Add SBOM enrichment usage CRD field for "package in use" feature by 0intro · Pull Request #2908 · DataDog/datadog-operator

0intro · 2026-04-16T10:26:29Z

What does this PR do?

Add first-class CRD support for sbom.enrichment.usage.enabled, which maps to DD_SBOM_ENRICHMENT_USAGE_ENABLED on both the core agent and system-probe containers. This decouples the "package in use" eBPF-based SBOM enrichment from CWS, matching the new agent config hierarchy.

Testing

Set specs.features.sbom.enrichment.usage.enabled to true in the CRD.
Generate a flare.
Look for LastSeenRunning in the .json files of the flare sbomfolder.

Motivation

What inspired you to submit this pull request?

Additional Notes

Anything else we should know when reviewing?

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

Agent: v7.79.0

Describe your test plan

Write there any instructions and details you may have to test your PR.

Checklist

PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
PR has a milestone or the qa/skip-qa label
All commits are signed (see: signing commits)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5323ad9b41

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-04-16T10:31:19Z

+	if f.enrichmentUsageEnabled {
+		managers.EnvVar().AddEnvVarToContainers(
+			[]apicommon.AgentContainerName{
+				apicommon.CoreAgentContainerName,
+				apicommon.SystemProbeContainerName,
+			},


Provision system-probe privileges for SBOM enrichment

When f.enrichmentUsageEnabled is true, this path only adds DD_SBOM_ENRICHMENT_USAGE_ENABLED to core-agent/system-probe, but the feature never configures system-probe with the eBPF privileges setup (capabilities/AppArmor) that other system-probe-backed features add. In the common case where users enable SBOM enrichment without also enabling CWS/USM/NPM, system-probe runs without the privileges needed for runtime file-access probes, so the new features.sbom.enrichment.usage.enabled setting does not actually work.

Useful? React with 👍 / 👎.

codecov-commenter · 2026-04-16T10:38:20Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.15%. Comparing base (6e2c0c9) to head (b558fd8).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2908      +/-   ##
==========================================
+ Coverage   40.08%   40.15%   +0.06%     
==========================================
  Files         320      320              
  Lines       28075    28107      +32     
==========================================
+ Hits        11254    11286      +32     
  Misses      16012    16012              
  Partials      809      809

Flag	Coverage Δ
unittests	`40.15% <100.00%> (+0.06%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...al/controller/datadogagent/feature/sbom/feature.go	`70.00% <100.00%> (+8.13%)`	⬆️

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 6e2c0c9...b558fd8. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

lebauce · 2026-04-20T08:18:06Z

+	if f.enrichmentUsageEnabled {
+		managers.EnvVar().AddEnvVarToContainers(
+			[]apicommon.AgentContainerName{
+				apicommon.CoreAgentContainerName,
+				apicommon.SystemProbeContainerName,
+			},


khewonc

Can you add testing instructions in your PR description?

Add first-class CRD support for sbom.enrichment.usage.enabled, which maps to DD_SBOM_ENRICHMENT_USAGE_ENABLED on both the core agent and system-probe containers. This decouples the "package in use" eBPF-based SBOM enrichment from CWS, matching the new agent config hierarchy.

0intro · 2026-04-21T15:38:31Z

Can you add testing instructions in your PR description?

Done.

diogocp · 2026-04-21T16:38:47Z

We tested this in chillpenguin.us1.staging.dog using a custom operator build.

Adds a new opt-in values key that sets DD_SBOM_ENRICHMENT_USAGE_ENABLED on the core agent and system-probe to enable runtime "package in use" SBOM enrichment via eBPF. Auto-enables system-probe and hostPID. Requires Agent 7.79.0+. See also: DataDog/datadog-operator#2908 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Add datadog.sbom.enrichment.usage.enabled Adds a new opt-in values key that sets DD_SBOM_ENRICHMENT_USAGE_ENABLED on the core agent and system-probe to enable runtime "package in use" SBOM enrichment via eBPF. Auto-enables system-probe and hostPID. Requires Agent 7.79.0+. See also: DataDog/datadog-operator#2908 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: diogo.pereira <diogo.pereira@datadoghq.com>

0intro requested a review from a team April 16, 2026 10:26

0intro requested review from a team as code owners April 16, 2026 10:26

github-actions Bot added team/agent-security team/container-platform team/container-autoscaling team/documentation labels Apr 16, 2026

0intro added enhancement New feature or request team/agent-cspm qa/skip-qa and removed team/container-platform team/agent-security team/container-autoscaling team/documentation labels Apr 16, 2026

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

maycmlee approved these changes Apr 16, 2026

View reviewed changes

0intro force-pushed the djc/package-in-use2 branch from 5323ad9 to 0e82dde Compare April 17, 2026 10:50

github-actions Bot added team/agent-security team/container-platform team/container-autoscaling team/documentation and removed team/agent-cspm labels Apr 17, 2026

0intro force-pushed the djc/package-in-use2 branch from 0e82dde to 017fd4b Compare April 17, 2026 13:49

lebauce approved these changes Apr 20, 2026

View reviewed changes

diogocp approved these changes Apr 20, 2026

View reviewed changes

khewonc reviewed Apr 21, 2026

View reviewed changes

Comment thread test-package-in-use.sh Outdated

0intro force-pushed the djc/package-in-use2 branch from 017fd4b to b558fd8 Compare April 21, 2026 15:33

khewonc added this to the v1.27.0 milestone Apr 21, 2026

khewonc removed the qa/skip-qa label Apr 21, 2026

khewonc approved these changes Apr 21, 2026

View reviewed changes

0intro merged commit ab3acdb into main Apr 22, 2026
45 checks passed

0intro deleted the djc/package-in-use2 branch April 22, 2026 12:14

diogocp mentioned this pull request Apr 28, 2026

Add datadog.sbom.enrichment.usage.enabled DataDog/helm-charts#2619

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SBOM enrichment usage CRD field for "package in use" feature#2908

Add SBOM enrichment usage CRD field for "package in use" feature#2908
0intro merged 1 commit intomainfrom
djc/package-in-use2

0intro commented Apr 16, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 16, 2026

Uh oh!

lebauce Apr 20, 2026

Uh oh!

codecov-commenter commented Apr 16, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

lebauce Apr 20, 2026

Uh oh!

khewonc left a comment

Uh oh!

Uh oh!

0intro commented Apr 21, 2026

Uh oh!

diogocp commented Apr 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

0intro commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Testing

Motivation

Additional Notes

Minimum Agent Versions

Describe your test plan

Checklist

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

lebauce Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment has been minimized.

lebauce Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

khewonc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

0intro commented Apr 21, 2026

Uh oh!

diogocp commented Apr 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

0intro commented Apr 16, 2026 •

edited

Loading

codecov-commenter commented Apr 16, 2026 •

edited

Loading