This commit moves all code which resolves CIDR group references into a
single `resolveCiliumNetworkPolicyRefs` function. This is done in
preparation for the upcoming sequence of commits, which will resolve
services references in the CNP. By having a single point where we
resolve references, we ensure that all different kinds of references
are updated together and consistently.

This commit does not contain any functional changes.

Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

This commit introduces a new helper function to the service cache which
allows users outside of the package to search for services based on
arbitrary conditions (such as e.g. matching labels). The helper will be
used in a subsequent commit.

Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

This commit relaxes the CNP/CCNP policy validation to allow `ToCIDRSet`
rules to coexist with other L3 members, such as `ToServices`. This has
no impact on user-submitted policies, since it is not possible for
policies imported via K8s/API to set the `Generated` field. The
`Generated` field is currently only set by the `ToServices`
implementation, which extracts service endpoints and translates them as
`ToCIDRSet` rules. Currently, this is done after CNP validation, however
a subsequent commit will perform that translation step earlier.

For this reason, we need to relax the rule validation to allow policy
rules to contain both a `ToServices` and generated `ToCIDRSet` rules.

This change has no user-facing impact.

Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

This commit changes the `CiliumCIDRGroup` translation logic to not
create a copy of the CNP/CCNP before it is translated. Instead, the
passed in parameter is mutated in place.

While it would arguably be nice to have a functional approach where we
have a input parameter and one output result, creating two copies for
every CNP change is expensive. In particular, since an upcoming change
will add additional translation steps and we want to avoid having to
create unnecessary copies for every translation step.

Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

This commit moves the logic to generate an IPCache resource ID into a
separate function. It will be used by additional call sites in a
subsequent commit.

Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

This commit moves the logic which translates `ToServices` rules to
`ToCIDRSet` rules into `pkg/policy/k8s`. In doing so, we also change how
translation is performed:

Previously, translation was split over multiple packages: Initial policy
ingestion (in `pkg/policy`) invoked `k8s.PreprocessRules`, which
populated the initial version of the policy with `ToCIDRSet` rules.
Service updates were handled incrementally by the service watcher, which
invoked a `k8s.RuleTranslator` for each update and allocating CIDR
identities (via IPCache) accordingly.

The new approach centralizes all the logic into `pkg/policy/k8s`. We
mirror the approach from the existing `CiliumCIDRGroup` logic which also
translates references to `CiliumCIDRGroups` to `ToSericeSet`s. Because
the new approach modifies the CNP/CCNP before it is added to the policy
repository, we no longer perform incremental updates and no longer need
manage CIDR identities ourselves. This simplifies the code and allows us
to remove one of the last users of the "synchronous IPCache API".

As a side-effect of this change, `ToServices` rules for policies
ingested via the non-persistent API (i.e. `cilium-dbg policy import`)
are no longer supported. We assume that this was not a commonly used
feature for two reasons: First, importing non-K8s policies that refer
K8s resources (i.e. services) is likely rather rare. And secondly, the
previously implementation was slightly broken: Because policies imported
via API were not preprocessed, the policy was defunct until one of the
matched services generated an update event.

Note that this commit only removes the conflicting parts the old
infrastructure to keep this commit reviewable. The remaining code of the
old infrastructure is removed in a subsequent commit.

Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

With the previous commit, this logic is no longer needed.

Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>