Handle edge-node clustering in mangle table marking with flowlog enabled

[naiming-zededa]

• similar to the filter table PR PR4408 and networking changes for Clustering #4454, this one to allow edge-node clustring ip packets to communicate when the device has flowlog enabled.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 20.90%. Comparing base (42df374) to head (fcdb6a2).
Report is 42 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4546   +/-   ##
=======================================
  Coverage   20.90%   20.90%           
=======================================
  Files          13       13           
  Lines        2894     2894           
=======================================
  Hits          605      605           
  Misses       2163     2163           
  Partials      126      126           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[eriknordmark]

Run tests

[uncleDecart]

LGTM, from code perspective since we are using new rules only for Kubernetes, I'd do something like this:

func defaultKubernetesIptablesRules() []iptables.Rule {
  // Allow all traffic from Kubernetes pods to Kubernetes services.
  // Note that traffic originating from another node is already D-NATed
  // and will get marked with the kube_pod mark.
  markKubeSvc := iptables.Rule{
    RuleLabel:   "Kubernetes service mark",
    MatchOpts:   []string{"-s", kubePodCIDR.String(), "-d", kubeSvcCIDR.String()},
    Target:      "CONNMARK",
    TargetOpts:  []string{"--set-mark", controlProtoMark("kube_svc")},
    Description: "Mark traffic from Kubernetes pods to Kubernetes services",
  }
  // ...

  return []iptables.Rule{
    markKubeSvc, 
    // ... 
  }
}

func (r *LinuxDpcReconciler) getIntendedMarkingRules(dpc types.DevicePortConfig, intendedIPv4ACLs, intendedIPv6ACLs dg.Graph) {   
  // ...

  if r.HVTypeKube {
    protoMarkV4Rules = append(protoMarkV4Rules, defaultKubernetesIptablesRules()...)
  }
}

And we won't run Kubernetes over ipv6, right?

[naiming-zededa]

defaultKubernetesIptablesRules()...

Good suggestion, updated. Correct, at the moment of this code, we don't support ipv6 applications for kubernetes.

[uncleDecart]

LGTM

[eriknordmark]

Re-run tests