loader: Remove program and route when disable endpoint routes

When per-endpoint routes are enabled, a route is added for each
endpoint. A BPF program is also attached to the lxc devices on the path
to the containers.

When per-endpoint routes are disabled, we need to remove the routes and
the programs.

Signed-off-by: Paul Chaignon <paul@cilium.io>

pkg/datapath/loader/loader.go

@@ -342,16 +342,27 @@ func (l *Loader) reloadDatapath(ctx context.Context, ep datapath.Endpoint, dirs
 				}
 				return err
 			}
+		} else {
+			err := RemoveTCFilters(ep.InterfaceName(), netlink.HANDLE_MIN_EGRESS)
+			if err != nil {
+				log.WithField("device", ep.InterfaceName()).Error(err)
+			}
 		}
 	}
 
-	if ep.RequireEndpointRoute() {
-		if ip := ep.IPv4Address(); ip.IsSet() {
+	if ip := ep.IPv4Address(); ip.IsSet() {
+		if ep.RequireEndpointRoute() {
 			upsertEndpointRoute(ep, *ip.IPNet(32))
+		} else {
+			removeEndpointRoute(ep, *ip.IPNet(32))
 		}
+	}
 
-		if ip := ep.IPv6Address(); ip.IsSet() {
+	if ip := ep.IPv6Address(); ip.IsSet() {
+		if ep.RequireEndpointRoute() {
 			upsertEndpointRoute(ep, *ip.IPNet(128))
+		} else {
+			removeEndpointRoute(ep, *ip.IPNet(128))
 		}
 	}