sigstore / fulcio

Sigstore OIDC PKI
Apache License 2.0
646 stars 137 forks source link

`/healthz` probe fails in Proxy-Enabled Environment #1704

Closed osmman closed 3 months ago

osmman commented 3 months ago

Description

The /healthz probe fails to function correctly in environments where a proxy is enabled. The issue stems from the probe using the 0.0.0.0 address to test gRPC readiness. This address cannot be effectively filtered using the NO_PROXY setting, resulting in readiness requests to gRPC being routed through the proxy. Consequently, these requests fail because the external proxy attempts to access 127.0.0.1.

HTTP_PROXY="http://x.x.x.x:3128"
HTTPS_PROXY="http://x.x.x.x:3128"
NO_PROXY=".cluster.local,.svc,.us-east-2.compute.internal,10.0.0.0/16,10.128.0.0/14,127.0.0.1,169.254.169.254,172.30.0.0/16,localhost"

Expected Behavior: The /healthz probe should successfully check the readiness of gRPC services without routing the requests through the proxy. The probe should use an address that can be filtered via the NO_PROXY setting.

Version 1.4.5