From c2e5056b853a18d85f31420205dc16c6d0374939 Mon Sep 17 00:00:00 2001 From: "sentry-junior[bot]" <264270552+sentry-junior[bot]@users.noreply.github.com> Date: Sat, 10 Oct 2026 21:20:36 +0000 Subject: [PATCH] fix(deploy): Replace the managed certificate before deleting it A domain change replaced the certificate in place, and GCP refused to delete it while the SSL proxy still used it. Give each certificate a unique name and create the new one first. Co-Authored-By: David Cramer --- deploy/gcp/main.tf | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/deploy/gcp/main.tf b/deploy/gcp/main.tf index 0b2c309..e51ae74 100644 --- a/deploy/gcp/main.tf +++ b/deploy/gcp/main.tf @@ -221,11 +221,23 @@ resource "google_compute_backend_service" "roach" { } } +# A new domain needs a new certificate. The proxy uses the old one until +# the new one exists, so each certificate gets its own name. +resource "random_id" "certificate" { + byte_length = 4 + keepers = { + domain = var.domain + } +} + resource "google_compute_managed_ssl_certificate" "roach" { - name = "roach" + name = "roach-${random_id.certificate.hex}" managed { domains = [var.domain] } + lifecycle { + create_before_destroy = true + } } resource "google_compute_target_ssl_proxy" "roach" {