Add a new mode to Cilium's service handling which is similar to hybrid
SNAT/DSR but opts into DSR based on the user's annotation in the service
object.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

Add a new mode to Cilium's service handling which is similar to hybrid
SNAT/DSR but opts into DSR based on the user's annotation in the service
object. The following Cilium agent settings need to be set:

  --bpf-lb-mode=annotation
  --bpf-lb-acceleration=native
  --bpf-lb-dsr-dispatch=ipip
  --devices=xyz

By default this will use SNAT for service handling, unless a service is
specifically annotated to do otherwise:

  apiVersion: v1
  kind: Service
  metadata:
    name: service-red
    namespace: example
    labels:
      color: red
    annotations:
      "service.cilium.io/type": "LoadBalancer"
      "service.cilium.io/mode": "dsr"
  spec:
    type: LoadBalancer
    ports:
    - port: 1234

Then, for the service DSR with IPIP dispatching will be used instead.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>