Add kubeactions par + rc config by frank-spano · Pull Request #3618 · DataDog/datadog-operator

frank-spano · 2026-10-17T15:30:42Z

What does this PR do?

A brief description of the change being made with this pull request.

Motivation

What inspired you to submit this pull request?

Additional Notes

Anything else we should know when reviewing?

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

Agent: vX.Y.Z
Cluster Agent: vX.Y.Z

Describe your test plan

Write there any instructions and details you may have to test your PR.

Checklist

PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
PR has a milestone or the qa/skip-qa label
All commits are signed (see: signing commits)

chatgpt-codex-connector · 2026-10-17T15:30:53Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T15:33:22.291283Z	`843ea5c`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 843ea5c1f2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-10-17T15:33:19Z

+	clusterAnnotationEnabled := featureutils.HasFeatureEnableAnnotation(dda, featureutils.EnableClusterAgentPrivateActionRunnerAnnotation)
+	if clusterAnnotationEnabled || featureutils.IsKubernetesActionsPAREnabled(ddaSpec) {


Gate PAR auto-enable on the Cluster Agent version

When communication.par is enabled for a Cluster Agent older than 7.84, this condition configures the Private Action Runner despite the API declaring that channel unsupported before 7.84. For versions below 7.79, the Kubernetes Actions feature rejects the configuration while this separate feature still provisions an orphan runner, ConfigMap, and RBAC; for 7.79–7.83 it selects a channel that cannot deliver Kubernetes Actions. Apply the corresponding Cluster Agent version gate before requiring the runner.

Useful? React with 👍 / 👎.

datadog-datadog-prod-us1 · 2026-10-17T15:42:15Z

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 55.45% (+0.07%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: d08b6cb | Docs | Give us feedback!}

Only pass DD_KUBEACTIONS_REMOTE_CONFIG_ENABLED / DD_KUBEACTIONS_PRIVATE_ACTION_RUNNER_ENABLED when the channel is turned off and the Cluster Agent understands the setting. On an older Cluster Agent, communication.rc=false is logged and ignored. communication.par=false now keeps Kubernetes actions out of a Private Action Runner enabled for other workflows. Fix the PAR minimum Cluster Agent version to 7.83.0.

…ons-communication # Conflicts: # docs/configuration.v2alpha1.md # docs/configuration_public.md

The patch DaemonSet / StatefulSet actions are not exposed in the Datadog UI, so do not grant the Cluster Agent cluster-wide patch on those workloads.

communication.par enabled the Cluster Agent Private Action Runner on any Cluster Agent version, provisioning an orphan runner, ConfigMap and RBAC on versions that don't ship the Kubernetes Actions bundle. Only enable it on 7.83.0+, from a shared feature-utils helper so the private action runner and Kubernetes Actions features agree, and log when the request is ignored. Also regenerate zz_generated.openapi.go (stale PAR field description) and add unit tests for the Kubernetes Actions helpers and builder.

gabedos · 2026-10-21T18:58:50Z

+
+// KubernetesActionsCommunicationConfig selects the channels used to deliver Kubernetes actions to the Cluster Agent.
+// +k8s:openapi-gen=true
+type KubernetesActionsCommunicationConfig struct {


Naming nit: could we spell these out as remoteConfiguration / privateActionRunner? The CRD already uses remoteConfiguration for RC (features.remoteConfiguration, features.cws.remoteConfiguration), PAR is spelled out in all the private-action-runner-* annotations, and the agent env vars this maps to (DD_KUBEACTIONS_REMOTE_CONFIG_ENABLED, DD_KUBEACTIONS_PRIVATE_ACTION_RUNNER_ENABLED) spell them out too.

Struct nit: Optionally, following the cws.remoteConfiguration.enabled pattern ({enabled: bool} sub-structs) would leave room for PAR-specific options later for communication to be configured (eg. providing own URL or APP keys to be used for that specific RC client)

gabedos · 2026-10-21T19:01:39Z

+	if !apiutils.BoolValue(ka.Enabled) {
+		return false
+	}
+	return ka.Communication == nil || ka.Communication.RC == nil || *ka.Communication.RC


Optional nit: unsure if you've considered this but there does exist the global features.remoteConfiguration config. It could make sense to also disable KubeActions RC if the global RC is disabled, but also fair if you want this to be completely independent. Just wanted to highlight this

…nfiguration is disabled Address review feedback: - Spell out communication.rc / communication.par as communication.remoteConfiguration.enabled / communication.privateActionRunner.enabled, using {enabled} sub-structs like cws.remoteConfiguration so per-channel options can be added later. - Log an error when Kubernetes Actions is enabled while features.remoteConfiguration is disabled: the Cluster Agent intentionally refuses to start in that case, and the log points at the cause.

vboulineau · 2026-10-22T08:37:45Z

+	// Communication selects the channels the Cluster Agent uses to receive Kubernetes actions.
+	// At least one channel must be enabled; both can be enabled at the same time.
+	// +optional
+	Communication *KubernetesActionsCommunicationConfig `json:"communication,omitempty"`


Do we really want to expose the internals here?

@vboulineau The thought was that we'd give the option to use both pipelines or just one. Are you thinking that maybe we just require both? The PAR uses RC for configuration so, it's not like customers can use it with RC disabled anyway.

features.kubernetesActions.enabled: true now uses both Remote Configuration and the Cluster Agent Private Action Runner (on Cluster Agent 7.83.0+); set communication.privateActionRunner.enabled: false for Remote Configuration only.

Raise the Kubernetes Actions minimum Cluster Agent version from 7.79.0 to 7.84.0 and use one KubernetesActionsMinVersion for both the Kubernetes Actions feature and the Private Action Runner it enables. On older Cluster Agents the feature is not configured.

gabedos

Exposing KubeActions.Communication.[RemoteConfig|PrivateActionRunner].Enabled looks good to me 👍

…ons-communication # Conflicts: # api/datadoghq/v2alpha1/zz_generated.openapi.go # docs/configuration.v2alpha1.md

Add kubeactions par + rc config

843ea5c

frank-spano requested a review from a team October 17, 2026 15:30

frank-spano requested review from a team as code owners October 17, 2026 15:30

frank-spano requested review from samrcarr and removed request for a team October 17, 2026 15:30

github-actions Bot added team/action-platform team/container-platform team/container-autoscaling team/documentation labels Oct 17, 2026

chatgpt-codex-connector Bot reviewed Oct 17, 2026

View reviewed changes

update rbac

9ea478b

drichards-87 approved these changes Oct 19, 2026

View reviewed changes

frank-spano added 3 commits October 21, 2026 09:25

Merge remote-tracking branch 'origin/main' into frank.spano/kube-acti…

d541bc6

…ons-communication # Conflicts: # docs/configuration.v2alpha1.md # docs/configuration_public.md

Drop DaemonSet / StatefulSet patch RBAC from Kubernetes Actions

e5cac83

The patch DaemonSet / StatefulSet actions are not exposed in the Datadog UI, so do not grant the Cluster Agent cluster-wide patch on those workloads.

frank-spano added the enhancement New feature or request label Oct 21, 2026

frank-spano added this to the v1.32.0 milestone Oct 21, 2026

gabedos reviewed Oct 21, 2026

View reviewed changes

vboulineau approved these changes Oct 22, 2026

View reviewed changes

vboulineau reviewed Oct 22, 2026

View reviewed changes

frank-spano added 2 commits October 22, 2026 09:52

Enable both Kubernetes Actions channels by default

7d99bf7

features.kubernetesActions.enabled: true now uses both Remote Configuration and the Cluster Agent Private Action Runner (on Cluster Agent 7.83.0+); set communication.privateActionRunner.enabled: false for Remote Configuration only.

gabedos approved these changes Oct 22, 2026

View reviewed changes

dd-gplassard approved these changes Oct 23, 2026

View reviewed changes

dd-gplassard mentioned this pull request Oct 23, 2026

[ACTP] Add Private Action Runner feature configuration #3653

Open

Merge remote-tracking branch 'origin/main' into frank.spano/kube-acti…

d08b6cb

…ons-communication # Conflicts: # api/datadoghq/v2alpha1/zz_generated.openapi.go # docs/configuration.v2alpha1.md

frank-spano force-pushed the frank.spano/kube-actions-communication branch from 72c5a56 to d08b6cb Compare October 23, 2026 12:35

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: waiting mergequeue-status: queued mergequeue-status: in_progress and removed mergequeue-status: waiting mergequeue-status: queued labels Oct 23, 2026

gh-worker-dd-mergequeue-cf854d Bot merged commit 94841e1 into main Oct 23, 2026
59 checks passed

gh-worker-dd-mergequeue-cf854d Bot deleted the frank.spano/kube-actions-communication branch October 23, 2026 14:14

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: done and removed mergequeue-status: in_progress labels Oct 23, 2026

Navigation Menu

Repository navigation

Add kubeactions par + rc config - #3618

Add kubeactions par + rc config#3618
gh-worker-dd-mergequeue-cf854d[bot] merged 10 commits into
mainfrom
frank.spano/kube-actions-communication

frank-spano commented Oct 17, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 17, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 17, 2026

Uh oh!

datadog-datadog-prod-us1 Bot commented Oct 17, 2026 •

edited by datadog-official Bot

Loading

Uh oh!

gabedos Oct 21, 2026

Uh oh!

gabedos Oct 21, 2026

Uh oh!

vboulineau Oct 22, 2026

Uh oh!

frank-spano Oct 22, 2026

Uh oh!

gabedos left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		clusterAnnotationEnabled := featureutils.HasFeatureEnableAnnotation(dda, featureutils.EnableClusterAgentPrivateActionRunnerAnnotation)
		if clusterAnnotationEnabled \|\| featureutils.IsKubernetesActionsPAREnabled(ddaSpec) {

Conversation

frank-spano commented Oct 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Additional Notes

Minimum Agent Versions

Describe your test plan

Checklist

Uh oh!

chatgpt-codex-connector Bot commented Oct 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 17, 2026

Choose a reason for hiding this comment

Uh oh!

datadog-datadog-prod-us1 Bot commented Oct 17, 2026 • edited by datadog-official Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gabedos Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

gabedos Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

vboulineau Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

frank-spano Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

gabedos left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

frank-spano commented Oct 17, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 17, 2026 •

edited

Loading

datadog-datadog-prod-us1 Bot commented Oct 17, 2026 •

edited by datadog-official Bot

Loading