Limit aproxy nftables redirection to egress traffic only

[weiiwang01]

What this PR does

Update the aproxy transparent proxy nftables rules so they only redirect traffic leaving the runner's default-route ("physical") interfaces.

Why we need it

This can simplify the aproxy-exclude-addresses configuration, as we don't need to include the private IP ranges by default, and we only need to include the actual IP addresses that we need to exclude. Also, this would help reduce the chances of IP range conflicts between internal services, like MicroK8s, Docker, and LXD, and external services within the infrastructure using private IP addresses.

Checklist

• I followed the contributing guide
• I added or updated the documentation (if applicable)
• I updated docs/changelog.md with user-relevant changes
• I used AI to assist with preparing this PR
• I added or updated tests as needed (unit and integration)
• If this is a Grafana dashboard: I added a screenshot of the dashboard
• If this is Terraform: terraform fmt passes and tflint reports no errors
• If the github-runner-manager application has been changed: The application version number is updated in github-runner-manager/pyproject.toml.

[Copilot]

Pull request overview

This PR updates the OpenStack runner cloud-init template to scope aproxy’s transparent-proxy nftables DNAT rules to traffic that will egress via the runner’s default-route interface(s), reducing the need to exclude broad private IP ranges and avoiding local/overlay traffic being captured.

Changes:

• Add default-route interface filtering to aproxy nftables prerouting and output chains.
• Update unit-test expected nftables snippets to match the new rules.
• Bump github-runner-manager version and document the user-facing change in docs/changelog.md.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
github-runner-manager/src/github_runner_manager/templates/openstack-userdata.sh.j2	Adds default-route NIC detection and applies interface-based filtering to aproxy nftables redirection.
github-runner-manager/tests/unit/openstack_cloud/test_openstack_runner_manager.py	Updates expected nftables rules in unit tests to match the new template output.
github-runner-manager/pyproject.toml	Version bump from 0.18.2 to 0.18.3.
docs/changelog.md	Adds a 2026-07-14 entry describing the aproxy redirection behavior change.

[yhaliaw]

Approved

---

🤝 Human review with AI assistance.