FYI I spotted this with the MCS-API conformance test: "Exporting a ClusterIP service should create a ServiceImport of type ClusterSetIP in the service's namespace in each cluster. Unexporting should delete the ServiceImport".

I was already running the conformance test (https://github.com/kubernetes-sigs/mcs-api/tree/master/conformance) regularly but it turns out I was not running it correctly in the past and I was effectively running it on only one of my cluster instead of two... which does test a few things but as you might expect leave a few things untested...

I will also start looking relatively soon at integrating this conformance test in the CI, the only thing is that we currently don't pass an (optional) test that checks for EndpointSlice because we only sync EndpointSlice if the user opted in with an annotation or if the service is headless and the conformance tests doesn't know about this Cilium specific details. But will try to figure out the best path forward to integrate this conformance test which would help us getting a "free" e2etest suite and catch a few more bugs like this one!

/test

I will also start looking relatively soon at integrating this conformance test in the CI, the only thing is that we currently don't pass an (optional) test that checks for EndpointSlice because we only sync EndpointSlice if the user opted in with an annotation or if the service is headless and the conformance tests doesn't know about this Cilium specific details. But will try to figure out the best path forward to integrate this conformance test which would help us getting a "free" e2etest suite and catch a few more bugs like this one!

That would be great, thanks! Feel free to ask if you need help with the CI. As for the currently failing test, I guess that one possibility in the short term could be just skipping it, so that we still get all the others for free.