Repository navigation
Resend gateway config before re-registering services - #4388
Open
vitostrokov wants to merge 1 commit into
Open
vitostrokov wants to merge 1 commit into
vitostrokov wants to merge 1 commit into
Conversation
The running gateway replica pipeline re-registers services after a gateway loses its state, e.g. when the gateway is reinstalled, but it never resends the global config. Certificates for the re-registered services are then requested from certbot's default ACME server instead of the configured one (staging, or an EAB CA). Only a server restart resent the config, through init_gateways. Submit the config before any service registration. The call is idempotent and happens only on ticks that register services. If it fails, skip the sync until the next tick rather than issue a certificate from the wrong server. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4385
When a gateway loses its state, for example after a Kubernetes gateway container restarts on a
fresh filesystem, the running-replica sync registers its services again but never resends the
global config. certbot then requests their certificates from its default ACME server instead of
DSTACK_ACME_SERVER, without the EAB credentials.The sync now calls
submit_gateway_config()before registering services, only on ticks thatregister something. If the call fails, the tick skips the sync and retries on the next one,
rather than request a certificate from the wrong server.
Testing:
uv run pytest src/tests/_internal/server/background/pipeline_tasks/test_gateway_replicas.py:74 passed, 74 skipped (the skipped ones are the Postgres variants, run with
--runpostgres).test_registers_new_service_and_replicanow checks that the config is submitted beforeregister_service.test_no_gateway_calls_when_state_already_in_syncnow checks that no config is submittedwhen there is nothing to register.
test_skips_registration_if_gateway_config_not_submittedcovers the failure path.uv run ruff checkanduv run ruff format --checkon the changed files: clean.🤖 Generated with Claude Code