jetstack-secure
jetstack-secure copied to clipboard
No health endpoint
I was checking the chart against some linter type tools and found that the deployment doesn't have any liveness or readiness probes configured. Having a check in the codebase it seems that we have prometheus metrics but no health endpoint we can use to configure the relevant probes.
For example a tool such as polaris indicates that there should be check in place:
readinessProbeMissing 😬 Warning
Reliability - Readiness probe should be configured
cpuRequestsMissing 🎉 Success
Efficiency - CPU requests are set
linuxHardening 🎉 Success
Security - One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
livenessProbeMissing 😬 Warning
Reliability - Liveness probe should be configured
Generally this is best practice to have these configured. So looking for some guidance on the best way to try and implement this is?
The only options I can think right now is:
- To open up the prometheus metrics (off by default) and use that endpoint as the http endpoint to check for liveness etc
- Or use the
preflight agent infocommand to just return info, for example:
> kubectl exec -ti jetstack-agent-saas-748f8bb945-ljmmx -- preflight agent info
Preflight version: v0.1.39 linux/amd64
Commit: 1926f2d424cbea70491bec19e5bfb2cf6c5b1feb
Built: Tue, 25 Apr 2023 14:30:11 +0000
Go: go1.19 linux/amd64
OAuth2:
ClientID: k3TrDbfLhCgnpAbOiiT2kIE1AbovKzjo
AuthServerDomain: auth.jetstack.io
Looking for input from the team as to the prefered approach here so I can update the chart.
I've checked the latest (v0.1.20) of jsctl for any difference and this also doesn't have any checks in place:
jsctl clusters connect test_cluster --stdout | yq ea 'select(.kind == "Deployment")