[ACTP] add private action runner to datadog operator #2516

dd-gplassard · 2026-01-23T16:03:47Z

What does this PR do?

Add deployment option of the Private Action Runner container on node agent

Motivation

We want to provide node agent deployment capabilities of the private action runner

Additional Notes

We're only targeting node agent in this PR but there will be a clusterAgent PR in the future (hence the wrapping of the settings)

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

Agent: v7.77.0

The PAR in agent is available in 7.76.0 but it needs a few changes that will be available in 7.77.0 to work properly

Describe your test plan

Built the datadog operator locally, deployed it to a docker-desktop cluster with this configuration

apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: datadog
spec:
  global:
    clusterName: gplassard-docker-desktop
    site: datad0g.com
    credentials:
      apiSecret:
        secretName: datadog-secret
        keyName: api-key
      appSecret:
        secretName: datadog-secret
        keyName: app-key
    kubelet:
      tlsVerify: false
  override:
    agent:
      image:
        name: gcr.io/datadoghq/cluster-agent:7.73.3
        pullPolicy: IfNotPresent
    nodeAgent:
      image:
        name: <local_image_of_agent_with_fixes>
        pullPolicy: Always
    clusterAgent:
      image:
        name: gcr.io/datadoghq/cluster-agent:7.73.3
        pullPolicy: IfNotPresent
  features:
    logCollection:
      enabled: true
      containerCollectAll: true
    liveContainerCollection:
      enabled: true
    privateActionRunner:
      enabled: true
      nodeAgent:
        selfEnroll: true
        actionsAllowlist:
          - "com.datadoghq.script.testConnection"
          - "com.datadoghq.script.enrichScript"
          - "com.datadoghq.script.runPredefinedScript"
          - "com.datadoghq.kubernetes.core.listPod"
          - "com.datadoghq.kubernetes.core.testConnection"

I verified it deployed and worked correctly

Checklist

PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
PR has a milestone or the qa/skip-qa label
All commits are signed (see: signing commits)

codecov-commenter · 2026-01-23T16:19:18Z

Codecov Report

❌ Patch coverage is 74.13793% with 30 lines in your changes missing coverage. Please review.
✅ Project coverage is 37.97%. Comparing base (c5cf124) to head (8c9b7f4).
⚠️ Report is 11 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/testutils/builder.go	0.00%	26 Missing ⚠️
...atadogagent/feature/privateactionrunner/feature.go	93.93%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2516      +/-   ##
==========================================
+ Coverage   37.91%   37.97%   +0.06%     
==========================================
  Files         303      304       +1     
  Lines       25962    26559     +597     
==========================================
+ Hits         9843    10086     +243     
- Misses      15376    15717     +341     
- Partials      743      756      +13

Flag	Coverage Δ
unittests	`37.97% <74.13%> (+0.06%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...controller/datadogagent/component/agent/default.go	`44.65% <100.00%> (+8.29%)`	⬆️
internal/controller/datadogagent/controller.go	`53.57% <ø> (ø)`
...ontroller/datadogagent/override/podtemplatespec.go	`77.55% <100.00%> (+0.15%)`	⬆️
...atadogagent/feature/privateactionrunner/feature.go	`93.93% <93.93%> (ø)`
pkg/testutils/builder.go	`0.00% <0.00%> (ø)`

... and 8 files with indirect coverage changes

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c5cf124...8c9b7f4. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…ropagate hostname / site as well

…usterAgent deployment

maycmlee

Some suggestions and a question

maycmlee · 2026-01-28T18:56:41Z

docs/configuration.v2alpha1.md

 | features.otlp.receiver.protocols.http.endpoint | For OTLP/HTTP. Default: '0.0.0.0:4318'. |
 | features.otlp.receiver.protocols.http.hostPortConfig.enabled | Enables host port configuration |
 | features.otlp.receiver.protocols.http.hostPortConfig.hostPort | Port takes a port number (0 < x < 65536) to expose on the host. (Most containers do not need this.) If HostNetwork is enabled, this value must match the ContainerPort. |
+| features.privateActionRunner.enabled | Is the main switch for Private Action Runner feature. Default: false |


maycmlee · 2026-01-28T18:57:25Z

docs/configuration.v2alpha1.md

+| features.privateActionRunner.enabled | Is the main switch for Private Action Runner feature. Default: false |
+| features.privateActionRunner.nodeAgent.actionsAllowlist | ActionsAllowlist specifies the list of actions that are allowed to be executed. |
+| features.privateActionRunner.nodeAgent.enabled | Enables Private Action Runner on the Node Agent. Default: true (when parent Enabled is true) |
+| features.privateActionRunner.nodeAgent.selfEnroll | SelfEnroll enables automatic self-enrollment for the node-level runner. |


Suggested change

| features.privateActionRunner.nodeAgent.selfEnroll | SelfEnroll enables automatic self-enrollment for the node-level runner. |

| features.privateActionRunner.nodeAgent.selfEnroll | Enables automatic self-enrollment for the node-level runner. |

maycmlee · 2026-01-28T18:57:59Z

docs/configuration.v2alpha1.md

 | features.otlp.receiver.protocols.http.hostPortConfig.enabled | Enables host port configuration |
 | features.otlp.receiver.protocols.http.hostPortConfig.hostPort | Port takes a port number (0 < x < 65536) to expose on the host. (Most containers do not need this.) If HostNetwork is enabled, this value must match the ContainerPort. |
+| features.privateActionRunner.enabled | Is the main switch for Private Action Runner feature. Default: false |
+| features.privateActionRunner.nodeAgent.actionsAllowlist | ActionsAllowlist specifies the list of actions that are allowed to be executed. |


Suggested change

| features.privateActionRunner.nodeAgent.actionsAllowlist | ActionsAllowlist specifies the list of actions that are allowed to be executed. |

| features.privateActionRunner.nodeAgent.actionsAllowlist | Specifies the list of actions that are allowed to be executed. |

maycmlee · 2026-01-28T18:59:02Z

docs/configuration.v2alpha1.md

 | features.otlp.receiver.protocols.http.hostPortConfig.hostPort | Port takes a port number (0 < x < 65536) to expose on the host. (Most containers do not need this.) If HostNetwork is enabled, this value must match the ContainerPort. |
+| features.privateActionRunner.enabled | Is the main switch for Private Action Runner feature. Default: false |
+| features.privateActionRunner.nodeAgent.actionsAllowlist | ActionsAllowlist specifies the list of actions that are allowed to be executed. |
+| features.privateActionRunner.nodeAgent.enabled | Enables Private Action Runner on the Node Agent. Default: true (when parent Enabled is true) |


What's the parent?

Suggested change

| features.privateActionRunner.nodeAgent.enabled | Enables Private Action Runner on the Node Agent. Default: true (when parent Enabled is true) |

| features.privateActionRunner.nodeAgent.enabled | Enables Private Action Runner on the node Agent. Default: true (when parent Enabled is true) |

maycmlee · 2026-01-28T19:00:48Z

docs/configuration_public.md

 : OTLP ingest configuration See [link](https://docs.datadoghq.com/opentelemetry/setup/otlp_ingest_in_the_agent/?tab=kubernetesoperator) for more information.

+`features.privateActionRunner.enabled`
+: Is the main switch for Private Action Runner feature. Default: false


Suggested change

: Is the main switch for Private Action Runner feature. Default: false

: Enables Private Action Runner. Default: false

maycmlee · 2026-01-28T19:01:58Z

docs/configuration_public.md

+: ActionsAllowlist specifies the list of actions that are allowed to be executed.
+
+`features.privateActionRunner.nodeAgent.enabled`
+: Enables Private Action Runner on the Node Agent. Default: true (when parent Enabled is true)
+
+`features.privateActionRunner.nodeAgent.selfEnroll`
+: SelfEnroll enables automatic self-enrollment for the node-level runner.


Same question, what's the parent?

Suggested change

: ActionsAllowlist specifies the list of actions that are allowed to be executed.

`features.privateActionRunner.nodeAgent.enabled`

: Enables Private Action Runner on the Node Agent. Default: true (when parent Enabled is true)

`features.privateActionRunner.nodeAgent.selfEnroll`

: SelfEnroll enables automatic self-enrollment for the node-level runner.

: Specifies the list of actions that are allowed to be executed.

`features.privateActionRunner.nodeAgent.enabled`

: Enables Private Action Runner on the node Agent. Default: true (when parent Enabled is true)

`features.privateActionRunner.nodeAgent.selfEnroll`

: Wnables automatic self-enrollment for the node-level runner.

[ACTP] add private action runner to datadog operator

aea56cd

dd-gplassard added 6 commits January 27, 2026 15:17

[ACTP] fix PAR spec

fc852f5

[ACTP] add support for selfEnroll and actionsAllowlist and properly p…

dc15658

…ropagate hostname / site as well

[ACTP] make auth volume writable

1012ba7

cleanup

e025550

remove unused custom config

d102076

[ACTP] wrap configuration into a nodeAgent property to prepare for cl…

cdda567

…usterAgent deployment

dd-gplassard added the enhancement New feature or request label Jan 28, 2026

dd-gplassard added this to the v1.23.0 milestone Jan 28, 2026

cleanup

8c9b7f4

dd-gplassard marked this pull request as ready for review January 28, 2026 18:41

dd-gplassard requested review from a team as code owners January 28, 2026 18:41

maycmlee self-assigned this Jan 28, 2026

maycmlee reviewed Jan 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ACTP] add private action runner to datadog operator #2516

[ACTP] add private action runner to datadog operator #2516

dd-gplassard commented Jan 23, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Jan 23, 2026 •

edited

Loading

Uh oh!

maycmlee left a comment

Uh oh!

maycmlee Jan 28, 2026

Uh oh!

maycmlee Jan 28, 2026

Uh oh!

maycmlee Jan 28, 2026

Uh oh!

maycmlee Jan 28, 2026

Uh oh!

maycmlee Jan 28, 2026

Uh oh!

maycmlee Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	\| features.privateActionRunner.enabled \| Is the main switch for Private Action Runner feature. Default: false \|
	\| features.privateActionRunner.enabled \| Enables Private Action Runner. Default: false \|

	\| features.privateActionRunner.nodeAgent.selfEnroll \| SelfEnroll enables automatic self-enrollment for the node-level runner. \|
	\| features.privateActionRunner.nodeAgent.selfEnroll \| Enables automatic self-enrollment for the node-level runner. \|

	: Is the main switch for Private Action Runner feature. Default: false
	: Enables Private Action Runner. Default: false

[ACTP] add private action runner to datadog operator #2516

Are you sure you want to change the base?

[ACTP] add private action runner to datadog operator #2516

Conversation

dd-gplassard commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Additional Notes

Minimum Agent Versions

Describe your test plan

Checklist

Uh oh!

codecov-commenter commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

maycmlee left a comment

Choose a reason for hiding this comment

Uh oh!

maycmlee Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

maycmlee Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

maycmlee Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

maycmlee Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

maycmlee Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

maycmlee Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dd-gplassard commented Jan 23, 2026 •

edited

Loading

codecov-commenter commented Jan 23, 2026 •

edited

Loading