discovery: add system-probe-lite support

Yumasi · Yumasi · commit 515532045dab · 2026-03-25T15:14:09.000+01:00
diff --git a/api/datadoghq/v2alpha1/datadogagent_types.go b/api/datadoghq/v2alpha1/datadogagent_types.go
@@ -647,6 +647,14 @@ type ServiceDiscoveryFeatureConfig struct {
 	// +optional
 	Enabled *bool `json:"enabled,omitempty"`
 
+	// EnabledByDefault is set by the operator when it enables this feature via default configuration,
+	// as opposed to an explicit user choice. When true, the system-probe binary is not used as a
+	// fallback if system-probe-lite is unavailable — the container falls back to sleep infinity
+	// instead, to avoid unexpected resource usage on older agent images.
+	// This field is managed by the operator and should not be set by users.
+	// +optional
+	EnabledByDefault *bool `json:"enabledByDefault,omitempty"`
+
 	// Enables the service discovery network stats collection.
 	// Default: true
 	// +optional
diff --git a/api/datadoghq/v2alpha1/zz_generated.deepcopy.go b/api/datadoghq/v2alpha1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentinternals.yaml b/config/crd/bases/v1/datadoghq.com_datadogagentinternals.yaml
@@ -2488,6 +2488,14 @@ spec:
                             Enables the service discovery check.
                             Default: false
                           type: boolean
+                        enabledByDefault:
+                          description: |-
+                            EnabledByDefault is set by the operator when it enables this feature via default configuration,
+                            as opposed to an explicit user choice. When true, the system-probe binary is not used as a
+                            fallback if system-probe-lite is unavailable — the container falls back to sleep infinity
+                            instead, to avoid unexpected resource usage on older agent images.
+                            This field is managed by the operator and should not be set by users.
+                          type: boolean
                         networkStats:
                           description: |-
                             Enables the service discovery network stats collection.
@@ -10909,6 +10917,14 @@ spec:
                                 Enables the service discovery check.
                                 Default: false
                               type: boolean
+                            enabledByDefault:
+                              description: |-
+                                EnabledByDefault is set by the operator when it enables this feature via default configuration,
+                                as opposed to an explicit user choice. When true, the system-probe binary is not used as a
+                                fallback if system-probe-lite is unavailable — the container falls back to sleep infinity
+                                instead, to avoid unexpected resource usage on older agent images.
+                                This field is managed by the operator and should not be set by users.
+                              type: boolean
                             networkStats:
                               description: |-
                                 Enables the service discovery network stats collection.
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentinternals_v1alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagentinternals_v1alpha1.json
@@ -2588,6 +2588,10 @@
                   "description": "Enables the service discovery check.\nDefault: false",
                   "type": "boolean"
                 },
+                "enabledByDefault": {
+                  "description": "EnabledByDefault is set by the operator when it enables this feature via default configuration,\nas opposed to an explicit user choice. When true, the system-probe binary is not used as a\nfallback if system-probe-lite is unavailable — the container falls back to sleep infinity\ninstead, to avoid unexpected resource usage on older agent images.\nThis field is managed by the operator and should not be set by users.",
+                  "type": "boolean"
+                },
                 "networkStats": {
                   "additionalProperties": false,
                   "description": "Enables the service discovery network stats collection.\nDefault: true",
@@ -10742,6 +10746,10 @@
                       "description": "Enables the service discovery check.\nDefault: false",
                       "type": "boolean"
                     },
+                    "enabledByDefault": {
+                      "description": "EnabledByDefault is set by the operator when it enables this feature via default configuration,\nas opposed to an explicit user choice. When true, the system-probe binary is not used as a\nfallback if system-probe-lite is unavailable — the container falls back to sleep infinity\ninstead, to avoid unexpected resource usage on older agent images.\nThis field is managed by the operator and should not be set by users.",
+                      "type": "boolean"
+                    },
                     "networkStats": {
                       "additionalProperties": false,
                       "description": "Enables the service discovery network stats collection.\nDefault: true",
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentprofiles.yaml b/config/crd/bases/v1/datadoghq.com_datadogagentprofiles.yaml
@@ -2488,6 +2488,14 @@ spec:
                                 Enables the service discovery check.
                                 Default: false
                               type: boolean
+                            enabledByDefault:
+                              description: |-
+                                EnabledByDefault is set by the operator when it enables this feature via default configuration,
+                                as opposed to an explicit user choice. When true, the system-probe binary is not used as a
+                                fallback if system-probe-lite is unavailable — the container falls back to sleep infinity
+                                instead, to avoid unexpected resource usage on older agent images.
+                                This field is managed by the operator and should not be set by users.
+                              type: boolean
                             networkStats:
                               description: |-
                                 Enables the service discovery network stats collection.
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentprofiles_v1alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagentprofiles_v1alpha1.json
@@ -2592,6 +2592,10 @@
                       "description": "Enables the service discovery check.\nDefault: false",
                       "type": "boolean"
                     },
+                    "enabledByDefault": {
+                      "description": "EnabledByDefault is set by the operator when it enables this feature via default configuration,\nas opposed to an explicit user choice. When true, the system-probe binary is not used as a\nfallback if system-probe-lite is unavailable — the container falls back to sleep infinity\ninstead, to avoid unexpected resource usage on older agent images.\nThis field is managed by the operator and should not be set by users.",
+                      "type": "boolean"
+                    },
                     "networkStats": {
                       "additionalProperties": false,
                       "description": "Enables the service discovery network stats collection.\nDefault: true",
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagents.yaml b/config/crd/bases/v1/datadoghq.com_datadogagents.yaml
@@ -2488,6 +2488,14 @@ spec:
                             Enables the service discovery check.
                             Default: false
                           type: boolean
+                        enabledByDefault:
+                          description: |-
+                            EnabledByDefault is set by the operator when it enables this feature via default configuration,
+                            as opposed to an explicit user choice. When true, the system-probe binary is not used as a
+                            fallback if system-probe-lite is unavailable — the container falls back to sleep infinity
+                            instead, to avoid unexpected resource usage on older agent images.
+                            This field is managed by the operator and should not be set by users.
+                          type: boolean
                         networkStats:
                           description: |-
                             Enables the service discovery network stats collection.
@@ -10959,6 +10967,14 @@ spec:
                                 Enables the service discovery check.
                                 Default: false
                               type: boolean
+                            enabledByDefault:
+                              description: |-
+                                EnabledByDefault is set by the operator when it enables this feature via default configuration,
+                                as opposed to an explicit user choice. When true, the system-probe binary is not used as a
+                                fallback if system-probe-lite is unavailable — the container falls back to sleep infinity
+                                instead, to avoid unexpected resource usage on older agent images.
+                                This field is managed by the operator and should not be set by users.
+                              type: boolean
                             networkStats:
                               description: |-
                                 Enables the service discovery network stats collection.
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagents_v2alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagents_v2alpha1.json
@@ -2588,6 +2588,10 @@
                   "description": "Enables the service discovery check.\nDefault: false",
                   "type": "boolean"
                 },
+                "enabledByDefault": {
+                  "description": "EnabledByDefault is set by the operator when it enables this feature via default configuration,\nas opposed to an explicit user choice. When true, the system-probe binary is not used as a\nfallback if system-probe-lite is unavailable — the container falls back to sleep infinity\ninstead, to avoid unexpected resource usage on older agent images.\nThis field is managed by the operator and should not be set by users.",
+                  "type": "boolean"
+                },
                 "networkStats": {
                   "additionalProperties": false,
                   "description": "Enables the service discovery network stats collection.\nDefault: true",
@@ -10807,6 +10811,10 @@
                       "description": "Enables the service discovery check.\nDefault: false",
                       "type": "boolean"
                     },
+                    "enabledByDefault": {
+                      "description": "EnabledByDefault is set by the operator when it enables this feature via default configuration,\nas opposed to an explicit user choice. When true, the system-probe binary is not used as a\nfallback if system-probe-lite is unavailable — the container falls back to sleep infinity\ninstead, to avoid unexpected resource usage on older agent images.\nThis field is managed by the operator and should not be set by users.",
+                      "type": "boolean"
+                    },
                     "networkStats": {
                       "additionalProperties": false,
                       "description": "Enables the service discovery network stats collection.\nDefault: true",
diff --git a/docs/configuration.v2alpha1.md b/docs/configuration.v2alpha1.md
@@ -200,6 +200,7 @@ spec:
 | features.sbom.host.analyzers | To use for SBOM collection. |
 | features.sbom.host.enabled | Enable this option to activate SBOM collection. Default: false |
 | features.serviceDiscovery.enabled | Enables the service discovery check. Default: false |
+| features.serviceDiscovery.enabledByDefault | EnabledByDefault is set by the operator when it enables this feature via default configuration, as opposed to an explicit user choice. When true, the system-probe binary is not used as a fallback if system-probe-lite is unavailable — the container falls back to sleep infinity instead, to avoid unexpected resource usage on older agent images. This field is managed by the operator and should not be set by users. |
 | features.serviceDiscovery.networkStats.enabled | Enables the Service Discovery Network Stats feature. Default: true |
 | features.tcpQueueLength.enabled | Enables the TCP queue length eBPF-based check. Default: false |
 | features.usm.enabled | Enables Universal Service Monitoring. Default: false |
diff --git a/docs/configuration_public.md b/docs/configuration_public.md
@@ -384,6 +384,9 @@ spec:
 `features.serviceDiscovery.enabled`
 : Enables the service discovery check. Default: false
 
+`features.serviceDiscovery.enabledByDefault`
+: EnabledByDefault is set by the operator when it enables this feature via default configuration, as opposed to an explicit user choice. When true, the system-probe binary is not used as a fallback if system-probe-lite is unavailable — the container falls back to sleep infinity instead, to avoid unexpected resource usage on older agent images. This field is managed by the operator and should not be set by users.
+
 `features.serviceDiscovery.networkStats.enabled`
 : Enables the Service Discovery Network Stats feature. Default: true
 
diff --git a/internal/controller/datadogagent/controller_v2_test.go b/internal/controller/datadogagent/controller_v2_test.go
@@ -1752,7 +1752,7 @@ func Test_DDAI_ReconcileV3(t *testing.T) {
 			wantFunc: func(t *testing.T, c client.Client) {
 				expectedDDAI := getBaseDDAI(dda)
 				expectedDDAI.Annotations = map[string]string{
-					constants.MD5DDAIDeploymentAnnotationKey: "ccac39a3a007bad81d7baf8febc6445f",
+					constants.MD5DDAIDeploymentAnnotationKey: "62d2822cc8547055dc8e2fca6f222a17",
 				}
 
 				verifyDDAI(t, c, []v1alpha1.DatadogAgentInternal{expectedDDAI})
@@ -1784,7 +1784,7 @@ func Test_DDAI_ReconcileV3(t *testing.T) {
 				baseDDAI := getBaseDDAI(dda)
 				expectedDDAI := baseDDAI.DeepCopy()
 				expectedDDAI.Annotations = map[string]string{
-					constants.MD5DDAIDeploymentAnnotationKey: "f2aa21d0ecced63c091ca2df3d31e451",
+					constants.MD5DDAIDeploymentAnnotationKey: "c362b9a0aa0e2ad1a1d60f4ee8575c8f",
 				}
 				expectedDDAI.Spec.Features.ClusterChecks.UseClusterChecksRunners = apiutils.NewBoolPointer(true)
 				expectedDDAI.Spec.Global.Credentials = &v2alpha1.DatadogCredentials{
@@ -1860,7 +1860,7 @@ func Test_DDAI_ReconcileV3(t *testing.T) {
 				profileDDAI := getBaseDDAI(dda)
 				profileDDAI.Name = "foo-profile"
 				profileDDAI.Annotations = map[string]string{
-					constants.MD5DDAIDeploymentAnnotationKey: "73e0cc1e445001e326507ac23654104e",
+					constants.MD5DDAIDeploymentAnnotationKey: "2c3c1664f08fb6d6591294f2c878d1dd",
 				}
 				profileDDAI.Labels[constants.ProfileLabelKey] = "foo-profile"
 				profileDDAI.Spec.Override = map[v2alpha1.ComponentName]*v2alpha1.DatadogAgentComponentOverride{
@@ -2094,7 +2094,7 @@ func getBaseDDAI(dda *v2alpha1.DatadogAgent) v1alpha1.DatadogAgentInternal {
 func getDefaultDDAI(dda *v2alpha1.DatadogAgent) v1alpha1.DatadogAgentInternal {
 	expectedDDAI := getBaseDDAI(dda)
 	expectedDDAI.Annotations = map[string]string{
-		constants.MD5DDAIDeploymentAnnotationKey: "f98c0497c66e2747f6d116970ab8f0b1",
+		constants.MD5DDAIDeploymentAnnotationKey: "7e6c12e645247762609327ab80b63d9e",
 	}
 	expectedDDAI.Spec.Override = map[v2alpha1.ComponentName]*v2alpha1.DatadogAgentComponentOverride{
 		v2alpha1.NodeAgentComponentName: {
diff --git a/internal/controller/datadogagent/defaults/datadogagent_default.go b/internal/controller/datadogagent/defaults/datadogagent_default.go
@@ -42,6 +42,7 @@ const (
 	defaultGPUMonitoringEnabled bool = false
 
 	defaultServiceDiscoveryEnabled             bool = false
+	defaultServiceDiscoveryEnabledByDefault    bool = false
 	defaultServiceDiscoveryNetworkStatsEnabled bool = true
 
 	defaultAPMEnabled                   bool   = true
@@ -304,8 +305,9 @@ func defaultFeaturesConfig(ddaSpec *v2alpha1.DatadogAgentSpec) {
 		ddaSpec.Features.ServiceDiscovery = &v2alpha1.ServiceDiscoveryFeatureConfig{}
 	}
 	apiutils.DefaultBooleanIfUnset(&ddaSpec.Features.ServiceDiscovery.Enabled, defaultServiceDiscoveryEnabled)
+	apiutils.DefaultBooleanIfUnset(&ddaSpec.Features.ServiceDiscovery.EnabledByDefault, defaultServiceDiscoveryEnabledByDefault)
 
-	if *ddaSpec.Features.ServiceDiscovery.Enabled {
+	if *ddaSpec.Features.ServiceDiscovery.Enabled || *ddaSpec.Features.ServiceDiscovery.EnabledByDefault {
 		if ddaSpec.Features.ServiceDiscovery.NetworkStats == nil {
 			ddaSpec.Features.ServiceDiscovery.NetworkStats = &v2alpha1.ServiceDiscoveryNetworkStatsConfig{}
 		}
diff --git a/internal/controller/datadogagent/defaults/datadogagent_default_test.go b/internal/controller/datadogagent/defaults/datadogagent_default_test.go
diff --git a/internal/controller/datadogagent/feature/servicediscovery/feature.go b/internal/controller/datadogagent/feature/servicediscovery/feature.go
diff --git a/internal/controller/datadogagent/feature/servicediscovery/feature_test.go b/internal/controller/datadogagent/feature/servicediscovery/feature_test.go
