When a veth pair has one end in a container and the other in the host
namespace, removing it failed: the container end's teardown deleted the
whole pair, so the host end's own delete then failed ("Cannot find
device") and aborted the teardown, leaving the interface behind.
The host-namespace delete added for the both-ends-in-container case was
emitted for every container veth end. Restrict it to the primary end,
which for a host/container pair is the host end that already deletes the
pair itself.
Extend the container veth tests to remove the pair and verify it is gone,
covering both the single-end (regression) and both-ends teardown paths.
Fixes: #1546
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Previously at least one end of a veth pair had to remain in the host
namespace, because that end created and destroyed the pair. Assigning
both ends to containers left no one to create it.
Select a deterministic primary end so exactly one side creates the pair.
When the primary is itself a container interface, create the pair in the
host namespace before the container starts; CNI host-device then moves
each end into its container. Teardown is deferred to the container
removal script so the pair does not linger and block re-creation.
Drop the now-obsolete limitation notes from the documentation and YANG,
and add a regression test connecting two containers over a veth pair.
Fixes: #941
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg