certbot-dns-ovh: old DNS entries are not removed, leading to a renewal failure

[przemub]

certbot-dns-ovh: old DNS entries are not removed, leading to a renewal failure

[avocadio]

Same issue observed.

[bmw]

@adferrand, if and only if you have the time and interest to take a look at this, I'd appreciate you doing so. if not, I can probably start poking at it late next week.

I don't think we necessarily have to fix this now, but I think it'd be good to at least understand the problem to help us know how to prioritize it. I believe our ovh plugin code is trying to clean up after itself.

[bmw]

after looking at the attached log and https://github.com/AnalogJ/lexicon/blob/v3.17.0/src/lexicon/_private/providers/ovh.py, it doesn't seem to me that certbot is leaking any records at least on that run. that lexicon file contains a number of helpful logging messages and my read after searching the log for create_record and delete_record is certbot failed to create the first record and then tried to delete all records that would have been created on that run which is presumably a noop.

i think it'd be helpful to see a log, ideally from the latest version of certbot, that doesn't have this pattern. while certbot does not attempt to clean up records from prior runs (and I'm hesitant to make it try to as I think it could delete something the user didn't want us to), it does at least try to clean up all records it creates on the given run even if it crashes so seeing a log where that process fails would helpful.