Distributions · Dd Agent Install Kubernetes · datadog-labs/agent-skills · Skills Docs

Distributions · Dd Agent Install Kubernetes · datadog-labs/agent-skills · Skills Docs

metadata:
  annotations:
    experimental.agent.datadoghq.com/autopilot: "true"
spec:
  override:
    nodeAgent:
      containers:
        agent:
          resources:
            requests:
              cpu: "200m"
              memory: "256Mi"
        trace-agent:
          resources:
            requests:
              cpu: "100m"
              memory: "200Mi"
        process-agent:
          resources:
            requests:
              cpu: "100m"
              memory: "200Mi"
        system-probe:
          resources:
            requests:
              cpu: "100m"
              memory: "400Mi"

spec:
  global:
    kubelet:
      tlsVerify: false
  features:
    apm:
      hostPortConfig:
        enabled: true
      unixDomainSocketConfig:
        enabled: false
    dogstatsd:
      unixDomainSocketConfig:
        enabled: false
  override:
    clusterAgent:
      serviceAccountName: datadog-agent-scc
    nodeAgent:
      serviceAccountName: datadog-agent-scc
      hostNetwork: true

REGION='<REGION>'; CLUSTER='<CLUSTER_NAME>'
for fp in $(aws eks list-fargate-profiles --region "$REGION" --cluster-name "$CLUSTER" --query 'fargateProfileNames[]' --output text); do
  aws eks describe-fargate-profile --region "$REGION" --cluster-name "$CLUSTER" --fargate-profile-name "$fp" \
    --query 'fargateProfile.[fargateProfileName,status,selectors]' --output json
done

for f in .env.local .env; do [ -f "$f" ] || continue; for k in DD_SITE DD_API_KEY DD_APP_KEY DD_CLUSTER_AGENT_TOKEN; do eval "[ -n \"\${$k:-}\" ]" && continue; v=$(grep -E "^$k=" "$f" | head -1 | cut -d= -f2- | tr -d '\r' | sed 's/^["'\'']//;s/["'\'']$//'); [ -n "$v" ] && export "$k=$v"; done; done
: "${DD_API_KEY:?not set - run dd-account-setup (commercial sites) or supply it directly (government sites)}"
WORKLOAD_NAMESPACES='<FARGATE_WORKLOAD_NAMESPACES>'   # <- e.g. 'shop payments'
case "$WORKLOAD_NAMESPACES" in *'<'*|'') echo "Set WORKLOAD_NAMESPACES to the Fargate workload namespaces - stop"; exit 1;; esac
if [ -z "${DD_CLUSTER_AGENT_TOKEN:-}" ]; then
  EXISTING_TOKEN=$(kubectl get secret datadog-secret -n datadog --ignore-not-found -o jsonpath='{.data.token}') || { echo "Could not read datadog-secret - fix cluster access and re-run"; exit 1; }
  if [ -n "$EXISTING_TOKEN" ]; then
    DD_CLUSTER_AGENT_TOKEN=$(printf '%s' "$EXISTING_TOKEN" | base64 --decode) || { echo "Could not decode the token in datadog-secret"; exit 1; }
  else
    DD_CLUSTER_AGENT_TOKEN=$(openssl rand -hex 16 2>/dev/null)
  fi
fi
case "${DD_CLUSTER_AGENT_TOKEN:-}" in ''|*[!A-Za-z0-9]*) echo "No usable cluster agent token - add DD_CLUSTER_AGENT_TOKEN to .env.local and re-run"; exit 1;; esac
[ "${#DD_CLUSTER_AGENT_TOKEN}" -ge 32 ] || { echo "DD_CLUSTER_AGENT_TOKEN must be at least 32 characters"; exit 1; }
for ns in datadog $WORKLOAD_NAMESPACES; do
  kubectl apply -f - <<EOF || { echo "Secret creation FAILED in $ns - stop"; exit 1; }
apiVersion: v1
kind: Secret
metadata:
  name: datadog-secret
  namespace: ${ns}
type: Opaque
stringData:
  api-key: "${DD_API_KEY}"
  token: "${DD_CLUSTER_AGENT_TOKEN}"
EOF
done

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: datadog-agent-fargate
rules:
  - apiGroups: [""]
    resources: ["nodes", "namespaces", "endpoints"]
    verbs: ["get", "list"]
  - apiGroups: [""]
    resources: ["nodes/metrics", "nodes/spec", "nodes/stats", "nodes/proxy", "nodes/pods", "nodes/healthz"]
    verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: datadog-agent-fargate
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: datadog-agent-fargate
subjects:
  - kind: ServiceAccount
    name: <SERVICE_ACCOUNT>
    namespace: <WORKLOAD_NAMESPACE>

spec:
  features:
    admissionController:
      agentSidecarInjection:
        profiles:
          - env:
              - name: DD_LOGS_CONFIG_CONTAINER_COLLECT_ALL
                value: "true"
  override:
    clusterAgent:
      env:
        - name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_KUBELET_API_LOGGING_ENABLED
          value: "true"

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: datadog-operator
  namespace: openshift-operators
spec:
  channel: stable
  name: datadog-operator
  source: certified-operators
  sourceNamespace: openshift-marketplace

ok=''
for i in $(seq 1 60); do
  csv=$(kubectl get subscription datadog-operator -n openshift-operators -o jsonpath='{.status.installedCSV}' 2>/dev/null)
  phase=$([ -n "$csv" ] && kubectl get csv "$csv" -n openshift-operators -o jsonpath='{.status.phase}' 2>/dev/null)
  [ "$phase" = Failed ] && { echo "Operator install FAILED (CSV $csv) - stop"; exit 1; }
  if [ "$phase" = Succeeded ] && kubectl wait --for=condition=established crd/datadogagents.datadoghq.com --timeout=10s >/dev/null 2>&1; then ok=1; break; fi
  sleep 10
done
[ -n "$ok" ] || { echo "Operator or DatadogAgent CRD not ready after 10 minutes - stop"; exit 1; }
echo "Operator $csv ready"

for f in .env.local .env; do [ -f "$f" ] || continue; for k in DD_SITE DD_API_KEY DD_APP_KEY; do eval "[ -n \"\${$k:-}\" ]" && continue; v=$(grep -E "^$k=" "$f" | head -1 | cut -d= -f2- | tr -d '\r' | sed 's/^["'\'']//;s/["'\'']$//'); [ -n "$v" ] && export "$k=$v"; done; done
: "${DD_API_KEY:?not set - run dd-account-setup (commercial sites) or supply it directly (government sites)}"
kubectl apply -f - <<EOF || { echo "Secret creation FAILED - do NOT apply datadog-agent.yaml"; exit 1; }
apiVersion: v1
kind: Secret
metadata:
  name: datadog-secret
  namespace: openshift-operators
type: Opaque
stringData:
  api-key: "${DD_API_KEY}"
EOF
kubectl apply -n openshift-operators -f datadog-agent.yaml

datadog:
  kubelet:
    useApiServer: true
  apm:
    portEnabled: true
    socketEnabled: false
agents:
  priorityClassCreate: true
  containers:
    agent:
      resources:
        requests:
          cpu: 200m
          memory: 256Mi
    traceAgent:
      resources:
        requests:
          cpu: 100m
          memory: 200Mi
    processAgent:
      resources:
        requests:
          cpu: 100m
          memory: 200Mi
    systemProbe:
      resources:
        requests:
          cpu: 100m
          memory: 400Mi
providers:
  gke:
    autopilot: true

datadog:
  kubelet:
    tlsVerify: false
  apm:
    portEnabled: true
    socketEnabled: false
agents:
  useHostNetwork: true
  podSecurity:
    securityContextConstraints:
      create: true
clusterAgent:
  podSecurity:
    securityContextConstraints:
      create: true

clusterAgent:
  env:
    - name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_KUBELET_API_LOGGING_ENABLED
      value: "true"
  admissionController:
    agentSidecarInjection:
      profiles:
        - env:
            - name: DD_LOGS_CONFIG_CONTAINER_COLLECT_ALL
              value: "true"