Skip to content

Conversation

@malagant
Copy link

@malagant malagant commented Jun 1, 2017

When you forgot to add the edit role to system:serviceaccount::letsencrypt the watcher script still tries to process an empty list of routes instead of giving a hint about the error.
This solution might be only a temporary fix, but works nice in our environment. ;)

@ibotty
Copy link
Owner

ibotty commented Jun 1, 2017

I agree to have more explicit error handling. I don't like calling watch_routes twice though.

Copy link
Owner

@ibotty ibotty left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my limited testing I could not reproduce. I don't understand how that could happen. The set -o pipefail should take care of that, because afaict the api call (curl) will return 403 when it cannot list routes. Do you still have your environment handy? If so, can you please oc rsh to your letsencrypt pod and do the following?

. /usr/share/letsencrypt-container/common.sh
set -o pipefail
watch_routes
echo $?
watch_routes | true
echo $?

Thank you!

log "Processing route $selfLink with domain $domainname."
get_certificate "$domainname" "$selfLink"
else
log "$(watch_routes)"
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we log something more concrete? Ideas?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants