---
# This file has been generated by `helm template datadog-agent datadog/datadog` from datadog/templates/cluster-agent-rbac.yaml. Please re-run `generate.sh` rather than modifying this file manually.
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  labels:
    app: "datadog"
    chart: "datadog-3.246.0"
    heritage: "Helm"
    release: "datadog"
  name: datadog-cluster-agent
  namespace: default
---
# This file has been generated by `helm template datadog-agent datadog/datadog` from datadog/templates/cluster-agent-rbac.yaml. Please re-run `generate.sh` rather than modifying this file manually.
apiVersion: "rbac.authorization.k8s.io/v1"
kind: ClusterRole
metadata:
  labels: {}
  name: datadog-cluster-agent
rules:
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
      - pods
      - nodes
      - namespaces
      - componentstatuses
      - limitranges
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
      - create
  - apiGroups:
      - "discovery.k8s.io"
    resources:
      - endpointslices
    verbs:
      - get
      - list
      - watch
  - apiGroups: ["quota.openshift.io"]
    resources:
      - clusterresourcequotas
    verbs:
      - get
      - list
  - apiGroups:
      - "autoscaling"
    resources:
      - horizontalpodautoscalers
    verbs:
      - list
      - watch
  - apiGroups:
      - "datadoghq.com"
    resources:
      - "datadoginstrumentations"
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "datadoghq.com"
    resources:
      - "datadoginstrumentations/status"
    verbs:
      - patch
      - update
  - apiGroups:
      - ""
    resources:
      - configmaps
    resourceNames:
      - datadogtoken # Kubernetes event collection state
      - datadogtoken # Kept for backward compatibility with agent <7.37.0
    verbs:
      - get
      - update
  - apiGroups:
      - ""
    resources:
      - configmaps
    resourceNames:
      - datadog-leader-election # Leader election token
      - datadog-leader-election # Kept for backward compatibility with agent <7.37.0
      - datadog-custom-metrics
    verbs:
      - get
      - update
  - apiGroups:
      - "coordination.k8s.io"
    resources:
      - leases
    resourceNames:
      - datadog-leader-election # Leader election token
    verbs:
      - get
      - update
  - apiGroups:
      - "coordination.k8s.io"
    resources:
      - leases
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - configmaps
    resourceNames:
      - extension-apiserver-authentication
    verbs:
      - get
      - list
      - watch
  - apiGroups: # To create the leader election token and hpa events
      - ""
    resources:
      - configmaps
      - events
    verbs:
      - create
  - nonResourceURLs:
      - "/version"
      - "/healthz"
      - "/metrics"
    verbs:
      - get
  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - validatingwebhookconfigurations
      - mutatingwebhookconfigurations
    resourceNames:
      - "datadog-webhook"
    verbs: ["get", "list", "watch", "update", "delete"]
  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - validatingwebhookconfigurations
      - mutatingwebhookconfigurations
    verbs: ["create"]
  - apiGroups: ["batch"]
    resources: ["jobs", "cronjobs"]
    verbs: ["get"]
  - apiGroups: ["apps"]
    resources: ["statefulsets", "replicasets", "deployments", "daemonsets"]
    verbs: ["get"]
  - apiGroups: [""]
    resources: ["replicationcontrollers"]
    verbs: ["get"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["csidrivers"]
    verbs: ["get", "list", "watch"]
  - apiGroups:
      - "security.openshift.io"
    resources:
      - securitycontextconstraints
    verbs:
      - use
    resourceNames:
      - datadog-cluster-agent
      - hostnetwork
  # Used by datadog.appsec.injector feature.
  # These rules are intentionally present by default, not gated behind
  # `datadog.appsec.injector.enabled`: the cluster-agent injector controller
  # creates cluster resources (Backend / EnvoyExtensionPolicy / EnvoyFilter /
  # ReferenceGrant / ConfigMap copies) and patches user Gateways. Retaining
  # get/list/delete/patch when the feature is disabled lets the controller clean
  # up those resources instead of orphaning them.
  - apiGroups:
      - "gateway.networking.k8s.io"
    resources:
      - gateways
      - gatewayclasses
    verbs:
      - get
      - list
      - watch
      - patch
  - apiGroups:
      - "gateway.networking.k8s.io"
    resources:
      - referencegrants
    verbs:
      - get
      - delete
      - create
      - patch
  - apiGroups:
      - "gateway.envoyproxy.io"
    resources:
      - envoyextensionpolicies
      - backends
    verbs:
      - get
      - delete
      - create
  - apiGroups:
      - "networking.istio.io"
    resources:
      - envoyfilters
    verbs:
      - get
      - create
      - delete
  - apiGroups:
      - "networking.istio.io"
    resources:
      - gateways
    verbs:
      - get
      - list
      - watch
  # AppSec proxy injection - ingress-nginx
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingressclasses"]
    verbs: ["get", "list", "watch"]
  # AppSec proxy injection - ingress-nginx ConfigMap management
  # SECURITY CONSIDERATION: These permissions are cluster-wide and unscoped.
  # ConfigMap names are derived dynamically from the controller's --configmap arg
  # (e.g. datadog-appsec-<original-name>) and cannot be predicted at RBAC
  # definition time. The watch verb is needed for the ConfigMap reconciler that
  # keeps DD copies in sync with originals. In practice, the code only operates
  # on ConfigMaps with the labels
  #   appsec.datadoghq.com/watched-configmap=true       (reconciler)
  #   app.kubernetes.io/component=datadog-appsec-injector (cleanup)
  # Consider namespace-scoped Roles if the blast radius needs to be reduced.
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch", "create", "update", "delete"]
---
# This file has been generated by `helm template datadog-agent datadog/datadog` from datadog/templates/cluster-agent-rbac.yaml. Please re-run `generate.sh` rather than modifying this file manually.
apiVersion: "rbac.authorization.k8s.io/v1"
kind: ClusterRoleBinding
metadata:
  labels: {}
  name: datadog-cluster-agent
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: datadog-cluster-agent
subjects:
  - kind: ServiceAccount
    name: datadog-cluster-agent
    namespace: default
---
# This file has been generated by `helm template datadog-agent datadog/datadog` from datadog/templates/cluster-agent-rbac.yaml. Please re-run `generate.sh` rather than modifying this file manually.
apiVersion: "rbac.authorization.k8s.io/v1"
kind: ClusterRoleBinding
metadata:
  labels:
    app: "datadog"
    chart: "datadog-3.246.0"
    release: "datadog"
    heritage: "Helm"
  name: datadog-cluster-agent-system-auth-delegator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
  - kind: ServiceAccount
    name: datadog-cluster-agent
    namespace: default
---
# This file has been generated by `helm template datadog-agent datadog/datadog` from datadog/templates/cluster-agent-rbac.yaml. Please re-run `generate.sh` rather than modifying this file manually.
apiVersion: "rbac.authorization.k8s.io/v1"
kind: Role
metadata:
  labels: {}
  name: datadog-cluster-agent-main
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "watch", "update", "create"]
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "update", "create"]
---
# This file has been generated by `helm template datadog-agent datadog/datadog` from datadog/templates/cluster-agent-rbac.yaml. Please re-run `generate.sh` rather than modifying this file manually.
apiVersion: "rbac.authorization.k8s.io/v1"
kind: RoleBinding
metadata:
  labels: {}
  name: "datadog-cluster-agent-main"
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: datadog-cluster-agent-main
subjects:
  - kind: ServiceAccount
    name: datadog-cluster-agent
    namespace: default
---
# This file has been generated by `helm template datadog-agent datadog/datadog` from datadog/templates/cluster-agent-rbac.yaml. Please re-run `generate.sh` rather than modifying this file manually.
apiVersion: "rbac.authorization.k8s.io/v1"
kind: RoleBinding
metadata:
  labels: {}
  name: "datadog-cluster-agent-apiserver"
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
  - kind: ServiceAccount
    name: datadog-cluster-agent
    namespace: default