kind: Configure external targets inside the cluster

[michi-covalent]

3 commits:

• add --external-target-ca-{name,namespace} flags to override CA bundle secret for client-egress-l7-tls tests.
• add an error log exception for "Unable to find identity of previously used CIDR" message for cilium version <1.14. see a question about CIDR policies when reserved:world and cilium node CIDR ranges overlap cilium#26881 for details.
• set up external targets inside the cluster for the kind workflow.

[michi-covalent]

to test locally:

kind delete clusters chart-testing
kind create cluster --config .github/kind-config.yaml

export worker2_ip=$(kubectl get nodes chart-testing-worker2 -o=jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')
export worker3_ip=$(kubectl get nodes chart-testing-worker3 -o=jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}')

cilium install \
  --nodes-without-cilium chart-testing-worker2,chart-testing-worker3 \
  --wait=false \
  --helm-set bpf.monitorAggregation=none \
  --helm-set cni.chainingMode=portmap \
  --helm-set loadBalancer.l7.backend=envoy \
  --helm-set tls.secretsBackend=k8s

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.12.0/cert-manager.yaml
kubectl create ns external-targets
cat .github/external-targets/certs.yaml | envsubst | kubectl apply -n external-targets -f -
kubectl apply -n external-targets -f ./.github/external-targets/nginx.yaml
./cilium connectivity test --all-flows --test-namespace test-namespace --curl-insecure \
  --external-target chart-testing-worker2 \
  --external-target-ca-namespace=external-targets \
  --external-target-ca-name=ca \
  --external-cidr 172.18.0.0/16 \
  --external-ip ${worker2_ip} \
  --external-other-ip ${worker3_ip} \
  --test client-egress-l7-tls-headers

[michi-covalent]

alright i'm shipping this.