{"action":"opened","issue":{"url":"https://api.github.com/repos/rook/rook/issues/1855","repository_url":"https://api.github.com/repos/rook/rook","labels_url":"https://api.github.com/repos/rook/rook/issues/1855/labels{/name}","comments_url":"https://api.github.com/repos/rook/rook/issues/1855/comments","events_url":"https://api.github.com/repos/rook/rook/issues/1855/events","html_url":"https://github.com/rook/rook/issues/1855","id":338807259,"node_id":"MDU6SXNzdWUzMzg4MDcyNTk=","number":1855,"title":"Support executing curl command for liveness probes in CockroachDB operator","user":{"login":"F21","id":2263040,"node_id":"MDQ6VXNlcjIyNjMwNDA=","avatar_url":"https://avatars0.githubusercontent.com/u/2263040?v=4","gravatar_id":"","url":"https://api.github.com/users/F21","html_url":"https://github.com/F21","followers_url":"https://api.github.com/users/F21/followers","following_url":"https://api.github.com/users/F21/following{/other_user}","gists_url":"https://api.github.com/users/F21/gists{/gist_id}","starred_url":"https://api.github.com/users/F21/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/F21/subscriptions","organizations_url":"https://api.github.com/users/F21/orgs","repos_url":"https://api.github.com/users/F21/repos","events_url":"https://api.github.com/users/F21/events{/privacy}","received_events_url":"https://api.github.com/users/F21/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-07-06T05:11:21Z","updated_at":"2018-07-06T05:11:21Z","closed_at":null,"author_association":"NONE","body":"**Is this a bug report or feature request?**\r\n* Feature Request\r\n\r\n**What should the feature do:**\r\nThe operator currently uses HTTP liveness probes to check service health. This works really great in a lot of setups. However, if you're using a service mesh such as Itsio with mutual TLS enabled, the liveness probes will fail. This is because all traffic in a pod will ingress or egress through the envoy proxy sidecar in the pod. Since all pods will have an envoy proxy sidecar and istio uses mutual TLS for communications between sidecars, liveness probes from the kubelet will fail due to the kubelet not having a valid TLS certificate issued by itsio. Support for this may be possible in istio in the future, but due to the complexity, it's unclear whether this will land anytime soon. \r\n\r\nA workaround would be to support health checks by executing curl within the pod. See: https://istio.io/help/faq/security/#k8s-health-checks\r\n\r\nIt's also possible to whitelist the 8080 port so that istio will not proxy traffic for that port over TLS, but since most operators do want everything secured when turning on mTLS, allowing cleartext traffic to the web interface over 8080 seems to be an adverse tradeoff.\r\n\r\n**What is use case behind this feature:**\r\nSupport for mTLS when using a service mesh such as istio.\r\n\r\n**Environment**:\r\nN/A"}}
{"actor":{"display_login":"F21"}}