Fix peer reconcilication - #11
Merged
Merged
Conversation
BonySmoke
approved these changes
Apr 15, 2026
Sea-you
approved these changes
Apr 15, 2026
mxhob1
referenced
this pull request
in node-networks-au/wireguard-operator
May 27, 2026
…lreadyExists When the <peer>-peer Secret exists before the WireguardPeer CR is reconciled (ops pre-clones keys for tenant migrations or 1Password-backed key sharing across tenants), the reconciler erred with `secrets "<peer>-peer" already exists` and bailed out — it never populated spec.publicKey or spec.privateKeyRef on the CR, so wg0 never got the [Peer] block for that peer and incoming handshakes landed on an empty config. Replace the unconditional Create with a Get-first pattern: - Found: parse data.privateKey, derive pubkey via wgtypes.ParseKey - NotFound: generate fresh keypair + Create the Secret (existing path) - Other error: surface it Then in both branches, populate spec.publicKey + spec.privateKeyRef on the CR via Patch (NOT Update) so we don't clobber KRO's labels / ownerRefs / other field-manager owned fields. Upstream PR #11 (already in v2.11.0) covered this for the Wireguard CR's keypair Secret but not the per-peer Secret. This closes that gap. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This addresses a race condition between WireguardPeerReconciler and WireguardReconciler that leaves peers stuck without keys.
WireguardReconciler and WireguardPeerReconciler are both trying to update WireguardPeer .spec concurrently leading to a race condition where an address is assigned, ResourceVersion updated but no wireguardpeer can be further configured as Update() is using a different version. We use patch instead so only the changed fields get updated.
Added a test which confirms the bug.