Feature: Update the Worker Operator to support Spoke-to-Spoke

[veenamj-avesha]

🔖 Feature description

Update the Worker Operator to support Spoke-to-Spoke

🎤 Pitch

In Hub-and-Spoke, a spoke has a gateway only to the hub — there is no direct
spoke-to-spoke gateway. Currently the Worker Operator gives a spoke a route only to
the hub's subnet, so a pod on one spoke cannot reach a pod on another spoke and the
traffic is dropped. For Hub-and-Spoke to be usable, spokes need to communicate, and
the Worker Operator is the component that programs these routes.

✌️ Solution

Route a spoke's slice traffic to the hub and let the hub — which is already connected
to every spoke — relay it, so no hub-side changes are needed.

• The controller will mark a spoke's gateway with RouteEntireSliceSubnet: true.
• On that flag, the Worker Operator will program the entire slice subnet (instead
    of just the peer gateway's subnet) toward the hub — in both the slice router and the
    gateway pod, so the traffic is forwarded over the tunnel to the hub.
• Full-mesh gateways (flag false) will keep their existing behaviour, so there is no
    regression.
• In the gateway-sidecar, use RouteReplace so the wider route takes effect over the
    existing NSM route, and add TCP MSS clamping so full-size packets are not dropped on
    the two-tunnel path.

🔄️ Alternative

No response

👀 Have you spent some time to check if this issue has been raised before?

• I checked and didn't find similar issue

🏢 Have you read the Code of Conduct?

• I have read the Code of Conduct