[BPF] Re-wire SetTriggerFn on syncer swap in proxy.SetSyncer

[tomastigera]

Description

proxy.New() wires the syncer's expand-NodePort fixup callback to the proxy's runner via dp.SetTriggerFn(p.runner.Run) (proxy.go:180). proxy.SetSyncer() swaps in a fresh syncer (e.g. on a host-IP change inside KubeProxy.run()) but did not re-wire that callback.

Effect

The expand-NodePort fixup goroutine handles ExternalTrafficPolicy=Local NodePort services with backends on remote nodes whose routes were not yet programmed when the syncer first computed dataplane state. It re-runs expandNodePorts on each route-table change and, when a previously-missed route now resolves, calls s.triggerFn() to schedule an Apply (syncer.go:1216).

After any host-IP change, the new syncer that KubeProxy.run() hands to SetSyncer had triggerFn = nil, so the fixup's resolution was silently lost until some unrelated service/endpoint update piggybacked an Apply. In a quiet cluster, NodePort entries to backends on certain remote nodes could remain stale for an arbitrary period.

Origin

The asymmetry is pre-existing — kp.run() always created a fresh syncer and called SetSyncer on it before #12667. But #12667 made it visible in the diff: the first call now also goes through this path's logical sibling (proxy.New(), which does set the trigger), making the missing wiring on SetSyncer plain to read. Caught on the v3.31 backport review (#12693).

Fix

Have proxy.SetSyncer call s.SetTriggerFn(p.runner.Run) on the new syncer, under the same lock as the dpSyncer swap, mirroring what proxy.New() does for the initial syncer.

Test

New regression test should re-arm the NodePort externalTrafficPolicy=Local route-fixup trigger after a syncer swap in proxy_test.go swaps a syncer via SetSyncer, verifies the new syncer received a non-nil trigger callback, and confirms invoking it schedules an Apply.

The test fails on master before this change with:

SetSyncer must wire the fixup callback on the new syncer
Expected <func()>: nil not to be nil

Related issues/PRs

Follow-up to #12667. Surfaced during v3.31 backport review (#12693, comment thread on kube-proxy.go:161).

Release Note

ebpf - Fix kube-proxy losing the NodePort externalTrafficPolicy=Local route-fixup trigger after a syncer swap, which could cause stale NAT entries on remote backends.

Reminder for the reviewer

• release-note-required
• docs-not-required (no user-facing config change; bug fix)
• cherry-pick-candidate (bug fix; should be backported alongside [v3.31] [BPF] Defer kube-proxy construction until first hostIPs #12693 / [v3.32] [BPF] Defer kube-proxy construction until first hostIPs and in-sync #12694)

[Copilot]

Pull request overview

This PR fixes a bug in Felix’s eBPF kube-proxy where swapping in a new DPSyncer via proxy.SetSyncer() failed to re-wire the syncer’s expand-NodePort route-fixup trigger callback, causing ExternalTrafficPolicy=Local NodePort updates to be missed after a syncer swap (e.g., host IP change).

Changes:

• Re-wire DPSyncer.SetTriggerFn(p.runner.Run) inside proxy.SetSyncer() when replacing the dataplane syncer.
• Add a regression test that swaps syncers, asserts the new syncer received a non-nil trigger callback, and verifies invoking it schedules an Apply.
• Extend the test mockSyncer to record the trigger function passed via SetTriggerFn.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
felix/bpf/proxy/proxy.go	Ensures SetSyncer() re-attaches the runner trigger to the newly installed syncer.
felix/bpf/proxy/proxy_test.go	Adds regression coverage for trigger re-wiring on syncer swap; updates mock syncer to capture triggerFn.