fix: increase readiness probe timeouts and add separate health endpoint#1879
fix: increase readiness probe timeouts and add separate health endpoint#1879tommartensen wants to merge 3 commits into
Conversation
The default 1-second timeout was too aggressive for HTTPS probes, causing intermittent failures when TLS handshake or response time exceeded the limit. This resulted in frequent "TLS handshake error ... EOF" log messages and Unhealthy pod events. Effect: Eliminates most readiness probe timeouts and reduces log noise from kubelet probe connections, improving pod stability. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe infra-server adds a direct ChangesHealth endpoint and readiness configuration
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant Kubelet
participant infraServer
participant healthzHandler
Kubelet->>infraServer: GET /healthz
infraServer->>healthzHandler: Dispatch health check
healthzHandler-->>Kubelet: HTTP 200 OK
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Adds an explicit health check endpoint that bypasses authentication and canonical redirects. This is more robust than relying on User-Agent detection in wrapHealthCheck, which only works after the TLS handshake completes. Changes: - Add /healthz handler in server.go that always returns 200 OK - Update readiness probe to use /healthz instead of / - Increase probe periodSeconds from 5 to 10 to reduce probe frequency - Keep wrapHealthCheck for GCP load balancer health checks (GoogleHC) Effect: Eliminates authentication/redirect overhead from probe requests and provides a more explicit, maintainable health check mechanism. Combined with the increased timeout, this ensures reliable readiness detection without TLS handshake errors. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
A single node development cluster (infra-pr-1879) was allocated in production infra for this PR. CI will attempt to deploy 🔌 You can connect to this cluster with: 🛠️ And pull infractl from the deployed dev infra-server with: 🔓 You must go to to export an . Your token from the prod infra instance will not work with dev environments. 🚲 You can then use the dev infra instance e.g.: Further Development☕ If you make changes, you can commit and push and CI will take care of updating the development cluster. 🚀 If you only modify configuration (chart/infra-server/configuration) or templates (chart/infra-server/{static,templates}), you can get a faster update with: LogsLogs for the development infra depending on your @redhat.com authuser: Or: |
| s.oidc.Handle(routeMux) | ||
|
|
||
| // Dedicated health endpoint for Kubernetes readiness probes. | ||
| // Bypasses authentication and redirects to prevent probe timeouts. |
3 participants
Intended effect: Eliminate most readiness probe timeouts, reduces log noise from kubelet probe connections, improving pod stability.