Allow using FIPS variants of ddot-collector and agent -full images by agagniere · Pull Request #2605 · DataDog/datadog-operator

agagniere · 2026-02-13T13:49:39Z

Preserve useFIPSAgent setting when overriding the agent version tag

What does this PR do?

useFIPSAgent setting now applies to agent -full and ddot-collector images.

Motivation

We will start publishing FIPS variants of those images soon: DataDog/datadog-agent#46053

OTAGENT-845

Additional Notes

Important point to review:

Previously, setting override.nodeAgent.image.tag to e.g. 7.75.3, with global.useFIPSAgent set to true, would result in node agents using the non-FIPS agent:7.75.3.

I changed the behavior to stop discarding the useFIPSAgent setting when overriding the version, in line with the helm chart.

Now we can even set the tag to 7.75.3-full and get agent:7.75.3-fips-full if desired.

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

Both: v7.78.0

can be merged before as the check makes sure the combination is valid

Describe your test plan

I added a few test cases

Checklist

PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
PR has a milestone or the qa/skip-qa label
All commits are signed¹

https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits ↩

codecov-commenter · 2026-02-13T14:16:29Z

Codecov Report

❌ Patch coverage is 76.92308% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 39.19%. Comparing base (4a814a5) to head (660cbb4).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...al/controller/datadogagent/component_reconciler.go	0.00%	3 Missing and 1 partial ⚠️
...troller/datadogagent/controller_reconcile_agent.go	0.00%	3 Missing and 1 partial ⚠️
...oller/datadogagentinternal/component_reconciler.go	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2605      +/-   ##
==========================================
+ Coverage   38.94%   39.19%   +0.25%     
==========================================
  Files         313      314       +1     
  Lines       27134    27403     +269     
==========================================
+ Hits        10567    10741     +174     
- Misses      15778    15865      +87     
- Partials      789      797       +8

Flag	Coverage Δ
unittests	`39.19% <76.92%> (+0.25%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/controller/datadogagent/global/global.go	`55.09% <100.00%> (+1.95%)`	⬆️
pkg/images/images.go	`97.34% <100.00%> (-0.24%)`	⬇️
...al/controller/datadogagent/component_reconciler.go	`71.71% <0.00%> (-3.02%)`	⬇️
...troller/datadogagent/controller_reconcile_agent.go	`65.62% <0.00%> (-0.84%)`	⬇️
...oller/datadogagentinternal/component_reconciler.go	`0.00% <0.00%> (ø)`

... and 5 files with indirect coverage changes

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4a814a5...660cbb4. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 482fefbed0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

pkg/images/images.go

levan-m · 2026-03-27T19:09:20Z

pkg/images/images_test.go

 				isFull:   true,
 			},
-			want: "gcr.io/datadoghq/agent:7.64.0-fips-jmx",
+			want: "gcr.io/datadoghq/agent:7.64.0-fips-full",


Does fips-full include jmx?

Yes, see https://github.com/DataDog/datadog-agent/blob/main/.gitlab/deploy/container_build/docker_linux.yml#L398

--build-arg WITH_JMX=true --build-arg WITH_JMX_FIPS=true

pkg/images/images_test.go

levan-m · 2026-03-27T19:12:11Z

pkg/images/images.go

+	if !i.isFIPS {
+		return nil
+	}
+	if i.isFull || i.name == DefaultDdotCollectorImageName {


This is called from applyGlobalSettings which is based on internal default and global registry, so it can't have a full suffix or be any version other than one hardcoded in this file. So it will either always error without user being able to do anything about it or be a dead code once default is 7.78+. We can drop this and wait for 7.78 bump and then merge this change.

Good catch, I had indeed placed my check at the wrong place, I now placed it after the override, which was my intent.

Preserve useFIPSAgent setting when overriding the agent version tag

Parse tag suffixes right to left (Full -> JMX -> FIPS) in fromImageConfig, matching the existing logic in FromString. Previously, checking FIPS before Full meant that -fips-full tags were misidentified: the FIPS flag was missed and -fips was left in the base tag, leading to double suffixes like -fips-fips-full when combined with a FIPS-enabled current image. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Extract parseTagSuffixes helper and use it in both FromString and fromImageConfig. When the name contains a tag, fromImageConfig now delegates directly to FromString instead of duplicating the logic. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…w 7.78

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

mackjmr · 2026-03-31T11:55:15Z

pkg/images/images.go

-			WithFull(overrideImage.isFull)
+		// Only override FIPS/Full if they're explicitly present in the override tag
+		// Otherwise preserve current settings (from global.useFIPSAgent or existing image)
+		if overrideImage.isFIPS {


I think user overrides should take precedence over useFips, so this can be:

image.WithFIPS(overrideImage.isFIPS). image.WithFull(overrideImage.isFull)

IMO client override should take precedence over other settings, if they hardcode something in that use it. Middle ground would be to log an error/ error out when they override to a non fips image tag + add useFips, as it may be risky to run a non fips image if useFips was set

I'll defere to @levan-m, what do we do in core agent when useFips is true but user overrides image tag to a non fips image ?

Reverted to previous behavior

agagniere added this to the v1.25.0 milestone Feb 13, 2026

agagniere requested a review from mackjmr February 13, 2026 13:49

agagniere self-assigned this Feb 13, 2026

agagniere added enhancement New feature or request do-not-merge labels Feb 13, 2026

agagniere force-pushed the agagniere/fips-full-and-ddot-fips branch from fdb5e60 to ea11e23 Compare February 13, 2026 13:59

agagniere changed the title ~~Allow using FIPS variants of ddot-collector and agent -full image.~~ Allow using FIPS variants of ddot-collector and agent -full images Feb 13, 2026

levan-m removed this from the v1.25.0 milestone Mar 3, 2026

agagniere force-pushed the agagniere/fips-full-and-ddot-fips branch from ea11e23 to 482fefb Compare March 23, 2026 15:22

agagniere added this to the v1.26.0 milestone Mar 23, 2026

agagniere marked this pull request as ready for review March 23, 2026 15:26

agagniere requested a review from a team March 23, 2026 15:26

agagniere removed the do-not-merge label Mar 23, 2026

chatgpt-codex-connector bot reviewed Mar 23, 2026

View reviewed changes

pkg/images/images.go Outdated Show resolved Hide resolved

pkg/images/images.go Outdated Show resolved Hide resolved

agagniere force-pushed the agagniere/fips-full-and-ddot-fips branch from f0ea705 to 5c1726e Compare March 26, 2026 17:51

github-actions bot added the team/container-platform label Mar 26, 2026

agagniere force-pushed the agagniere/fips-full-and-ddot-fips branch from 5c1726e to 6d35212 Compare March 27, 2026 14:46

agagniere requested a review from a team as a code owner March 27, 2026 14:46

agagniere requested a review from asopkin March 27, 2026 14:46

github-actions bot added the team/opentelemetry label Mar 27, 2026

levan-m requested changes Mar 27, 2026

View reviewed changes

agagniere and others added 8 commits March 30, 2026 17:47

Allow using FIPS variants of ddot-collector and agent -full image.

085d0a9

Preserve useFIPSAgent setting when overriding the agent version tag

Fail with a clear error when requesting DDOT + FIPS with version belo…

4c0e66e

…w 7.78

Add tests for the DDOT FIPS check

32a6491

Fix GetGlobalSettingsFunc return type in datadogagentinternal

f59ac21

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Test applyGlobalSettings

8530ca4

Move the DDOT FIPS version check after the overrides

df0544d

agagniere force-pushed the agagniere/fips-full-and-ddot-fips branch from b5b4eb5 to df0544d Compare March 31, 2026 09:28

github-actions bot removed the team/opentelemetry label Mar 31, 2026

mackjmr reviewed Mar 31, 2026

View reviewed changes

agagniere added 2 commits March 31, 2026 14:15

Revert useFIPSAgent having precendence over overrides

e273cc5

Update tests for new behavior

660cbb4

agagniere requested a review from levan-m March 31, 2026 14:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow using FIPS variants of ddot-collector and agent -full images#2605

Allow using FIPS variants of ddot-collector and agent -full images#2605
agagniere wants to merge 10 commits intomainfrom
agagniere/fips-full-and-ddot-fips

agagniere commented Feb 13, 2026 •

edited by atlassian bot

Loading

Uh oh!

codecov-commenter commented Feb 13, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

Uh oh!

levan-m Mar 27, 2026

Uh oh!

agagniere Mar 27, 2026

Uh oh!

Uh oh!

levan-m Mar 27, 2026

Uh oh!

agagniere Mar 31, 2026

Uh oh!

mackjmr Mar 31, 2026

Uh oh!

mackjmr Mar 31, 2026

Uh oh!

agagniere Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

agagniere commented Feb 13, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Additional Notes

Minimum Agent Versions

Describe your test plan

Checklist

Footnotes

Uh oh!

codecov-commenter commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

levan-m Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

agagniere Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

levan-m Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

agagniere Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

mackjmr Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

mackjmr Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

agagniere Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

agagniere commented Feb 13, 2026 •

edited by atlassian bot

Loading

codecov-commenter commented Feb 13, 2026 •

edited

Loading