Expired SSL certificate for agones.dev

[abidon]

What happened:
Initially wanted to deploy Agones using the official Helm chart.
Also tried to visit agones.dev and got a certificate expiry alert on my browser

What you expected to happen:
To be able to retrieve the chart without a certificate
AND
To reach the site without an expired certificate

How to reproduce it (as minimally and precisely as possible):
Go to https://agones.dev with a web browser (I tried both Zen – a Firefox fork – and Safari)

[markmandel]

Again? 😬 @igooch can you update this ASAP!

[markmandel]

Sorry this happened @abidon - we're moving off of Google owned infra for this and many other reasons. It's a work in progress, but right now us maintainers don't have access to this infrastructure. Soon we will.

[markmandel]

@peterzhongyi if you are around and can take of this?

[markmandel]

I might write this up as a separate issue, but we really should automate this process. Having a manual process every three months clearly isn't tenable.

Since we're down anyway, I'd suggest enabling: https://docs.cloud.google.com/appengine/docs/standard/securing-custom-domains-with-ssl#upgrade_to_managed_ssl_certificates

To see if that will resolve the issue permanently. Previously I hadn't considered it because of our dynamic subdomains, but reading the documentation now (or noticing it for the first time?)

If you are using subdomains and the certificate is issued by Let's Encrypt, there is a limit of 50 managed certificates per week for each base domain. If you encounter the limit, App Engine keeps trying to issue managed certificates until all requests have been fulfilled.

We definitely have less than 50 subdomains.

At this point, it's at least worth a shot. Nothing to lose.

[markmandel]

If you need a workaround - the Google Cloud Storage Bucket that the helm chart repo points to is always available: https://storage.googleapis.com/agones-chart

(we should also document this as a backup just in case)

helm repo add agones https://storage.googleapis.com/agones-chart

Should work just fine.

[monitz87]

Hi, is there an alternative mirror for the docs?

[yan-vikng-dev]

Is this something external contributors can help with? I didn't see any relevant SSL IaC in the site directory, so I assume this was set up with manual GCP clicks? This can pretty easily be automated, i'd love to give a hand!

[abidon]

The Web Archive does the trick, it's just slow.

[markmandel]

Is this something external contributors can help with? I didn't see any relevant SSL IaC in the site directory, so I assume this was set up with manual GCP clicks? This can pretty easily be automated, i'd love to give a hand!

I wish. See #4304 -- unfortunately only Google FTEs have access to the Google Cloud project. This is one of the largest driving factors of migrating the project to the CNCF.

So unless a Google employee is working (and it's a long weekend), stuff can't get fixed.

[yan-vikng-dev]

I wish. See #4304 -- unfortunately only Google FTEs have access to the Google Cloud project. This is one of the largest driving factors of migrating the project to the CNCF.

So unless a Google employee is working (and it's a long weekend), stuff can't get fixed.

Keep up the good work rocket man. Im working on my first ever Agones based server, godspeed!

[Sivasankaran25]

@abidon Sorry for the delay. The certificate has been updated. The site is working now.

[igooch]

Apologies for the inconvenience. For some reason we stopped getting alerts that the certificates were expiring soon. @Sivasankaran25 will be looking into migrating over to a managed cert solution, so that we don't need to manually generated and upload certificates.

[peterzhongyi]

Unfortunately I didn't have the permission to run the command to re-generate the certificate, but I will also be looking the managed cert solution.

[peterzhongyi]

@markmandel if I follow https://docs.cloud.google.com/appengine/docs/standard/securing-custom-domains-with-ssl#upgrade_to_managed_ssl_certificates and change it to managed certificates, will you still not have access to it after it's migrated to CNCF?