[orchestrator] Grant networkpolicies to the orchestrator-explorer ClusterRole

[kangyili]

What

Add networkpolicies to the networking.k8s.io rule in the orchestrator-explorer feature's ClusterRole (used by the cluster-checks runner / cluster-agent when it runs the orchestrator check).

Why — this is a bug

The orchestrator check already lists networkpolicies as a collected resource, but the operator-generated ClusterRole only grants ingresses under networking.k8s.io.

The public Datadog Helm chart already grants this exact permission to the cluster-agent for orchestrator-explorer, confirming this is a gap on the operator side:

https://github.com/DataDog/helm-charts/blob/main/charts/datadog/templates/cluster-agent-rbac.yaml#L239-L243

- apiGroups:
  - networking.k8s.io
  resources:
  - networkpolicies
  verbs:
  - list

Change

One line in internal/controller/datadogagent/feature/orchestratorexplorer/rbac.go:

- Resources: []string{rbac.IngressesResource},
+ Resources: []string{rbac.IngressesResource, rbac.NetworkPolicyResource},

Test plan

• go build ./... — passes
• go test ./internal/controller/datadogagent/feature/orchestratorexplorer/... — passes
• go test ./internal/controller/datadogagent/... — passes (all features + controller + override + store + global + merger + object)
• Post-merge, in an operator-managed cluster, confirm the generated *-orch-exp-ccr ClusterRole includes networkpolicies and that the orchestrator check (DCA or CCR) no longer logs the RBAC-denied error.

🤖 Generated with Claude Code

[datadog-prod-us1-4]

 

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 50.12% (+0.00%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c33b36c | Docs | View more details | Give us feedback!}