From a08ed898e8f19a18f7885741d3fa5cf25c2bb817 Mon Sep 17 00:00:00 2001 From: Florian Weber Date: Thu, 13 Aug 2026 12:30:17 +0200 Subject: [PATCH] Update Helm chart version and modify probes to use exec for readiness and liveness checks --- charts/aptly/Chart.yaml | 10 ++-------- charts/aptly/templates/statefulset.yaml | 12 +++++++++--- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/charts/aptly/Chart.yaml b/charts/aptly/Chart.yaml index 7602665..337d145 100644 --- a/charts/aptly/Chart.yaml +++ b/charts/aptly/Chart.yaml @@ -5,7 +5,7 @@ description: >- an nginx read/auth sidecar, a fully aptly-native values API, and declarative repo/mirror/publish state reconciled via a Helm hook. type: application -version: 0.2.0 +version: 0.2.1 appVersion: "1.6.3-1" home: https://git.morlana.online/f.weber/aptly-containerized sources: @@ -32,11 +32,5 @@ annotations: fingerprint: FC35C0FAA26605C4C21C7BBFBF43884145E5AA94 url: https://git.morlana.online/f.weber/aptly-containerized/raw/branch/main/pubkeys/chart-signing.asc artifacthub.io/changes: | - - kind: added - description: Configurable ServiceAccount (serviceAccount.create/name/annotations/automountServiceAccountToken), defaulting to a dedicated ServiceAccount per release. - - kind: added - description: Configurable internal container ports (ports.aptly/nginx/metrics). - kind: fixed - description: nginx and aptly no longer both listen on port 8080 inside the same pod, which made nginx fail to start with "address already in use". nginx now defaults to 8081 internally; external service.port is unchanged. - - kind: changed - description: Chart releases are now triggered by publishing a Gitea Release (instead of a bare tag push), so pre-releases can be flagged for ArtifactHub. + description: The aptly container's startup/readiness/liveness probes now exec curl against 127.0.0.1 instead of using httpGet. httpGet probes are dialed by kubelet against the pod IP, not localhost — since aptly listens on 127.0.0.1 only (by design, see proxy.enabled), that connection was always refused, leaving the pod stuck failing its startup probe forever despite aptly actually being healthy. diff --git a/charts/aptly/templates/statefulset.yaml b/charts/aptly/templates/statefulset.yaml index e17534e..18aff79 100644 --- a/charts/aptly/templates/statefulset.yaml +++ b/charts/aptly/templates/statefulset.yaml @@ -180,17 +180,23 @@ spec: {{- with .Values.extraVolumeMounts }} {{- toYaml . | nindent 12 }} {{- end }} + # exec, not httpGet: aptly listens on 127.0.0.1 only (see + # aptly.apiListen) when proxy.enabled=true, but kubelet's httpGet + # probes connect to the POD IP, not localhost — that dials a + # loopback-only listener from outside and gets "connection + # refused". exec runs curl inside this container's own netns, + # where 127.0.0.1 is correct in either proxy mode. startupProbe: - httpGet: { path: /api/ready, port: aptly } + exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/ready"] } periodSeconds: {{ .Values.probes.startup.periodSeconds }} failureThreshold: {{ .Values.probes.startup.failureThreshold }} readinessProbe: - httpGet: { path: /api/ready, port: aptly } + exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/ready"] } periodSeconds: {{ .Values.probes.readiness.periodSeconds }} timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }} failureThreshold: {{ .Values.probes.readiness.failureThreshold }} livenessProbe: - httpGet: { path: /api/healthy, port: aptly } + exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/healthy"] } periodSeconds: {{ .Values.probes.liveness.periodSeconds }} timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }} failureThreshold: {{ .Values.probes.liveness.failureThreshold }}