k8s/watchers: set unfiltered pod labels on CEP on pod update

The labels on the CEP are set to the unfiltered pod labels on CEP
creation, see [1]. On any label update where labels contain filtered
labels, e.g. io.cilium.k8s.* labels or labels filtered out by the user
by means of the --label and/or --label-prefix-file agent options the
current logic would wrongly remove the filtered labels from the CEP
labels. Fix this by always using the unfiltered pod labels.

[1] https://github.com/cilium/cilium/blob/b58125d885edbb278f11f84303c0e7c934ca7ea4/pkg/endpointmanager/endpointsynchronizer.go#L185-L187

Signed-off-by: Tobias Klauser <tobias@cilium.io>

pkg/k8s/watchers/pod.go

@@ -413,7 +413,7 @@ func (k *K8sWatcher) updateK8sPodV1(oldK8sPod, newK8sPod *slim_corev1.Pod) error
 			}
 
 			// Synchronize Pod labels with CiliumEndpoint labels if there is a change.
-			updateCiliumEndpointLabels(k.clientset, podEP, newPodLabels)
+			updateCiliumEndpointLabels(k.clientset, podEP, newK8sPod.Labels)
 		}
 
 		if annotationsChanged {