Avoid PodSecurityPolicy cleanup if the resource is not supported by Kubernetes API

controllers/datadogagent/dependencies/store.go

@@ -264,7 +264,7 @@ func (ds *Store) Cleanup(ctx context.Context, k8sClient client.Client, ddaNs, dd
 	listOptions := &client.ListOptions{
 		LabelSelector: labels.NewSelector().Add(*requirementLabel),
 	}
-	for _, kind := range kubernetes.GetResourcesKind(ds.supportCilium) {
+	for _, kind := range ds.platformInfo.GetAgentResourcesKind(ds.supportCilium) {
 		objList := kubernetes.ObjectListFromKind(kind, ds.platformInfo)
 		if err := k8sClient.List(ctx, objList, listOptions); err != nil {
 			errs = append(errs, err)
@@ -294,7 +294,7 @@ func (ds *Store) DeleteAll(ctx context.Context, k8sClient client.Client) []error
 
 	var objsToDelete []client.Object
 
-	for _, kind := range kubernetes.GetResourcesKind(ds.supportCilium) {
+	for _, kind := range ds.platformInfo.GetAgentResourcesKind(ds.supportCilium) {
 		requirementLabel, _ := labels.NewRequirement(operatorStoreLabelKey, selection.Exists, nil)
 		listOptions := &client.ListOptions{
 			LabelSelector: labels.NewSelector().Add(*requirementLabel),

pkg/kubernetes/const.go

@@ -57,7 +57,7 @@ const (
 )
 
 // GetResourcesKind return the list of all possible ObjectKind supported as DatadogAgent dependencies
-func GetResourcesKind(withCiliumResources bool) []ObjectKind {
+func getResourcesKind(withCiliumResources, withPodSecurityPolicy bool) []ObjectKind {
 	resources := []ObjectKind{
 		ConfigMapKind,
 		ClusterRolesKind,
@@ -71,13 +71,16 @@ func GetResourcesKind(withCiliumResources bool) []ObjectKind {
 		ServiceAccountsKind,
 		PodDisruptionBudgetsKind,
 		NetworkPoliciesKind,
-		PodSecurityPoliciesKind,
 		// SecurityContextConstraintsKind,
 	}
 
 	if withCiliumResources {
 		resources = append(resources, CiliumNetworkPoliciesKind)
 	}
 
+	if withPodSecurityPolicy {
+		resources = append(resources, PodSecurityPoliciesKind)
+	}
+
 	return resources
 }

pkg/kubernetes/platforminfo.go

@@ -87,3 +87,16 @@ func (platformInfo *PlatformInfo) CreatePDBObjectList() client.ObjectList {
 		return &policyv1.PodDisruptionBudgetList{}
 	}
 }
+
+func (platformInfo *PlatformInfo) GetAgentResourcesKind(withCiliumResources bool) []ObjectKind {
+	return getResourcesKind(withCiliumResources, platformInfo.supportsPSP())
+}
+
+func (platformInfo *PlatformInfo) supportsPSP() bool {
+	if platformInfo.apiOtherVersions == nil || platformInfo.apiPreferredVersions == nil {
+		return true
+	}
+	_, otherExists := platformInfo.apiOtherVersions["PodSecurityPolicy"]
+	_, preferredExists := platformInfo.apiPreferredVersions["PodSecurityPolicy"]
+	return otherExists || preferredExists
+}

pkg/kubernetes/platforminfo_test.go

@@ -94,16 +94,19 @@ func Test_getPDBFlag(t *testing.T) {
 		preferred     map[string]string
 		other         map[string]string
 		useV1Beta1PDB bool
+		supportsPSP   bool
 	}{
 		{
 			name: "Chooses preferred version of PodDisruptionBudget",
 			preferred: map[string]string{
 				"PodDisruptionBudget": "policy/v1",
+				"PodSecurityPolicy":   "anything",
 			},
 			other: map[string]string{
 				"PodDisruptionBudget": "policy/v1beta1",
 			},
 			useV1Beta1PDB: false,
+			supportsPSP:   true,
 		},
 		{
 			name: "Chooses preferred version of PodDisruptionBudget",
@@ -112,8 +115,10 @@ func Test_getPDBFlag(t *testing.T) {
 			},
 			other: map[string]string{
 				"PodDisruptionBudget": "policy/v1",
+				"PodSecurityPolicy":   "anything",
 			},
 			useV1Beta1PDB: true,
+			supportsPSP:   true,
 		},
 		{
 			name: "Unrecognized preferred version, defaults to v1",
@@ -122,13 +127,16 @@ func Test_getPDBFlag(t *testing.T) {
 			},
 			other:         map[string]string{},
 			useV1Beta1PDB: false,
+			supportsPSP:   false,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			platformInfo := NewPlatformInfoFromVersionMaps(nil, tt.preferred, tt.other)
 			assert.Equal(t, tt.useV1Beta1PDB, platformInfo.UseV1Beta1PDB())
+			assert.Equal(t, tt.supportsPSP, platformInfo.supportsPSP())
+			assert.Equal(t, tt.supportsPSP, containsObjectKind(platformInfo.GetAgentResourcesKind(false), PodSecurityPoliciesKind))
 		})
 	}
 }
@@ -168,3 +176,12 @@ func newApiGroupPointer(apiGroup v1.APIGroup) *v1.APIGroup {
 func newApiResourceListPointer(apiResourceList v1.APIResourceList) *v1.APIResourceList {
 	return &apiResourceList
 }
+
+func containsObjectKind(list []ObjectKind, s ObjectKind) bool {
+	for _, v := range list {
+		if v == s {
+			return true
+		}
+	}
+	return false
+}