Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve support for Kubernetes probes when server listening on localhost #2002

Closed
tsandall opened this issue Jan 14, 2020 · 0 comments · Fixed by #2385
Closed

Improve support for Kubernetes probes when server listening on localhost #2002

tsandall opened this issue Jan 14, 2020 · 0 comments · Fixed by #2385
Assignees
@patrick-east

Comments

@tsandall
Copy link
Member

If the OPA HTTP server is only listening on localhost the kubelet cannot execute HTTP health checks against the Health API. You can reproduce this problem simply by deploying OPA with --addr=127.0.0.1:8181. If you enable liveness and readiness probes the pod will fail to start because the kubelet can't connect to the HTTP server.

The current workaround is to tell OPA to bind on 0.0.0.0 instead of localhost.

There are a couple ways this could be addressed:

  • Add support for serving the Health API on another address/port
  • Add a subcommand into the OPA binary to execute a health check (then the kubelet can use execProbe)
@patrick-east patrick-east self-assigned this Apr 13, 2020
@patrick-east patrick-east mentioned this issue May 7, 2020
Merged
patrick-east added a commit to patrick-east/opa that referenced this issue May 12, 2020
@patrick-east
server: Add param for diagnostic address binding
9c85eff 
This adds a new config option for the OPA server (along with plumbing
from `opa run` downward to the server) to configure separate
diagnostic addresses to listen on. These will only be configured to
serve the /metrics and /health.

This will allow for more secure OPA deployments with the normal "data"
or "policies" API's made to be only accessible on localhost.

Fixes: open-policy-agent#2002
Signed-off-by: Patrick East <east.patrick@gmail.com>
patrick-east added a commit that referenced this issue May 13, 2020
@patrick-east
server: Add param for diagnostic address binding
8b5cbfa 
This adds a new config option for the OPA server (along with plumbing
from `opa run` downward to the server) to configure separate
diagnostic addresses to listen on. These will only be configured to
serve the /metrics and /health.

This will allow for more secure OPA deployments with the normal "data"
or "policies" API's made to be only accessible on localhost.

Fixes: #2002
Signed-off-by: Patrick East <east.patrick@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@patrick-east patrick-east

Labels
None yet
Projects
Open Policy Agent
Archived in project
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add --diagnostic-addr for server patrick-east/opa
2 participants
@tsandall @patrick-east