Skip to content

feat: add readiness probe and read only root filesystem #2515

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
CarolinaRFerreira wants to merge 5 commits into
base: main
Choose a base branch
from
+46 −0
Open

feat: add readiness probe and read only root filesystem #2515

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
393e31a
feat: add readinessProbe field
CarolinaRFerreira Jul 1, 2026
430c60c
feat: add readOnlyRootFilesystem field
CarolinaRFerreira Jul 1, 2026
c2db960
chore: add readinessProbe to deployment
CarolinaRFerreira Jul 1, 2026
c3345f6
feat: add livenessProbe field
CarolinaRFerreira Jul 2, 2026
139cd83
chore: add livenessProbe to deployment
CarolinaRFerreira Jul 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions charts/network-observer/templates/_deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
secretName: {{ include "network-observer.basicAuthSecretName" . }}
{{- end }}
{{- end }}
- name: proxy-tmp
emptyDir: {}
{{- end -}}

{{- define "network-observer.nginxProxySpec" -}}
Expand Down Expand Up @@ -52,6 +54,8 @@ volumeMounts:
name: {{ include "network-observer.tlsSecretName" . }}
- mountPath: /etc/nginx
name: nginx-config
- mountPath: /tmp
name: proxy-tmp
{{- if eq .Values.auth.strategy "basic" }}
- mountPath: /etc/httpusers
name: nginx-htpasswd
Expand Down Expand Up @@ -90,4 +94,6 @@ volumeMounts:
name: {{ include "network-observer.tlsSecretName" . }}
- mountPath: /etc/session-secrets/
name: session-cookie-secret
- mountPath: /tmp
name: proxy-tmp
{{- end -}}
8 changes: 8 additions & 0 deletions charts/network-observer/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,14 @@ spec:
{{- end }}
containers:
- name: network-observer
{{- if .Values.livenessProbe.enabled }}
livenessProbe:
{{- omit .Values.livenessProbe "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.readinessProbe.enabled }}
readinessProbe:
{{- omit .Values.readinessProbe "enabled" | toYaml | nindent 12 }}
{{- end }}
Comment thread
CarolinaRFerreira marked this conversation as resolved.
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
{{- with .Values.securityContext }}
Expand Down
32 changes: 32 additions & 0 deletions charts/network-observer/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ prometheus:
pullPolicy: IfNotPresent
tag: "v3.11.3"
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop:
Expand Down Expand Up @@ -79,6 +80,7 @@ nginx:
tag: "1.31.0-alpine"
pullPolicy: IfNotPresent
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop:
Expand All @@ -90,6 +92,7 @@ openshiftOauthProxy:
tag: "4.22.0"
pullPolicy: IfNotPresent
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop:
Expand Down Expand Up @@ -218,9 +221,38 @@ podSecurityContext:

# network-observer container securityContext
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL

skipManagementLabels: false

## Controller containers' readiness probe
## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
readinessProbe:

@c-kruse c-kruse Jul 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@CarolinaRFerreira thank you for the pull request. I am curious if you had a plan for these probes already or have been able to test this change with enabled: true. As it stands, I do not believe the commented example: GET :9191/healthz would not work.

enabled: false
# httpGet:
# path: /healthz
# port: 9191
# scheme: HTTP
# failureThreshold: 3
# initialDelaySeconds: 60
# periodSeconds: 30
# successThreshold: 1
# timeoutSeconds: 30

## Default backend containers' liveness probe
## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
livenessProbe:
enabled: false
# httpGet:
# path: /healthz
# port: 9191
# scheme: HTTP
# failureThreshold: 3
# initialDelaySeconds: 60
# periodSeconds: 30
# successThreshold: 1
# timeoutSeconds: 30