feat: clean up stale HNS resources on NC create for delegated NICs in SwiftV2

[jackieluc]

Reason for Change:

• Add a EnableStaleHNSCleanupOnNCCreate config flag (also gated behind several conditions: NetworkingContainerType == ACI, ManageEndpointState, and NC has delegated NIC type)
• Adds stale HNS endpoint/network cleanup during CreateNetworkContainer when a delegated NIC MAC is reused by a new NC. This handles cases where a previous NC was not properly cleaned up (e.g., CNI DEL was never called because of containerd issues), which kept stale HNS resources and blocked new SwiftV2 NC creations due to control plane thinking the NIC was available when in reality it was not.
• Add a HNSClient for CNS and for testing
• Emits a telemetry metric on each cleanup attempt with success/failure status.

Testing:

• Unit tests added for cleanupStaleHNSResources and findEndpointStateByMAC
• Validated on a SwiftV2 SF cluster with delegated NICs by simulating stale HNS resources and stale endpoint state in CNS

Issue Fixed:

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:

[Copilot]

Pull request overview

Adds an opt-in mechanism in CNS to proactively clean up stale Windows HNS endpoint/network resources (and corresponding CNS endpoint-state entries) during CreateNetworkContainer for SwiftV2 delegated NIC scenarios, helping unblock NC creation when a delegated NIC/MAC is reused.

Changes:

• Introduces EnableStaleHNSCleanupOnNCCreate config/option and wires it into CNS service options.
• Adds stale-resource detection/cleanup helpers (normalizeMAC, findEndpointStateByMAC, cleanupStaleHNSResources) invoked on ACI NC create when delegated NIC info is present and endpoint-state management is enabled.
• Adds an HNSClient abstraction for deletions (with tests) and emits a cleanup metric.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
common/config.go	Adds new option key for enabling stale HNS cleanup on NC create.
cns/configuration/configuration.go	Adds config field to toggle stale HNS cleanup behavior.
cns/service/main.go	Wires new config flag into CNS service options.
cns/restserver/restserver.go	Injects an hnsClient into HTTPRestService for runtime + testability.
cns/restserver/api.go	Triggers stale HNS cleanup during ACI CreateNetworkContainer under gating conditions.
cns/restserver/ipam.go	Implements MAC normalization, endpoint-state lookup by MAC, cleanup logic, and metric emission.
cns/restserver/ipam_test.go	Adds unit tests for MAC lookup and stale HNS cleanup (with a mock HNS client).
cns/logger/constants.go	Adds metric name constant for stale HNS cleanup telemetry.
cns/hnsclient/hnsclient.go	Introduces HNSClient interface + default implementation.
cns/hnsclient/hnsclient_windows.go	Exposes DeleteNetworkByIDHnsV2 wrapper used by the client interface.
cns/hnsclient/hnsclient_linux.go	Adds non-Windows stubs for the new delete-by-ID functions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jackieluc]

/azp run Azure Container Networking PR

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[jackieluc]

/azp run Azure Container Networking PR

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[github-actions]

This pull request is stale because it has been open for 2 weeks with no activity. Remove stale label or comment or this will be closed in 7 days