ob status does not report a route domain that has no certificate

未关闭
  • 哪里不对？
#237 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
55/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
go
领域
cli, devops

调研方向

Start from the ob status certificate checks and proxy.CertExpiries, which the issue says currently reads only domain.main; trace how applied resolvers, ACME stores, and terminating route domains reach that code. Check route discovery output under /etc/traefik/dynamic if the existing route data is insufficient. Done when status reports missing or renewal-floor certificates for route domains, counts SAN and wildcard coverage, and avoids immediate divergence while issuance is pending.

由索引模型根据 Issue 内容生成。

描述

enhancement

What happens

ob status reports a healthy proxy when a terminating route's domain has no certificate from the resolver that should issue it. If the configured resolver never obtains a certificate for a domain (for example, the HTTP-01 challenge is blocked or the DNS-01 token is wrong), Traefik serves its default self-signed certificate for that domain. Status does not mention the domain at all.

Status only judges certificates that exist in the ACME stores. A domain with no renewable certificate does not appear there, so it raises no issue and does not set Diverged.

Before #236 this case was sometimes caught by accident. If a leftover resolver key still held an old certificate for the domain, that certificate was eventually flagged as overdue. Since #236, a leftover certificate is marked orphaned and never flagged, so nothing reports the missing one.

Expected

For each domain that a terminating route serves, status checks that a resolver in the applied static configuration holds a certificate for it in the store it writes, and that the certificate is outside the renewal floor. A route domain with no such certificate is reported as an issue, and status diverges. Wildcard routes are covered by a matching wildcard certificate from the wildcard resolver.

Notes

  • The route domains come from the application's routes, which status already knows, or from the discovery controller's output in /etc/traefik/dynamic.
  • A certificate's SANs should count as well as domain.main. proxy.CertExpiries currently extracts only domain.main, so a domain covered only through a SAN would be reported as missing.
  • A route whose certificate is still being issued right after its first deploy should not report divergence immediately. A short grace period, or reporting it as pending, avoids a false alarm.

Reproduce

  1. Deploy an application with a terminating route for a domain whose ACME challenge cannot succeed, for example a domain whose DNS does not point at the host.
  2. Wait for Traefik's issuance attempt to fail. The domain then serves Traefik's default certificate.
  3. Run ob status. It reports the proxy as in sync and exits zero.
主要语言
Go
星标
4
派生
0
平均合并
36 分钟
30 天内合并 PR
13

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

labstack/onebox 的其他 Issue

查看 labstack/onebox 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。