From a2513e048be973b211aaa5fb2c6b77008a51f582 Mon Sep 17 00:00:00 2001 From: Irving Santiago Date: Mon, 10 Aug 2026 01:14:52 +0200 Subject: [PATCH] [DOCS-XXXXX] Rewrite Private Actions Overview for Execution Policies --- .../en/actions/private_actions/_index.md | 113 +++++++++++++----- 1 file changed, 81 insertions(+), 32 deletions(-) diff --git a/hugo/content/en/actions/private_actions/_index.md b/hugo/content/en/actions/private_actions/_index.md index 13a590af8f1..03b13a5f69f 100644 --- a/hugo/content/en/actions/private_actions/_index.md +++ b/hugo/content/en/actions/private_actions/_index.md @@ -1,58 +1,107 @@ --- title: Private Actions Overview -description: Allow workflows and apps to interact with private network services using private action runners with secure authentication. +description: Run actions against services in your private network from Datadog products, using a private action runner as the execution and authorization layer for on-premises actions. disable_toc: false aliases: - service_management/workflows/private_actions/ - service_management/app_builder/private_actions/ further_reading: -- link: "actions/connections" - tag: "Documentation" - text: "App Builder Connections" -- link: "actions/connections" - tag: "Documentation" - text: "Workflow Connections" - link: "actions/private_actions/use_private_actions" tag: "Documentation" - text: "Use Private Actions" -- link: "actions/private_actions/run_script" + text: "Set up a private action runner" +- link: "actions/private_actions/enroll_runner" tag: "Documentation" - text: "Run a Script with the Private Action Runner" -- link: "actions/private_actions/private_action_credentials" + text: "Enrollment and ownership" +- link: "actions/private_actions/execution_policies" tag: "Documentation" - text: "Handling Private Action Credentials" -- link: "https://www.datadoghq.com/blog/private-actions/" - tag: "Blog" - text: "Remediate Kubernetes incidents faster using private actions in your apps and workflows" -- link: "https://www.datadoghq.com/blog/pm-app-automation/" - tag: "Blog" - text: "How we created a single app to automate repetitive tasks with Datadog Workflow Automation, Datastore, and App Builder" + text: "Execution Policies" +- link: "actions/connections" + tag: "Documentation" + text: "Connections" --- -Private actions allow your Datadog workflows and apps to interact with services hosted on your private network without exposing them to the public internet. To use private actions, you must install a private action runner on a host in your network and pair the runner with a [connection][1]. +Private actions allow you to run actions against services in your private network, such as Kubernetes +clusters, internal hosts, databases, and internal APIs, without exposing those services to the public +internet. You run them through a private action runner that you deploy in your environment, either +inside the Datadog Agent (recommended) or as a standalone runner. Datadog products that use private +actions include Workflow Automation, App Builder, Datadog MCP, and Bits AI investigations. + +To go from zero to running your first private action, see [Get started with private actions][8]. + +Private actions rely on two layers: + +- **The authorization layer** is managed in Datadog. It defines which users and products can run which + actions on which runners, and grants or denies each action before it reaches a runner. The actions a + runner is allowed to run are also restricted on the Agent side, by the actions allowlist in the Agent + configuration (`datadog.yaml`). +- **The execution layer** is the private action runner. It runs in your network, receives action tasks + from Datadog, runs each task against the target service, and returns the result to Datadog. +For how authorization works, see [How private actions are authorized](#how-private-actions-are-authorized). + +## The private action runner + +The private action runner is the component you deploy in your environment to run private actions. It opens +an outbound connection to Datadog, polls for action tasks, runs each task against the target service, and +returns the result. + +## Choose how to run the runner + +The private action runner is available in two forms: a standalone runner that you deploy and manage +yourself, or a runner built into the Datadog Agent. + +| | Runner in the Datadog Agent | Standalone runner | +|---|---|---| +| **What it is** | A component of the Datadog Agent, turned on with a single configuration flag. | A dedicated container you can install and manage independently of the Datadog Agent. | +| **Best when** | You already run the Datadog Agent and want to manage the runner through the Agent life cycle. | You need an integration that is not yet available in the Agent. | +| **Status** | Recommended for new deployments. | Supported (maintenance mode). | + +For most users, running the private action runner in the Datadog Agent is the recommended path. + +### Deployment options in the Datadog Agent + +When you run the private action runner in the Datadog Agent, you choose one of three deployment options, +based on where the runner needs to act: -The recommended way to install a private action runner is through the [Datadog Agent][2] (version `7.77.0` or later). This method supports Linux, Windows, and Kubernetes environments. Alternatively, you can install the runner as a standalone Docker container or [Kubernetes][3] deployment. See [Use Private Actions][4] for installation instructions. +| Deployment option | How it runs | Deploy with | Best for | +|---|---|---|---| +| **Host** | A separate process next to the Datadog Agent on a Linux or Windows host. | Host install | Actions that target a specific host. | +| **Kubernetes node Agent** | A container in the node Agent, using the same runner binary as the host process. | Helm, Operator | Node-local actions in a Kubernetes cluster. | +| **Kubernetes Cluster Agent** | In-process inside the Cluster Agent, with no separate binary. One runner serves the whole cluster. | Helm, Operator | Cluster-wide Kubernetes actions. | -
To install a private action runner, your organization must have Remote Configuration enabled.
+For installation steps, see [Set up a private action runner in the Datadog Agent][1] or +[Set up a standalone runner][7]. -When you first start the runner, it generates a private key for authentication with Datadog's servers. This private key is never accessible by Datadog and ensures you exclusive access. Datadog uses a public key derived from the private key as the means to authenticate specific runners. +## How private actions are authorized -## How it works +Datadog offers two authorization models. The model a runner uses is set when the runner is enrolled, and +it follows from the runner's ownership. For details, see [Enrollment and ownership][2]. -The private action runner continuously polls for tasks from your Datadog account, executes them by interacting with your internal service, and reports the result back to Datadog. +- **Execution Policies** apply to runners in the Datadog Agent and are built for managing access at scale. + Instead of creating a separate connection for each integration on each runner, you use Agent tags to + target one or more sets of runners. Execution Policies also give you fine-grained control: you can allow + or deny specific actions or sets of actions, and apply integration-specific scopes, such as the target + Kubernetes namespaces for a Kubernetes action. +- **Connections** are available for both the runner in the Agent and the standalone runner. They can be + attached to at most a single runner. A connection can store credentials for a service. -{{< img src="actions/private_actions/private_action_runner_-_diagram_workflow.png" alt="Overview diagram illustrating how Private actions work" style="width:90%;" >}} +To compare the two models and decide which one applies to your runner, see [Authorize private actions][3]. -## Monitor your Private Action Runners with Datadog Metrics +## Choose your setup -While setting up your Private Action Runners, you can enable observability metrics to monitor your runners' health and private action usage. These metrics can be used in Datadog products like Dashboards and Monitors. To get started quickly, you can use the provided [out-of-the-box Dashboard][5]. +- To use the recommended, Agent-managed setup with fleet-wide access control, run the runner in the + Datadog Agent and authorize it with Execution Policies. Start with: + 1. [Set up a private action runner][1] + 2. then [Execution Policies][4]. +- Or use Connections with a runner in the Agent or a standalone runner. See [Connections][5]. ## Further reading {{< partial name="whats-next/whats-next.html" >}} -[1]: /actions/connections/ -[2]: /agent/ -[3]: https://github.com/DataDog/helm-charts/tree/main/charts/private-action-runner -[4]: /actions/private_actions/use_private_actions -[5]: https://app.datadoghq.com/dash/integration/private_actions_runner +[1]: /actions/private_actions/use_private_actions/ +[2]: /actions/private_actions/enroll_runner/ +[3]: /actions/private_actions/authorize_private_actions/ +[4]: /actions/private_actions/execution_policies/ +[5]: /actions/connections/ +[7]: /actions/private_actions/set_up_standalone/ +[8]: /actions/private_actions/getting_started/