api, cmd, policy: Show rule labels in policy selectors output

[christarazi]

• policy: Plumb rule labels through selector cache
• api, cmd, policy: Show rule labels in policy selectors output

---

Commits for convenience of review:

policy: Plumb rule labels through selector cache

In order to make investigating the output of cilium policy selectors
easier to understand, plumb the rule labels from KNP, CNP, and CCNPs.
This makes it so that the user can very easily see which policy the
selector came from.

Benchmark results before and after given that selectorcache can be a hot
path in the policy engine:

$ go test -v ./pkg/policy -run '^$' -bench 'BenchmarkRegenerateL3EgressPolicyRules' -test.benchtime 100x -test.benchmem -test.count 10
...
$ benchstat old.txt new.txt
name                              old time/op    new time/op    delta
RegenerateL3EgressPolicyRules-16    8.13ms ±13%    8.01ms ±11%     ~     (p=0.912 n=10+10)

name                              old alloc/op   new alloc/op   delta
RegenerateL3EgressPolicyRules-16    1.75MB ± 0%    1.94MB ± 0%  +10.78%  (p=0.000 n=10+9)

name                              old allocs/op  new allocs/op  delta
RegenerateL3EgressPolicyRules-16     24.1k ± 0%     25.1k ± 0%   +4.15%  (p=0.000 n=10+10)

api, cmd, policy: Show rule labels in policy selectors output

Use the functionality implemented in previous commits to output the rule
labels in the selector output. This is useful for understanding which
policy the selector comes from, which makes debugging issues much
easier.

Example output:

root@kind-worker:/home/cilium# cilium policy selectors
SELECTOR                                                                                                                                                            LABELS                          USERS   IDENTITIES
&LabelSelector{MatchLabels:map[string]string{k8s.io.kubernetes.pod.namespace: kube-system,k8s.k8s-app: kube-dns,},MatchExpressions:[]LabelSelectorRequirement{},}   default/tofqdn-dns-visibility   1       16500
&LabelSelector{MatchLabels:map[string]string{reserved.none: ,},MatchExpressions:[]LabelSelectorRequirement{},}                                                      default/tofqdn-dns-visibility   1
MatchName: , MatchPattern: *                                                                                                                                        default/tofqdn-dns-visibility   1       16777217
                                                                                                                                                                                                            16777218
                                                                                                                                                                                                            16777219

Improve the usability of the `cilium policy selectors` command by including the policy name and namespace in order to easily understand which selector comes from what policy

---

Related: #27804

[christarazi]

/test

[christarazi]

/test

Edit:

• Clustermesh hit CI: ClusterMesh: timeouts in client-egress-l7 #24990
• ci-e2e hit CI: Conformance IPsec E2E: no-policies/pod-to-world/https-to-one.one.one.one-index-0: Resolving timed out after 2000 milliseconds #27799

[christarazi]

/test

[christarazi]

/test

Edit: Hit #27688

[tommyp1ckles]

Looks good, this is a really useful change 🚀

[christarazi]

/test