Start supporting the use case of no cluster agent

docs/cluster_agent_setup.md

@@ -73,3 +73,27 @@ datadog-agent-hjlbg                          1/1     Running   0          33s
 ```
 
 [1]: https://github.com/DataDog/datadog-operator/blob/main/examples/datadogagent/datadog-agent-with-clusteragent.yaml
+
+## Running without the Cluster Agent
+
+The Cluster Agent is optional. If you don't need cluster-level features (Kubernetes State Metrics Core, Admission Controller, Cluster Checks, External Metrics Server, Orchestrator Explorer, etc.), you can disable it and run the node Agent on its own, for example: [`datadog-agent-without-clusteragent.yaml` file][2]:
+
+```yaml
+apiVersion: datadoghq.com/v2alpha1
+kind: DatadogAgent
+metadata:
+  name: datadog
+spec:
+  global:
+    clusterName: my-example-cluster
+    credentials:
+      apiKey: "<DATADOG_API_KEY>"
+
+  override:
+    clusterAgent:
+      disabled: true
+```
+
+With `spec.override.clusterAgent.disabled: true`, no Cluster Agent `Deployment`, `Service`, or RBAC is created, and the node Agent is configured to run without one (`DD_CLUSTER_AGENT_ENABLED` is set to `false`). Any feature under `spec.features` that requires the Cluster Agent (for example `kubeStateMetricsCore`, `admissionController`, `clusterChecks`, `externalMetricsServer`, or `orchestratorExplorer`) is automatically left disabled rather than producing a broken, half-configured deployment — remove `override.clusterAgent.disabled` if you later need any of those features.
+
+[2]: https://github.com/DataDog/datadog-operator/blob/main/examples/datadogagent/datadog-agent-without-clusteragent.yaml

examples/datadogagent/datadog-agent-without-clusteragent.yaml

@@ -0,0 +1,13 @@
+apiVersion: datadoghq.com/v2alpha1
+kind: DatadogAgent
+metadata:
+  name: datadog
+spec:
+  global:
+    clusterName: my-example-cluster
+    credentials:
+      apiKey: <DATADOG_API_KEY>
+
+  override:
+    clusterAgent:
+      disabled: true

internal/controller/datadogagent/dependencies.go

@@ -15,6 +15,7 @@ import (
 
 	v1alpha1 "github.com/DataDog/datadog-operator/api/datadoghq/v1alpha1"
 	"github.com/DataDog/datadog-operator/api/datadoghq/v2alpha1"
+	apiutils "github.com/DataDog/datadog-operator/api/utils"
 	"github.com/DataDog/datadog-operator/internal/controller/datadogagent/common"
 	"github.com/DataDog/datadog-operator/internal/controller/datadogagent/component/clusteragent"
 	"github.com/DataDog/datadog-operator/internal/controller/datadogagent/feature"
@@ -55,24 +56,32 @@ func (r *Reconciler) manageDDADependenciesWithDDAI(ctx context.Context, logger l
 		return err
 	}
 
-	// DCA token
-	if err := global.AddDCATokenDependencies(logger, instance.GetObjectMeta(), &instance.Spec, &instance.Status, resourceManagers); err != nil {
-		return err
+	// DCA token and Service are only needed when a Cluster Agent is actually
+	// going to be deployed; otherwise they're resources without a consumer.
+	clusterAgentDisabled := false
+	if override, ok := instance.Spec.Override[v2alpha1.ClusterAgentComponentName]; ok {
+		clusterAgentDisabled = apiutils.BoolValue(override.Disabled)
+	}
+	if !clusterAgentDisabled {
+		// DCA token
+		if err := global.AddDCATokenDependencies(logger, instance.GetObjectMeta(), &instance.Spec, &instance.Status, resourceManagers); err != nil {
+			return err
+		}
+		ensureAutoGeneratedTokenInStatus(instance, newDDAStatus, resourceManagers, logger)
+
+		// DCA service
+		service := clusteragent.GetClusterAgentService(instance)
+		if err := resourceManagers.ServiceManager().AddService(service.Name, service.Namespace, service.Spec.Selector, service.Spec.Ports, service.Spec.InternalTrafficPolicy); err != nil {
+			return err
+		}
 	}
-	ensureAutoGeneratedTokenInStatus(instance, newDDAStatus, resourceManagers, logger)
 
 	// APM Telemetry
 	// ConfigMap stores DatadogAgent resource UID and creation time whether or not DatadogAgentInternal is enabled.
 	if err := global.AddAPMTelemetryDependencies(logger, instance, resourceManagers); err != nil {
 		return err
 	}
 
-	// DCA service
-	service := clusteragent.GetClusterAgentService(instance)
-	if err := resourceManagers.ServiceManager().AddService(service.Name, service.Namespace, service.Spec.Selector, service.Spec.Ports, service.Spec.InternalTrafficPolicy); err != nil {
-		return err
-	}
-
 	// Dependencies that can get configs from DDA and DDAI
 	// Example: agent local service for APM, DSD, and OTLP
 	if err := r.addDDASharedDependencies(instance, ddais, resourceManagers); err != nil {

internal/controller/datadogagent/feature/admissioncontroller/feature.go

@@ -110,7 +110,15 @@ func (f *admissionControllerFeature) Configure(dda metav1.Object, ddaSpec *v2alp
 
 	ac := ddaSpec.Features.AdmissionController
 
-	if ac != nil && apiutils.BoolValue(ac.Enabled) {
+	// The admission controller webhook server runs inside the Cluster Agent; without one
+	// there's nothing to back the webhook Service, and the API server would block pod
+	// creation trying to reach it.
+	clusterAgentDisabled := false
+	if clusterAgent, ok := ddaSpec.Override[v2alpha1.ClusterAgentComponentName]; ok {
+		clusterAgentDisabled = apiutils.BoolValue(clusterAgent.Disabled)
+	}
+
+	if !clusterAgentDisabled && ac != nil && apiutils.BoolValue(ac.Enabled) {
 		if ac.Validation != nil && ac.Validation.Enabled != nil {
 			f.validationWebhookConfig = &ValidationConfig{enabled: apiutils.BoolValue(ac.Validation.Enabled)}
 		}

internal/controller/datadogagent/feature/admissioncontroller/feature_test.go

@@ -36,6 +36,14 @@ func Test_admissionControllerFeature_Configure(t *testing.T) {
 				Build(),
 			WantConfigure: false,
 		},
+		{
+			Name: "Admission Controller enabled but cluster agent disabled",
+			DDA: testutils.NewDatadogAgentBuilder().
+				WithAdmissionControllerEnabled(true).
+				WithClusterAgentDisabled(true).
+				Build(),
+			WantConfigure: false,
+		},
 		{
 			Name: "Admission Controller enabled grants CSI driver RBAC unconditionally",
 			DDA: testutils.NewDatadogAgentBuilder().

internal/controller/datadogagent/feature/apm/feature_test.go

@@ -106,6 +106,43 @@ func TestAPMConfigureSSIWithoutNodeAPM(t *testing.T) {
 	assert.True(t, feat.shouldEnableLanguageDetection())
 }
 
+// TestAPMConfigureSSIClusterAgentDisabled verifies that SSI (including language detection,
+// which runs on the Cluster Agent admission controller path) is not configured when the
+// Cluster Agent is disabled via override, even though admissionController and SSI are both
+// otherwise enabled. This is handled by validateSSISharedComponentPrerequisites (checked via
+// shouldConfigureSSI), not by a dedicated override check in this feature.
+func TestAPMConfigureSSIClusterAgentDisabled(t *testing.T) {
+	dda := &v2alpha1.DatadogAgent{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "datadog",
+			Namespace: "default",
+		},
+		Spec: v2alpha1.DatadogAgentSpec{
+			Features: &v2alpha1.DatadogFeatures{
+				AdmissionController: &v2alpha1.AdmissionControllerFeatureConfig{Enabled: ptr.To(true)},
+				APM: &v2alpha1.APMFeatureConfig{
+					Enabled: ptr.To(false),
+					SingleStepInstrumentation: &v2alpha1.SingleStepInstrumentation{
+						Enabled:           ptr.To(true),
+						LanguageDetection: &v2alpha1.LanguageDetectionConfig{Enabled: ptr.To(true)},
+					},
+				},
+			},
+			Override: map[v2alpha1.ComponentName]*v2alpha1.DatadogAgentComponentOverride{
+				v2alpha1.ClusterAgentComponentName: {
+					Disabled: ptr.To(true),
+				},
+			},
+		},
+	}
+
+	feat := buildAPMFeature(&feature.Options{}).(*apmFeature)
+	reqComp := feat.Configure(dda, &dda.Spec, nil)
+
+	assert.False(t, reqComp.ClusterAgent.IsEnabled())
+	assert.False(t, feat.shouldEnableLanguageDetection())
+}
+
 func TestAPMFeature(t *testing.T) {
 	tests := test.FeatureTestSuite{
 		{

internal/controller/datadogagent/feature/appsec/feature.go

@@ -110,6 +110,12 @@ func (f *appsecFeature) Configure(dda metav1.Object, ddaSpec *v2alpha1.DatadogAg
 		return feature.RequiredComponents{}
 	}
 
+	// AppSec injection is configured and served by the Cluster Agent; without one there's
+	// nothing to create RBAC for.
+	if clusterAgent, ok := ddaSpec.Override[v2alpha1.ClusterAgentComponentName]; ok && apiutils.BoolValue(clusterAgent.Disabled) {
+		return feature.RequiredComponents{}
+	}
+
 	var inj *v2alpha1.AppsecInjectorConfig
 	if ddaSpec.Features != nil && ddaSpec.Features.Appsec != nil {
 		inj = ddaSpec.Features.Appsec.Injector

internal/controller/datadogagent/feature/appsec/feature_test.go

@@ -786,6 +786,21 @@ func TestAppsecFeatureConfigure(t *testing.T) {
 	}
 }
 
+func TestAppsecFeatureConfigureClusterAgentDisabled(t *testing.T) {
+	dda := testutils.NewDatadogAgentBuilder().
+		WithClusterAgentTag("7.76.0").
+		WithClusterAgentDisabled(true).
+		WithAnnotations(map[string]string{
+			AnnotationInjectorEnabled: "true",
+		}).
+		Build()
+
+	f := buildAppsecFeature(nil).(*appsecFeature)
+	reqComp := f.Configure(dda, &dda.Spec, nil)
+
+	assert.False(t, reqComp.IsEnabled(), "AppSec should not be enabled when the cluster agent is disabled")
+}
+
 func TestAppsecFeatureManageClusterAgentDisabled(t *testing.T) {
 	// Test that ManageClusterAgent does nothing when feature is disabled
 	dda := testutils.NewDatadogAgentBuilder().

internal/controller/datadogagent/feature/asm/feature.go

@@ -56,6 +56,10 @@ func (f *asmFeature) Configure(_ metav1.Object, ddaSpec *v2alpha1.DatadogAgentSp
 		return feature.RequiredComponents{}
 	}
 
+	if clusterAgent, ok := ddaSpec.Override[v2alpha1.ClusterAgentComponentName]; ok && apiutils.BoolValue(clusterAgent.Disabled) {
+		return feature.RequiredComponents{}
+	}
+
 	f.threatsEnabled = apiutils.BoolValue(asm.Threats.Enabled)
 	f.iastEnabled = apiutils.BoolValue(asm.IAST.Enabled)
 	f.scaEnabled = apiutils.BoolValue(asm.SCA.Enabled)

internal/controller/datadogagent/feature/asm/feature_test.go

@@ -68,6 +68,15 @@ func TestASMFeature(t *testing.T) {
 			WantConfigure: true,
 			ClusterAgent:  assertEnv(envVar{name: DDAdmissionControllerAppsecEnabled, value: "true", present: true}),
 		},
+		{
+			Name: "ASM Threats enabled but cluster agent disabled",
+			DDA: testutils.NewDatadogAgentBuilder().
+				WithAdmissionControllerEnabled(true).
+				WithASMEnabled(true, false, false).
+				WithClusterAgentDisabled(true).
+				Build(),
+			WantConfigure: false,
+		},
 		{
 			Name: "ASM Threats enabled, admission controller not enabled",
 			DDA: testutils.NewDatadogAgentBuilder().

internal/controller/datadogagent/feature/autoscaling/feature.go

@@ -71,6 +71,12 @@ func (f *autoscalingFeature) Configure(dda metav1.Object, ddaSpec *v2alpha1.Data
 		return feature.RequiredComponents{}
 	}
 
+	// Autoscaling decisions are computed and served by the Cluster Agent; without one
+	// there's no RBAC to create.
+	if clusterAgent, ok := ddaSpec.Override[v2alpha1.ClusterAgentComponentName]; ok && apiutils.BoolValue(clusterAgent.Disabled) {
+		return feature.RequiredComponents{}
+	}
+
 	if autoscaling.Workload != nil && apiutils.BoolValue(autoscaling.Workload.Enabled) {
 		f.workloadEnabled = true
 		if autoscaling.Workload.InPlaceVerticalScaling != nil {

internal/controller/datadogagent/feature/autoscaling/feature_test.go

@@ -119,6 +119,18 @@ func TestAutoscalingFeature(t *testing.T) {
 	tests.Run(t, buildAutoscalingFeature)
 }
 
+func TestAutoscalingFeature_ClusterAgentDisabled(t *testing.T) {
+	dda := newAgent(true, true, true, false, false)
+	dda.Spec.Override = map[v2alpha1.ComponentName]*v2alpha1.DatadogAgentComponentOverride{
+		v2alpha1.ClusterAgentComponentName: {Disabled: ptr.To(true)},
+	}
+
+	f := buildAutoscalingFeature(nil)
+	reqComp := f.Configure(dda, &dda.Spec, nil)
+
+	assert.False(t, reqComp.IsEnabled(), "autoscaling should not be enabled when the cluster agent is disabled")
+}
+
 func newAgent(workloadEnabled, clusterEnabled, admissionEnabled, clusterSpotEnabled, workloadInPlaceVerticalScalingEnabled bool) *v2alpha1.DatadogAgent {
 	return &v2alpha1.DatadogAgent{
 		ObjectMeta: metav1.ObjectMeta{

internal/controller/datadogagent/feature/clusterchecks/feature.go

@@ -58,6 +58,10 @@ func (f *clusterChecksFeature) ID() feature.IDType {
 }
 
 func (f *clusterChecksFeature) Configure(dda metav1.Object, ddaSpec *v2alpha1.DatadogAgentSpec, _ *v2alpha1.RemoteConfigConfiguration) (reqComp feature.RequiredComponents) {
+	if clusterAgent, ok := ddaSpec.Override[v2alpha1.ClusterAgentComponentName]; ok && apiutils.BoolValue(clusterAgent.Disabled) {
+		return reqComp
+	}
+
 	if apiutils.BoolValue(ddaSpec.Features.ClusterChecks.Enabled) {
 		f.updateConfigHash(dda, ddaSpec)
 		f.owner = dda

internal/controller/datadogagent/feature/clusterchecks/feature_test.go

@@ -68,6 +68,14 @@ func TestClusterChecksFeature(t *testing.T) {
 			ClusterAgent:  test.NewDefaultComponentTest().WithWantFunc(wantClusterAgentHasExpectedEnvsAndChecksum),
 			Agent:         testAgentHasExpectedEnvsWithNoRunners(apicommon.CoreAgentContainerName),
 		},
+		{
+			Name: "cluster checks enabled but cluster agent disabled",
+			DDA: testutils.NewDatadogAgentBuilder().
+				WithClusterChecksEnabled(true).
+				WithClusterAgentDisabled(true).
+				Build(),
+			WantConfigure: false,
+		},
 		{
 			Name: "cluster checks enabled and runners not enabled with single container strategy",
 			DDA: testutils.NewDatadogAgentBuilder().

internal/controller/datadogagent/feature/controlplanemonitoring/feature.go

@@ -67,6 +67,12 @@ func (f *controlPlaneMonitoringFeature) Configure(dda metav1.Object, ddaSpec *v2
 
 	controlPlaneMonitoring := ddaSpec.Features.ControlPlaneMonitoring
 
+	// Control plane monitoring is driven by the Cluster Agent; without one there's no RBAC
+	// or ConfigMap to create.
+	if clusterAgent, ok := ddaSpec.Override[v2alpha1.ClusterAgentComponentName]; ok && apiutils.BoolValue(clusterAgent.Disabled) {
+		return reqComp
+	}
+
 	if controlPlaneMonitoring != nil && apiutils.BoolValue(controlPlaneMonitoring.Enabled) {
 		f.enabled = true
 		reqComp.ClusterAgent.IsRequired = new(true)

internal/controller/datadogagent/feature/controlplanemonitoring/feature_test.go

@@ -38,6 +38,14 @@ func Test_controlPlaneMonitoringFeature_Configure(t *testing.T) {
 				Build(),
 			WantConfigure: false,
 		},
+		{
+			Name: "Control Plane Monitoring enabled but cluster agent disabled",
+			DDA: testutils.NewDatadogAgentBuilder().
+				WithControlPlaneMonitoring(true).
+				WithClusterAgentDisabled(true).
+				Build(),
+			WantConfigure: false,
+		},
 		{
 			Name: "Control Plane Monitoring enabled with default provider",
 			DDA: testutils.NewInitializedDatadogAgentBuilder(resourcesNamespace, resourcesName).

internal/controller/datadogagent/feature/cspm/feature.go

@@ -80,7 +80,14 @@ func (f *cspmFeature) Configure(dda metav1.Object, ddaSpec *v2alpha1.DatadogAgen
 
 	cspmConfig := ddaSpec.Features.CSPM
 
-	if cspmConfig != nil && apiutils.BoolValue(cspmConfig.Enabled) {
+	// CSPM dispatches its checks via the Cluster Agent; without one there's no RBAC to
+	// create and the node-side check has nothing to report through.
+	clusterAgentDisabled := false
+	if clusterAgent, ok := ddaSpec.Override[v2alpha1.ClusterAgentComponentName]; ok {
+		clusterAgentDisabled = apiutils.BoolValue(clusterAgent.Disabled)
+	}
+
+	if !clusterAgentDisabled && cspmConfig != nil && apiutils.BoolValue(cspmConfig.Enabled) {
 		f.enable = true
 		f.serviceAccountName = constants.GetClusterAgentServiceAccount(dda.GetName(), ddaSpec)
 

internal/controller/datadogagent/feature/cspm/feature_test.go

@@ -83,6 +83,17 @@ func Test_cspmFeature_Configure(t *testing.T) {
 			DDA:           ddaCSPMDisabled.DeepCopy(),
 			WantConfigure: false,
 		},
+		{
+			Name: "CSPM enabled but cluster agent disabled",
+			DDA: func() *v2alpha1.DatadogAgent {
+				dda := ddaCSPMEnabled.DeepCopy()
+				dda.Spec.Override = map[v2alpha1.ComponentName]*v2alpha1.DatadogAgentComponentOverride{
+					v2alpha1.ClusterAgentComponentName: {Disabled: ptr.To(true)},
+				}
+				return dda
+			}(),
+			WantConfigure: false,
+		},
 		{
 			Name:          "CSPM enabled",
 			DDA:           ddaCSPMEnabled,