Skip to content

Commit 7aa5f39

Browse files
jcscottiiijcscottiii
authored
bugfix: Fix cert renewal (#82)
We received an alert yesterday that the certificate for wpt.live is going to expire. Upon looking at the logs, it showed this error: ``` AttributeError: module 'josepy' has no attribute 'ComparableX509'. Did you mean: 'ComparableKey'? ``` Which looks like this issue: certbot/certbot#10185 Thid changes bumps the python libraries and moves them into a requirements.txt for the cert renewer python process image Also simplified some of the package pinning to only the minor version where able (all but the pip dpkg)
1 parent e583354 commit 7aa5f39

File tree

4 files changed

+60
-60
lines changed

4 files changed

+60
-60
lines changed

‎cert-renewer-requirements.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
acme==4.1.1
2+
certbot==4.1.1
3+
certbot-dns-google==4.1.1

‎cert-renewer.Dockerfile

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,26 +8,25 @@ ENV WPT_HOST=wpt.live \
88
WPT_ALT_HOST=not-wpt.live \
99
WPT_BUCKET=wpt-live
1010

11-
# Pin the versions of python and google cloud cli for repeatable builds
12-
# For ubuntu package versions, go to https://packages.ubuntu.com/
13-
# Search for the package with the "jammy" distribution (aka 22.04) selected.
11+
# Search for the packages with the "jammy" distribution (aka 22.04) selected on https://packages.ubuntu.com/.
1412
RUN apt-get -qqy update && \
1513
apt-get -qqy install \
1614
apt-transport-https \
1715
ca-certificates \
1816
curl \
1917
gnupg \
20-
python3=3.10.6-1~22.04.1 \
21-
python3-dev=3.10.6-1~22.04.1 \
22-
python3-pip=22.0.2+dfsg-1ubuntu0.5
18+
python3.10 \
19+
python3.10-dev \
20+
python3-pip
2321
# For Google Cloud, look under https://packages.cloud.google.com/apt/dists/cloud-sdk/main/binary-amd64/Packages
2422
# https://cloud.google.com/storage/docs/gsutil_install
2523
# Copy the "Docker Tip" instructions from gsutil_install link and then pin the version
26-
RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key --keyring /usr/share/keyrings/cloud.google.gpg add - && apt-get update -y && apt-get install google-cloud-cli=451.0.1-0 -y
24+
RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key --keyring /usr/share/keyrings/cloud.google.gpg add - && apt-get update -y && apt-get install google-cloud-cli=526.0.1-0 -y
2725

2826
# Instructions for certbot installation
2927
# https://certbot.eff.org/instructions?ws=other&os=pip
30-
RUN pip install acme==1.29.0 certbot==1.29.0 certbot-dns-google==1.29.0
28+
COPY cert-renewer-requirements.txt requirements.txt
29+
RUN pip install -r requirements.txt
3130

3231
COPY src/cert-store.sh /usr/local/bin/
3332

‎terraform.tfstate

Lines changed: 44 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"version": 4,
33
"terraform_version": "1.6.2",
4-
"serial": 289,
4+
"serial": 298,
55
"lineage": "93d46d9c-57ba-2cec-a13b-46298c0751ec",
66
"outputs": {
77
"wpt-live-address": {
@@ -92,9 +92,9 @@
9292
{
9393
"schema_version": 0,
9494
"attributes": {
95-
"id": "sha256:029a3b2e90d2b74a7453f237af5c4fd346ac5673ca9f6e8a7bb7f4ccc9867d34",
95+
"id": "sha256:2a448949978e21356a3003926a2d7646046193ada20038f2252aaeb286a56472",
9696
"name": "gcr.io/wpt-live-app/wpt-live-cert-renewer:latest",
97-
"repo_digest": "gcr.io/wpt-live-app/wpt-live-cert-renewer@sha256:b067affafee033a8206a18a7230f314f4769b817eeba7493cafedc2282c3723f"
97+
"repo_digest": "gcr.io/wpt-live-app/wpt-live-cert-renewer@sha256:806d59f4764ea12fa6bc7aeea80efe90846ab4709b111e1d5bd3d9ab671e8f6f"
9898
},
9999
"sensitive_attributes": []
100100
}
@@ -199,24 +199,24 @@
199199
"create_time": "2023-10-24T14:36:06.871869Z",
200200
"creator": "[email protected]",
201201
"delete_time": "",
202-
"etag": "\"CNC_6MAGENijiDc/cHJvamVjdHMvd3B0LWxpdmUtYXBwL2xvY2F0aW9ucy91cy1jZW50cmFsMS9qb2JzL3dwdC10b3QtYXBwLWNlcnQtcmVuZXdlcnM\"",
203-
"execution_count": 562,
202+
"etag": "\"CMqgscIGEODrndAC/cHJvamVjdHMvd3B0LWxpdmUtYXBwL2xvY2F0aW9ucy91cy1jZW50cmFsMS9qb2JzL3dwdC10b3QtYXBwLWNlcnQtcmVuZXdlcnM\"",
203+
"execution_count": 601,
204204
"expire_time": "",
205-
"generation": "2",
205+
"generation": "3",
206206
"id": "projects/wpt-live-app/locations/us-central1/jobs/wpt-tot-app-cert-renewers",
207207
"labels": {},
208208
"last_modifier": "[email protected]",
209209
"latest_created_execution": [
210210
{
211-
"completion_time": "2025-05-06T00:02:57.524979Z",
212-
"create_time": "2025-05-06T00:00:01.496371Z",
213-
"name": "wpt-tot-app-cert-renewers-9scn7"
211+
"completion_time": "2025-06-13T16:27:27.694533Z",
212+
"create_time": "2025-06-13T16:24:01.144163Z",
213+
"name": "wpt-tot-app-cert-renewers-qtlts"
214214
}
215215
],
216216
"launch_stage": "GA",
217217
"location": "us-central1",
218218
"name": "wpt-tot-app-cert-renewers",
219-
"observed_generation": "2",
219+
"observed_generation": "3",
220220
"project": "wpt-live-app",
221221
"reconciling": false,
222222
"template": [
@@ -248,7 +248,7 @@
248248
"value_source": []
249249
}
250250
],
251-
"image": "gcr.io/wpt-live-app/wpt-live-cert-renewer@sha256:b067affafee033a8206a18a7230f314f4769b817eeba7493cafedc2282c3723f",
251+
"image": "gcr.io/wpt-live-app/wpt-live-cert-renewer@sha256:806d59f4764ea12fa6bc7aeea80efe90846ab4709b111e1d5bd3d9ab671e8f6f",
252252
"liveness_probe": [],
253253
"name": "",
254254
"ports": [],
@@ -290,7 +290,7 @@
290290
],
291291
"timeouts": null,
292292
"uid": "8003276c-d47c-42b6-b171-b2bf451d1043",
293-
"update_time": "2025-05-06T14:42:24.115479Z"
293+
"update_time": "2025-06-13T16:22:34.705132Z"
294294
},
295295
"sensitive_attributes": [],
296296
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxMjAwMDAwMDAwMDAwLCJkZWxldGUiOjEyMDAwMDAwMDAwMDAsInVwZGF0ZSI6MTIwMDAwMDAwMDAwMH19",
@@ -933,7 +933,7 @@
933933
],
934934
"base_instance_name": "wpt-tot-app-wpt-servers",
935935
"description": "compute VM Instance Group",
936-
"fingerprint": "qvYgsyNU75g=",
936+
"fingerprint": "HYyOMy7guno=",
937937
"id": "projects/wpt-live-app/zones/us-central1-b/instanceGroupManagers/wpt-tot-app-wpt-servers",
938938
"instance_group": "https://www.googleapis.com/compute/v1/projects/wpt-live-app/zones/us-central1-b/instanceGroups/wpt-tot-app-wpt-servers",
939939
"instance_lifecycle_policy": [
@@ -979,7 +979,7 @@
979979
"stateful_disk": [],
980980
"status": [
981981
{
982-
"is_stable": true,
982+
"is_stable": false,
983983
"stateful": [
984984
{
985985
"has_stateful_config": false,
@@ -992,7 +992,7 @@
992992
],
993993
"version_target": [
994994
{
995-
"is_reached": true
995+
"is_reached": false
996996
}
997997
]
998998
}
@@ -1016,7 +1016,7 @@
10161016
],
10171017
"version": [
10181018
{
1019-
"instance_template": "https://www.googleapis.com/compute/v1/projects/wpt-live-app/global/instanceTemplates/default-20250506144812248100000001",
1019+
"instance_template": "https://www.googleapis.com/compute/v1/projects/wpt-live-app/global/instanceTemplates/default-20250613193202312900000001",
10201020
"name": "wpt-tot-app-wpt-servers-default",
10211021
"target_size": []
10221022
}
@@ -1052,7 +1052,7 @@
10521052
"attributes": {
10531053
"advanced_machine_features": [],
10541054
"can_ip_forward": false,
1055-
"confidential_instance_config": [],
1055+
"confidential_instance_config": null,
10561056
"description": "",
10571057
"disk": [
10581058
{
@@ -1064,35 +1064,35 @@
10641064
"disk_size_gb": 0,
10651065
"disk_type": "pd-ssd",
10661066
"interface": "SCSI",
1067-
"labels": {},
1067+
"labels": null,
10681068
"mode": "READ_WRITE",
10691069
"provisioned_iops": 0,
1070-
"resource_policies": [],
1070+
"resource_policies": null,
10711071
"source": "",
1072-
"source_image": "projects/cos-cloud/global/images/cos-stable-117-18613-164-124",
1072+
"source_image": "projects/cos-cloud/global/images/cos-stable-121-18867-90-59",
10731073
"source_image_encryption_key": [],
10741074
"source_snapshot": "",
10751075
"source_snapshot_encryption_key": [],
10761076
"type": "PERSISTENT"
10771077
}
10781078
],
10791079
"guest_accelerator": [],
1080-
"id": "projects/wpt-live-app/global/instanceTemplates/default-20250506144812248100000001",
1080+
"id": "projects/wpt-live-app/global/instanceTemplates/default-20250613193202312900000001",
10811081
"instance_description": "",
10821082
"labels": {
1083-
"container-vm": "cos-stable-117-18613-164-124"
1083+
"container-vm": "cos-stable-121-18867-90-59"
10841084
},
10851085
"machine_type": "e2-medium",
10861086
"metadata": {
1087-
"gce-container-declaration": "\"spec\":\n \"containers\":\n - \"env\":\n - \"name\": \"WPT_HOST\"\n \"value\": \"wpt.live\"\n - \"name\": \"WPT_ALT_HOST\"\n \"value\": \"not-wpt.live\"\n - \"name\": \"WPT_BUCKET\"\n \"value\": \"wpt-tot-app-certificates\"\n \"image\": \"gcr.io/wpt-live-app/wpt-live-wpt-server-tot@sha256:9b82ef82950f1a23a1e553f4657c3790b2e432c072c8de227cd84a063075ddce\"\n \"restartPolicy\": \"Always\"\n \"volumes\": []\n",
1087+
"gce-container-declaration": "\"spec\":\n \"containers\":\n - \"env\":\n - \"name\": \"WPT_HOST\"\n \"value\": \"wpt.live\"\n - \"name\": \"WPT_ALT_HOST\"\n \"value\": \"not-wpt.live\"\n - \"name\": \"WPT_BUCKET\"\n \"value\": \"wpt-tot-app-certificates\"\n \"image\": \"gcr.io/wpt-live-app/wpt-live-wpt-server-tot@sha256:e9aa7d5bc5930bb8ba4ed749fc5d955e5bb9b014abf91dedbde39c6925281ff0\"\n \"restartPolicy\": \"Always\"\n \"volumes\": []\n",
10881088
"google-logging-enabled": "true",
10891089
"startup-script": "",
10901090
"tf_depends_id": ""
10911091
},
1092-
"metadata_fingerprint": "c4qsyfsW3Ao=",
1092+
"metadata_fingerprint": "6pbpq1TuRxs=",
10931093
"metadata_startup_script": null,
10941094
"min_cpu_platform": "",
1095-
"name": "default-20250506144812248100000001",
1095+
"name": "default-20250613193202312900000001",
10961096
"name_prefix": "default-",
10971097
"network_interface": [
10981098
{
@@ -1135,8 +1135,8 @@
11351135
"provisioning_model": "STANDARD"
11361136
}
11371137
],
1138-
"self_link": "https://www.googleapis.com/compute/v1/projects/wpt-live-app/global/instanceTemplates/default-20250506144812248100000001",
1139-
"self_link_unique": "https://www.googleapis.com/compute/v1/projects/wpt-live-app/global/instanceTemplates/default-20250506144812248100000001?uniqueId=8807221264062586819",
1138+
"self_link": "https://www.googleapis.com/compute/v1/projects/wpt-live-app/global/instanceTemplates/default-20250613193202312900000001",
1139+
"self_link_unique": "https://www.googleapis.com/compute/v1/projects/wpt-live-app/global/instanceTemplates/default-20250613193202312900000001?uniqueId=9063920210827919965",
11401140
"service_account": [
11411141
{
11421142
"email": "default",
@@ -1147,7 +1147,7 @@
11471147
}
11481148
],
11491149
"shielded_instance_config": [],
1150-
"tags": [],
1150+
"tags": null,
11511151
"tags_fingerprint": "",
11521152
"timeouts": null
11531153
},
@@ -1181,8 +1181,8 @@
11811181
],
11821182
"id": "projects/wpt-live-app/regions/us-central1/targetPools/wpt-tot-app-load-balancing",
11831183
"instances": [
1184-
"us-central1-b/wpt-tot-app-wpt-servers-33nv",
1185-
"us-central1-b/wpt-tot-app-wpt-servers-7gxp"
1184+
"us-central1-b/wpt-tot-app-wpt-servers-2xj5",
1185+
"us-central1-b/wpt-tot-app-wpt-servers-655d"
11861186
],
11871187
"name": "wpt-tot-app-load-balancing",
11881188
"project": "wpt-live-app",
@@ -1424,30 +1424,30 @@
14241424
{
14251425
"schema_version": 0,
14261426
"attributes": {
1427-
"archive_size_bytes": 1907636160,
1428-
"creation_timestamp": "2025-04-29T13:49:18.409-07:00",
1429-
"description": "Google, Container-Optimized OS, 117-18613.164.124 stable, Kernel: COS-6.6.72 Kubernetes: 1.30.3 Docker: 24.0.9 Family: cos-stable",
1427+
"archive_size_bytes": 1931812224,
1428+
"creation_timestamp": "2025-06-10T16:58:11.795-07:00",
1429+
"description": "Google, Container-Optimized OS, 121-18867.90.59 stable, Kernel: COS-6.6.87 Kubernetes: 1.30.3 Docker: 27.5.1 Family: cos-stable",
14301430
"disk_size_gb": 10,
14311431
"family": "cos-stable",
14321432
"filter": null,
1433-
"id": "projects/cos-cloud/global/images/cos-stable-117-18613-164-124",
1433+
"id": "projects/cos-cloud/global/images/cos-stable-121-18867-90-59",
14341434
"image_encryption_key_sha256": "",
1435-
"image_id": "5949804630412920226",
1436-
"label_fingerprint": "6a05UBQMhWk=",
1435+
"image_id": "2494191935395559548",
1436+
"label_fingerprint": "c57SMzoVwZI=",
14371437
"labels": {
1438-
"build_number": "18613-164-124",
1439-
"milestone": "117",
1438+
"build_number": "18867-90-59",
1439+
"milestone": "121",
14401440
"public-image": "true"
14411441
},
14421442
"licenses": [
1443+
"https://www.googleapis.com/compute/v1/projects/cos-cloud/global/licenses/cos-pcid",
14431444
"https://www.googleapis.com/compute/v1/projects/cos-cloud-shielded/global/licenses/shielded-cos",
1444-
"https://www.googleapis.com/compute/v1/projects/cos-cloud/global/licenses/cos",
1445-
"https://www.googleapis.com/compute/v1/projects/cos-cloud/global/licenses/cos-pcid"
1445+
"https://www.googleapis.com/compute/v1/projects/cos-cloud/global/licenses/cos"
14461446
],
14471447
"most_recent": false,
1448-
"name": "cos-stable-117-18613-164-124",
1448+
"name": "cos-stable-121-18867-90-59",
14491449
"project": "cos-cloud",
1450-
"self_link": "https://www.googleapis.com/compute/v1/projects/cos-cloud/global/images/cos-stable-117-18613-164-124",
1450+
"self_link": "https://www.googleapis.com/compute/v1/projects/cos-cloud/global/images/cos-stable-121-18867-90-59",
14511451
"source_disk": "",
14521452
"source_disk_encryption_key_sha256": "",
14531453
"source_disk_id": "",
@@ -1468,9 +1468,9 @@
14681468
{
14691469
"schema_version": 0,
14701470
"attributes": {
1471-
"id": "sha256:91e4a0a18efb18331fa8dc75c9533efc2165685bd537446aa59a55f4c10e1587",
1471+
"id": "sha256:9759f68b8345171ea4709ed0de979530b99c3c992021cbee9a5cdc9d5fc5858c",
14721472
"name": "gcr.io/wpt-live-app/wpt-live-wpt-server-tot:latest",
1473-
"repo_digest": "gcr.io/wpt-live-app/wpt-live-wpt-server-tot@sha256:9b82ef82950f1a23a1e553f4657c3790b2e432c072c8de227cd84a063075ddce"
1473+
"repo_digest": "gcr.io/wpt-live-app/wpt-live-wpt-server-tot@sha256:e9aa7d5bc5930bb8ba4ed749fc5d955e5bb9b014abf91dedbde39c6925281ff0"
14741474
},
14751475
"sensitive_attributes": []
14761476
}

‎wpt-server-tot.Dockerfile

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,7 @@ FROM ubuntu:22.04
44
ENV DEBIAN_FRONTEND=noninteractive \
55
DEBCONF_NONINTERACTIVE_SEEN=true
66

7-
# Pin the versions of python and google cloud cli for repeatable builds
8-
# For ubuntu package versions, go to https://packages.ubuntu.com/
9-
# Search for the package with the "jammy" distribution (aka 22.04) selected.
7+
# Search for the packages with the "jammy" distribution (aka 22.04) selected on https://packages.ubuntu.com/.
108
RUN \
119
apt-get -qqy update && \
1210
apt-get -qqy install \
@@ -17,16 +15,16 @@ RUN \
1715
git \
1816
gnupg \
1917
locales \
20-
python3=3.10.6-1~22.04.1 \
21-
python3-dev=3.10.6-1~22.04.1 \
22-
python3-pip=22.0.2+dfsg-1ubuntu0.5 \
23-
python3-venv=3.10.6-1~22.04.1 \
18+
python3.10 \
19+
python3.10-dev \
20+
python3.10-venv \
21+
python3-pip \
2422
supervisor \
2523
tzdata
2624
# For Google Cloud, look under https://packages.cloud.google.com/apt/dists/cloud-sdk/main/binary-amd64/Packages
2725
# https://cloud.google.com/storage/docs/gsutil_install
2826
# Copy the "Docker Tip" instructions from gsutil_install link and then pin the version
29-
RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key --keyring /usr/share/keyrings/cloud.google.gpg add - && apt-get update -y && apt-get install google-cloud-cli=451.0.1-0 -y
27+
RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key --keyring /usr/share/keyrings/cloud.google.gpg add - && apt-get update -y && apt-get install google-cloud-cli=526.0.1-0 -y
3028

3129

3230

0 commit comments

Comments
 (0)