ipcache: add tests reproducing host-IP-as-world misclassification during agent restart

[seanduncandatadog]

Problem

During rolling Cilium agent restarts, host IPs that fall within a CiliumCIDRGroup subnet can be transiently misclassified as world identity. This causes policy_denied drops for traffic from those IPs to endpoints whose CNP uses fromEntities: cluster (which does not include world, id=2).

Root Cause

Three code paths cooperate to produce the bug:

1. local_identity_restorer.go:128 — host identity excluded from restoration

if nid.Scope() == identity.IdentityScopeLocal || nid == identity.ReservedIdentityIngress {
    localPrefixes[k.Prefix()] = nid  // ReservedIdentityHost NEVER matches this
}

ReservedIdentityHost (id=1) has IdentityScopeGlobal (scope bits = 0). It is excluded from the restored identity set. After ipcachemap.Recreate() wipes the BPF map (cell.go:118), host IP entries are gone until syncHostIPs runs.

2. daemon.go startup ordering — CiliumCIDRGroup processing races syncHostIPs

daemon.go:202  K8sWatcher.InitK8sSubsystem()    // starts CiliumCIDRGroup processing
daemon.go:249  SyncHostIPs.StartAndWaitFirst()  // host IPs registered HERE

Between these two lines, the Kubernetes watcher processes CiliumCIDRGroup objects and calls UpsertMetadata with only a cidrgroup:* label for IPs in the covered subnet — before syncHostIPs has inserted reserved:host.

3. metadata.go:798 — resolveLabels() world fallback

isNode := lbls.HasRemoteNodeLabel() || lbls.HasHostLabel()  // false
isInCluster := (isNode || ...)                               // false

if !isInCluster {
    lbls.AddWorldLabel(prefix.AsPrefix().Addr())  // world assigned to host IP
}

The host IP ends up with world identity and is denied by fromEntities: cluster CNP rules.

Changes

pkg/ipcache/metadata_restart_test.go

• TestHostIPWorldFallbackDuringRestartWindow: inserts only a cidrgroup:* label for a host IP (simulating the restart window before syncHostIPs runs), calls doInjectLabels, and asserts that world identity is assigned. This directly reproduces the bug and is expected to fail once a fix is applied.
• TestWorldFallbackDoesNotOccurWhenHostLabelPresentFirst: verifies the correct steady-state behaviour where reserved:host is present before cidrgroup labels arrive.

pkg/ipcache/restore/local_identity_restorer_test.go

• TestHostIdentityExcludedFromIPCacheRestoration: tests the exact filter predicate from dumpOldIPCache (line 128) against all relevant identity types, documenting which survive restoration.
• TestHostIdentityScopeIsGlobal: verifies that ReservedIdentityHost.Scope() == IdentityScopeGlobal, the direct mechanical reason it is excluded from restoration.

Test plan

# Compile check (no BPF deps needed):
GOOS=linux go vet ./pkg/ipcache/... ./pkg/ipcache/restore/...

# Run on a Linux host:
go test ./pkg/ipcache/... -run "TestHostIP|TestWorldFallback" -v
go test ./pkg/ipcache/restore/... -run "TestHostIdentity" -v

TestHostIPWorldFallbackDuringRestartWindow currently passes (the bug is present). It should be updated to assert ReservedIdentityHost once a fix is implemented.

🤖 Generated with Claude Code

[41ks]

Feel free to open a PR in the upstream Cilium repo. The main in this fork is kept in sync with the upstream main. We only push to our v1.xx-dd branches in case we need to apply a patch before it is released in the official upstream version.