[PSUPCLPL-15272] IPIP connectivity check rework

[alexarefev]

Description

• The network.ipip_connectivity task in check_iaas could return incorrect results due to IaaS level firewall rules. For instance, in OpenStack set of Iptables rules that implements the Security Group. That Iptables rules allow the ESTABLISHED and RELATED packets which leads to the following case. IPIP packets moving from VM-1 to VM-2 are blocked, but the IPIP packets from VM-2 to VM-1 are allowed as they look like RELATED packets whereas, IPIP traffic is not allowed in Security Group at all for VM-1 and VM-2.
• In this case, the only way to check the IPIP connectivity in cluster is to avoid IPIP packets movement from VM-1 to VM-2 and vice versa. Therefore, VM-1 must send packets to VM-2 and VM-2 to VM-3 and VM-3 must send packets to VM-1 (if there are three nodes in the cluster). That approach is not comprehensive (it doesn't take in to account the connectivity from VM-1 to VM-3 and from VM-2 to VM-1 ), but allows to check IPIP connectivity in general in the particular cluster.
• There is no possibility to set the source port in ipip_check

Solution

• Organize ring topology in the network.ipip_connectivity procedure
• Add input sport parameter

How to apply

Not applicable

Test Cases

TestCase 1
Check if the new approach is working

Test Configuration:

• Hardware:
• OS:
• Inventory:

Steps:

1. Prepare OpenStack instances as Kubernetes cluster nodes.
2. Set Security Group to allow all IPv4 egress traffic and not allow IPIP ingress traffic.
3. Run check_iaas with --tasks "network.ipip_connectivity" option several times in a row.
4. Change Security Group to allow IPIP ingress traffic for some of the cluster nodes.
5. Run check_iaas with --tasks "network.ipip_connectivity" option several time in a row.

Results:

Before	After
Results vary; Results do not match the Security Group rules	Results are the same; Results match the Security Group rules
Results vary; Results do not match the Security Group rules	Results are the same; Results match the Security Group rules

Checklist

• I have commented my code, particularly in hard-to-understand areas
• Integration CI passed
• There is no merge conflicts