BPF: Set DSCP only for traffic leaving cluster

[mazdakn]

Description

Apply DSCP on traffic only when leaving cluster. In the original support of DSCP in bpf, DSCP is set on all egress traffic from an endpoint even when both source and destination are inside cluster. This PR changes the behavior to only set DSCP when either source or destination is outside cluster.

Related issues/PRs

Follow up for #10881

Todos

• Tests
• Documentation
• Release note

Release Note

TBD

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

• docs-pr-required: This change requires a change to the documentation that has not been completed yet.
• docs-completed: This change has all necessary documentation completed.
• docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

• release-note-required: This PR has user-facing changes. Most PRs should have this label.
• release-note-not-required: This PR has no user-facing changes.

Other optional labels:

• cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
• needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.

[Copilot]

Pull Request Overview

This PR modifies the DSCP (Differentiated Services Code Point) handling in Calico's BPF dataplane to only apply DSCP marking when traffic is crossing cluster boundaries. Previously, DSCP was applied to all egress traffic from endpoints, but now it's restricted to traffic where either the source or destination is outside the cluster.

Key changes:

• Introduces cluster boundary detection logic using routing table flags
• Adds new state flags and conntrack flags to track external cluster traffic
• Updates DSCP application logic to only set DSCP for cross-cluster traffic

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
felix/fv/dscp_test.go	Updates test description and adds test case for return traffic from external connections
felix/bpf/ut/qos_test.go	Refactors DSCP tests into comprehensive test cases covering internal and external cluster scenarios
felix/bpf-gpl/types.h	Adds CALI_ST_CLUSTER_EXTERNAL state flag for tracking cross-cluster traffic
felix/bpf-gpl/tc.c	Implements cluster boundary detection logic and updates DSCP application condition
felix/bpf-gpl/routes.h	Adds helper functions for detecting external addresses and host/pool addresses
felix/bpf-gpl/qos.h	Splits DSCP logic into condition check and application functions
felix/bpf-gpl/conntrack_types.h	Adds CALI_CT_FLAG_CLUSTER_EXTERNAL conntrack flag and updates copyright year

Comments suppressed due to low confidence (1)

felix/bpf-gpl/qos.h:1

• This TODO comment is now obsolete since the PR implements the functionality described in the comment. The TODO should be removed.

// Project Calico BPF dataplane programs.