.github: fix EKS native-routing CIDR lookup on pooled clusters

The egress-gateway-excluded-cidrs connectivity test asserts that traffic
matching an excluded CIDR reaches the external echo with the client node's
HostIP. That only holds when Cilium masquerades the pod's egress, which the
EKS workflow arranges deliberately: the external echo runs on a node in a
second availability zone, and the "Determine the native routing CIDR" step
narrows ipv4NativeRoutingCIDR to the first zone's subnet so that traffic to
the other zone is outside the non-masquerade CIDR and gets SNATed to HostIP.

That narrowing looked up the subnet by the alpha.eksctl.io/cluster-name tag
using steps.vars.outputs.cluster_name, the synthetic per-run name. On a
cluster taken from the pool the subnets are tagged with the real eksctl name
(steps.setup-cluster.outputs.cluster_name), so the filter matched nothing,
NATIVE_CIDR came back empty, and Cilium fell back to the whole VPC CIDR.
With the entire VPC excluded from masquerade the in-VPC echo target is
reached with the raw pod IP, and the test failed with a source IP that was
neither HostIP nor the egress gateway IP. The sibling nodegroup and external
target steps already use setup-cluster.outputs.cluster_name; only this one
was missed when the pool was introduced (cilium#45246).

Use the real cluster name here too, and fail the step loudly if the lookup
does not return exactly one CIDR rather than silently disabling masquerade,
so a future mismatch surfaces as a red step instead of a connectivity flake.

AIL:3
Signed-off-by: André Martins <andre@cilium.io>

Author: aanm

.github/workflows/conformance-eks.yaml

@@ -499,9 +499,17 @@ jobs:
           # availability zone), to reflect the most common type of real deployments.
           NATIVE_CIDR=$(aws ec2 describe-subnets --region ${{ matrix.region }} \
             --filters Name=availability-zone,Values=${{ steps.vars.outputs.eks_zone_1 }} \
-                Name=tag:alpha.eksctl.io/cluster-name,Values=${{ steps.vars.outputs.cluster_name }} \
+                Name=tag:alpha.eksctl.io/cluster-name,Values=${{ steps.setup-cluster.outputs.cluster_name }} \
                 Name=map-public-ip-on-launch,Values=false \
             --query 'Subnets[*].CidrBlock' --output text)
+          # A pooled cluster is tagged with its real eksctl name, not the
+          # synthetic run name, so an empty result means the lookup missed and
+          # Cilium would silently fall back to the whole-VPC CIDR, disabling the
+          # masquerade this test relies on. Fail loudly instead.
+          if [ "$(echo "$NATIVE_CIDR" | wc -w)" -ne 1 ]; then
+            echo "::error::native routing CIDR lookup returned '$NATIVE_CIDR' (expected exactly one CIDR); masquerade would not engage"
+            exit 1
+          fi
           echo "ipv4_native_cidr=$NATIVE_CIDR" >> $GITHUB_OUTPUT
           echo "Native routing CIDR: $NATIVE_CIDR"