Merge branch 'main' of github.com:DataDog/datadog-operator into lenai…

…c/CONTINT-4412

.gitlab-ci.yml

@@ -503,7 +503,7 @@ publish_nightly_workflow:
     ENVIRONMENTS: "experimental"
     CHART: "datadog-operator"
     OPTION_AUTOMATIC_ROLLOUT: "true"
-    EXPLICIT_WORKFLOWS: "//workflows:deploy_operator.operator_nightly.publish"
+    EXPLICIT_WORKFLOWS: "//workflows:deploy_operator_nightly.operator_nightly.publish"
     BAZEL_TARGET: $BAZEL_TARGET
     DDR: $DDR
     TARGET_ENV: $TARGET_ENV
@@ -514,7 +514,7 @@ publish_nightly_workflow:
 publish_release_candidate_workflow:
   stage: deploy
   rules:
-    - if: '$CI_COMMIT_BRANCH == "main" && $CI_COMMIT_TAG'
+    - if: $CI_COMMIT_TAG
       when: manual # TODO: change this to on_success when feeling confident
     - when: never
   needs:

api/datadoghq/common/envvar.go

@@ -113,6 +113,8 @@ const (
 	DDNamespaceLabelsAsTags                              = "DD_KUBERNETES_NAMESPACE_LABELS_AS_TAGS"
 	DDNamespaceAnnotationsAsTags                         = "DD_KUBERNETES_NAMESPACE_ANNOTATIONS_AS_TAGS"
 	DDNodeLabelsAsTags                                   = "DD_KUBERNETES_NODE_LABELS_AS_TAGS"
+	DDKubernetesResourcesLabelsAsTags                    = "DD_KUBERNETES_RESOURCES_LABELS_AS_TAGS"
+	DDKubernetesResourcesAnnotationsAsTags               = "DD_KUBERNETES_RESOURCES_ANNOTATIONS_AS_TAGS"
 	DDOrchestratorExplorerEnabled                        = "DD_ORCHESTRATOR_EXPLORER_ENABLED"
 	DDOrchestratorExplorerExtraTags                      = "DD_ORCHESTRATOR_EXPLORER_EXTRA_TAGS"
 	DDOrchestratorExplorerDDUrl                          = "DD_ORCHESTRATOR_EXPLORER_ORCHESTRATOR_DD_URL"

api/datadoghq/v2alpha1/datadogagent_types.go

@@ -1222,6 +1222,20 @@ type GlobalConfig struct {
 	// +optional
 	NamespaceAnnotationsAsTags map[string]string `json:"namespaceAnnotationsAsTags,omitempty"`
 
+	// Provide a mapping of Kubernetes Resource Groups to labels mapping to Datadog Tags.
+	// <KUBERNETES_RESOURCE_GROUP>:
+	//		<KUBERNETES_LABEL>: <DATADOG_TAG_KEY>
+	// KUBERNETES_RESOURCE_GROUP should be in the form `{resource}.{group}` or `{resource}` (example: deployments.apps, pods)
+	// +optional
+	KubernetesResourcesLabelsAsTags map[string]map[string]string `json:"kubernetesResourcesLabelsAsTags,omitempty"`
+
+	// Provide a mapping of Kubernetes Resource Groups to annotations mapping to Datadog Tags.
+	// <KUBERNETES_RESOURCE_GROUP>:
+	//		<KUBERNETES_ANNOTATION>: <DATADOG_TAG_KEY>
+	// KUBERNETES_RESOURCE_GROUP should be in the form `{resource}.{group}` or `{resource}` (example: deployments.apps, pods)
+	// +optional
+	KubernetesResourcesAnnotationsAsTags map[string]map[string]string `json:"kubernetesResourcesAnnotationsAsTags,omitempty"`
+
 	// NetworkPolicy contains the network configuration.
 	// +optional
 	NetworkPolicy *NetworkPolicyConfig `json:"networkPolicy,omitempty"`
@@ -1418,6 +1432,10 @@ type DatadogAgentComponentOverride struct {
 	// +optional
 	ServiceAccountName *string `json:"serviceAccountName,omitempty"`
 
+	// Sets the ServiceAccountAnnotations used by this component.
+	// +optional
+	ServiceAccountAnnotations map[string]string `json:"serviceAccountAnnotations,omitempty"`
+
 	// The container image of the different components (Datadog Agent, Cluster Agent, Cluster Check Runner).
 	// +optional
 	Image *AgentImageConfig `json:"image,omitempty"`

api/datadoghq/v2alpha1/utils.go

@@ -53,6 +53,33 @@ func GetClusterChecksRunnerServiceAccount(dda *DatadogAgent) string {
 	return saDefault
 }
 
+// GetClusterAgentServiceAccountAnnotations returns the annotations for the cluster-agent service account.
+func GetClusterAgentServiceAccountAnnotations(dda *DatadogAgent) map[string]string {
+	defaultAnnotations := map[string]string{}
+	if dda.Spec.Override[ClusterAgentComponentName] != nil && dda.Spec.Override[ClusterAgentComponentName].ServiceAccountAnnotations != nil {
+		return dda.Spec.Override[ClusterAgentComponentName].ServiceAccountAnnotations
+	}
+	return defaultAnnotations
+}
+
+// GetAgentServiceAccountAnnotations returns the annotations for the agent service account.
+func GetAgentServiceAccountAnnotations(dda *DatadogAgent) map[string]string {
+	defaultAnnotations := map[string]string{}
+	if dda.Spec.Override[NodeAgentComponentName] != nil && dda.Spec.Override[NodeAgentComponentName].ServiceAccountAnnotations != nil {
+		return dda.Spec.Override[NodeAgentComponentName].ServiceAccountAnnotations
+	}
+	return defaultAnnotations
+}
+
+// GetClusterChecksRunnerServiceAccountAnnotations returns the annotations for the cluster-checks-runner service account.
+func GetClusterChecksRunnerServiceAccountAnnotations(dda *DatadogAgent) map[string]string {
+	defaultAnnotations := map[string]string{}
+	if dda.Spec.Override[ClusterChecksRunnerComponentName] != nil && dda.Spec.Override[ClusterChecksRunnerComponentName].ServiceAccountAnnotations != nil {
+		return dda.Spec.Override[ClusterChecksRunnerComponentName].ServiceAccountAnnotations
+	}
+	return defaultAnnotations
+}
+
 // IsHostNetworkEnabled returns whether the pod should use the host's network namespace
 func IsHostNetworkEnabled(dda *DatadogAgent, component ComponentName) bool {
 	if dda.Spec.Override != nil {

api/datadoghq/v2alpha1/utils_test.go

@@ -108,7 +108,7 @@ func Test_GetImage(t *testing.T) {
 	}
 }
 
-func TestServiceAccountOverride(t *testing.T) {
+func TestServiceAccountNameOverride(t *testing.T) {
 	customServiceAccount := "fake"
 	ddaName := "test-dda"
 	tests := []struct {
@@ -154,3 +154,122 @@ func TestServiceAccountOverride(t *testing.T) {
 		})
 	}
 }
+
+func TestServiceAccountAnnotationOverride(t *testing.T) {
+	customServiceAccount := "fake"
+	customServiceAccountAnnotations := map[string]string{
+		"eks.amazonaws.com/role-arn": "arn:aws:iam::123456789012:role/datadog-role",
+		"really.important":           "annotation",
+	}
+	ddaName := "test-dda"
+	tests := []struct {
+		name string
+		dda  *DatadogAgent
+		want map[ComponentName]map[string]interface{}
+	}{
+		{
+			name: "custom serviceaccount annotations for dda, dca and clc",
+			dda: &DatadogAgent{
+				ObjectMeta: v1.ObjectMeta{
+					Name: ddaName,
+				},
+				Spec: DatadogAgentSpec{
+					Override: map[ComponentName]*DatadogAgentComponentOverride{
+						ClusterAgentComponentName: {
+							ServiceAccountName:        &customServiceAccount,
+							ServiceAccountAnnotations: customServiceAccountAnnotations,
+						},
+						ClusterChecksRunnerComponentName: {
+							ServiceAccountAnnotations: customServiceAccountAnnotations,
+						},
+						NodeAgentComponentName: {
+							ServiceAccountAnnotations: customServiceAccountAnnotations,
+						},
+					},
+				},
+			},
+			want: map[ComponentName]map[string]interface{}{
+				ClusterAgentComponentName: {
+					"name":        customServiceAccount,
+					"annotations": customServiceAccountAnnotations,
+				},
+				NodeAgentComponentName: {
+					"name":        fmt.Sprintf("%s-%s", ddaName, DefaultAgentResourceSuffix),
+					"annotations": customServiceAccountAnnotations,
+				},
+				ClusterChecksRunnerComponentName: {
+					"name":        fmt.Sprintf("%s-%s", ddaName, DefaultClusterChecksRunnerResourceSuffix),
+					"annotations": customServiceAccountAnnotations,
+				},
+			},
+		},
+		{
+			name: "custom serviceaccount annotations for dca",
+			dda: &DatadogAgent{
+				ObjectMeta: v1.ObjectMeta{
+					Name: ddaName,
+				},
+				Spec: DatadogAgentSpec{
+					Override: map[ComponentName]*DatadogAgentComponentOverride{
+						ClusterAgentComponentName: {
+							ServiceAccountName:        &customServiceAccount,
+							ServiceAccountAnnotations: customServiceAccountAnnotations,
+						},
+					},
+				},
+			},
+			want: map[ComponentName]map[string]interface{}{
+				NodeAgentComponentName: {
+					"name":        fmt.Sprintf("%s-%s", ddaName, DefaultAgentResourceSuffix),
+					"annotations": map[string]string{},
+				},
+				ClusterAgentComponentName: {
+					"name":        customServiceAccount,
+					"annotations": customServiceAccountAnnotations,
+				},
+				ClusterChecksRunnerComponentName: {
+					"name":        fmt.Sprintf("%s-%s", ddaName, DefaultClusterChecksRunnerResourceSuffix),
+					"annotations": map[string]string{},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			res := map[ComponentName]map[string]interface{}{
+				NodeAgentComponentName: {
+					"name":        GetAgentServiceAccount(tt.dda),
+					"annotations": GetAgentServiceAccountAnnotations(tt.dda),
+				},
+				ClusterChecksRunnerComponentName: {
+					"name":        GetClusterChecksRunnerServiceAccount(tt.dda),
+					"annotations": GetClusterChecksRunnerServiceAccountAnnotations(tt.dda),
+				},
+				ClusterAgentComponentName: {
+					"name":        GetClusterAgentServiceAccount(tt.dda),
+					"annotations": GetClusterAgentServiceAccountAnnotations(tt.dda),
+				},
+			}
+			for componentName, sa := range tt.want {
+				if res[componentName]["name"] != sa["name"] {
+					t.Errorf("Service Account Override Name error = %v, want %v", res[componentName], tt.want[componentName])
+				}
+				if !mapsEqual(res[componentName]["annotations"].(map[string]string), sa["annotations"].(map[string]string)) {
+					t.Errorf("Service Account Override Annotation error = %v, want %v", res[componentName], tt.want[componentName])
+				}
+			}
+		})
+	}
+}
+
+func mapsEqual(a, b map[string]string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for key, value := range a {
+		if bValue, ok := b[key]; !ok || value != bValue {
+			return false
+		}
+	}
+	return true
+}