cerc-io/stack-orchestrator
13
1
Fork 3
Code Issues 116 Pull Requests 23 Actions Packages Projects Releases 491 Wiki Activity

fix(k8s): drop stale ACME accounts during etcd cleanup #991

Open
AFDudley wants to merge 1 commits from fix-etcd-drop-stale-acme into main
pull from: fix-etcd-drop-stale-acme
merge into: cerc-io:main
Conversation 0 Commits 1 Files Changed 1 +13 -3
AFDudley commented 2026-02-10 06:57:17 +00:00
Owner
Copy Link

_clean_etcd_keeping_certs() preserved ALL caddy-system secrets across
cluster recreations, including ACME account secrets registered with
wrong/empty email. Caddy reuses these stale accounts instead of
registering fresh ones, causing recurring "unable to parse email
address" errors.

Filter the etcd restore loop to only keep certificate secrets (keys
matching certificates). ACME accounts, OCSP staples, and locks are
transient and get recreated automatically by Caddy on startup.

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

_clean_etcd_keeping_certs() preserved ALL caddy-system secrets across cluster recreations, including ACME account secrets registered with wrong/empty email. Caddy reuses these stale accounts instead of registering fresh ones, causing recurring "unable to parse email address" errors. Filter the etcd restore loop to only keep certificate secrets (keys matching *certificates*). ACME accounts, OCSP staples, and locks are transient and get recreated automatically by Caddy on startup. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
AFDudley added 1 commit 2026-02-10 06:57:18 +00:00
fix(k8s): drop stale ACME accounts during etcd cleanup
Some checks failed
Lint Checks / Run linter (push) Successful in 13s
Details
Lint Checks / Run linter (pull_request) Successful in 16s
Details
Smoke Test / Run basic test suite (pull_request) Successful in 1m23s
Details
K8s Deployment Control Test / Run deployment control suite on kind/k8s (pull_request) Failing after 1m53s
Details
K8s Deploy Test / Run deploy test suite on kind/k8s (pull_request) Failing after 2m7s
Details
Webapp Test / Run webapp test suite (pull_request) Successful in 2m8s
Details
Deploy Test / Run deploy test suite (pull_request) Successful in 2m17s
Details
6a2f2a5dde 
_clean_etcd_keeping_certs() preserved ALL caddy-system secrets across
cluster recreations, including ACME account secrets registered with
wrong/empty email. Caddy reuses these stale accounts instead of
registering fresh ones, causing recurring "unable to parse email
address" errors.

Filter the etcd restore loop to only keep certificate secrets (keys
matching *certificates*). ACME accounts, OCSP staples, and locks are
transient and get recreated automatically by Caddy on startup.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Some checks failed
Lint Checks / Run linter (push) Successful in 13s
Details
Lint Checks / Run linter (pull_request) Successful in 16s
Details
Smoke Test / Run basic test suite (pull_request) Successful in 1m23s
Details
K8s Deployment Control Test / Run deployment control suite on kind/k8s (pull_request) Failing after 1m53s
Details
K8s Deploy Test / Run deploy test suite on kind/k8s (pull_request) Failing after 2m7s
Details
Webapp Test / Run webapp test suite (pull_request) Successful in 2m8s
Details
Deploy Test / Run deploy test suite (pull_request) Successful in 2m17s
Details
This pull request doesn't have enough approvals yet. 0 of 1 approvals granted.
You are not authorized to merge this pull request.
View command line instructions.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix-etcd-drop-stale-acme:fix-etcd-drop-stale-acme
git checkout fix-etcd-drop-stale-acme
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug

Something isn't working

  
documentation

Improvements or additions to documentation

  
duplicate

This issue or pull request already exists

  
enhancement

New feature or request

  
feature

   
good first issue

Good for newcomers

  
help wanted

Extra attention is needed

  
in progress

   
invalid

This doesn't seem right

  
question

Further information is requested

  
wontfix

This will not be worked on

  
Copied from Github

An issue or PR manually copied from GitHub.

  
Kind/Breaking

Breaking change that won't be backward compatible

  
Kind/Bug

Something is not working

  
Kind/Documentation

Documentation changes

  
Kind/Enhancement

Improve existing functionality

  
Kind/Feature

New functionality

  
Kind/Security

This is security issue

  
Kind/Testing

Issue or pull request related to testing

  
Priority
Critical
The priority is critical

  
Priority
High
The priority is high

  
Priority
Low
The priority is low

  
Priority
Medium
The priority is medium

  
Reviewed
Confirmed
Issue has been confirmed

  
Reviewed
Duplicate
This issue or pull request already exists

  
Reviewed
Invalid
Invalid issue

  
Reviewed
Won't Fix
This issue won't be fixed

  
Status
Abandoned
Somebody has started to work on this but abandoned work

  
Status
Blocked
Something is blocking this issue or pull request

  
Status
Need More Info
Feedback is required to reproduce issue or to continue work

No Label
bug
documentation
duplicate
enhancement
feature
good first issue
help wanted
in progress
invalid
question
wontfix
Copied from Github
Kind/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: cerc-io/stack-orchestrator#991
No description provided.
Delete Branch "fix-etcd-drop-stale-acme"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?