After encrypting (mTLS ) a ServiceMesh control plane applications Liveness health check does not work
Issue
-
After encrypting
spec.security.dataPlane.mtlstotruein theServiceMeshControlPlaneapplications that are using liveness health check don not work because the probe needs to be an HTTPS probe. -
Pods with HTTPS health check enabled starts restarting unnecessarily
Liveness probe failed: Get "http://10.x.10.1:8080/health" read tcp 10.x.x.1:46672->10.x.11.1:8080: read: connection reset by peer -
The
istio-proxylogs show the following when the probes fail:info cache generated new workload certificate latency=407.377705ms ttl=23h59m59.570232648s info cache returned delayed workload certificate from cache ttl=23h59m59.570112338s info sds SDS: PUSH resource=default info sds SDS: PUSH resource=ROOTCA info sds SDS: PUSH resource=ROOTCA error Prober does not exists url /app-health/productpage/livez error Prober does not exists url /app-health/productpage/livez error Prober does not exists url /app-health/productpage/livez error Prober does not exists url /app-health/productpage/livez error Prober does not exists url /app-health/productpage/livez error Prober does not exists url /app-health/productpage/livez
Environment
- Red Hat OpenShift Container Platform
- 4.7.x
- Red Hat OpenShift Service Mesh
- v2.0.7.1
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.