Don't leak old tunnel addresses

[caseydavenport]

Spotted a bug where we'll leak addresses that don't have any allocation
attributes. Turns out we used to allocate all tunnel addresses without
attributes, and so tunnel addresses allocated prior to v3.6 will get
leaked once Calico is upgraded to v3.8+.

This PR aims to fix the leak. Subsequent PRs will try to clean up the
leaked addresses, and fix another potential leak spotted in code
reading.

There are a few cases we need to consider:

The node has an address in its spec, but the address doesn't exist in IPAM.

The current code handles this already simply by assigning a new address and updating the node.

The node has an address in its spec, the address exists in IPAM but has no attributes

This is the case that this PR is primarily trying to fix. Currently, we assign a new address and leak the old. In this PR, we will attempt to "correct" the allocation in IPAM to have attributes, and if that fails we'll just release it and assign a new one. We will only release it if we can see for sure the allocation has no handle. If it had a handle, it would suggest this is actually a WEP address.

The node has an address in its spec, the address exists and has attributes.

The current code handles this case already

The node has no address in its spec, the address exists in IPAM but has no attributes

In this case, the current code will simply allocate a new address and leak the old one. Since the old address has no attributes / handle, we have no way of identifying it and thus cannot clean it up.

A potential future enhancement would be to have kube-controllers detect addresses which have no handle and no attributes and garbage collect them.

The node has no address in its spec, the address exists in IPAM and has attributes

In this case, the current code will simply allocate a new address and leak the old one. However, the address does have a handle associated with it, so we can determine if we're hitting this scenario. I propose we do a defensive "ReleaseByHandle" if we detect that the node has no address in order to cover this case.

The node has no address in its spec, the address does not exist in IPAM.

The current code handles this case already.

• Tests
• Documentation
• Release note

Fix potential tunnel address leak when upgrading from Calico < v3.6 to Calico  >= v3.8

[nelljerram]

Basically looks good, just a few minor points.

[nelljerram]

LGTM, thanks.