Error destroying ipset when deleting NodeNetworkPolicy

[tnqn]

Describe the bug

While debugging another issue, I found the following errors in antrea-agent logs:

E0919 15:26:53.365234 13 networkpolicy_controller.go:897] Error syncing rule "f7b29a365e132446", retrying. Error: error destroying ipset ANTREA-POL-F7B29A365E132446-4: exit status 1

After adding more logs to the log via #6705, I got the following:

E0930 14:24:09.356269 13 networkpolicy_controller.go:902] Error syncing rule "4f5505d534deb0ef", retrying. Error: error destroying ipset ANTREA-POL-4F5505D534DEB0EF-4, err: exit status 1, output: ipset v7.19: Set cannot be destroyed: it is in use by a kernel component

The full log can be downloaded here e2e-kind-encap-all-features-enabled.tar.gz.zip.

The error was gone eventually after being repeated a few times. It may be because the networkpolicy controller didn't remove the iptables rules first before destroying the ipset, or could be a kernel bug that the reference was not deleted immediately after the iptables rules were deleted.

Versions:

Please provide the following information:

• Antrea version (Docker image tag). v2.2-dev

[tnqn]

@hongliangl could you please take a look?

[hongliangl]

@hongliangl could you please take a look?

Will do.