flock-agent: GC orphaned allocations; retry birdc on socket-not-ready (#5)

flock-agent: GC orphaned allocations; retry birdc on socket-not-ready

pkg/agent/runtime_linux.go

@@ -82,6 +82,34 @@ func (s *Server) configureRuntime(ctx context.Context) error {
 		return fmt.Errorf("pod informer: %w", err)
 	}
 
+	// Startup orphan GC: the pod informer is now fully synced. Walk all
+	// committed allocations and release any whose owner pod is absent from
+	// this node. This catches ungraceful evictions where CNI DEL never ran
+	// (TaintManagerEviction path) and prevents stale public /128s from
+	// suppressing the live pod's BGP advertisement after rescheduling.
+	gcOrphans := func(label string) int {
+		orphans := orphanedCommitted(s.Store.Snapshot(), func(ns, name string) (string, bool) {
+			pod, ok := pods.Get(ns, name)
+			if !ok {
+				return "", false
+			}
+			return string(pod.UID), true
+		})
+		for _, a := range orphans {
+			s.Logger.Info(label,
+				"container_id", a.ContainerID,
+				"pod", a.Namespace+"/"+a.PodName,
+				"ip6", a.IP6,
+				"ip4", a.IP4,
+			)
+			_ = Teardown(a.ContainerID, net.ParseIP(a.IP6), net.ParseIP(a.IP4))
+			_ = s.Store.Delete(a.ContainerID)
+			ipam.Release(net.ParseIP(a.IP6), net.ParseIP(a.IP4))
+		}
+		return len(orphans)
+	}
+	gcOrphans("GC orphaned committed allocation (startup)")
+
 	// Keep NetworkUnavailable=False so the node.kubernetes.io/network-
 	// unavailable taint never gets re-applied. Calico's calico-node sets
 	// it on shutdown; without an owner replacing it, kubelet's controller
@@ -132,6 +160,25 @@ func (s *Server) configureRuntime(ctx context.Context) error {
 		}
 	}()
 
+	// Periodic orphan GC: defense-in-depth against allocations that escape
+	// the startup sweep (e.g. a pod evicted while the agent is running and
+	// the CNI DEL is never delivered). Keeps the store and IPAM in sync
+	// with the live pod set without requiring a full agent restart.
+	go func() {
+		t := time.NewTicker(60 * time.Second)
+		defer t.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-t.C:
+				if n := gcOrphans("GC orphaned committed allocation (periodic)"); n > 0 {
+					anycast.Trigger()
+				}
+			}
+		}
+	}()
+
 	// NetworkPolicy enforcement.
 	world := netpol.NewWorld(s.Logger)
 	if err := world.Start(ctx, s.restCfg); err != nil {