falcosecurity / charts

Community managed Helm charts for running Falco with Kubernetes
Apache License 2.0
243 stars 288 forks source link

Use redis-cli ping command instead of tcp socket to attest readiness of the redis-stack:7.2.0-v11 #732

Closed damienvergnaud closed 1 month ago

damienvergnaud commented 2 months ago

Concerned lines : https://github.com/falcosecurity/charts/blob/46516b090cc91d4c89630b91c393cf15e37ddac5/charts/falcosidekick/templates/deployment-ui.yaml#L211C1-L218C32

Based on : https://stackoverflow.com/questions/64068179/readiness-probe-for-redis-with-large-dataset

Because if i observe logs of one starting pod :

│ 9:C 28 Aug 2024 13:58:53.127 * oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo                                                                                                                                    │
... REMOVED LINES ...   
│ 9:M 28 Aug 2024 13:59:56.320 * Ready to accept connections tcp                                                                                                                                                  │

In some cases, the others falco pods may think the service is ready to receive calls, which is not the case.

Correction that supposedly work (I verified the presence of redis-cli ping command inside the container). It only respond "PONG" when redis is really READY to receive calls.

 readinessProbe:
  exec:
    command:
    - redis-cli
    - ping
  initialDelaySeconds: 20
  timeoutSeconds: 5
  periodSeconds: 3

Hope it helps ;)

This proposal has been made during my working time at WeScale company ;)

Issif commented 1 month ago

This is a good proposal, I'll test that solution

Issif commented 1 month ago

Done with #740