Agent

Prelude

Released on: 2026-09-03

• Please refer to the 7.83.0 tag on integrations-core for the list of changes on the Core Checks

New Features

• Add a Data Security provider that schedules one-off database scan checks triggered through Remote Configuration. It is enabled when both data_security.enabled and shared_library_check.enabled are set, and currently targets PostgreSQL databases already monitored by the Agent (via the postgres check).

• Add k8s cluster receiver, k8s leader elector extension, and count connector to the DDOT (Datadog Distribution of OpenTelemetry Collector) default manifest, enabling collection of Kubernetes cluster-level metrics, leader election coordination for Kubernetes receivers, and count-based metric generation via the OpenTelemetry Collector pipeline.

• Add Helm rollback action

• Adds an Agent Data Plane (ADP) preflight mode, controlled by the new data_plane.preflight_mode setting (enabled by default).

  When data_plane.enabled has not been set at all, the Agent starts ADP once at startup for 90 seconds in an isolated configuration, sends a single throwaway metric through it, then stops it and reports any startup errors to Datadog as agent telemetry. This surfaces environment-specific ADP problems before ADP is enabled for real.

  The preflight process handles no customer data: it runs in standalone mode, listens only on a temporary DogStatsD endpoint under the Agent's run directory, does not register with the Agent's remote agent registry, and never takes over the Agent's own DogStatsD port. The temporary configuration it is given contains the Agent's resolved configuration, so it is written user-only and removed once the run finishes. To keep values that were only ever held in memory from being written out this way, the pre-flight does not run at all when secrets are in use: when secret_backend_command, secret_backend_type or multi_secret_backends is set, or when any setting has already been resolved from a secret. Setting data_plane.enabled explicitly to either true or false, or setting data_plane.preflight_mode to false, also disables the pre-flight, as does running an Agent package that does not ship ADP.

• APM : Add support for span-derived primary tags on span metrics produced by the Datadog Distribution of OpenTelemetry Collector (DDOT). Set span_derived_primary_tags on the datadog connector's traces section to a list of attribute keys, and the value of each key found on a span (or, failing that, on its resource) is attached to the APM stats the connector emits, letting you break down span metrics by those tags:

  connectors:
    datadog/connector:
      traces:
        span_derived_primary_tags: [team, region]

  Keys absent from both the span and its resource attributes are omitted. Each key must also be configured as a primary tag in your Datadog organization; keys that are not registered as primary tags are dropped by the intake and do not appear on the resulting span metrics.

• CWS set actions accept a new capture field, a regular expression with a single capture group that is applied to the value of field to extract part of it. This makes it possible to lift an identifier embedded in an event field, such as a command id inside a file path or an IAM role inside an IMDS url, and store it as a scoped variable rather than storing the whole field value. capture can only be used together with field, and only on fields holding a single string. A value that does not match the expression leaves the variable untouched.

• When data_security.enabled is set, the Agent now forwards sensitive-data-scanner findings to Datadog as structured sds-result payloads on the event platform.

• Scaffold PostgreSQL support to the data security check.

• DDOT (Datadog Distribution of OpenTelemetry Collector): the embedded datadog exporter now honors the orchestrator_explorer setting when the OpenTelemetry Agent runs in standalone mode (DD_OTEL_STANDALONE=true). When enabled, Kubernetes resource manifests collected by a k8sobjects receiver in the exporter's logs pipeline are forwarded to the Orchestrator Explorer (Kubernetes Resources) intake. In connected mode this setting is ignored, as the Datadog Cluster Agent already collects and ships orchestrator data.

• Add support for additional log collection options for Kubernetes workloads through DatadogInstrumentation resources.

• Adds support for configuring Network Path Dynamic Test filters through Remote Config.

• Adds support for scheduling Network Path tests through Remote Config.

• Added ConfigMap collection to the Kubernetes Orchestrator. ConfigMap manifests are sent with their data and binaryData fields stripped. The collector is disabled by default (IsStable: false) and must be activated explicitly by listing configmaps in the collectors field of the orchestrator check instance configuration.

• The DDOT (OpenTelemetry) config converter now automatically injects the cumulativetodelta processor into metrics pipelines that export to the datadog exporter, converting all cumulative metric types (sum, histogram and exponential histogram) to delta. The processor is added only to metrics pipelines, and is skipped for any pipeline where a cumulativetodelta processor is already defined. This behavior is controlled by the new cumulativetodelta entry in otelcollector.converter.features, which is enabled by default; remove it from that list to disable the auto-injection.

• OTLP ingestion: Adds a new otlp_config.logs.infra_attributes.tags_as_ddtags option. When enabled, custom tagger-derived tags (for example, tags configured via kubernetesResourcesLabelsAsTags/kubernetesResourcesAnnotationsAsTags) are written as real Datadog log tags instead of log attributes for OTLP logs ingested directly by the Agent. Default behavior is unchanged. (commit 522ee5fe634)

• DDOT: The infraattributes processor now supports a new logs_tags_as_ddtags option. When enabled, custom tagger-derived tags (for example, tags configured via kubernetesResourcesLabelsAsTags/kubernetesResourcesAnnotationsAsTags) are written as real Datadog log tags instead of log attributes. Default behavior is unchanged. (commit 522ee5fe634)

• Added a com.datadoghq.remoteaction.agent Private Action Runner bundle exposing read-only datadog-agent operations (status, diagnose, and configuration) as remote actions executed against the local Agent's authenticated IPC API. (Preview)

• Added a generateFlare action to the com.datadoghq.remoteaction.agent Private Action Runner bundle that builds a flare archive on the Agent host. (Preview)

• The Private Action Runner now supports a split deployment model in which a dedicated on-demand executor runs actions in a separate process, reachable over a local gRPC socket secured with mutual TLS.

• Added the data_security.enabled configuration flag (disabled by default) which enables the sds-result event platform forwarder used to send sensitive-data-scanner results to Datadog.

• Add the Data Security feature to scan monitored PostgreSQL databases for sensitive data, driven remotely through Remote Configuration (DATA_SECURITY_DB_SCAN_TASKS). Enabled with data_security.enabled and shared_library_check.enabled.

• Agent Cloud Auth (delegated authentication / Workload Identity Federation) on AWS now resolves credentials from EKS IRSA, ECS task roles, EKS Pod Identity and EC2 IMDS in the trace-agent, standalone DogStatsD, private action runner, IoT Agent and Heroku Agent. Previously only flavors built with the ec2 build tag (main Agent, Cluster Agent, process-agent, security-agent, system-probe, installer) supported those credential sources; the others silently disabled the feature. Most notably the trace-agent is now covered, so APM no longer requires a statically configured api_key when Cloud Auth is in use. OpenTelemetry Collector (DDOT / otel-agent) is not covered: it does not load the delegated authentication component, and still requires a statically configured api_key.

• Setting delegated_auth.aws.region without delegated_auth.provider no longer skips cloud provider auto-detection. The configured region is now applied to the auto-detected provider, as intended, instead of being treated as an explicit provider configuration.

Enhancement Notes

• Notable Events on Windows now reports critical temperature events: system shutdown or hibernation triggered by a critical thermal condition.

• The Linux Agent packages now ship a built-in datasecurity Rust-based check as a shared library under /etc/datadog-agent/checks.d. This is an initial scaffold and is not enabled by default.

• Rust artifacts are now built with codegen-units = 1 to minimize the size of the produced binaries and shared libraries.

• The kubelet check now collects kubelet.containers_per_pod (.count and .sum), a histogram of the number of containers running per pod on a node. This provides visibility into the distribution of container counts across pods, which can help identify pods with unusually high sidecar/container density.

• Adds kubernetes-actions functionality to the private action runner in the DCA.

• Adds ability to patch daemonsets and statefulsets through the kubernetes-actions pipeline.

• Add exporter.datadogexporter.AddUnits feature gate that maps OTLP (UCUM) metric units to their Datadog equivalents.

• APM : Supported new db.system.name attribute replacing db.system according to changes in OpenTelemetry Semantic Conventions (v1.30.0+).

• APM: agent status now shows the live trace-semantics registry in the APM Agent section, reporting whether it comes from Remote Configuration or the embedded default along with its content hash and version.

• APM: Reduced memory allocations when decoding incoming v0.4 and v0.5 trace payloads with the convert-traces feature enabled. Span attributes are now batch-allocated while converting to the internal trace format, lowering allocation counts and garbage-collection pressure in the trace-agent receiver. This has no effect when convert-traces is disabled.

• The Rust shared-library checks are now built with Bazel, which enables running their unit tests and clippy lint checks in CI as part of the build.

• Agents are now built with Go 1.26.7.

• Check instances scheduled via configuration discovery now carry the dd_config_discovery:true tag. This can be used to identify, and if needed exclude, metrics submitted by an autodiscovered check that duplicates a check configured manually elsewhere for the same service.

• Data Security scan results now report the total number of sensitive-data matches found in each column (count_matches), in addition to the number of distinct rows that contain a match. This gives more accurate visibility when a single row contains several matches.

• The Data Security check now resolves its PostgreSQL source from fully templated autodiscovery configurations, so scan targets are matched reliably when the PostgreSQL integration is configured with template variables such as %%host%%.

• The data security check now reports the number of scanned rows and the list of scanned columns (name and data type) for each scanned table in its scan results.

• Augment the datasecurity component with the sensitive data scanner library.

• Add a new dogstatsd_require_listener configuration option (disabled by default). When enabled, DogStatsD exits with a non-zero status if it cannot create any listener (UDP port, Unix socket, or named pipe), which would otherwise leave DogStatsD running with no way to receive metrics. Enable it so a process supervisor can detect and restart a non-functional DogStatsD.

• The dogstatsd_stream_socket configuration option, which lets DogStatsD listen for metrics on a Unix domain socket using stream mode (SOCK_STREAM), is now considered stable.

• gpu: add volatile ECC error metrics as a counterpart to the existing aggregate (lifetime) ones, including errors.ecc.corrected.volatile and errors.ecc.sram.uncorrected_by_subtype.volatile.

• The Agent flare now includes ulimit.log (the running Agent process' resource limits, on non-Windows platforms) and, on AIX, svmon.log (a per-segment virtual memory breakdown from svmon -P). These help diagnose resource-exhaustion issues without requiring a separate manual collection step from the host.

• gpu: Add NVLink fabric cluster UUID and clique ID to GPU tags (gpu_fabric_cluster_uuid and gpu_fabric_clique_id).

• GPU: emit gpu.errors.xid, a count of NVIDIA XID errors in each collection interval. gpu.errors.xid.total remains the lifetime total since the Agent started collecting events.

• In Kubernetes environments, the apm_config.apm_non_local_traffic and jmx_use_container_support defaults are now applied directly by the Agent binary instead of relying on the datadog-kubernetes.yaml file shipped in the container image. This preserves these Kubernetes defaults even when external tooling (such as the Datadog Operator or Helm chart) replaces datadog.yaml. Values explicitly set via a config file or environment variable continue to take precedence.

• The orchestrator check now collects DatadogInstrumentation (datadoghq.com/v1alpha1) custom resources as part of the out-of-the-box set indexed by the Kubernetes Explorer, alongside the other datadoghq.com custom resources. Collection requires orchestrator_explorer.custom_resources.ootb.enabled (enabled by default) and is skipped when the custom resource definition is absent from the cluster.

• OTLP: Mapped the service.namespace resource attribute to a service.namespace tag by default. OpenTelemetry semantic conventions only guarantee service.name / service.instance.id uniqueness within a service.namespace, so it is now preserved to keep service identity.

• On Windows and Linux, the fleet installer now also registers the Private Action Runner's on-demand executor with dd-procmgr.

• Private Action Runner in Datadog Agent now emits healthcheck metrics like its standalone counterpart.

• Private Action Runner: add the private_action_runner.restricted_shell.allowed_system_services setting to further restrict system-service action grants resolved by Datadog execution policies. Leaving the setting unset preserves the backend grants; configuring an empty map blocks all system-service operations.

• The Agent can now refresh secrets-managed API keys when a Remote Agent reports an Invalid API Key event.

• End User Device Monitoring no longer applies a preconfigured set of SaaS domain filters to network_path.collector.filters. Network Path filters are now empty by default in end_user_device mode, and user-configured filters are preserved unchanged.

• Bumped the Security Agent policies to v0.83.0

• Shared-library checks now honor an explicit min_collection_interval: 0 as one-shot scheduling (the check runs a single time), matching the behavior of Python checks.

• Logs emitted by shared library checks are now routed through the Datadog Agent logger, so their output is formatted and level-filtered consistently with other checks instead of being written directly to standard output.

• SNMP device scans now walk devices using GetBulk by default, requesting only OIDs the device actually returns and adapting the max-repetitions on failures. This avoids the infinite loops and device crashes that could occur with the previous GetNext-based walk. SNMPv1 devices, which do not support GetBulk, continue to use the GetNext walk.

• SNMP device scans now report results incrementally while the scan is running instead of only after it completes, so large devices surface OIDs sooner.

• Upgrade OpenTelemetry Collector dependencies from v0.156.0 to v0.158.0 (core v1.62.0 to v1.64.0).

  See the full upstream changelogs: collector-contrib v0.157.0, collector core v0.157.0. collector-contrib v0.158.0, collector core v0.158.0.

• Agent Cloud Auth (delegated authentication) now reports why it did not start. When org_uuid is configured but no supported cloud provider is detected, the Agent logs a warning naming every credential source it checked instead of a debug-level message, and agent status shows the reason rather than only "not enabled".

• The agent status Delegated Authentication section now reports the AWS credential source in use for each managed API key (static environment variables, IRSA web identity, ECS/EKS container credentials, or EC2 IMDS), along with the last and next scheduled key refresh and the last error.

• Agent Cloud Auth (delegated authentication) failures now name the AWS credential mechanism that was attempted and what to check for it, instead of reporting a generic missing AWS credentials. Credential resolution that returns blank credentials, for example when the EC2 metadata service answers with an error document, is now treated as a failure rather than reported as a successful resolution.

• The windows_certificate check now supports filters.include and filters.exclude configuration to scope certificate collection by any emitted tag key (thumbprint, SAN, CN, friendly name, template, etc.) using Go regex patterns.

Deprecation Notes

• The eBPF probes for GPU Monitoring are deprecated and are now disabled by default. Set gpu_monitoring.enable_ebpf_probes to true in system-probe.yaml to keep using them.

Security Notes

• In FIPS mode, the default SNMPv3 authentication and privacy protocols used when authKey/privKey are set without an explicit authProtocol/privProtocol are now SHA-256/AES instead of MD5/DES, since MD5 and DES are not FIPS 140-3 compatible. Outside FIPS mode, the defaults remain unchanged.
• The otel-agent flare command now writes its diagnostic archive into a private, unpredictably-named directory (restricted to the current user) instead of a predictable, world-readable path in the shared system temporary directory. Previously, on a multi-user host, another local user could read the flare contents (collected configuration, environment variables, and debug data), or redirect the archive by pre-creating a symlink at the predictable path.

Bug Fixes

• APM: The trace-agent refreshes the API key and retries on a 403 only when secret_refresh_on_api_key_failure_interval is set (> 0), now consistent with metrics and logs
• APM : Container tags resolution debug information is now stored using the tracer payload's deduplicated string table instead of inline strings, reducing the size of payloads that include this debug information.
• APM: Fix trace-agent crashes on malformed trace payloads that contain nil entries: nil spans, span links, or span events, and nil span-event attribute values. Nil entries are now dropped at decoding and conversion boundaries before payloads reach trace processing.
• APM: Fix a trace-agent crash when a /v1.0/traces trace chunk carries a trace ID that is not 16 bytes long. Chunk trace IDs are now normalized to 16 bytes during normalization instead of panicking on an out-of-bounds slice in the score and probabilistic samplers.
• APM: ProbabilisticSampler now properly uses the lower order bits of the trace ID on v1 traces.
• APM: Fix a trace-agent crash from unbounded recursion when decoding deeply nested attribute values; nesting depth is now bounded.
• APM: Fix a trace-agent crash when a span event attribute declares an array type but carries a missing array or array element.
• APM V1 trace endpoint now safely skips unknown fields, harvesting any inline strings they carry into the string table so that streaming-string references in later known fields continue to resolve correctly.
• Keep daemon specific default log filepaths now that the core agent's log_file configuration is populated.
• Windows: Fix a crash in the Agent when a statsd client configured to use a named pipe is closed without ever having successfully written to that pipe. The named pipe connection is established on first write, so closing such a client dereferenced a nil connection and terminated the process. Fixed by updating datadog-go to v5.9.1.
• [DBM] Bump go-sqllexer to v0.2.4 to fix a SQL normalization bug:
  • Stop treating backslash as a string escape character in SQL Server and Oracle string literals, which previously caused the obfuscator to swallow SQL past a literal like ESCAPE '\' and truncate the obfuscated query.
• Bump the embedded GoSNMP library to fix SNMPv3 engine-ID discovery and improve robustness of SNMP OID and varbind parsing.
• APM: Make the automatic library injection mode use the CSI driver only when the injector and library images come from configured Datadog registries. Images from other registries now fall back to init containers so Kubernetes can use the workload's image pull credentials.
• APM: Fixed Dynamic Instrumentation snapshot and log-probe uploads failing with a connection reset when the Logs product is disabled (logs_enabled: false). The debugger proxy now drains the request body before responding, so these uploads are dropped cleanly instead of resetting the tracer's connection.
• On ECS Managed Instances in daemon mode, the ECS workloadmeta collector no longer fails to start when the ECS Metadata v1 introspection endpoint is unreachable. The collector now falls back to the metadata v4 /tasks endpoint, which provides all the task data this deployment needs. Previously a v1 failure produced no ECSTask entities for the whole host, so container.* metrics were missing the task_arn, task_family, task_version, ecs_cluster_name and ecs_container_name tags. ECS EC2 daemon mode still requires metadata v1, which provides its task list.
• ECS cluster metadata (cluster name, cluster ID, region and AWS account ID) now falls back to the Agent's own task metadata when the ECS Metadata v1 introspection endpoint is unavailable. This fixes the orchestrator ECS check being skipped, the container lifecycle check reporting an empty cluster ID, and the flare missing its ECS section on ECS Managed Instances. The fallback applies to every non-Fargate launch type, so ECS EC2 deployments whose v1 introspection endpoint is unreachable now resolve cluster metadata instead of failing.
• The Cluster Agent no longer schedules endpoints checks against EndpointSlice endpoints that are not ready or are terminating. This restores the behavior of the v1.Endpoints code path, which only ever targeted ready addresses, and stops checks from erroring out against pods that are shutting down or failing their readiness probes.
• Fixed an issue where the Docker container collector could not inspect a container whose image declares a port range in its exposed ports (for example EXPOSE 1061-1070). Such containers were skipped entirely with an invalid port '1061-1070': invalid syntax error. Older Docker daemons return these ranges verbatim, which the container inspect decoder rejected. The Agent now expands port-range entries into individual ports so the container is collected normally.
• Fix agent status (and the JSON/HTML status renderers) showing a stale HA Agent state (active/standby). The status page previously read a snapshot cached by the periodic inventory metadata collector, which could lag up to inventories_max_interval (10 minutes by default) behind the agent's actual HA state. The status page now reflects the live state on every call, matching the behavior already used by the flare payload.
• Stop the Agent from repeatedly attempting to connect to a Kubelet on hosts that are not running on Kubernetes. This removes the recurring Impossible to reach Kubelet through HTTPS, fallback to HTTP warning logged by host-based and non-Kubernetes containerized installations. There is no change in behavior on Kubernetes nodes.
• Logs Agent: fixed a file source that could stop collecting permanently (Bytes Read: 0) after its log file was rotated or truncated below the offset already read. When a tailer starts, the Agent now checks that the offset stored for the file is still within it, and restarts from the beginning of the file when it is not.
• Fixed the kubernetes_state.deployment.rollout_duration metric occasionally reporting erroneous large values after a cluster agent restart
• Fix chassis type detection on Windows for convertible and detachable 2-in-1 devices (SMBIOS codes 31 and 32), which were previously reported as Other.
• Agent GUI now follows symbolic links when processing conf.d items.
• Fix the NVIDIA Jetson check so missing or frequency-only GPU fields in tegrastats output do not prevent other Jetson metrics from being collected.
• OTel Agent: The datadog extension no longer probes cloud metadata source providers when a hostname is already set in the configuration, avoiding spurious GCP metadata server requests on non-GCP hosts. See open-telemetry/opentelemetry-collector-contrib#49241.
• Fixed a crash loop in standalone otel-agent (DD_OTEL_STANDALONE=true) when deployed alongside a core Datadog Agent that injects DD_REMOTE_CONFIGURATION_ENABLED=true or DD_AGENT_IPC_CONFIG_REFRESH_INTERVAL into its environment, such as when using the Datadog Operator. Standalone mode now reliably disables Remote Configuration and config sync regardless of these environment variables, since it has no core agent IPC endpoint to use them with.
• The private action runner now stops heartbeating a task once the backend reports it no longer exists, instead of retrying indefinitely.
• Prevent double counting container memory limits when no limit is set on the container level and the limit is only set on the pod level. Use the metric kubernetes.memory.limits to only expose memory limits set explicitly at the container level.
• Fixed missing network IP metadata for the Agent when running containerized without host networking (the common case for most Kubernetes deployments). Previously, network metadata collection was skipped entirely in this case. The Agent now falls back to reporting the node's IP address, using the existing kubernetes_kubelet_host configuration value.
• A panic in a Rust-based shared-library check no longer aborts the whole Agent. The panic is now caught at the check boundary and surfaced as a check error, keeping the rest of the Agent running.
• Fixed the host SBOM scan (sbom.host.enabled) reporting no packages when the Agent runs as dd-agent. The scan walks the paths the enabled analyzers declare, one of which is /root/buildinfo/content_manifests, and /root is only traversable by root. Such a path is now skipped and the scan reports the packages it found.

Other Notes

• Agent Data Plane has been bumped to version 1.4.0. See the Agent Data Plane 1.4.0 release notes.
• The datasecurity shared-library check now embeds the datadog.sds protobuf definitions used to report scan results. This is internal wiring; no scan results are emitted yet.
• The ddot-collector image now starts in standalone mode by default. Using it in bundled mode now requires to explicitly set DD_OTEL_STANDALONE to false.
• In ECS daemon mode, the ECS workloadmeta collector now returns a startup error when the ECS Metadata v1 instance data cannot be retrieved and no v1-independent task parser is available, instead of starting without a task parser. Startup is retried, so the collector recovers once the endpoint becomes reachable.
• The Agent no longer reports a Check Execution Failure health platform issue when a check run fails.
• Shared-library (Rust) checks can now submit event platform events as raw bytes, in addition to strings, allowing binary payloads such as protobuf.

Datadog Cluster Agent

Prelude

Released on: 2026-09-03 Pinned to datadog-agent v7.83.0: CHANGELOG.

Upgrade Notes

• The <namespace> part of a datadogmetric@<namespace>:<name> external metric reference is now ignored. The referenced DatadogMetric is always looked up in the namespace of the HorizontalPodAutoscaler or WatermarkPodAutoscaler that holds the reference, so referencing a DatadogMetric owned by another namespace is no longer supported. Such a reference now resolves to a DatadogMetric that does not exist, which leaves the autoscaler without a metric value and unable to scale.

  To find out whether you are affected, list every external metric reference that carries an explicit namespace:

  kubectl get hpa --all-namespaces -o yaml | grep -E 'datadogmetric@[a-z0-9-]+:'
  kubectl get wpa --all-namespaces -o yaml | grep -E 'datadogmetric@[a-z0-9-]+:'

  References whose namespace is the namespace of the autoscaler holding them keep working unchanged. For every reference pointing at another namespace, create a DatadogMetric with the same query in the autoscaler's own namespace and point the autoscaler at it. The namespace can now be left out entirely, datadogmetric@<name> is a valid reference that resolves in the autoscaler's namespace.

New Features

• Add the kubernetes_state.pod.terminating gauge to the Kubernetes State Core check. The metric reports a value of 1 for each pod from the moment its deletion timestamp is set until the pod leaves the informer.
• DatadogInstrumentation checks and logs configurations can now target Argo Rollout workloads.

Enhancement Notes

• Add the kube_argo_rollout tag to pod metrics emitted by the Kubernetes State Core check for pods managed by Argo Rollouts.
• Add the -l and --list options to datadog-cluster-agent status to list available status sections. A section name can now be passed to the command to display only that section.
• The Cluster Agent's Prometheus HTTP Service Discovery provider now applies the OpenMetrics check template's rename_labels mapping to the tags derived from the SD target labels, in addition to the labels scraped from each target. Previously rename_labels only affected scraped metric labels, so a label supplied by the SD endpoint could not be renamed. No configuration change is required: the existing rename_labels in the check_template now covers both sources.
• The cluster-agent KSM auto-sharding dispatcher (cluster_checks.ksm_sharding_enabled) now supports a single kubernetes_state_core config that combines a shardable cluster_unassigned instance with a cluster_aggregates_only instance. The cluster_unassigned instance is sharded by resource type (pods/nodes/others) as before, and the cluster_aggregates_only instance (which does a full-pod watch and cannot be sharded) is dispatched alongside the pods shard. Previously such a multi-instance config disabled sharding. This lets KSM auto-sharding and the cluster-aggregate .total fix be enabled together from one config.
• The Cluster Agent now uses a single ListWatch call to track Kubernetes Node metadata, instead of one call per node.
• Karpenter NodePool autoscaling now tries to automatically resolve which EC2NodeClass/NodeClass to use when more than one exists for a given provider, based on the NodePool's kubernetes.io/os and kubernetes.io/arch requirements. Each NodeClass's own kubernetes.io/os/kubernetes.io/arch labels are preferred when present, falling back to matching tokens in the NodeClass name (e.g. linux-amd64) otherwise; if neither signal uniquely identifies a NodeClass, or the label- and name-based signals disagree, the ambiguity is left unresolved. Previously, having more than one NodeClass of the same provider type always caused NodePool creation/update to fail with a "too many NodeClasses found" error; this is still the outcome when the disambiguation above can't resolve to a single NodeClass. Additionally, when both a manual Karpenter EC2NodeClass and an EKS Auto Mode NodeClass exist in the cluster, the EKS Auto Mode NodeClass is now preferred; previously the EC2NodeClass was always preferred.

Security Notes

• The Cluster Agent external metrics provider now resolves datadogmetric@ references in the namespace of the requesting object rather than the namespace embedded in the metric name. Previously, a workload could read the value of a DatadogMetric owned by another namespace, and keep that DatadogMetric active so that its Datadog queries kept running.

Bug Fixes

• Fix kubernetes_state.container.cpu_requested and kubernetes_state.container.memory_requested to use the effective requests reported by Kubernetes after an in-place vertical resize. Pod spec requests remain the fallback when status resources are unavailable.
• The Cluster Agent no longer opens a second, redundant cluster-wide ListWatch for Kubernetes Nodes. Setting kubernetes_node_labels_as_tags or kubernetes_node_annotations_as_tags used to start an extra Node metadata watch in addition to the one already used to populate the Node cache; that extra watch has been removed and label/annotation-as-tags extraction now relies solely on the existing Node cache.