Support for egressgateway IPv6 policies in the controlplane

[rgo3]

This PR is a follow up to #37713, where we introduced datapath handling for IPv6 egress gateway policies. The goal of this PR is to make sure the agent creates the correct bpf state for the datapath, in terms of bpf map entries in the IPv6 egress gateway map. Please see individual commits for more implementation details.

To provide an example, a EgressGatewayPolicy can now look like the following:

apiVersion: cilium.io/v2
kind: CiliumEgressGatewayPolicy
metadata:
  name: egress-sample
spec:
  # Specify which pods should be subject to the current policy.
  # Multiple pod selectors can be specified.
  selectors:
  - podSelector:
      matchLabels:
        org: empire
        class: mediabot
        # The following label selects default namespace
        io.kubernetes.pod.namespace: default
  # Specify which destination CIDR(s) this policy applies to.
  # Multiple CIDRs can be specified.
  destinationCIDRs:
  - "0.0.0.0/0"
  - "::/0"

  # Configure the gateway node.
  egressGateway:
    # Specify which node should act as gateway for this policy.
    nodeSelector:
      matchLabels:
        node.kubernetes.io/name: node2
    # The first IPv4 or IPv6 address assigned to this interface, will be chosen as the egress IP respectively
    interface: "eth0"

This policy would create entries in both the IPv4 and IPv6 policy maps, given it specifies destination CIDRs for both protocols.

Add support for IPv6 egress gateway policies

[rgo3]

This is a first draft of this PR and there are still some things missing but currently it is a bit unclear to me how the controlplane should decide on when to create or retrieve and assign version dependent resources if an egress gateway policy crd object is ip version agnostic. And what the failure mode should be if a policy is technically valid for both ip stacks but the controlplane was only able to partially apply it. Any feedback would be appreciated!

[julianwiedmann]

Thank you! A few comments inline. I think once we have --enable-ipv6-egress-gateway wired up and disable it in the e2e CLI tests, we could merge this fairly soon. And then connect the last dots, so that all variants of policies etc work.

[rgo3]

Looks like there are still some leftover references to some older APIs I refactored and I still need to add necessary test cases for the unit tests of the egressgateway manager. Apart from that, this should be close to be ready for "real" review.

[rgo3]

/test

[rgo3]

/test

[rgo3]

/test

[pippolo84]

🚀

[rgo3]

/test