L7 traffic examples need tunnelling datapath mode

[lizrice]

In direct routing datapath mode, traffic from the Envoy host process is not being subjected correctly to datapath processing. The symptoms are

• Lack of L7 visibility for traffic from the proxy (for example, load-balanced traffic)
• Failure to enforce network policy for these flows

The workaround is to run Cilium in tunnelling database mode, using --datapath-mode=vxlan on the cilium install command.

Seen on GKE and EKS.

[gkjsa]

Same on AKS. When using datapath-mode=azure (by detection) it won't route traffic. vxlan works.