[Backport v1.23] [feature][autoscaling] Update RBAC allow watch for karpenter resources

[dd-octo-sts]

Backport 784f22c from #2508.

---

What does this PR do?

Allow watch for karpenter.sh resources

Motivation

The cluster agent controller requires this permission in order to live scale clusters.

Additional Notes

Anything else we should know when reviewing?

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

• Agent: vX.Y.Z
• Cluster Agent: v7.74.1

Describe your test plan

1. Enable the cluster autoscaling feature
2. Check that the datadog-cluster-agent-autoscaling clusterrole has policy rule with *.karpenter.sh verb watch

Checklist

• PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
• PR has a milestone or the qa/skip-qa label
• All commits are signed (see: signing commits)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.32%. Comparing base (04b2037) to head (dcce6f8).
⚠️ Report is 16 commits behind head on v1.23.

Additional details and impacted files

@@           Coverage Diff           @@
##            v1.23    #2510   +/-   ##
=======================================
  Coverage   38.32%   38.32%           
=======================================
  Files         300      300           
  Lines       25576    25577    +1     
=======================================
+ Hits         9801     9802    +1     
  Misses      15032    15032           
  Partials      743      743           

Flag	Coverage Δ
unittests	38.32% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...ontroller/datadogagent/feature/autoscaling/rbac.go	100.00% <100.00%> (ø)
internal/controller/datadogagent_controller.go	66.66% <ø> (ø)

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 04b2037...dcce6f8. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fanny-jiang]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-01-21 18:38:00 UTC ℹ️ Start processing command /merge

---

2026-01-21 18:38:24 UTC ℹ️ MergeQueue: waiting for PR to be ready

This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
It will be added to the queue as soon as checks pass and/or get approvals. View in MergeQueue UI.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.

---

2026-01-21 22:39:06 UTC ⚠️ MergeQueue: This merge request was unqueued

devflow unqueued this merge request: It did not become mergeable within the expected time