hashicorp / hashicorp/vault-helm

Ability to configure readinessProbe and livenessProbe for vault agent injector

Open
#540 2 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

**Is your feature request related to a problem? Please describe.**

Currently running the generated manifest from helm through a tool like [kube-score](https://github.com/zegl/kube-score), results in the following error:

```
apps/v1/Deployment vault-agent-injector in my-namespace 💥
[CRITICAL] Pod Probes
· Container has the same readiness and liveness probe
Using the same probe for liveness and readiness is very likely
dangerous. Generally it's better to avoid the livenessProbe than
re-using the readinessProbe.
More information: https://github.com/zegl/kube-score/blob/master/README_PROBES.md
```

Given the `vault-agent-injector` is already running as PID 1, a better option for liveness check would be to rely on the default behaviour of k8s: Restart the container if the PID 1 has exited.

**Describe the solution you'd like**

Ability to configure the readiness and liveness probe. We could use a similar way of how things are supported for vault server:r:

```
# Used to define custom readinessProbe settings
readinessProbe:
enabled: true
# If you need to use a http path instead of the default exec
path: /v1/sys/health?standbyok=true

# When a probe fails, Kubernetes will try failureThreshold times before giving up
failureThreshold: 2
# Number of seconds after the container has started before probe initiates
initialDelaySeconds: 5
# How often (in seconds) to perform the probe
periodSeconds: 5
# Minimum consecutive successes for the probe to be considered successful after having failed
successThreshold: 1
# Number of seconds after which the probe times out.
timeoutSeconds: 3
# Used to enable a livenessProbe for the pods
livenessProbe:
enabled: false
path: "/v1/sys/health?standbyok=true"
# When a probe fails, Kubernetes will try failureThreshold times before giving up
failureThreshold: 2
# Number of seconds after the container has started before probe initiates
initialDelaySeconds: 60
# How often (in seconds) to perform the probe
periodSeconds: 5
# Minimum consecutive successes for the probe to be considered successful after having failed
successThreshold: 1
# Number of seconds after which the probe times out.
timeoutSeconds: 3
```

**Describe alternatives you've considered**

There are various recommendations from kube-score itself regarding the alternative solutions for the liveness probes in general: https://github.com/zegl/kube-score/blob/master/README_PROBES.md#livenessprobe

**Additional context**

No additional context, but can provide if something is required. Also, liveness and readiness probe can be similar in some situations and there isn't a exact need to follow kube-score recommendations. But if that's the case, I would like to understand the reasoning behind it.

Contributor guide

Open the contributing guide

Research direction

Start by locating the Helm values and generated vault-agent-injector Deployment manifest, then render the chart to inspect its current readinessProbe and livenessProbe settings. Add configurable probe values and verify that rendered manifests reflect enabled or disabled probes and their settings.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.