routing: Fix the incorrect deletion of IP rules
routing: Fix the incorrect deletion of IP rules

The IP rules for ENI can have two forms, with or without the to
x.x.x.x/x part. There is a bug between the creation and deletion of
rules, where the conditions to decide which form to use aren't the same.
As the result, we would attempt to remove the wrong IP rules on pod
deletion, causing a warning message in logs and leaving a stale IP rule
behind:

    level=warning msg="No rule matching found" rule="111: from 100.69.11.94/32 to 10.244.0.0/16 lookup 0" subsys=linux-routing

In case a new rule is later added for a new pod with the same IP, we can
end up with a conflict if the new pod is on a different ENI. We will
then have two rules for the same IP with lookups in different rouing
tables.

    111: from 10.19.192.168 lookup 10
    111: from 10.19.192.168 lookup 11

This conflict can then cause connectivity issues because of pod traffic
leaving through the wrong interface.

Flag --aws-release-excess-ips needs to be enabled for the bug to occur.
Otherwise the IP address stays attached to the same ENI and we don't end
up with an IP rule conflict.

Reported-by: Sebastian Wicki <7fcb34670283b6ba16bfb1909995639b51e96332@gmx.net>
Signed-off-by: Paul Chaignon <a027184a55211cd23e3f3094f1fdc728df5e0500@cilium.io>

cilium/cilium,cilium/cilium,michi-covalent/cilium,cilium/cilium,michi-covalent/cilium,michi-covalent/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium,michi-covalent/cilium