Encryption status sub command.

[viktor-kurchenko]

Cluster wide encryption status command:

Output examples:

1. Encryption disabled:

./cilium encrypt status
Encryption: Disabled (3/3 nodes)

2. Cluster wide IPsec without errors:

./cilium encrypt status
Encryption: IPsec (3/3 nodes)
IPsec keys in use: 1 on 3/3
IPsec highest Seq. Number: 0x7b2/0xffffffff across all nodes
IPsec errors: 0 across all nodes

3. Cluster wide IPsec with errors:

./cilium encrypt status
Encryption: IPsec (3/3 nodes)
IPsec keys in use: 1 on 3/3
IPsec highest Seq. Number: 0x7da/0xffffffff across all nodes
IPsec errors: 6 across all nodes
        XfrmInNoState: 6 on 3/3 nodes

4. Per node IPsec without errors:

./cilium encrypt status --per-node-details
Node: kind-worker
Encryption: IPsec
IPsec keys in use: 1
IPsec highest Seq. Number: 0x7b5/0xffffffff
IPsec errors: 0

Node: kind-worker2
Encryption: IPsec
IPsec keys in use: 1
IPsec highest Seq. Number: 0x7b5/0xffffffff
IPsec errors: 0

Node: kind-control-plane
Encryption: IPsec
IPsec keys in use: 1
IPsec highest Seq. Number: N/A
IPsec errors: 0

[mhofstetter]

Thanks for this addition.

I have concerns building this feature by parsing the raw text output of the command cilium-dbg encrypt status. IMO we have to improve the "API" first: at least by introducing a structured form that we can rely on a little bit more.

[mhofstetter]

LGTM for the CLI aspect (i only tested that the command works - but didn't verified the output from a IPSec & Wireguard perspective)

nit: would be nice if you could reduce the amount of commits and squash the following commits into the first one.

• Alias for the encryption command
• Status structure and initTargetCiliumPods method simplified.

I think it's OK to have the last commit (JSON) as dedicated commit.

But i'll leave that up to the maintainer that will merge this PR.

Thanks Viktor!

[viktor-kurchenko]

LGTM for the CLI aspect (i only tested that the command works - but didn't verified the output from a IPSec & Wireguard perspective)

nit: would be nice if you could reduce the amount of commits and squash the following commits into the first one.

• Alias for the encryption command
• Status structure and initTargetCiliumPods method simplified.

I think it's OK to have the last commit (JSON) as dedicated commit.

But i'll leave that up to the maintainer that will merge this PR.

Thanks Viktor!

Done.
Thank you for the review @mhofstetter !

[rgo3]

Overall LGTM, just a small nit to simplify the concurrent status fetch if possible.