Now that proxy redirects are created before mapstate entries, we no
longer need the listener name in the MapStateEntry.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Old value must be saved also when overriding an allow entry with a deny.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Change key tests to validate full MapStateEntries by changing from Equals
to DeepEquals.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Remove extraneous printing and Use t.Logf() instead of fmt.Printf().

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Do not export DerivedFromRules member so that we can change the
implementation later. Remove from tests where it's value was ignored
anyway, and add actual validation for them in the endpoint integration
tests. Note that these were ignored there as well before, so there are
some missing labels, now in comments. To be fixed in forthcoming commits.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Prepare for hiding internals of MapStateEntry by making ChangeState.Old
private.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Remove the following actions in
TestMapState_denyPreferredInsertWithSubnets test left unnecessary since
the introduction of the transactional selector cache:

- insertAWithBProto
- insertAasB
- insertBWithAProto
- insertBWithAProtoAsDeny

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

… entry

Remove unused 'incremental' attribute from policy map updates.

Store the actual delete entry value rather than the missing empty value
in reported mapstate diffs.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Skip updating the realized mapstate when updating bpf policy map, as:

1. Usually the realized mapstate is the same as desired mapstate so there is
   nothing to update

2. The realized mapstate is ephemeral dump from the datapath, there is no
   point updating it.

3. When a new policy has been computed, the new desired mapstate will
   replace the old realized mapstate anyway after the successful policy
   update. If policy update fails use a full policy map dump for restoring
   to the last known good policy.

   Not updating the realized policy also keeps the old realized policy as
   "the last known good" policy that we can restore to when policy update
   fails.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

We generally want to add new policy map entries to avoid transient
drops. Since policy map size is limited, it is possible that adds fail
due to hitting the size limit. In that case it is possible that more
space would be available if any entries are deleted, so it makes sense to
retry after key deletion.

Note that since we no longer update the realized map on successful map
updates, we need to do the full map diff again.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Define mapStateEntry to hold the internal bookkeeping and contain
MapStateEntry without them. This way the containters used for internal
bookkeeping are not exposed to other packages.

Remove the MapState interface that was ill-defined due to mixing &
matching exported and non-exported methods. Within the policy package use
'*mapState' directly, and export the needed functions via
'EndpointPolicy'.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

When an existing entry is updated without changing its IsDeny flag the
update can be done on the 'entries' map without delete from the other
map, or without sanity checking the key.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Upon reflecting on the iterators used when deleting covered entries, or
adding new ones due to precedence, it is safe to add them directly, as
the iterators hold enough state for it to be safe to delete entries on
descendants, and add entries to existing trie nodes.

Simplify insertion of dependent keys with new helpers.

Simplify the structure of 'denyPreferredInsertWithChanges' by not
returning early on the end of the deny block.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>