[profiles] Add apm feature override

[khewonc]

What does this PR do?

Add APM feature overrides for profiles

Motivation

What inspired you to submit this pull request?

Additional Notes

Anything else we should know when reviewing?

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

• Agent: vX.Y.Z
• Cluster Agent: vX.Y.Z

Describe your test plan

Enable profiles in the operator by setting datadogAgentProfile.enabled=true and datadogCRDs.crds.datadogAgentProfiles=true in the operator helm chart

1. SSI profile on base APM disabled

Base DDA

apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: qa-dda
spec:
  features:
    admissionController:
      enabled: true
    apm:
      enabled: false

DAP

apiVersion: datadoghq.com/v1alpha1
kind: DatadogAgentProfile
metadata:
  name: qa-ssi-profile
spec:
  profileAffinity:
    profileNodeAffinity:
      - key: dap-qa
        operator: In
        values: ["enabled"]
  config:
    features:
      apm:
        instrumentation:
          enabled: true

Apply both and check:

kubectl describe datadogagentprofile qa-ssi-profile

Expected describe output should include:

Status:
  Applied:  True
  Conditions:
    Message:  DatadogAgentProfile applied
    Reason:   Applied
    Status:   True
    Type:     Applied

Also check rendered config:

kubectl get deploy -o yaml | grep DD_APM_INSTRUMENTATION_ENABLED -A2
kubectl get ds -o yaml | grep DD_APM_ENABLED -A2

Expected: Cluster Agent has SSI enabled, default node Agent does not enable node APM.

2. APM-Only Profile Does Not Need SSI Prereqs

Disable admission on the base DDA:

kubectl patch datadogagent qa-dda --type merge \
  -p '{"spec":{"features":{"admissionController":{"enabled":false},"apm":{"enabled":false}}}}'

DAP:

apiVersion: datadoghq.com/v1alpha1
kind: DatadogAgentProfile
metadata:
  name: qa-apm-only-profile
spec:
  profileAffinity:
    profileNodeAffinity:
      - key: dap-qa
        operator: In
        values: ["enabled"]
  config:
    features:
      apm:
        enabled: true

Check:

kubectl describe datadogagentprofile qa-apm-only-profile

Expected describe output should include:

Status:
  Applied:  True
  Conditions:
    Message:  DatadogAgentProfile applied
    Reason:   Applied
    Status:   True
    Type:     Applied

Also check rendered config:

kubectl get ds -o yaml | grep DD_APM_ENABLED -A2

Expected: profile DaemonSet has node APM config.

3. SSI Profile Rejects When Shared Path Is Unavailable

Keep admission disabled, then apply:

apiVersion: datadoghq.com/v1alpha1
kind: DatadogAgentProfile
metadata:
  name: qa-ssi-reject-profile
spec:
  profileAffinity:
    profileNodeAffinity:
      - key: dap-qa
        operator: In
        values: ["enabled"]
  config:
    features:
      apm:
        instrumentation:
          enabled: true

Check:

kubectl describe datadogagentprofile qa-ssi-reject-profile

Expected describe output should include:

Status:
  Applied:  False
  Conditions:
    Message:  features.admissionController.enabled must be true on the base DatadogAgent when APM instrumentation is configured
    Reason:   Conflict
    Status:   False
    Type:     Applied

Optional Cluster Agent variant:

kubectl patch datadogagent qa-dda --type merge \
  -p '{"spec":{"features":{"admissionController":{"enabled":true}},"override":{"clusterAgent":{"disabled":true}}}}'

Expected describe output should include:

Status:
  Applied:  False
  Conditions:
    Message:  clusterAgent cannot be disabled on the base DatadogAgent when APM instrumentation is configured
    Reason:   Conflict
    Status:   False
    Type:     Applied

Checklist

• PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
• PR has a milestone or the qa/skip-qa label
• All commits are signed (see: signing commits)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 67.28625% with 88 lines in your changes missing coverage. Please review.
✅ Project coverage is 44.64%. Comparing base (bd0f5e2) to head (b459861).
⚠️ Report is 23 commits behind head on main.

Files with missing lines	Patch %	Lines
...nal/controller/datadogagent/feature/apm/feature.go	40.21%	47 Missing and 8 partials ⚠️
...controller/datadogagent/feature/profile_overlay.go	0.00%	14 Missing ⚠️
pkg/agentprofile/agent_profile.go	0.00%	10 Missing ⚠️
...roller/datadogagent/feature/apm/profile_overlay.go	92.74%	5 Missing and 4 partials ⚠️

❌ Your patch status has failed because the patch coverage (67.28%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3073      +/-   ##
==========================================
+ Coverage   42.90%   44.64%   +1.74%     
==========================================
  Files         341      354      +13     
  Lines       29403    31164    +1761     
==========================================
+ Hits        12614    13913    +1299     
- Misses      15965    16348     +383     
- Partials      824      903      +79     

Flag	Coverage Δ
unittests	44.64% <67.28%> (+1.74%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...controller/datadogagent/controller_reconcile_v2.go	53.00% <100.00%> (+0.47%)	⬆️
internal/controller/datadogagent/profile.go	78.63% <100.00%> (+6.02%)	⬆️
...roller/datadogagent/feature/apm/profile_overlay.go	92.74% <92.74%> (ø)
pkg/agentprofile/agent_profile.go	72.52% <0.00%> (-1.85%)	⬇️
...controller/datadogagent/feature/profile_overlay.go	0.00% <0.00%> (ø)
...nal/controller/datadogagent/feature/apm/feature.go	69.96% <40.21%> (-0.82%)	⬇️

... and 35 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bd0f5e2...b459861. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[datadog-datadog-prod-us1]

 

✨ Fix all issues with BitsAI

🛑 Gate Violations

🎯 1 Code Coverage issue detected

A Patch coverage percentage gate may be blocking this PR.

• Patch coverage: 65.71% (threshold: 80.00%)

⚠️ Warnings

🚦 1 Pipeline job failed

DataDog/datadog-operator | build     

ℹ️ Info

🎯 Code Coverage (details)
• Patch Coverage: 65.71%
• Overall Coverage: 44.91% (+1.14%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: b459861 | Docs | Datadog PR Page | Give us feedback!}