Zenithar/chaos controller/full bpf network filter

[Zenithar]

What does this PR do?

• Adds new functionality
• Alters existing functionality

Replaces the legacy iptables/u32-based network disruption packet filtering with a full eBPF (TC classifier) implementation for both ingress and egress traffic paths. Subsequent commits harden the engine, add a Docker-based integration test harness, and extend the BPF data plane with direction-aware rules, ICMP/ICMPv6 protocol support, and ingress-path behavioral tests.

---

Key changes

BPF data plane

• New bpfdisrupt package — Engine manages the BPF data plane: clsact qdisc lifecycle, IFB device for ingress shaping redirect, BPF program attachment (TC egress classifier + ingress DirectAction), and LPM trie map population for target CIDR matching.
• Direction-aware LPM rules — lpm_val carries a direction field (DirBoth=0, DirEgress=1, DirIngress=2). The egress BPF hook skips DIR_INGRESS rules; the ingress hook skips DIR_EGRESS rules. ALLOW/safeguard rules use DirBoth so both hooks honour them.
• ICMP / ICMPv6 support — IPPROTO_ICMP (1) and IPPROTO_ICMPV6 (58) added to match_l4; port matching is skipped for those protocols.
• bpf-network-disruption CLI — new --direction egress|ingress|both and --protocol icmp|icmpv6|tcp|udp flags; populateRules passes --direction for every rule.

Injector

• Ingress shaping path — when any host has flow: ingress with delay/bandwidth/corrupt/duplicate, an IFB (Intermediate Functional Block) virtual device is created; matched ingress packets are redirected via bpf_redirect and shaped by a netem/tbf chain on the IFB.
• Ingress drop path — ActionDrop rules apply probabilistic drop directly in the BPF ingress hook (TC_ACT_SHOT) without an IFB device.
• ALLOW rules use DirBoth — safeguard IPs (node IP, default gateway) and allowedHosts entries are now direction-neutral so they are honoured on both the egress and ingress hooks.

Integration tests

• Docker-based harness (Dockerfile.integration, make test-integration) with isolated per-test bridge networks, real tc/iptables/netlink drivers, and testcontainers-go containers.
• Egress tests — latency structural + behavioral, packet loss structural + behavioral, clean-state recovery.
• Ingress tests — latency (IFB structural + behavioral), drop (BPF filter structural + behavioral).
• BPFConfigInformerMock wired into buildNetworkInjector — removes bpftool runtime dependency.
• make test-integration now tees full output to /tmp/chaos-integration-test.log and filters DEBUG lines from the terminal.

API

• protocol enum extended to icmp | icmpv6 | tcp | udp on NetworkDisruptionHostSpec and NetworkDisruptionServiceSpec.

Docs & examples

• Updated protocol enum and removed stale "ingress only works for TCP" constraint across all docs.
• Expanded examples/network_ingress.yaml; added examples/network_icmp.yaml.

---

⚠️ Potential breaking changes

Area	Change	Impact
BPF map layout	lpm_val gains a direction byte at offset 17 (was padding). Struct size unchanged (20 bytes).	Any tooling that reads or writes the disruption_rl BPF map directly (e.g. bpftool map dump) will see the new field. In-flight disruptions during a rolling upgrade will have stale map entries without the direction bit set — they default to DirBoth=0 (match both directions), which is safe.
bpf-network-disruption CLI	--direction is now passed for every rule. Old injector pods (pre-upgrade) do not pass --direction; the binary defaults to 0 (DirBoth), which preserves previous behaviour. New binary, old engine: --direction flag unrecognised — upgrade engine and binary together.	Rolling upgrades should update both the injector image and the BPF binary atomically.
Direction.String() output	DirBoth.String() now returns "both" (was "unknown" for zero value). Any code that compared against "unknown" for the zero direction will no longer match.	Internal only — not exposed in the CRD or API.
protocol validation	icmp and icmpv6 are now valid values. Existing disruptions with protocol: tcp or protocol: udp are unaffected.	No breakage for existing resources.
ALLOW rule direction	Safeguard IPs and allowedHosts rules previously stored with DirEgress are now stored with DirBoth. In-flight disruptions during upgrade: old rules in the LPM map have DirEgress; the new ingress hook skips them (returns TC_ACT_OK), so safeguarded hosts continue to pass ingress traffic — behaviour is preserved but for the wrong reason until the disruption is re-injected.	Re-inject any active disruption after upgrade to pick up DirBoth ALLOW rules.
Ingress + egress interaction	Ingress-only specs (flow: ingress) still create a netem qdisc on the egress side of eth0 because applyOperationsToIfaces always runs. Egress traffic is shaped by that netem. This pre-existing limitation is unchanged.	Expected — document in follow-up if needed.

---

Code Quality Checklist

• The documentation is up to date.
• My code is sufficiently commented and passes continuous integration checks.
• I have signed my commit (see Contributing Docs).

Testing

• I leveraged continuous integration testing
  • by adding new unit tests and integration tests (Docker-based, make test-integration).
• I manually tested the following steps:
  • locally (167/167 integration tests pass).
  • as a canary deployment to a cluster.

[datadog-datadog-prod-us1-2]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 43.80%
• Overall Coverage: 38.84% (-0.24%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 4ac738b | Docs | Datadog PR Page | Give us feedback!}