fix: handle correctly change of listen address for maintenance service

Fixes #7738

If the SideroLink address changes, maintenance service should listen on
new address. Previously it worked "sometimes", as there was a race on
maintenance config either be removed/recreated or just updated. In case
of an update the listen address was not updated properly, but recreate
case worked correctly.

Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>

internal/app/machined/pkg/controllers/runtime/maintenance_service.go

@@ -86,6 +86,7 @@ func (ctrl *MaintenanceServiceController) Run(ctx context.Context, r controller.
 		listener                   net.Listener
 		lastReachableAddresses     []string
 		lastCertificateFingerprint string
+		lastListenAddress          string
 		usagePrinted               bool
 	)
 
@@ -106,6 +107,7 @@ func (ctrl *MaintenanceServiceController) Run(ctx context.Context, r controller.
 
 			listener = nil
 			lastReachableAddresses = nil
+			lastListenAddress = ""
 		}
 	}
 
@@ -207,11 +209,18 @@ func (ctrl *MaintenanceServiceController) Run(ctx context.Context, r controller.
 			continue
 		}
 
+		if listener != nil && cfg.TypedSpec().ListenAddress != lastListenAddress {
+			// listen address changed, restart the server
+			shutdownServer(ctx)
+		}
+
 		if listener == nil {
 			listener, err = net.Listen("tcp", cfg.TypedSpec().ListenAddress)
 			if err != nil {
 				return fmt.Errorf("failed to listen: %w", err)
 			}
+
+			lastListenAddress = cfg.TypedSpec().ListenAddress
 		}
 
 		if server == nil {

internal/app/machined/pkg/controllers/runtime/maintenance_service_test.go

@@ -104,6 +104,32 @@ func (suite *MaintenanceServiceSuite) TestRunService() {
 
 	suite.Require().NoError(mc.Close())
 
+	// change the listen address
+	oldListenAddress := maintenanceConfig.TypedSpec().ListenAddress
+	maintenanceConfig.TypedSpec().ListenAddress = suite.findListenAddr()
+	suite.Require().NoError(suite.State().Update(suite.Ctx(), maintenanceConfig))
+
+	// wait for the service to be up on the new address
+	suite.AssertWithin(time.Second, 10*time.Millisecond, func() error {
+		var c *tls.Conn
+
+		c, err = tls.Dial("tcp", maintenanceConfig.TypedSpec().ListenAddress,
+			&tls.Config{
+				InsecureSkipVerify: true,
+			},
+		)
+
+		if c != nil {
+			c.Close() //nolint:errcheck
+		}
+
+		return retry.ExpectedError(err)
+	})
+
+	// verify that old address returns connection refused
+	_, err = net.Dial("tcp", oldListenAddress)
+	suite.Require().ErrorContains(err, "connection refused")
+
 	// teardown the maintenance service
 	_, err = suite.State().Teardown(suite.Ctx(), maintenanceRequest.Metadata())
 	suite.Require().NoError(err)