Add container-based config discovery support to fluxcd

Adds a from_ports discovery strategy on port 8080 (the shared Prometheus
metrics port across all Flux controllers) and an auto_conf.yaml matching
the four flux-system controller images (helm-controller, kustomize-controller,
notification-controller, source-controller) already exercised by the
integration's kind-based E2E test. Wires the new kind-based E2E discovery
helpers (setup_discovery_agent/save_kube_discovery_state/
run_discovery_check_kubernetes/assert_all_discovery_candidates_stable_kubernetes)
into conftest.py and test_e2e.py.

Environment: Datadog workspace

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: vitkyrka

fluxcd/assets/configuration/spec.yaml

@@ -2,6 +2,12 @@ name: fluxcd
 fleet_configurable: true
 files:
 - name: fluxcd.yaml
+  discovery:
+    strategies:
+    - template: discovery/openmetrics_from_named_ports
+      overrides:
+        port_names:
+        - http-prom
   options:
   - template: init_config
     options:
@@ -15,3 +21,20 @@ files:
         for Flux custom resources (Flux 2.1+).
       value:
         type: string
+- name: auto_conf.yaml
+  options:
+  - template: ad_identifiers
+    overrides:
+      value.example:
+      - helm-controller
+      - kustomize-controller
+      - notification-controller
+      - source-controller
+  - template: auto_conf/cel_selector
+    overrides:
+      cel_selector.value.example:
+        containers:
+        # Narrow down matching containers since the controller names are generic
+        # and don't identify the container as being part of FluxCD.
+        - container.image.reference.contains("fluxcd/")
+  - template: auto_conf/discovery

fluxcd/changelog.d/24510.added

@@ -0,0 +1 @@
+Add container-based config discovery support.

fluxcd/datadog_checks/fluxcd/config_models/discovery.py

@@ -0,0 +1,42 @@
+# (C) Datadog, Inc. 2026-present
+# All rights reserved
+# Licensed under a 3-clause BSD style license (see LICENSE)
+
+# This file is autogenerated.
+# To change this file you should edit assets/configuration/spec.yaml and then run the following commands:
+#     ddev -x validate config -s <INTEGRATION_NAME>
+#     ddev -x validate models -s <INTEGRATION_NAME>
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+from typing import Any
+
+from datadog_checks.base.utils.discovery import Service, candidate_ports_by_name
+from datadog_checks.fluxcd.config_models import discovery_overrides
+from datadog_checks.fluxcd.config_models.instance import InstanceConfig
+from datadog_checks.fluxcd.config_models.shared import SharedConfig
+
+
+def _generated_candidates(service: Service) -> Iterator[dict[str, Any]]:
+    shared = SharedConfig.model_validate({}, context={'configured_fields': frozenset()}).model_dump(
+        by_alias=True, mode='json', exclude_none=True
+    )
+    # discovery[0]: from_named_ports
+    for port in candidate_ports_by_name(service, ['http-prom']):
+        ctx = {'port': port}
+        instance_data = {
+            'openmetrics_endpoint': 'http://{service.host}:{port.number}/metrics'.format(service=service, **ctx),
+        }
+        instance = InstanceConfig.model_validate(
+            instance_data, context={'configured_fields': frozenset(instance_data)}
+        ).model_dump(by_alias=True, mode='json', exclude_none=True)
+        yield {'init_config': shared, 'instances': [instance]}
+
+
+def candidates(service: Service) -> Iterator[dict[str, Any]]:
+    override = getattr(discovery_overrides, 'candidates', None)
+    if override is None:
+        yield from _generated_candidates(service)
+    else:
+        yield from override(service, default=_generated_candidates)

fluxcd/datadog_checks/fluxcd/config_models/discovery_overrides.py

@@ -0,0 +1,12 @@
+# (C) Datadog, Inc. 2026-present
+# All rights reserved
+# Licensed under a 3-clause BSD style license (see LICENSE)
+
+# Override the generated discovery candidates() for this integration.
+#
+# Define a candidates(service, default) function to wrap or replace the generated
+# candidate generation. `default` is the generated generator; call it to reuse
+# the spec-driven candidates, or ignore it to replace them entirely.
+#
+# def candidates(service, default):
+#     yield from default(service)

fluxcd/datadog_checks/fluxcd/config_models/discovery_strategies.py

@@ -0,0 +1,18 @@
+# (C) Datadog, Inc. 2026-present
+# All rights reserved
+# Licensed under a 3-clause BSD style license (see LICENSE)
+
+# Here you can define custom (local:) discovery strategies for this integration.
+#
+# Decorate a generator with @discovery_strategy (imported from
+# datadog_checks.base.utils.discovery) and reference it from the spec discovery
+# stanza as `strategy: local:<function_name>`. The function receives the
+# discovered Service plus the inputs declared in the spec and yields one context
+# (ctx) mapping per candidate, exposing the keys listed in `provides`.
+#
+# from datadog_checks.base.utils.discovery import discovery_strategy
+#
+# @discovery_strategy(provides=('svc',))
+# def from_some_config(service, config_path):
+#     ...
+#     yield {'svc': ...}

fluxcd/datadog_checks/fluxcd/data/auto_conf.yaml

@@ -0,0 +1,29 @@
+## @param ad_identifiers - list of strings - required
+## A list of container identifiers that are used by Autodiscovery to identify
+## which container the check should be run against. For more information, see:
+## https://docs.datadoghq.com/agent/guide/ad_identifiers/
+#
+ad_identifiers:
+  - helm-controller
+  - kustomize-controller
+  - notification-controller
+  - source-controller
+
+## @param cel_selector - mapping - optional
+## CEL selector for autodiscovery.
+#
+cel_selector:
+  containers:
+  - container.image.reference.contains("fluxcd/")
+
+## Enables configuration discovery
+#
+discovery: {}
+
+## Unused init configuration
+#
+init_config:
+
+## Unused instance configuration
+#
+instances: []

fluxcd/tests/conftest.py

@@ -9,6 +9,7 @@
 
 from datadog_checks.dev import get_here
 from datadog_checks.dev.kind import kind_run
+from datadog_checks.dev.kube_discovery import setup_discovery_agent
 from datadog_checks.dev.kube_port_forward import port_forward
 from datadog_checks.dev.subprocess import run_command
 from datadog_checks.fluxcd import FluxcdCheck
@@ -38,6 +39,7 @@ def dd_environment():
     with kind_run(conditions=[setup_fluxcd]) as kubeconfig:
         instances = []
         with ExitStack() as stack:
+            setup_discovery_agent(kubeconfig)
             for controller in (
                 'source-controller',
                 'helm-controller',

fluxcd/tests/test_e2e.py

@@ -2,10 +2,37 @@
 # All rights reserved
 # Licensed under a 3-clause BSD style license (see LICENSE)
 
+import pytest
+
+from datadog_checks.dev.kube_discovery import (
+    assert_all_discovery_candidates_stable_kubernetes,
+    run_discovery_check_kubernetes,
+)
 from datadog_checks.dev.utils import get_metadata_metrics
+from datadog_checks.fluxcd import FluxcdCheck
 
 from .common import EXPECTED_METRICS
 
+# These require an actual reconcile/workqueue event to fire, which doesn't happen against an
+# idle test cluster with no GitRepository/Kustomization/HelmRelease objects configured.
+IGNORED_METRICS = {
+    'fluxcd.controller.runtime.reconcile.count',
+    'fluxcd.controller.runtime.reconcile.errors.count',
+    'fluxcd.controller.runtime.reconcile.time.seconds.bucket',
+    'fluxcd.controller.runtime.reconcile.time.seconds.count',
+    'fluxcd.controller.runtime.reconcile.time.seconds.sum',
+    'fluxcd.gotk.reconcile.condition',
+    'fluxcd.gotk.reconcile.duration.seconds.bucket',
+    'fluxcd.gotk.reconcile.duration.seconds.count',
+    'fluxcd.gotk.reconcile.duration.seconds.sum',
+    # Emitted by kube-state-metrics (Flux 2.1+), not Flux controller /metrics endpoints.
+    'fluxcd.gotk.resource.info',
+    'fluxcd.gotk.suspend.status',
+    'fluxcd.process.cpu_seconds.count',
+    'fluxcd.workqueue.adds.count',
+    'fluxcd.workqueue.retries.count',
+}
+
 
 def test_source_controller_metrics(dd_agent_check):
     """
@@ -14,24 +41,30 @@ def test_source_controller_metrics(dd_agent_check):
     Version 1 is in maintenance mode, all our users are on version 2.
     """
     aggregator = dd_agent_check()
-    ignore = {
-        'fluxcd.controller.runtime.reconcile.count',
-        'fluxcd.controller.runtime.reconcile.errors.count',
-        'fluxcd.controller.runtime.reconcile.time.seconds.bucket',
-        'fluxcd.controller.runtime.reconcile.time.seconds.count',
-        'fluxcd.controller.runtime.reconcile.time.seconds.sum',
-        'fluxcd.gotk.reconcile.condition',
-        'fluxcd.gotk.reconcile.duration.seconds.bucket',
-        'fluxcd.gotk.reconcile.duration.seconds.count',
-        'fluxcd.gotk.reconcile.duration.seconds.sum',
-        # Emitted by kube-state-metrics (Flux 2.1+), not Flux controller /metrics endpoints.
-        'fluxcd.gotk.resource.info',
-        'fluxcd.gotk.suspend.status',
-        'fluxcd.process.cpu_seconds.count',
-        'fluxcd.workqueue.adds.count',
-        'fluxcd.workqueue.retries.count',
-    }
-    for metric_name in set(EXPECTED_METRICS['v2']) - ignore:
+    for metric_name in set(EXPECTED_METRICS['v2']) - IGNORED_METRICS:
+        aggregator.assert_metric(metric_name)
+    aggregator.assert_all_metrics_covered()
+    aggregator.assert_metrics_using_metadata(get_metadata_metrics())
+
+
+@pytest.mark.e2e
+def test_e2e_discovery(aggregator, datadog_agent):
+    # Kubelet Autodiscovery is expected to find all four flux-system controller pods exercised by
+    # the non-discovery E2E test above (source, helm, kustomize, notification-controller).
+    run_discovery_check_kubernetes(aggregator, datadog_agent, discovery_min_instances=4)
+
+    for metric_name in set(EXPECTED_METRICS['v2']) - IGNORED_METRICS:
         aggregator.assert_metric(metric_name)
     aggregator.assert_all_metrics_covered()
     aggregator.assert_metrics_using_metadata(get_metadata_metrics())
+
+
+@pytest.mark.e2e
+def test_e2e_discovery_all_candidates(aggregator, datadog_agent):
+    assert_all_discovery_candidates_stable_kubernetes(
+        FluxcdCheck,
+        aggregator,
+        datadog_agent,
+        namespace='flux-system',
+        pod_selector='app=source-controller',
+    )