test/cni: work-around conntrack lingering rules

If not enough time passes between the affinity and the perf test
(E.g. in the CI), the perf test fails on all CNIs (but Calico?) due
to lingering DNAT conntrack rules that map to old endpoints.

This seems a bug in either MetalLB or kubeproxy, as it points to
IP addresses that are not anymore valid.

test/cni/Makefile

@@ -110,6 +110,8 @@ _check_perf: _wait_up _wait_running
 	$(QUIET) for POD in $$(minikube kubectl -- get pods | grep my-nginx | awk '{print $$1}'); do \
 	           while [[ "$$(minikube kubectl -- logs $$POD | grep 'Up and running...')" == ""  ]]; do sleep 1; done; \
 	         done;
+	$(QUIET) echo "Workaround lingering old conntrack (metallb/kubeproxy bug?)..."
+	$(QUIET) minikube ssh "sudo conntrack -F"
 	$(QUIET) echo "Launching iperf tests..."
 	set -o pipefail; \
 	NETNS=client ./perf/check_perf.sh 2>&1 | tee .last_perf_report.txt; \