[Feature] Auth on Healthcheck path?

[crsnt]

Hi, new Kong user here. I'm wondering if down the track, we can specify some kind of auth for upstream healthcheck for apps that have protected healthcheck endpoints.

Thanks.

[mayocream]

Hi @crsnt,

In my opinion, K8s pod liveness probe and consul discovery support setting custom HTTP headers for health checks.
Kong can also support that feature.

Kong's health check library do support setting HTTP header for probes, ref: Kong/lua-resty-healthcheck#54.
But Kong doesn't support it in its schema yet:

kong/kong/db/schema/entities/upstreams.lua

Lines 87 to 123 in 8514843

	local healthchecks_config = {
	active = {
	type = "http",
	timeout = 1,
	concurrency = 10,
	http_path = "/",
	https_sni = NO_DEFAULT,
	https_verify_certificate = true,
	healthy = {
	interval = 0, -- 0 = probing disabled by default
	http_statuses = { 200, 302 },
	successes = 0, -- 0 = disabled by default
	},
	unhealthy = {
	interval = 0, -- 0 = probing disabled by default
	http_statuses = { 429, 404,
	500, 501, 502, 503, 504, 505 },
	tcp_failures = 0, -- 0 = disabled by default
	timeouts = 0, -- 0 = disabled by default
	http_failures = 0, -- 0 = disabled by default
	},
	},
	passive = {
	type = "http",
	healthy = {
	http_statuses = { 200, 201, 202, 203, 204, 205, 206, 207, 208, 226,
	300, 301, 302, 303, 304, 305, 306, 307, 308 },
	successes = 0,
	},
	unhealthy = {
	http_statuses = { 429, 500, 503 },
	tcp_failures = 0, -- 0 = circuit-breaker disabled by default
	timeouts = 0, -- 0 = circuit-breaker disabled by default
	http_failures = 0, -- 0 = circuit-breaker disabled by default
	},
	},
	}

Can you elaborate on your use cases?