Repository navigation
Conversation
Provider-neutral identity for installers that are not tied to a specific cloud (MCI on Nebius, CoreWeave and later clouds), per FX-1127: - env DD_MANAGED_INSTALLATION_ID + DD_RESOURCE_KEY_SHA256 - updater tags managed_installation_id, resource_key_sha256, managed_agent_installation:generic-v1 - intent decoder for provider "generic" (json field resourceKeySHA256) The EKS provider is unchanged; configuring both fails closed as before. Co-Authored-By: Claude Code <noreply@anthropic.com>
Adds the absent desired-state path, the whitespace validation branch, TargetID's undecodable digest branch, and table-driven error cases for every decoder rejection: missing and oversized intents, trailing JSON, unsupported version, invalid operation and acknowledged operation IDs, acknowledgement mismatch, invalid bootstrap cluster name and site, and unsupported desired state. Addresses the PR-gate patch coverage threshold. Co-Authored-By: Claude Code <noreply@anthropic.com>
yuhuyoyo
force-pushed
the
yuhu/managed-install-agent-config-on-generic
branch
from
November 10, 2026 19:33
4c9b5bb to
a4283ae
Compare
yuhuyoyo
changed the title
yuhuyoyo
marked this pull request as ready for review
November 10, 2026 22:39
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 74aca56d8d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… intent
Managed Cloud Instrumentation (MCI) installs the agent with a minimal
bootstrap spec, so GPU monitoring and APM single-step instrumentation
cannot be requested at install time today; the only remote path
(update_operator) cannot express DatadogAgentProfile-based node scoping.
Extend the managed Agent installation intent with two optional settings
the EKS decoder accepts:
- agentConfig: a {"spec": <DatadogAgentSpec fragment>} merged over the
bootstrap spec at install time. Bootstrap stays authoritative for
clusterName, site, and the linux node selectors; credentials are
rejected. This is the same shape the Fleet INSTALLER_CONFIG path and
the APM setup page use, so the ssi-mode datadog-agent.yaml applies
verbatim.
- agentProfiles: DatadogAgentProfile entries (name, profileAffinity,
config.spec) the Fleet Daemon creates next to the managed DatadogAgent,
fleet-owned like the existing Windows profile (validated with the
profile allowlists, torn down via owner garbage collection, waited on
during uninstall). When profiles are present the DatadogAgent gets the
agent.datadoghq.com/update-metadata annotation.
Both settings are covered by the intent digest (canonicalized, so JSON
reformatting does not change it) and rejected on uninstall intents.
The decode/merge/validate/digest logic sits in a provider-neutral
finalizeManagedAgentInstallationIntent, so provider decoders beyond EKS
(the generic provider proposed in #3751) can adopt the same settings with
a wire-field pair and one call.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The PR Gates patch-coverage check requires 80% of modified lines to be covered; the agentProfiles paths only had happy-path and rejection tests. Add tests for valid profile decoding, decoder edge cases (trailing content, profile count limit, config without spec), fragment merge without component overrides, profile validation branches (terminating, foreign ownership, missing owner), install fault modes (profile create/read failures on new and existing targets, drift), the acknowledge-time pinned-config validation, and the uninstall inventory profile list failure, bringing local patch coverage to ~96%. Environment: Datadog workspace Co-Authored-By: Claude Code <noreply@anthropic.com>
Route the generic provider intent through the shared finalizeManagedAgentInstallationIntent so Nebius/CoreWeave installs can request DatadogAgentProfiles (GPU monitoring) via the install intent, matching the EKS decoder wiring from PR 3753. Update the desired-state error expectation now that the shared finalize emits the provider-neutral message. Local test branch for live Nebius GPU-cluster validation only. Environment: Datadog workspace Co-Authored-By: Claude Code <noreply@anthropic.com>
Revert the EKS intent decoder and the EKS marketplace schema/template changes so agentConfig/agentProfiles are wired only into the generic provider decoder (PR #3751). EKS keeps its inline decoder and can adopt the shared finalizeManagedAgentInstallationIntent tail later. Rewrite the agent config/profile tests against the generic wire format and swap the APM example configs for log collection: base APM is enabled by default in the operator, so the agentConfig mechanism targets single-step instrumentation and other non-default settings. Environment: Datadog workspace Co-Authored-By: Claude Code <noreply@anthropic.com>
yuhuyoyo
force-pushed
the
yuhu/managed-install-agent-config-on-generic
branch
from
November 12, 2026 22:33
74aca56 to
c780a6a
Compare
Collapse every comment the PR introduces to one line and one sentence, dropping redundant detail. No code or test behavior changes. Environment: Datadog workspace Co-Authored-By: Claude Code <noreply@anthropic.com>
The intent decoder only ran ValidateDatadogAgentProfileSpec, which does not enforce the 63-character label-value limit on profile names and does not parse node selector requirements. A DNS-valid multi-label name longer than 63 characters, or an affinity requirement such as `operator: In` with no values, therefore passed decoding even though the profile controller skips that profile during reconciliation. Fleet could then report a successful installation without applying the requested configuration. Run agentprofile.ValidateProfileAndReturnRequirements during decoding, matching reconcileProfiles, so these intents are rejected before installation completion. Add regression tests for both cases. Environment: Datadog workspace Co-Authored-By: Claude Code <noreply@anthropic.com>
levan-m
approved these changes
Nov 13, 2026
Resolve add/add conflicts in pkg/fleet/managed_agent_installation_intent_generic.go and its test (artifact of #3751's squash merge): keep the PR side, which wires agentConfig/agentProfiles through finalizeManagedAgentInstallationIntent. Environment: Datadog workspace Co-Authored-By: Claude Code (claude-deepseek-v4.1-flash) <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds two optional, provider-neutral settings to the managed Agent installation intent (the ConfigMap the Fleet Daemon watches), wired into the generic provider decoder only (from #3751):
agentConfig—{"spec": <DatadogAgentSpec fragment>}merged over the bootstrap spec at install time. Bootstrap stays authoritative forclusterName,site, and the linux node selectors;spec.global.credentials/ cluster Agent tokens are rejected, so the Fleet-delivered credentials are never overridden. The shape matches the Fleet INSTALLER_CONFIG payload and the Datadog Agent setup page'sdatadog-agent.yaml, so a fragment such asfeatures.apm.instrumentation(single-step instrumentation) applies verbatim.agentProfiles—DatadogAgentProfileentries (name,profileAffinity,config.spec) created next to the managed DatadogAgent, mirroring the existing Windows profile: fleet ownership labels + controller owner reference, validated against the profile allowlists (gpu,apm,hostProfiler), garbage-collected via the owner reference on uninstall, and waited on bymanagedAgentInstallationResourcesAbsent. When profiles are requested the DatadogAgent is annotatedagent.datadoghq.com/update-metadata: "true", as required by the Agent Profiles feature.Both settings participate in the intent digest (canonicalized so JSON reformatting does not change it, which keeps replay-with-different-content protection covering the config), and uninstall intents carrying them are rejected.
The decode/merge/validate/digest logic lives in one shared
finalizeManagedAgentInstallationIntentused by the generic provider decoder. EKS is intentionally untouched: its decoder keeps its existing inline logic (noagentConfig/agentProfileson the EKS wire format, no EKS marketplace schema/template changes) and can adopt the shared finalize tail later. This PR is stacked on #3751 (fx-1127-generic-identity); merge order is #3751 first.Why
MCI installs the agent with a minimal bootstrap intent, so on generic-provider clusters (Nebius, CoreWeave — the provider added in #3751) a rule cannot request GPU monitoring (GPU-nodes-only via a
DatadogAgentProfilewithprofileNodeAffinity) or APM single-step instrumentation at install time. The only post-install remote path (update_operatorconfig deployments) patches the DatadogAgent only and cannot address profiles or node selectors. Carrying the config in the install intent makes rule-create → install → features on, with no manual YAML.Note that base APM is enabled by default in the operator (
defaultAPMEnabled = true), so theagentConfigpath is not needed for plain APM. It is for single-step instrumentation (which is not default-on) and other non-default settings.Live test on a real Nebius GPU cluster (2026-11-12)
Verified end-to-end against a Nebius managed Kubernetes GPU cluster with the generic provider:
Works end-to-end: intent ConfigMap → fleet daemon → DatadogAgent +
gpu-nodesDatadogAgentProfile (VALID/APPLIED) → a second DaemonSet scheduled only on the GPU node, with the base DaemonSet desired count 0 on profile-matched nodes →DD_GPU_ENABLED=true, NVML detected, andgpu.*metrics (e.g.gpu.total_energy_consumption) arriving in Datadog.The GPU node affinity label is cloud-specific:
nebius.com/gpu=true— notnvidia.com/gpu.present.gpu.nvidia.com/class/gpu.coreweave.cloud/driver-version.nvidia.com/gpu.present.A wrong label is a silent no-op: the profile matches 0 nodes, the base DaemonSet covers the GPU node without GPU monitoring, and the fleet state still reports
DONE. Suggested follow-up: surface the matched-node count inDatadogAgentProfilestatus, or have the fleet daemon warn when a requested profile matches 0 nodes.Nebius has no
nvidiaRuntimeClass (drivers are baked into the node image). Intents targeting managed-driver clouds must setfeatures.gpu.requiredRuntimeClassName: ""; the operator default is"nvidia", which leaves the agent pods unschedulable there.Install → acknowledge → uninstall was verified. Deleting the intent ConfigMap garbage-collects the state ConfigMap because it is owned by the intent ConfigMap, so Fleet must always update the intent ConfigMap in place, never delete and recreate it.
Nebius provider detection ([FX-1133] Detect Nebius and default kubelet.tlsVerify to false #3722) works in managed-install mode:
DD_KUBELET_TLS_VERIFY=falseis set on all agent containers.Testing
go test ./pkg/fleet/ -count=1green.go build ./...clean;make lintreports 0 issues.agentConfig/agentProfiles(merge semantics, bootstrap authority, digest stability across reformatting, digest change on config change), unsafe-settings table (credentials in agentConfig / profile config, unknown fields, reserved/duplicated/invalid profile names, missing affinity, feature outside the profile allowlist, settings on uninstall), profile lifecycle (create/validate/idempotent ensure/drift rejection), uninstall waits for fleet-owned profiles, and a fullinstallDatadogAgentwith profiles asserting the update-metadata annotation and the created profile.The dd-source counterpart (MCI rule
install_options→ intent plumbing) is ddoghq/dd-source#171714.🤖 Generated with Claude Code