[ upstream commit a579e9b ]

[ backporter's notes: Key rotation duration option doesn't exist on this
  branch, so I deleted them. Also, this PR contains the commit that
  defines key rotation duration. I talked with the original author and
  dropped that commit because it was accidentally introduced. ]

The IPsec key watcher is used to automatically detect and apply changes
in the key (typically during key rotations). Having this watcher avoids
having to restart the agents to apply the key change.

It can however be desired to only apply the key change when the agent is
restarted. It gives control to the user on when exactly the change
happens. It may also be used as a way to switch from one IPsec
implementation to another (XFRM configs specifically): the user rotates
the key just before the upgrade; on upgrade, the SPI is implicitly used
to distinguish between the old and new implementations as well as the
old and new keys.

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit 3ee2fb7 ]

[ backporter's notes: Fixed minor conflict in Helm template ]

This commit adds a Helm value for the enable-ipsec-key-watcher agent
flag introduced in the previous commit.

Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit 4704655 ]

[ backporter's note: Adjusted function fixture. Also I dropped the
  second commit on this PR since reloadIPSecOnLinkChanges() is not used
  in this branch. ]

Now that the code is reloading the bpf_network program at runtime we
should not fatal if we fail to reload the program since this may be caused
by ongoing interface changes (e.g. interface was being removed). Change
the log.Fatal into log.Error and keep loading to other interfaces.

Fixes: bf0940b ("loader: Reinitialize IPsec on device changes on ENI")
Signed-off-by: Jussi Maki <jussi@isovalent.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>

[ upstream commit 592777d ]

reloadIPSecOnLinkChanges() did not ignore veth device updates causing
reload to be triggered when new endpoints were created. Ignore any
updates with "veth" as device type.

The draining of updates during settle wait was broken due to unintentional
breaking out of the loop. Removed the break.

Fixes: bf0940b ("loader: Reinitialize IPsec on device changes on ENI")
Signed-off-by: Jussi Maki <jussi@isovalent.com>
Signed-off-by: Yutaro Hayakawa <yutaro.hayakawa@isovalent.com>