ip-algo: rename pod field to app; image from pod spec

The `pod` field hashed pod.Name, which differs per replica because of
the ReplicaSet pod-template-hash + 5-char random suffix. With
namespace,pod,image, all replicas of the same Deployment got distinct
hextets even though they were the same workload.

Replace `pod` with `app` — a stable workload identifier derived from
the controller chain:

  - Deployment → ReplicaSet → Pod: strip the pod-template-hash suffix
    from the RS name (`traefik-789df685f` → `traefik`).
  - StatefulSet/DaemonSet/Job → Pod: use controller name as-is.
  - Bare pod: pod name.

Image now comes from pod.Spec.Containers[0].Image (the spec'd
reference). 64-hex-char values are treated as sha256 digests and
parsed as before; everything else (image:tag, short SHA) is FNV-1a-64'd
as a string. This makes `traefik:v3.5` deterministic across replicas
without needing the runtime-resolved digest.

Net effect: namespace,app,image yields identical hextets across all
replicas of the same Deployment except the trailing random N nibble.

embed.Values.Pod → App; AllocRequest.Pod kept for log context only,
new App and Image fields drive the embed call. handlers.go computes
both via deriveAppName + podImageRef helpers.

Tests: 7 new TestDeriveAppName_* cases (Deploy/STS/DS/bare/RS-without-
hash/non-controller-owner) + TestPodImageRef. Existing fuzz seeds
updated for the new keyword.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pkg/agent/handlers.go

@@ -5,13 +5,89 @@ import (
 	"fmt"
 	"log/slog"
 	"net"
+	"strings"
 	"time"
 
 	flockcni "code.fritzlab.net/fritzlab/flock/pkg/cni"
 	cnitypes "github.com/containernetworking/cni/pkg/types"
 	current "github.com/containernetworking/cni/pkg/types/100"
+	corev1 "k8s.io/api/core/v1"
 )
 
+// podTemplateHashLabel is the well-known label Kubernetes attaches to
+// every Pod owned by a ReplicaSet so the ReplicaSet name can be
+// reconstructed as "<deploy>-<hash>". We use it to peel the hash back off
+// in deriveAppName.
+const podTemplateHashLabel = "pod-template-hash"
+
+// deriveAppName returns the stable workload identifier for a Pod — the
+// name of the topmost stable controller, with the pod-template-hash
+// stripped for ReplicaSet-owned pods.
+//
+// The rule maps to Kubernetes pod-name generation:
+//
+//	Deployment → ReplicaSet → Pod   pod owner is RS named "<deploy>-<hash>";
+//	                                 strip the trailing "-<hash>" to recover
+//	                                 the Deployment name.
+//	StatefulSet → Pod                pod owner is the STS itself; use as-is.
+//	DaemonSet  → Pod                 pod owner is the DS itself; use as-is.
+//	Job        → Pod                 pod owner is the Job itself; use as-is.
+//	(bare pod) → Pod                 no controller owner; fall back to pod name.
+//
+// All replicas of the same workload converge on the same return value,
+// which is the property the ip-algo `app` field needs.
+func deriveAppName(pod *corev1.Pod) string {
+	owner := controllerOwner(pod)
+	if owner == nil {
+		return pod.Name
+	}
+	if owner.Kind == "ReplicaSet" {
+		if hash, ok := pod.Labels[podTemplateHashLabel]; ok && hash != "" {
+			suffix := "-" + hash
+			if strings.HasSuffix(owner.Name, suffix) {
+				return strings.TrimSuffix(owner.Name, suffix)
+			}
+		}
+		// Custom controller named the RS something that doesn't match
+		// the pod-template-hash convention. Falling back to the RS name
+		// keeps replicas of the same RS aligned, which is the second-
+		// best correctness we can offer.
+		return owner.Name
+	}
+	return owner.Name
+}
+
+// controllerOwner returns the OwnerReference flagged with Controller=true,
+// or nil if none. Kubernetes guarantees at most one controller per object.
+func controllerOwner(pod *corev1.Pod) *metav1OwnerLite {
+	for i := range pod.OwnerReferences {
+		o := &pod.OwnerReferences[i]
+		if o.Controller != nil && *o.Controller {
+			return &metav1OwnerLite{Kind: o.Kind, Name: o.Name}
+		}
+	}
+	return nil
+}
+
+// metav1OwnerLite is the slice of OwnerReference we actually consult,
+// kept tiny so it can be returned by value-pointer cheaply.
+type metav1OwnerLite struct {
+	Kind string
+	Name string
+}
+
+// podImageRef returns a deterministic image reference for the embed
+// `image` field. We use the first container's spec'd image — this is
+// stable across replicas of the same Deployment without requiring the
+// runtime-resolved digest. Empty string if the pod has no containers,
+// in which case the embed package falls back to FNV(containerID).
+func podImageRef(pod *corev1.Pod) string {
+	if len(pod.Spec.Containers) == 0 {
+		return ""
+	}
+	return pod.Spec.Containers[0].Image
+}
+
 // PodHandler is the platform-agnostic ADD/DEL/CHECK implementation. It
 // resolves the Pod from the informer cache, parses annotations, allocates
 // from IPAM, programs netns (or skips on non-Linux build), and persists
@@ -68,11 +144,13 @@ func (h *PodHandler) Add(ctx context.Context, req flockcni.Request) (*current.Re
 		ContainerID: req.ContainerID,
 		Namespace:   args.PodNamespace,
 		Pod:         args.PodName,
+		App:         deriveAppName(pod),
 		WantV6:      parsed.WantV6,
 		WantV4:      parsed.WantV4,
 		AnnCIDR6:    parsed.CIDR6,
 		AnnCIDR4:    parsed.CIDR4,
 		IPAlgo:      ipAlgo,
+		Image:       podImageRef(pod),
 	}
 	res, err := h.IPAM.Allocate(allocReq)
 	if err != nil {