent_installation_credentials.yaml | 24 +++++++++++++ .../charts/operator-eks-addon/values.yaml | 1 + 4 files changed, 51 insertions(+), 28 deletions(-) create mode 100644 marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml diff --git a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json index 45239050e9..70c069b8f4 100644 --- a/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json +++ b/marketplaces/charts/operator-eks-addon/aws_mp_configuration_schema.json @@ -142,23 +142,20 @@ } } }, - "remoteUpdates": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean" - } - } - }, - "createControllerRevisions": { - "type": "boolean" - }, "watchNamespaces": { "type": "array", "items": {} }, "containerSecurityContext": { "type": "object" + }, + "volumes": { + "type": "array", + "items": {} + }, + "volumeMounts": { + "type": "array", + "items": {} } } }, @@ -234,6 +231,23 @@ "bootstrap" ], "additionalProperties": false + }, + "managedAgentInstallationCredentials": { + "type": [ + "object", + "null" + ], + "properties": { + "secretsManagerSecretID": { + "type": "string", + "minLength": 1, + "maxLength": 2048 + } + }, + "required": [ + "secretsManagerSecretID" + ], + "additionalProperties": false } } } diff --git a/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml index b4099d3709..63911619b1 100644 --- a/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml +++ b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation.yaml @@ -14,26 +14,10 @@ apiVersion: v1 kind: ConfigMap metadata: name: datadog-agent-managed-installation-intent - namespace: datadog + namespace: {{ $.Release.Namespace }} labels: app.kubernetes.io/managed-by: eks-addon data: intent.json: |- {{ $intent | toJson }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: datadog-agent-managed-installation-runtime - namespace: {{ $.Release.Namespace }} - labels: - app.kubernetes.io/managed-by: eks-addon ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: datadog-agent-managed-installation-runtime - labels: - app.kubernetes.io/managed-by: eks-addon -rules: [] {{- end }} diff --git a/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml new file mode 100644 index 0000000000..6e2f9db948 --- /dev/null +++ b/marketplaces/charts/operator-eks-addon/templates/managed_agent_installation_credentials.yaml @@ -0,0 +1,24 @@ +{{- with .Values.managedAgentInstallationCredentials }} +apiVersion: secrets-store.csi.x-k8s.io/v1 +kind: SecretProviderClass +metadata: + name: datadog-api-key + namespace: {{ $.Release.Namespace }} + labels: + app.kubernetes.io/managed-by: eks-addon +spec: + provider: aws + secretObjects: + - secretName: datadog-secret + type: Opaque + data: + - objectName: api-key + key: api-key + parameters: + usePodIdentity: "true" + objects: | + - objectName: {{ .secretsManagerSecretID | quote }} + objectType: secretsmanager + objectAlias: api-key + filePermission: "0400" +{{- end }} diff --git a/marketplaces/charts/operator-eks-addon/values.yaml b/marketplaces/charts/operator-eks-addon/values.yaml index 0aceed94b0..1d93de25a2 100644 --- a/marketplaces/charts/operator-eks-addon/values.yaml +++ b/marketplaces/charts/operator-eks-addon/values.yaml @@ -9,3 +9,4 @@ datadog-operator: operatorMetricsEnabled: false managedAgentInstallation: null +managedAgentInstallationCredentials: null