feat(orchestrator): grant KubeAI collection RBAC

[aureleoules]

What does this PR do?

Grants list and watch access to kubeai.org/models in Cluster Agent roles generated by the Datadog Operator and in the operator's own RBAC role.

Motivation

Make KubeAI model manifests collectable by the Cluster Agent without manual RBAC changes. The operator itself needs the same access so it can create the generated Cluster Agent roles.

Additional Notes

• Agent collection: feat(orchestrator): collect KubeAI custom resources by default datadog-agent#55892
• Datadog Helm chart RBAC: feat(datadog): grant KubeAI collection RBAC helm-charts#2899
• Internal Datadog Operator chart RBAC: https://github.com/DataDog/k8s-datadog-agent-ops/pull/9650

Minimum Agent Versions

• Agent: N/A
• Cluster Agent: v7.84.0

Describe your test plan

• make generate
• make golden-update
• go test ./internal/controller/datadogagent/feature/orchestratorexplorer ./pkg/kubernetes/rbac

Checklist

• PR has the enhancement label
• PR has milestone v1.31.0
• All commits are signed

[Copilot]

🟢 Approval recommended

The RBAC addition is narrowly scoped (list/watch), consistently wired through constants, generation outputs, and unit/golden tests, with no behavioral risk beyond the intended permission change.

Pull request overview

This PR extends the Datadog Operator’s orchestrator-explorer RBAC to allow list/watch on KubeAI kubeai.org/models, so Cluster Agent roles rendered/generated by the operator can collect KubeAI model manifests without manual RBAC edits. It also updates the operator’s own generated RBAC role and all related golden fixtures/tests to reflect the new permission.

Changes:

• Add KubeAI API group/resource constants and include kubeai.org/models in orchestrator-explorer Cluster Agent RBAC rules.
• Grant the operator manager RBAC list/watch on kubeai.org/models via kubebuilder markers and regenerated config/rbac/role.yaml.
• Update orchestrator-explorer RBAC unit tests and renderer golden YAML outputs to include the new rule.

File summaries

File	Description
pkg/kubernetes/rbac/const.go	Adds KubeAIAPIGroup and KubeAIModelsResource constants used by RBAC generation.
internal/controller/datadogagent/feature/orchestratorexplorer/rbac.go	Adds a policy rule for kubeai.org/models (defaulting to list/watch via existing verb-defaulting logic).
internal/controller/datadogagent/feature/orchestratorexplorer/rbac_test.go	Extends RBAC unit test expectations to include the new KubeAI rule.
internal/controller/datadogagent_controller.go	Adds kubebuilder RBAC marker granting operator list/watch on kubeai.org/models.
config/rbac/role.yaml	Regenerated operator role YAML including the new kubeai.org/models rule.
internal/controller/testutils/renderer/testdata/golden/suppression-baseline.golden.yaml	Updates golden RBAC output to include kubeai.org/models rule.
internal/controller/testutils/renderer/testdata/golden/suppression-autopilot.golden.yaml	Updates golden RBAC output to include kubeai.org/models rule.
internal/controller/testutils/renderer/testdata/golden/override-baseline.golden.yaml	Updates golden RBAC output to include kubeai.org/models rule.
internal/controller/testutils/renderer/testdata/golden/override-autopilot.golden.yaml	Updates golden RBAC output to include kubeai.org/models rule.
internal/controller/testutils/renderer/testdata/golden/minimal-baseline.golden.yaml	Updates golden RBAC output to include kubeai.org/models rule.
internal/controller/testutils/renderer/testdata/golden/minimal-autopilot.golden.yaml	Updates golden RBAC output to include kubeai.org/models rule.
internal/controller/testutils/renderer/testdata/golden/comprehensive-eks-hostname-from-file.golden.yaml	Updates golden RBAC output to include kubeai.org/models rule.
internal/controller/testutils/renderer/testdata/golden/comprehensive-baseline.golden.yaml	Updates golden RBAC output to include kubeai.org/models rule.
internal/controller/testutils/renderer/testdata/golden/comprehensive-autopilot.golden.yaml	Updates golden RBAC output to include kubeai.org/models rule.
internal/controller/testutils/renderer/testdata/golden/comprehensive-aks.golden.yaml	Updates golden RBAC output to include kubeai.org/models rule.

Review details

• Files reviewed: 15/15 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[datadog-datadog-prod-us1-2]

✨ Unblock PR with BitsAI

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 4 Pipeline jobs failed

DataDog/datadog-operator | build — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

validation | build — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Linting issue: struct field SloId should be SloID at internal/controller/datadoggenericresource/slo_corrections.go:161:5.

pull request linter | Check Milestone

View more details · View in GitHub Actions

Missing milestone or qa/skip-qa label during the CI workflow execution.

View all 4 failed jobs.

📋 Copy fix prompt

CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Before you start, set up the Datadog software-delivery tooling so you can
query the CI data yourself:

1. Check whether you already have the Datadog software-delivery MCP tools
   (e.g. a `search_datadog_ci_pipeline_events` tool) and the `unblock-pr` skill.
2. If either is missing, STOP and ask me for permission before installing
   anything. Do not install or run anything until I have said yes.
3. Only with my explicit approval, set up the Datadog software-delivery MCP
   server and skills by following:
     https://docs.datadoghq.com/getting_started/software_delivery_mcp_tools/
   then restart so the skill is picked up.
4. If I decline, skip all of the above and work from the context below alone.

Then run /unblock-pr — it will pull the CI data itself. The job context below is what we already know.

If /unblock-pr is not available — because I declined the setup above, or it did not install — work from the context below instead.

Datadog has already classified this failure as caused by changes in this PR.
Take that as given and work the fix:

1. Locate the change. Diff this branch against its base and find the change
   that produces this error. Explain the mechanism, don't just name a file:
     git fetch origin && git diff $(git merge-base origin/main HEAD)...HEAD
2. Reproduce it locally. Run the failing job's command or test before
   proposing anything.
3. Propose the smallest fix that addresses the root cause — not a workaround,
   not a broadened assertion, not a disabled or skipped test.
4. Re-run the same command to confirm, and say exactly what you ran.
5. If the failure turns out to be intermittent rather than deterministic, say
   so plainly instead of "fixing" it — that is a flaky test, and patching it
   hides the problem.

If the right move is to re-run the job rather than change code, use the job
link in the context below. For GitHub Actions: `gh run rerun <run-id> --failed`,
where the run ID is the number after `/runs/` in that URL (not the trailing
number, which is the job ID).

Branch: codex/grant-kubeai-orchestrator-rbac

validation | build
Commit: 9cb31238de7a53509dfe80fbe8b93a29725e4835
Error (code / quality):
Linting issue: struct field SloId should be SloID at internal/controller/datadoggenericresource/slo_corrections.go:161:5.
CI job: https://github.com/DataDog/datadog-operator/actions/runs/33890218830/job/101079789998

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 9cb3123 | Docs | View more details | Give us feedback!}