#2643)

[datadog] auto-enable discovery on `latest` and `7` tags

The `get-agent-version` fallback substituted `7.67.0` for the
single-component tags `latest` and `7`, which is below the `>=7.78.0`
threshold that auto-enables service discovery (introduced in #2598). As
a result, users on these floating tags never got a system-probe
container or `system-probe-lite`, despite the actual `latest` image
supporting it.

Bump the fallback to `7.78.0` so the chart treats `latest`/`7` like the
current agent and auto-enables discovery with `system-probe-lite`.

[datadog] expand 3.209.0 CHANGELOG entry to match PR scope

The fallback bump affects several version-gated code paths besides
discovery (ADP, -fips-full, standalone DDOT FIPS, DD_USE_DOGSTATSD).
Reword the changelog so it matches the release note in the PR
description.

Merge remote-tracking branch 'origin/main' into vitkyrka/disco-latest

# Conflicts:
#	charts/datadog/CHANGELOG.md

Merge remote-tracking branch 'origin/main' into vitkyrka/disco-latest

# Conflicts:
#	charts/datadog/CHANGELOG.md
#	charts/datadog/Chart.yaml
#	charts/datadog/README.md

Co-authored-by: vincent.whitchurch <[email protected]>

### What does this PR do?

Adds a Kubernetes E2E sanity test for the Datadog Agent's discovery feature, mirroring (in spirit) the existing Linux VM suite in `test/new-e2e/tests/discovery/linux_test.go`. The new suite at `test/new-e2e/tests/discovery/k8s_test.go`:

- Provisions a Kind-on-EC2 cluster (`provkindvm`) with the agent installed via Helm and an `nginx` workload.
- Runs `TestNginxDiscovered` in two sub-tests covering both discovery modes:
  - `system-probe-lite` — discovery enabled alone; the agent execs into `system-probe-lite` per `cmd/system-probe/subcommands/run/splite.go`.
  - `system-probe` — adds `datadog.systemProbe.enableOOMKill: true` so the agent's `shouldExecSPLite` keeps the full binary running.
- Asserts on the matched nginx process: TCP port 80 listener, `ServiceDiscovery.GeneratedServiceName == {nginx, SOURCE_COMMAND_LINE}`, `ApmInstrumentation == false`, `InjectionState == NOT_INJECTED`, non-empty `ContainerId`.
- Pins the Helm chart version to `3.213.0`; the framework default (`3.155.1`) predates both the discovery template (chart 3.205.0, DataDog/helm-charts#2598) and the `latest`/`7` → `7.78.x` fallback fix (chart 3.213.0, DataDog/helm-charts#2643).

### Motivation

https://datadoghq.atlassian.net/browse/DSCVR-385

There is no k8s e2e for discovery today. DataDog/helm-charts#2634 fixed a bug in discovery on k8s related to the seccomp profile; the change went undetected before merge because nothing exercises the discovery flow on a Helm-installed agent. This suite closes that gap with a smoke-level check that the discovery payload reaches fakeintake in both modes.

The k8s suite is narrower than `linux_test.go` (single workload, smoke-level assertions), at least for now. This is to avoid having to add new app definitions at this point for a basic test. The VM suite continues to be the exhaustive per-language source of truth.

### Describe how you validated your changes

Ran locally against AWS twice with `E2E_DEV_MODE=true dda inv -- -e new-e2e-tests.run --targets ./tests/discovery --run TestK8sTestSuite --stack-name-suffix v2`:

```
--- PASS: TestK8sTestSuite (364.64s)
    --- PASS: TestK8sTestSuite/TestNginxDiscovered (...)
        --- PASS: TestK8sTestSuite/TestNginxDiscovered/system-probe-lite
        --- PASS: TestK8sTestSuite/TestNginxDiscovered/system-probe
```

Lint: `golangci-lint run ./test/new-e2e/tests/discovery/...` clean (0 issues).

### Additional Notes

A few quirks worth flagging for reviewers:

- **Forced DaemonSet rollout via pod annotation.** Toggling `datadog.systemProbe.enableOOMKill` between sub-tests only mutates the chart-rendered configmap; the chart's `daemonset.yaml` has no `checksum/system-probe-yaml` annotation tying the pod template to that configmap, so the existing pod stays alive across the change. The suite writes a `agents.podAnnotations.discovery-e2e-mode: "spl"/"sp"` that intentionally differs per sub-test to bump the pod-template hash and force a rollout.
- **Tracer metadata / language detection out of scope.** Nginx is C/native so `language` and `serviceDiscovery.tracerMetadata` aren't populated. The two natural ways to extend this — switch to (or add) an OTel-instrumented Go server (`apps-calendar-go` — no `K8sAppDefinition` yet) or a `dd-trace-go`-instrumented app (`apps-tracegen` predates the memfd-tracer-metadata feature in `dd-trace-go.v1`) — both require cross-repo work in `test-infra-definitions`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: vincent.whitchurch <[email protected]>

### What does this PR do?

Adds a Kubernetes E2E sanity test for the Datadog Agent's discovery feature, mirroring (in spirit) the existing Linux VM suite in `test/new-e2e/tests/discovery/linux_test.go`. The new suite at `test/new-e2e/tests/discovery/k8s_test.go`:

- Provisions a Kind-on-EC2 cluster (`provkindvm`) with the agent installed via Helm and an `nginx` workload.
- Runs `TestNginxDiscovered` in two sub-tests covering both discovery modes:
  - `system-probe-lite` — discovery enabled alone; the agent execs into `system-probe-lite` per `cmd/system-probe/subcommands/run/splite.go`.
  - `system-probe` — adds `datadog.systemProbe.enableOOMKill: true` so the agent's `shouldExecSPLite` keeps the full binary running.
- Asserts on the matched nginx process: TCP port 80 listener, `ServiceDiscovery.GeneratedServiceName == {nginx, SOURCE_COMMAND_LINE}`, `ApmInstrumentation == false`, `InjectionState == NOT_INJECTED`, non-empty `ContainerId`.
- Pins the Helm chart version to `3.213.0`; the framework default (`3.155.1`) predates both the discovery template (chart 3.205.0, DataDog/helm-charts#2598) and the `latest`/`7` → `7.78.x` fallback fix (chart 3.213.0, DataDog/helm-charts#2643).

### Motivation

https://datadoghq.atlassian.net/browse/DSCVR-385

There is no k8s e2e for discovery today. DataDog/helm-charts#2634 fixed a bug in discovery on k8s related to the seccomp profile; the change went undetected before merge because nothing exercises the discovery flow on a Helm-installed agent. This suite closes that gap with a smoke-level check that the discovery payload reaches fakeintake in both modes.

The k8s suite is narrower than `linux_test.go` (single workload, smoke-level assertions), at least for now. This is to avoid having to add new app definitions at this point for a basic test. The VM suite continues to be the exhaustive per-language source of truth.

### Describe how you validated your changes

Ran locally against AWS twice with `E2E_DEV_MODE=true dda inv -- -e new-e2e-tests.run --targets ./tests/discovery --run TestK8sTestSuite --stack-name-suffix v2`:

```
--- PASS: TestK8sTestSuite (364.64s)
    --- PASS: TestK8sTestSuite/TestNginxDiscovered (...)
        --- PASS: TestK8sTestSuite/TestNginxDiscovered/system-probe-lite
        --- PASS: TestK8sTestSuite/TestNginxDiscovered/system-probe
```

Lint: `golangci-lint run ./test/new-e2e/tests/discovery/...` clean (0 issues).

### Additional Notes

A few quirks worth flagging for reviewers:

- **Forced DaemonSet rollout via pod annotation.** Toggling `datadog.systemProbe.enableOOMKill` between sub-tests only mutates the chart-rendered configmap; the chart's `daemonset.yaml` has no `checksum/system-probe-yaml` annotation tying the pod template to that configmap, so the existing pod stays alive across the change. The suite writes a `agents.podAnnotations.discovery-e2e-mode: "spl"/"sp"` that intentionally differs per sub-test to bump the pod-template hash and force a rollout.
- **Tracer metadata / language detection out of scope.** Nginx is C/native so `language` and `serviceDiscovery.tracerMetadata` aren't populated. The two natural ways to extend this — switch to (or add) an OTel-instrumented Go server (`apps-calendar-go` — no `K8sAppDefinition` yet) or a `dd-trace-go`-instrumented app (`apps-tracegen` predates the memfd-tracer-metadata feature in `dd-trace-go.v1`) — both require cross-repo work in `test-infra-definitions`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: vincent.whitchurch <[email protected]>