feat: add terminateOnSuccess flag to iptables monitor

[QxBytes]

Reason for Change:

Adds a new flag to iptables monitor so that the program can terminate if no user iptables rules are detected.
Refactors the code to make testing easier.
Changes the default location of the azure block iptables bpf map so it doesn't conflict with the location of the azure iptables block binary that was recently added to the image.
Adds tests.

Issue Fixed:

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:
Tested on dualstack cluster with iptables block running (ubuntu 24)

BPF Map

• Adding a blocked iptable rule blocks the operation
• The operation is logged with bpftool map dump pinned /sys/fs/bpf/azure-block-iptables/iptables_block_event_counter
• The map is read by the program and sends an event if the number increases-- the number is also logged properly

Monitoring

• A user iptable rule causes an event to be created
• Removing the user iptable rule stops new events related to user iptables rules
• Adding the user iptable rule creates a node label on ciliumnodes
• Removing the user iptable rule sets the node label on ciliumnodes to false
• Waiting 30 seconds (shortened interval) updates the node label and sends an event
• Ip6 table rules are checked and causes an event and label to come out

Termination

• when terminate on success is true, the iptables monitor that has user rules gets stuck in init
• then, when there are no user iptables rules, the init container finishes

[santhoshmprabhu]

Add a test? Also add in the description how you have validated this.

[Copilot]

Pull Request Overview

This PR adds a new terminateOnSuccess flag to the iptables monitor that allows the program to exit when no user iptables rules are detected. The changes also refactor the code for better testability by introducing dependency injection interfaces and comprehensive test coverage.

• Added terminateOnSuccess configuration flag for conditional program termination
• Refactored code into testable functions with dependency injection interfaces
• Updated default BPF map path to avoid conflicts with azure iptables block binary

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
azure-iptables-monitor/interfaces.go	New file defining interfaces for dependency injection and configuration structs
azure-iptables-monitor/iptables_monitor.go	Refactored main logic into testable functions, added terminateOnSuccess support, updated default map path
azure-iptables-monitor/iptables_monitor_test.go	Added comprehensive test coverage with mock implementations for all dependencies
azure-iptables-monitor/README.md	Updated documentation for new flags and default map path

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[santhoshmprabhu]

/azp run Azure Container Networking PR

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).