Configure the Datadog Operator
This page lists commonly-used configuration parameters for the Datadog Operator. For all configuration parameters, see the configuration spec in the DataDog/datadog-operator repo.
The Agent configuration the Operator generates is determined by two inputs: the DatadogAgent spec (the parameters documented on this page) and a small set of metadata annotations on the DatadogAgent.
Provider
A provider identifies an environment or platform that needs a specific set of customizations to the Agent configuration. The Operator detects the cluster provider automatically, or you can declare it with the agent.datadoghq.com/cluster-provider annotation (mirroring the Helm chart’s providers.* configuration):
metadata:
annotations:
agent.datadoghq.com/cluster-provider: eks
For what a provider is, how it is resolved, the full list of values, and their Helm mappings, see the providers documentation.
Example manifests
Global options
The table in this section lists configurable parameters for the DatadogAgent resource. To override parameters for individual components (Node Agent, Cluster Agent, or Cluster Checks Runner) see override options.
For example: the following manifest uses the global.clusterName parameter to set a custom cluster name:
apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
name: datadog
spec:
global:
clusterName: my-test-cluster
credentials:
apiSecret:
secretName: datadog-secret
keyName: api-key
appSecret:
secretName: datadog-secret
keyName: app-key
features.admissionController.agentCommunicationMode- AgentCommunicationMode corresponds to the mode used by the Datadog application libraries to communicate with the Agent. It can be “hostip”, “service”, or “socket”.
features.admissionController.agentSidecarInjection- AgentSidecarInjection contains Agent sidecar injection configurations. See link for more information.
features.admissionController.cwsInstrumentation.enabled- Enable the CWS Instrumentation admission controller endpoint. Default: false
features.admissionController.cwsInstrumentation.mode- Defines the behavior of the CWS Instrumentation endpoint, and can be either “init_container” or “remote_copy”. Default: “remote_copy”
features.admissionController.enabled- Enables the Admission Controller. Default: true
features.admissionController.failurePolicy- FailurePolicy determines how unrecognized and timeout errors are handled.
features.admissionController.kubernetesAdmissionEvents.enabled- Enable the Kubernetes Admission Events feature. Default: false
features.admissionController.mutateUnlabelled- MutateUnlabelled enables config injection without the need of pod label ‘admission.datadoghq.com/enabled=“true”’. Default: false
features.admissionController.mutation.enabled- Enables the Admission Controller mutation webhook. Default: true
features.admissionController.registry- Defines an image registry for the admission controller.
features.admissionController.serviceName- ServiceName corresponds to the webhook service name.
features.admissionController.validation.enabled- Enables the Admission Controller validation webhook. Default: true
features.admissionController.webhookName- WebhookName is a custom name for the MutatingWebhookConfiguration. Default: “datadog-webhook”
features.apm.enabled- Enables Application Performance Monitoring. Default: true
features.apm.errorTrackingStandalone.enabled- Enables Error Tracking for backend services. Default: false
features.apm.hostPortConfig.enabled- Enables host port configuration
features.apm.hostPortConfig.hostPort- Port takes a port number (0 < x < 65536) to expose on the host. (Most containers do not need this.) If HostNetwork is enabled, this value must match the ContainerPort.
features.apm.instrumentation- SingleStepInstrumentation allows the agent to inject the Datadog APM libraries into all pods in the cluster. Feature is in beta. See also: https://docs.datadoghq.com/tracing/trace_collection/single-step-apm Enabled Default: false
features.apm.unixDomainSocketConfig.enabled- Enables Unix Domain Socket. Default: true
features.apm.unixDomainSocketConfig.path- Defines the socket path used when enabled.
features.appsec.injector.autoDetect- Controls automatic proxy detection. Default: true
features.appsec.injector.enabled- Enables the AppSec injector. Default: false
features.appsec.injector.gke.gatewayClasses- Lists GKE GatewayClasses for AppSec injection. Configuration is create-only with no drift reconciliation, so deleting a GCPTrafficExtension while its Gateway still exists does not recreate it. The extension has no ownerReferences; if the cluster-agent is down or not leader when the Gateway is deleted, it can be orphaned. After disabling AppSec, teardown can take about 5-7 minutes and traffic remains inspected or blocked during that period. A pre-existing GCPTrafficExtension without the app.kubernetes.io/managed-by: datadog-cluster-agent label is left alone. A Gateway labeled appsec.datadoghq.com/enabled=false is skipped. GKE injection requires cluster-agent version 7.82.0 or later. The
mode: external setting is required only when gke-gateway is explicitly listed in proxies; a gatewayClasses-only configuration relying on agent-side autoDetect remains valid in any mode. features.appsec.injector.mode- Selects the AppSec injection mode. When unset, this uses the agent default sidecar.
features.appsec.injector.nginx.moduleMountPath- Sets the nginx module mount path. Default: /modules_mount
features.appsec.injector.processor.address- Sets the processor address.
features.appsec.injector.processor.port- Sets the processor port. Default: 443
features.appsec.injector.processor.service.name- Sets the processor Service name.
features.appsec.injector.processor.service.namespace- Sets the processor Service namespace. This is ignored for gke-gateway because the callout Service is resolved in each Gateway’s own namespace; deploy the Service in every AppSec-enabled Gateway namespace.
features.appsec.injector.proxies- Lists proxies for AppSec injection. Default: []
features.appsec.injector.sidecar.bodyParsingSizeLimit- Sets the sidecar body parsing size limit. Default: 0
features.appsec.injector.sidecar.healthPort- Sets the sidecar health port. Default: 8081
features.appsec.injector.sidecar.image- Sets the sidecar image. Default: ghcr.io/datadog/dd-trace-go/service-extensions-callout
features.appsec.injector.sidecar.imageTag- Sets the sidecar image tag. When unset, the tag defaults to a value determined by the cluster-agent image in use.
features.appsec.injector.sidecar.port- Sets the sidecar port. Default: 8080
features.appsec.injector.sidecar.resources- Configures sidecar resources. Only requests and limits for cpu and memory are honored. See link for more information.
features.asm.iast.enabled- Enables Interactive Application Security Testing (IAST). Default: false
features.asm.sca.enabled- Enables Software Composition Analysis (SCA). Default: false
features.asm.threats.enabled- Enables ASM App & API Protection. Default: false
features.autoscaling.cluster.enabled- Enables the cluster autoscaling product. (Requires Cluster Agent 7.74.0+) Default: false
features.autoscaling.cluster.spot.enabled- Enables the cluster spot scheduling product. (Requires Cluster Agent 7.79.0+) Default: false
features.autoscaling.workload.enabled- Enables the workload autoscaling product. Default: false
features.autoscaling.workload.inPlaceVerticalScaling.enabled- Enables in-place vertical scaling for workload autoscaling. (Requires Cluster Agent 7.78.0+ and Kubernetes 1.33+) Default: false
features.clusterChecks.enabled- Enables Cluster Checks scheduling in the Cluster Agent. Default: true
features.clusterChecks.useClusterChecksRunners- Enabled enables Cluster Checks Runners to run all Cluster Checks. Default: false
features.controlPlaneMonitoring.enabled- Enables control plane monitoring checks in the cluster agent. Default: true
features.cspm.checkInterval- CheckInterval defines the check interval.
features.cspm.customBenchmarks- CustomBenchmarks contains CSPM benchmarks. The content of the ConfigMap will be merged with the benchmarks bundled with the agent. Any benchmarks with the same name as those existing in the agent will take precedence.
features.cspm.enabled- Enables Cloud Security Posture Management, including Docker and Kubernetes benchmarks. Default: false
features.cspm.hostBenchmarks.enabled- Enables Linux host benchmarks. Requires
features.cspm.enabled to be set to true. Default: true features.cspm.runInSystemProbe- RunInSystemProbe configures CSPM to send payloads directly from the system-probe, without using the security-agent. This is an experimental feature. Contact support before using. Default: false
features.cws.customPolicies.configData- ConfigData corresponds to the configuration file content.
features.cws.customPolicies.configMap.items- Maps a ConfigMap data
key to a file path mount. features.cws.customPolicies.configMap.name- Is the name of the ConfigMap.
features.cws.directSendFromSystemProbe- DirectSendFromSystemProbe configures CWS to send payloads directly from the system-probe, without using the security-agent. This is an experimental feature. Contact support before using. Default: false
features.cws.enabled- Enables Cloud Workload Security. Default: false
features.cws.enforcement.enabled- Enables Enforcement for Cloud Workload Security. Default: true
features.cws.network.enabled- Enables Cloud Workload Security Network detections. Default: true
features.cws.remoteConfiguration.enabled- Enables Remote Configuration for Cloud Workload Security. Default: true
features.cws.securityProfiles.enabled- Enables Security Profiles collection for Cloud Workload Security. Default: true
features.cws.syscallMonitorEnabled- SyscallMonitorEnabled enables Syscall Monitoring (recommended for troubleshooting only). Default: false
features.dataPlane.dogstatsd.enabled- Configures the Data Plane to handle DogStatsD traffic. When set to false, DogStatsD is handled by the Core Agent instead. Default: true
features.dataPlane.enabled- Enables the Data Plane. Default: false
features.dogstatsd.hostPortConfig.enabled- Enables host port configuration
features.dogstatsd.hostPortConfig.hostPort- Port takes a port number (0 < x < 65536) to expose on the host. (Most containers do not need this.) If HostNetwork is enabled, this value must match the ContainerPort.
features.dogstatsd.mapperProfiles.configData- ConfigData corresponds to the configuration file content.
features.dogstatsd.mapperProfiles.configMap.items- Maps a ConfigMap data
key to a file path mount. features.dogstatsd.mapperProfiles.configMap.name- Is the name of the ConfigMap.
features.dogstatsd.nonLocalTraffic- NonLocalTraffic enables non-local traffic for Dogstatsd. Default: true
features.dogstatsd.originDetectionEnabled- OriginDetectionEnabled enables origin detection for container tagging. See also: https://docs.datadoghq.com/developers/dogstatsd/unix_socket/#using-origin-detection-for-container-tagging
features.dogstatsd.tagCardinality- TagCardinality configures tag cardinality for the metrics collected using origin detection (
low, orchestrator or high). This setting only applies when OriginDetectionEnabled is true. See also: https://docs.datadoghq.com/getting_started/tagging/assigning_tags/?tab=containerizedenvironments#environment-variables Cardinality default: low features.dogstatsd.unixDomainSocketConfig.enabled- Enables Unix Domain Socket. Default: true
features.dogstatsd.unixDomainSocketConfig.path- Defines the socket path used when enabled.
features.dynamicInstrumentation.enabled- Enables the Dynamic Instrumentation system probe module. Default: false
features.ebpfCheck.enabled- Enables the eBPF check. Default: false
features.eventCollection.collectKubernetesEvents- CollectKubernetesEvents enables Kubernetes event collection. Default: true
features.eventCollection.collectedEventTypes- CollectedEventTypes defines the list of events to collect when UnbundleEvents is enabled. Default: [ {“kind”:“Pod”,“reasons”:[“Failed”,“BackOff”,“Unhealthy”,“FailedScheduling”,“FailedMount”,“FailedAttachVolume”]}, {“kind”:“Node”,“reasons”:[“TerminatingEvictedPod”,“NodeNotReady”,“Rebooted”,“HostPortConflict”]}, {“kind”:“CronJob”,“reasons”:[“SawCompletedJob”]} ]
features.eventCollection.unbundleEvents- UnbundleEvents enables collection of Kubernetes events as individual events. Default: false
features.externalMetricsServer- ExternalMetricsServer configuration. See link for more information.
features.gpu.enabled- Enables GPU monitoring core check. Default: false
features.gpu.patchCgroupPermissions- PatchCgroupPermissions enables the patch of cgroup permissions for GPU monitoring, in case the container runtime is not properly configured and the Agent containers lose access to GPU devices. Default: false
features.gpu.privilegedMode- PrivilegedMode enables GPU Probe module in System Probe. The module’s eBPF probes are disabled; privileged mode is retained for cgroup permission patching. To re-enable the eBPF probes, set DD_GPU_MONITORING_ENABLE_EBPF_PROBES=true on the core agent and system-probe containers via spec.override.nodeAgent.containers. Default: false
features.gpu.requiredRuntimeClassName- PodRuntimeClassName specifies the runtime class name required for the GPU monitoring feature. If the value is an empty string, the runtime class is not set. Default: nvidia
features.helmCheck.collectEvents- CollectEvents set to
true enables event collection in the Helm check (Requires Agent 7.36.0+ and Cluster Agent 1.20.0+) Default: false features.helmCheck.enabled- Enables the Helm check. Default: false
features.helmCheck.valuesAsTags- ValuesAsTags collects Helm values from a release and uses them as tags (Requires Agent and Cluster Agent 7.40.0+). Default: {}
features.kubeStateMetricsCore.collectCrMetricsCollectCrMetrics defines custom resources for the kube-state-metrics core check to collect. The datadog agent uses the same logic as upstream kube-state-metrics. So is its configuration. The exact structure and existing fields of each item in this list can be found in: https://github.com/kubernetes/kube-state-metrics/blob/main/docs/metrics/extend/customresourcestate-metrics.mdfeatures.kubeStateMetricsCore.conf- Overrides the configuration for the default Kubernetes State Metrics Core check. This must point to a ConfigMap containing a valid cluster check configuration.
features.kubeStateMetricsCore.enabled- Enables Kube State Metrics Core. Default: true
features.kubeStateMetricsCore.podCollectionMode- PodCollectionMode controls where the KSM check collects pod metrics. When set to “node_kubelet” the operator splits the kubernetes_state_core check into two: the cluster-side instance keeps every collector except scheduled pods (only unscheduled pods are kept on that side), and a dedicated pods-only instance is deployed on every node agent to read pods locally from its Kubelet via workloadmeta. In the generated agent check YAML this corresponds to the snake_case check options
pod_collection_mode: cluster_unassigned on the cluster side and pod_collection_mode: node_kubelet (with collectors: [pods]) on the node side; this CRD field itself is the camelCase podCollectionMode per Kubernetes API convention. Useful in large clusters where a single KSM instance is a bottleneck. The cluster-aggregate .total metrics (kubernetes_state.{container,initcontainer}._{requested,limit}.total) carry a reduced tag set with no host or node, so they cannot be collected correctly by every node agent independently without colliding at ingestion. To avoid this, the operator also enables cluster_aggregates_enabled on the cluster-side and node-side instances, which silences those aggregate metrics on both, and schedules a dedicated cluster_aggregates_only instance on the cluster-side component to collect them instead. Requires Agent / Cluster Agent 7.82+. When features.kubeStateMetricsCore.conf is also set, the operator deploys the node-side check but does NOT modify the user-supplied cluster-side config. To avoid double pod collection in that case, the user’s cluster-side instance must either omit pods from its collectors list OR set the pod_collection_mode: cluster_unassigned check option themselves. Omitting collectors entirely falls back to upstream KSM defaults, which include pods. Default behavior is unchanged when this field is unset. features.kubernetesActions.enabled- Enables the Kubernetes Actions feature on the Cluster Agent. Default: false
features.liveContainerCollection.enabled- Enables container collection for the Live Container View. Default: true
features.liveProcessCollection.enabled- Enables Process monitoring. Default: false
features.liveProcessCollection.scrubProcessArguments- ScrubProcessArguments enables scrubbing of sensitive data in process command-lines (passwords, tokens, etc. ). Default: true
features.liveProcessCollection.stripProcessArguments- StripProcessArguments enables stripping of all process arguments. Default: false
features.logCollection.autoMultiLineDetection- AutoMultiLineDetection allows the Agent to detect and aggregate common multi-line logs automatically. See also: https://docs.datadoghq.com/agent/logs/auto_multiline_detection/
features.logCollection.containerCollectAll- ContainerCollectAll enables Log collection from all containers. Default: false
features.logCollection.containerCollectUsingFiles- ContainerCollectUsingFiles enables log collection from files in
/var/log/pods instead of using the container runtime API. Collecting logs from files is usually the most efficient way of collecting logs. See also: https://docs.datadoghq.com/agent/basic_agent_usage/kubernetes/#log-collection-setup Default: true features.logCollection.containerLogsPath- ContainerLogsPath allows log collection from the container log path. Set to a different path if you are not using the Docker runtime. See also: https://docs.datadoghq.com/agent/kubernetes/daemonset_setup/?tab=k8sfile#create-manifest Default:
/var/lib/docker/containers features.logCollection.containerSymlinksPath- ContainerSymlinksPath allows log collection to use symbolic links in this directory to validate container ID -> pod. Default:
/var/log/containers features.logCollection.enabled- Enables Log collection. Default: false
features.logCollection.openFilesLimit- OpenFilesLimit sets the maximum number of log files that the Datadog Agent tails. Increasing this limit can increase resource consumption of the Agent. See also: https://docs.datadoghq.com/agent/basic_agent_usage/kubernetes/#log-collection-setup Default: 100
features.logCollection.podLogsPath- PodLogsPath allows log collection from a pod log path. Default:
/var/log/pods features.logCollection.tempStoragePath- TempStoragePath (always mounted from the host) is used by the Agent to store information about processed log files. If the Agent is restarted, it starts tailing the log files immediately. Default:
/var/lib/datadog-agent/logs features.npm.collectDNSStats- CollectDNSStats enables DNS stat collection. Default: false
features.npm.enableConntrack- EnableConntrack enables the system-probe agent to connect to the netlink/conntrack subsystem to add NAT information to connection data. See also: http://conntrack-tools.netfilter.org/ Default: false
features.npm.enabled- Enables Network Performance Monitoring. Default: false
features.oomKill.enabled- Enables the OOMKill eBPF-based check. Default: false
features.orchestratorExplorer.conf.configData- ConfigData corresponds to the configuration file content.
features.orchestratorExplorer.conf.configMap.items- Maps a ConfigMap data
key to a file path mount. features.orchestratorExplorer.conf.configMap.name- Is the name of the ConfigMap.
features.orchestratorExplorer.customResourcesCustomResources defines custom resources for the orchestrator explorer to collect. Each item should follow the convention group/version/kind. For example, datadoghq.com/v1alpha1/datadogmetrics.features.orchestratorExplorer.ddUrl- Override the API endpoint for the Orchestrator Explorer. URL Default: “https://orchestrator.datadoghq.com”.
features.orchestratorExplorer.enabled- Enables the Orchestrator Explorer. Default: true
features.orchestratorExplorer.extraTags- Additional tags to associate with the collected data in the form of
a b c. This is a Cluster Agent option distinct from DD_TAGS that is used in the Orchestrator Explorer. features.orchestratorExplorer.scrubContainers- ScrubContainers enables scrubbing of sensitive container data (passwords, tokens, etc. ). Default: true
features.otelAgentGateway.conf- Overrides the configuration for the default OTel Agent Gateway. This must point to a ConfigMap containing a valid OTel collector configuration. When passing a configmap, file name must be otel-gateway-config.yaml.
features.otelAgentGateway.enabled- Enables the OTel Agent Gateway. Default: false
features.otelAgentGateway.featureGates- FeatureGates are the feature gates to pass to the OTel collector as a comma-separated list. Example: “component.UseLocalHostAsDefaultHost,connector.datadogconnector.NativeIngest”
features.otelAgentGateway.ports- Contains the ports that the OTel Collector is listening on. Defaults: otel-grpc:4317 / otel-http:4318.
features.otelCollector- OtelCollector configuration. See link for more information.
features.otlp- OTLP ingest configuration See link for more information.
features.processDiscovery.enabled- Enables the Process Discovery check in the Agent. Default: true
features.prometheusScrape.additionalConfigs- AdditionalConfigs allows adding advanced Prometheus check configurations with custom discovery rules.
features.prometheusScrape.enableServiceEndpoints- EnableServiceEndpoints enables generating dedicated checks for service endpoints. Default: false
features.prometheusScrape.enabled- Enable autodiscovery of pods and services exposing Prometheus metrics. Default: false
features.prometheusScrape.version- Specifies the version of the OpenMetrics check. Default: 2
features.remoteConfiguration.enabled- Enable this option to activate Remote Configuration. Default: true
features.sbom.containerImage.analyzers- To use for SBOM collection.
features.sbom.containerImage.enabled- Enable this option to activate SBOM collection. Default: false
features.sbom.containerImage.overlayFSDirectScan- Enable this option to enable experimental overlayFS direct scan. Default: false
features.sbom.containerImage.uncompressedLayersSupport- Enable this option to enable support for uncompressed layers. Default: false
features.sbom.enabled- Enable this option to activate SBOM collection. Default: false
features.sbom.enrichment.usage.enabled- Enable this option to activate SBOM enrichment with runtime “package in use” detection. Requires system-probe for eBPF-based file access tracking. Default: false
features.sbom.host.analyzers- To use for SBOM collection.
features.sbom.host.enabled- Enable this option to activate SBOM collection. Default: false
features.serviceDiscovery.enabled- Enables the service discovery check. Default: true when omitted and the node Agent image is >= 7.78.0. Otherwise false. If the image version cannot be determined, it is treated as latest.
features.tcpQueueLength.enabled- Enables the TCP queue length eBPF-based check. Default: false
features.usm.enabled- Enables Universal Service Monitoring. Default: false
global.checksTagCardinality- ChecksTagCardinality configures tag cardinality for the metrics collected by integrations (
low, orchestrator or high). See also: https://docs.datadoghq.com/getting_started/tagging/assigning_tags/?tab=containerizedenvironments#tags-cardinality. Not set by default to avoid overriding existing DD_CHECKS_TAG_CARDINALITY configurations, the default value in the Agent is low. Ref: https://github.com/DataDog/datadog-agent/blob/856cf4a66142ce91fd4f8a278149436eb971184a/pkg/config/setup/config.go#L625. global.clusterAgentToken- ClusterAgentToken is the token for communication between the NodeAgent and ClusterAgent.
global.clusterAgentTokenSecret.keyName- KeyName is the key of the secret to use.
global.clusterAgentTokenSecret.secretName- SecretName is the name of the secret.
global.clusterName- ClusterName sets a unique cluster name for the deployment to easily scope monitoring data in the Datadog app.
global.commonLabels- CommonLabels specified labels to be added to all operator-managed Kubernetes resources (DaemonSets, Deployments, ConfigMaps, Services, ServiceAccounts, etc.). This is useful when external policy tools such as Kyverno enforce the presence of specific labels on all cluster resources. Labels defined here are merged with the operator’s own default labels; operator labels take precedence on any key conflict.
global.containerStrategy- ContainerStrategy determines whether agents run in a single or multiple containers. Default: ‘optimized’
global.credentials.apiKey- APIKey configures your Datadog API key. See also: https://app.datadoghq.com/account/settings#agent/kubernetes
global.credentials.apiSecret.keyName- KeyName is the key of the secret to use.
global.credentials.apiSecret.secretName- SecretName is the name of the secret.
global.credentials.appKey- AppKey configures your Datadog application key. If you are using features.externalMetricsServer.enabled = true, you must set a Datadog application key for read access to your metrics.
global.credentials.appSecret.keyName- KeyName is the key of the secret to use.
global.credentials.appSecret.secretName- SecretName is the name of the secret.
global.criSocketPath- Path to the container runtime socket (if different from Docker).
global.csi.apm.pullSecrets- PullSecrets are kubernetes.io/dockerconfigjson Secrets used to download APM libraries from private registries. Propagated to the managed DatadogCSIDriver as spec.apm.pullSecrets. Restart the CSI DaemonSet after rotating these Secrets. Not supported on GKE Autopilot.
global.csi.autoManage- AutoManage controls whether the operator automatically manages the DatadogCSIDriver custom resource on behalf of this DatadogAgent. Set to false to hand ownership over to a DatadogCSIDriver CR that you maintain yourself (useful for migrations where you need customizations not exposed on the DatadogAgent spec). When toggled from true to false, the operator cleans up the DDA-owned DatadogCSIDriver CR; you are then responsible for providing a replacement so CSI continues to work. Default: true
global.csi.enabled- Enables the usage of CSI driver in Datadog Agent. When the operator is started with
--datadogCSIDriverEnabled=true, it will also install the driver by creating a DatadogCSIDriver custom resource, unless a cluster-scoped k8s.csi.datadoghq.com CSIDriver is already present, in which case it defers to the existing installation (e.g. from the Datadog CSI driver Helm chart). Default: false global.csi.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution- The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding “weight” to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
global.csi.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms- Required. A list of node selector terms. The terms are ORed.
global.csi.nodeSelector- NodeSelector is a map of key-value pairs for CSI driver DaemonSet pod node selection.
global.csi.tolerations- Configure the CSI driver DaemonSet pod tolerations.
global.dockerSocketPath- Path to the docker runtime socket.
global.endpoint.credentials.apiKey- APIKey configures your Datadog API key. See also: https://app.datadoghq.com/account/settings#agent/kubernetes
global.endpoint.credentials.apiSecret.keyName- KeyName is the key of the secret to use.
global.endpoint.credentials.apiSecret.secretName- SecretName is the name of the secret.
global.endpoint.credentials.appKey- AppKey configures your Datadog application key. If you are using features.externalMetricsServer.enabled = true, you must set a Datadog application key for read access to your metrics.
global.endpoint.credentials.appSecret.keyName- KeyName is the key of the secret to use.
global.endpoint.credentials.appSecret.secretName- SecretName is the name of the secret.
global.endpoint.url- URL defines the endpoint URL.
global.env- Contains a list of environment variables that are set for all Agents.
global.fips- FIPS contains configuration used to customize the FIPS proxy sidecar. See link for more information.
global.kubelet.agentCAPath- AgentCAPath is the container path where the kubelet CA certificate is stored. Default: ‘/var/run/host-kubelet-ca.crt’ if hostCAPath is set, else ‘/var/run/secrets/kubernetes.io/serviceaccount/ca.crt’
global.kubelet.host- Overrides the host used to contact kubelet API (default to status.hostIP).
global.kubelet.hostCAPath- HostCAPath is the host path where the kubelet CA certificate is stored.
global.kubelet.podResourcesSocketPath- PodResourcesSocketPath is the host path where the pod resources socket is stored. Default:
/var/lib/kubelet/pod-resources/ global.kubelet.tlsVerify- TLSVerify toggles kubelet TLS verification. Default: true
global.kubernetesResourcesAnnotationsAsTags- Provide a mapping of Kubernetes Resource Groups to annotations mapping to Datadog Tags. <KUBERNETES_RESOURCE_GROUP>: <KUBERNETES_ANNOTATION>: <DATADOG_TAG_KEY> KUBERNETES_RESOURCE_GROUP should be in the form
{resource}.{group} or {resource} (example: deployments.apps, pods) global.kubernetesResourcesLabelsAsTags- Provide a mapping of Kubernetes Resource Groups to labels mapping to Datadog Tags. <KUBERNETES_RESOURCE_GROUP>: <KUBERNETES_LABEL>: <DATADOG_TAG_KEY> KUBERNETES_RESOURCE_GROUP should be in the form
{resource}.{group} or {resource} (example: deployments.apps, pods) global.localService.forceEnableLocalService- ForceEnableLocalService forces the creation of the internal traffic policy service to target the agent running on the local node. This parameter only applies to Kubernetes 1.21, where the feature is in alpha and is disabled by default. (On Kubernetes 1.22+, the feature entered beta and the internal traffic service is created by default, so this parameter is ignored.) Default: false
global.localService.nameOverride- NameOverride defines the name of the internal traffic service to target the agent running on the local node.
global.logLevel- LogLevel sets logging verbosity. This can be overridden by container. Valid log levels are: trace, debug, info, warn, error, critical, and off. Default: ‘info’
global.namespaceAnnotationsAsTags- Provide a mapping of Kubernetes Namespace Annotations to Datadog Tags. <KUBERNETES_LABEL>: <DATADOG_TAG_KEY>
global.namespaceLabelsAsTags- Provide a mapping of Kubernetes Namespace Labels to Datadog Tags. <KUBERNETES_NAMESPACE_LABEL>: <DATADOG_TAG_KEY>
global.networkPolicy.create- Defines whether to create a NetworkPolicy for the current deployment.
global.networkPolicy.dnsSelectorEndpoints- DNSSelectorEndpoints defines the cilium selector of the DNS server entity.
global.networkPolicy.flavor- Defines Which network policy to use.
global.nodeLabelsAsTags- Provide a mapping of Kubernetes Node Labels to Datadog Tags. <KUBERNETES_NODE_LABEL>: <DATADOG_TAG_KEY>
global.originDetectionUnified.enabled- Enables unified mechanism for origin detection. Default: false
global.podAnnotationsAsTags- Provide a mapping of Kubernetes Annotations to Datadog Tags. <KUBERNETES_ANNOTATIONS>: <DATADOG_TAG_KEY>
global.podLabelsAsTags- Provide a mapping of Kubernetes Labels to Datadog Tags. <KUBERNETES_LABEL>: <DATADOG_TAG_KEY>
global.registry- Is the image registry to use for all Agent images. Use ‘public.ecr.aws/datadog’ for AWS ECR. Use ‘datadoghq.azurecr.io’ for Azure Container Registry. Use ‘gcr.io/datadoghq’ for Google Container Registry. Use ’eu.gcr.io/datadoghq’ for Google Container Registry in the EU region. Use ‘asia.gcr.io/datadoghq’ for Google Container Registry in the Asia region. Use ‘docker.io/datadog’ for DockerHub. Default: ‘registry.datadoghq.com’
global.secretBackend.args- List of arguments to pass to the command (space-separated strings).
global.secretBackend.command- The secret backend command to use. Datadog provides a pre-defined binary
/readsecret_multiple_providers.sh. Read more about /readsecret_multiple_providers.sh at https://docs.datadoghq.com/agent/configuration/secrets-management/?tab=linux#script-for-reading-from-multiple-secret-providers. global.secretBackend.config- Additional configuration for the secret backend type.
global.secretBackend.enableGlobalPermissions- Whether to create a global permission allowing Datadog agents to read all Kubernetes secrets. Default:
false. global.secretBackend.refreshInterval- The refresh interval for secrets (0 disables refreshing). Default:
0. global.secretBackend.roles- For Datadog to read the specified secrets, replacing
enableGlobalPermissions. They are defined as a list of namespace/secrets. Each defined namespace needs to be present in the DatadogAgent controller using WATCH_NAMESPACE or DD_AGENT_WATCH_NAMESPACE. See also: https://github.com/DataDog/datadog-operator/blob/main/docs/secret_management.md#how-to-deploy-the-agent-components-using-the-secret-backend-feature-with-datadogagent. global.secretBackend.timeout- The command timeout in seconds. Default:
30. global.secretBackend.type- The built-in secret backend type to use (e.g.,
k8s.secrets, docker.secrets, aws.secrets). Alternative to Command; when Type is set, the Agent uses the built-in backend to resolve secrets. Requires Agent 7.70+. global.site- Is the Datadog intake site Agent data is sent to. Set this to your Datadog site (
). Default: ‘datadoghq.com’ global.tags- Contains a list of tags to attach to every metric, event and service check collected. Learn more about tagging: https://docs.datadoghq.com/tagging/
global.useFIPSAgent- UseFIPSAgent enables the FIPS flavor of the Agent. If ’true’, the FIPS proxy will always be disabled. Default: ‘false’
global.useVSock- UseVSock allows the use of VSock communication between the Agent and containerized workloads. Default: ‘false’
override- The default configurations of the agents
For a complete list of parameters, see the Operator configuration spec.
Override options
The following table lists parameters that can be used to override default or global settings for individual components. override is a map with the following possible keys: nodeAgent, clusterAgent, otelAgentGateway, or clusterChecksRunner. Maps and arrays have a type annotation in the table. In the parameter names, component refers to one of these component keys, and container refers to a specific container name within that component (such as agent, cluster-agent, process-agent, trace-agent, or system-probe).
For example: the following manifest overrides the Node Agent’s image and tag, in addition to the resource limits of the system probe container:
apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
name: datadog
spec:
override:
nodeAgent:
image:
name: agent
tag: 7.41.0-rc.5
containers:
system-probe:
resources:
limits:
cpu: "2"
memory: 1Gi
In the table,
spec.override.nodeAgent.image.name and
spec.override.nodeAgent.containers.system-probe.resources.limits appear as
[component].image.name and
[component].containers.[container].resources.limits, respectively.
Resource limits on high-core-count nodes
On nodes with a high logical CPU count (for example, large GPU or bare-metal hosts), the Agent’s Go runtime sizes its scheduler to the host CPU count by default. This scales memory usage proportionally with the CPU count and can cause the Agent container to be OOM-killed even with otherwise modest workloads.
Setting an explicit CPU limit on the agent container constrains the runtime to that value:
apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
name: datadog
spec:
override:
nodeAgent:
containers:
agent:
resources:
requests:
cpu: "2"
memory: 512Mi
limits:
cpu: "2"
memory: 1Gi
Use an integer value for limits.cpu so the runtime can read it directly. If your cluster has node shapes with widely varying core counts, apply different limits per shape with DatadogAgentProfiles rather than setting a single global value that may be too low for small nodes or too high for large ones.
[component].affinity- If specified, the pod’s scheduling constraints. See link for more information.
[component].annotations- type:
map[string]string
Annotations provide annotations that are added to the different component (Datadog Agent, Cluster Agent, Cluster Check Runner) pods. [component].celWorkloadExclude- type:
[]object
CELWorkloadExclude enables excluding workloads from monitoring using Common Expression Language (CEL). See https://docs.datadoghq.com/containers/guide/container-discovery-management (Requires Agent 7.73+ and Cluster Agent 7.73+) [component].containers- type:
map[string]object
Configure the basic configurations for each Agent container. Valid Agent container names are: agent, cluster-agent, init-config, init-volume, process-agent, seccomp-setup, security-agent, system-probe, and trace-agent. [component].containers.[container].appArmorProfileName- AppArmorProfileName specifies an apparmor profile.
[component].containers.[container].args- type:
[]string
Args allows the specification of extra args to the Command parameter [component].containers.[container].command- type:
[]string
Command allows the specification of a custom entrypoint for container [component].containers.[container].env- type:
[]object
Specify additional environment variables in the container. See also: https://docs.datadoghq.com/agent/kubernetes/?tab=helm#environment-variables [component].containers.[container].healthPort- HealthPort of the container for the internal liveness probe. Must be the same as the Liveness/Readiness probes.
[component].containers.[container].livenessProbe- Configure the Liveness Probe of the container See link for more information.
[component].containers.[container].logLevel- LogLevel sets logging verbosity (overrides global setting). Valid log levels are: trace, debug, info, warn, error, critical, and off. Default: ‘info’
[component].containers.[container].name- Name of the container that is overridden
[component].containers.[container].ports- type:
[]object
Specify additional ports to be exposed by the container. Not specifying a port here DOES NOT prevent that port from being exposed. See https://pkg.go.dev/k8s.io/api/core/v1#Container documentation for more details. [component].containers.[container].readinessProbe- Configure the Readiness Probe of the container See link for more information.
[component].containers.[container].resources- Specify the Request and Limits of the pods To get guaranteed QoS class, specify requests and limits equal. See also: http://kubernetes.io/docs/user-guide/compute-resources/ See link for more information.
[component].containers.[container].seccompConfig- Seccomp configurations to override Operator actions. For all other Seccomp Profile manipulation, use SecurityContext. See link for more information.
[component].containers.[container].securityContext- Container-level SecurityContext. See link for more information.
[component].containers.[container].startupProbe- Configure the Startup Probe of the container See link for more information.
[component].containers.[container].volumeMounts- type:
[]object
Specify additional volume mounts in the container. [component].createPodDisruptionBudget- Set CreatePodDisruptionBudget to true to create a PodDisruptionBudget for this component. Not applicable for the Node Agent. A Cluster Agent PDB is set with 1 minimum available pod, and a Cluster Checks Runner PDB is set with 1 maximum unavailable pod.
[component].createRbac- Set CreateRbac to false to prevent automatic creation of Role/ClusterRole for this component
[component].customConfigurations- type:
map[string]object
CustomConfigurations specifies custom contents for datadog.yaml, datadog-cluster.yaml, security-agent.yaml, and system-probe.yaml. Each provided file replaces the corresponding default file from the Agent image without merging. Agent settings provided through environment variables take precedence over these files. [component].customConfigurations.[container].configData- ConfigData corresponds to the configuration file content.
[component].customConfigurations.[container].configMap.items- Items maps a ConfigMap data
key to a file path mount. [component].customConfigurations.[container].configMap.name- Name is the name of the ConfigMap.
[component].disabled- Disabled force disables a component.
[component].dnsConfig- Specifies the DNS parameters of a pod. Parameters specified here will be merged to the generated DNS configuration based on DNSPolicy. See link for more information.
[component].dnsPolicy- Set DNS policy for the pod. Defaults to “ClusterFirst”. Valid values are ‘ClusterFirstWithHostNet’, ‘ClusterFirst’, ‘Default’ or ‘None’. DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy. To have DNS options set along with hostNetwork, you have to specify DNS policy explicitly to ‘ClusterFirstWithHostNet’. See link for more information.
[component].env- type:
[]object
Specify additional environment variables for all containers in this component Priority is Container > Component. See also: https://docs.datadoghq.com/agent/kubernetes/?tab=helm#environment-variables [component].envFrom- type:
[]object
EnvFrom specifies the ConfigMaps and Secrets to expose as environment variables. Priority is env > envFrom. [component].extraChecksd- Checksd configuration allowing to specify custom checks placed under /etc/datadog-agent/checks.d/ See https://docs.datadoghq.com/agent/guide/agent-configuration-files/?tab=agentv6 for more details.
[component].extraConfd- Confd configuration allowing to specify config files for custom checks placed under /etc/datadog-agent/conf.d/. See https://docs.datadoghq.com/agent/guide/agent-configuration-files/?tab=agentv6 for more details.
[component].hostNetwork- Host networking requested for this pod. Use the host’s network namespace.
[component].hostPID- Use the host’s PID namespace.
[component].image.jmxEnabled- Define whether the Agent image should support JMX. To be used if the
Name field does not correspond to a full image string. [component].image.name- Defines the Agent image name for the pod. You can provide this as: *
<NAME> - Use agent for the Datadog Agent, cluster-agent for the Datadog Cluster Agent, or dogstatsd for DogStatsD. The full image string is derived from global.registry, [key].image.tag, and [key].image.jmxEnabled. * <NAME>:<TAG> - For example, agent:latest. The registry is derived from global.registry. [key].image.tag and [key].image.jmxEnabled are ignored. * <REGISTRY>/<NAME>:<TAG> - For example, gcr.io/datadoghq/agent:latest. If the full image string is specified like this, then global.registry, [key].image.tag, and [key].image.jmxEnabled are ignored. [component].image.pullPolicy- The Kubernetes pull policy: Use
Always, Never, or IfNotPresent. [component].image.pullSecrets- It is possible to specify Docker registry credentials. See https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
[component].image.tag- Define the image tag to use. To be used if the
Name field does not correspond to a full image string. [component].labels- type:
map[string]string
AdditionalLabels provide labels that are added to the different component (Datadog Agent, Cluster Agent, Cluster Check Runner) pods. [component].name- Name overrides the default name for the resource
[component].nodeSelector- type:
map[string]string
A map of key-value pairs. For this pod to run on a specific node, the node must have these key-value pairs as labels. See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ [component].priorityClassName- If specified, indicates the pod’s priority. “system-node-critical” and “system-cluster-critical” are two special keywords which indicate the highest priorities with the former being the highest priority. Any other name must be defined by creating a PriorityClass object with that name. If not specified, the pod priority is default, or zero if there is no default.
[component].replicas- Number of the replicas. Not applicable for a DaemonSet deployment
[component].runtimeClassName- If specified, indicates the pod’s RuntimeClass kubelet should use to run the pod. If the named RuntimeClass does not exist, or the CRI cannot run the corresponding handler, the pod enters the Failed terminal phase. If no runtimeClassName is specified, the default RuntimeHandler is used, which is equivalent to the behavior when the RuntimeClass feature is disabled.
[component].securityContext- Pod-level SecurityContext. See link for more information.
[component].serviceAccountAnnotations- type:
map[string]string
Sets the ServiceAccountAnnotations used by this component. [component].serviceAccountName- Sets the ServiceAccount used by this component. Ignored if the field CreateRbac is true.
[component].tolerations- type:
[]object
Configure the component tolerations. See link for more information. [component].topologySpreadConstraints- type:
[]object
TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed. See link for more information. [component].updateStrategy- The deployment strategy to use to replace existing pods with new ones. See [link](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#updating-a-deployment https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/#updating-a-daemonset) for more information.
[component].volumes- type:
[]object
Specify additional volumes in the different components (Datadog Agent, Cluster Agent, Cluster Check Runner).
For a complete list of parameters, see the Operator configuration spec.