Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AGIC health probe on containerPort #1653

Open
Lyonsupernova opened this issue Oct 17, 2024 · 0 comments
Open

AGIC health probe on containerPort #1653

Lyonsupernova opened this issue Oct 17, 2024 · 0 comments

Comments

@Lyonsupernova
Copy link

Lyonsupernova commented Oct 17, 2024

Describe the bug
A clear and concise description of what the bug is.

According to the doc https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-add-health-probes

By default, the Application Gateway Ingress Controller (AGIC) provisions an HTTP GET probe for exposed Azure Kubernetes Service (AKS) pods. You can customize the probe properties by adding a [readiness or liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/) to your deployment or pod specification.

From my understanding, the AGIC health probe take precedence AGIC custom Annotations > Readiness Probe > Liveness Probe > AGIC default health probe (fallback)

For our case, we are not using any AGIC annotations, and our application (kestrel server) is listening on port 8443, while the AGIC health probe won't use Readiness probe or liveness probe unless the containerPort matches 8443.

From the k8s docs: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#ports See known issue posts: kubernetes/kubernetes#108255

Before the docs mentioned, the k8s container port is more like informational but this is misleading -
Quoting

- When using a Service with a targetPort that references a name in the ports arrays of the pod.
- Some software (ab)uses this API to get which ports are used (See https://github.com/kubernetes/kubernetes/issues/108131 Although unfixable, my goal is to fix the documentation so other people don't have the same problem). The Azure Load Balancer implementation does this for instance.
- Some other network/security software might use this information.

From this issue: #987.
AGIC is using containerPort when filtering container from pods. Would like to add to the AGIC docs mentioning about the containerPort needs to match the port on application server is listening on to make sure the readiness/liveness probe work.

To Reproduce
Steps to reproduce the behavior:

  1. Application listens port on 8443
  2. Set ContainerPort w/ 8443 or w/o using i.e: 443
  3. Go to Azure Portal AGW Health Probes
  4. The fallback to readiness probe works only when containerPort matches application ports listen on.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant