feat(datadog): enable cluster-agent RC for on-demand SSI - #2868
Draft
iamluc wants to merge 1 commit into
Draft
Conversation
Expose onDemand in chart values and gate DD_REMOTE_CONFIGURATION_ENABLED on the admission controller with on-demand instrumentation enabled, so APM_POLICIES Remote Config rules work without remoteInstrumentation.
iamluc
added
bug
Contributor
|
github-actions
Bot
added
the
chart/datadog
This was referenced Aug 19, 2026
Merged
iamluc
changed the title
gh-worker-dd-mergequeue-cf854d Bot
pushed a commit
to DataDog/datadog-agent
that referenced
this pull request
Aug 28, 2026
…55057) ### What does this PR do? Expands `TestSSISuite/TestRemoteConfig` so APM_POLICIES is exercised end-to-end against three workloads (helm target, annotated lib-injection, unannotated) and three RC documents: - **Host-only policy** does not match Kubernetes admission facts: annotated pod stays `k8s_lib_injection`, unannotated stays uninjected, helm target still gets SSI (`applied-target=python-apps`). - **Namespace policy** (`NAMESPACE_NAME=other`) enables SSI outside the helm target, including true on-demand on the unannotated pod (`applied-policy` set). Helm fallback is unchanged. - **Deny policy** matching `targeted-namespace` overrides the local helm target (no injection, no `applied-target`). Namespace `other` is unchanged. Cluster-agent RC on the published chart is enabled via `remoteInstrumentation.enabled` (temporary until [helm-charts#2868](DataDog/helm-charts#2868)). Extra cluster-agent env uses `envDict` so fakeintake RC settings are not replaced. Stacked on #55019. ### Motivation Catch the SSI false-positive (host-only RC flipping annotated pods), prove on-demand SSI from RC, and prove remote-before-local override — none of which unit tests cover through fakeintake + admission. ### Describe how you validated your changes - [x] Local kind-local: `dda inv new-e2e-tests.run --targets=./tests/ssi --run='TestSSISuite/TestRemoteConfig'` - [ ] CI `new-e2e-ssi` job ### Additional Notes `remoteInstrumentation.enabled` is only the published-chart RC gate, not the feature under test. Drop it once helm-charts#2868 is released. Co-authored-by: luc.vieillescazes <luc.vieillescazes@datadoghq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
On-demand SSI policies are delivered over Remote Config (
APM_POLICIES). Thecluster-agent subscribes to that product when
apm_config.instrumentation.on_demandis true (agent default), but the Helm chart did not enable Remote Configuration
on the cluster-agent unless
clusterAgent.admissionController.remoteInstrumentation(or a few other unrelated features) was enabled.
This PR:
datadog.apm.instrumentation.onDemand(defaulttrue, matching the agent)DD_APM_INSTRUMENTATION_ON_DEMANDon the cluster-agent from that valueclusterAgent-remoteConfiguration-enabledto returntruewhen theadmission controller is enabled and on-demand SSI is on
With chart defaults (
remoteConfiguration.enabled,admissionController.enabled,and
onDemandall true), the cluster-agent polls Remote Config without requiringremoteInstrumentation.enabled.Related Issue
Follow-up to SSI on-demand RC E2E work in datadog-agent.
Type of Change
Checklist
How Has This Been Tested?
make update-test-baselines-datadog-agent(baseline manifests updated).github/helm-docs.shAdditional Notes
This changes default cluster-agent installs to set
DD_REMOTE_CONFIGURATION_ENABLED=truewhen admission controller + onDemand are enabled (both default to true). Expected
side effect: cluster-agent starts polling RC in more default installs.
Related datadog-agent E2E PR can drop its
DD_REMOTE_CONFIGURATION_ENABLEDworkaroundonce this chart version is published and pinned in the E2E framework.