[martin-prevost1]

What does this PR do?

Adds spec.features.privateActionRunner with shared enabled and configData settings for the Node Agent and Cluster Agent, plus per-agent overrides. Component configData replaces the shared YAML, including its allowlist.

spec:
  features:
    privateActionRunner:
      enabled: true
      configData: |
        private_action_runner:
          self_enroll: true
          actions_allowlist:
            - com.datadoghq.script.runPredefinedScript

Existing annotation configuration remains supported. Split mode stays controlled by annotation; Kubernetes actions use the existing features.kubernetesActions feature.

Test

• Targeted unit tests, make lint, API/CRD generation, and server-side validation of all six examples passed.
• Colima with Agent/Cluster Agent 7.84.1: ten configuration scenarios, split annotation, and Kubernetes Actions/RBAC coexistence validated.

[datadog-datadog-prod-us1-2]

🎯 Code Coverage (details)
• Patch Coverage: 85.92%
• Overall Coverage: 55.45% (+0.06%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 9e4a31b | Docs | View more details | Give us feedback!}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T11:53:38.209491Z	e6732ec	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[dd-gplassard]

this probably shouldn't be exposed as a top level config and can be kept as an annotation

[dd-gplassard]

maybe we can keep it in configdata ? especially since we are heavily discussing what we are doing about it, we might not want to introduce it in this PR

[martin-prevost1]

Do you have an idea of the timeline for removing the allowlist? If it is planned for several quarters from now, it may be worth keeping it. But if it is happening very soon, I agree with you. 🙂

[dd-gplassard]

The discussions are happening ~now but there are many open questions on it. I think showing an example with the allowlist in the configdata is a good solution for now

[dd-gplassard]

FYI this might conflict with #3618, you might want to sync on it

[dd-gplassard]

I think this might conflict / double usage with

spec:
  features:
    kubernetesActions:
      enabled: true

which already exists

[estherk15]

instead of what?

Suggested change

	: ConfigData contains YAML configuration, including the private_action_runner key, shared by both agents. The enabled field is controlled by Enabled instead. Configure allowed action patterns with private_action_runner.actions_allowlist. Default: "private_action_runner:\n enabled: true\n"
	: ConfigData contains YAML configuration, including the private_action_runner key, shared by both agents. The enabled field is controlled by Enabled. Configure allowed action patterns with private_action_runner.actions_allowlist. Default: "private_action_runner:\n enabled: true\n"