Add library for manually syncing EndpointSlices

[andrewstucki]

This adds a library-style Kubernetes controller that publishes the EndpointSlices backing "colocated" Services: Services whose ports are served by overlapping-but-distinct subsets of a shared pod pool.

It replaces the native EndpointSlice controller for Services that deliberately define no selector. Where the native
controller aligns Pods to Services with spec.selector, this library aligns them through a configurable label or annotation, and a pluggable membership check decides — per pod, per port — which pods back which ports:

Service: my-service
  ├── port 8080 (http)  → pods A, B, C
  └── port 8443 (https) → pods B, C, D

Usage is found in the example file included, but roughly corresponds to:

	mapper, _ := portmapper.New(portmapper.Config{
		...
		Membership: portmapper.PerPort(map[string]portmapper.Checker{
			"http":  portmapper.HTTPGet("/healthz", time.Second),
			"https": portmapper.TCPDial(time.Second),
			"someother": portmapper.All(
				portmapper.PodReady(),
				portmapper.PortNames(portmapper.AnnotationKey(portsKey)),
			),
		}, nil),
		...
	})
	_ = mapper.SetupWithManager(mgr)

Custom membership mapping functions (with an optional tristate membership-determination interface for ambiguous responses) are supported as well.

[secpanda]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[chrisseto]

Just did a quick pass but overall LGTM. For an MVP in cloud this looks great. If we want to expose this degree of configuration more generally, the wiring up will likely get pretty nasty. Happy to do a more thorough pass if you'd like.

[chrisseto]

nit: DisableMigrationCleanup may be more clear

[chrisseto]

Wouldn't it be more efficient to perform a List? I can't think of any real benefit to perform name specific look ups.

[chrisseto]

Is this true? I was under the impression that an error would be returned if the underlying cache/informer hadn't yet been started up.

[chrisseto]

Seems like a perfect use case for errgroup.Group.SetLimit?

[chrisseto]

Any reason to not rely on SSA to perform this check for you?

[chrisseto]

Ah, last thought: We'll need to test how this performs in each cloud. It would not surprise me if certain configurations bypassed kube-proxy and/or ignored endpoint slices.

Huh... I wonder if Cilium would respect this.

[andrewstucki]

@chrisseto yeah -- I've been going back and forth about whether we should actually maintain both EndpointSlices and deprecated Endpoints directly. I recall there being some oddities around DNS resolution in stock CoreDNS for certain configurations where we were trying to populate EndpointSlices without creating the underlying legacy Endpoints as well. Definitely worth trying out/testing in each major cloud just to make sure that we don't have to do a bunch of legacy stuff too.

[chrisseto]

Before I forget: We should probably respect publishNotReady (I don't think I saw that anywhere)