discovery: add sd-agent support

Yumasi · Yumasi · commit b2401a995cac · 2026-02-18T14:55:36.000+01:00
diff --git a/api/datadoghq/v2alpha1/datadogagent_types.go b/api/datadoghq/v2alpha1/datadogagent_types.go
@@ -626,6 +626,13 @@ type ServiceDiscoveryFeatureConfig struct {
 	// Default: true
 	// +optional
 	NetworkStats *ServiceDiscoveryNetworkStatsConfig `json:"networkStats,omitempty"`
+
+	// UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.
+	// When enabled, the system-probe container uses sd-agent as a lightweight wrapper,
+	// falling back to plain system-probe if the binary is not available.
+	// Default: false
+	// +optional
+	UseSdAgent *bool `json:"useSdAgent,omitempty"`
 }
 
 // ServiceDiscoveryNetworkStatsConfig configures Service Discovery's network stats
diff --git a/api/datadoghq/v2alpha1/zz_generated.deepcopy.go b/api/datadoghq/v2alpha1/zz_generated.deepcopy.go
diff --git a/api/datadoghq/v2alpha1/zz_generated.openapi.go b/api/datadoghq/v2alpha1/zz_generated.openapi.go
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentinternals.yaml b/config/crd/bases/v1/datadoghq.com_datadogagentinternals.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: datadogagentinternals.datadoghq.com
 spec:
   group: datadoghq.com
@@ -2368,6 +2368,13 @@ spec:
                                 Default: true
                               type: boolean
                           type: object
+                        useSdAgent:
+                          description: |-
+                            UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.
+                            When enabled, the system-probe container uses sd-agent as a lightweight wrapper,
+                            falling back to plain system-probe if the binary is not available.
+                            Default: false
+                          type: boolean
                       type: object
                     tcpQueueLength:
                       description: TCPQueueLength configuration.
@@ -10373,6 +10380,13 @@ spec:
                                     Default: true
                                   type: boolean
                               type: object
+                            useSdAgent:
+                              description: |-
+                                UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.
+                                When enabled, the system-probe container uses sd-agent as a lightweight wrapper,
+                                falling back to plain system-probe if the binary is not available.
+                                Default: false
+                              type: boolean
                           type: object
                         tcpQueueLength:
                           description: TCPQueueLength configuration.
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentinternals_v1alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagentinternals_v1alpha1.json
@@ -2485,6 +2485,10 @@
                     }
                   },
                   "type": "object"
+                },
+                "useSdAgent": {
+                  "description": "UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.\nWhen enabled, the system-probe container uses sd-agent as a lightweight wrapper,\nfalling back to plain system-probe if the binary is not available.\nDefault: false",
+                  "type": "boolean"
                 }
               },
               "type": "object"
@@ -10348,6 +10352,10 @@
                         }
                       },
                       "type": "object"
+                    },
+                    "useSdAgent": {
+                      "description": "UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.\nWhen enabled, the system-probe container uses sd-agent as a lightweight wrapper,\nfalling back to plain system-probe if the binary is not available.\nDefault: false",
+                      "type": "boolean"
                     }
                   },
                   "type": "object"
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentprofiles.yaml b/config/crd/bases/v1/datadoghq.com_datadogagentprofiles.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: datadogagentprofiles.datadoghq.com
 spec:
   group: datadoghq.com
@@ -2368,6 +2368,13 @@ spec:
                                     Default: true
                                   type: boolean
                               type: object
+                            useSdAgent:
+                              description: |-
+                                UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.
+                                When enabled, the system-probe container uses sd-agent as a lightweight wrapper,
+                                falling back to plain system-probe if the binary is not available.
+                                Default: false
+                              type: boolean
                           type: object
                         tcpQueueLength:
                           description: TCPQueueLength configuration.
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagentprofiles_v1alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagentprofiles_v1alpha1.json
@@ -2489,6 +2489,10 @@
                         }
                       },
                       "type": "object"
+                    },
+                    "useSdAgent": {
+                      "description": "UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.\nWhen enabled, the system-probe container uses sd-agent as a lightweight wrapper,\nfalling back to plain system-probe if the binary is not available.\nDefault: false",
+                      "type": "boolean"
                     }
                   },
                   "type": "object"
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagents.yaml b/config/crd/bases/v1/datadoghq.com_datadogagents.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.3
+    controller-gen.kubebuilder.io/version: v0.16.3
   name: datadogagents.datadoghq.com
 spec:
   group: datadoghq.com
@@ -2368,6 +2368,13 @@ spec:
                                 Default: true
                               type: boolean
                           type: object
+                        useSdAgent:
+                          description: |-
+                            UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.
+                            When enabled, the system-probe container uses sd-agent as a lightweight wrapper,
+                            falling back to plain system-probe if the binary is not available.
+                            Default: false
+                          type: boolean
                       type: object
                     tcpQueueLength:
                       description: TCPQueueLength configuration.
@@ -10423,6 +10430,13 @@ spec:
                                     Default: true
                                   type: boolean
                               type: object
+                            useSdAgent:
+                              description: |-
+                                UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.
+                                When enabled, the system-probe container uses sd-agent as a lightweight wrapper,
+                                falling back to plain system-probe if the binary is not available.
+                                Default: false
+                              type: boolean
                           type: object
                         tcpQueueLength:
                           description: TCPQueueLength configuration.
diff --git a/config/crd/bases/v1/datadoghq.com_datadogagents_v2alpha1.json b/config/crd/bases/v1/datadoghq.com_datadogagents_v2alpha1.json
@@ -2485,6 +2485,10 @@
                     }
                   },
                   "type": "object"
+                },
+                "useSdAgent": {
+                  "description": "UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.\nWhen enabled, the system-probe container uses sd-agent as a lightweight wrapper,\nfalling back to plain system-probe if the binary is not available.\nDefault: false",
+                  "type": "boolean"
                 }
               },
               "type": "object"
@@ -10413,6 +10417,10 @@
                         }
                       },
                       "type": "object"
+                    },
+                    "useSdAgent": {
+                      "description": "UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.\nWhen enabled, the system-probe container uses sd-agent as a lightweight wrapper,\nfalling back to plain system-probe if the binary is not available.\nDefault: false",
+                      "type": "boolean"
                     }
                   },
                   "type": "object"
diff --git a/docs/configuration.v2alpha1.md b/docs/configuration.v2alpha1.md
@@ -195,6 +195,7 @@ spec:
 | features.sbom.host.enabled | Enable this option to activate SBOM collection. Default: false |
 | features.serviceDiscovery.enabled | Enables the service discovery check. Default: false |
 | features.serviceDiscovery.networkStats.enabled | Enables the Service Discovery Network Stats feature. Default: true |
+| features.serviceDiscovery.useSdAgent | UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery. When enabled, the system-probe container uses sd-agent as a lightweight wrapper, falling back to plain system-probe if the binary is not available. Default: false |
 | features.tcpQueueLength.enabled | Enables the TCP queue length eBPF-based check. Default: false |
 | features.usm.enabled | Enables Universal Service Monitoring. Default: false |
 | global.checksTagCardinality | ChecksTagCardinality configures tag cardinality for the metrics collected by integrations (`low`, `orchestrator` or `high`). See also: https://docs.datadoghq.com/getting_started/tagging/assigning_tags/?tab=containerizedenvironments#tags-cardinality. Not set by default to avoid overriding existing DD_CHECKS_TAG_CARDINALITY configurations, the default value in the Agent is low. Ref: https://github.com/DataDog/datadog-agent/blob/856cf4a66142ce91fd4f8a278149436eb971184a/pkg/config/setup/config.go#L625. |
diff --git a/docs/configuration_public.md b/docs/configuration_public.md
@@ -393,6 +393,9 @@ spec:
 `features.serviceDiscovery.networkStats.enabled`
 : Enables the Service Discovery Network Stats feature. Default: true
 
+`features.serviceDiscovery.useSdAgent`
+: UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery. When enabled, the system-probe container uses sd-agent as a lightweight wrapper, falling back to plain system-probe if the binary is not available. Default: false
+
 `features.tcpQueueLength.enabled`
 : Enables the TCP queue length eBPF-based check. Default: false
 
diff --git a/internal/controller/datadogagent/feature/servicediscovery/envvar.go b/internal/controller/datadogagent/feature/servicediscovery/envvar.go
@@ -8,4 +8,5 @@ package servicediscovery
 const (
 	DDServiceDiscoveryEnabled             = "DD_DISCOVERY_ENABLED"
 	DDServiceDiscoveryNetworkStatsEnabled = "DD_DISCOVERY_NETWORK_STATS_ENABLED"
+	DDDiscoveryUseSdAgent                 = "DD_DISCOVERY_USE_SD_AGENT"
 )
diff --git a/internal/controller/datadogagent/feature/servicediscovery/feature.go b/internal/controller/datadogagent/feature/servicediscovery/feature.go
@@ -31,6 +31,7 @@ func buildFeature(*feature.Options) feature.Feature {
 
 type serviceDiscoveryFeature struct {
 	networkStatsEnabled bool
+	useSdAgent          bool
 }
 
 // ID returns the ID of the Feature
@@ -50,6 +51,8 @@ func (f *serviceDiscoveryFeature) Configure(_ metav1.Object, ddaSpec *v2alpha1.D
 		if ddaSpec.Features.ServiceDiscovery.NetworkStats != nil {
 			f.networkStatsEnabled = apiutils.BoolValue(ddaSpec.Features.ServiceDiscovery.NetworkStats.Enabled)
 		}
+
+		f.useSdAgent = apiutils.BoolValue(ddaSpec.Features.ServiceDiscovery.UseSdAgent)
 	}
 
 	return reqComp
@@ -136,6 +139,30 @@ func (f *serviceDiscoveryFeature) ManageNodeAgent(managers feature.PodTemplateMa
 	managers.EnvVar().AddEnvVarToContainer(apicommon.CoreAgentContainerName, socketEnvVar)
 	managers.EnvVar().AddEnvVarToContainer(apicommon.SystemProbeContainerName, socketEnvVar)
 
+	if f.useSdAgent {
+		managers.EnvVar().AddEnvVarToContainer(apicommon.SystemProbeContainerName, &corev1.EnvVar{
+			Name:  DDDiscoveryUseSdAgent,
+			Value: "true",
+		})
+
+		// Override system-probe command with sd-agent wrapper (runtime fallback if binary missing)
+		for i := range managers.PodTemplateSpec().Spec.Containers {
+			c := &managers.PodTemplateSpec().Spec.Containers[i]
+			if c.Name == string(apicommon.SystemProbeContainerName) {
+				c.Command = []string{"/bin/sh", "-c"}
+				c.Args = []string{
+					"if [ -x /opt/datadog-agent/embedded/bin/sd-agent ]; then " +
+						"exec /opt/datadog-agent/embedded/bin/sd-agent -- " +
+						"/opt/datadog-agent/embedded/bin/system-probe " +
+						"--config=/etc/datadog-agent/system-probe.yaml; " +
+						"else exec system-probe " +
+						"--config=/etc/datadog-agent/system-probe.yaml; fi",
+				}
+				break
+			}
+		}
+	}
+
 	return nil
 }
 
diff --git a/internal/controller/datadogagent/feature/servicediscovery/feature_test.go b/internal/controller/datadogagent/feature/servicediscovery/feature_test.go
@@ -43,6 +43,10 @@ func Test_serviceDiscoveryFeature_Configure(t *testing.T) {
 	{
 		ddaServiceDiscoveryEnabledWithNetStats.Spec.Features.ServiceDiscovery.NetworkStats.Enabled = apiutils.NewBoolPointer(true)
 	}
+	ddaServiceDiscoveryWithSdAgent := ddaServiceDiscoveryEnabledWithNetStats.DeepCopy()
+	{
+		ddaServiceDiscoveryWithSdAgent.Spec.Features.ServiceDiscovery.UseSdAgent = apiutils.NewBoolPointer(true)
+	}
 
 	tests := test.FeatureTestSuite{
 		{
@@ -54,13 +58,21 @@ func Test_serviceDiscoveryFeature_Configure(t *testing.T) {
 			Name:          "service discovery enabled - no network stats",
 			DDA:           ddaServiceDiscoveryEnabledNoNetStats,
 			WantConfigure: true,
-			Agent:         test.NewDefaultComponentTest().WithWantFunc(getWantFunc(noNetStats)),
+			Agent:         test.NewDefaultComponentTest().WithWantFunc(getWantFunc(noNetStats, noSdAgent)),
 		},
 		{
 			Name:          "service discovery enabled - with network stats",
 			DDA:           ddaServiceDiscoveryEnabledWithNetStats,
 			WantConfigure: true,
-			Agent:         test.NewDefaultComponentTest().WithWantFunc(getWantFunc(withNetStats)),
+			Agent:         test.NewDefaultComponentTest().WithWantFunc(getWantFunc(withNetStats, noSdAgent)),
+		},
+		{
+			Name:          "service discovery enabled - with sd-agent",
+			DDA:           ddaServiceDiscoveryWithSdAgent,
+			WantConfigure: true,
+			Agent: test.NewDefaultComponentTest().
+				WithCreateFunc(createFuncWithSystemProbeContainer()).
+				WithWantFunc(getWantFunc(withNetStats, withSdAgent)),
 		},
 	}
 
@@ -70,9 +82,29 @@ func Test_serviceDiscoveryFeature_Configure(t *testing.T) {
 const (
 	noNetStats   = false
 	withNetStats = true
+	noSdAgent    = false
+	withSdAgent  = true
 )
 
-func getWantFunc(withNetStats bool) func(t testing.TB, mgrInterface feature.PodTemplateManagers) {
+func createFuncWithSystemProbeContainer() func(testing.TB) (feature.PodTemplateManagers, string) {
+	return func(t testing.TB) (feature.PodTemplateManagers, string) {
+		newPTS := corev1.PodTemplateSpec{
+			Spec: corev1.PodSpec{
+				Containers: []corev1.Container{
+					{
+						Name: string(apicommon.CoreAgentContainerName),
+					},
+					{
+						Name: string(apicommon.SystemProbeContainerName),
+					},
+				},
+			},
+		}
+		return fake.NewPodTemplateManagers(t, newPTS), ""
+	}
+}
+
+func getWantFunc(withNetStats bool, useSdAgent bool) func(t testing.TB, mgrInterface feature.PodTemplateManagers) {
 	return func(t testing.TB, mgrInterface feature.PodTemplateManagers) {
 		mgr := mgrInterface.(*fake.PodTemplateManagers)
 
@@ -216,11 +248,31 @@ func getWantFunc(withNetStats bool) func(t testing.TB, mgrInterface feature.PodT
 			},
 		}
 
+		if useSdAgent {
+			wantSPEnvVars = append(wantSPEnvVars, &corev1.EnvVar{
+				Name:  DDDiscoveryUseSdAgent,
+				Value: "true",
+			})
+		}
+
 		agentEnvVars := mgr.EnvVarMgr.EnvVarsByC[apicommon.CoreAgentContainerName]
 		assert.True(t, apiutils.IsEqualStruct(agentEnvVars, wantAgentEnvVars), "Agent envvars \ndiff = %s", cmp.Diff(agentEnvVars, wantAgentEnvVars))
 
 		systemProbeEnvVars := mgr.EnvVarMgr.EnvVarsByC[apicommon.SystemProbeContainerName]
 		assert.True(t, apiutils.IsEqualStruct(systemProbeEnvVars, wantSPEnvVars), "System Probe envvars \ndiff = %s", cmp.Diff(systemProbeEnvVars, wantSPEnvVars))
+
+		// check system-probe container command override for sd-agent
+		if useSdAgent {
+			for _, c := range mgr.PodTemplateSpec().Spec.Containers {
+				if c.Name == string(apicommon.SystemProbeContainerName) {
+					assert.Equal(t, []string{"/bin/sh", "-c"}, c.Command, "System Probe command should be overridden for sd-agent")
+					assert.Len(t, c.Args, 1, "System Probe args should have one element")
+					assert.Contains(t, c.Args[0], "sd-agent", "System Probe args should contain sd-agent")
+					assert.Contains(t, c.Args[0], "system-probe", "System Probe args should contain system-probe fallback")
+					break
+				}
+			}
+		}
 	}
 }
 

Original file line number	Diff line number	Diff line change
`@@ -2485,6 +2485,10 @@`
`2485`	`2485`	`}`
`2486`	`2486`	`},`
`2487`	`2487`	`"type": "object"`
	`2488`	`+ },`
	`2489`	`+ "useSdAgent": {`
	`2490`	`+ "description": "UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.\nWhen enabled, the system-probe container uses sd-agent as a lightweight wrapper,\nfalling back to plain system-probe if the binary is not available.\nDefault: false",`
	`2491`	`+ "type": "boolean"`
`2488`	`2492`	`}`
`2489`	`2493`	`},`
`2490`	`2494`	`"type": "object"`
`@@ -10348,6 +10352,10 @@`
`10348`	`10352`	`}`
`10349`	`10353`	`},`
`10350`	`10354`	`"type": "object"`
	`10355`	`+ },`
	`10356`	`+ "useSdAgent": {`
	`10357`	`+ "description": "UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.\nWhen enabled, the system-probe container uses sd-agent as a lightweight wrapper,\nfalling back to plain system-probe if the binary is not available.\nDefault: false",`
	`10358`	`+ "type": "boolean"`
`10351`	`10359`	`}`
`10352`	`10360`	`},`
`10353`	`10361`	`"type": "object"`
Original file line number	Diff line number	Diff line change
`@@ -2489,6 +2489,10 @@`
`2489`	`2489`	`}`
`2490`	`2490`	`},`
`2491`	`2491`	`"type": "object"`
	`2492`	`+ },`
	`2493`	`+ "useSdAgent": {`
	`2494`	`+ "description": "UseSdAgent enables the sd-agent wrapper for system-probe when running service discovery.\nWhen enabled, the system-probe container uses sd-agent as a lightweight wrapper,\nfalling back to plain system-probe if the binary is not available.\nDefault: false",`
	`2495`	`+ "type": "boolean"`
`2492`	`2496`	`}`
`2493`	`2497`	`},`
`2494`	`2498`	`"type": "object"`