kyverno: add container-based config discovery support

[vitkyrka]

What does this PR do?

Adds container-based config discovery support to kyverno.

Discovery finds the Kyverno controller metrics endpoints using named Kubernetes ports (metrics-port and metrics) instead of a numeric port hint.

The ad_identifiers targets somewhat generic image names (background-controller, etc.) so we use a CEL selector to narrow those to Kyverno images.

The E2E coverage validates that Kubernetes Autodiscovery finds the four Kyverno controller instances and that generated discovery candidates can probe a Kyverno controller without destabilizing it.

Motivation

https://datadoghq.atlassian.net/browse/DSCVR-527

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[datadog-datadog-us1-prod]

 

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 50.00%
• Overall Coverage: 81.48% (+11.59%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 3c32b04 | Docs | Datadog PR Page | Give us feedback!}

[vitkyrka]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• kyverno: add container-based config discovery support #24511 👈 (View in Graphite)
• argo_workflows: add container-based config discovery support #24512 : 1 other dependent PR (#24510 )
• velero: add container-based config discovery support #24507 : 6 other dependent PRs (#24459 , #24506 , #24519 and 3 others)
• Add discovery port name helper #24555
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[dd-octo-sts]

Validation Report

Validation	Description	Status
license-headers	Validate Python files have proper license headers	❌
models	Validate configuration data models match spec.yaml	❌

Run ddev validate all changed --fix to attempt to auto-fix supported validations.

Passed validations (19)

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run