Implement inspect and summary commands

[yokaze]

This PR:

• modifies list command to show Egress/Ingress instead of EGRESS/INGRESS.
  • It is consistent with cilium command.
• implements list --manifests command that shows all the CNP/CCNP in YAML format applied to the pod.
• implements inspect command that shows active L3/L4 rules for a pod.
• implements summary command that shows the rule count of all the pods in a namespace, grouped into ingress-allow, ingress-deny, egress-allow, and egress-deny.
  • This helps us to find possible misconfiguration.
• CI:
  • moves test pods into test namespace.
  • changes l3-baseline rule from CNP to CCNP to test CCNP.
  • adds CIDR rules.

Example:

$ npv list --manifests -n test self-5b9b6f4f84-fzwnj | yq 'del(.spec)'
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  annotations: {}
  name: l3-baseline
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  annotations: {}
  name: l3-egress
  namespace: test
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  annotations: {}
  name: l4-egress
  namespace: test

$ npv inspect -n test self-5b9b6f4f84-fzwnj
POLICY DIRECTION IDENTITY NAMESPACE EXAMPLE                                        PROTOCOL PORT BYTES PACKETS
Deny   Egress    1101     test      l3-egress-explicit-deny-all-6f9f4df95-bbsdv    ANY      ANY  0     0
Deny   Egress    29722    test      l4-egress-explicit-deny-tcp-7fb99cc88-x58mr    TCP      8080 0     0
Deny   Egress    32645    test      l4-egress-explicit-deny-any-6b94cf9f77-rhh6l   SCTP     53   0     0
Deny   Egress    32645    test      l4-egress-explicit-deny-any-6b94cf9f77-rhh6l   TCP      53   0     0
Deny   Egress    32645    test      l4-egress-explicit-deny-any-6b94cf9f77-rhh6l   UDP      53   0     0
Deny   Egress    16777218 -         cidr:8.8.4.4/32                                TCP      53   0     0
Deny   Egress    16777218 -         cidr:8.8.4.4/32                                UDP      53   0     0
Deny   Egress    16777218 -         cidr:8.8.4.4/32                                SCTP     53   0     0
Allow  Ingress   1        -         reserved:host                                  ANY      ANY  0     0
Allow  Egress    1342     test      l3-ingress-explicit-allow-all-7b76f9fb7d-xlpjb ANY      ANY  0     0
Allow  Egress    2703     test      l4-ingress-explicit-deny-any-688bbf4987-7xfdr  SCTP     53   0     0
Allow  Egress    2703     test      l4-ingress-explicit-deny-any-688bbf4987-7xfdr  TCP      53   0     0
Allow  Egress    2703     test      l4-ingress-explicit-deny-any-688bbf4987-7xfdr  UDP      53   0     0
Allow  Egress    4950     test      l4-ingress-explicit-deny-udp-5cb894f994-jbqhx  UDP      161  0     0
Allow  Egress    9904     test      l3-ingress-explicit-deny-all-575f9f7795-2qssr  ANY      ANY  0     0
Allow  Egress    17501    test      l4-ingress-explicit-allow-tcp-5b7f6f75d9-wmps7 TCP      8080 0     0
Allow  Egress    52785    test      l3-ingress-implicit-deny-all-6ff569996b-ldhst  ANY      ANY  0     0
Allow  Egress    58313    test      l4-ingress-explicit-allow-any-9b5df64d8-zdr6w  TCP      53   0     0
Allow  Egress    58313    test      l4-ingress-explicit-allow-any-9b5df64d8-zdr6w  UDP      53   0     0
Allow  Egress    58313    test      l4-ingress-explicit-allow-any-9b5df64d8-zdr6w  SCTP     53   0     0
Allow  Egress    16777217 -         cidr:8.8.8.8/32                                TCP      53   0     0
Allow  Egress    16777217 -         cidr:8.8.8.8/32                                UDP      53   0     0
Allow  Egress    16777217 -         cidr:8.8.8.8/32                                SCTP     53   0     0

$ npv summary -n test
NAMESPACE NAME                                           INGRESS-ALLOW INGRESS-DENY EGRESS-ALLOW EGRESS-DENY
test      l3-egress-explicit-deny-all-6f9f4df95-bbsdv    1             0            0            0
test      l3-egress-implicit-deny-all-76f99c9df8-4qvvg   1             0            0            0
test      l3-ingress-explicit-allow-all-7b76f9fb7d-xlpjb 2             0            0            0
test      l3-ingress-explicit-deny-all-575f9f7795-2qssr  1             1            0            0
test      l3-ingress-implicit-deny-all-6ff569996b-ldhst  1             0            0            0
test      l4-egress-explicit-deny-any-6b94cf9f77-rhh6l   1             0            0            0
test      l4-egress-explicit-deny-tcp-7fb99cc88-x58mr    1             0            0            0
test      l4-ingress-explicit-allow-any-9b5df64d8-zdr6w  4             0            0            0
test      l4-ingress-explicit-allow-tcp-5b7f6f75d9-wmps7 2             0            0            0
test      l4-ingress-explicit-deny-any-688bbf4987-7xfdr  1             3            0            0
test      l4-ingress-explicit-deny-udp-5cb894f994-jbqhx  1             1            0            0
test      self-5b9b6f4f84-fzwnj                          1             0            14           8

[chez-shanpu]

I left a few comments.

And also, the e2e is failing in my laptop and it seems cilium-agent-proxy needs CAP_BPF.

[chez-shanpu]

LGTM