[DADP-182] Enable ADP by default for Linux Operator workloads

cmd/main.go

@@ -139,6 +139,7 @@ type options struct {
 	untaintControllerEnabled            bool
 	untaintControllerWaitForCSIDriver   bool
 	rolloutOnConfigMapChangeEnabled     bool
+	defaultDataPlaneLinuxEnabled        bool
 
 	// Secret Backend options
 	secretBackendCommand  string
@@ -188,6 +189,7 @@ func (opts *options) Parse() {
 		"When true (requires --untaintControllerEnabled), the Untaint controller removes the startup taint only after both the node Agent and Datadog CSI node-server pods are Ready. Requires Pod watch coverage of CSI namespaces (DD_CSIDRIVER_WATCH_NAMESPACE).")
 	flag.BoolVar(&opts.rolloutOnConfigMapChangeEnabled, "rolloutOnConfigMapChangeEnabled", true,
 		"Automatically roll out Agent/Cluster Agent/Cluster Check Runner/OTel Agent Gateway workloads when a ConfigMap referenced by their pod template changes content out-of-band")
+	flag.BoolVar(&opts.defaultDataPlaneLinuxEnabled, "defaultDataPlaneLinuxEnabled", false, "Enable the Agent Data Plane by default on Linux")
 
 	// DatadogAgentInternal
 	flag.BoolVar(&opts.createControllerRevisions, "createControllerRevisions", false, "Enable creation of ControllerRevision snapshots on each DDA spec change")
@@ -223,6 +225,7 @@ func (opts *options) Parse() {
 		boolEnv(&opts.untaintControllerWaitForCSIDriver, "DD_UNTAINT_CONTROLLER_WAIT_FOR_CSI_DRIVER"),
 		boolEnv(&opts.createControllerRevisions, "DD_CREATE_CONTROLLER_REVISIONS"),
 		boolEnv(&opts.rolloutOnConfigMapChangeEnabled, "DD_ROLLOUT_ON_CONFIGMAP_CHANGE_ENABLED"),
+		boolEnv(&opts.defaultDataPlaneLinuxEnabled, "DD_DEFAULT_DATA_PLANE_LINUX_ENABLED"),
 	})
 
 	// Parsing flags
@@ -501,6 +504,7 @@ func run(opts *options) error {
 		UntaintControllerEnabled:          opts.untaintControllerEnabled,
 		UntaintControllerWaitForCSIDriver: opts.untaintControllerWaitForCSIDriver,
 		RolloutOnConfigMapChangeEnabled:   opts.rolloutOnConfigMapChangeEnabled,
+		DefaultDataPlaneLinuxEnabled:      opts.defaultDataPlaneLinuxEnabled,
 		ClusterProviderDetector:           providerDetector,
 	}
 

cmd/main_test.go

@@ -65,6 +65,15 @@ func TestOperatorManagedAgentInstallationEnabled(t *testing.T) {
 	}
 }
 
+func TestOptionsParse_DefaultDataPlaneLinuxEnabled(t *testing.T) {
+	resetCommandLine(t)
+
+	var opts options
+	opts.Parse()
+
+	require.False(t, opts.defaultDataPlaneLinuxEnabled)
+}
+
 func TestOptionsParse_EnvOverridesDefaults(t *testing.T) {
 	resetCommandLine(t)
 	t.Setenv("DD_METRICS_ADDR", ":9090")
@@ -81,6 +90,7 @@ func TestOptionsParse_EnvOverridesDefaults(t *testing.T) {
 	t.Setenv("DD_UNTAINT_CONTROLLER_WAIT_FOR_CSI_DRIVER", "true")
 	t.Setenv("DD_CREATE_CONTROLLER_REVISIONS", "true")
 	t.Setenv("DD_MANAGED_AGENT_INSTALLATION_ENABLED", "true")
+	t.Setenv("DD_DEFAULT_DATA_PLANE_LINUX_ENABLED", "true")
 
 	var opts options
 	opts.Parse()
@@ -99,6 +109,7 @@ func TestOptionsParse_EnvOverridesDefaults(t *testing.T) {
 	require.True(t, opts.untaintControllerWaitForCSIDriver)
 	require.True(t, opts.createControllerRevisions)
 	require.True(t, opts.managedAgentInstallationEnabled)
+	require.True(t, opts.defaultDataPlaneLinuxEnabled)
 }
 
 func TestOptionsParse_CLIOverridesEnv(t *testing.T) {
@@ -111,6 +122,7 @@ func TestOptionsParse_CLIOverridesEnv(t *testing.T) {
 		"-datadogGenericResourceRequeuePeriod=2m30s",
 		"-leader-election-lease-duration=2m",
 		"-untaintControllerWaitForCSIDriver=false",
+		"-defaultDataPlaneLinuxEnabled=false",
 	)
 	t.Setenv("DD_METRICS_ADDR", ":9090")
 	t.Setenv("DD_METRICS_SECURE", "true")
@@ -120,6 +132,7 @@ func TestOptionsParse_CLIOverridesEnv(t *testing.T) {
 	t.Setenv("DD_GENERIC_RESOURCE_REQUEUE_PERIOD", "5m")
 	t.Setenv("DD_LEADER_ELECTION_LEASE_DURATION", "90s")
 	t.Setenv("DD_UNTAINT_CONTROLLER_WAIT_FOR_CSI_DRIVER", "true")
+	t.Setenv("DD_DEFAULT_DATA_PLANE_LINUX_ENABLED", "true")
 
 	var opts options
 	opts.Parse()
@@ -132,6 +145,7 @@ func TestOptionsParse_CLIOverridesEnv(t *testing.T) {
 	require.Equal(t, 150*time.Second, opts.datadogGenericResourceRequeuePeriod)
 	require.Equal(t, 2*time.Minute, opts.leaderElectionLeaseDuration)
 	require.False(t, opts.untaintControllerWaitForCSIDriver)
+	require.False(t, opts.defaultDataPlaneLinuxEnabled)
 }
 
 func TestOptionsParse_InvalidEnvLeavesDefault(t *testing.T) {
@@ -141,6 +155,7 @@ func TestOptionsParse_InvalidEnvLeavesDefault(t *testing.T) {
 	t.Setenv("DD_GENERIC_RESOURCE_REQUEUE_PERIOD", "120")
 	t.Setenv("DD_LEADER_ELECTION_LEASE_DURATION", "not-a-duration")
 	t.Setenv("DD_MONITOR_CONTROLLER_ENABLED", "not-a-boolean-meaning-string")
+	t.Setenv("DD_DEFAULT_DATA_PLANE_LINUX_ENABLED", "not-a-boolean-meaning-string")
 
 	var opts options
 	opts.Parse()
@@ -150,6 +165,7 @@ func TestOptionsParse_InvalidEnvLeavesDefault(t *testing.T) {
 	require.Equal(t, defaultDatadogGenericResourceRequeuePeriod, opts.datadogGenericResourceRequeuePeriod)
 	require.Equal(t, 60*time.Second, opts.leaderElectionLeaseDuration)
 	require.False(t, opts.datadogMonitorEnabled)
+	require.False(t, opts.defaultDataPlaneLinuxEnabled)
 }
 
 func resetCommandLine(t *testing.T, args ...string) {

docs/installation.md

@@ -191,6 +191,7 @@ Other operator startup options can also be configured via environment variable:
 | DDGR max concurrent reconciles | `--datadogGenericResourceMaxConcurrentReconciles` | `DD_GENERIC_RESOURCE_MAX_CONCURRENT_RECONCILES` | `1` |
 | DDGR requeue period        | `--datadogGenericResourceRequeuePeriod` | `DD_GENERIC_RESOURCE_REQUEUE_PERIOD` | `60s`   |
 | Controller revisions       | `--createControllerRevisions`        | `DD_CREATE_CONTROLLER_REVISIONS`      | `false` |
+| Linux Data Plane default   | `--defaultDataPlaneLinuxEnabled`     | `DD_DEFAULT_DATA_PLANE_LINUX_ENABLED` | `false` |
 
 The leader election toggle (`--enable-leader-election`), pprof (`--pprof`),
 log options (`--loglevel`, `--logEncoder`), secret backend options

internal/controller/datadogagent/feature/dataplane/feature.go

@@ -29,6 +29,7 @@ func buildDataPlaneFeature(options *feature.Options) feature.Feature {
 
 	if options != nil {
 		f.logger = options.Logger
+		f.defaultEnabled = options.DefaultDataPlaneEnabled
 	}
 
 	return f
@@ -37,6 +38,7 @@ func buildDataPlaneFeature(options *feature.Options) feature.Feature {
 type dataPlaneFeature struct {
 	logger logr.Logger
 
+	defaultEnabled   bool
 	enabled          bool
 	dogstatsdEnabled bool
 }
@@ -49,11 +51,12 @@ func (f *dataPlaneFeature) ID() feature.IDType {
 // Configure is used to configure the feature from a v2alpha1.DatadogAgent instance.
 func (f *dataPlaneFeature) Configure(dda metav1.Object, ddaSpec *v2alpha1.DatadogAgentSpec, _ *v2alpha1.RemoteConfigConfiguration) feature.RequiredComponents {
 	// Check if the deprecated annotation is being used, and log a warning if so.
-	if featureutils.HasFeatureEnableAnnotation(dda, featureutils.EnableADPAnnotation) {
+	if featureutils.HasFeatureEnableAnnotation(dda, featureutils.EnableADPAnnotation) ||
+		featureutils.HasFeatureDisableAnnotation(dda, featureutils.EnableADPAnnotation) {
 		f.logger.Info("DEPRECATION WARNING: annotation 'agent.datadoghq.com/adp-enabled' is deprecated; use 'spec.features.dataPlane.enabled' instead")
 	}
 
-	f.enabled = featureutils.IsDataPlaneEnabled(dda, ddaSpec)
+	f.enabled = featureutils.IsDataPlaneEnabled(dda, ddaSpec, f.defaultEnabled)
 	f.dogstatsdEnabled = featureutils.IsDataPlaneDogstatsdEnabled(ddaSpec)
 
 	var reqComp feature.RequiredComponents
@@ -84,40 +87,40 @@ func (f *dataPlaneFeature) ManageClusterAgent(managers feature.PodTemplateManage
 // if SingleContainerStrategy is enabled and can be used with the configured feature set.
 // It should do nothing if the feature doesn't need to configure it.
 func (f *dataPlaneFeature) ManageSingleContainerNodeAgent(managers feature.PodTemplateManagers) error {
-	return f.ManageNodeAgent(managers)
+	return f.manageNodeAgent(managers, apicommon.UnprivilegedSingleAgentContainerName, apicommon.UnprivilegedSingleAgentContainerName)
 }
 
 // ManageNodeAgent allows a feature to configure the Node Agent's corev1.PodTemplateSpec
 // It should do nothing if the feature doesn't need to configure it.
 func (f *dataPlaneFeature) ManageNodeAgent(managers feature.PodTemplateManagers) error {
-	// We set the relevant configuration on the Core Agent specifically, which trickles down to the Data Plane when it
-	// queries the Core Agent for its configuration.
-	//
-	// It is also used to influence the Core Agent in terms of what it chooses to run itself or allow to be delegated to
-	// the data plane.
-	if f.enabled {
-		// When Data Plane is enabled, we signal this to the Core Agent by setting an environment variable.
-		managers.EnvVar().AddEnvVarToContainer(apicommon.CoreAgentContainerName, &corev1.EnvVar{
-			Name:  common.DDDataPlaneEnabled,
-			Value: "true",
-		})
+	return f.manageNodeAgent(managers, apicommon.CoreAgentContainerName, apicommon.AgentDataPlaneContainerName)
+}
 
-		// Configure the ADP container to fetch configuration from the Core Agent.
-		managers.EnvVar().AddEnvVarToContainer(apicommon.AgentDataPlaneContainerName, &corev1.EnvVar{
-			Name:  common.DDDataPlaneRemoteAgentEnabled,
-			Value: "true",
-		})
-		managers.EnvVar().AddEnvVarToContainer(apicommon.AgentDataPlaneContainerName, &corev1.EnvVar{
-			Name:  common.DDDataPlaneUseNewConfigStreamEndpoint,
+func (f *dataPlaneFeature) manageNodeAgent(managers feature.PodTemplateManagers, coreContainer, dataPlaneContainer apicommon.AgentContainerName) error {
+	if !f.enabled {
+		return nil
+	}
+
+	// Core Agent delegates the selected pipelines to ADP. In the single-container strategy,
+	// both processes inherit these settings from the shared container environment.
+	managers.EnvVar().AddEnvVarToContainer(coreContainer, &corev1.EnvVar{
+		Name:  common.DDDataPlaneEnabled,
+		Value: "true",
+	})
+	managers.EnvVar().AddEnvVarToContainer(dataPlaneContainer, &corev1.EnvVar{
+		Name:  common.DDDataPlaneRemoteAgentEnabled,
+		Value: "true",
+	})
+	managers.EnvVar().AddEnvVarToContainer(dataPlaneContainer, &corev1.EnvVar{
+		Name:  common.DDDataPlaneUseNewConfigStreamEndpoint,
+		Value: "true",
+	})
+
+	if f.dogstatsdEnabled {
+		managers.EnvVar().AddEnvVarToContainer(coreContainer, &corev1.EnvVar{
+			Name:  common.DDDataPlaneDogstatsdEnabled,
 			Value: "true",
 		})
-
-		if f.dogstatsdEnabled {
-			managers.EnvVar().AddEnvVarToContainer(apicommon.CoreAgentContainerName, &corev1.EnvVar{
-				Name:  common.DDDataPlaneDogstatsdEnabled,
-				Value: "true",
-			})
-		}
 	}
 
 	return nil

internal/controller/datadogagent/feature/dataplane/feature_test.go

@@ -8,7 +8,11 @@ package dataplane
 import (
 	"testing"
 
+	"github.com/go-logr/zapr"
 	"github.com/stretchr/testify/assert"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+	"go.uber.org/zap/zaptest/observer"
 	corev1 "k8s.io/api/core/v1"
 
 	apicommon "github.com/DataDog/datadog-operator/api/datadoghq/common"
@@ -29,6 +33,14 @@ func Test_dataPlaneFeature(t *testing.T) {
 		Name:  common.DDDataPlaneDogstatsdEnabled,
 		Value: "true",
 	}
+	dataPlaneRemoteAgentEnabledEnvVar := &corev1.EnvVar{
+		Name:  common.DDDataPlaneRemoteAgentEnabled,
+		Value: "true",
+	}
+	dataPlaneUseNewConfigStreamEndpointEnvVar := &corev1.EnvVar{
+		Name:  common.DDDataPlaneUseNewConfigStreamEndpoint,
+		Value: "true",
+	}
 
 	tests := test.FeatureTestSuite{
 		{
@@ -46,12 +58,83 @@ func Test_dataPlaneFeature(t *testing.T) {
 			),
 		},
 		{
-			Name: "data plane disabled (forced via annotation)",
+			Name: "data plane enabled by feature default",
+			DDA: testutils.NewDatadogAgentBuilder().
+				WithNodeAgentImage("agent:7.83.0-rc.5").
+				BuildWithDefaults(),
+			FeatureOptions: &feature.Options{
+				DefaultDataPlaneEnabled: true,
+			},
+			WantConfigure: true,
+			Agent: test.NewDefaultComponentTest().WithWantFunc(
+				func(t testing.TB, mgrInterface feature.PodTemplateManagers) {
+					mgr := mgrInterface.(*fake.PodTemplateManagers)
+					agentEnvVars := mgr.EnvVarMgr.EnvVarsByC[apicommon.CoreAgentContainerName]
+					assert.Contains(t, agentEnvVars, dataPlaneEnabledEnvVar, "DD_DATA_PLANE_ENABLED should be set when Data Plane is enabled by the feature default")
+
+					adpEnvVars := mgr.EnvVarMgr.EnvVarsByC[apicommon.AgentDataPlaneContainerName]
+					assert.Contains(t, adpEnvVars, dataPlaneRemoteAgentEnabledEnvVar, "DD_DATA_PLANE_REMOTE_AGENT_ENABLED should be set on Agent Data Plane when Data Plane is enabled by the feature default")
+					assert.Contains(t, adpEnvVars, dataPlaneUseNewConfigStreamEndpointEnvVar, "DD_DATA_PLANE_USE_NEW_CONFIG_STREAM_ENDPOINT should be set on Agent Data Plane when Data Plane is enabled by the feature default")
+
+					dda := testutils.NewDatadogAgentBuilder().WithNodeAgentImage("agent:7.83.0-rc.5").BuildWithDefaults()
+					requiredComponents := buildDataPlaneFeature(&feature.Options{DefaultDataPlaneEnabled: true}).Configure(dda, &dda.Spec, dda.Status.RemoteConfigConfiguration)
+					assert.Contains(t, requiredComponents.Agent.Containers, apicommon.AgentDataPlaneContainerName, "Agent Data Plane should be a required Agent component when Data Plane is enabled by the feature default")
+				},
+			),
+		},
+		{
+			Name: "data plane enabled by feature default with single container strategy",
+			DDA: testutils.NewDatadogAgentBuilder().
+				WithSingleContainerStrategy(true).
+				WithDataPlaneDogstatsdEnabled(true).
+				WithNodeAgentImage("agent:7.83.0-rc.5").
+				BuildWithDefaults(),
+			FeatureOptions: &feature.Options{
+				DefaultDataPlaneEnabled: true,
+			},
+			WantConfigure: true,
+			Agent: test.NewDefaultComponentTest().WithWantFunc(
+				func(t testing.TB, mgrInterface feature.PodTemplateManagers) {
+					mgr := mgrInterface.(*fake.PodTemplateManagers)
+					singleAgentEnvVars := mgr.EnvVarMgr.EnvVarsByC[apicommon.UnprivilegedSingleAgentContainerName]
+					assert.ElementsMatch(t, []*corev1.EnvVar{
+						dataPlaneEnabledEnvVar,
+						dataPlaneDogstatsdEnabledEnvVar,
+						dataPlaneRemoteAgentEnabledEnvVar,
+						dataPlaneUseNewConfigStreamEndpointEnvVar,
+					}, singleAgentEnvVars, "all Data Plane interaction flags should be set on the shared single Agent container")
+					assert.Empty(t, mgr.EnvVarMgr.EnvVarsByC[apicommon.CoreAgentContainerName], "single container strategy should not mutate the Core Agent container")
+					assert.Empty(t, mgr.EnvVarMgr.EnvVarsByC[apicommon.AgentDataPlaneContainerName], "single container strategy should not mutate the Agent Data Plane container")
+				},
+			),
+		},
+		{
+			Name: "data plane explicitly disabled via CRD overrides feature default",
+			DDA: testutils.NewDatadogAgentBuilder().
+				WithDataPlaneEnabled(false).
+				BuildWithDefaults(),
+			FeatureOptions: &feature.Options{
+				DefaultDataPlaneEnabled: true,
+			},
+			WantConfigure: false,
+			Agent: test.NewDefaultComponentTest().WithWantFunc(
+				func(t testing.TB, mgrInterface feature.PodTemplateManagers) {
+					mgr := mgrInterface.(*fake.PodTemplateManagers)
+					agentEnvVars := mgr.EnvVarMgr.EnvVarsByC[apicommon.CoreAgentContainerName]
+					assert.NotContains(t, agentEnvVars, dataPlaneEnabledEnvVar, "DD_DATA_PLANE_ENABLED should not be set when the CRD explicitly disables Data Plane")
+				},
+			),
+		},
+		{
+			Name: "data plane disabled via legacy annotation overrides feature default",
 			DDA: testutils.NewDatadogAgentBuilder().
 				WithAnnotations(map[string]string{
 					utils.EnableADPAnnotation: "false",
 				}).
 				BuildWithDefaults(),
+			FeatureOptions: &feature.Options{
+				DefaultDataPlaneEnabled: true,
+			},
 			WantConfigure: false,
 			Agent: test.NewDefaultComponentTest().WithWantFunc(
 				func(t testing.TB, mgrInterface feature.PodTemplateManagers) {
@@ -61,6 +144,26 @@ func Test_dataPlaneFeature(t *testing.T) {
 				},
 			),
 		},
+		{
+			Name: "data plane CRD enable overrides legacy disable annotation",
+			DDA: testutils.NewDatadogAgentBuilder().
+				WithDataPlaneEnabled(true).
+				WithAnnotations(map[string]string{
+					utils.EnableADPAnnotation: "false",
+				}).
+				BuildWithDefaults(),
+			FeatureOptions: &feature.Options{
+				DefaultDataPlaneEnabled: true,
+			},
+			WantConfigure: true,
+			Agent: test.NewDefaultComponentTest().WithWantFunc(
+				func(t testing.TB, mgrInterface feature.PodTemplateManagers) {
+					mgr := mgrInterface.(*fake.PodTemplateManagers)
+					agentEnvVars := mgr.EnvVarMgr.EnvVarsByC[apicommon.CoreAgentContainerName]
+					assert.Contains(t, agentEnvVars, dataPlaneEnabledEnvVar, "DD_DATA_PLANE_ENABLED should be set when the CRD explicitly enables Data Plane")
+				},
+			),
+		},
 		{
 			Name: "data plane enabled via annotation (deprecated)",
 			DDA: testutils.NewDatadogAgentBuilder().
@@ -128,3 +231,37 @@ func Test_dataPlaneFeature(t *testing.T) {
 
 	tests.Run(t, buildDataPlaneFeature)
 }
+
+func TestDataPlaneFeatureManageSingleContainerNodeAgent(t *testing.T) {
+	managers := fake.NewPodTemplateManagers(t, corev1.PodTemplateSpec{})
+	feature := &dataPlaneFeature{enabled: true, dogstatsdEnabled: true}
+
+	assert.NoError(t, feature.ManageSingleContainerNodeAgent(managers))
+	assert.ElementsMatch(t, []*corev1.EnvVar{
+		{Name: common.DDDataPlaneEnabled, Value: "true"},
+		{Name: common.DDDataPlaneRemoteAgentEnabled, Value: "true"},
+		{Name: common.DDDataPlaneUseNewConfigStreamEndpoint, Value: "true"},
+		{Name: common.DDDataPlaneDogstatsdEnabled, Value: "true"},
+	}, managers.EnvVarMgr.EnvVarsByC[apicommon.UnprivilegedSingleAgentContainerName])
+
+	disabledManagers := fake.NewPodTemplateManagers(t, corev1.PodTemplateSpec{})
+	disabledFeature := &dataPlaneFeature{}
+	assert.NoError(t, disabledFeature.ManageSingleContainerNodeAgent(disabledManagers))
+	assert.Empty(t, disabledManagers.EnvVarMgr.EnvVarsByC[apicommon.UnprivilegedSingleAgentContainerName])
+}
+
+func TestDataPlaneFeatureLogsLegacyAnnotationDeprecation(t *testing.T) {
+	for _, annotationValue := range []string{"true", "false"} {
+		t.Run(annotationValue, func(t *testing.T) {
+			core, logs := observer.New(zapcore.InfoLevel)
+			feature := buildDataPlaneFeature(&feature.Options{Logger: zapr.NewLogger(zap.New(core))}).(*dataPlaneFeature)
+			dda := testutils.NewDatadogAgentBuilder().
+				WithAnnotations(map[string]string{utils.EnableADPAnnotation: annotationValue}).
+				BuildWithDefaults()
+
+			feature.Configure(dda, &dda.Spec, nil)
+
+			assert.Len(t, logs.FilterMessage("DEPRECATION WARNING: annotation 'agent.datadoghq.com/adp-enabled' is deprecated; use 'spec.features.dataPlane.enabled' instead").All(), 1)
+		})
+	}
+}