DataONEorg / k8s-cluster

Documentation on the DataONE Kubernetes cluster
Apache License 2.0
2 stars 1 forks source link

Check on certbot.renew service on docker-ucsb-4 #28

Closed amoeba closed 2 years ago

amoeba commented 2 years ago

Hey @gothub, while looking at #27, I also noticed a service snap.certbot.renew.service was in a failed state,

Mar 10 03:08:47 docker-ucsb-4 certbot.renew[2367]: Failed to renew certificate docker-ucsb-4.dataone.org with er
Mar 10 03:08:47 docker-ucsb-4 certbot.renew[2367]: All renewals failed. The following certificates could not be
Mar 10 03:08:47 docker-ucsb-4 certbot.renew[2367]:   /etc/letsencrypt/live/docker-ucsb-4.dataone.org/fullchain.p
Mar 10 03:08:47 docker-ucsb-4 certbot.renew[2367]: 1 renew failure(s), 0 parse failure(s)
Mar 10 03:08:47 docker-ucsb-4 systemd[1]: snap.certbot.renew.service: Main process exited, code=exited, status=1
Mar 10 03:08:47 docker-ucsb-4 systemd[1]: snap.certbot.renew.service: Failed with result 'exit-code'.
Mar 10 03:08:47 docker-ucsb-4 systemd[1]: Failed to start Service for snap application certbot.renew.

Is this expected or possibly an issue?

gothub commented 2 years ago

Before we started using cert-manager, LE certs were requested by certbot, then manually copied from the system location to each k8s namespace secret. I don't think these certbot LE certs are being used by anything now, so can be deleted.

I just now deleted the cert on dev k8s, ensuring that they are no longer used by following the instructions here.

I will do the same for docker-ucsb-4.

amoeba commented 2 years ago

Gotcha, thanks @gothub.