jetstack-secure icon indicating copy to clipboard operation
jetstack-secure copied to clipboard

No health endpoint

Open hawksight opened this issue 2 years ago • 0 comments

I was checking the chart against some linter type tools and found that the deployment doesn't have any liveness or readiness probes configured. Having a check in the codebase it seems that we have prometheus metrics but no health endpoint we can use to configure the relevant probes.

For example a tool such as polaris indicates that there should be check in place:

    readinessProbeMissing                😬 Warning
        Reliability - Readiness probe should be configured
    cpuRequestsMissing                   🎉 Success
        Efficiency - CPU requests are set
    linuxHardening                       🎉 Success
        Security - One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
    livenessProbeMissing                 😬 Warning
        Reliability - Liveness probe should be configured

Generally this is best practice to have these configured. So looking for some guidance on the best way to try and implement this is?

The only options I can think right now is:

  1. To open up the prometheus metrics (off by default) and use that endpoint as the http endpoint to check for liveness etc
  2. Or use the preflight agent info command to just return info, for example:
> kubectl exec -ti jetstack-agent-saas-748f8bb945-ljmmx -- preflight agent info                       
Preflight version:  v0.1.39 linux/amd64
  Commit:  1926f2d424cbea70491bec19e5bfb2cf6c5b1feb
  Built:   Tue, 25 Apr 2023 14:30:11 +0000
  Go:      go1.19 linux/amd64

OAuth2: 
  ClientID:          k3TrDbfLhCgnpAbOiiT2kIE1AbovKzjo
  AuthServerDomain:  auth.jetstack.io

Looking for input from the team as to the prefered approach here so I can update the chart. I've checked the latest (v0.1.20) of jsctl for any difference and this also doesn't have any checks in place:

jsctl clusters connect test_cluster --stdout | yq ea 'select(.kind == "Deployment")

hawksight avatar May 12 '23 16:05 hawksight