pkg/fqdn: use LRU in FQDN policy calculation

[aanm]

Using an LRU for the memory-intensive operations such as regex.Compile
bring some benefits as presented in the following benchmarks [1]. These
benchmarks assumed there were 2 CNPs that shared 100 FQDN
matchPattern on a node with 20 endpoints.

[1]

name                             old time/op    new time/op    delta
_perEPAllow_setPortRulesForID-8    13.9ms ± 6%     1.2ms ±63%  -91.10%  (p=0.008 n=5+5)

name                             old alloc/op   new alloc/op   delta
_perEPAllow_setPortRulesForID-8    17.4MB ± 0%     0.6MB ± 0%  -96.56%  (p=0.008 n=5+5)

name                             old allocs/op  new allocs/op  delta
_perEPAllow_setPortRulesForID-8     42.8k ± 0%      8.1k ± 0%  -81.13%  (p=0.008 n=5+5)

Signed-off-by: André Martins andre@cilium.io

Optimize memory consumption for clusters with high number of repeated FQDN matchPattern or matchNames

[aanm]

test-me-please

Job 'Cilium-PR-K8s-1.19-kernel-5.4' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sDatapathConfig AutoDirectNodeRoutes Check connectivity with sockops and direct routing

Failure Output

FAIL: Error creating resource /home/jenkins/workspace/Cilium-PR-K8s-1.19-kernel-5.4/src/github.com/cilium/cilium/test/k8sT/manifests/l3-policy-demo.yaml: Cannot retrieve cilium pod cilium-2fq7c policy revision: cannot get revision from json output '': could not parse JSON from command "kubectl exec -n kube-system cilium-2fq7c -- cilium policy get -o json"

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.19-kernel-5.4 so I can create a new GitHub issue to track it.

Job 'Cilium-PR-K8s-GKE' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sDemosTest Tests Star Wars Demo

Failure Output

FAIL: unable to access deathstar.default.svc.cluster.local/v1/exhaust-port when policy allows it; 000

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-GKE so I can create a new GitHub issue to track it.

Job 'Cilium-PR-K8s-1.16-net-next' has 1 failure but they might be new flake since it also hit 1 known flake: #17176 (91.52)

[christarazi]

LGTM, minor docs rewording suggested

[aanm]

test-1.16-netnext

[aanm]

test-1.19-5.4

[aanm]

test-gke

[aanm]

ci-eks

[pchaigno]

test-me-please

Job 'Cilium-PR-K8s-GKE' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sIstioTest Istio Bookinfo Demo Tests bookinfo inter-service connectivity

Failure Output

FAIL: Pods are not ready after timeout

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-GKE so I can create a new GitHub issue to track it.

[pchaigno]

The test was passing before I made the comment change. It also doesn't load any FQDN policies, so probably unrelated to this pull request.

/mlh new-flake Cilium-PR-K8s-GKE

👍 created #17270

[pchaigno]

The GKE flake is unrelated (see above) and AKS has been failing for a while. All tests were passing before I changed the comment and rebased. All team review requests are covered. Marking ready to merge.