Toggles DD_DISCOVERY_ENABLED and DD_DISCOVERY_USE_SYSTEM_PROBE_LITE
on the system-probe container. Chart key path matches
tests/cws/kind_test.go.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

TestK8sTestSuite deploys the existing nginx workload and verifies
that the agent's discovery feature reports it on tcp/80. Covers
both system-probe-lite and system-probe modes via Helm.

This is a sanity check that the discovery flow works end-to-end on
k8s; deep per-language assertions remain the VM suite's job. Closes
the gap that allowed
DataDog/helm-charts#2634 to ship without
detection.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

- getAgentPod: fail fast with t.Fatalf when no agent pod has a
  ready system-probe container, instead of silently falling back
  to a possibly-terminating pod.
- TestNginxDiscovered: flush fakeintake before validateDiscoveryMode
  so the second mode's assertion can't be satisfied by stale
  payloads from the first mode.
- Drop K8s infix from validateDiscoveryMode and dumpDebugInfo;
  the receiver already disambiguates from linuxTestSuite's
  methods of the same name.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Add datadog.discovery.enabled: true so the chart deploys the
system-probe container. Without this, the chart's
should-enable-system-probe template returns false (agent version
resolves below the 7.78.0 auto-enable threshold) and our
container-level env vars have no effect because the container
itself isn't deployed.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Drop dual-mode iteration (system-probe-lite / system-probe). The
env-var override that was meant to flip modes at runtime
(DD_DISCOVERY_USE_SYSTEM_PROBE_LITE) doesn't take effect because
the chart-generated /etc/datadog-agent/system-probe.yaml wins,
and the chart's discovery-use-system-probe-lite template resolves
to false on QA agent versions below 7.78.0.

Also drop validateDiscoveryMode and the post-UpdateEnv pod-readiness
race they exposed. The k8s test is now a pure sanity check: deploy
nginx, wait for fakeintake to receive a process payload reporting
tcp/80, done. Whichever discovery mode the chart picks is fine.

Mode-switching coverage can return as a follow-up once the chart
exposes a values key for use_system_probe_lite or we configure
system-probe.yaml directly.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Lint nit caught by gopls slicescontains rule. Pure simplification.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

The chart's get-agent-version helper eagerly maps both "latest" and
"7" to a 7.67.0 floor for version comparison, so without an explicit
pin the chart picks full system-probe (its 7.78.0 SPL auto-enable
threshold is gated off). Pin agents.image.tag to 7.78.0 so the lite
path is exercised by default both locally and in CI.

Then cover full system-probe too: enable
datadog.systemProbe.enableOOMKill in the second sub-test to add a
non-discovery system-probe feature. The agent's shouldExecSPLite
logic only exec's into system-probe-lite when discovery is the only
enabled module, so this forces the full binary.

Pod-readiness after UpdateEnv is wrapped in EventuallyWithT to
handle the daemonset roll between sub-tests.

Also log the matched nginx process payload so we can iterate on
service-name and language assertions in a follow-up once we see
what fields the agent actually populates.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

The framework default chart version (test/e2e-framework/components/
datadog/agent/kubernetes_helm.go HelmVersion = 3.155.1) predates
the discovery-use-system-probe-lite template (added in chart 3.205.0
via DataDog/helm-charts#2598). Without bumping the chart version,
SPL is never enabled regardless of agent image tag or
datadog.discovery.enabled setting.

Pin per-test via kubernetesagentparams.WithHelmChartVersion so the
framework default doesn't have to change.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Toggling datadog.systemProbe.enableOOMKill via helm values only
mutates the chart-rendered configmap; it doesn't change the
DaemonSet pod template, and the chart's daemonset.yaml has no
checksum/system-probe-yaml annotation tying the pod template to
that configmap. Result: the existing pod stays alive between
sub-tests, system-probe-lite keeps running, and the sub-test
expecting full system-probe fails.

Replace the EnableOOMKill bool with a Mode string ("spl"/"sp")
that drives both the OOMKill toggle and a unique
agents.podAnnotations.discovery-e2e-mode value. The annotation
change shifts the pod template hash so k8s rolls the DaemonSet
when the mode flips.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

…on state

Beyond the bare nginx-on-tcp/80 check, also verify what the
discovery pipeline populates on the matched process:

- ServiceDiscovery.GeneratedServiceName.Name == "nginx"
- ServiceDiscovery.GeneratedServiceName.Source == COMMAND_LINE
- ServiceDiscovery.ApmInstrumentation == false (no tracer)
- Process.InjectionState == INJECTION_NOT_INJECTED
- Process.ContainerId is populated (proves the discovery → tagger
  pipeline correlated the process with its container)

nginx is C/native so language detection doesn't fire and there's
no tracer metadata to assert. Language + tracer assertions can
come in a follow-up that adds an instrumented Go workload (the
existing apps-calendar-go image is a fit but has no K8sAppDefinition
yet).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Chart 3.213.0 ships DataDog/helm-charts#2643 which bumps the
get-agent-version fallback for the single-component tags "latest"
and "7" from 7.67.0 to 7.78.3. With that fix the chart treats
either tag like a current agent and the discovery
>=7.78.0 auto-enable threshold is met without an explicit
agents.image.tag override.

Drop the 7.78.0 pin and the doNotCheckTag escape hatch. The
framework's default image (gcr.io/datadoghq/agent:latest locally,
the pipeline-built tag in CI) now flows through to a chart that
will enable SPL on both.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Co-Authored-By: Claude Sonnet 4.6 (1M context) <[email protected]>