v1.28.0-rc.4

Changelog

• 9c31609 Add RBAC for Gateway API, service mesh, and ingress controller CRDs (#2874)
• 4e59e1d Add make bundle workflow (#3023)
• 20ecb9e Add missing flock workspace checksum (#3019)
• 65b9d19 Align otel collector config mount with Helm (#3031)
• c86d5e5 Bump default Agent version to 7.79.2 (#3077)
• 7dfe2e5 Do not set process-agent AppArmor for NPM fallback (#3185) (#3189)
• a4fd8d9 Drop provider arg from Feature interface methods (#3007)
• 03e4b46 E2E Dogstatsd validation (#3033)
• 5301a0c E2E improvements: remove gotoolchain hack, share go cache, stream test output (#3074)
• 1e1aeff Emit Kubernetes events for FA experiment transitions (#3037)
• 079486f Expose workload autoscaling in-place vertical scaling (#3055)
• c85321f FA rollout experiment fixes (#3035)
• 913e801 Fix CVE 2026-39820: bump golang (#3003)
• 6ef503a Fix E2e tests on main (#3064)
• fa3049c Make CNM team owner of the npm feature, not ndm-core (#2998)
• c7d49fe No-op: allow containers-tee to use MQ (#3069)
• 19c5d3f Operator manifest renderer (#2947)
• bd0f5e2 Provider capabilities basic framework and eks.ec2.useHostnameFromFile support (#3009)
• 0ec9665 Reduce operator image chmod layers (#3087)
• 3df38d6 Refactor experiment signals (#2944)
• 071c3fa Release EKS-addon v1.26.0 (#2974)
• 93e1cb6 Release v1.26.0 Google Marketplace and add scripts to update the CRDs from a given tag (#2973)
• 8e0b1e8 Remove non-existent setsidaccept4 syscall from seccomp allowlist (#2992)
• 4d64420 Remove operatorrelease chainguard STS policies (#2993)
• d9789bb Rename agent-all to agent-community-eng (#3089)
• a580b06 Restore system-probe DSD socket volumeMount (#3001)
• 6d3740a Revert "feat: Add APM to DatadogInstrumentation CRD (#2984)" (#3015)
• 3579eb4 Secret management sollutions (#3052)
• 491d342 Stop mounting debugfs in process-agent (#2996)
• f49eb24 Support oomKill, tcpQueueLength features on GKE COS via provider annotation (#3011)
• b2a60a9 Undefined replica count remains undefined (#3036)
• d60ff16 Untaint controller (#2753)
• bed889f Update FIPS proxy version references to 1.1.24 (#2997)
• f70667d Update FIPS proxy version references to 1.1.25 (#3044)
• cab73c6 Update FIPS proxy version references to 1.1.26 (#3067)
• bd00a4a Update Golang to 1.25.11 (#3085)
• 49937bd Update agent image to 7.80.2 (#3155) (#3156)
• dbe65ff Update default agent version to 7.79.1 (#3054)
• 7a0a7a8 Use Ubuntu 26.04 GBI for internal build (#3038)
• 097216f [CASCL-1292] Wire Karpenter check as endpoint check on Fargate (#2999)
• b9f5936 [CASCL-1304] Fix Fargate profile name in dd-cluster-info ConfigMap (#3000)
• 2c675b3 [CASCL-1304] kubectl-datadog: enrich dd-cluster-info ConfigMap (#2980)
• b1ebe71 [CONTP-1585] Add SLO support to DatadogGenericResource (#3070)
• ed139da [CONTP-1589] Add DDGR force sync period configuration (#3043)
• 6b4b5f7 [CONTP-1596]Improve GKE Autopilot support (#3013)
• da5cd49 [CONTP-1639] Refactor CRD metadata collection to use informer (#2979)
• 4d241e3 [CONTP-1702] Support CSI mode in GKE Autopilot (#3094) (#3133)
• 68d9802 [CONTP-1709] Support enabling datadoginstrumentation crd controller (#3002) (#3125)
• 762837d [CONTP-1715] Align Operator to Helm csi daemonset and include csidrivers RBAC for DCA (#3093) (#3132)
• 4a8f342 [Host Profiler] Remove seccomp configmap and use profile baked into image (#3061) (#3107)
• 82a75d4 [Host Profiler] Tighten seccomp profile (#3042)
• f636740 [PROF-14068] Remove privileges for host-profiler (#2953)
• 104bcf9 [codex] Use reachable git tag for build version (#3115) (#3119)
• 7f86fa0 kubectl-datadog: redistribute autoscaling cluster packages by concern (#3012)
• c30557a add octo sts policies for release dashboard (#3066)
• 33d6508 chore(deps): Bump to v0.55.0 (#3105) (#3111)
• f6aeb7b correct policy issuer in staging for release-dashboard-api to ticino (#3071)
• ad3447a discovery: remove networkStats option (#3117) (#3123)
• f7ac48f enable CNM direct send by default (#3045) (#3103)
• 47e8393 enforce min agent version for CNM direct send (#3010)
• 7ef174d feat(appsec): add ingress-nginx proxy injection support (#3053)
• 8b39974 feat(ddgr): surface Datadog Monitor state in CR status (#3047)
• d97a3dc feat: Add APM to DatadogInstrumentation CRD (#2984)
• a1cbe91 fix issuer to vault and correct subject (#3084)
• dad893d fix monitor recreate (#3050)
• 1a48339 fix(appsec): correct envoyproxy RBAC resource typo backend -> backends (#3116) (#3121)
• efb068e fix(dogstatsd): always set DSD environment variables on Core Agent container (#3032)
• 1f58351 fix(rbac): remove stale gateways entry from orchestrator explorer RBAC (#3075)
• 6416ca2 fix: make apm config a pointer (#2995)
• 88d9f7a never let PodTemplateSpec rewrite Host Profiler seccomp init container (#3135) (#3145)
• 5ac71e6 release v1.28.0-rc.1 (#3095)
• 1d862cd release v1.28.0-rc.2 (#3141)
• 9ca69f3 release v1.28.0-rc.3 (#3157)
• 4a3f4bc release v1.28.0-rc.4 (#3190)
• 04424c1 update agent image to 7.80.1 (#3134) (#3139)
• e62a2b2 update bundle for 1.27 (#3081)