v1.28.0-rc.3

Changelog

• 9c31609 Add RBAC for Gateway API, service mesh, and ingress controller CRDs (#2874)
• 4e59e1d Add make bundle workflow (#3023)
• 20ecb9e Add missing flock workspace checksum (#3019)
• 65b9d19 Align otel collector config mount with Helm (#3031)
• c86d5e5 Bump default Agent version to 7.79.2 (#3077)
• a4fd8d9 Drop provider arg from Feature interface methods (#3007)
• 03e4b46 E2E Dogstatsd validation (#3033)
• 5301a0c E2E improvements: remove gotoolchain hack, share go cache, stream test output (#3074)
• 1e1aeff Emit Kubernetes events for FA experiment transitions (#3037)
• 079486f Expose workload autoscaling in-place vertical scaling (#3055)
• c85321f FA rollout experiment fixes (#3035)
• 913e801 Fix CVE 2026-39820: bump golang (#3003)
• 6ef503a Fix E2e tests on main (#3064)
• fa3049c Make CNM team owner of the npm feature, not ndm-core (#2998)
• c7d49fe No-op: allow containers-tee to use MQ (#3069)
• 19c5d3f Operator manifest renderer (#2947)
• bd0f5e2 Provider capabilities basic framework and eks.ec2.useHostnameFromFile support (#3009)
• 0ec9665 Reduce operator image chmod layers (#3087)
• 3df38d6 Refactor experiment signals (#2944)
• 071c3fa Release EKS-addon v1.26.0 (#2974)
• 93e1cb6 Release v1.26.0 Google Marketplace and add scripts to update the CRDs from a given tag (#2973)
• 8e0b1e8 Remove non-existent setsidaccept4 syscall from seccomp allowlist (#2992)
• 4d64420 Remove operatorrelease chainguard STS policies (#2993)
• d9789bb Rename agent-all to agent-community-eng (#3089)
• a580b06 Restore system-probe DSD socket volumeMount (#3001)
• 6d3740a Revert "feat: Add APM to DatadogInstrumentation CRD (#2984)" (#3015)
• 3579eb4 Secret management sollutions (#3052)
• 491d342 Stop mounting debugfs in process-agent (#2996)
• f49eb24 Support oomKill, tcpQueueLength features on GKE COS via provider annotation (#3011)
• b2a60a9 Undefined replica count remains undefined (#3036)
• d60ff16 Untaint controller (#2753)
• bed889f Update FIPS proxy version references to 1.1.24 (#2997)
• f70667d Update FIPS proxy version references to 1.1.25 (#3044)
• cab73c6 Update FIPS proxy version references to 1.1.26 (#3067)
• bd00a4a Update Golang to 1.25.11 (#3085)
• 49937bd Update agent image to 7.80.2 (#3155) (#3156)
• dbe65ff Update default agent version to 7.79.1 (#3054)
• 7a0a7a8 Use Ubuntu 26.04 GBI for internal build (#3038)
• 097216f [CASCL-1292] Wire Karpenter check as endpoint check on Fargate (#2999)
• b9f5936 [CASCL-1304] Fix Fargate profile name in dd-cluster-info ConfigMap (#3000)
• 2c675b3 [CASCL-1304] kubectl-datadog: enrich dd-cluster-info ConfigMap (#2980)
• b1ebe71 [CONTP-1585] Add SLO support to DatadogGenericResource (#3070)
• ed139da [CONTP-1589] Add DDGR force sync period configuration (#3043)
• 6b4b5f7 [CONTP-1596]Improve GKE Autopilot support (#3013)
• da5cd49 [CONTP-1639] Refactor CRD metadata collection to use informer (#2979)
• 4d241e3 [CONTP-1702] Support CSI mode in GKE Autopilot (#3094) (#3133)
• 68d9802 [CONTP-1709] Support enabling datadoginstrumentation crd controller (#3002) (#3125)
• 762837d [CONTP-1715] Align Operator to Helm csi daemonset and include csidrivers RBAC for DCA (#3093) (#3132)
• 4a8f342 [Host Profiler] Remove seccomp configmap and use profile baked into image (#3061) (#3107)
• 82a75d4 [Host Profiler] Tighten seccomp profile (#3042)
• f636740 [PROF-14068] Remove privileges for host-profiler (#2953)
• 104bcf9 [codex] Use reachable git tag for build version (#3115) (#3119)
• 7f86fa0 kubectl-datadog: redistribute autoscaling cluster packages by concern (#3012)
• c30557a add octo sts policies for release dashboard (#3066)
• 33d6508 chore(deps): Bump to v0.55.0 (#3105) (#3111)
• f6aeb7b correct policy issuer in staging for release-dashboard-api to ticino (#3071)
• ad3447a discovery: remove networkStats option (#3117) (#3123)
• f7ac48f enable CNM direct send by default (#3045) (#3103)
• 47e8393 enforce min agent version for CNM direct send (#3010)
• 7ef174d feat(appsec): add ingress-nginx proxy injection support (#3053)
• 8b39974 feat(ddgr): surface Datadog Monitor state in CR status (#3047)
• d97a3dc feat: Add APM to DatadogInstrumentation CRD (#2984)
• a1cbe91 fix issuer to vault and correct subject (#3084)
• dad893d fix monitor recreate (#3050)
• 1a48339 fix(appsec): correct envoyproxy RBAC resource typo backend -> backends (#3116) (#3121)
• efb068e fix(dogstatsd): always set DSD environment variables on Core Agent container (#3032)
• 1f58351 fix(rbac): remove stale gateways entry from orchestrator explorer RBAC (#3075)
• 6416ca2 fix: make apm config a pointer (#2995)
• 88d9f7a never let PodTemplateSpec rewrite Host Profiler seccomp init container (#3135) (#3145)
• 5ac71e6 release v1.28.0-rc.1 (#3095)
• 1d862cd release v1.28.0-rc.2 (#3141)
• 9ca69f3 release v1.28.0-rc.3 (#3157)
• 04424c1 update agent image to 7.80.1 (#3134) (#3139)
• e62a2b2 update bundle for 1.27 (#3081)

v1.28.0-rc.2

Changelog

• 9c31609 Add RBAC for Gateway API, service mesh, and ingress controller CRDs (#2874)
• 4e59e1d Add make bundle workflow (#3023)
• 20ecb9e Add missing flock workspace checksum (#3019)
• 65b9d19 Align otel collector config mount with Helm (#3031)
• c86d5e5 Bump default Agent version to 7.79.2 (#3077)
• a4fd8d9 Drop provider arg from Feature interface methods (#3007)
• 03e4b46 E2E Dogstatsd validation (#3033)
• 5301a0c E2E improvements: remove gotoolchain hack, share go cache, stream test output (#3074)
• 1e1aeff Emit Kubernetes events for FA experiment transitions (#3037)
• 079486f Expose workload autoscaling in-place vertical scaling (#3055)
• c85321f FA rollout experiment fixes (#3035)
• 913e801 Fix CVE 2026-39820: bump golang (#3003)
• 6ef503a Fix E2e tests on main (#3064)
• fa3049c Make CNM team owner of the npm feature, not ndm-core (#2998)
• c7d49fe No-op: allow containers-tee to use MQ (#3069)
• 19c5d3f Operator manifest renderer (#2947)
• bd0f5e2 Provider capabilities basic framework and eks.ec2.useHostnameFromFile support (#3009)
• 0ec9665 Reduce operator image chmod layers (#3087)
• 3df38d6 Refactor experiment signals (#2944)
• 071c3fa Release EKS-addon v1.26.0 (#2974)
• 93e1cb6 Release v1.26.0 Google Marketplace and add scripts to update the CRDs from a given tag (#2973)
• 8e0b1e8 Remove non-existent setsidaccept4 syscall from seccomp allowlist (#2992)
• 4d64420 Remove operatorrelease chainguard STS policies (#2993)
• d9789bb Rename agent-all to agent-community-eng (#3089)
• a580b06 Restore system-probe DSD socket volumeMount (#3001)
• 6d3740a Revert "feat: Add APM to DatadogInstrumentation CRD (#2984)" (#3015)
• 3579eb4 Secret management sollutions (#3052)
• 491d342 Stop mounting debugfs in process-agent (#2996)
• f49eb24 Support oomKill, tcpQueueLength features on GKE COS via provider annotation (#3011)
• b2a60a9 Undefined replica count remains undefined (#3036)
• d60ff16 Untaint controller (#2753)
• bed889f Update FIPS proxy version references to 1.1.24 (#2997)
• f70667d Update FIPS proxy version references to 1.1.25 (#3044)
• cab73c6 Update FIPS proxy version references to 1.1.26 (#3067)
• bd00a4a Update Golang to 1.25.11 (#3085)
• dbe65ff Update default agent version to 7.79.1 (#3054)
• 7a0a7a8 Use Ubuntu 26.04 GBI for internal build (#3038)
• 097216f [CASCL-1292] Wire Karpenter check as endpoint check on Fargate (#2999)
• b9f5936 [CASCL-1304] Fix Fargate profile name in dd-cluster-info ConfigMap (#3000)
• 2c675b3 [CASCL-1304] kubectl-datadog: enrich dd-cluster-info ConfigMap (#2980)
• b1ebe71 [CONTP-1585] Add SLO support to DatadogGenericResource (#3070)
• ed139da [CONTP-1589] Add DDGR force sync period configuration (#3043)
• 6b4b5f7 [CONTP-1596]Improve GKE Autopilot support (#3013)
• da5cd49 [CONTP-1639] Refactor CRD metadata collection to use informer (#2979)
• 4d241e3 [CONTP-1702] Support CSI mode in GKE Autopilot (#3094) (#3133)
• 68d9802 [CONTP-1709] Support enabling datadoginstrumentation crd controller (#3002) (#3125)
• 762837d [CONTP-1715] Align Operator to Helm csi daemonset and include csidrivers RBAC for DCA (#3093) (#3132)
• 4a8f342 [Host Profiler] Remove seccomp configmap and use profile baked into image (#3061) (#3107)
• 82a75d4 [Host Profiler] Tighten seccomp profile (#3042)
• f636740 [PROF-14068] Remove privileges for host-profiler (#2953)
• 104bcf9 [codex] Use reachable git tag for build version (#3115) (#3119)
• 7f86fa0 kubectl-datadog: redistribute autoscaling cluster packages by concern (#3012)
• c30557a add octo sts policies for release dashboard (#3066)
• 33d6508 chore(deps): Bump to v0.55.0 (#3105) (#3111)
• f6aeb7b correct policy issuer in staging for release-dashboard-api to ticino (#3071)
• ad3447a discovery: remove networkStats option (#3117) (#3123)
• f7ac48f enable CNM direct send by default (#3045) (#3103)
• 47e8393 enforce min agent version for CNM direct send (#3010)
• 7ef174d feat(appsec): add ingress-nginx proxy injection support (#3053)
• 8b39974 feat(ddgr): surface Datadog Monitor state in CR status (#3047)
• d97a3dc feat: Add APM to DatadogInstrumentation CRD (#2984)
• a1cbe91 fix issuer to vault and correct subject (#3084)
• dad893d fix monitor recreate (#3050)
• 1a48339 fix(appsec): correct envoyproxy RBAC resource typo backend -> backends (#3116) (#3121)
• efb068e fix(dogstatsd): always set DSD environment variables on Core Agent container (#3032)
• 1f58351 fix(rbac): remove stale gateways entry from orchestrator explorer RBAC (#3075)
• 6416ca2 fix: make apm config a pointer (#2995)
• 5ac71e6 release v1.28.0-rc.1 (#3095)
• 1d862cd release v1.28.0-rc.2 (#3141)
• 04424c1 update agent image to 7.80.1 (#3134) (#3139)
• e62a2b2 update bundle for 1.27 (#3081)

v1.27.1

Changelog

• 509ac59 [codex] Use reachable git tag for build version (#3115) (#3118)
• f683209 chore(deps): Bump to v0.55.0 (#3105) (#3110)
• 2895962 release v1.27.1 (#3122)
• ab91a53 release v1.27.1-rc.1 (#3113)

v1.27.1-rc.1

Changelog

• f683209 chore(deps): Bump to v0.55.0 (#3105) (#3110)
• ab91a53 release v1.27.1-rc.1 (#3113)

v1.28.0-rc.1

Changelog

• 9c31609 Add RBAC for Gateway API, service mesh, and ingress controller CRDs (#2874)
• 4e59e1d Add make bundle workflow (#3023)
• 20ecb9e Add missing flock workspace checksum (#3019)
• 65b9d19 Align otel collector config mount with Helm (#3031)
• c86d5e5 Bump default Agent version to 7.79.2 (#3077)
• a4fd8d9 Drop provider arg from Feature interface methods (#3007)
• 03e4b46 E2E Dogstatsd validation (#3033)
• 5301a0c E2E improvements: remove gotoolchain hack, share go cache, stream test output (#3074)
• 1e1aeff Emit Kubernetes events for FA experiment transitions (#3037)
• 079486f Expose workload autoscaling in-place vertical scaling (#3055)
• c85321f FA rollout experiment fixes (#3035)
• 913e801 Fix CVE 2026-39820: bump golang (#3003)
• 6ef503a Fix E2e tests on main (#3064)
• fa3049c Make CNM team owner of the npm feature, not ndm-core (#2998)
• c7d49fe No-op: allow containers-tee to use MQ (#3069)
• 19c5d3f Operator manifest renderer (#2947)
• bd0f5e2 Provider capabilities basic framework and eks.ec2.useHostnameFromFile support (#3009)
• 0ec9665 Reduce operator image chmod layers (#3087)
• 3df38d6 Refactor experiment signals (#2944)
• 071c3fa Release EKS-addon v1.26.0 (#2974)
• 93e1cb6 Release v1.26.0 Google Marketplace and add scripts to update the CRDs from a given tag (#2973)
• 8e0b1e8 Remove non-existent setsidaccept4 syscall from seccomp allowlist (#2992)
• 4d64420 Remove operatorrelease chainguard STS policies (#2993)
• d9789bb Rename agent-all to agent-community-eng (#3089)
• a580b06 Restore system-probe DSD socket volumeMount (#3001)
• 6d3740a Revert "feat: Add APM to DatadogInstrumentation CRD (#2984)" (#3015)
• 3579eb4 Secret management sollutions (#3052)
• 491d342 Stop mounting debugfs in process-agent (#2996)
• f49eb24 Support oomKill, tcpQueueLength features on GKE COS via provider annotation (#3011)
• b2a60a9 Undefined replica count remains undefined (#3036)
• d60ff16 Untaint controller (#2753)
• bed889f Update FIPS proxy version references to 1.1.24 (#2997)
• f70667d Update FIPS proxy version references to 1.1.25 (#3044)
• cab73c6 Update FIPS proxy version references to 1.1.26 (#3067)
• bd00a4a Update Golang to 1.25.11 (#3085)
• dbe65ff Update default agent version to 7.79.1 (#3054)
• 7a0a7a8 Use Ubuntu 26.04 GBI for internal build (#3038)
• 097216f [CASCL-1292] Wire Karpenter check as endpoint check on Fargate (#2999)
• b9f5936 [CASCL-1304] Fix Fargate profile name in dd-cluster-info ConfigMap (#3000)
• 2c675b3 [CASCL-1304] kubectl-datadog: enrich dd-cluster-info ConfigMap (#2980)
• b1ebe71 [CONTP-1585] Add SLO support to DatadogGenericResource (#3070)
• ed139da [CONTP-1589] Add DDGR force sync period configuration (#3043)
• 6b4b5f7 [CONTP-1596]Improve GKE Autopilot support (#3013)
• da5cd49 [CONTP-1639] Refactor CRD metadata collection to use informer (#2979)
• 82a75d4 [Host Profiler] Tighten seccomp profile (#3042)
• f636740 [PROF-14068] Remove privileges for host-profiler (#2953)
• 7f86fa0 kubectl-datadog: redistribute autoscaling cluster packages by concern (#3012)
• c30557a add octo sts policies for release dashboard (#3066)
• f6aeb7b correct policy issuer in staging for release-dashboard-api to ticino (#3071)
• 47e8393 enforce min agent version for CNM direct send (#3010)
• 7ef174d feat(appsec): add ingress-nginx proxy injection support (#3053)
• 8b39974 feat(ddgr): surface Datadog Monitor state in CR status (#3047)
• d97a3dc feat: Add APM to DatadogInstrumentation CRD (#2984)
• a1cbe91 fix issuer to vault and correct subject (#3084)
• dad893d fix monitor recreate (#3050)
• efb068e fix(dogstatsd): always set DSD environment variables on Core Agent container (#3032)
• 1f58351 fix(rbac): remove stale gateways entry from orchestrator explorer RBAC (#3075)
• 6416ca2 fix: make apm config a pointer (#2995)
• 5ac71e6 release v1.28.0-rc.1 (#3095)
• e62a2b2 update bundle for 1.27 (#3081)

v1.27.0

Changelog

• 79c0824 (No-op) SA1019: Remove deprecated functions usage (#2478)
• c08166e Add KILL capability to CSPM container (#2931)
• ab3acdb Add SBOM enrichment usage CRD field for "package in use" feature (#2908)
• f41ef99 Add cache namespace options for DatadogCSIDriver controller (#2934)
• c7b7f58 Add code-coverage.datadog.yml (#2893)
• 0dcbf67 Add experiment signals to fleet remote config (#2872)
• 97a7761 Add writev and shutdown to system-probe seccomp profile (#2986)
• 540be47 Align tmp/run volume names and remove system-probe DogStatsD mount (#2985)
• 41dddf7 Always clean DDA before next test to avoid races (#2954)
• d09fcb3 Avoid RBAC errors when Operator can't list or watch ConfigMaps (#2889)
• dc24a2c Bump default Agent version to 7.79.2 (#3077) (#3078)
• 039572f Comment out flaky test (#2932)
• d67ed03 Emit Kubernetes events for FA experiment transitions (#3037) (#3051)
• 68f6e13 FA rollout experiment fixes (#3035) (#3049)
• 9678903 Fix AppArmor annotations for absent containers in annotation overrides (#2897)
• a97d1de Fix CVE 2026-39820: bump golang (#3003) (#3005)
• ea99112 Fix E2e tests on main (#3064) (#3068)
• 658de74 Migrate kubectl-datadog autoscaling cluster to client-go pager (#2960)
• 881aa65 Refactor experiment signals (#2944) (#3016)
• d94085f Remove DatadogAgentEnabled flag (#2912)
• b066672 Restore system-probe DSD socket volumeMount (#3001) (#3006)
• 8653f51 Revert "feat: Add APM to DatadogInstrumentation CRD (#2984)" (#3015) (#3017)
• 4e9c1ab Sync operator 1.26.0 bundle to main (#2972)
• 59f9e3d Update Chaingaurd for Release Worker (#2977)
• 6714de3 Update FIPS proxy version references to 1.1.25 (#3044) (#3046)
• a4b7a6d Update FIPS proxy version references to 1.1.26 (#3067) (#3076)
• 56159c6 Update CLAUDE.md to reference AGENTS.md and lean out AGENTS.md replacing agent.md (#2905)
• ef88adb Update code-owners to otel-agent team and move QA cards to their board (#2895)
• d5f00bf Update default Agent version to 7.78.1 and update CSI default tag to 1.2.2 (#2939)
• 091cc87 Update default agent version to 7.79.1 (#3054) (#3058)
• 4c230b1 Update the documented fips-proxy image tag to latest 1.1.23 release (#2951)
• c2069ff Upgrade karpenter-provider-aws from v1.3.6 to v1.9.0 (#2888)
• 34d375a Use Ubuntu 26.04 GBI for internal build (#3038) (#3041)
• c816592 Use dd-sts OIDC token exchange instead of DD_API_KEY repo secret (#2873)
• b0aad13 Validate AWS account consistency before Karpenter operations (#2892)
• 94725a1 [CASCL-1292] Add Fargate mode to kubectl-datadog install (#2891)
• 654839d [CASCL-1304] Snapshot node managers in ConfigMap during install (#2945)
• 099f33f [CASCL-1305] No-op kubectl-datadog install on a foreign Karpenter (#2949)
• d3652e6 [CASCL-1323] Add update subcommand to kubectl-datadog autoscaling cluster (#2976)
• aad76e3 [CASCL-1323] Extract generic FindKarpenterInstallation helper (#2970)
• 35814b5 [CASCL-1323] chore(kubectl-datadog): split autoscaling install.go into smaller files (#2968)
• abc96a5 [CONS-8253] Propagate DDGR finalizer error (#2919)
• 927e76e [CONTP-1335] organize finalizers (#2879)
• 4fe811a [CONTP-1502] chore: Refresh secrets on reconcile instead of callbacks (#2916)
• e3f69bf [CONTP-1504] Manage DatadogCSIDriver from DatadogAgent (#2857)
• a646370 [CONTP-1547] Push rc-latest mutable image tags from Operator GitLab pipeline (#2903)
• 99a6fc8 [CONTP-1604] When user updates k8s genericresource, force re-create if deleted (#2909)
• 6e2c0c9 [CONTP-1605] [DDGR] Use context based logging and reconcile once, no double get (#2910)
• dcbf3bf [CONTP-1606] [DDGR] Reduce boilerplate: CreateResult, stateful handlers, handler registry (#2911)
• 3628a15 [CONTP-1656] Add datadog instrumentation crd rbac perms (#2975)
• d1d2b65 [CONTP-1656] feat: Add DatadogInstrumentation CRD (#2962)
• 3c567c5 [DOCS-14086] Use dynamic site parameter in Operator config docs (#2978)
• 4c40cf4 [VULN-62334] Update helm.sh/helm/v3 dependency to v3.20.2 (#2969)
• f1faf64 [datadog-operator] Release EKS-addon v1.25.0 (#2881)
• ed1b311 [datadog-operator] Release v1.25.0 Google Marketplace (#2896)
• 1ed0fbc [feature][autoscaling] add Spot scheduling feature and update RBAC (#2957)
• e49c18f kubectl-datadog: delegate OCI image parsing to go-containerregistry (#2971)
• 78490c3 chore: OperatorRelease worker permissions (#2943)
• f11b43c chore: transfer dataplane feature ownership and register agent-data-plane team (#2929)
• 6be3f12 discovery: enable by default on agents >= 7.78 (#2915)
• d3e7b0d dogstatsd: drop DD_USE_DOGSTATSD=false override when dataPlane handles DSD (#2965)
• 953ade2 enhancement: default dataPlane.dogstatsd.enabled to true (#2935)
• 9c04e3d feat(DPA): Add options.burstable + CPURequestsRemoveLimitsMemoryRequestsAndLimits controlled values (#2902)
• 7c966f8 feat(ddgr): add dashboard support (#2906)
• 849be07 feat: Add APM to DatadogInstrumentation CRD (#2984) (#2994)
• 1607b6c fix(dogstatsd): always set DSD environment variables on Core Agent container (#3032) (#3034)
• b6fdaa5 refacto: rename full-host-profiler to host-profiler (#2901)
• 2d50488 release v1.27.0 (#3079)
• 083623f release v1.27.0-rc.1 (#2989)
• 8e158b7 release v1.27.0-rc.2 (#3018)
• 1ad9264 release v1.27.0-rc.3 (#3059)

v1.27.0-rc.3

Changelog

• 79c0824 (No-op) SA1019: Remove deprecated functions usage (#2478)
• c08166e Add KILL capability to CSPM container (#2931)
• ab3acdb Add SBOM enrichment usage CRD field for "package in use" feature (#2908)
• f41ef99 Add cache namespace options for DatadogCSIDriver controller (#2934)
• c7b7f58 Add code-coverage.datadog.yml (#2893)
• 0dcbf67 Add experiment signals to fleet remote config (#2872)
• 97a7761 Add writev and shutdown to system-probe seccomp profile (#2986)
• 540be47 Align tmp/run volume names and remove system-probe DogStatsD mount (#2985)
• 41dddf7 Always clean DDA before next test to avoid races (#2954)
• d09fcb3 Avoid RBAC errors when Operator can't list or watch ConfigMaps (#2889)
• 039572f Comment out flaky test (#2932)
• d67ed03 Emit Kubernetes events for FA experiment transitions (#3037) (#3051)
• 68f6e13 FA rollout experiment fixes (#3035) (#3049)
• 9678903 Fix AppArmor annotations for absent containers in annotation overrides (#2897)
• a97d1de Fix CVE 2026-39820: bump golang (#3003) (#3005)
• 658de74 Migrate kubectl-datadog autoscaling cluster to client-go pager (#2960)
• 881aa65 Refactor experiment signals (#2944) (#3016)
• d94085f Remove DatadogAgentEnabled flag (#2912)
• b066672 Restore system-probe DSD socket volumeMount (#3001) (#3006)
• 8653f51 Revert "feat: Add APM to DatadogInstrumentation CRD (#2984)" (#3015) (#3017)
• 4e9c1ab Sync operator 1.26.0 bundle to main (#2972)
• 59f9e3d Update Chaingaurd for Release Worker (#2977)
• 6714de3 Update FIPS proxy version references to 1.1.25 (#3044) (#3046)
• 56159c6 Update CLAUDE.md to reference AGENTS.md and lean out AGENTS.md replacing agent.md (#2905)
• ef88adb Update code-owners to otel-agent team and move QA cards to their board (#2895)
• d5f00bf Update default Agent version to 7.78.1 and update CSI default tag to 1.2.2 (#2939)
• 091cc87 Update default agent version to 7.79.1 (#3054) (#3058)
• 4c230b1 Update the documented fips-proxy image tag to latest 1.1.23 release (#2951)
• c2069ff Upgrade karpenter-provider-aws from v1.3.6 to v1.9.0 (#2888)
• 34d375a Use Ubuntu 26.04 GBI for internal build (#3038) (#3041)
• c816592 Use dd-sts OIDC token exchange instead of DD_API_KEY repo secret (#2873)
• b0aad13 Validate AWS account consistency before Karpenter operations (#2892)
• 94725a1 [CASCL-1292] Add Fargate mode to kubectl-datadog install (#2891)
• 654839d [CASCL-1304] Snapshot node managers in ConfigMap during install (#2945)
• 099f33f [CASCL-1305] No-op kubectl-datadog install on a foreign Karpenter (#2949)
• d3652e6 [CASCL-1323] Add update subcommand to kubectl-datadog autoscaling cluster (#2976)
• aad76e3 [CASCL-1323] Extract generic FindKarpenterInstallation helper (#2970)
• 35814b5 [CASCL-1323] chore(kubectl-datadog): split autoscaling install.go into smaller files (#2968)
• abc96a5 [CONS-8253] Propagate DDGR finalizer error (#2919)
• 927e76e [CONTP-1335] organize finalizers (#2879)
• 4fe811a [CONTP-1502] chore: Refresh secrets on reconcile instead of callbacks (#2916)
• e3f69bf [CONTP-1504] Manage DatadogCSIDriver from DatadogAgent (#2857)
• a646370 [CONTP-1547] Push rc-latest mutable image tags from Operator GitLab pipeline (#2903)
• 99a6fc8 [CONTP-1604] When user updates k8s genericresource, force re-create if deleted (#2909)
• 6e2c0c9 [CONTP-1605] [DDGR] Use context based logging and reconcile once, no double get (#2910)
• dcbf3bf [CONTP-1606] [DDGR] Reduce boilerplate: CreateResult, stateful handlers, handler registry (#2911)
• 3628a15 [CONTP-1656] Add datadog instrumentation crd rbac perms (#2975)
• d1d2b65 [CONTP-1656] feat: Add DatadogInstrumentation CRD (#2962)
• 3c567c5 [DOCS-14086] Use dynamic site parameter in Operator config docs (#2978)
• 4c40cf4 [VULN-62334] Update helm.sh/helm/v3 dependency to v3.20.2 (#2969)
• f1faf64 [datadog-operator] Release EKS-addon v1.25.0 (#2881)
• ed1b311 [datadog-operator] Release v1.25.0 Google Marketplace (#2896)
• 1ed0fbc [feature][autoscaling] add Spot scheduling feature and update RBAC (#2957)
• e49c18f kubectl-datadog: delegate OCI image parsing to go-containerregistry (#2971)
• 78490c3 chore: OperatorRelease worker permissions (#2943)
• f11b43c chore: transfer dataplane feature ownership and register agent-data-plane team (#2929)
• 6be3f12 discovery: enable by default on agents >= 7.78 (#2915)
• d3e7b0d dogstatsd: drop DD_USE_DOGSTATSD=false override when dataPlane handles DSD (#2965)
• 953ade2 enhancement: default dataPlane.dogstatsd.enabled to true (#2935)
• 9c04e3d feat(DPA): Add options.burstable + CPURequestsRemoveLimitsMemoryRequestsAndLimits controlled values (#2902)
• 7c966f8 feat(ddgr): add dashboard support (#2906)
• 849be07 feat: Add APM to DatadogInstrumentation CRD (#2984) (#2994)
• 1607b6c fix(dogstatsd): always set DSD environment variables on Core Agent container (#3032) (#3034)
• b6fdaa5 refacto: rename full-host-profiler to host-profiler (#2901)
• 083623f release v1.27.0-rc.1 (#2989)
• 8e158b7 release v1.27.0-rc.2 (#3018)
• 1ad9264 release v1.27.0-rc.3 (#3059)

v1.27.0-rc.2

Changelog

• 79c0824 (No-op) SA1019: Remove deprecated functions usage (#2478)
• c08166e Add KILL capability to CSPM container (#2931)
• ab3acdb Add SBOM enrichment usage CRD field for "package in use" feature (#2908)
• f41ef99 Add cache namespace options for DatadogCSIDriver controller (#2934)
• c7b7f58 Add code-coverage.datadog.yml (#2893)
• 0dcbf67 Add experiment signals to fleet remote config (#2872)
• 97a7761 Add writev and shutdown to system-probe seccomp profile (#2986)
• 540be47 Align tmp/run volume names and remove system-probe DogStatsD mount (#2985)
• 41dddf7 Always clean DDA before next test to avoid races (#2954)
• d09fcb3 Avoid RBAC errors when Operator can't list or watch ConfigMaps (#2889)
• 039572f Comment out flaky test (#2932)
• 9678903 Fix AppArmor annotations for absent containers in annotation overrides (#2897)
• a97d1de Fix CVE 2026-39820: bump golang (#3003) (#3005)
• 658de74 Migrate kubectl-datadog autoscaling cluster to client-go pager (#2960)
• 881aa65 Refactor experiment signals (#2944) (#3016)
• d94085f Remove DatadogAgentEnabled flag (#2912)
• b066672 Restore system-probe DSD socket volumeMount (#3001) (#3006)
• 8653f51 Revert "feat: Add APM to DatadogInstrumentation CRD (#2984)" (#3015) (#3017)
• 4e9c1ab Sync operator 1.26.0 bundle to main (#2972)
• 59f9e3d Update Chaingaurd for Release Worker (#2977)
• 56159c6 Update CLAUDE.md to reference AGENTS.md and lean out AGENTS.md replacing agent.md (#2905)
• ef88adb Update code-owners to otel-agent team and move QA cards to their board (#2895)
• d5f00bf Update default Agent version to 7.78.1 and update CSI default tag to 1.2.2 (#2939)
• 4c230b1 Update the documented fips-proxy image tag to latest 1.1.23 release (#2951)
• c2069ff Upgrade karpenter-provider-aws from v1.3.6 to v1.9.0 (#2888)
• c816592 Use dd-sts OIDC token exchange instead of DD_API_KEY repo secret (#2873)
• b0aad13 Validate AWS account consistency before Karpenter operations (#2892)
• 94725a1 [CASCL-1292] Add Fargate mode to kubectl-datadog install (#2891)
• 654839d [CASCL-1304] Snapshot node managers in ConfigMap during install (#2945)
• 099f33f [CASCL-1305] No-op kubectl-datadog install on a foreign Karpenter (#2949)
• d3652e6 [CASCL-1323] Add update subcommand to kubectl-datadog autoscaling cluster (#2976)
• aad76e3 [CASCL-1323] Extract generic FindKarpenterInstallation helper (#2970)
• 35814b5 [CASCL-1323] chore(kubectl-datadog): split autoscaling install.go into smaller files (#2968)
• abc96a5 [CONS-8253] Propagate DDGR finalizer error (#2919)
• 927e76e [CONTP-1335] organize finalizers (#2879)
• 4fe811a [CONTP-1502] chore: Refresh secrets on reconcile instead of callbacks (#2916)
• e3f69bf [CONTP-1504] Manage DatadogCSIDriver from DatadogAgent (#2857)
• a646370 [CONTP-1547] Push rc-latest mutable image tags from Operator GitLab pipeline (#2903)
• 99a6fc8 [CONTP-1604] When user updates k8s genericresource, force re-create if deleted (#2909)
• 6e2c0c9 [CONTP-1605] [DDGR] Use context based logging and reconcile once, no double get (#2910)
• dcbf3bf [CONTP-1606] [DDGR] Reduce boilerplate: CreateResult, stateful handlers, handler registry (#2911)
• 3628a15 [CONTP-1656] Add datadog instrumentation crd rbac perms (#2975)
• d1d2b65 [CONTP-1656] feat: Add DatadogInstrumentation CRD (#2962)
• 3c567c5 [DOCS-14086] Use dynamic site parameter in Operator config docs (#2978)
• 4c40cf4 [VULN-62334] Update helm.sh/helm/v3 dependency to v3.20.2 (#2969)
• f1faf64 [datadog-operator] Release EKS-addon v1.25.0 (#2881)
• ed1b311 [datadog-operator] Release v1.25.0 Google Marketplace (#2896)
• 1ed0fbc [feature][autoscaling] add Spot scheduling feature and update RBAC (#2957)
• e49c18f kubectl-datadog: delegate OCI image parsing to go-containerregistry (#2971)
• 78490c3 chore: OperatorRelease worker permissions (#2943)
• f11b43c chore: transfer dataplane feature ownership and register agent-data-plane team (#2929)
• 6be3f12 discovery: enable by default on agents >= 7.78 (#2915)
• d3e7b0d dogstatsd: drop DD_USE_DOGSTATSD=false override when dataPlane handles DSD (#2965)
• 953ade2 enhancement: default dataPlane.dogstatsd.enabled to true (#2935)
• 9c04e3d feat(DPA): Add options.burstable + CPURequestsRemoveLimitsMemoryRequestsAndLimits controlled values (#2902)
• 7c966f8 feat(ddgr): add dashboard support (#2906)
• 849be07 feat: Add APM to DatadogInstrumentation CRD (#2984) (#2994)
• b6fdaa5 refacto: rename full-host-profiler to host-profiler (#2901)
• 083623f release v1.27.0-rc.1 (#2989)
• 8e158b7 release v1.27.0-rc.2 (#3018)

v1.27.0-rc.1

Changelog

• 79c0824 (No-op) SA1019: Remove deprecated functions usage (#2478)
• c08166e Add KILL capability to CSPM container (#2931)
• ab3acdb Add SBOM enrichment usage CRD field for "package in use" feature (#2908)
• f41ef99 Add cache namespace options for DatadogCSIDriver controller (#2934)
• c7b7f58 Add code-coverage.datadog.yml (#2893)
• 0dcbf67 Add experiment signals to fleet remote config (#2872)
• 97a7761 Add writev and shutdown to system-probe seccomp profile (#2986)
• 540be47 Align tmp/run volume names and remove system-probe DogStatsD mount (#2985)
• 41dddf7 Always clean DDA before next test to avoid races (#2954)
• d09fcb3 Avoid RBAC errors when Operator can't list or watch ConfigMaps (#2889)
• 039572f Comment out flaky test (#2932)
• 9678903 Fix AppArmor annotations for absent containers in annotation overrides (#2897)
• 658de74 Migrate kubectl-datadog autoscaling cluster to client-go pager (#2960)
• d94085f Remove DatadogAgentEnabled flag (#2912)
• 4e9c1ab Sync operator 1.26.0 bundle to main (#2972)
• 59f9e3d Update Chaingaurd for Release Worker (#2977)
• 56159c6 Update CLAUDE.md to reference AGENTS.md and lean out AGENTS.md replacing agent.md (#2905)
• ef88adb Update code-owners to otel-agent team and move QA cards to their board (#2895)
• d5f00bf Update default Agent version to 7.78.1 and update CSI default tag to 1.2.2 (#2939)
• 4c230b1 Update the documented fips-proxy image tag to latest 1.1.23 release (#2951)
• c2069ff Upgrade karpenter-provider-aws from v1.3.6 to v1.9.0 (#2888)
• c816592 Use dd-sts OIDC token exchange instead of DD_API_KEY repo secret (#2873)
• b0aad13 Validate AWS account consistency before Karpenter operations (#2892)
• 94725a1 [CASCL-1292] Add Fargate mode to kubectl-datadog install (#2891)
• 654839d [CASCL-1304] Snapshot node managers in ConfigMap during install (#2945)
• 099f33f [CASCL-1305] No-op kubectl-datadog install on a foreign Karpenter (#2949)
• d3652e6 [CASCL-1323] Add update subcommand to kubectl-datadog autoscaling cluster (#2976)
• aad76e3 [CASCL-1323] Extract generic FindKarpenterInstallation helper (#2970)
• 35814b5 [CASCL-1323] chore(kubectl-datadog): split autoscaling install.go into smaller files (#2968)
• abc96a5 [CONS-8253] Propagate DDGR finalizer error (#2919)
• 927e76e [CONTP-1335] organize finalizers (#2879)
• 4fe811a [CONTP-1502] chore: Refresh secrets on reconcile instead of callbacks (#2916)
• e3f69bf [CONTP-1504] Manage DatadogCSIDriver from DatadogAgent (#2857)
• a646370 [CONTP-1547] Push rc-latest mutable image tags from Operator GitLab pipeline (#2903)
• 99a6fc8 [CONTP-1604] When user updates k8s genericresource, force re-create if deleted (#2909)
• 6e2c0c9 [CONTP-1605] [DDGR] Use context based logging and reconcile once, no double get (#2910)
• dcbf3bf [CONTP-1606] [DDGR] Reduce boilerplate: CreateResult, stateful handlers, handler registry (#2911)
• 3628a15 [CONTP-1656] Add datadog instrumentation crd rbac perms (#2975)
• d1d2b65 [CONTP-1656] feat: Add DatadogInstrumentation CRD (#2962)
• 3c567c5 [DOCS-14086] Use dynamic site parameter in Operator config docs (#2978)
• 4c40cf4 [VULN-62334] Update helm.sh/helm/v3 dependency to v3.20.2 (#2969)
• f1faf64 [datadog-operator] Release EKS-addon v1.25.0 (#2881)
• ed1b311 [datadog-operator] Release v1.25.0 Google Marketplace (#2896)
• 1ed0fbc [feature][autoscaling] add Spot scheduling feature and update RBAC (#2957)
• e49c18f kubectl-datadog: delegate OCI image parsing to go-containerregistry (#2971)
• 78490c3 chore: OperatorRelease worker permissions (#2943)
• f11b43c chore: transfer dataplane feature ownership and register agent-data-plane team (#2929)
• 6be3f12 discovery: enable by default on agents >= 7.78 (#2915)
• d3e7b0d dogstatsd: drop DD_USE_DOGSTATSD=false override when dataPlane handles DSD (#2965)
• 953ade2 enhancement: default dataPlane.dogstatsd.enabled to true (#2935)
• 9c04e3d feat(DPA): Add options.burstable + CPURequestsRemoveLimitsMemoryRequestsAndLimits controlled values (#2902)
• 7c966f8 feat(ddgr): add dashboard support (#2906)
• b6fdaa5 refacto: rename full-host-profiler to host-profiler (#2901)
• 083623f release v1.27.0-rc.1 (#2989)

v1.26.0

Changelog

• ae90bec (fleet) add Fleet daemon boilerplate (#2670)
• d574470 Add 'otelAgentGateway' to list of override targets (#2790)
• 3d96136 Add DDA rollback functionality (#2838)
• 8931a7b Add Datadog code coverage upload (#2773)
• cb82673 Add IPC env vars to host profiler (#2806)
• 75232bf Add cache namespace options for DatadogCSIDriver controller (#2934) (#2940)
• e4190c2 Add deployment_type gateway (#2745)
• ed2b4df Add error-tracking monitor option to DatadogMonitor CRD. #2775 (#2843)
• 651ae77 Add experiment signals to fleet remote config (#2872) (#2920)
• b03c3fd Add feature codeowners (#2763)
• 21a8087 Add fleet as codeowners (#2777)
• bea964a Add flightrecorder feature to the operator (#2785)
• 8c060c4 Add host volume mounts and NET_RAW capability to PAR container (#2799)
• 61e7c1b Add standalone DatadogCSIDriver controller (#2856)
• 23b1350 Add support of vsock for intra agents communications (#2336)
• 62fdb06 Add time_slice SLO type support (#2875)
• 8fa2be8 Allow using FIPS variants of ddot-collector and agent -full images (#2605)
• 354f6ec Always clean DDA before next test to avoid races (#2954) (#2955)
• 35f861a Avoid RBAC errors when Operator can't list or watch ConfigMaps (#2889) (#2900)
• 444f938 Avoid RBAC errors when Operator can't list or watch Secrets (#2793)
• b9f0028 Bump actions/download-artifact from 8.0.0 to 8.0.1 (#2769)
• 567252b Bump codecov/codecov-action from 5.5.2 to 5.5.3 (#2814)
• 6785cc7 Bump go and grpc versions (#2789)
• b931f03 Bump golang to 1.25.8 (#2830)
• 284ce70 Bump otel dependencies, CVE-2026-24051 (#2869)
• bceb41f Bump softprops/action-gh-release from 2.5.0 to 2.6.1 (#2768)
• 40eb5c8 Clarify CSPM host benchmarks configuration hierarchy (#2765)
• 554029b Comment out flaky test (#2932) (#2933)
• 2eab729 Configure Renovate (#2833)
• a1206ff Create controller revisions for DDAs (#2767)
• a3c9251 DDQA config for Operator repo (#2762)
• 161fd4f Drop qa/skip-qa label in backport PRs (#2835)
• d7029b7 EKS add-on release for Operator 1.24.0 (#2757)
• 7d61c8e Fix AppArmor annotations for absent containers in annotation overrides (#2897) (#2899)
• f662670 Fix PAR cluster agent: use Args instead of Command for -E flag (#2864)
• eac82b0 Fix component logging and downgrade to debug (#2820)
• a312b88 Fix missing workqueue_* metrics in /metrics endpoint (#2772)
• 3e75166 Fix nightly (#2748)
• 5c29d8d Github workflow to add codeowner team labels (#2802)
• e0ba90e Improve Dockerfile to fasten build time (#2740)
• fa251de Improve Makefile: fix redundancies and optimize CI (#2741)
• 0887e50 Introduce DatadogPodAutoscalerClusterProfile CRD (#2794)
• 489abca Migrate deprecated runner tags (#2784)
• 951b12a No-op: remove EDS replace directive (#2749)
• a0dc8c0 Only add the AppArmor annotation if the container actually exists (#2834)
• 6145a19 Only use operator_nightly variable (#2755)
• 8669701 Pass context for ddai (#2759)
• 62a1d4b Reduce logging and use same logging format as other logs (#2870)
• e0fbfce Remove Dependabot configuration (#2812)
• 4a814a5 Remove NetworkStats sub-option from ServiceDiscovery feature (#2822)
• e7b30e7 Remove collector config from host profiler. (#2807)
• f6bad2a Remove default ResizePendingPeriod and RolloutFallbackDelay (#2801)
• 7b97864 Remove run subcommand from host profiler (#2808)
• 2655785 Replace Mode field of DPA with addition to Strategy field (#2787)
• 2b3594e Trim metadata logging and add logging fields (#2725)
• 4239d45 Update GCP marketplace chart and operator image to 1.24.0 (#2747)
• 5adfc81 Update base os from RHEL9 to RHEL10 (#2882)
• 8c58559 Update default Agent version to 7.78.1 and update CSI default tag to 1.2.2 (#2939) (#2941)
• 7fae85c Update golangci lint to latest (2.11.3) and fix violations (#2742)
• 75603ae Update repository.datadog.yml for MQ teams (#2845)
• 395974a Update to Go 1.25.9 (#2877)
• 6a0f976 [ACTP] Add k8s remediation RBAC rules for private action runner (#2770)
• 9b607f1 [ACTP] Fix PAR ConfigMap name for profile DDAIs (#2796)
• d134930 [ACTP] Fix PAR self_enroll Secret RBAC promoted to cluster-wide scope (#2781)
• f4f827e [AGENTRUN-1193] Update FIPS proxy version references to 1.1.22 (#2863)
• 40e907c [ARTSEC-INT] Update datadog-agent-buildimages to v102144341-64dad9f8 (#2779)
• 82e5a30 [CONS-8186] Implement DD_SLO_FORCE_SYNC_PERIOD for DatadogSLO (#2811)
• 3a7029c [CONTINT-5126] DPA and autoscaling RBAC updates (#2743)
• c0654ea [CONTP-1259] Add kubernetese use endpoint slices global with default true (#2825)
• 1b39bf6 [CONTP-1397] add admission controller probe configuration (#2720)
• 692c028 [CONTP-1428] Set necessary env vars on Cluster Agent when UDS is enabled. (#2839)
• e5cf461 [CONTP-1504] Manage DatadogCSIDriver from DatadogAgent (#2857) (#2938)
• c3d0d96 [CONTP-1547] Push rc-latest mutable image tags from Operator GitLab pipeline (#2903) (#2907)
• 8f7f141 [CXP-2639] Remove run_in_core_agent envvar override and cleanup (#2841)
• 15a35f5 [DatadogMonitor] Unregister metrics forwarder on finalization (#2804)
• 3ef9c91 [No-op] Use k8s utils ptr (#2865)
• 189f12c [OTAGENT-920] Set DD_OTELCOLLECTOR_INSTALLATION_METHOD on otel-agent container (#2846)
• c58e5d1 [PROF-14075] add profiling preset to upstream otel Helm config follow up (#2840)
• 52ba052 [datadog-operator] Expose DCA Agent Sidecar TLS Config (#2700)
• 60a4b9c [datadog-operator] Operator v1.25.0 Bundle Updates (#2876)
• 251c4d0 [datadog-operator] Update agent version v7.77.0 (#2788)
• 14f2c96 [datadog-operator] Update stable agent to v7.77.2 (#2860)
• 3c95679 add back ddr_workflow_id (#2756)
• de229a4 chore(deps): eol major upgrades — 10 packages (major: 1 · unstable: 4 · minor: 1 · patch: 4) (#2851)
• 8996e09 chore(deps): minor upgrades — 4 packages (minor: 1 · patch: 3) [api] (#2852)
• badcf9f chore(deps): minor upgrades — 7 packages (minor: 3 · patch: 4) [test/e2e] (#2853)
• 44f4524 feat(appsec): forward sidecar injection mode and istio-gateway config to cluster-agent (#2774)
• a350a29 fix(renovate): Adjust minimum release age condition (#2858)
• cd1a28a fix(renovate): Ignore unresolvable dependencies (#2859)
• 2f61357 release v1.26.0 (#2966)
• 6c7d6e8 release v1.26.0-rc.1 (#2884)
• 974005b release v1.26.0-rc.2 (#2921)
• d7d73cf release v1.26.0-rc.3 (#2942)