chore(helm): disable liveness probes by default, allow all probe settings#21789
Conversation
Signed-off-by: Danny Kopping <danny@coder.com>
Documentation CheckUpdates Needed
RecommendationAdd a new subsection explaining probe configuration best practices, including:
Automated review via Coder Tasks |
Signed-off-by: Danny Kopping <danny@coder.com>
| - Both the control plane and workspaces set resource request/limits by | ||
| default. | ||
|
|
||
| 7. **All Kubernetes objects must define liveness and readiness probes** |
There was a problem hiding this comment.
It was pretty odd to include this under "Security" recommendations in the first place; removing.
There was a problem hiding this comment.
@ericpaulsen I know we're going deep into the archives on this one, but do you remember why this was in the list of security requirements?
There was a problem hiding this comment.
@dannykopping @spikecurtis i wrote this K8s security reference directly in line with K8s requirements customers were providing us, i.e. #7 was a specific ask on if our helm chart provided liveness & readiness probe config. though this may be more relevant for a K8s resiliency doc instead of a security one.
either way, that's the context.
There was a problem hiding this comment.
Cool thanks @ericpaulsen 👍 since they're still provided (but liveness is disabled by default) I think that still satisfies the ask.
| - Both the control plane and workspaces set resource request/limits by | ||
| default. | ||
|
|
||
| 7. **All Kubernetes objects must define liveness and readiness probes** |
There was a problem hiding this comment.
@ericpaulsen I know we're going deep into the archives on this one, but do you remember why this was in the list of security requirements?
3 participants
Liveness checks are currently causing pods to be killed during long-running migrations.
They are generally not advisable for our workloads; if a pod becomes unresponsive we need to know about it (due to a deadlock, etc) and not paper over the issue by killing the pod.
I've also made all probe settings configurable.