Synchronize AclMaintainer converge

1 files changed, 3 insertions, 1 deletions

diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/acl/AclMaintainer.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/acl/AclMaintainer.java
index a68eda7e39e..247cf8bffd6 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/acl/AclMaintainer.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/acl/AclMaintainer.java
@@ -51,7 +51,9 @@ public class AclMaintainer {
         this.ipAddresses = ipAddresses;
     }
 
-    public void converge(NodeAgentContext context) {
+    // ip(6)tables operate while having the xtables lock, run with synchronized to prevent multiple NodeAgents
+    // invoking ip(6)tables concurrently.
+    public synchronized void converge(NodeAgentContext context) {
         // Apply acl to the filter table
         editFlushOnError(context, IPVersion.IPv4, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv4));
         editFlushOnError(context, IPVersion.IPv6, "filter", FilterTableLineEditor.from(context.acl(), IPVersion.IPv6));