Merge pull request #27181 from vespa-engine/andreer/wireguard-fix

ensure wireguard config is always updated

1 files changed, 2 insertions, 0 deletions

diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentImpl.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentImpl.java
index 64efeb85e63..1ff1b5c8ffe 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentImpl.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentImpl.java
@@ -619,8 +619,10 @@ public class NodeAgentImpl implements NodeAgent {
         } catch (OrchestratorException e) {
             // Ensure the ACLs are up to date: The reason we're unable to suspend may be because some other
             // node is unable to resume because the ACL rules of SOME Docker container is wrong...
+            // Same can happen with stale WireGuard config, so update that too
             try {
                 aclMaintainer.ifPresent(maintainer -> maintainer.converge(context));
+                wireguardTasks.forEach(task -> getContainer(context).ifPresent(c -> task.converge(context, c.id())));
             } catch (RuntimeException suppressed) {
                 logger.log(Level.WARNING, "Suppressing ACL update failure: " + suppressed);
                 e.addSuppressed(suppressed);