Stop rotating docker TLS CA on update - #3803
Closed
ntner wants to merge 2 commits into
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the feature/update/fix?
Fix: Preserve Docker TLS Certificates Across Rack Updates
The rack's internal Docker TLS certificate authority is now preserved across rack version updates. Certificates are regenerated only when the stored certificate is missing, unreadable, or close to expiry, so across version updates the rack API and the Docker daemons on rack instances continue to trust the same certificate authority.
With this change, commands that reach an instance's Docker daemon, such as
convox runandconvox exec, keep working on every instance immediately after a rack update, with no instance replacement needed.How to use it?
The fix is automatic. Update your rack:
No configuration or parameter changes are required.
Does it have a breaking change?
No breaking changes. Certificate validity and the TLS configuration between the rack API and instance Docker daemons are unchanged; the difference is that updates preserve the existing certificates instead of reissuing them.
Requirements
To receive this fix, you must update to rack version
20260714094620or newer.convox rackconvox rack update