cluster-agent-deployment.yaml

{{- template "check-dca-version" . }}
{{- if eq (include "should-deploy-cluster-agent" .) "true" }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "datadog.fullname" . }}-cluster-agent
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "datadog.labels" . | indent 4 }}
    app.kubernetes.io/component: cluster-agent
    {{- if .Values.clusterAgent.additionalLabels }}
{{ toYaml .Values.clusterAgent.additionalLabels | indent 4 }}
    {{- end }}
{{ include "provider-labels" . | indent 4 }}
  {{- if .Values.clusterAgent.deploymentAnnotations }}
  annotations: {{ toYaml .Values.clusterAgent.deploymentAnnotations | nindent 4 }}
  {{- end }}
spec:
  replicas: {{ .Values.clusterAgent.replicas }}
  revisionHistoryLimit: {{ .Values.clusterAgent.revisionHistoryLimit }}
  strategy:
{{- if .Values.clusterAgent.strategy }}
{{ toYaml .Values.clusterAgent.strategy | indent 4 }}
{{- else }}
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
{{- end }}
  selector:
    matchLabels:
      app: {{ template "datadog.fullname" . }}-cluster-agent
        {{- if .Values.clusterAgent.podLabels }}
{{ toYaml .Values.clusterAgent.podLabels | indent 6 }}
        {{- end }}
  template:
    metadata:
      labels:
{{ include "datadog.template-labels" . | indent 8 }}
        app.kubernetes.io/component: cluster-agent
        admission.datadoghq.com/enabled: "false"
        app: {{ template "datadog.fullname" . }}-cluster-agent
        {{- if .Values.clusterAgent.podLabels }}
{{ toYaml .Values.clusterAgent.podLabels | indent 8 }}
        {{- end }}
        {{- if .Values.clusterAgent.additionalLabels }}
{{ toYaml .Values.clusterAgent.additionalLabels | indent 8 }}
        {{- end }}
{{ include "provider-labels" . | indent 8 }}
      name: {{ template "datadog.fullname" . }}-cluster-agent
      annotations:
        checksum/clusteragent_token: {{ include (print $.Template.BasePath "/secret-cluster-agent-token.yaml") . | sha256sum }}
        checksum/clusteragent-configmap: {{ include (print $.Template.BasePath "/cluster-agent-confd-configmap.yaml") . | sha256sum }}
        {{- if not .Values.datadog.apiKeyExistingSecret }}
        checksum/api_key: {{ include (print $.Template.BasePath "/secret-api-key.yaml") . | sha256sum }}
        {{- end }}
        {{- if not .Values.datadog.appKeyExistingSecret }}
        checksum/application_key: {{ include (print $.Template.BasePath "/secret-application-key.yaml") . | sha256sum }}
        {{- end }}
        checksum/install_info: {{ printf "%s-%s" .Chart.Name .Chart.Version | sha256sum }}
        {{- if .Values.clusterAgent.datadog_cluster_yaml }}
        checksum/clusteragent-config: {{ tpl (toYaml .Values.clusterAgent.datadog_cluster_yaml) . | sha256sum }}
        {{- end }}
        {{- if .Values.clusterAgent.confd }}
        checksum/confd-config: {{ tpl (toYaml .Values.clusterAgent.confd) . | sha256sum }}
        {{- end }}
      {{- if .Values.clusterAgent.podAnnotations }}
{{ tpl (toYaml .Values.clusterAgent.podAnnotations) . | indent 8 }}
      {{- end }}
    spec:
      {{- if .Values.clusterAgent.shareProcessNamespace }}
      shareProcessNamespace: {{ .Values.clusterAgent.shareProcessNamespace }}
      {{- end }}
      {{- if .Values.clusterAgent.priorityClassName }}
      priorityClassName: "{{ .Values.clusterAgent.priorityClassName }}"
      {{- end }}
      {{- if .Values.clusterAgent.image.pullSecrets }}
      imagePullSecrets:
{{ toYaml .Values.clusterAgent.image.pullSecrets | indent 8 }}
      {{- end }}
      serviceAccountName: {{ if .Values.clusterAgent.rbac.create }}{{ template "datadog.fullname" . }}-cluster-agent{{ else }}"{{ .Values.clusterAgent.rbac.serviceAccountName }}"{{ end }}
      {{- if .Values.clusterAgent.rbac.create  }}
      automountServiceAccountToken: {{ .Values.clusterAgent.rbac.automountServiceAccountToken }}
      {{- end }}
      {{- if .Values.clusterAgent.useHostNetwork }}
      hostNetwork: {{ .Values.clusterAgent.useHostNetwork }}
      dnsPolicy: ClusterFirstWithHostNet
      {{- end }}
      {{- if .Values.clusterAgent.dnsConfig }}
      dnsConfig:
{{ toYaml .Values.clusterAgent.dnsConfig | indent 8 }}
      {{- end }}
      {{- if .Values.clusterAgent.securityContext }}
      securityContext:
        {{ toYaml .Values.clusterAgent.securityContext | nindent 8 }}
      {{- end }}
      initContainers:
      - name: init-volume
        image: "{{ include "image-path" (dict "root" .Values "image" .Values.clusterAgent.image) }}"
{{- if .Values.clusterAgent.containers.initContainers.securityContext }}
        securityContext:
{{ toYaml .Values.clusterAgent.containers.initContainers.securityContext | indent 10 }}
{{- end }}
{{- if .Values.clusterAgent.containers.initContainers.resources }}
        resources:
{{ toYaml .Values.clusterAgent.containers.initContainers.resources | indent 10 }}
{{- end }}
        imagePullPolicy: {{ .Values.clusterAgent.image.pullPolicy }}
        command:
          - cp
          - -r
        args:
          - /etc/datadog-agent
          - /opt
        volumeMounts:
          - name: config
            mountPath: /opt/datadog-agent
      containers:
        {{- if eq  (include "should-enable-fips" .) "true" }}
          {{- include "fips-proxy" . | nindent 6 }}
        {{- end }}
      - name: cluster-agent
        image: "{{ include "image-path" (dict "root" .Values "image" .Values.clusterAgent.image) }}"
        {{- with .Values.clusterAgent.command }}
        command: {{ range . }}
          - {{ . | quote }}
        {{- end }}
        {{- end }}
        imagePullPolicy: {{ .Values.clusterAgent.image.pullPolicy }}
        resources:
{{ toYaml .Values.clusterAgent.resources | indent 10 }}
        ports:
        - containerPort: 5005
          name: agentport
          protocol: TCP
        - containerPort: 5000
          name: agentmetrics
          protocol: TCP
        {{- if .Values.clusterAgent.metricsProvider.enabled }}
        - containerPort: {{ template "clusterAgent.metricsProvider.port" . }}
          name: metricsapi
          protocol: TCP
        {{- end }}
        {{- if .Values.clusterAgent.admissionController.enabled }}
        - containerPort: {{ .Values.clusterAgent.admissionController.port }}
          name: datadog-webhook
          protocol: TCP
        {{- end }}
{{- if or .Values.datadog.envFrom .Values.clusterAgent.envFrom }}
        envFrom:
{{- if .Values.datadog.envFrom }}
{{ .Values.datadog.envFrom | toYaml | indent 10 }}
{{- end }}
{{- if .Values.clusterAgent.envFrom }}
{{ .Values.clusterAgent.envFrom | toYaml | indent 10 }}
{{- end }}
{{- end }}
        env:
          - name: DD_POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: DD_CLUSTER_AGENT_SERVICE_ACCOUNT_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.serviceAccountName
          - name: DD_HEALTH_PORT
          {{- $healthPort := .Values.clusterAgent.healthPort }}
            value: {{ $healthPort | quote }}
          - name: DD_API_KEY
            valueFrom:
              secretKeyRef:
                name: {{ template "datadog.apiSecretName" . }}
                key: api-key
                optional: true
          {{- include "components-common-env" . | nindent 10 }}
          {{- include "language-detection-common-env" . | nindent 10 }}
          {{- if .Values.clusterAgent.metricsProvider.enabled }}
          - name: DD_APP_KEY
            valueFrom:
              secretKeyRef:
                name: {{ template "datadog.appKeySecretName" . }}
                key: app-key
          - name: DD_EXTERNAL_METRICS_PROVIDER_ENABLED
            value: {{ .Values.clusterAgent.metricsProvider.enabled | quote }}
          - name: DD_EXTERNAL_METRICS_PROVIDER_PORT
            value: {{ include "clusterAgent.metricsProvider.port" . | quote }}
          - name: DD_EXTERNAL_METRICS_PROVIDER_WPA_CONTROLLER
            value: {{ .Values.clusterAgent.metricsProvider.wpaController | quote }}
          - name: DD_EXTERNAL_METRICS_PROVIDER_USE_DATADOGMETRIC_CRD
            value: {{ .Values.clusterAgent.metricsProvider.useDatadogMetrics | quote }}
          {{- if .Values.clusterAgent.metricsProvider.endpoint }}
          - name: DD_EXTERNAL_METRICS_PROVIDER_ENDPOINT
            value: {{ .Values.clusterAgent.metricsProvider.endpoint | quote }}
          {{- end }}
          {{- if .Values.clusterAgent.containerInclude }}
          - name: DD_CONTAINER_INCLUDE
            value: {{ .Values.clusterAgent.containerInclude | quote }}
          {{- end }}
          {{- if .Values.clusterAgent.containerExclude }}
          - name: DD_CONTAINER_EXCLUDE
            value: {{ .Values.clusterAgent.containerExclude | quote }}
          {{- end }}
          - name: DD_EXTERNAL_METRICS_AGGREGATOR
            value: {{ .Values.clusterAgent.metricsProvider.aggregator | quote }}
          {{- end }}
          {{- if .Values.clusterAgent.admissionController.enabled }}
          - name: DD_ADMISSION_CONTROLLER_ENABLED
            value: {{ .Values.clusterAgent.admissionController.enabled | quote }}
          - name: DD_ADMISSION_CONTROLLER_VALIDATION_ENABLED
            value: {{ .Values.clusterAgent.admissionController.validation.enabled | quote }}
          - name: DD_ADMISSION_CONTROLLER_MUTATION_ENABLED
            value: {{ .Values.clusterAgent.admissionController.mutation.enabled | quote }}
          - name: DD_ADMISSION_CONTROLLER_WEBHOOK_NAME
            value: {{ .Values.clusterAgent.admissionController.webhookName | quote }}
          - name: DD_ADMISSION_CONTROLLER_MUTATE_UNLABELLED
            value: {{ .Values.clusterAgent.admissionController.mutateUnlabelled | quote }}
          - name: DD_ADMISSION_CONTROLLER_SERVICE_NAME
            value: {{ template "datadog.fullname" . }}-cluster-agent-admission-controller
          - name: DD_ADMISSION_CONTROLLER_INJECT_CONFIG_MODE
            {{- if .Values.clusterAgent.admissionController.configMode }}
            value: {{ .Values.clusterAgent.admissionController.configMode }}
            {{- else if eq (include "trace-agent-use-uds" .) "true" }}
            value: socket
            {{- else if or (eq (include "trace-agent-use-host-port" .) "true") ( .Values.providers.gke.autopilot )}}
            value: hostip
            {{- else if (eq (include "trace-agent-use-local-service" .) "true")}}
            value: service
            {{- else if or (not .Values.datadog.apm.enabled ) (and (eq (include "trace-agent-use-tcp-port" .) "true") (eq (include "trace-agent-use-uds" .) "true")) }}
            value: socket
            {{- else }}
            value: {{ .Values.clusterAgent.admissionController.configMode | quote }}
            {{- end }}
          - name: DD_ADMISSION_CONTROLLER_INJECT_CONFIG_LOCAL_SERVICE_NAME
            value: {{ template "localService.name" . }}
          {{- if .Values.providers.aks.enabled }}
          - name: DD_ADMISSION_CONTROLLER_ADD_AKS_SELECTORS
            value: "true"
          {{- end }}
          - name: DD_ADMISSION_CONTROLLER_FAILURE_POLICY
            value: {{ .Values.clusterAgent.admissionController.failurePolicy | quote }}
          - name: DD_ADMISSION_CONTROLLER_PORT
            value: {{ .Values.clusterAgent.admissionController.port | quote }}
          {{- end }}
          {{- if .Values.clusterAgent.admissionController.remoteInstrumentation.enabled }}
          - name: DD_ADMISSION_CONTROLLER_AUTO_INSTRUMENTATION_PATCHER_ENABLED
            value: "true"
          {{- end }}
          - name: DD_ADMISSION_CONTROLLER_CONTAINER_REGISTRY
          {{- if .Values.clusterAgent.admissionController.containerRegistry }}
            value: {{ .Values.clusterAgent.admissionController.containerRegistry | quote }}
          {{- else }}
            value: {{ include "registry" .Values | quote }}
          {{- end }}
          {{- if .Values.clusterAgent.admissionController.cwsInstrumentation.enabled }}
          - name: DD_ADMISSION_CONTROLLER_CWS_INSTRUMENTATION_ENABLED
            value: "true"
          - name: DD_ADMISSION_CONTROLLER_CWS_INSTRUMENTATION_MODE
            value: {{ .Values.clusterAgent.admissionController.cwsInstrumentation.mode | quote }}
          {{- end }}
          {{ include "ac-agent-sidecar-env" . | nindent 10 }}
          - name: DD_REMOTE_CONFIGURATION_ENABLED
            value: {{ include "clusterAgent-remoteConfiguration-enabled" . | quote }}
          {{- if .Values.datadog.apm.instrumentation.enabled }}
          - name: DD_APM_INSTRUMENTATION_ENABLED
            value: {{ .Values.datadog.apm.instrumentation.enabled | quote }}
          {{- end }}
          {{- if .Values.datadog.apm.instrumentation.enabledNamespaces }}
          - name: DD_APM_INSTRUMENTATION_ENABLED_NAMESPACES
            value: {{ .Values.datadog.apm.instrumentation.enabledNamespaces | toJson | quote }}
          {{- end }}
          {{- if .Values.datadog.apm.instrumentation.disabledNamespaces }}
          - name: DD_APM_INSTRUMENTATION_DISABLED_NAMESPACES
            value: {{ .Values.datadog.apm.instrumentation.disabledNamespaces | toJson | quote }}
          {{- end }}
          {{- if .Values.datadog.apm.instrumentation.libVersions }}
          - name: DD_APM_INSTRUMENTATION_LIB_VERSIONS
            value: {{ .Values.datadog.apm.instrumentation.libVersions | toJson | quote }}
          {{- end }}
          {{- if .Values.datadog.asm.threats.enabled }}
          - name: DD_ADMISSION_CONTROLLER_AUTO_INSTRUMENTATION_APPSEC_ENABLED
            value: "true"
          {{- end }}
          {{- if .Values.datadog.asm.sca.enabled }}
          - name: DD_ADMISSION_CONTROLLER_AUTO_INSTRUMENTATION_APPSEC_SCA_ENABLED
            value: "true"
          {{- end }}
          {{- if .Values.datadog.asm.iast.enabled }}
          - name: DD_ADMISSION_CONTROLLER_AUTO_INSTRUMENTATION_IAST_ENABLED
            value: "true"
          {{- end }}
          {{- if not (eq .Values.datadog.profiling.enabled nil) }}
          - name: DD_ADMISSION_CONTROLLER_AUTO_INSTRUMENTATION_PROFILING_ENABLED
            value: {{ .Values.datadog.profiling.enabled | quote }}
          {{- end }}
          {{- if .Values.datadog.clusterChecks.enabled }}
          - name: DD_CLUSTER_CHECKS_ENABLED
            value: {{ .Values.datadog.clusterChecks.enabled | quote }}
          - name: DD_EXTRA_CONFIG_PROVIDERS
            value: "kube_endpoints kube_services"
          - name: DD_EXTRA_LISTENERS
            value: "kube_endpoints kube_services"
          {{- end }}
          {{- if .Values.datadog.logLevel }}
          - name: DD_LOG_LEVEL
            value: {{ .Values.datadog.logLevel | quote }}
          {{- end }}
          - name: DD_LEADER_ELECTION
            value: {{ .Values.datadog.leaderElection | quote}}
          - name: DD_LEADER_ELECTION_DEFAULT_RESOURCE
            value: {{ .Values.datadog.leaderElectionResource | quote}}
          {{- if .Values.datadog.leaderLeaseDuration }}
          - name: DD_LEADER_LEASE_DURATION
            value: {{ .Values.datadog.leaderLeaseDuration | quote }}
          {{- else if (eq (include "should-enable-cluster-check-workers" .) "true") }}
          - name: DD_LEADER_LEASE_DURATION
            value: "15"
          {{- end }}
          - name: DD_LEADER_LEASE_NAME
            value: {{ template "datadog.fullname" . }}-leader-election
          - name: DD_CLUSTER_AGENT_TOKEN_NAME
            value: {{ template "datadog.fullname" . }}token
          {{- if .Values.datadog.collectEvents }}
          - name: DD_COLLECT_KUBERNETES_EVENTS
            value: {{ .Values.datadog.collectEvents | quote }}
          {{- end }}
          - name: DD_KUBERNETES_EVENTS_SOURCE_DETECTION_ENABLED
            value: {{ .Values.datadog.kubernetesEvents.sourceDetectionEnabled | quote }}
          - name: DD_CLUSTER_AGENT_KUBERNETES_SERVICE_NAME
            value: {{ template "datadog.fullname" . }}-cluster-agent
          - name: DD_CLUSTER_AGENT_AUTH_TOKEN
            valueFrom:
              secretKeyRef:
                name: {{ template "clusterAgent.tokenSecretName" . }}
                key: token
          - name: DD_CLUSTER_AGENT_COLLECT_KUBERNETES_TAGS
            value: {{ .Values.datadog.clusterTagger.collectKubernetesTags | quote }}
          - name: DD_KUBE_RESOURCES_NAMESPACE
            value: {{ .Release.Namespace }}
          - name: CHART_RELEASE_NAME
            value: {{ .Release.Name | quote }}
          - name: AGENT_DAEMONSET
            value: {{ template "datadog.fullname" . }}
          - name: CLUSTER_AGENT_DEPLOYMENT
            value: {{ template "datadog.fullname" . }}-cluster-agent
          - name: DD_ORCHESTRATOR_EXPLORER_ENABLED
            value: {{ (include "should-enable-k8s-resource-monitoring" .) | quote }}
          {{- if eq (include "should-enable-k8s-resource-monitoring" .) "true" }}
          - name: DD_ORCHESTRATOR_EXPLORER_CONTAINER_SCRUBBING_ENABLED
            value: {{ .Values.datadog.orchestratorExplorer.container_scrubbing.enabled | quote }}
          {{- end }}
          - name: DD_CLUSTER_AGENT_LANGUAGE_DETECTION_PATCHER_ENABLED
            value: {{ include "language-detection-enabled" .  | quote }}
          {{- if eq  (include "should-enable-security-agent" .) "true" }}
          - name: DD_COMPLIANCE_CONFIG_ENABLED
            value:  {{ .Values.datadog.securityAgent.compliance.enabled | quote }}
          {{- if .Values.datadog.securityAgent.compliance.enabled }}
          - name: DD_COMPLIANCE_CONFIG_CHECK_INTERVAL
            value: {{ .Values.datadog.securityAgent.compliance.checkInterval | quote }}
          {{- end }}
          {{- end }}
          {{- if .Values.datadog.prometheusScrape.enabled }}
          - name: DD_PROMETHEUS_SCRAPE_ENABLED
            value: "true"
          - name: DD_PROMETHEUS_SCRAPE_SERVICE_ENDPOINTS
            value: {{ .Values.datadog.prometheusScrape.serviceEndpoints | quote }}
          {{- if .Values.datadog.prometheusScrape.additionalConfigs }}
          - name: DD_PROMETHEUS_SCRAPE_CHECKS
            value: {{ .Values.datadog.prometheusScrape.additionalConfigs | toJson | quote }}
          {{- end }}
          {{- if .Values.datadog.prometheusScrape.version }}
          - name: DD_PROMETHEUS_SCRAPE_VERSION
            value: {{ .Values.datadog.prometheusScrape.version | quote }}
          {{- end }}
          {{- end }}
          {{- if (((.Values.datadog.autoscaling).workload).enabled) }}
          - name: DD_AUTOSCALING_WORKLOAD_ENABLED
            value: {{ (((.Values.datadog.autoscaling).workload).enabled) | quote }}
          {{- end }}
          - name: DD_INSTRUMENTATION_INSTALL_TIME
            valueFrom:
              configMapKeyRef:
                name: {{ template "datadog.fullname" . }}-kpi-telemetry-configmap
                key: install_time
          - name: DD_INSTRUMENTATION_INSTALL_ID
            valueFrom:
              configMapKeyRef:
                name: {{ template "datadog.fullname" . }}-kpi-telemetry-configmap
                key: install_id
          - name: DD_INSTRUMENTATION_INSTALL_TYPE
            valueFrom:
              configMapKeyRef:
                name: {{ template "datadog.fullname" . }}-kpi-telemetry-configmap
                key: install_type
          {{- include "fips-envvar" . | nindent 10 }}
          {{- include "additional-env-entries" .Values.clusterAgent.env | indent 10 }}
          {{- include "additional-env-dict-entries" .Values.clusterAgent.envDict | indent 10 }}
        livenessProbe:
{{- $live := .Values.clusterAgent.livenessProbe }}
{{ include "probe.http" (dict "path" "/live" "port" $healthPort "settings" $live) | indent 10 }}
        readinessProbe:
{{- $ready := .Values.clusterAgent.readinessProbe }}
{{ include "probe.http" (dict "path" "/ready" "port" $healthPort "settings" $ready) | indent 10 }}
        startupProbe:
{{- $startup := .Values.clusterAgent.startupProbe }}
{{ include "probe.http" (dict "path" "/startup" "port" $healthPort "settings" $startup) | indent 10 }}
{{- if .Values.clusterAgent.containers.clusterAgent.securityContext }}
        securityContext:
{{ toYaml .Values.clusterAgent.containers.clusterAgent.securityContext | indent 10 }}
{{- end }}
        volumeMounts:
          - name: datadogrun
            mountPath: /opt/datadog-agent/run
            readOnly: false
          - name: varlog
            mountPath: /var/log/datadog
            readOnly: false
          - name: tmpdir
            mountPath: /tmp
            readOnly: false
          - name: installinfo
            subPath: install_info
            {{- if eq .Values.targetSystem "windows" }}
            mountPath: C:/ProgramData/Datadog/install_info
            {{- else }}
            mountPath: /etc/datadog-agent/install_info
            {{- end }}
            readOnly: true
{{- if .Values.clusterAgent.volumeMounts }}
{{ toYaml .Values.clusterAgent.volumeMounts | indent 10 }}
{{- end }}
{{- if eq (include "need-cluster-agent-confd" .) "true" }}
          - name: confd
            mountPath: /conf.d
            readOnly: true
{{- end }}
{{- if .Values.clusterAgent.datadog_cluster_yaml }}
          - name: cluster-agent-yaml
            mountPath: /etc/datadog-agent/datadog-cluster.yaml
            subPath: datadog-cluster.yaml
            readOnly: true
{{- end}}
{{- if eq  (include "should-enable-security-agent" .) "true" }}
{{- if and .Values.datadog.securityAgent.compliance.enabled .Values.datadog.securityAgent.compliance.configMap }}
          - name: complianceconfigdir
            mountPath: /etc/datadog-agent/compliance.d
            readOnly: true
{{- end}}
{{- end}}
          - name: config
            mountPath: /etc/datadog-agent
      volumes:
        - name: datadogrun
          emptyDir: {}
        - name: varlog
          emptyDir: {}
        - name: tmpdir
          emptyDir: {}
        - name: installinfo
          configMap:
            name: {{ include "agents-install-info-configmap-name" . }}
{{- if eq (include "need-cluster-agent-confd" .) "true" }}
        - name: confd
          configMap:
            name: {{ template "datadog.fullname" . }}-cluster-agent-confd
            items:
{{- range $file, $configs := $.Values.clusterAgent.confd }}
            - key: {{ $file | quote }}
              path: {{ $file | quote }}
{{- end }}
{{- if .Values.datadog.kubeStateMetricsCore.enabled }}
            - key: kubernetes_state_core.yaml.default
              path: kubernetes_state_core.yaml.default
{{- end }}
{{- if .Values.datadog.helmCheck.enabled }}
            - key: helm.yaml
              path: helm.yaml
{{- end }}
{{- if .Values.datadog.collectEvents }}
            - key: kubernetes_apiserver.yaml
              path: kubernetes_apiserver.yaml
{{- end }}
{{- if .Values.datadog.orchestratorExplorer.enabled }}
{{- if eq (include "orchestratorExplorer-add-crd-collection-config" .) "true" }}
            - key: orchestrator.yaml
              path: orchestrator.yaml
{{- end }}
{{- end }}
{{- range $integration, $configs := $.Values.clusterAgent.advancedConfd }}
{{- range $name, $config := $configs }}
            - key: {{ printf "%s--%s" $integration $name | quote }}
              path: {{ printf "%s/%s" $integration $name | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.clusterAgent.datadog_cluster_yaml }}
        - name: cluster-agent-yaml
          configMap:
            name: {{ template "datadog.fullname" . }}-cluster-agent-config
{{- end}}
{{- if eq  (include "should-enable-security-agent" .) "true" }}
{{- if  and .Values.datadog.securityAgent.compliance.enabled .Values.datadog.securityAgent.compliance.configMap }}
        - name: complianceconfigdir
          configMap:
            name: {{ .Values.datadog.securityAgent.compliance.configMap }}
{{- end}}
{{- end}}
        - name: config
          emptyDir: {}
{{- if eq (include "should-mount-fips-configmap" .) "true"}}
{{ include "linux-container-fips-proxy-cfg-volume" . | indent 8}}
{{- end }}
{{- if .Values.clusterAgent.volumes }}
{{ toYaml .Values.clusterAgent.volumes | indent 8 }}
{{- end }}
      {{- if .Values.clusterAgent.tolerations }}
      tolerations:
{{ toYaml .Values.clusterAgent.tolerations | indent 8 }}
      {{- end }}
      affinity:
{{- if .Values.clusterAgent.affinity }}
{{ toYaml .Values.clusterAgent.affinity | indent 8 }}
{{- else }}
        # Prefer scheduling the cluster agents on different nodes
        # to guarantee that the standby instance can immediately take the lead from a leader running of a faulty node.
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 50
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: {{ template "datadog.fullname" . }}-cluster-agent
              topologyKey: kubernetes.io/hostname
{{- end }}
      nodeSelector:
        {{ template "label.os" . }}: {{ .Values.targetSystem }}
      {{- if .Values.clusterAgent.nodeSelector }}
{{ toYaml .Values.clusterAgent.nodeSelector | indent 8 }}
      {{- end }}
      {{- with .Values.clusterAgent.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
      {{- end }}
{{ end }}