The kube-apiserver reserved identity requires us to create a IPCache
entry based on the endpoints of the `default/kubernetes` K8s service.

This kube-apiserver  IPCache entry will overwrite any existing remote
host entries. The entry also blocks the creation of remote host entries
for the same IP (via `source.AllowsOverwrite`).

When the kube-apiserver entry is created, we check if there is an
existing remote node entry, and if so, copy over the IPSec keypair
information into the newly created kube-apiserver entry. If however the
order is reversed (we first create the kube-apiserver entry before the
remote node is discovered), then the IPSec keypair is never updated.
This in turn means that connectivity to any remote nodes which also run
the kube-apiserver is broken when node-to-node encryption is enabled.

This commit works around the issue by adding the IPKeyPair before the
labels are injected. This allows InjectLabels to look up the pair
whenever the entry is created or updated.

This work is also needed for the upcoming WireGuard node-to-node
encryption.

Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

This commit completely changes the WireGuard integration in the
datapath to enable the host2host encryption (also, pod2host and
host2pod).

Previously, we supported only the pod2pod case. This was implemented by
marking a to be encrypted packet, and then letting the IP rule installed
in the host netns to forward the packet to the WireGuard tunnel device
"cilium_wg0" for the encryption, as shown below:

┌─────────────────┐
│   Pod A netns   │
│   ┌────────┐    │
│   │  eth0  │    │
└───┴────┬───┴────┘
    ┌────┴──────────┐
    │ bpf_lxc@veth0 │               (host netns)
    └────┬──────────┘
         │1."from-container" in bpf_lxc sets MARK_MAGIC_ENCRYPT
         │2. ip rule matches the mark and routes packet to WG netdev
         │       ┌───────────┐
         └──────►│cilium_wg0 │
                 └────┬──────┘
                      │
                  ┌───▼───┐
                  │ eth0  │
                  └───────┘

This was working fine for the pod2pod case (albeit one danger that a
sysadmin could nuke the rule making the packet to bypass the WG dev).

However, with this approach it was not possible to enable the host2host
case, as a packet originating from the host netns was never handled by
bpf_lxc. Thus, we needed to change the datapath.

To encrypt a host2host packet we need to attach bpf_host to the outgoing
device connecting cluster nodes which in the picture is "eth0". Then the
program "to-netdev" from bpf_host can forward the packet to the WG dev.
Once encrypted, the packet will be again hitting the same bpf_host
program. To avoid the packet looping forever, we can configure the WG
netdev to set the skb mark after the encryption. Then, in the program
we can skip the redirection to the WG netdev if the mark is set.

The flow below shows the new integration.

┌─────────────────┐
│   Pod A netns   │
│   ┌────────┐    │
│   │  eth0  │    │
└───┴────┬───┴────┘
    ┌────┴──────────┐
    │ bpf_lxc@veth0 │    (host netns)
    └────┬──────────┘
         │
    ┌────▼───────────┐  1. "to-netdev" does redirect    ┌───────────┐
    │ bpf_host@eth0  │─────────────────────────────────►│cilium_wg0 │
    └─┬─────────▲────┘                                  └──────┬────┘
      │         │                                              │
      │         │  2. encrypt and set MARK_MAGIC_ENCRYPTED     │
      │         └──────────────────────────────────────────────┘
      │
      │ 3. output the encrypted packet
      │
      ▼

The same flow is used for the host2host, host2pod and pod2host cases.

Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>
Signed-off-by: Martynas Pumputis <m@lambda.lt>