feat(orchestrator): collect KubeAI custom resources by default

[aureleoules]

What does this PR do?

Adds built-in collection for KubeAI Model resources from kubeai.org/v1. It also teaches custom-resource manifest scrubbing to handle map-form environment variables, including token-suffixed names, and adds kind/fakeintake coverage for collection and redaction.

Motivation

Make KubeAI model manifests available in Orchestrator Explorer without manual collector configuration while preventing credentials in spec.env from being forwarded.

Describe how you validated your changes

• dda inv test --targets=./pkg/collector/corechecks/cluster/orchestrator
• dda inv test --targets=./pkg/redact
• Go linters for the redaction, orchestrator E2E, and kind framework packages
• release-note validation

The live AWS kind suite was not run locally; PR CI will exercise it.

Additional Notes

• Datadog Operator RBAC: feat(orchestrator): grant KubeAI collection RBAC datadog-operator#3439
• Datadog Helm chart RBAC: feat(datadog): grant KubeAI collection RBAC helm-charts#2899
• Internal Datadog Operator chart RBAC: https://github.com/DataDog/k8s-datadog-agent-ops/pull/9650

[github-actions]

AI review by Codex (OpenAI) - workflow run

Patch is correct. The KubeAI collector, map-form env redaction, and tests are consistent. The fakeintake E2E is justified because it validates real CRD discovery, deployed Agent collection, scrubbing, encoding, and forwarding.

[github-actions]

AI review by Codex (OpenAI) - workflow run

patch is correct — KubeAI collection and map-form environment scrubbing are covered by unit and justified fakeintake E2E tests, with no actionable defects found.

[Copilot]

🟢 Approval recommended

The changes are cohesive, include unit + E2E coverage for the new behavior, and the framework ordering/RBAC adjustments appear consistent with existing patterns.

Pull request overview

This PR extends the Orchestrator Explorer built-in custom resource collection to include KubeAI Model resources (kubeai.org/v1) by default, and enhances manifest scrubbing to redact credentials in spec.env when that field is expressed as either a list-form env or a map-form env (including _TOKEN-suffixed names). It also adds E2E (kind + fakeintake) coverage to validate collection and redaction behavior.

Changes:

• Add KubeAI kubeai.org/v1/models to the built-in CRD configs and corresponding unit test expectations.
• Extend CR manifest scrubbing to support env as either [] (name/value entries) or {key: value} maps, and treat *_TOKEN env var names as sensitive.
• Add a kind E2E that deploys a KubeAI CRD + Model pre-Agent and asserts the scrubbed manifest is received in fakeintake.

File summaries

File	Description
test/new-e2e/tests/orchestrator/util_test.go	Extend manifest parsing helper to read spec.env as a map for the new KubeAI assertion.
test/new-e2e/tests/orchestrator/kubeai_test.go	New kind E2E asserting KubeAI Model manifest collection + redaction.
test/new-e2e/tests/orchestrator/k8s_test.go	Deploy KubeAI CRD/CR pre-Agent via new kindvm hook to ensure startup discovery sees it.
test/new-e2e/tests/orchestrator/fixtures/kubeai.yaml	Fixture defining the KubeAI CRD and a Model instance containing env values to be scrubbed.
test/new-e2e/tests/orchestrator/BUILD.bazel	Wire new test + fixture and add direct deps for Pulumi YAML apply.
test/new-e2e/tests/orchestrator/agent_values.yaml	Grant RBAC for kubeai.org/v1/models without relying on custom CR config in the test values.
test/e2e-framework/scenarios/aws/kindvm/run.go	Implement “pre-agent workloads” deployment and ensure Agent/operator installs depend on them.
test/e2e-framework/scenarios/aws/kindvm/run_args.go	Add WithPreAgentWorkloadApp run option and store it in scenario params.
test/e2e-framework/AGENTS.md	Document the new pre-Agent workload hook and its standalone OTel incompatibility.
releasenotes-dca/notes/collect-kubeai-custom-resources-by-default-a8d286a9133ed907.yaml	Release note entry for the new built-in KubeAI collection.
pkg/redact/cr.go	Support map-form env scrubbing and add _TOKEN env-var name sensitivity helper.
pkg/redact/cr_test.go	Add tests for token-suffixed env redaction and map-form env scrubbing.
pkg/collector/corechecks/cluster/orchestrator/collector_bundler_test.go	Update expected built-in CRD config list to include KubeAI models.
pkg/collector/corechecks/cluster/orchestrator/collector_bundle.go	Add KubeAI group constant and built-in config entry for models in kubeai.org/v1.

Review details

• Files reviewed: 14/14 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.