Passbolt server cannot start with Istio injection enabled

[SmartGuyy]

Recently tried to enable istio sidecar injection for my Passbolt pods, unfortunately one specific behavior is blocking us from using Istio-proxy's sidecar and Passbolt :

• The initContainer "passbolt-depl-srv-init" tries to connect to the MariaDB database
• Since the Istio sidecar (which handles traffic routing within the Istio service mesh) is not yet running, the traffic from the initContainer does not go through the Istio service mesh.

As a result, the initContainer's attempts to connect to MariaDB and fails

Proposition :

• remove that init container to check the DB connection
• replace it by a readiness probe that actually verify connection to mariaDB since in any case, Passbolt shouldn't be able to handle any traffic if its DB is unreachable.

[Tecnobutrul]

Thanks for the contribution @SmartGuyy. To solve this issue, we are thinking about creating a toggle to disable the init container, so when you install the helm chart or on any upgrade it won't prevent the passbolt container to start up. Since we already have a readiness probe that checks the execution of passbolt healthcheck, the passbolt container won't receive traffic until the app is up and running. Do you think this solution would work for your environment?

[SmartGuyy]

@Tecnobutrul thanks for your fast reply. Indeed i think this solution would work

[Tecnobutrul]

Great! This is going to be included on the next release which will be out very soon.

[SmartGuyy]

Thanks ! :+1: