policy: improve CNP initial sync

[jaffcheng]

Check for the existence of CNP egress rules before translating
since we only do translation for egress rules.
This reduces the time cost of an add event of CNP without egress rules
and makes cilium agent start faster in a cluster with large amount of
CNPs and services.

Time cost comparison in a cluster with 10k CCNPs (all without egress rule), 44k services/endpoints:

Before:

per CNP add event time cost              20 ~ 30 ms
overall time cost of initial CNP sync    255 s

After:

per CNP add event time cost              0.5 ~ 1 ms
overall time cost of initial CNP sync    15 s

Signed-off-by: Jaff Cheng jaff.cheng.sh@gmail.com

[aanm]

test-me-please

[christarazi]

🚀 Did you happen to make any time comparisons before and after this commit?

[jaffcheng]

🚀 Did you happen to make any time comparisons before and after this commit?

Yes, in one of our clusters with 10k CCNPs (all without egress rule), 44k services/endpoints, time cost of each CNP add event reduced from 20 ~ 30ms to 0.5 ~ 1ms, and the overall time cost of initial CNP sync reduced from 4m15s (exceeds k8s-sync-timeout) to 15s.

[christarazi]

rocket Did you happen to make any time comparisons before and after this commit?

Yes, in one of our clusters with 10k CCNPs (all without egress rule), 44k services/endpoints, time cost of each CNP add event reduced from 20 ~ 30ms to 0.5 ~ 1ms, and the overall time cost of initial CNP sync reduced from 4m15s (exceeds k8s-sync-timeout) to 15s.

Awesome, could you encode that in the commit msg?

[jaffcheng]

Sure, commit msg updated, PTAL @christarazi

[aanm]

test-me-please

[aanm]

@jaffcheng we have fixed a lot of flakes in our CI. Could you rebase against master so that we can trigger the tests again? Thank you!

[jaffcheng]

Rebased

[aanm]

test-me-please

[pchaigno]

k8s-1.21-kernel-4.9 is failing with known flake #14959. Other CI jobs are passing and reviews are in. Merging.