node/manager: Only remove old IPs if they weren't already added

[christarazi]

Previously, IPs that were added to the ipset would be removed upon a
node update event.

For example, take the following scenario:

1. Node add event received, N:{IPs:[X]}
2. Add IP X to ipset
3. Node update event received, N:{IPs:[X, Y, Z]}
4. Add IPs Y and Z to ipset
5. Remove IP X from ipset

Step (5) would occur because upon a node update event, we iterate
through the old IPs from the previous event (i.e. IPs:[X]) and delete
the IPs from the previous event.

Therefore, we need to add a check before processing an ipset delete to
ensure that the IPs being deleted are not currently present inside the
node event.

Fixes: d5e5bf3 ("node/manager: Remove ipset config from previous node state")

Signed-off-by: Chris Tarazi chris@isovalent.com

[christarazi]

/test

[christarazi]

/test

Job 'Cilium-PR-K8s-1.27-kernel-net-next' failed:

Click to show.

Test Name

K8sAgentPolicyTest Multi-node policy test validates ingress CIDR-dependent L4 With host policy Connectivity is restored after importing ingress policy

Failure Output

FAIL: Timed out after 1.001s.

Jenkins URL: https://jenkins.cilium.io/job/Cilium-PR-K8s-1.27-kernel-net-next/89/

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.27-kernel-net-next so I can create one.