api: real actuator health probes + raise k8s startup budget#186
Merged
Conversation
The kubelet was marking the api Ready as soon as Tomcat bound port
8080, well before Flyway migrations, Hibernate metadata scan, Vault
Agent handshake and the OAuth2 Authorization Server had finished
initializing — in-flight requests could land on half-initialized
beans. Switch liveness/readiness to httpGet probes against
/actuator/health/{liveness,readiness} on the management port (8081),
which only report UP once AvailabilityState and all HealthIndicators
agree. A dedicated @order(0) SecurityFilterChain matching
EndpointRequest.toAnyEndpoint() permits unauthenticated access and
bypasses the HTTPS redirect that breaks plain-HTTP kubelet probes.
Startup budget bumped to 15 min (5s * 180) so slow cold boots aren't
crashlooped while startup optimisation lands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tcpSocketliveness/readiness withhttpGetagainst Spring Boot's/actuator/health/{liveness,readiness}on the management port (8081). Tomcat binding alone said nothing about Flyway, Hibernate, Vault, or the OAuth2 AS being ready — pods were going Ready while half-initialized.@Order(0)SecurityFilterChainmatchingEndpointRequest.toAnyEndpoint()that permits all and skips the HTTPS-redirect filter so the kubelet's plain-HTTP probes aren't 302'd.containerPort: 8081 name: managementand bumpstartupProbe.failureThresholdfrom 60 to 180 (5s × 180 = 15 min) so slow cold boots aren't crashlooped while startup-optimization work is still pending.Test plan
:services:api:testpasses (architecture tests pass locally; full suite needs the CI MariaDB).kubectl execinto a pod andcurl -fsS http://localhost:8081/actuator/health/livenessand/readinessreturn 200 with{"status":"UP"}.https://v2.esa-blueshell.nl/api/healthstill returns 200 (unchanged path on port 8080)./actuator/prometheusstill works.