Track NSS hosts-order dependency for subdomain FQDN guest checks

[oshoval]

Context

In Fedora 43 test-tooling image provisioning in kubevirtci, we override /etc/nsswitch.conf hosts: order so guest-side hostname -f returns an FQDN when subdomain-based DNS is configured.

Previous vs current NSS tweak

Previous image-provisioning line (F39):

sudo sed -i 's/hosts:      files myhostname resolve \[\!UNAVAIL=return\] dns/hosts:      resolve \[\!UNAVAIL=return\] files myhostname dns/' /etc/nsswitch.conf

Current image-provisioning line (F43):

sudo sed -i 's/^hosts:.*/hosts:      files dns myhostname resolve [!UNAVAIL=return]/' /etc/nsswitch.conf

Effective order:

F39 (original sed)
before: hosts:      files myhostname resolve [!UNAVAIL=return] dns
after:  hosts:      resolve [!UNAVAIL=return] files myhostname dns

F43 (new sed)
before: hosts:      files myhostname resolve [!UNAVAIL=return] dns
after:  hosts:      files dns myhostname resolve [!UNAVAIL=return]

Why this is needed

In Fedora 43 test-tooling setup, when resolve is prioritized before DNS in hosts: lookup, hostname -f can return only the short hostname instead of the expected FQDN.

vmi_subdomain tests assert hostname -f inside the guest and expect an FQDN when subdomain is declared.

Affected KubeVirt tests

kubevirt/tests/network/vmi_subdomain.go uses hostname -f:

• DescribeTable("VMI should have the expected FQDN", ...)
  • with Masquerade binding and subdomain and hostname
  • with Bridge binding and subdomain
• It("VMI with custom DNSPolicy should have the expected FQDN", ...)

Helper:

• assertFQDNinGuest(...) sends hostname -f in guest console.

Reference PR that added the tests: kubevirt/kubevirt#6985

Alternatives to image-level tweak

1. Test-scoped cloud-init runcmd tweak in affected tests
   Add per-test cloud-init that rewrites /etc/nsswitch.conf only for specific subdomain/FQDN tests.

2. Use alternative methods to verify hostname/FQDN in the guest
   Replace or complement hostname -f checks with explicit lookups such as getent hosts <fqdn> or dig, while ensuring external lookup/connectivity behavior still works intact.

Why keeping this on the guest image still makes sense

• This is a baseline contract for the Fedora test-tooling image used broadly in KubeVirt CI, not a product runtime image.
• The affected behavior is environment-level name-resolution semantics, not business logic of a single test.
• Centralizing NSS normalization in image provisioning keeps tests simpler and deterministic, and avoids repeating the same workaround in multiple specs.
• Per-test cloud-init customization is possible, but would distribute resolver policy into test code, increasing drift and maintenance overhead.

Proposed follow-up

• Decide whether to keep image-level NSS normalization as the long-term CI baseline or move to test-scoped setup.

[oshoval]

cc @EdDev

[dhiller]

/triage accepted