Repository navigation
chore: Pin mc-iam-manager and mc-web-console 0.7.2, sync bundled config copies, automate Let's Encrypt renewal - #236
Merged
Merged
Conversation
Mode B issued the certificate once with standalone certbot and never renewed it, so installations stopped serving HTTPS after 90 days. The host certbot.timer and deploy hook described in README did not apply because the certificate lives in the container volume. - add conf/docker/scripts/renew-cert.sh: renew via certbot container (webroot while nginx is running, standalone otherwise), reload nginx, --install-cron registers /etc/cron.d/mcmp-cert-renew (twice daily) - installAll.sh -m prod registers the cron after issuance - mount the ACME webroot in docker-compose.cert.yaml - remove certbot-deploy-hook.sh and rewrite README renewal section
fix(cert): prod 모드 Let's Encrypt 인증서 갱신 보완
admin-cli 배포는 web api conf·메뉴 카탈로그·역할-메뉴 권한을 이 레포의 사본으로 마운트하므로, web·iam 변경을 사본에도 맞춘다. - conf/docker/conf/mc-web-console/api/conf/api.yaml: mc-iam-manager GetTemporaryCredentials(POST /api/workspaces/temporary-credentials), GetMyWorkspaceRoles(GET /api/users/me/workspace-roles) 추가 (mc-web-console 사용자 메뉴 CSP Credentials 기능이 사용) - webconsole_menu_resources.yaml: mc-web-console 카탈로그에 있는 cspdefinitions 추가 - conf/docker/conf/mc-iam-manager/permission.yaml: admin 역할에 cspdefinitions 추가
…-seed fix(conf): CSP 임시 자격 증명 API와 CSP Definitions 메뉴를 번들 설정 사본에 반영
- docker-compose.yaml, docker-compose.mini.yaml: mc-iam-manager, mc-web-console-api, mc-web-console-front 0.7.1 → 0.7.2 - api.yaml 3종(conf/, conf/docker/, conf/docker/conf/mc-web-console/api/conf/): mc-iam-manager, mc-web-console version 0.7.1 → 0.7.2
chore: mc-iam-manager, mc-web-console up to 0.7.2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's Changed
Pin mc-iam-manager and mc-web-console to 0.7.2
Apply the mc-iam-manager v0.7.2 and mc-web-console v0.7.2 releases.
docker-compose.yaml,docker-compose.mini.yaml:cloudbaristaorg/mc-iam-manager,mc-web-console-api,mc-web-console-front0.7.1 → 0.7.2conf/,conf/docker/,conf/docker/conf/mc-web-console/api/conf/):mc-iam-managerandmc-web-consoleversion 0.7.1 → 0.7.2Bundled config copies — CSP temporary credentials and the CSP Definitions menu
mc-admin-cli mounts its own copies of the web API
conf/(api.yaml, menu catalog) and of mc-iam-manager'spermission.yaml, so web/iam changes also need to be made in these copies.conf/docker/conf/mc-web-console/api/conf/api.yaml: add the mc-iam-manager service actionsGetTemporaryCredentials(POST /api/workspaces/temporary-credentials) andGetMyWorkspaceRoles(GET /api/users/me/workspace-roles), used by the mc-web-console user menu CSP Credentials (v0.7.2). Without them the feature does not work in an mc-admin-cli deploymentwebconsole_menu_resources.yaml: addcspdefinitions(Settings > Environment > Cloud SPs > CSP Definitions), which is in the mc-web-console menu catalogconf/docker/conf/mc-iam-manager/permission.yaml: grantcspdefinitionsto theadminroleforce=true, and restartmc-web-console-apiafter updating api.yamlCertificates — automatic Let's Encrypt renewal in prod mode (Mode B)
In a prod install the Let's Encrypt certificate was not renewed, so HTTPS expired after 90 days. The previous renewal steps did not match how the certificate is actually issued:
certbot.timer+ deploy hook) work on the host's/etc/letsencrypt, but the certificate is issued by the certbot container into the container volume (container-volume/mc-iam-manager/certs), so it was never renewed.docker execin the deploy hook cannot run inside the container eithercertonly --standalone, so the renewal config stayed standalone and renew failed while nginx held port 80. An earlier webroot change updated only the README and the hook, not the compose fileChanges:
conf/docker/scripts/renew-cert.sh: renews the certificate volume with the certbot container (webroot when nginx is running, standalone otherwise), then reloads nginx.--install-cronregisters/etc/cron.d/mcmp-cert-renew(twice a day, renews only within 30 days of expiry);installAll.sh -m prodregisters it right after the first issuedocker-compose.cert.yaml: mount the ACME webroot volumecertbot-deploy-hook.sh, which could not work with the container layout, and rewrite the renewal steps inREADME.md/README_kr.mdfor the actual volume layoutTested
Clean install on a dev VM with these changes:
./installAll.sh -m prodstarted 51 containers with none unhealthy, running mc-iam-manager and mc-web-console 0.7.2. After CB-Tumblebuginit.sh, an AWS Infra was created from the web console (Add Infra) and reached Running.