ROX-29399: integration tests for external IPs direction config

[Stringy]

Description

This adds integration tests for the network direction filtering of external IPs. It uses a prepared tap device to mimick egress and ingress connections, providing the tests (and collector) with both ends of the connection to ensure that aggregation happens in the correct places, with the correct configuration.

Also includes minor adjustments to test code to improve runtime configuration testing in the future.

I've chosen to add netcat to the berserker image rather than adding a new image or modifying a different one. It is likely that we will want to use berserker's network workload in the future, and that will require the same tap device, so the prepare-tap.sh script has been added, and netcat is used here for simplicity.

Checklist

• Investigated and inspected CI test results
• Updated documentation accordingly

Automated testing

• Added integration tests

If any of these don't apply, please comment below.

Testing Performed

Tests test the tests.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 28.83%. Comparing base (0fc1c87) to head (f9bad77).

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2140   +/-   ##
=======================================
  Coverage   28.83%   28.83%           
=======================================
  Files          96       96           
  Lines        5799     5799           
  Branches     2551     2551           
=======================================
  Hits         1672     1672           
  Misses       3408     3408           
  Partials      719      719           

Flag	Coverage Δ
collector-unit-tests	28.83% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ovalenti]

As I understand it, both the containers are in the host network namespace, and thus they both have the tun device. The two netcat instances can bind to the external IP or use their POD's IP depending on the direction we want to simulate. And this all works because the routing table has all the IPs and knows how to route locally. Is this correct ?

If this is the case, then we may have to use the -s netcat parameter on the client to make sure that the client "comes" from the expected address.