recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix: roll out rotated traefik certificate secrets #29

Merged
autonomic-bot merged 1 commits from fix/traefik-certificate-rollout into main 2026-08-31 18:57:23 +00:00
Conversation 0 Commits 1 Files Changed 2
+55 -2
autonomic-bot commented 2026-08-31 18:57:16 +00:00
Owner
Copy Link
Copy Source

What changed

Makes Traefik redeploy its current recipe version when its active Swarm service still references an older immutable wildcard cert/key secret pair.

Why

The first production certificate was issued correctly, but a held-major Traefik recipe upgrade prevented the normal reconcile path from deploying the newly inserted certificate secrets. Certificate rotation must not be blocked by an unrelated image-major policy.

Evidence

  • Production Let’s Encrypt validated both SANs and issued the certificate.
  • The handoff copied the certificate and created the new versioned secrets, while the service still referenced the old v1 pair.
  • Added unit coverage for detecting whether an active service uses the desired secret pair; targeted pytest: 16 passed.
  • Targeted Ruff format/check and NixOS evaluation passed.
## What changed Makes Traefik redeploy its current recipe version when its active Swarm service still references an older immutable wildcard cert/key secret pair. ## Why The first production certificate was issued correctly, but a held-major Traefik recipe upgrade prevented the normal reconcile path from deploying the newly inserted certificate secrets. Certificate rotation must not be blocked by an unrelated image-major policy. ## Evidence - Production Let’s Encrypt validated both SANs and issued the certificate. - The handoff copied the certificate and created the new versioned secrets, while the service still referenced the old `v1` pair. - Added unit coverage for detecting whether an active service uses the desired secret pair; targeted pytest: 16 passed. - Targeted Ruff format/check and NixOS evaluation passed.
autonomic-bot added 1 commit 2026-08-31 18:57:16 +00:00
fix: roll out rotated traefik certificate secrets 611e16f62d
autonomic-bot merged commit 04e50c7c17 into main 2026-08-31 18:57:23 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci#29