feat: enable Cilium source IP preservation

[dkoshkin]

What problem does this PR solve?:
Set Cilium's configuration to preserve source IPs from external connections. See https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/#client-source-ip-preservation

Which issue(s) this PR fixes:
Fixes #

How Has This Been Tested?:

Special notes for your reviewer:

[jimmidyson]

I wonder if we can add a test that checks that source IP is actually being preserved with this configuration?

[dkoshkin]

Here is the diff of the ConfigMap used by Cilium after applying kube-proxy replacement

diff cm-pre.yaml cm-after.yaml 
11a12
>   bpf-lb-dsr-dispatch: geneve
13a15
>   bpf-lb-mode: dsr
63d64
<   enable-node-port: "false"
99c100
<   kube-proxy-replacement: "false"
---
>   kube-proxy-replacement: "true"
141c142
<   tunnel-protocol: vxlan
---
>   tunnel-protocol: geneve
159c160
<   resourceVersion: "570"
---
>   resourceVersion: "2378"

Tested this with:

kubectl run nginx --image=docker.io/library/nginx:latest --labels app=nginx
kubectl create service loadbalancer nginx --tcp=80:80 
curl $(kubectl get svc nginx -ojsonpath='{.status.loadBalancer.ingress[0].ip}')

Notice how the client IP changes after enabling:

$ kubectl logs nginx
...
192.168.1.141 - - [10/Sep/2025:15:58:54 +0000] "GET / HTTP/1.1" 200 615 "-" "curl/8.7.1" "-"
10.22.24.127 - - [10/Sep/2025:16:00:20 +0000] "GET / HTTP/1.1" 200 615 "-" "curl/8.7.1" "-"

[yanhua121]

I wonder if we can add a test that checks that source IP is actually being preserved with this configuration?

+1

[dkoshkin]

I wonder if we can add a test that checks that source IP is actually being preserved with this configuration?

+1

@jimmidyson @yanhua121 please see #1304, I will rebase and extend the test in this PR after the other changes are merged.