diff --git a/bpf-prog/ipv6-hp-bpf/pkg/egress/egress.go b/bpf-prog/ipv6-hp-bpf/pkg/egress/egress.go index b8de9fcb32..438bb956ad 100644 --- a/bpf-prog/ipv6-hp-bpf/pkg/egress/egress.go +++ b/bpf-prog/ipv6-hp-bpf/pkg/egress/egress.go @@ -32,6 +32,15 @@ func SetupEgressFilter(ifaceIndex int, objs *EgressObjects, logger *zap.Logger) } break } + // Delete the old filter for cilium if priority is 1. This is to avoid duplicate filters after restarting the daemonset in the + // singlestack -> dualstack migration scenario. + if filter, ok := filter.(*netlink.BpfFilter); ok && filter.Name == "cil_to_netdev-eth0" && filter.Priority == 1 { + if err := netlink.FilterDel(filter); err != nil { + logger.Error("Failed to delete filter", zap.Error(err)) + return err + } + break + } } egressFilter := &netlink.BpfFilter{ diff --git a/bpf-prog/ipv6-hp-bpf/pkg/ingress/ingress.go b/bpf-prog/ipv6-hp-bpf/pkg/ingress/ingress.go index 556e5b9bfe..810c399c86 100644 --- a/bpf-prog/ipv6-hp-bpf/pkg/ingress/ingress.go +++ b/bpf-prog/ipv6-hp-bpf/pkg/ingress/ingress.go @@ -32,6 +32,15 @@ func SetupIngressFilter(ifaceIndex int, objs *IngressObjects, logger *zap.Logger } break } + // Delete the old filter for cilium if priority is 1. This is to avoid duplicate filters after restarting the daemonset in the + // singlestack -> dualstack migration scenario. + if filter, ok := filter.(*netlink.BpfFilter); ok && filter.Name == "cil_from_netdev-eth0" && filter.Priority == 1 { + if err := netlink.FilterDel(filter); err != nil { + logger.Error("Failed to delete filter", zap.Error(err)) + return err + } + break + } } ingressFilter := &netlink.BpfFilter{