service cache should handle duplicate endpoints addresses

[aojea]

In some corner cases, a group of endpointslices may have the same address duplicate in different slices.

Since the Endpoints are cached by address, when aggregating the endpoints, we should merge the content instead of overwriting.

Please ensure your pull request adheres to the following guidelines:

• For first time contributors, read Submitting a pull request
• All code is covered by unit and/or runtime tests where feasible.
• All commits contain a well written commit description including a title,
  description and a Fixes: #XXX line if the commit addresses a particular
  GitHub issue.
• If your commit description contains a Fixes: <commit-id> tag, then
  please add the commit author[s] as reviewer[s] to this issue.
• All commits are signed off. See the section Developer’s Certificate of Origin
• Provide a title or release-note blurb suitable for the release notes.
• Thanks for contributing!

Kubernetes e2e test now passes

e2e.test -kubeconfig /tmp/kindkind -ginkgo.v --ginkgo.focus="should.mirror.a.custom.Endpoint.with.multiple.subsets.and.same.IP.address"

Fixes: #22446

Solved an issue failing to forward traffic to Services if the Endpoint Slices had the same Address on different Slices

[aojea]

/assign @aanm @squeed

This is much easier to review, and we'll need for 1.11 if possible 🙏

Thanks

[varunmar]

Nicely contained change. Thanks!

[borkmann]

/test

Job 'Cilium-PR-K8s-1.25-kernel-4.19' failed:

Click to show.

Test Name

K8sDatapathVerifier Runs the kernel verifier against Cilium's BPF datapath

Failure Output

FAIL: terminating containers are not deleted after timeout

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.25-kernel-4.19 so I can create one.

[aditighag]

Changes mostly look good! Thanks!

Kubernetes e2e test now passes

Can we add this test to the cilium k8s conformance test suite?

nit: Can you fix the release note?

Fix a bug where Cilium didn't handle correctly

*didn't correctly handle

Also, release notes are user facing, so they should highlight the issue from the user's perspective. I think your original issue title might be better as a release note "fail to forward traffic to custom Endpoint Slices with the same Address on different Slices".

[aojea]

Can we add this test to the cilium k8s conformance test suite?

I specifically added an e2e test in Kubernetes to verify this behavior, as this bug was reported internally to me and was only present in Cilium and I wanted to check nobody else has it. kubernetes/kubernetes#114155

I apologize but I don't have more time to add new conformance tests, however, I added a commit in #24174 to run this e2e kubernetes conformance tests, so it will be tested once that merges

I spend a lot of time in Kubernetes creating, maintaining and ensuring the kubernetes SIG-network tests covers and test all the known issues and features so the ecosystem is consistent with the behaviors we define in Kubernetes, cilium should run these e2e tests, it should have caught issues like this one or #24174

[squeed]

/test

Job 'Cilium-PR-K8s-1.26-kernel-net-next' failed:

Click to show.

Test Name

K8sDatapathConfig Host firewall With VXLAN and endpoint routes

Failure Output

FAIL: Failed to reach 10.0.1.244:80 from testclient-host-nmsvw

If it is a flake and a GitHub issue doesn't already exist to track it, comment /mlh new-flake Cilium-PR-K8s-1.26-kernel-net-next so I can create one.

Hit #15455

[squeed]

/test-1.26-net-next