From 617f7a03c459171fb068e6db79591f3354cf2b30 Mon Sep 17 00:00:00 2001
From: Jules Macret <jules.macret@datadoghq.com>
Date: Fri, 17 Jul 2026 15:46:51 +0200
Subject: [PATCH] Add DD_PRIVATE_ACTION_RUNNER_API_KEY_ONLY_ENROLLMENT env var

Allows setting private_action_runner.api_key_only_enrollment in
datadog.yaml at install time, following the same pattern as the
existing actions_allowlist env var.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 install_script.sh.template        | 12 +++++++++++-
 unit_tests/test_install_script.sh | 16 ++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/install_script.sh.template b/install_script.sh.template
index 71ca6135..d0447a0f 100644
--- a/install_script.sh.template
+++ b/install_script.sh.template
@@ -976,6 +976,11 @@ if [ -n "$DD_PRIVATE_ACTION_RUNNER_ACTIONS_ALLOWLIST" ]; then
   par_actions_allowlist=$DD_PRIVATE_ACTION_RUNNER_ACTIONS_ALLOWLIST
 fi
 
+par_api_key_only_enrollment=
+if [ -n "$DD_PRIVATE_ACTION_RUNNER_API_KEY_ONLY_ENROLLMENT" ]; then
+  par_api_key_only_enrollment=$DD_PRIVATE_ACTION_RUNNER_API_KEY_ONLY_ENROLLMENT
+fi
+
 ##
 # INSTALL SCRIPT CONFIGURATION OPTIONS
 # Technical options to test with non-production values for signature keys, packages or reporting telemetry.
@@ -2211,6 +2216,7 @@ function update_par(){
   local config_file="$2"
   local par_enabled="$3"
   local par_actions_allowlist="$4"
+  local par_api_key_only_enrollment="$5"
 
   if [ "$par_enabled" != "true" ]; then
     return
@@ -2241,6 +2247,10 @@ function update_par(){
     par_config="${par_config}
   actions_allowlist:${actions_append}"
   fi
+  if [ -n "$par_api_key_only_enrollment" ]; then
+    par_config="${par_config}
+  api_key_only_enrollment: ${par_api_key_only_enrollment}"
+  fi
   $sudo_cmd sh -c "cat >> '$config_file'" <<EOF
 
 ${par_config}
@@ -2348,7 +2358,7 @@ elif [ ! "$no_agent" ]; then
       update_logs_config_process_collect_all "$sudo_cmd" "$config_file"
     fi
     update_remote_updates "$sudo_cmd" "$remote_updates" "$config_file"
-    update_par "$sudo_cmd" "$config_file" "$par_enabled" "$par_actions_allowlist"
+    update_par "$sudo_cmd" "$config_file" "$par_enabled" "$par_actions_allowlist" "$par_api_key_only_enrollment"
   fi
 
   # DD_LOGS_CONFIG_PROCESS_COLLECT_ALL needs discovery to be enabled
diff --git a/unit_tests/test_install_script.sh b/unit_tests/test_install_script.sh
index b932299c..d3d1f917 100755
--- a/unit_tests/test_install_script.sh
+++ b/unit_tests/test_install_script.sh
@@ -401,6 +401,22 @@ testParConfigAlreadyExists() {
   # Should not modify existing config
   assertEquals "$(sudo yq eval '.private_action_runner.enabled' $config_file)" "false"
 }
+testParEnabledWithApiKeyOnlyEnrollment() {
+  sudo rm $config_file 2> /dev/null
+  ensure_config_file_exists "sudo" $config_file "dd-agent"
+  update_par "sudo" $config_file "true" "" "true"
+  yamllint -c "$yaml_config" --no-warnings $config_file
+  assertEquals 0 $?
+  assertEquals "$(sudo yq eval '.private_action_runner.enabled' $config_file)" "true"
+  assertEquals "$(sudo yq eval '.private_action_runner.api_key_only_enrollment' $config_file)" "true"
+}
+testParEnabledWithoutApiKeyOnlyEnrollment() {
+  sudo rm $config_file 2> /dev/null
+  ensure_config_file_exists "sudo" $config_file "dd-agent"
+  update_par "sudo" $config_file "true" ""
+  # Should not add api_key_only_enrollment when not provided
+  assertEquals "$(sudo yq eval '.private_action_runner.api_key_only_enrollment' $config_file)" "null"
+}
 
 # shellcheck source=/dev/null
 . shunit2