Split configuration out of NodeIPAM into its own cell so that other
packages can pull in NodeIPAM configuration.

The rationale to position this outside the operator is to avoid
shared packages building dependencies into the operator.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>

This commit moves NodeSvcLBClass and NodeSvcLBMatchLabelsAnnotation
strings out of the nodeipam package and into the nodeipamconfig package,
such that the strings are reusable in other areas of the codebase.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>

Split configuration out of LBIPAM into its own cell so that other
packages can pull in LBIPAM configuration.

The rationale to position this outside the operator is to avoid
shared packages	building dependencies into the operator.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>

The following commit split out LB-IPAM configuration structures into
their own package, but this still expressed two configuration structs
which seemed unnecessary.

This commit consolidates the properties of lbipamconfig.SharedConfig
into the lbipamconfig.lbipamConfig structure to simplify this a little
while also exporting an interface rather than structure members directly.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>

This commit refactors the NewExternalConfig() function to accept an
input params structure, rather than a long list of input parameters, so
the following commit can extend this with additional configs.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>

Introduce additional values in the loadbalancer ExternalConfig struct
so that the loadbalancer is aware of LB-IPAM and Node-IPAM configs, which
are required by the wildcard generation logic in the BPF reconciler.

This commit also updates various test infrastructure to properly include
the new dependencies, as well as documentation.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>

Currently, the loadbalancer's BPF reconciler will create "wildcard"
service entries in the Cilium datapath for any externally facing VIP,
to ensure the datapath does not punt IP traffic towards VIPs on ports
that are not actually mapped to a service.

This works as intended with LB-IPAM, but if VIPs are allocated with
Node-IPAM, the result is that Node IPs are used instead. This leads to
wildcard entries being programmed with Node IPs, which disrupts control
traffic within a cluster.

This commit introduces additional logic in the loadbalancer's BPF
reconciler to only program wildcard service entries if either of
the following cases are true.

1. There is no loadBalancerClass defined on the service, and the
   default LB service IPAM is LB-IPAM.

2. There is a defined loadBalancerClass defined on the service, and
   it is set to either of the following strings:
   - BGPLoadBalancerClass ("io.cilium/bgp-control-plane")
   - L2AnnounceLoadBalancerClass ("io.cilium/l2-announcer")

This ensures the loadbalancer does not program wildcard service entries
for Node-IPAM allocated VIPs.

Example with service allocated via LB-IPAM:

  $ kubectl get svc netshoot-service -o json | jq '{loadBalancerClass: .spec.loadBalancerClass, ingress: .status.loadBalancer.ingress}'
  {
    "loadBalancerClass": null,
    "ingress": [
      {
        "ip": "10.244.255.200",
        "ipMode": "VIP"
      },
      {
        "ip": "fd00:10:244:ff:ffff:ffff:ffff:ff00",
        "ipMode": "VIP"
      }
    ]
  }

Note presence of wildcard "ANY" entry in datapath:

  # cilium bpf lb list |  grep -E '10.244.255.200.*LoadBalancer'
  10.244.255.200:8000/TCP (0)                         0.0.0.0:0 (19) (0) [LoadBalancer]
  10.244.255.200:8000/UDP (0)                         0.0.0.0:0 (20) (0) [LoadBalancer]
  10.244.255.200:0/ANY (0)                            0.0.0.0:0 (0) (0) [LoadBalancer, non-routable]

Example with service allocated via Node-IPAM:

  $ kubectl get svc netshoot-service2 -o json | jq '{loadBalancerClass: .spec.loadBalancerClass, ingress: .status.loadBalancer.ingress}'
  {
    "loadBalancerClass": "io.cilium/node",
    "ingress": [
      {
        "ip": "172.18.0.3",
        "ipMode": "VIP"
      },
      {
        "ip": "fc00:c111::3",
        "ipMode": "VIP"
      }
    ]
  }

Note absence of wildcard "ANY" entry in datapath:

  # cilium bpf lb list | grep -E '172.18.0.3.*LoadBalancer'
  172.18.0.3:8001/TCP (0)                             0.0.0.0:0 (35) (0) [LoadBalancer]
  172.18.0.3:8001/UDP (0)                             0.0.0.0:0 (36) (0) [LoadBalancer]

Fixes: b3b0fc8 ("loadbalancer: Add logic to program wildcard (drop) entries in eBPF.")
Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>