Add opt-in auto-rollout on referenced ConfigMap content change

[gabedos]

What does this PR do?

Re-deploy Agent whenever external configmaps are updated by maintaining a hash of all configmaps used into a checksum that is updated on the daemonset/deployment every reconcile loop.

Motivation

ConfigMaps mounted into Agent/DCA/CCR/OTel/etc sometimes don't trigger a rollout of the Agent. This is particularly true for configmaps not created by the Operator (eg. CustomConfig.ConfigMap.Name). These can be edited outside of the scope of the Operator and no re-deployment occurs. This PR tracks external configmaps to trigger a redeployment.

Additional Notes

Defaults to false; fully backward compatible. Can look into bumping this to true later or potentially even removing the option to configure it.

Describe your test plan

Install the Operator with the config flag to active configmap monitoring:

helm repo update datadog
helm install datadog-operator datadog/datadog-operator \
  --devel \
  --namespace datadog --create-namespace \
  --set-json 'env=[{"name":"DD_ROLLOUT_ON_CONFIGMAP_CHANGE_ENABLED","value":"true"}]'

Create an external config map:

apiVersion: v1
kind: ConfigMap
metadata:
  name: http-check-extra-confd
  namespace: datadog
data:
  conf.yaml: |
    init_config:
    instances:
      - name: Example Website
        url: https://example.com

And attach it to the DatadogAgent CR:

apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: datadog
  namespace: datadog
spec:
  override:
    nodeAgent:
      extraConfd:
        configMap:
          name: http-check-extra-confd
          items:
            - key: conf.yaml
              path: http_check.yaml

Observe the resourceVersion and checksum.agent.datadoghq.com/referenced-configmaps annotation on the DS:

kubectl -n datadog get daemonset datadog-agent -o jsonpath='{.metadata.resourceVersion}{"\n"}'
kubectl -n datadog get daemonset datadog-agent -o jsonpath='{.spec.template.metadata.annotations}' | python3 -m json.tool

Then edit the configmap to trigger a redeployment via kubectl edit http-check-extra-confd -n datadog.

After at least 15 seconds (1 reconciliation loop) check to see if the daemonset has been updated and redeployed the Agent nodes with the previous 2 commands.

Checklist

• PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
• PR has a milestone or the qa/skip-qa label
• All commits are signed (see: signing commits)

[datadog-datadog-prod-us1]

 

✨ Unblock PR with BitsAI

🛑 Gate Violations

🎯 1 Code Coverage issue detected

A Patch coverage percentage gate may be blocking this PR.

• Patch coverage: 70.69% (threshold: 80.00%)

⚠️ Warnings

🚦 2 Pipeline jobs failed

DataDog/datadog-operator | check_formatting     

pull request linter | build     

ℹ️ Info

🎯 Code Coverage (details)
• Patch Coverage: 70.69%
• Overall Coverage: 47.06% (+0.10%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c6aec50 | Docs | Datadog PR Page | Give us feedback!}