ci: run TestK8sOperator in the shared sqlite matrix

It needs no special runner (every integration container already runs privileged), so it joins the generated matrix; load br_netfilter only for that test.

Updates #1202

.github/workflows/integration-test-template.yml

@@ -78,6 +78,13 @@ jobs:
           echo '{"storage-driver":"overlay2"}' | sudo tee /etc/docker/daemon.json
           sudo systemctl restart docker
           docker version
+      - name: Load br_netfilter for in-cluster service routing
+        if: inputs.test == 'TestK8sOperator'
+        # TestK8sOperator runs k3s in a container; without br_netfilter on the
+        # host, bridged pod-to-pod traffic skips kube-proxy's ClusterIP DNAT and
+        # in-cluster DNS (kube-dns) is unreachable. The module cannot be loaded
+        # from inside the unprivileged-module rancher/k3s image, so load it here.
+        run: sudo modprobe br_netfilter
       - name: Login to Docker Hub
         env:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_CI_USERNAME }}

.github/workflows/test-integration.yaml

@@ -311,6 +311,7 @@ jobs:
           - Test2118DeletingOnlineNodePanics
           - TestGrantCapRelay
           - TestGrantCapDrive
+          - TestK8sOperator
           - TestEnablingRoutes
           - TestHASubnetRouterFailover
           - TestSubnetRouteACL