datapath: Cover subnet encryption in XFRM leak test

[pchaigno]

This commit complements 27a8fb1 ("datapath: Integration test for XFRM leaks on node churn"). In that previous commit, subnet encryption (the XFRM config used for ENI and Azure IPAM modes) was not covered. This commit covers it.

There are two pre-conditions to subnet encryption: nodes must have a list of pod subnets (cf. IPv{4,6}PodSubnets) and the encryption interface must exist and have an IP address. The test configures these two preconditions before running the usual checks for XFRM config leaks.

[jschwinger233]

I have to confess that I didn't know encryption interface before, but my initial understanding is:

1. it's used for non-tunneling mode, replacing the cilium_vxlan.
2. it's used for EKS because of its special IPAM mode: node IPs are within the pod CIDRs, so we don't need tunnels, but consequently we need to specify encryption interface.

In the test, encryption iface's address is 1.1.1.1, but pod subnet is 4.4.0.0/16. If my understanding is correct, maybe we should assign a IP address within the pod CIDR to encrption interface?

[pchaigno]

I have to confess that I didn't know encryption interface before, but my initial understanding is:

1. it's used for non-tunneling mode, replacing the cilium_vxlan.
2. it's used for EKS because of its special IPAM mode: node IPs are within the pod CIDRs, so we don't need tunnels, but consequently we need to specify encryption interface.

It's actually a bit simpler: it's just the native device from which encrypted traffic will leave. Typically some eth0 interface. On EKS and AKS, if option.Config.UseCiliumInternalIPForIPsec=false (default), we then use the IP address of that interface as the outer IP address for IPsec encapsulation.

In the test, encryption iface's address is 1.1.1.1, but pod subnet is 4.4.0.0/16. If my understanding is correct, maybe we should assign a IP address within the pod CIDR to encrption interface?

It is therefore expected that the IP address of that eth0 interface isn't part of the pod subnet.

[brb]

@pchaigno I am a bit puzzled about this PR - did you intend to add a new test case, or to replace the existing one to cover the subnet encryption? AFAICS, the latter was done.