Use gRPC-based liveness probe instead of tetra status #2478
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✅ Deploy Preview for tetragon ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
tpapagian
force-pushed
the
pr/apapag/grpc_liveness
branch
from
658a99a to
513a5c1
Compare
tpapagian
added
the
release-note/misc
tpapagian
changed the title
7 tasks
There was a problem hiding this comment.
@lambdanis have we already started writing version specific upgrade guide? it might make sense to document this change, something like:
In v1.2 tetragon container uses the grpc liveness probe by default. To continue using "tetra status" for liveness probe,
specify tetragon.livenessProbe Helm value. For example:
tetragon:
livenessProbe:
timeoutSeconds: 60
exec:
command:
- tetra
- status
- --server-address
- "54321"
- --retries
- "5"
4f795cb to
5caad77
Compare
lambdanis
reviewed
May 29, 2024
tpapagian
force-pushed
the
pr/apapag/grpc_liveness
branch
from
5caad77 to
c693503
Compare
Now, we use tetra status command to report the status of tetragon agent. This comes with some overheads as tetra binary has a lot of additional functionality and it seems like an overkill to use that for status reporting. On the other hand, k8s supports liveness probes by using an gRPC endpoint (i.e. https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-grpc-liveness-probe). This patch first creates a dedicated gRPC server to report agent status that can be used for the liveness probe. Signed-off-by: Anastasios Papagiannis <[email protected]>
tpapagian
force-pushed
the
pr/apapag/grpc_liveness
branch
from
c693503 to
722cb5c
Compare
The previous commit introduced a gRPC server that can be used for
the liveness probe. This patch changes helm to make that default instead
of the tetra status based liveness probe.
The user can still use the tetra status based liveness probe by
defining a values file similar to:
tetragon:
livenessProbe:
timeoutSeconds: 60
exec:
command:
- tetra
- status
- --server-address
- "54321"
- --retries
- "5"
Signed-off-by: Anastasios Papagiannis <[email protected]>
tpapagian
force-pushed
the
pr/apapag/grpc_liveness
branch
from
722cb5c to
9ebe488
Compare
kkourt
approved these changes
May 29, 2024
lambdanis
approved these changes
May 29, 2024
This was referenced May 29, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Please ensure your pull request adheres to the following guidelines:
description and a
Fixes: #XXXline if the commit addresses a particularGitHub issue.
Now, we use tetra status command to report the status of tetragon agent. This comes with some overheads as tetra binary has a lot of additional functionality and it seems like an overkill to use that for status reporting.
On the other hand, k8s supports liveness probes by using an gRPC-based server. This first patch creates a new gRPC health server to report agent status. The second patch changes the helm chart to make use of that.