Early fail if LEGO_EMAIL is not overridden from the default value

[pgporada]

If LEGO_EMAIL is not overridden by a user from the default value of [email protected], there should be an early fail message to the user before even reaching out to Let's Encrypt. A valid email address allows the a Let's Encrypt subscriber to receive certificate expiry notifications which are crucial to the proper operation of an encrypted web :+1: . The default of [email protected] won't allow send the subscriber that email, hence the early fail message. Even in a subscribers staging environment, the expiry notification email is useful to experience and be aware of :+1: .

For more details on that, please see https://letsencrypt.org/docs/expiration-emails/

Significantly, [email protected] is the default value set in the kubernetes/charts repository located at https://github.com/kubernetes/charts/blob/master/stable/kube-lego/values.yaml.

[ankon]

Unless I'm missing something: LEGO_EMAIL is a required field, and kube-lego fails if it is not set (https://github.com/jetstack/kube-lego/blob/master/pkg/kubelego/kubelego.go#L224). It looks to me like the problem is in the helm chart itself, which provides a completely bogus value as a default (if it wanted to provide a default, then it should use an example.com domain, at least!). If the chart were not to provide any value, you'd get the behavior you're looking for: early failure.

[munnerz]

Yep, this is an issue with the Helm chart itself.

Now that Helm 2.3 is released, there is a new required keyword that we can use.

I've put in a PR here: https://github.com/kubernetes/charts/pull/912

[chepurko]

Quick question, if you initially deployed Kube-Lego and even received a few certificates for production sites with the default e-mail, can you update the address to your correct e-mail and then delete and redeploy the ConfigMap and Deployment?

Do you believe future renewals and certificate requests would continue without errors with the corrected e-mail?

Obviously I just realised I did this :sweat_smile: and now I'm coming here for consolation from hopefully finding out that my mistake wasn't fatal.