Don't merge: Revert "endpoint/bpf: remove change empty condition for updateEnvoy"

YutaroHayakawa · YutaroHayakawa · commit d123ec6bbb0a · 2026-02-27T18:00:42.000-08:00
This reverts commit cbf536a.
diff --git a/pkg/endpoint/bpf.go b/pkg/endpoint/bpf.go
@@ -1142,6 +1142,9 @@ func (e *Endpoint) ApplyPolicyMapChanges(proxyWaitGroup *completion.WaitGroup) e
 func (e *Endpoint) applyPolicyMapChangesLocked(regenContext *regenerationContext, hasNewPolicy bool) error {
 	e.PolicyDebug("applyPolicyMapChanges")
 
+	// Always update Envoy if policy has changed
+	updateEnvoy := hasNewPolicy
+
 	// Note that after successful endpoint regeneration the desired and realized policies are
 	// the same pointer. During the bpf regeneration possible incremental updates are collected
 	// on the newly computed desired policy, which is not fully realized yet. This is why we get
@@ -1161,17 +1164,20 @@ func (e *Endpoint) applyPolicyMapChangesLocked(regenContext *regenerationContext
 	}
 
 	hasEnvoyRedirect := e.desiredPolicy.L4Policy.HasEnvoyRedirect()
-	// updateEnvoy when policy has changed, if the endpoint has Envoy redirects,
-	// or is an Ingress endpoint, which needs to enforce also the full L3/4 policy.
-	//
-	// Even if there are no changes, we update the proxyWaitGroup for any in-progress
-	// NetworkPolicy update to be done if the endpoint has envoy redirects, so that the
-	// the expected policy is in place.
-	//
-	// 'updateEnvoy' is already set to 'true' if policy changed. In that case there can
-	// be new redirects and a full policy map update even if there were no incremental
-	// updates.
-	updateEnvoy := hasNewPolicy || hasEnvoyRedirect || e.isIngress
+	if !changes.Empty() {
+		// updateEnvoy if there were any mapChanges, but only if the endpoint has Envoy
+		// redirects, or is an Ingress endpoint, which needs to enforce also the full L3/4
+		// policy.
+		//
+		// Even if there are no changes, we update the proxyWaitGroup for any in-progress
+		// NetworkPolicy update to be done if the endpoint has envoy redirects, so that the
+		// the expected policy is in place.
+		//
+		// 'updateEnvoy' is already set to 'true' if policy changed. In that case there can
+		// be new redirects and a full policy map update even if there were no incremental
+		// updates.
+		updateEnvoy = updateEnvoy || hasEnvoyRedirect || e.isIngress
+	}
 
 	stats := &regenContext.Stats
 	datapathRegenCtxt := regenContext.datapathRegenerationContext
