Cilium v1.16 had a regression where in-cluster traffic was incorrectly SNATed and could not be matched to the source's security identity: #34615
Specifically, this affected IPAM modes "eni", "azure" and "alibabacloud" when ipv4-native-routing-CIDR option was not explicitly set.

The issue has been addressed in both v1.16 and main branches with, respectively, #35611 and #35624.

An e2e test should be added to verify that in-cluster traffic is not SNATed, following the repro depicted in #34615 itself (that is, apply a CNP to allow ingress traffic from pods on remote nodes, but not traffic from the remote nodes themselves).