fix(e2e): unblock Chainsaw suite after replication fix

With the kubeconfig port fix, replication works and the suite advanced,
exposing four pre-existing issues:

- zones-and-records asserted status.domainRef.status.nameservers (real
  Cloudflare NS) which is populated by NSO; CI runs without NSO. Assert
  only operator-owned fields (conditions + DNSZoneClass nameservers).
- display-annotations asserted a single-element conditions slice while
  the DNSZone carries two (Accepted+Programmed), failing on slice length.
  Use a JMESPath filter to assert the Accepted condition only.
- alias/zones-and-records scripts used 'set -euo pipefail'; chainsaw runs
  scripts under dash, which rejects '-o pipefail'. Use 'set -eu'.
- events.k8s.io/v1 Events require a non-empty reportingInstance, but
  POD_NAME was never injected, so every emitted Event was rejected. Inject
  POD_NAME via the downward API and add a hostname fallback in code.

Refs #46

Author: kevwilliams

config/manager/manager.yaml

@@ -68,6 +68,13 @@ spec:
         image: ghcr.io/datum-cloud/dns-operator:latest
         imagePullPolicy: IfNotPresent
         name: manager
+        # POD_NAME is used as the reportingInstance on emitted events.k8s.io/v1
+        # Events, which the API server requires to be non-empty.
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
         ports: []
         securityContext:
           readOnlyRootFilesystem: true

internal/controller/events.go

@@ -247,10 +247,31 @@ func buildEvent(
 		Note:                note,
 		Type:                eventType,
 		ReportingController: "dns.networking.miloapis.com/dns-operator",
-		ReportingInstance:   os.Getenv("POD_NAME"),
+		ReportingInstance:   reportingInstance(),
 	}
 }
 
+// reportingInstance returns a non-empty identifier for the reporting pod.
+// events.k8s.io/v1 requires reportingInstance to be set (1-128 chars), so we
+// fall back through POD_NAME -> hostname -> a constant when the downward-API
+// env var is unset (e.g. in tests or misconfigured deployments). The result is
+// truncated to the 128-character API limit.
+func reportingInstance() string {
+	name := os.Getenv("POD_NAME")
+	if name == "" {
+		if h, err := os.Hostname(); err == nil {
+			name = h
+		}
+	}
+	if name == "" {
+		name = "dns-operator"
+	}
+	if len(name) > 128 {
+		name = name[:128]
+	}
+	return name
+}
+
 // recordSetObjectRef builds a corev1.ObjectReference for a DNSRecordSet using
 // hardcoded GVK values (stable and known for this operator).
 func recordSetObjectRef(rs *dnsv1alpha1.DNSRecordSet) corev1.ObjectReference {

test/e2e/alias/chainsaw-test.yaml

@@ -163,7 +163,7 @@ spec:
     - script:
         cluster: upstream
         content: |
-          set -euo pipefail
+          set -eu
           for i in $(seq 1 30); do
             acc="$(kubectl -n "$NAMESPACE" get dnsrecordset example-test-alias-apex -o jsonpath='{.status.conditions[?(@.type=="Accepted")].status}' 2>/dev/null || true)"
             prog="$(kubectl -n "$NAMESPACE" get dnsrecordset example-test-alias-apex -o jsonpath='{.status.conditions[?(@.type=="Programmed")].status}' 2>/dev/null || true)"
@@ -208,12 +208,12 @@ spec:
     - script:
         cluster: downstream
         content: |
-          set -euo pipefail
+          set -eu
           kubectl wait --for=condition=Ready --timeout=120s -n default pod/dnsutils-alias
           # ALIAS is provider-internal; clients query A/AAAA for the owner name.
           # Validate expansion by comparing A answers to a public resolver (dynamic, no hard-coded IPs).
           kubectl -n default exec pod/dnsutils-alias -- sh -lc '
-            set -euo pipefail
+            set -eu
             expected="$(dig @1.1.1.1 example.com A +short +tries=1 +time=2 | sort -u)"
             [ -n "$expected" ] || { echo "expected A set is empty" >&2; exit 1; }
             got="$(dig @pdns-auth.dns-agent-system.svc.cluster.local example.test A +short +tries=2 +time=2 | sort -u)"

test/e2e/display-annotations/chainsaw-test.yaml

@@ -100,10 +100,12 @@ spec:
           kind: DNSZone
           metadata:
             name: annotations-test-zone
+          # The DNSZone carries both Accepted and Programmed conditions; assert
+          # only that the Accepted condition is True without requiring the slice
+          # to match exactly (a bare list would force a length match).
           status:
-            conditions:
-            - type: Accepted
-              status: "True"
+            (conditions[?type == 'Accepted']):
+            - status: "True"
 
   - name: Create DNSRecordSet upstream (A record)
     try:

test/e2e/zones-and-records/chainsaw-test.yaml

@@ -132,12 +132,14 @@ spec:
           kind: DNSZone
           metadata:
             name: example-com
+          # NOTE: status.domainRef.status.nameservers is mirrored from the
+          # upstream NSO Domain object's status, which is only populated when
+          # the Network Services Operator is deployed and resolving real
+          # external DNS. CI bootstraps without NSO (NSO_DEPLOY=false), so we
+          # assert only the fields this operator owns: the Accepted/Programmed
+          # conditions and (in the next step) the DNSZoneClass-derived
+          # nameservers.
           status:
-            domainRef:
-              status:
-                nameservers:
-                - hostname: elliott.ns.cloudflare.com
-                - hostname: hera.ns.cloudflare.com
             conditions:
             - type: Accepted
               status: "True"
@@ -255,7 +257,7 @@ spec:
     - script:
         cluster: downstream
         content: |
-          set -euo pipefail
+          set -eu
           # wait for pod ready condition
           kubectl wait --for=condition=Ready --timeout=120s -n default pod/dnsutils
           # Execute dig from inside the dnsutils pod (in-cluster DNS context)
@@ -287,7 +289,7 @@ spec:
     - script:
         cluster: upstream
         content: |
-          set -euo pipefail
+          set -eu
           # Confirm it no longer exists upstream
           if kubectl -n "$NAMESPACE" get dnsrecordset www-example-com >/dev/null 2>&1; then
             echo "upstream DNSRecordSet still exists" >&2
@@ -298,7 +300,7 @@ spec:
     - script:
         cluster: downstream
         content: |
-          set -euo pipefail
+          set -eu
           # verify A record no longer resolves
           kubectl -n default exec pod/dnsutils -- sh -lc '
           out=$(dig @pdns-auth.dns-agent-system.svc.cluster.local www.example.com A +short +tries=1 +time=1);