<p>I have a Docker image which runs a python subprocess, which is a <code>node.js</code> server exposing an end point <code>/check</code>. The whole thing is put inside a Kubernetes pod and uses <code>/check</code> as the readinessProbe endpoint.</p>

<p>Now at some point, I want to close this endpoint or force-fail all the requests coming at it. Ideally, I want to do this via higher-level entities (i.e. Kubernetes lifecycle hooks) so as not to touch the lower-level implementation (such as opening a new endpoint /stop that switch some boolean flag and force the /check to fail)</p>

<p>Is that possible at all? If not, what is the best alternative?</p>

KeenSeeker99
<blockquote>
  <p>Is that possible at all? If not, what is the best alternative?</p>
</blockquote>

<p>I believe there are a few:</p>

<ul>
<li>remote address filtering</li>
<li>magic headers</li>
<li>a formal proxy container</li>
</ul>

<h3>remote address</h3>

<p>Requests to <code>/check</code> coming from kubernetes will come from the Node's SDN IP address (so if a Node's SDN subnet is <code>10.10.5.0/24</code>, then requests will come from 10.10.5.1), so you could permit the checks from the <code>.1</code> of the <code>/24</code> assigned to the Pod</p>

<h3>magic headers</h3>

<p>The <code>httpGet</code> <code>readinessProbe</code> allows <code>httpHeaders:</code> so you could turn on HTTP Basic auth for <code>/check</code> and then put the <code>- name: Authentication value: Basic xxyyzz==</code> in the <code>httpHeaders:</code></p>

<h3>a formal proxy container</h3>

<p>Add a 2nd container to the <code>Pod</code> that runs <code>haproxy</code> and filters <code>/check</code> requests to return 401 or 404 or whatever you want. Since all containers in a Pod share the same networking namespace, configuring <code>haproxy</code> to speak to your node.js server will be super trivial, and your <code>readinessProbe</code> (as well as <code>liveliness</code>) can continue to use the URL because only kubernetes will have access to it by using the non-haproxy container's <code>port</code>. To complete that loop, point the <code>Service</code> at the <code>haproxy</code> container's port.</p>
