Merge branch 'branch/v16' into bot/backport-42536-branch/v16

lib/vnet/osconfig.go

@@ -130,11 +130,9 @@ func (c *osConfigurator) updateOSConfiguration(ctx context.Context) error {
 	return trace.Wrap(err, "configuring OS")
 }
 
-func (c *osConfigurator) deconfigureOS() error {
+func (c *osConfigurator) deconfigureOS(ctx context.Context) error {
 	// configureOS is meant to be called with an empty config to deconfigure anything necessary.
-	// Pass context.Background() because we are likely deconfiguring because we received a signal to terminate
-	// and all contexts have been canceled.
-	return trace.Wrap(configureOS(context.Background(), &osConfig{}))
+	return trace.Wrap(configureOS(ctx, &osConfig{}))
 }
 
 func (c *osConfigurator) setTunIPv4FromCIDR(cidrRange string) error {

lib/vnet/setup.go

@@ -235,10 +235,19 @@ func createAndSetupTUNDeviceAsRoot(ctx context.Context, ipv6Prefix, dnsAddr stri
 		return tunCh, errCh
 	}
 
+	// Clean up any stale configuration left by a previous VNet instance that may have failed to clean up.
+	// This is necessary in case any stale /etc/resolver/<proxy address> entries are still present, we need to
+	// be able to reach the proxy in order to fetch the vnet_config.
+	if err := osConfigurator.deconfigureOS(ctx); err != nil {
+		errCh <- trace.Wrap(err, "cleaning up OS configuration on startup")
+		return tunCh, errCh
+	}
+
 	go func() {
 		defer func() {
-			// Shutting down, deconfigure OS.
-			errCh <- trace.Wrap(osConfigurator.deconfigureOS())
+			// Shutting down, deconfigure OS. Pass context.Background because [ctx] has likely been canceled
+			// already but we still need to clean up.
+			errCh <- trace.Wrap(osConfigurator.deconfigureOS(context.Background()))
 		}()
 
 		if err := osConfigurator.updateOSConfiguration(ctx); err != nil {