Health Checking of Istio Services
Kubernetes liveness and readiness probes6 describes several ways to configure liveness and readiness probes including:
The command approach works with Istio regardless of whether or not mutual TLS is enabled.
The HTTP request approach, on the other hand, requires special Istio configuration when mutual TLS is enabled.
This is because the health check requests to the liveness-http
service are sent by Kubelet,
which does not have an Istio issued certificate. Therefore when mutual TLS is enabled,
the health check requests will fail.
Istio solves this problem by rewriting the application PodSpec
readiness/liveness probe,
so that the probe request is sent to the sidecar agent7.
The sidecar agent then redirects the request to the application, strips the response body, only returning the response code.
This feature is enabled by default in all built-in Istio configuration profiles8 but can be disabled as described below.
Liveness and readiness probes using the command approach
Istio provides a liveness sample9 that implements this approach. To demonstrate it working with mutual TLS enabled, first create a namespace for the example:
To configure strict mutual TLS, run:
Next, run the following command to deploy the sample service:
To confirm that the liveness probes are working, check the status of the sample pod to verify that it is running.
Liveness and readiness probes using the HTTP request approach
As stated previously, Istio uses probe rewrite to implement HTTP probes by default. You can disable this feature either for specific pods, or globally.
Disable the HTTP probe rewrite for a pod
You can annotate the pod10 with sidecar.istio.io/rewriteAppHTTPProbers: "false"
to disable the probe rewrite option. Make sure you add the annotation to the
pod resource11 because it will be ignored
anywhere else (for example, on an enclosing deployment resource).
This approach allows you to disable the health check probe rewrite gradually on individual deployments, without reinstalling Istio.
Disable the probe rewrite globally
Install Istio12 using --set values.sidecarInjectorWebhook.rewriteAppHTTPProbe=false
to disable the probe rewrite globally. Alternatively, update the configuration map for the Istio sidecar injector:
Cleanup
Remove the namespace used for the examples: