@@ -2,5 +2,8 @@
 
 @test "Create a tenant Kubernetes control plane with latest version" {
   . hack/e2e-apps/run-kubernetes.sh
-  run_kubernetes_test 'keys | sort_by(.) | .[-1]' 'test-latest-version' '59991'
+  # 4th arg = enable_ouroboros: folds the standalone ouroboros.bats's
+  # hairpin-NAT reconciliation assertions onto this cluster instead of
+  # spinning up a second ~25m Kamaji bringup.
+  run_kubernetes_test 'keys | sort_by(.) | .[-1]' 'test-latest-version' '59991' 'true'
 }
@@ -4,12 +4,36 @@ run_kubernetes_test() {
     local version_expr="$1"
     local test_name="$2"
     local port="$3"
+    # Optional: when "true", enable the ouroboros addon on the Kubernetes CR
+    # and run the hairpin-NAT reconciliation assertions after the cluster is
+    # Ready. Folded in here so we don't pay a second ~25m Kamaji bringup just
+    # to flip one addon flag — kubernetes-latest passes "true", kubernetes-
+    # previous leaves it empty.
+    local enable_ouroboros="${4:-}"
     local k8s_version=$(yq "$version_expr" packages/apps/kubernetes/files/versions.yaml)
 
   # Clean up stale resources from a previous failed retry
   kubectl -n tenant-test delete kuberneteses.apps.cozystack.io "${test_name}" --ignore-not-found --wait=false 2>/dev/null || true
   kubectl -n tenant-test wait kuberneteses.apps.cozystack.io "${test_name}" --for=delete --timeout=2m 2>/dev/null || true
 
+  # Compose the optional ouroboros addon block. Indentation matches the
+  # surrounding addons map (4 spaces).
+  local ouroboros_addon=""
+  if [ "${enable_ouroboros}" = "true" ]; then
+    ouroboros_addon=$(cat <<'YAML'
+    ouroboros:
+      enabled: true
+      # logLevel=debug surfaces controller informer events for failure
+      # diagnosis; scoped to the e2e fixture only, production tenants stay
+      # on the upstream chart default (info).
+      valuesOverride:
+        ouroboros:
+          controller:
+            logLevel: debug
+YAML
+)
+  fi
+
   kubectl apply -f - <<EOF
 apiVersion: apps.cozystack.io/v1alpha1
 kind: Kubernetes
@@ -38,6 +62,7 @@ spec:
     monitoringAgents:
       enabled: false
       valuesOverride: {}
+${ouroboros_addon}
     verticalPodAutoscaler:
       valuesOverride: {}
   controlPlane:
@@ -71,8 +96,11 @@ EOF
   # Wait for the tenant-test namespace to be active
   kubectl wait namespace tenant-test --timeout=20s --for=jsonpath='{.status.phase}'=Active
 
-  # Wait for the Kamaji control plane to be created (retry for up to 10 seconds)
-  timeout 10 sh -ec 'until kubectl get kamajicontrolplane -n tenant-test kubernetes-'"${test_name}"'; do sleep 1; done'
+  # Wait for the Kamaji control plane to be created. Under Flux v2.8
+  # kstatus-based health checks helm-controller can take 20-30s to dispatch
+  # the new Kubernetes HR before it renders the KamajiControlPlane CR; the
+  # old 10s budget was tight on v2.7 and consistently fails on v2.8.
+  timeout 2m sh -ec 'until kubectl get kamajicontrolplane -n tenant-test kubernetes-'"${test_name}"'; do sleep 1; done'
 
   # Wait for the tenant control plane to be fully created (timeout after 4 minutes)
   kubectl wait --for=condition=TenantControlPlaneCreated kamajicontrolplane -n tenant-test kubernetes-${test_name} --timeout=4m
@@ -323,10 +351,125 @@ EOF
   kubectl wait machinedeployment kubernetes-${test_name}-md0 -n tenant-test --timeout=10m --for=jsonpath='{.status.v1beta2.readyReplicas}'=2
 
   for component in cilium coredns csi vsnap-crd; do
-      kubectl wait hr kubernetes-${test_name}-${component} -n tenant-test --timeout=1m --for=condition=ready
+      kubectl wait hr kubernetes-${test_name}-${component} -n tenant-test --timeout=5m --for=condition=ready
     done
     kubectl wait hr kubernetes-${test_name}-ingress-nginx -n tenant-test --timeout=5m --for=condition=ready
 
+  # Optional ouroboros addon assertions. Folded in from the standalone
+  # ouroboros.bats so the test reuses this cluster instead of spinning up a
+  # second ~25m Kamaji bringup. The assertions cover: HR Ready, controller
+  # pod Running, Ingress->coredns-custom rewrite line injection, and the
+  # end-to-end DNS resolution proof from inside the tenant cluster.
+  if [ "${enable_ouroboros}" = "true" ]; then
+    kubectl wait hr "kubernetes-${test_name}-ouroboros" -n tenant-test \
+      --timeout=10m --for=condition=ready
+
+    # cozystack coredns wrapper renders an empty coredns-custom ConfigMap in
+    # kube-system; the ouroboros controller writes the rewrite snippet into
+    # its ouroboros.override key.
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n kube-system \
+      get configmap coredns-custom
+
+    # Upstream chart ships no readiness probe — wait covers pod Running only;
+    # the rewrite-snippet check below is the real reconciliation assertion.
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n cozy-ouroboros \
+      wait pod --selector=app.kubernetes.io/component=controller \
+      --timeout=5m --for=condition=ready
+
+    local hairpin_host=hairpin-cozystack-e2e.example.invalid
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n default apply -f - <<EOF
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: hairpin-probe
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - ${hairpin_host}
+      secretName: hairpin-probe-tls
+  rules:
+    - host: ${hairpin_host}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: hairpin-probe
+                port:
+                  number: 80
+EOF
+
+    # Poll the import ConfigMap for the rewrite line. Dump-the-whole-map
+    # form avoids the silent-empty kubectl jsonpath bracket-notation trap
+    # on ConfigMap keys with dots (e.g. ouroboros.override).
+    local deadline=$(( $(date +%s) + 300 ))
+    local snippet=
+    while [ "$(date +%s)" -lt "${deadline}" ]; do
+      snippet=$(kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n kube-system \
+        get configmap coredns coredns-custom \
+        -o 'jsonpath={range .items[*]}{.metadata.name}{"\n"}{.data}{"\n---\n"}{end}' \
+        2>/dev/null || true)
+      if echo "${snippet}" | grep -q "rewrite name ${hairpin_host}"; then break; fi
+      sleep 5
+    done
+    if ! echo "${snippet}" | grep -q "rewrite name ${hairpin_host}"; then
+      echo "ouroboros rewrite snippet for ${hairpin_host} not written to coredns-custom within 5m" >&2
+      kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n cozy-ouroboros \
+        logs --selector=app.kubernetes.io/component=controller --tail=200 --all-containers || true
+      exit 1
+    fi
+
+    # End-to-end proof: resolve the hairpin host from inside the tenant.
+    # CoreDNS reload-period default is 30s, so the in-pod loop is needed.
+    local proxy_ip
+    proxy_ip=$(kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n cozy-ouroboros \
+      get service ouroboros-proxy -o jsonpath='{.spec.clusterIP}' 2>/dev/null || true)
+    if [ -z "${proxy_ip}" ]; then
+      echo "ouroboros-proxy Service has no ClusterIP" >&2
+      exit 1
+    fi
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n default \
+      delete pod dnscheck --ignore-not-found 2>/dev/null || true
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n default \
+      run dnscheck --image=nicolaka/netshoot:v0.13 --restart=Never \
+      --command -- sh -c "
+        deadline=\$(( \$(date +%s) + 120 ))
+        while [ \"\$(date +%s)\" -lt \"\${deadline}\" ]; do
+          addr=\$(dig +short +tries=2 +time=5 ${hairpin_host} | head -n 1)
+          echo \"resolved: \${addr:-<empty>}\"
+          if [ \"\${addr}\" = \"${proxy_ip}\" ]; then
+            exit 0
+          fi
+          sleep 5
+        done
+        echo \"timed out waiting for ${hairpin_host} to resolve to ${proxy_ip}\"
+        exit 1
+      "
+    local dns_deadline=$(( $(date +%s) + 180 ))
+    local phase=
+    while [ "$(date +%s)" -lt "${dns_deadline}" ]; do
+      phase=$(kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n default \
+        get pod dnscheck -o jsonpath='{.status.phase}' 2>/dev/null || true)
+      case "${phase}" in
+        Succeeded|Failed) break ;;
+      esac
+      sleep 3
+    done
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n default \
+      logs dnscheck 2>&1 | sed 's/^/  dnscheck: /' || true
+    if [ "${phase:-}" != "Succeeded" ]; then
+      echo "dnscheck pod did not reach Succeeded phase (last seen: ${phase:-<empty>})" >&2
+      exit 1
+    fi
+
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n default \
+      delete pod dnscheck --ignore-not-found 2>/dev/null || true
+    kubectl --kubeconfig "tenantkubeconfig-${test_name}" -n default \
+      delete ingress hairpin-probe --ignore-not-found 2>/dev/null || true
+  fi
+
   # Guard: parent HelmRelease must not have entered an install/upgrade remediation cycle.
   # A non-zero installFailures/upgradeFailures indicates the helm-wait budget expired while
   # admin-kubeconfig was still being provisioned, which would trigger uninstall remediation
Original file line number	Diff line number	Diff line change
`@@ -2,5 +2,8 @@`
`2`	`2`
`3`	`3`	`@test "Create a tenant Kubernetes control plane with latest version" {`
`4`	`4`	`. hack/e2e-apps/run-kubernetes.sh`
`5`		`- run_kubernetes_test 'keys \| sort_by(.) \| .[-1]' 'test-latest-version' '59991'`
	`5`	`+ # 4th arg = enable_ouroboros: folds the standalone ouroboros.bats's`
	`6`	`+ # hairpin-NAT reconciliation assertions onto this cluster instead of`
	`7`	`+ # spinning up a second ~25m Kamaji bringup.`
	`8`	`+ run_kubernetes_test 'keys \| sort_by(.) \| .[-1]' 'test-latest-version' '59991' 'true'`
`6`	`9`	`}`