Repository navigation
atenet: keep the router pod unready until its Envoy is serving - #2325
Tim Hockin (thockin) merged 1 commit into
Conversation
Greg Castle (destijl)
left a comment
Greg Castle (destijl)
left a comment
There was a problem hiding this comment.
gregbot: LGTM
gregbot nit: Separate follow-up observation for the agentgateway overlay: in manifests/ate-install/components/agentgateway/kustomization.yaml (lines 41-74), the atenet-router replacement container agentgateway declares port readiness (15021) but has no readinessProbe (unlike atenet-egress in the same file at lines 135-139, which probes /healthz/ready on readiness). Out of scope for this Envoy PR, but worth a follow-up if the agentgateway overlay is still maintained.
| t.Errorf("listener %q forwards to the admin API but its stat prefixes (listener %q, HCM %q) lack \"admin\", so envoyDrainer counts its connections and the drain may never reach zero", r.listener, r.listenerStatPrefix, r.hcmStatPrefix) | ||
| } | ||
| } | ||
| if !seen[m.requiredPath] { |
There was a problem hiding this comment.
gregbot nit: Now that TestEnvoyReadinessProbeAsksEnvoy requires /ready on every entry in envoyAdminManifests, the egressManifests[0] entry's requiredPath: "/ready" is redundant (and both manifests now have kubelet probes on /ready, so the // PodMonitoring vs // kubelet probes comments on envoyAdminManifests are slightly dated).
| if probe.HTTPGet.Path != "/ready" { | ||
| t.Errorf("the envoy readiness probe asks %q; it must ask Envoy's /ready", probe.HTTPGet.Path) | ||
| } | ||
| if probe.HTTPGet.Host != "" || probe.HTTPGet.Scheme == corev1.URISchemeHTTPS { |
There was a problem hiding this comment.
gregbot nit: Checking probe.HTTPGet.Scheme != "" && probe.HTTPGet.Scheme != corev1.URISchemeHTTP would reject any non-HTTP scheme value (e.g. lowercase https or a typo) rather than only exact "HTTPS".
This adds a readiness probe on the envoy container that asks Envoy's /ready through the envoy-metrics listener from #2310, and a manifest test that requires a probe kubelet can actually reach on both gateways.
Wihtout it a router pod can be Ready as soon as its atenet-router container answered /readyz, without checking if envoy is ready