Merge remote-tracking branch 'origin/main' into liliya.belaus/remove-…

…datadog-ns-blacklisting-ssi

.github/workflows/labeler/labels.yaml

@@ -0,0 +1,45 @@
+chart/datadog:
+    - changed-files:
+        - any-glob-to-any-file: "charts/datadog/**"
+
+chart/datadog-crds:
+    - changed-files:
+        - any-glob-to-any-file: "charts/datadog-crds/**"
+        - any-glob-to-any-file: "crds/**"
+
+chart/datadog-operator:
+    - changed-files:
+        - any-glob-to-any-file: "charts/datadog-operator/**"
+
+chart/extended-daemon-set:
+    - changed-files:
+        - any-glob-to-any-file: "charts/extended-daemon-set/**"
+
+chart/watermarkpodautoscaler:
+    - changed-files:
+        - any-glob-to-any-file: "charts/watermarkpodautoscaler/**"
+
+chart/observability-pipelines-worker:
+    - changed-files:
+        - any-glob-to-any-file: "charts/observability-pipelines-worker/**"
+
+chart/synthetics-private-location:
+    - changed-files:
+        - any-glob-to-any-file: "charts/synthetics-private-location/**"
+
+tools/tests:
+    - changed-files:
+        - any-glob-to-any-file: "tests/**"
+
+tools/ci:
+    - changed-files:
+        - any-glob-to-any-file: ".github/**"
+        - any-glob-to-any-file: ".gitlab-ci.yml"
+        - any-glob-to-any-file: "Makefile"
+
+documentation:
+    - changed-files:
+        - any-glob-to-any-file: "README.md"
+        - any-glob-to-any-file: "examples/**"
+        - any-glob-to-any-file: "CONTRIBUTING.md"
+        - any-glob-to-any-file: "LICENSE"

.github/workflows/pr-labeler.yaml

@@ -0,0 +1,16 @@
+name: Labeler
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  label:
+    name: Add label for PRs
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/labeler@v5
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          configuration-path: .github/workflows/labeler/labels.yaml

charts/datadog/CHANGELOG.md

@@ -4,6 +4,14 @@
 
 * Change configuration options for APM Instrumentation.
 
+## 3.57.3
+
+* Exclude agent, cluster agent and agent clusterchecks pods from injection from the admission controller.
+
+## 3.57.2
+
+* Add `networkpolicies` default permission for the cluster agent.
+
 ## 3.57.1
 
 * Allow configuring CWS security profile based auto suppression feature and enable it by default.

charts/datadog/templates/agent-clusterchecks-deployment.yaml

@@ -27,6 +27,7 @@ spec:
       labels:
 {{ include "datadog.template-labels" . | indent 8 }}
         app.kubernetes.io/component: clusterchecks-agent
+        admission.datadoghq.com/enabled: "false"
         app: {{ template "datadog.fullname" . }}-clusterchecks
         {{- if .Values.clusterChecksRunner.additionalLabels }}
 {{ toYaml .Values.clusterChecksRunner.additionalLabels | indent 8 }}

charts/datadog/templates/cluster-agent-deployment.yaml

@@ -38,6 +38,7 @@ spec:
       labels:
 {{ include "datadog.template-labels" . | indent 8 }}
         app.kubernetes.io/component: cluster-agent
+        admission.datadoghq.com/enabled: "false"
         app: {{ template "datadog.fullname" . }}-cluster-agent
         {{- if .Values.clusterAgent.podLabels }}
 {{ toYaml .Values.clusterAgent.podLabels | indent 8 }}

charts/datadog/templates/cluster-agent-rbac.yaml

@@ -171,6 +171,7 @@ rules:
   - networking.k8s.io
   resources:
   - ingresses
+  - networkpolicies
   verbs:
   - list
   - get

charts/datadog/templates/daemonset.yaml

@@ -9,7 +9,6 @@ metadata:
   labels:
 {{ include "datadog.labels" . | indent 4 }}
     app.kubernetes.io/component: agent
-    admission.datadoghq.com/enabled: "false"
     {{- if .Values.agents.additionalLabels }}
 {{ toYaml .Values.agents.additionalLabels | indent 4 }}
     {{- end }}
@@ -30,6 +29,7 @@ spec:
       labels:
 {{ include "datadog.template-labels" . | indent 8 }}
         app.kubernetes.io/component: agent
+        admission.datadoghq.com/enabled: "false"
         app: {{ template "datadog.fullname" . }}
         {{- if .Values.agents.podLabels }}
 {{ toYaml .Values.agents.podLabels | indent 8 }}