discovery: remove EnabledByDefault from CRD, use nil tri-state

Yumasi · claude · Yumasi · commit 9bff932f4cba · 2026-04-08T16:36:14.000+02:00
Remove EnabledByDefault from the CRD and instead use the nil/false/true
tri-state on Enabled:
- Enabled=nil  → not configured by user (operator may auto-enable later)
- Enabled=false → explicit user opt-out
- Enabled=true  → explicit user opt-in (system-probe fallback allowed)

The fallback distinction is preserved: userExplicitlyEnabled is only
true when Enabled=*true, so a future operator auto-enable path (nil)
would still use the conservative sleep-infinity fallback.

Enabled is intentionally not defaulted to false so that nil remains
distinguishable from an explicit opt-out.

Co-Authored-By: Claude Sonnet 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/api/datadoghq/v2alpha1/datadogagent_types.go b/api/datadoghq/v2alpha1/datadogagent_types.go
@@ -647,13 +647,6 @@ type ServiceDiscoveryFeatureConfig struct {
 	// +optional
 	Enabled *bool `json:"enabled,omitempty"`
 
-	// Indicates that the operator enabled this feature automatically rather than in response to an
-	// explicit user setting. When true, if `system-probe-lite` is unavailable, the container falls
-	// back to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on
-	// older agent images. This field is managed by the operator and must not be set by users.
-	// +optional
-	EnabledByDefault *bool `json:"enabledByDefault,omitempty"`
-
 	// DEPRECATED: NetworkStats is no longer configurable and will be ignored. Scheduled for removal in v1.28.
 	// +deprecated
 	// +optional
diff --git a/api/datadoghq/v2alpha1/zz_generated.deepcopy.go b/api/datadoghq/v2alpha1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentinternals.yaml b/config/crd/bases/v1/datadoghq.com_datadogagentinternals.yaml
@@ -2503,13 +2503,6 @@ spec:
                             Enables the service discovery check.
                             Default: false
                           type: boolean
-                        enabledByDefault:
-                          description: |-
-                            Indicates that the operator enabled this feature automatically rather than in response to an
-                            explicit user setting. When true, if `system-probe-lite` is unavailable, the container falls
-                            back to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on
-                            older agent images. This field is managed by the operator and must not be set by users.
-                          type: boolean
                         networkStats:
                           description: 'DEPRECATED: NetworkStats is no longer configurable and will be ignored. Scheduled for removal in v1.28.'
                           properties:
@@ -10942,13 +10935,6 @@ spec:
                                 Enables the service discovery check.
                                 Default: false
                               type: boolean
-                            enabledByDefault:
-                              description: |-
-                                Indicates that the operator enabled this feature automatically rather than in response to an
-                                explicit user setting. When true, if `system-probe-lite` is unavailable, the container falls
-                                back to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on
-                                older agent images. This field is managed by the operator and must not be set by users.
-                              type: boolean
                             networkStats:
                               description: 'DEPRECATED: NetworkStats is no longer configurable and will be ignored. Scheduled for removal in v1.28.'
                               properties:
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentinternals_v1alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagentinternals_v1alpha1.json
@@ -2603,10 +2603,6 @@
                   "description": "Enables the service discovery check.\nDefault: false",
                   "type": "boolean"
                 },
-                "enabledByDefault": {
-                  "description": "Indicates that the operator enabled this feature automatically rather than in response to an\nexplicit user setting. When true, if `system-probe-lite` is unavailable, the container falls\nback to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on\nolder agent images. This field is managed by the operator and must not be set by users.",
-                  "type": "boolean"
-                },
                 "networkStats": {
                   "additionalProperties": false,
                   "description": "DEPRECATED: NetworkStats is no longer configurable and will be ignored. Scheduled for removal in v1.28.",
@@ -10776,10 +10772,6 @@
                       "description": "Enables the service discovery check.\nDefault: false",
                       "type": "boolean"
                     },
-                    "enabledByDefault": {
-                      "description": "Indicates that the operator enabled this feature automatically rather than in response to an\nexplicit user setting. When true, if `system-probe-lite` is unavailable, the container falls\nback to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on\nolder agent images. This field is managed by the operator and must not be set by users.",
-                      "type": "boolean"
-                    },
                     "networkStats": {
                       "additionalProperties": false,
                       "description": "DEPRECATED: NetworkStats is no longer configurable and will be ignored. Scheduled for removal in v1.28.",
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentprofiles.yaml b/config/crd/bases/v1/datadoghq.com_datadogagentprofiles.yaml
@@ -2503,13 +2503,6 @@ spec:
                                 Enables the service discovery check.
                                 Default: false
                               type: boolean
-                            enabledByDefault:
-                              description: |-
-                                Indicates that the operator enabled this feature automatically rather than in response to an
-                                explicit user setting. When true, if `system-probe-lite` is unavailable, the container falls
-                                back to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on
-                                older agent images. This field is managed by the operator and must not be set by users.
-                              type: boolean
                             networkStats:
                               description: 'DEPRECATED: NetworkStats is no longer configurable and will be ignored. Scheduled for removal in v1.28.'
                               properties:
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentprofiles_v1alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagentprofiles_v1alpha1.json
@@ -2607,10 +2607,6 @@
                       "description": "Enables the service discovery check.\nDefault: false",
                       "type": "boolean"
                     },
-                    "enabledByDefault": {
-                      "description": "Indicates that the operator enabled this feature automatically rather than in response to an\nexplicit user setting. When true, if `system-probe-lite` is unavailable, the container falls\nback to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on\nolder agent images. This field is managed by the operator and must not be set by users.",
-                      "type": "boolean"
-                    },
                     "networkStats": {
                       "additionalProperties": false,
                       "description": "DEPRECATED: NetworkStats is no longer configurable and will be ignored. Scheduled for removal in v1.28.",
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagents.yaml b/config/crd/bases/v1/datadoghq.com_datadogagents.yaml
@@ -2507,13 +2507,6 @@ spec:
                             Enables the service discovery check.
                             Default: false
                           type: boolean
-                        enabledByDefault:
-                          description: |-
-                            Indicates that the operator enabled this feature automatically rather than in response to an
-                            explicit user setting. When true, if `system-probe-lite` is unavailable, the container falls
-                            back to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on
-                            older agent images. This field is managed by the operator and must not be set by users.
-                          type: boolean
                         networkStats:
                           description: 'DEPRECATED: NetworkStats is no longer configurable and will be ignored. Scheduled for removal in v1.28.'
                           properties:
@@ -11022,13 +11015,6 @@ spec:
                                 Enables the service discovery check.
                                 Default: false
                               type: boolean
-                            enabledByDefault:
-                              description: |-
-                                Indicates that the operator enabled this feature automatically rather than in response to an
-                                explicit user setting. When true, if `system-probe-lite` is unavailable, the container falls
-                                back to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on
-                                older agent images. This field is managed by the operator and must not be set by users.
-                              type: boolean
                             networkStats:
                               description: 'DEPRECATED: NetworkStats is no longer configurable and will be ignored. Scheduled for removal in v1.28.'
                               properties:
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagents_v2alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagents_v2alpha1.json
@@ -2603,10 +2603,6 @@
                   "description": "Enables the service discovery check.\nDefault: false",
                   "type": "boolean"
                 },
-                "enabledByDefault": {
-                  "description": "Indicates that the operator enabled this feature automatically rather than in response to an\nexplicit user setting. When true, if `system-probe-lite` is unavailable, the container falls\nback to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on\nolder agent images. This field is managed by the operator and must not be set by users.",
-                  "type": "boolean"
-                },
                 "networkStats": {
                   "additionalProperties": false,
                   "description": "DEPRECATED: NetworkStats is no longer configurable and will be ignored. Scheduled for removal in v1.28.",
@@ -10869,10 +10865,6 @@
                       "description": "Enables the service discovery check.\nDefault: false",
                       "type": "boolean"
                     },
-                    "enabledByDefault": {
-                      "description": "Indicates that the operator enabled this feature automatically rather than in response to an\nexplicit user setting. When true, if `system-probe-lite` is unavailable, the container falls\nback to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on\nolder agent images. This field is managed by the operator and must not be set by users.",
-                      "type": "boolean"
-                    },
                     "networkStats": {
                       "additionalProperties": false,
                       "description": "DEPRECATED: NetworkStats is no longer configurable and will be ignored. Scheduled for removal in v1.28.",
diff --git a/docs/configuration.v2alpha1.md b/docs/configuration.v2alpha1.md
@@ -202,7 +202,6 @@ spec:
 | features.sbom.host.analyzers | To use for SBOM collection. |
 | features.sbom.host.enabled | Enable this option to activate SBOM collection. Default: false |
 | features.serviceDiscovery.enabled | Enables the service discovery check. Default: false |
-| features.serviceDiscovery.enabledByDefault | Indicates that the operator enabled this feature automatically rather than in response to an explicit user setting. When true, if `system-probe-lite` is unavailable, the container falls back to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on older agent images. This field is managed by the operator and must not be set by users. |
 | features.serviceDiscovery.networkStats.enabled | DEPRECATED: this field is ignored. |
 | features.tcpQueueLength.enabled | Enables the TCP queue length eBPF-based check. Default: false |
 | features.usm.enabled | Enables Universal Service Monitoring. Default: false |
diff --git a/docs/configuration_public.md b/docs/configuration_public.md
@@ -384,9 +384,6 @@ spec:
 `features.serviceDiscovery.enabled`
 : Enables the service discovery check. Default: false
 
-`features.serviceDiscovery.enabledByDefault`
-: Indicates that the operator enabled this feature automatically rather than in response to an explicit user setting. When true, if `system-probe-lite` is unavailable, the container falls back to `sleep infinity` rather than `system-probe`, to avoid unexpected resource usage on older agent images. This field is managed by the operator and must not be set by users.
-
 `features.serviceDiscovery.networkStats.enabled`
 : DEPRECATED: this field is ignored.
 
diff --git a/internal/controller/datadogagent/defaults/datadogagent_default.go b/internal/controller/datadogagent/defaults/datadogagent_default.go
@@ -43,9 +43,6 @@ const (
 
 	defaultGPUMonitoringEnabled bool = false
 
-	defaultServiceDiscoveryEnabled          bool = false
-	defaultServiceDiscoveryEnabledByDefault bool = false
-
 	defaultAPMEnabled                   bool   = true
 	defaultAPMHostPortEnabled           bool   = false
 	defaultAPMHostPort                  int32  = 8126
@@ -305,12 +302,9 @@ func defaultFeaturesConfig(ddaSpec *v2alpha1.DatadogAgentSpec) {
 	if ddaSpec.Features.ServiceDiscovery == nil {
 		ddaSpec.Features.ServiceDiscovery = &v2alpha1.ServiceDiscoveryFeatureConfig{}
 	}
-	apiutils.DefaultBooleanIfUnset(&ddaSpec.Features.ServiceDiscovery.EnabledByDefault, defaultServiceDiscoveryEnabledByDefault)
-	// Only default Enabled to false when not enabled-by-default, so that Enabled=nil remains
-	// distinguishable from Enabled=false (explicit user opt-out) when EnabledByDefault=true.
-	if !apiutils.BoolValue(ddaSpec.Features.ServiceDiscovery.EnabledByDefault) {
-		apiutils.DefaultBooleanIfUnset(&ddaSpec.Features.ServiceDiscovery.Enabled, defaultServiceDiscoveryEnabled)
-	}
+	// Enabled is intentionally not defaulted to false — Enabled=nil (not configured by user)
+	// must remain distinguishable from Enabled=false (explicit opt-out) so that the feature
+	// can be auto-activated by the operator in the future without exposing a CRD field.
 
 	// GPU monitoring feature
 	if ddaSpec.Features.GPU == nil {
diff --git a/internal/controller/datadogagent/defaults/datadogagent_default_test.go b/internal/controller/datadogagent/defaults/datadogagent_default_test.go
diff --git a/internal/controller/datadogagent/feature/factory.go b/internal/controller/datadogagent/feature/factory.go
diff --git a/internal/controller/datadogagent/feature/servicediscovery/feature.go b/internal/controller/datadogagent/feature/servicediscovery/feature.go
diff --git a/internal/controller/datadogagent/feature/servicediscovery/feature_test.go b/internal/controller/datadogagent/feature/servicediscovery/feature_test.go
