Fix a bug when a namespace has two egress IPs on same node

[danwinship]

#19603 was supposed to make us sanity-check-but-ignore additional egress IPs on a namespace, but it accidentally made it so that the iptables rules for the IP would get set up anyway. In the sane case where the namespace had multiple egress IPs on different nodes, this had no visible effect, because no one was sending egress traffic for the namespace to the second node anyway, so it just had a useless iptables rule. But if you had two egress IPs for the same namespace on the same node (which is stupid, but...) then they'd both get set up on that node, and the second one ended up having priority over the first one.

This fixes it so that only the first egress IP for a namespace ever gets set up. (#19578 will need a larger fix.)

The change to updateNamespaceEgress is to deal with:

• Set node-1's egressIPs to ["1.1.1.1", "2.2.2.2"]
• Set namespace-A's egressIPs to ["1.1.1.1"] (which will add OVS and iptables rules for 1.1.1.1)
• Set namespace-A's egressIPs to ["2.2.2.2", "1.1.1.1"] (which needs to add OVS and iptables rules for 2.2.2.2 and remove them for 1.1.1.1, but in order to make the latter happen, we have to add 1.1.1.1 to the "changed" list, even though it didn't actually change)

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1585947

[knobunc]

/lgtm

Thanks Dan

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danwinship, knobunc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/network/OWNERS [danwinship,knobunc]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[knobunc]

/retest

[knobunc]

/retest

[0xmichalis]

/retest