hashicorp / hashicorp/vault-helm
Add "host" and "httpHeaders" keys to "livenessProbe"
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 898
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
**Is your feature request related to a problem? Please describe.**
My Vault deployment on Kubernetes has TLS enabled on all Pod replicas and Ingress. The certificate's CN is set to it's DNS name, with additional alternate name set to the service's internal DNS name. It's working just fine, except for the liveness probe.
I'm receiving the following error:
`Liveness probe failed: Get https://10.42.29.53:8200/v1/sys/health?standbyok=true: net/http: request canceled (Client.Timeout exceeded while awaiting headers)`
This is happening because the livenessProbe's default behaviour is to set the URL host to the Pod's IP address, which is not in the TLS certificate.
**Describe the solution you'd like**
The chart should offer the option to set the hostname manually in it's `livenessProbe` config key.
**Describe alternatives you've considered**
The `templates/server-statefulset.yaml` file only sets the `path`, `port` and `scheme` keys for the `livenessProbe.httpGet` object.
```
livenessProbe:
httpGet:
path: {{ .Values.server.livenessProbe.path | quote }}
port: 8200
scheme: {{ include "vault.scheme" . | upper }}
```
The `HTTPGetAction` Kubernetes object accepts other two parameter named `host` and `httpHeaders`. These should be included in the above template, as to allow alternative host addresses other than the Pod's IP. The code below has not been tested.
```
livenessProbe:
httpGet:
path: {{ .Values.server.livenessProbe.path | quote }}
port: 8200
scheme: {{ include "vault.scheme" . | upper }}
{{- if .Values.server.livenessProbe.host }}
host: {{ .Values.server.livenessProbe.host | quote }}
{{- end }}
{{- if .Values.server.livenessProbe.httpHeaders }}
httpHeaders:
{{- range .Values.server.livenessProbe.httpHeaders }}
- name: {{ .name }}
value: {{ .value }}
{{- end -}}
{{- end -}}
```
And the `values.yaml` file would support these parameters like this:
```
livenessProbe:
host: vaulthost.vault.corp
```
or
```
livenessProbe:
httpHeaders:
- name: host
value: vaulthost.vault.corp
```
Contributor guide
Assessment
This issue has not been assessed yet.