OVN has always had a node-before-master upgrade strategy, where ovn-controller is kept compatible with SBDB schema and format changes for a couple versions. The expectation is that all ovn-controllers are updated first, and only when compatible ovn-controllers are running does ovn-northd get upgraded and potentially make incompatible database changes.
If this strategy isn't followed (which is the case with OpenShift which upgrades masters first) then older ovn-controllers may not understand the new changes to SBDB and might not install those flows to OVS, leading to missing flows.
The CNO should be changed to upgrade the ovn-kubernetes node daemonset first, and whne all nodes in the cluster have been updated, then upgrade the master pods.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
*** Bug 1915970 has been marked as a duplicate of this bug. ***