feat(networking): edge-to-edge resources optimization

[cheina97]

Restrict pod IP remapping to provider VirtualNodes, drop the unknown-source IP mapping controller, and fix the gateway remapping FirewallConfiguration to use a single DNAT chain.

Changes

IP mapping controller

• Deleted the unknown-source IP controller
  Removed pkg/liqo-controller-manager/ipmapping/configuration_controller.go, its test file, and its suite. The controller-manager no longer creates <cfg>-unknown-source IP resources. The corresponding CtrlConfigurationIPMapping constant and main-manager wiring were removed.

• Create IP CRs only for pods on provider VirtualNodes
  Updated OffloadedPodReconciler.Reconcile to look up the Node referenced by pod.Spec.NodeName and verify it carries the standard virtual-node label (liqo.io/type: virtual-node). Only then does it call CreateOrUpdateIP. Pods running on real local nodes are skipped.

  Added the required nodes RBAC (get;list;watch) to the reconciler.

External-network remapping

• Single-chain gateway FirewallConfiguration
enforceFirewallConfigurationChains now allocates only one chain (prerouting / DNAT) instead of two. Removed the postrouting / SNAT chain and ensureFirewallConfigurationSNATRules, which caused asymmetric NAT and CRD validation errors (null chains[1]). The masquerade variant remains unchanged.

[kimchi-review]

Kimchi Code Review

Property	Value
Commit	c0dccf4
Author	@cheina97
Files changed	23
Review status	Completed
Comments	4 (1 info, 3 warning)
Duration	86s

Summary

📊 Review Score: 78/100 (overall code quality — 0 lowest, 100 highest)
⏱️ Estimated effort to review: 3/5 (1 = trivial, 5 = very complex)

🧪 Tests: yes — Unit tests were added for firewall NAT rule generation in firewall_test.go and for internal-node route/firewall cleanup in internalnode_k8s_test.go. However, no tests cover the new deleteUnknownSourceIP behavior in the ConfigurationReconciler when NodePort support is disabled.

📝 Found 4 issue(s). See inline comments for details.

What to expect

Kimchi will analyze the changes in this pull request and post:

• A summary of the overall changes
• Inline comments on specific lines with findings categorized by issue type

The review typically completes within a few minutes. This comment will be updated once the review is ready.

Interact with Kimchi

• @getkimchi review — re-trigger a full review on the latest commit
• @getkimchi summary — regenerate the PR summary
• @getkimchi ignore — skip this PR (no review will be posted)
• Reply to any inline comment to ask follow-up questions or request clarification

Configuration

Reviews are configured by your organization admin.
Review instructions, excluded directories, and severity thresholds can be adjusted per repository in the Kimchi dashboard.

---

Powered by Kimchi — AI-powered code review by CAST AI

[kimchi-review]

📊 Review Score: 78/100 (overall code quality — 0 lowest, 100 highest)
⏱️ Estimated effort to review: 3/5 (1 = trivial, 5 = very complex)

🧪 Tests: yes — Unit tests were added for firewall NAT rule generation in firewall_test.go and for internal-node route/firewall cleanup in internalnode_k8s_test.go. However, no tests cover the new deleteUnknownSourceIP behavior in the ConfigurationReconciler when NodePort support is disabled.

📝 Found 4 issue(s). See inline comments for details.

[cheina97]

/build