cmd, watchers: Populate ipcache in case of high-scale ipcache

[pchaigno]

The first commit contains the main changes (description below). Second commit fixes our end-to-end test and third reenables it.

The high-scale ipcache feature aims to enable policy enforcement across very large Kubernetes environments comprised of many clusters which are not using Cilium Clustermesh.

The main issue of Cilium Clustermesh at that scale is that ipcache on each node would need to be populated with all remote pods, and they would be to be constantly updated. It doesn't scale. Instead the high-scale ipcache feature removes all pods from the ipcache and relies on other mecanisms to enforce policies.

This comes with a significant drawback. Ipcache being such a central component of Cilium, without ipcache entries for pods, many features (egress gateway, IPsec, etc.) cannot work anymore. For that reason, high-scale ipcache is today incompatible with those features.

This commit implements an intermediate solution found by Hemanth. Since the scalability concern comes from the very large number of remote clusters, we only need to keep pods from those clusters out of the ipcache. Hence, the ipcache can keep all pod entries for the local cluster's pods; since we are not using Cilium Clustermesh, entries for other clusters will never be added.

As a consequence, all advanced features will keep working for the local cluster. Features that rely on the ipcache will of course not work for remote clusters, but that was never the goal of high-scale ipcache anyway.

[pchaigno]

/test