[ upstream commit 6d1c07e ]

[ backporter's note: several merge conflict in
  pkg/node/manager/manager.go:
  1) Removed additional (*IPCache).RemoveMetadata in
     pkg/ipcache/metadata.go in favor of the existing implementation in
     pkg/ipcache/ipcache.go.
  2) Changed RemoveMetadata in IPCache interface to RemoveLabels and
     adjusted parameters so pkg/ipcache.(*IPCache) satisfies the
     interface.
  3) Adjusted m.deleteIPCache calls in (*Manager).NodeUpdated for health
     IPs by adding identity.IdentityUnknown and the resource ID to the
     existing calls.
  4) Adjusted (*Manager).deleteIPCache and (*Manager).removeFromIDMD
     parameters to match what (*IPCache).RemoveLabels expects.
  5) Use prefix in call to m.removeFromIDMD, per
     https://github.com/cilium/cilium/pull/27010/files#r1342807054 ]

Previously the node manager code only ever performed upserts into the
ipcache for remote-node labels on node creation/update events. However,
it never cleaned up these labels upon delete. As a result, if a node was
ever removed, then Cilium would continue to consider traffic towards
that IP as traffic reaching towards a remote node. In extreme cases,
this IP could be reallocated to another host in the network which could
cause connectivity disruption to that peer, particularly if the new peer
is subject to CIDR or Entities based policies.

Signed-off-by: Joe Stringer <joe@cilium.io>
Signed-off-by: Tobias Klauser <tobias@cilium.io>