[ upstream commit 8103535 ]

IPSec relies on XFRM states and policies to ensure encrypted pod-to-pod
connectivity. In the XFRM state:

* seq is the incoming sequence number counter. It is used by the kernel
  to track and validate received packets. When a packet arrives, its
  sequence number is compared to the expected range to detect replays
  or out-of-order packets. Together this the oseq value, it helps implement
  the anti-replay window to prevent attackers from resending previously captured packets.
* oseq is the outgoing sequence number counter. It is used when sending
  packets protected by IPsec. Each outbound IPsec packet is assigned an
  incrementing oseq value. The oseq ensures unique sequence numbers for
  each packet, which the receiver uses to validate the order and detect replays.

In a SA between two nodes A and B, the seq/oseq values in the XFRM state
A must match the oseq/seq values in node B, and vice versa. If that is not
the case, users would experience the `XfrmInStateProtoError` error, with
no IPSec connectivity between the two nodes.

We noticed that a Cilium user might end up in this situation in both the
following cases, as stated in the doc changes:

1. KVStore Mode (e.g., etcd): if a Cilium agent connects too late to the
   newly created KVStore, it may miss the node delete and create events
   for entries that were restored or reinitialized. This results in staling
   XFRM state, causing permanent network disruption.
2. KVStore Mode: if a Cilium agent is down for prolonged time, the
   corresponding node entry in the kvstore will be deleted due to lease
   expiration (15m), resulting in stale XFRM states.
3. CRD Mode: a similar issue may occur when a CiliumNode resource is deleted
   and the Cilium agent DaemonSet is restarted. While other agents will
   recreate fresh XFRM states for the new CiliumNode, the restarted agent
   may continue to hold obsolete XFRM states referencing all peer nodes.

The identified mitigation strategy for these scenario is an IPSec
key rotation, which would cause all the states to be consistently
recreated in all Cilium agents.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>
Signed-off-by: viktor-kurchenko <viktor.kurchenko@isovalent.com>