cmd: enhance cilium bpf policy list&get

[mhofstetter]

This PR introduces the following changes related to the cilium commands cilium bpf policy get/list:

• Fixing structured output (JSON/YAML) when listing all policy maps, by formatting the whole content - and not on a per map basis
• The Endpoint ID gets printed before the actual policy map content in addition to the path when listing in table form
• The recently introduced Auth Type (e.g. mtls-spiffe) gets printed when getting/listing in the table form

Listing all policy maps as JSON/YAML

Currently, when listing all policy maps with structured output (e.g. cilium bpf policy list -o json), the output as a whole isn't structured as JSON, only the individual policy maps per endpoint. This prevents piping its output into other tools - e.g. jq.

/sys/fs/bpf/tc/globals/cilium_policy_00035:

[
  {
    // map entry
  },
  {
    // map entry
  }
]

/sys/fs/bpf/tc/globals/cilium_policy_00038:

[
  {
    // map entry
  },
  {
    // map entry
  }
]

This commits changes this by formatting the full output as JSON/YAML with EndpointID, Path & Content.

[
  {
    "EndpointID": "35",
    "Path": "/sys/fs/bpf/tc/globals/cilium_policy_00035",
    "Content": [
      {
        // map entry
      },
      {
        // map entry
      }
    ]
  },
  {
    "EndpointID": "38",
    "Path": "/sys/fs/bpf/tc/globals/cilium_policy_00038",
    "Content": [
      {
        // map entry
      },
      {
        // map entry
      }
    ]
  },
...
]

Endpoint ID

Explicitly display Endpoint ID in addition to path (where it might not be that obvious that it contains the endpoint id)

before

...
/sys/fs/bpf/tc/globals/cilium_policy_03642:

POLICY   DIRECTION   LABELS (source:key[=value])                                                  PORT/PROTO   PROXY PORT   AUTH TYPE   BYTES   PACKETS   PREFIX   
Allow    Ingress     reserved:unknown                                                             ANY          NONE         none        0       0         0        
Allow    Ingress     reserved:host                                                                ANY          NONE         none        0       0         0        
...

after

...
Endpoint ID: 3642
Path: /sys/fs/bpf/tc/globals/cilium_policy_03642

POLICY   DIRECTION   LABELS (source:key[=value])                                                  PORT/PROTO   PROXY PORT   AUTH TYPE   BYTES   PACKETS   PREFIX   
Allow    Ingress     reserved:unknown                                                             ANY          NONE         none        0       0         0        
Allow    Ingress     reserved:host                                                                ANY          NONE         none        0       0         0        
...

[mhofstetter]

/test

Job 'Cilium-PR-K8s-1.26-kernel-net-next' failed:

Click to show.

Test Name

K8sDatapathServicesTest Checks N/S loadbalancing With host policy Tests NodePort

Failure Output

FAIL: Can not connect to service "tftp://192.168.56.11:32194/hello" from outside cluster (1/10)

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.26-kernel-net-next/2301/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.26-kernel-net-next so I can create one.

Then please upload the Jenkins artifacts to that issue.

Job 'Cilium-PR-K8s-1.26-kernel-net-next' failed:

Click to show.

Test Name

K8sDatapathServicesTest Checks N/S loadbalancing With host policy Tests NodePort

Failure Output

FAIL: Can not connect to service "http://192.168.56.12:30805" from outside cluster (1/10)

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.26-kernel-net-next/2312/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.26-kernel-net-next so I can create one.

Then please upload the Jenkins artifacts to that issue.

[mhofstetter]

testrun flaked with #25411
/test-1.26-net-next

[mhofstetter]

testrun flaked with #25411
/test-1.26-net-next

[asauber]

LGTM