Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detect health check steal #2731

Open
Razz4780 opened this issue Sep 4, 2024 · 0 comments
Open

Detect health check steal #2731

Razz4780 opened this issue Sep 4, 2024 · 0 comments
Labels
enhancement New feature or request ux

Comments

@Razz4780
Copy link
Contributor

Razz4780 commented Sep 4, 2024

We can:

  1. Read health checks config after target resource is fetched.
  2. Check if it will be possible for the app to steal health checks (e.g incoming config does not exclude health checks port and no http filter is used) and warn the user (warning should be dismissable from the IDE). This should help most new users, who don't use advanced configuration.
  3. At runtime, detect when the app subscribes to health check port without an HTTP filter and issue a warning from within the intproxy. This should help us when reading logs.

Based on k8s docs, we can have exec, httpGet, tcpSocket and grpc probes:

  1. exec probes we should probably ignore, because the command can do anything
  2. tcpSocket probes can definitely be ignored, because the connection will always be accepted (either by target container or by the agent)
  3. httpGet - we have to check port+headers+path against steal configuration
  4. grpc - we can infer the path from configured service name and compare port+path against steal configuration
  5. We should inspect both liveness and readiness probes
@Razz4780 Razz4780 added enhancement New feature or request ux labels Sep 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request ux
Projects
None yet
Development

No branches or pull requests

1 participant