[AAP] Configure the Kubernetes AppSec injector through DatadogAgent CRD fields

[eliottness]

What does this PR do?

Moves every Datadog Operator example and reference entry for the Kubernetes AppSec injector from the agent.datadoghq.com/appsec.* annotations to the spec.features.appsec.injector fields of the DatadogAgent CRD.

Pages updated:

Page	Change
containers/kubernetes/appsec.md	Sidecar-mode and external-mode Operator snippets; both configuration reference lists now name CRD fields instead of annotations; note about the annotation deprecation
security/application_security/setup/kubernetes/istio.md	Operator snippet
security/application_security/setup/kubernetes/envoy-gateway.md	Operator snippet — external mode now comes from injector.mode: external instead of the DD_CLUSTER_AGENT_APPSEC_INJECTOR_MODE env override
security/application_security/setup/nginx/ingress-controller.md	Operator snippet, plus the Operator minimum version in the prerequisites

Motivation

The Datadog Operator now configures the AppSec injector from the CRD. The agent.datadoghq.com/appsec.* annotations are deprecated in Operator v1.31.0 — the first release that carries spec.features.appsec.injector — and removed in v1.32.0. The two sources are mutually exclusive — when spec.features.appsec.injector is set, annotations are ignored entirely, including for fields the CRD leaves unset — which the docs now state explicitly so nobody migrates one field at a time and silently turns the feature off.

Mapping used (from the Operator's docs/deprecated_configs.md):

Annotation	CRD field
agent.datadoghq.com/appsec.injector.enabled	spec.features.appsec.injector.enabled
…/appsec.injector.mode	…injector.mode
…/appsec.injector.autoDetect	…injector.autoDetect
…/appsec.injector.proxies	…injector.proxies
…/appsec.injector.processor.address	…injector.processor.address
…/appsec.injector.processor.port	…injector.processor.port
…/appsec.injector.processor.service.name	…injector.processor.service.name
…/appsec.injector.processor.service.namespace	…injector.processor.service.namespace
…/appsec.sidecar.image	…injector.sidecar.image
…/appsec.sidecar.image_tag	…injector.sidecar.imageTag
…/appsec.sidecar.port	…injector.sidecar.port
…/appsec.sidecar.health_port	…injector.sidecar.healthPort
…/appsec.sidecar.body_parsing_size_limit	…injector.sidecar.bodyParsingSizeLimit
…/appsec.sidecar.resources.{requests,limits}.{cpu,memory}	…injector.sidecar.resources.{requests,limits}.{cpu,memory}
…/appsec.nginx.module_mount_path	…injector.nginx.moduleMountPath

⚠️ Draft on purpose

Do not merge before the Datadog Operator release that contains spec.features.appsec.injector is published. Until then these snippets would not work for customers. Note: v1.30.0 was released on 2026-09-08 without this field (verified with git tag --contains — the v1.30 release branch was cut before PR #3337 merged), so the diff says v1.31.0. Before merging:

• Confirm the released Operator version and update v1.31.0 everywhere in the diff if it changed
• Confirm the removal version (v1.32.0) in the deprecation note

Not in this PR

• hugo/content/es/... translations of the Istio and Envoy Gateway pages, which still carry the annotations and are handled by the localization pipeline
• spec.features.appsec.injector.gke.gatewayClasses, a new capability with no annotation equivalent (requires Cluster Agent 7.82.0+) — worth its own PR
• Helm values, which this migration does not affect

[github-actions]

Preview links (active after the build_preview check completes)

Modified Files

• https://docs-staging.datadoghq.com/eliott.bouhana/aap-k8s-injector-crd-fields/containers/kubernetes/appsec
• https://docs-staging.datadoghq.com/eliott.bouhana/aap-k8s-injector-crd-fields/security/application_security/setup/kubernetes/envoy-gateway
• https://docs-staging.datadoghq.com/eliott.bouhana/aap-k8s-injector-crd-fields/security/application_security/setup/kubernetes/istio
• https://docs-staging.datadoghq.com/eliott.bouhana/aap-k8s-injector-crd-fields/security/application_security/setup/nginx/ingress-controller