Merge branch 'main' into khewonc/refactor-experiment-signals

Author: levan-m

.github/CODEOWNERS

@@ -37,7 +37,7 @@ README.md               @DataDog/documentation  @DataDog/container-platform
 /internal/controller/datadogagent/feature/livecontainer             @DataDog/container-experiences  @DataDog/container-platform
 /internal/controller/datadogagent/feature/liveprocess               @DataDog/container-experiences  @DataDog/container-platform
 /internal/controller/datadogagent/feature/logcollection             @DataDog/agent-log-pipelines    @DataDog/container-platform
-/internal/controller/datadogagent/feature/npm                       @DataDog/ndm-core               @DataDog/container-platform
+/internal/controller/datadogagent/feature/npm                       @DataDog/cloud-network-monitoring @DataDog/container-platform
 /internal/controller/datadogagent/feature/oomkill                   @DataDog/ebpf-platform          @DataDog/container-platform
 /internal/controller/datadogagent/feature/orchestratorexplorer      @DataDog/kubernetes-experiences @DataDog/container-platform
 /internal/controller/datadogagent/feature/otelagentgateway          @DataDog/opentelemetry-agent    @DataDog/container-platform

.github/chainguard/self.operatorrelease-prod.sts.yaml

@@ -50,6 +50,7 @@ core,github.com/aws/aws-sdk-go-v2/internal/configsources,Apache-2.0
 core,github.com/aws/aws-sdk-go-v2/internal/endpoints/v2,Apache-2.0
 core,github.com/aws/aws-sdk-go-v2/internal/ini,Apache-2.0
 core,github.com/aws/aws-sdk-go-v2/internal/sync/singleflight,BSD-3-Clause
+core,github.com/aws/aws-sdk-go-v2/service/autoscaling,Apache-2.0
 core,github.com/aws/aws-sdk-go-v2/service/cloudformation,Apache-2.0
 core,github.com/aws/aws-sdk-go-v2/service/ec2,Apache-2.0
 core,github.com/aws/aws-sdk-go-v2/service/eks,Apache-2.0
@@ -76,7 +77,7 @@ core,github.com/containerd/containerd,Apache-2.0
 core,github.com/containerd/errdefs,Apache-2.0
 core,github.com/containerd/log,Apache-2.0
 core,github.com/containerd/platforms,Apache-2.0
-core,github.com/cyphar/filepath-securejoin,BSD-3-Clause
+core,github.com/cyphar/filepath-securejoin,MPL-2.0
 core,github.com/davecgh/go-spew/spew,ISC
 core,github.com/dsnet/compress,BSD-3-Clause
 core,github.com/dustin/go-humanize,MIT
@@ -114,6 +115,7 @@ core,github.com/golang/snappy,BSD-3-Clause
 core,github.com/google/btree,Apache-2.0
 core,github.com/google/cel-go,Apache-2.0
 core,github.com/google/gnostic-models,Apache-2.0
+core,github.com/google/go-containerregistry/pkg/name,Apache-2.0
 core,github.com/google/pprof/profile,Apache-2.0
 core,github.com/google/uuid,BSD-3-Clause
 core,github.com/gorilla/websocket,BSD-2-Clause

.github/chainguard/self.operatorrelease-staging.sts.yaml

@@ -72,6 +72,14 @@ resources:
   kind: DatadogPodAutoscaler
   path: github.com/DataDog/datadog-operator/api/datadoghq/v1alpha1
   version: v1alpha1
+- api:
+    crdVersion: v1
+    namespaced: true
+  domain: com
+  group: datadoghq
+  kind: DatadogInstrumentation
+  path: github.com/DataDog/datadog-operator/api/datadoghq/v1alpha1
+  version: v1alpha1
 - api:
     crdVersion: v1
     namespaced: true

LICENSE-3rdparty.csv

@@ -359,12 +359,21 @@ type DatadogPodAutoscalerConstraints struct {
 }
 
 // DatadogPodAutoscalerContainerControlledValues specifies which resource values should be controlled.
-// +kubebuilder:validation:Enum:=RequestsAndLimits;RequestsOnly
+// +kubebuilder:validation:Enum:=RequestsAndLimits;RequestsOnly;CPURequestsRemoveLimitsMemoryRequestsAndLimits
 type DatadogPodAutoscalerContainerControlledValues string
 
 const (
+	// DatadogPodAutoscalerContainerControlledValuesRequestsAndLimits controls both requests and limits for all resources (CPU and Memory).
 	DatadogPodAutoscalerContainerControlledValuesRequestsAndLimits DatadogPodAutoscalerContainerControlledValues = "RequestsAndLimits"
-	DatadogPodAutoscalerContainerControlledValuesRequestsOnly      DatadogPodAutoscalerContainerControlledValues = "RequestsOnly"
+
+	// DatadogPodAutoscalerContainerControlledValuesRequestsOnly controls only requests for all resources (CPU and Memory).
+	// Existing limits are left unchanged.
+	DatadogPodAutoscalerContainerControlledValuesRequestsOnly DatadogPodAutoscalerContainerControlledValues = "RequestsOnly"
+
+	// DatadogPodAutoscalerContainerControlledValuesCPURequestsRemoveLimitsMemoryRequestsAndLimits applies different strategies per resource:
+	// - CPU: only requests are controlled and any existing CPU limit is removed, allowing the container to burst freely and avoid CPU throttling.
+	// - Memory: both requests and limits are controlled.
+	DatadogPodAutoscalerContainerControlledValuesCPURequestsRemoveLimitsMemoryRequestsAndLimits DatadogPodAutoscalerContainerControlledValues = "CPURequestsRemoveLimitsMemoryRequestsAndLimits"
 )
 
 // DatadogPodAutoscalerContainerConstraints defines constraints that should always be respected for a container.
@@ -419,6 +428,12 @@ type DatadogPodAutoscalerOptions struct {
 	// OutOfMemory configures behavior when OOM events are detected.
 	// +optional
 	OutOfMemory *DatadogPodAutoscalerOutOfMemoryOptions `json:"outOfMemory,omitempty"`
+
+	// Burstable, if true, removes CPU limits from containers while keeping CPU request recommendations,
+	// granting the pod a Burstable QoS class and allowing it to consume idle node CPU capacity beyond its requests.
+	// If not set, the default value is determined by the Cluster Agent setting autoscaling.workload.options.burstable.
+	// +optional
+	Burstable *bool `json:"burstable,omitempty"`
 }
 
 // DatadogPodAutoscalerOutOfMemoryOptions configures the behavior when out-of-memory events are detected.
@@ -431,6 +446,16 @@ type DatadogPodAutoscalerOutOfMemoryOptions struct {
 	BumpUpRatio *resource.Quantity `json:"bumpUpRatio,omitempty"`
 }
 
+// DatadogPodAutoscalerOptionsStatus reflects the effective options applied by the autoscaler.
+// +kubebuilder:object:generate=true
+type DatadogPodAutoscalerOptionsStatus struct {
+	// Burstable is the effective value of the burstable setting applied by the autoscaler.
+	// When not set in the spec, this reflects the default determined by the Cluster Agent
+	// setting autoscaling.workload.options.burstable.
+	// +optional
+	Burstable *bool `json:"burstable,omitempty"`
+}
+
 // DatadogPodAutoscalerStatus defines the observed state of DatadogPodAutoscaler
 // +kubebuilder:object:generate=true
 type DatadogPodAutoscalerStatus struct {
@@ -446,6 +471,10 @@ type DatadogPodAutoscalerStatus struct {
 	// +optional
 	CurrentReplicas *int32 `json:"currentReplicas,omitempty"`
 
+	// Options reflects the effective options applied by the autoscaler.
+	// +optional
+	Options *DatadogPodAutoscalerOptionsStatus `json:"options,omitempty"`
+
 	// Conditions describe the current state of the DatadogPodAutoscaler operations.
 	// +patchMergeKey=type
 	// +patchStrategy=merge

PROJECT

@@ -14,11 +14,11 @@ import (
 )
 
 // ValidateDatadogAgentProfileSpec is used to check if a DatadogAgentProfileSpec is valid
-func ValidateDatadogAgentProfileSpec(spec *DatadogAgentProfileSpec, datadogAgentInternalEnabled bool) error {
+func ValidateDatadogAgentProfileSpec(spec *DatadogAgentProfileSpec) error {
 	if err := validateProfileAffinity(spec.ProfileAffinity); err != nil {
 		return err
 	}
-	if err := validateConfig(spec.Config, datadogAgentInternalEnabled); err != nil {
+	if err := validateConfig(spec.Config); err != nil {
 		return err
 	}
 
@@ -39,20 +39,17 @@ func validateProfileAffinity(profileAffinity *ProfileAffinity) error {
 	return nil
 }
 
-func validateConfig(spec *v2alpha1.DatadogAgentSpec, datadogAgentInternalEnabled bool) error {
+func validateConfig(spec *v2alpha1.DatadogAgentSpec) error {
 	if spec == nil {
 		return undefinedError("config")
 	}
-	if err := validateFeatures(spec.Features, datadogAgentInternalEnabled); err != nil {
+	if err := validateFeatures(spec.Features); err != nil {
 		return err
 	}
 	// global is not supported
 	if spec.Global != nil {
 		return unsupportedError("global")
 	}
-	if !datadogAgentInternalEnabled && spec.Override == nil {
-		return undefinedError("config override")
-	}
 	for component, override := range spec.Override {
 		if err := validateOverride(component, override); err != nil {
 			return err
@@ -62,13 +59,10 @@ func validateConfig(spec *v2alpha1.DatadogAgentSpec, datadogAgentInternalEnabled
 	return nil
 }
 
-func validateFeatures(features *v2alpha1.DatadogFeatures, datadogAgentInternalEnabled bool) error {
+func validateFeatures(features *v2alpha1.DatadogFeatures) error {
 	if features == nil {
 		return nil
 	}
-	if !datadogAgentInternalEnabled {
-		return fmt.Errorf("the 'features' field is only supported when DatadogAgentInternal is enabled")
-	}
 
 	// Only GPU feature is currently supported in DatadogAgentProfile context.
 	// Remove supported features from the `unsupportedFeatures` array.

api/datadoghq/common/datadogpodautoscaler_types.go

@@ -155,101 +155,70 @@ func TestIsValidDatadogAgentProfile(t *testing.T) {
 			},
 		},
 	}
-	invalidFeaturesNoDDAI := &DatadogAgentProfileSpec{
-		ProfileAffinity: basicProfileAffinity,
-		Config: &v2alpha1.DatadogAgentSpec{
-			Features: &v2alpha1.DatadogFeatures{
-				GPU: &v2alpha1.GPUFeatureConfig{
-					Enabled: ptr.To(true),
-				},
-			},
-		},
-	}
-
 	testCases := []struct {
-		name                        string
-		spec                        *DatadogAgentProfileSpec
-		datadogAgentInternalEnabled bool
-		wantErr                     string
+		name    string
+		spec    *DatadogAgentProfileSpec
+		wantErr string
 	}{
 		{
-			name:                        "valid dap",
-			spec:                        valid,
-			datadogAgentInternalEnabled: true,
-		},
-		{
-			name:                        "valid dap, resources specified in one container only",
-			spec:                        validResourceOverrideInOneContainerOnly,
-			datadogAgentInternalEnabled: true,
+			name: "valid dap",
+			spec: valid,
 		},
 		{
-			name:                        "invalid component override",
-			spec:                        invalidComponentOverride,
-			datadogAgentInternalEnabled: true,
-			wantErr:                     "component node selector override is not supported",
+			name: "valid dap, resources specified in one container only",
+			spec: validResourceOverrideInOneContainerOnly,
 		},
 		{
-			name:                        "invalid container override",
-			spec:                        invalidContainerOverride,
-			datadogAgentInternalEnabled: true,
-			wantErr:                     "container command override is not supported",
+			name:    "invalid component override",
+			spec:    invalidComponentOverride,
+			wantErr: "component node selector override is not supported",
 		},
 		{
-			name:                        "missing override when ddai disabled",
-			spec:                        missingOverride,
-			datadogAgentInternalEnabled: false,
-			wantErr:                     "config override must be defined",
+			name:    "invalid container override",
+			spec:    invalidContainerOverride,
+			wantErr: "container command override is not supported",
 		},
 		{
-			name:                        "missing config",
-			spec:                        missingConfig,
-			datadogAgentInternalEnabled: true,
-			wantErr:                     "config must be defined",
+			name: "missing override is valid",
+			spec: missingOverride,
 		},
 		{
-			name:                        "missing node selector requirement",
-			spec:                        missingNSR,
-			datadogAgentInternalEnabled: true,
-			wantErr:                     "profileNodeAffinity must have at least 1 requirement",
+			name:    "missing config",
+			spec:    missingConfig,
+			wantErr: "config must be defined",
 		},
 		{
-			name:                        "missing profile node affinity",
-			spec:                        missingNodeAffinity,
-			datadogAgentInternalEnabled: true,
-			wantErr:                     "profileNodeAffinity must be defined",
+			name:    "missing node selector requirement",
+			spec:    missingNSR,
+			wantErr: "profileNodeAffinity must have at least 1 requirement",
 		},
 		{
-			name:                        "missing profile affinity",
-			spec:                        missingProfileAffinity,
-			datadogAgentInternalEnabled: true,
-			wantErr:                     "profileAffinity must be defined",
+			name:    "missing profile node affinity",
+			spec:    missingNodeAffinity,
+			wantErr: "profileNodeAffinity must be defined",
 		},
 		{
-			name:                        "gpu feature override",
-			spec:                        validGPUFeature,
-			datadogAgentInternalEnabled: true,
+			name:    "missing profile affinity",
+			spec:    missingProfileAffinity,
+			wantErr: "profileAffinity must be defined",
 		},
 		{
-			name:                        "valid dap with features only when ddai enabled",
-			spec:                        validFeaturesNoOverride,
-			datadogAgentInternalEnabled: true,
+			name: "gpu feature override",
+			spec: validGPUFeature,
 		},
 		{
-			name:                        "dap with unsupported feature when ddai enabled",
-			spec:                        invalidFeatures,
-			datadogAgentInternalEnabled: true,
-			wantErr:                     "npm override is not supported",
+			name: "valid dap with features only, no override",
+			spec: validFeaturesNoOverride,
 		},
 		{
-			name:                        "features not supported when ddai disabled",
-			spec:                        invalidFeaturesNoDDAI,
-			datadogAgentInternalEnabled: false,
-			wantErr:                     "the 'features' field is only supported when DatadogAgentInternal is enabled",
+			name:    "dap with unsupported feature",
+			spec:    invalidFeatures,
+			wantErr: "npm override is not supported",
 		},
 	}
 	for _, test := range testCases {
 		t.Run(test.name, func(t *testing.T) {
-			result := ValidateDatadogAgentProfileSpec(test.spec, test.datadogAgentInternalEnabled)
+			result := ValidateDatadogAgentProfileSpec(test.spec)
 			if test.wantErr != "" {
 				assert.EqualError(t, result, test.wantErr)
 			} else {