Update Helm chart version and modify probes to use exec for readiness and liveness checks

charts/aptly/Chart.yaml

@@ -5,7 +5,7 @@ description: >-
   an nginx read/auth sidecar, a fully aptly-native values API, and declarative
   repo/mirror/publish state reconciled via a Helm hook.
 type: application
-version: 0.2.0
+version: 0.2.1
 appVersion: "1.6.3-1"
 home: https://git.morlana.online/f.weber/aptly-containerized
 sources:
@@ -32,11 +32,5 @@ annotations:
     fingerprint: FC35C0FAA26605C4C21C7BBFBF43884145E5AA94
     url: https://git.morlana.online/f.weber/aptly-containerized/raw/branch/main/pubkeys/chart-signing.asc
   artifacthub.io/changes: |
-    - kind: added
-      description: Configurable ServiceAccount (serviceAccount.create/name/annotations/automountServiceAccountToken), defaulting to a dedicated ServiceAccount per release.
-    - kind: added
-      description: Configurable internal container ports (ports.aptly/nginx/metrics).
     - kind: fixed
-      description: nginx and aptly no longer both listen on port 8080 inside the same pod, which made nginx fail to start with "address already in use". nginx now defaults to 8081 internally; external service.port is unchanged.
-    - kind: changed
-      description: Chart releases are now triggered by publishing a Gitea Release (instead of a bare tag push), so pre-releases can be flagged for ArtifactHub.
+      description: The aptly container's startup/readiness/liveness probes now exec curl against 127.0.0.1 instead of using httpGet. httpGet probes are dialed by kubelet against the pod IP, not localhost — since aptly listens on 127.0.0.1 only (by design, see proxy.enabled), that connection was always refused, leaving the pod stuck failing its startup probe forever despite aptly actually being healthy.

charts/aptly/templates/statefulset.yaml

@@ -180,17 +180,23 @@ spec:
             {{- with .Values.extraVolumeMounts }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
+          # exec, not httpGet: aptly listens on 127.0.0.1 only (see
+          # aptly.apiListen) when proxy.enabled=true, but kubelet's httpGet
+          # probes connect to the POD IP, not localhost — that dials a
+          # loopback-only listener from outside and gets "connection
+          # refused". exec runs curl inside this container's own netns,
+          # where 127.0.0.1 is correct in either proxy mode.
           startupProbe:
-            httpGet: { path: /api/ready, port: aptly }
+            exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/ready"] }
             periodSeconds: {{ .Values.probes.startup.periodSeconds }}
             failureThreshold: {{ .Values.probes.startup.failureThreshold }}
           readinessProbe:
-            httpGet: { path: /api/ready, port: aptly }
+            exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/ready"] }
             periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
             timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
             failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
           livenessProbe:
-            httpGet: { path: /api/healthy, port: aptly }
+            exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/healthy"] }
             periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
             timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
             failureThreshold: {{ .Values.probes.liveness.failureThreshold }}