[TON-743] Add EKS add-on credential sync resources

[fanny-jiang]

What does this PR do?

Adds an opt-in credentials-sync contract to the Datadog Operator EKS add-on chart.

When managedAgentInstallationCredentials is configured, the chart renders:

• ServiceAccount/datadog-ascp-sync
• SecretProviderClass/datadog-api-key
• a Linux EC2-only Deployment/datadog-ascp-secret-sync that keeps the CSI volume mounted

The SecretProviderClass syncs the configured AWS Secrets Manager value into datadog-secret[api-key] in the add-on namespace.

Motivation

This supports an intermediary EKS installation path where the instrumenter installs the Datadog Operator EKS add-on while the existing Lambda remains responsible for creating the DatadogAgent.

Additional Notes

This intentionally excludes the managed Agent lifecycle-intent resources from the broader add-on proposal.

The cluster must separately provide the AWS Secrets Store CSI Driver provider, EKS Pod Identity Agent, Kubernetes Secret sync support, and a Pod Identity association that grants the dedicated ServiceAccount access to the configured secret.

Before publishing the Marketplace add-on, the sync image should be mirrored and pinned in the Datadog Marketplace ECR repository.

Minimum Agent Versions

• Agent: N/A
• Cluster Agent: N/A

Describe your test plan

• Linted the complete wrapper chart using the local upstream datadog-operator chart.
• Rendered the enabled configuration and verified the ServiceAccount, SecretProviderClass, and Deployment contract.
• Rendered the default configuration and verified that no credentials-sync resources are created.
• Validated the Marketplace configuration schema as JSON.
• Ran git diff --check.

Checklist

• PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
• PR has a milestone or the qa/skip-qa label
• All commits are signed (see: signing commits)

[datadog-prod-us1-6]

 

🔄 Datadog auto-retried 1 job - 1 passed on retry

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 47.15% (+0.19%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 6c9ce50 | Docs | Datadog PR Page | Give us feedback!}

[zhuminyi]

should we use marketplace ecr?