fix: validate iptable rule exists after calling insert or append iptable rule

[QxBytes]

Reason for Change:

It was speculated that even though the iptables command returns with no errors, it was possible that the iptables rule was never created. This change aims to validate the rule was created and will error out the cni plugin if the rule specified in append or insert was not found (using a -C check).

Validated against transparent vlan and pipeline with no error: https://msazure.visualstudio.com/One/_build/results?buildId=121810862&view=results

Issue Fixed:

See above.

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:

[QxBytes]

/azp run Azure Container Networking PR

[Copilot]

Pull Request Overview

This PR introduces validation checks to ensure that iptables rules created via insert or append operations are successfully applied. Key changes include:

• Adding an error variable to report failed iptables rule validation.
• Modifying both the InsertIptableRule and AppendIptableRule functions to run a post-insertion validation.

Comments suppressed due to low confidence (3)

iptables/iptables.go:15

• [nitpick] Consider renaming the error variable to use 'iptables' (plural) consistently with the package naming, e.g., 'errCouldNotValidateIptablesRuleExists'.

var errCouldNotValidateRuleExists = errors.New("could not validate iptable rule exists after insertion") 

iptables/iptables.go:180

• [nitpick] Consider including diagnostic details (such as the rule parameters) in the error message to improve troubleshooting when rule validation fails.

if !c.RuleExists(version, tableName, chainName, match, target) { 

iptables/iptables.go:205

• [nitpick] Consider including diagnostic details (such as the rule parameters) in the error message to improve troubleshooting when rule validation fails.

if !c.RuleExists(version, tableName, chainName, match, target) { 

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull Request Overview

This PR aims to improve reliability by verifying that an iptables rule is successfully created after an insert or append operation. Key changes include:

• Adding tests to validate rule creation using a new validation function.
• Modifying the Client struct in iptables.go to store an ExecClient instance.
• Implementing post-command rule existence checks in the InsertIptableRule and AppendIptableRule methods.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
iptables/iptables_test.go	New tests for rule validation functionality using a mock ExecClient.
iptables/iptables.go	Updates to Client struct and added logic to ensure rule existence.

Comments suppressed due to low confidence (1)

iptables/iptables.go:185

• [nitpick] Consider revising the error message associated with errCouldNotValidateRuleExists to consistently use 'iptables' (plural) for clarity.

if !c.RuleExists(version, tableName, chainName, match, target) { 

[QxBytes]

/azp run Azure Container Networking PR

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).