Update Helm chart version and modify probes to use exec for readiness and liveness checks

2026-08-13 12:30:17 +02:00
parent 1675ea9a4e
commit a08ed898e8
2 changed files with 11 additions and 11 deletions
@@ -180,17 +180,23 @@ spec:
            {{- with .Values.extraVolumeMounts }}
            {{- toYaml . | nindent 12 }}
            {{- end }}
+          # exec, not httpGet: aptly listens on 127.0.0.1 only (see
+          # aptly.apiListen) when proxy.enabled=true, but kubelet's httpGet
+          # probes connect to the POD IP, not localhost — that dials a
+          # loopback-only listener from outside and gets "connection
+          # refused". exec runs curl inside this container's own netns,
+          # where 127.0.0.1 is correct in either proxy mode.
          startupProbe:
-            httpGet: { path: /api/ready, port: aptly }
+            exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/ready"] }
            periodSeconds: {{ .Values.probes.startup.periodSeconds }}
            failureThreshold: {{ .Values.probes.startup.failureThreshold }}
          readinessProbe:
-            httpGet: { path: /api/ready, port: aptly }
+            exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/ready"] }
            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
          livenessProbe:
-            httpGet: { path: /api/healthy, port: aptly }
+            exec: { command: ["curl", "-fsS", "http://127.0.0.1:{{ .Values.ports.aptly }}/api/healthy"] }
            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}