upgrade go to 1.16 and add SAN to all certs #2164

cindy52 · 2021-06-30T22:45:42Z

What type of PR is this?

Uncomment only one /kind <> line, press enter to put that in a new line, and remove leading whitespace from that line:

/kind breaking
/kind bug

kind cleanup

/kind documentation
/kind feature
/kind hotfix

What this PR does / Why we need it:
Upgrade go version to the latest (1.16.5). Go 1.15 no longer supports Common Name based certs for HTTPS without a specific flag. This PR includes adding SAN for all related certs and updating the doc to create a cert with SAN for allocation service.

Which issue(s) this PR fixes:

Closes #1899
Closes #2024

Special notes for your reviewer:

google-oss-robot · 2021-06-30T22:45:54Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cindy52
To complete the pull request process, please assign markmandel after the PR has been reviewed.
You can assign the PR to them by writing /assign @markmandel in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

agones-bot · 2021-06-30T23:01:56Z

Build Failed 😱

Build Id: 4b8add07-128a-4281-9ba5-63be47798dfd

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

agones-bot · 2021-06-30T23:26:03Z

Build Failed 😱

Build Id: ac121d3f-3218-4904-b111-1dc2c272131d

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

markmandel · 2021-06-30T23:47:14Z

In case you didn't see it:

docker run -e FILE="/go/src/agones.dev/agones/site/content/en/docs/Reference/agones_crd_api_reference.html" -e VERSION=1.16.0 --rm -i -v /workspace/build//.config/gcloud:/root/.config/gcloud -v ~/.kube/:/root/.kube -v ~/.config/helm:/root/.config/helm -v ~/.cache/helm:/root/.cache/helm -v /workspace:/go/src/agones.dev/agones -v /workspace/build//.gomod:/go/pkg/mod -v /workspace/build//.gocache:/root/.cache/go-build agones-build:d2646eda2f bash -c "/go/src/agones.dev/agones/site/gen-api-docs.sh"
using go proxy as a workaround for git.agache.org being down: http://proxy.golang.org
includes/website.mk:100: recipe for target 'test-gen-api-docs' failed
make[1]: Leaving directory '/workspace/build'

That seems weird actually, I'm not sure what is going on there. Can you repro locally?

Usually that means need to run gen-api-docs, but I don't see a diff issue there 🤔

agones-bot · 2021-06-30T23:54:10Z

Build Failed 😱

Build Id: 3f0d8eef-b354-4133-afcd-af4424753e61

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

cindy52 · 2021-06-30T23:56:48Z

In case you didn't see it:

docker run -e FILE="/go/src/agones.dev/agones/site/content/en/docs/Reference/agones_crd_api_reference.html" -e VERSION=1.16.0 --rm -i -v /workspace/build//.config/gcloud:/root/.config/gcloud -v ~/.kube/:/root/.kube -v ~/.config/helm:/root/.config/helm -v ~/.cache/helm:/root/.cache/helm -v /workspace:/go/src/agones.dev/agones -v /workspace/build//.gomod:/go/pkg/mod -v /workspace/build//.gocache:/root/.cache/go-build agones-build:d2646eda2f bash -c "/go/src/agones.dev/agones/site/gen-api-docs.sh"
using go proxy as a workaround for git.agache.org being down: http://proxy.golang.org
includes/website.mk:100: recipe for target 'test-gen-api-docs' failed
make[1]: Leaving directory '/workspace/build'

That seems weird actually, I'm not sure what is going on there. Can you repro locally?

Usually that means need to run gen-api-docs, but I don't see a diff issue there 🤔

It's weird. Every time it fails with different errors. Last time I checked it failed with build-agones-sdk-image-windows....

agones-bot · 2021-07-01T00:44:35Z

Build Failed 😱

Build Id: 574b18ab-e747-42ba-9a79-32d3fde4a737

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

agones-bot · 2021-07-01T01:12:49Z

Build Failed 😱

Build Id: 0d083f87-d263-4d52-a4ae-5cceee0d1851

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

agones-bot · 2021-07-01T01:30:52Z

Build Failed 😱

Build Id: f9c47a63-572f-4398-a422-8f156df8c66e

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

cindy52 · 2021-07-01T05:57:28Z

gen-api-docs currently failed because In Go 1.16, module-aware commands report an error after discovering a problem in go.mod or go.sum instead of attempting to fix the problem automatically. The related issue can be found here golang/go#44529. I tried to fix it as suggested by changing the replacement and add -mod=mod with go build in gen-api-docs.sh file. The build was successfully after that but I'm getting an error type invalid type has kind=Unsupported which is unhandled when generating the api doc. Found some related issues here kubeflow/website#1899. Looks like there is not a known fix yet.

agones-bot · 2021-07-01T06:02:50Z

Build Failed 😱

Build Id: 99e980ce-b586-48cb-b346-ecd224b2b136

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

markmandel · 2021-07-01T19:42:53Z

install/helm/agones/certs/cert.sh

@@ -4,7 +4,7 @@ echo "Generating certs..."
 echo "Email should be: emailAddress=agones-discuss@googlegroups.com"
 echo "Common Name should be: agones-controller-service.agones-system.svc"
 openssl genrsa -out server.key 2048
-openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
+openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650 -addext 'subjectAltName=DNS:agones-controller-service.agones-system.svc'


Aaah. That's how you do it!

markmandel · 2021-07-01T19:56:40Z

Total shot in the dark, but this is the library we use:
https://github.com/ahmetb/gen-crd-api-reference-docs

I see a similar issue here: ahmetb/gen-crd-api-reference-docs#10

Also wondering if an upgrade helps? 🤷🏻

cindy52 · 2021-07-01T19:59:45Z

Total shot in the dark, but this is the library we use:
https://github.com/ahmetb/gen-crd-api-reference-docs

I see a similar issue here: ahmetb/gen-crd-api-reference-docs#10

Also wondering if an upgrade helps? 🤷🏻

I tried upgrading to the latest but still got the same err..

markmandel · 2021-07-01T21:30:57Z

Digging into how other people fixed this on their end, looks like they found a solution here: https://github.com/knative/docs/pull/2054/files

But the author does work here at Google (he's on my team 😄 ) we could always go bug him and see what he knows.

It makes me feel like we're missing a reference to something somewhere.

cindy52 · 2021-07-01T21:42:15Z

Digging into how other people fixed this on their end, looks like they found a solution here: https://github.com/knative/docs/pull/2054/files

But the author does work here at Google (he's on my team 😄 ) we could always go bug him and see what he knows.

It makes me feel like we're missing a reference to something somewhere.

I saw it yesterday and even looks into his error logs in the issue: ahmetb/gen-crd-api-reference-docs#10. I believe the cause is different. For knative issue, it turns out some of the import paths are github.com instead of knative.dev, it shows in the error log he attached. I turned on detailed log as well and all import paths are agones.dev. It shows in the details of the failed build.

markmandel · 2021-07-28T19:30:23Z

Should we close this PR for now?

cindy52 · 2021-07-28T20:12:58Z

Should we close this PR for now?

Done!

google-cla bot added the cla: yes label Jun 30, 2021

google-oss-robot added the size/L label Jun 30, 2021

google-oss-robot requested review from cyriltovena and EricFortin June 30, 2021 22:45

upgrade go to 1.16 and add SAN to all certs

7a3f021

markmandel reviewed Jul 1, 2021

View reviewed changes

cindy52 mentioned this pull request Jul 1, 2021

Can't run gen-api-docs with Go 1.16 #2168

Closed

roberthbailey added the feature-freeze-do-not-merge Only eligible to be merged once we are out of feature freeze (next full release) label Jul 13, 2021

roberthbailey removed the feature-freeze-do-not-merge Only eligible to be merged once we are out of feature freeze (next full release) label Jul 20, 2021

cindy52 closed this Jul 28, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

upgrade go to 1.16 and add SAN to all certs #2164

upgrade go to 1.16 and add SAN to all certs #2164

cindy52 commented Jun 30, 2021 •

edited

Loading

google-oss-robot commented Jun 30, 2021

agones-bot commented Jun 30, 2021

agones-bot commented Jun 30, 2021

markmandel commented Jun 30, 2021

agones-bot commented Jun 30, 2021

cindy52 commented Jun 30, 2021

agones-bot commented Jul 1, 2021

agones-bot commented Jul 1, 2021

agones-bot commented Jul 1, 2021

cindy52 commented Jul 1, 2021

agones-bot commented Jul 1, 2021

markmandel Jul 1, 2021

markmandel commented Jul 1, 2021

cindy52 commented Jul 1, 2021

markmandel commented Jul 1, 2021

cindy52 commented Jul 1, 2021

markmandel commented Jul 28, 2021

cindy52 commented Jul 28, 2021

upgrade go to 1.16 and add SAN to all certs #2164

upgrade go to 1.16 and add SAN to all certs #2164

Conversation

cindy52 commented Jun 30, 2021 • edited Loading

google-oss-robot commented Jun 30, 2021

agones-bot commented Jun 30, 2021

agones-bot commented Jun 30, 2021

markmandel commented Jun 30, 2021

agones-bot commented Jun 30, 2021

cindy52 commented Jun 30, 2021

agones-bot commented Jul 1, 2021

agones-bot commented Jul 1, 2021

agones-bot commented Jul 1, 2021

cindy52 commented Jul 1, 2021

agones-bot commented Jul 1, 2021

markmandel Jul 1, 2021

Choose a reason for hiding this comment

markmandel commented Jul 1, 2021

cindy52 commented Jul 1, 2021

markmandel commented Jul 1, 2021

cindy52 commented Jul 1, 2021

markmandel commented Jul 28, 2021

cindy52 commented Jul 28, 2021

cindy52 commented Jun 30, 2021 •

edited

Loading