Add global.vsock with full/system-probe modes (system-probe <=> micro VM VSock)

api/datadoghq/v2alpha1/datadogagent_types.go

@@ -1909,8 +1909,43 @@ type GlobalConfig struct {
 
 	// UseVSock allows the use of VSock communication between the Agent and containerized workloads.
 	// Default: 'false'
+	// Deprecated: Use VSock.Enabled instead. When VSock is set, this field is ignored.
 	// +optional
 	UseVSock *bool `json:"useVSock,omitempty"`
+
+	// VSock configures VSock communication for the Agent.
+	// +optional
+	VSock *VSockConfig `json:"vsock,omitempty"`
+}
+
+// VSockMode controls which Agent components communicate over VSock.
+// +kubebuilder:validation:Enum=full;system-probe
+type VSockMode string
+
+const (
+	// VSockModeFull enables VSock communication between the Agent and containerized workloads
+	// for all Agent components. This is the default and matches the legacy UseVSock behavior.
+	VSockModeFull VSockMode = "full"
+	// VSockModeSystemProbe scopes VSock communication to the CWS runtime-security event gRPC
+	// server only, allowing the system-probe running inside a micro VM to forward events to the
+	// host system-probe over VSock. All other Agent communications use the regular TCP/unix
+	// socket transport. This mode requires features.cws.directSendFromSystemProbe to be enabled,
+	// since the host system-probe no longer exposes the unix socket the security-agent connects to.
+	VSockModeSystemProbe VSockMode = "system-probe"
+)
+
+// VSockConfig configures VSock communication for the Agent.
+type VSockConfig struct {
+	// Enabled enables VSock communication.
+	// Default: 'false'
+	// +optional
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// Mode controls which Agent components communicate over VSock.
+	// "full" (default): all Agent components communicate over VSock.
+	// "system-probe": only the CWS system-probe <=> micro VM system-probe communication uses VSock.
+	// +optional
+	Mode *VSockMode `json:"mode,omitempty"`
 }
 
 // DatadogCredentials is a generic structure that holds credentials to access Datadog.

api/datadoghq/v2alpha1/datadogagent_validation.go

@@ -5,7 +5,11 @@
 
 package v2alpha1
 
-import "fmt"
+import (
+	"fmt"
+
+	apiutils "github.com/DataDog/datadog-operator/api/utils"
+)
 
 // ValidateDatadogAgent is used to check if a DatadogAgent is valid
 func ValidateDatadogAgent(dda *DatadogAgent) error {
@@ -14,5 +18,30 @@ func ValidateDatadogAgent(dda *DatadogAgent) error {
 	if dda.Spec.Global == nil || dda.Spec.Global.Credentials == nil {
 		return fmt.Errorf("credentials not configured in the DatadogAgent, can't reconcile")
 	}
+
+	if err := validateVSock(&dda.Spec); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// validateVSock ensures the VSock configuration is consistent with the features that rely on it.
+func validateVSock(spec *DatadogAgentSpec) error {
+	vsockEnabled, vsockMode := spec.Global.GetVSockConfig()
+	if !vsockEnabled || vsockMode != VSockModeSystemProbe {
+		return nil
+	}
+
+	// In SystemProbe mode the host system-probe hosts the runtime-security event server over
+	// VSock and no longer exposes the unix socket the security-agent connects to, so CWS must
+	// send payloads directly from the system-probe.
+	if spec.Features == nil || spec.Features.CWS == nil || !apiutils.BoolValue(spec.Features.CWS.Enabled) {
+		return nil
+	}
+	if !apiutils.BoolValue(spec.Features.CWS.DirectSendFromSystemProbe) {
+		return fmt.Errorf("global.vsock.mode %q requires features.cws.directSendFromSystemProbe to be enabled", VSockModeSystemProbe)
+	}
+
 	return nil
 }

api/datadoghq/v2alpha1/datadogagent_validation_test.go

@@ -0,0 +1,102 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+package v2alpha1
+
+import (
+	"testing"
+
+	"k8s.io/utils/ptr"
+)
+
+func Test_validateVSock(t *testing.T) {
+	tests := []struct {
+		name    string
+		spec    *DatadogAgentSpec
+		wantErr bool
+	}{
+		{
+			name:    "no global - no error",
+			spec:    &DatadogAgentSpec{},
+			wantErr: false,
+		},
+		{
+			name: "vsock disabled - no error",
+			spec: &DatadogAgentSpec{
+				Global: &GlobalConfig{},
+			},
+			wantErr: false,
+		},
+		{
+			name: "vsock Full mode + CWS without directSend - no error",
+			spec: &DatadogAgentSpec{
+				Global: &GlobalConfig{
+					VSock: &VSockConfig{Enabled: ptr.To(true), Mode: ptr.To(VSockModeFull)},
+				},
+				Features: &DatadogFeatures{
+					CWS: &CWSFeatureConfig{Enabled: ptr.To(true)},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "deprecated useVSock (maps to Full) + CWS without directSend - no error",
+			spec: &DatadogAgentSpec{
+				Global: &GlobalConfig{
+					UseVSock: ptr.To(true),
+				},
+				Features: &DatadogFeatures{
+					CWS: &CWSFeatureConfig{Enabled: ptr.To(true)},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "vsock SystemProbe mode + CWS disabled - no error",
+			spec: &DatadogAgentSpec{
+				Global: &GlobalConfig{
+					VSock: &VSockConfig{Enabled: ptr.To(true), Mode: ptr.To(VSockModeSystemProbe)},
+				},
+				Features: &DatadogFeatures{
+					CWS: &CWSFeatureConfig{Enabled: ptr.To(false)},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "vsock SystemProbe mode + CWS enabled + directSend - no error",
+			spec: &DatadogAgentSpec{
+				Global: &GlobalConfig{
+					VSock: &VSockConfig{Enabled: ptr.To(true), Mode: ptr.To(VSockModeSystemProbe)},
+				},
+				Features: &DatadogFeatures{
+					CWS: &CWSFeatureConfig{Enabled: ptr.To(true), DirectSendFromSystemProbe: ptr.To(true)},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "vsock SystemProbe mode + CWS enabled without directSend - error",
+			spec: &DatadogAgentSpec{
+				Global: &GlobalConfig{
+					VSock: &VSockConfig{Enabled: ptr.To(true), Mode: ptr.To(VSockModeSystemProbe)},
+				},
+				Features: &DatadogFeatures{
+					CWS: &CWSFeatureConfig{Enabled: ptr.To(true)},
+				},
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateVSock(tt.spec)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateVSock() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}

api/datadoghq/v2alpha1/vsock.go

@@ -0,0 +1,38 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+package v2alpha1
+
+// GetVSockConfig resolves the effective VSock configuration from the GlobalConfig,
+// taking into account the deprecated UseVSock field.
+//
+// The new VSock section takes precedence: when the VSock section is set, the
+// deprecated UseVSock field is ignored. When the VSock section is absent, UseVSock
+// is honored for backward compatibility and maps to the "full" mode.
+//
+// It returns whether VSock communication is enabled and the mode that controls which
+// Agent components communicate over VSock (defaulting to VSockModeFull).
+func (g *GlobalConfig) GetVSockConfig() (enabled bool, mode VSockMode) {
+	mode = VSockModeFull
+	if g == nil {
+		return false, mode
+	}
+
+	if g.VSock != nil {
+		if g.VSock.Enabled != nil {
+			enabled = *g.VSock.Enabled
+		}
+		if g.VSock.Mode != nil {
+			mode = *g.VSock.Mode
+		}
+		return enabled, mode
+	}
+
+	// Backward compatibility with the deprecated UseVSock field.
+	if g.UseVSock != nil {
+		enabled = *g.UseVSock
+	}
+	return enabled, mode
+}

config/crd/bases/v1/datadoghq.com_datadogagentinternals.yaml

@@ -3689,7 +3689,26 @@ spec:
                       description: |-
                         UseVSock allows the use of VSock communication between the Agent and containerized workloads.
                         Default: 'false'
+                        Deprecated: Use VSock.Enabled instead. When VSock is set, this field is ignored.
                       type: boolean
+                    vsock:
+                      description: VSock configures VSock communication for the Agent.
+                      properties:
+                        enabled:
+                          description: |-
+                            Enabled enables VSock communication.
+                            Default: 'false'
+                          type: boolean
+                        mode:
+                          description: |-
+                            Mode controls which Agent components communicate over VSock.
+                            "full" (default): all Agent components communicate over VSock.
+                            "system-probe": only the CWS system-probe <=> micro VM system-probe communication uses VSock.
+                          enum:
+                            - full
+                            - system-probe
+                          type: string
+                      type: object
                   type: object
                 override:
                   additionalProperties:

config/crd/bases/v1/datadoghq.com_datadogagentinternals_v1alpha1.json

@@ -3823,8 +3823,27 @@
               "type": "boolean"
             },
             "useVSock": {
-              "description": "UseVSock allows the use of VSock communication between the Agent and containerized workloads.\nDefault: 'false'",
+              "description": "UseVSock allows the use of VSock communication between the Agent and containerized workloads.\nDefault: 'false'\nDeprecated: Use VSock.Enabled instead. When VSock is set, this field is ignored.",
               "type": "boolean"
+            },
+            "vsock": {
+              "additionalProperties": false,
+              "description": "VSock configures VSock communication for the Agent.",
+              "properties": {
+                "enabled": {
+                  "description": "Enabled enables VSock communication.\nDefault: 'false'",
+                  "type": "boolean"
+                },
+                "mode": {
+                  "description": "Mode controls which Agent components communicate over VSock.\n\"full\" (default): all Agent components communicate over VSock.\n\"system-probe\": only the CWS system-probe \u003c=\u003e micro VM system-probe communication uses VSock.",
+                  "enum": [
+                    "full",
+                    "system-probe"
+                  ],
+                  "type": "string"
+                }
+              },
+              "type": "object"
             }
           },
           "type": "object"

config/crd/bases/v1/datadoghq.com_datadogagentprofiles.yaml

@@ -3689,7 +3689,26 @@ spec:
                           description: |-
                             UseVSock allows the use of VSock communication between the Agent and containerized workloads.
                             Default: 'false'
+                            Deprecated: Use VSock.Enabled instead. When VSock is set, this field is ignored.
                           type: boolean
+                        vsock:
+                          description: VSock configures VSock communication for the Agent.
+                          properties:
+                            enabled:
+                              description: |-
+                                Enabled enables VSock communication.
+                                Default: 'false'
+                              type: boolean
+                            mode:
+                              description: |-
+                                Mode controls which Agent components communicate over VSock.
+                                "full" (default): all Agent components communicate over VSock.
+                                "system-probe": only the CWS system-probe <=> micro VM system-probe communication uses VSock.
+                              enum:
+                                - full
+                                - system-probe
+                              type: string
+                          type: object
                       type: object
                     override:
                       additionalProperties:

config/crd/bases/v1/datadoghq.com_datadogagentprofiles_v1alpha1.json

@@ -3827,8 +3827,27 @@
                   "type": "boolean"
                 },
                 "useVSock": {
-                  "description": "UseVSock allows the use of VSock communication between the Agent and containerized workloads.\nDefault: 'false'",
+                  "description": "UseVSock allows the use of VSock communication between the Agent and containerized workloads.\nDefault: 'false'\nDeprecated: Use VSock.Enabled instead. When VSock is set, this field is ignored.",
                   "type": "boolean"
+                },
+                "vsock": {
+                  "additionalProperties": false,
+                  "description": "VSock configures VSock communication for the Agent.",
+                  "properties": {
+                    "enabled": {
+                      "description": "Enabled enables VSock communication.\nDefault: 'false'",
+                      "type": "boolean"
+                    },
+                    "mode": {
+                      "description": "Mode controls which Agent components communicate over VSock.\n\"full\" (default): all Agent components communicate over VSock.\n\"system-probe\": only the CWS system-probe \u003c=\u003e micro VM system-probe communication uses VSock.",
+                      "enum": [
+                        "full",
+                        "system-probe"
+                      ],
+                      "type": "string"
+                    }
+                  },
+                  "type": "object"
                 }
               },
               "type": "object"