Added option, but rbac is not updating properly

DataDog · Mar 7, 2025 · e83816b · e83816b
1 parent 7ee6d21
commit e83816b
Show file tree

Hide file tree

Showing 5 changed files with 22 additions and 1 deletion.
diff --git a/charts/datadog/CHANGELOG.md b/charts/datadog/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Datadog changelog
 
+## 3.106.1
+
+* Add `pods` to the list of resources to collect in the Agent RBAC when `datadog.kubelet.useApiServer` is set to `true`.
+* Add configuration option for `datadog.kubelet.useApiServer` to get the pod list from the API Server instead of the Kubelet. Disabled by default.
+
 ## 3.106.0
 
 * Target based workload selection for Single Step Instrumentation has been added in preview (requires Cluster Agent 7.64.0+)

diff --git a/charts/datadog/Chart.yaml b/charts/datadog/Chart.yaml
@@ -1,7 +1,7 @@
 ---
 apiVersion: v1
 name: datadog
-version: 3.106.0
+version: 3.106.1
 appVersion: "7"
 description: Datadog Agent
 keywords:

diff --git a/charts/datadog/templates/_containers-common-env.yaml b/charts/datadog/templates/_containers-common-env.yaml
@@ -22,6 +22,10 @@
 - name: DD_KUBELET_TLS_VERIFY
   value: {{ .Values.datadog.kubelet.tlsVerify | quote }}
 {{- end }}
+{{- if .Values.datadog.kubelet.useApiServer | quote }}
+- name: DD_KUBELET_USE_API_SERVER
+  value: {{ .Values.datadog.kubelet.useApiServer | quote }}
+{{- end }}
 {{- if ne (include "datadog.kubelet.mountPath" .) "" }}
 - name: DD_KUBELET_CLIENT_CA
   value: {{ include "datadog.kubelet.mountPath" . }}

diff --git a/charts/datadog/templates/rbac.yaml b/charts/datadog/templates/rbac.yaml
@@ -27,6 +27,15 @@ rules:
   verbs:
   - get
   - list
+{{- if .Values.datadog.kubelet.useApiServer }}
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+{{- end }}
 {{- if .Values.datadog.collectEvents }}
 - apiGroups:
   - ""

diff --git a/charts/datadog/values.yaml b/charts/datadog/values.yaml
@@ -316,6 +316,9 @@ datadog:
     # datadog.kubelet.podResourcesSocketDir -- Path (on host) where the kubelet.sock socket for the PodResources API is located
     # @default -- /var/lib/kubelet/pod-resources
     podResourcesSocketDir: /var/lib/kubelet/pod-resources
+    # datadog.kubelet.useApiServer -- Enable this to query the pod list from the API Server instead of the Kubelet
+    # @default -- false
+    useApiServer: true
 
 
   # datadog.expvarPort -- Specify the port to expose pprof and expvar to not interfere with the agent metrics port from the cluster-agent, which defaults to 5000