mirror of
https://github.com/suitenumerique/docs.git
synced 2026-09-10 19:57:54 +02:00
✨(yhub) add custom probes more efficient
The probes used before was using the only one public available endpoint. This endpoint is the jwks endpoint but it is not an appropriated one. For the readyness we check that it is possible to connect to postgres and to redis. for the liveness we made a ping pong just checking the http connection.
This commit is contained in:
Manuel Raynaud
+69
-69
@@ -339,75 +339,75 @@
|
||||
|
||||
### yhub
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------ |
|
||||
| `yhub.enabled` | Enable the yhub collaboration server, its service and its init-db job | `true` |
|
||||
| `yhub.image.repository` | Repository to use to pull the yhub container image | `lasuite/impress-yhub` |
|
||||
| `yhub.image.tag` | yhub container tag | `latest` |
|
||||
| `yhub.image.pullPolicy` | yhub container image pull policy | `IfNotPresent` |
|
||||
| `yhub.command` | Override the yhub container command | `[]` |
|
||||
| `yhub.args` | Override the yhub container args | `[]` |
|
||||
| `yhub.replicas` | Amount of yhub replicas | `3` |
|
||||
| `yhub.shareProcessNamespace` | Enable share process namespace between containers | `false` |
|
||||
| `yhub.sidecars` | Add sidecars containers to yhub deployment | `[]` |
|
||||
| `yhub.terminationGracePeriodSeconds` | Grace period given to a yhub pod to drain before it is killed | `60` |
|
||||
| `yhub.securityContext.allowPrivilegeEscalation` | Whether to allow privilege escalation for the yhub container | `false` |
|
||||
| `yhub.securityContext.capabilities.drop` | List of capabilities to drop for the yhub container | `["ALL"]` |
|
||||
| `yhub.securityContext.runAsNonRoot` | Whether to run the yhub container as a non-root user | `true` |
|
||||
| `yhub.securityContext.runAsUser` | User the yhub container runs as | `1000` |
|
||||
| `yhub.securityContext.runAsGroup` | Group the yhub container runs as | `1000` |
|
||||
| `yhub.securityContext.seccompProfile.type` | Seccomp profile type for the yhub container | `RuntimeDefault` |
|
||||
| `yhub.envVars` | Configure yhub container environment variables | `undefined` |
|
||||
| `yhub.envVars.REDIS` | Required, redis/valkey url holding the live document state (e.g. redis://valkey:6379/0) | |
|
||||
| `yhub.envVars.POSTGRES` | Required, url of the yhub database, created by the init-db job (e.g. postgres://user:pass@postgres:5432/yhub) | |
|
||||
| `yhub.envVars.REDIS_PREFIX` | Namespace of the redis keys, when the instance is shared (default: yhub) | |
|
||||
| `yhub.envVars.COLLABORATION_BACKEND_BASE_URL` | Base url of the Docs backend, which yhub asks about users and document access rights | |
|
||||
| `yhub.envVars.COLLABORATION_SERVER_ORIGIN` | Comma separated list of the origins allowed to open a websocket | |
|
||||
| `yhub.envVars.YHUB_JWT_PRIVATE_KEY_FILE` | Path to the RSA private key (PEM) yhub signs its calls to the backend with, mounted from a secret | |
|
||||
| `yhub.envVars.SOFT_MIGRATION` | Set to "true" to seed rooms from the legacy Django/S3 document store on first access | |
|
||||
| `yhub.envVars.BY_VALUE` | Example environment variable by setting value directly | |
|
||||
| `yhub.envVars.FROM_CONFIGMAP.configMapKeyRef.name` | Name of a ConfigMap when configuring env vars from a ConfigMap | |
|
||||
| `yhub.envVars.FROM_CONFIGMAP.configMapKeyRef.key` | Key within a ConfigMap when configuring env vars from a ConfigMap | |
|
||||
| `yhub.envVars.FROM_SECRET.secretKeyRef.name` | Name of a Secret when configuring env vars from a Secret | |
|
||||
| `yhub.envVars.FROM_SECRET.secretKeyRef.key` | Key within a Secret when configuring env vars from a Secret | |
|
||||
| `yhub.podAnnotations` | Annotations to add to the yhub Pod | `{}` |
|
||||
| `yhub.dpAnnotations` | Annotations to add to the yhub Deployment | `{}` |
|
||||
| `yhub.initDbJobAnnotations` | Annotations for the yhub init-db job | `{}` |
|
||||
| `yhub.jobs.ttlSecondsAfterFinished` | Period to wait before removing the init-db job | `30` |
|
||||
| `yhub.jobs.backoffLimit` | Numbers of init-db job retries | `2` |
|
||||
| `yhub.initDb.enabled` | Run the job creating and upgrading the yhub schema | `true` |
|
||||
| `yhub.initDb.command` | Override the command creating and upgrading the yhub schema | `[]` |
|
||||
| `yhub.initDb.retries` | How many times the schema script is retried while the postgres server does not answer | `60` |
|
||||
| `yhub.initDb.retryDelaySeconds` | Seconds between two attempts | `5` |
|
||||
| `yhub.initDb.restartPolicy` | Restart policy of the init-db job | `Never` |
|
||||
| `yhub.service.type` | yhub Service type | `ClusterIP` |
|
||||
| `yhub.service.port` | yhub Service listening port | `443` |
|
||||
| `yhub.service.targetPort` | yhub container listening port | `3002` |
|
||||
| `yhub.service.annotations` | Annotations to add to the yhub Service | `{}` |
|
||||
| `yhub.probes.liveness.path` | Configure path for yhub HTTP liveness probe | `/collaboration/jwks/v1` |
|
||||
| `yhub.probes.liveness.initialDelaySeconds` | Configure initial delay for yhub liveness probe | `10` |
|
||||
| `yhub.probes.readiness.path` | Configure path for yhub HTTP readiness probe | `/collaboration/jwks/v1` |
|
||||
| `yhub.probes.readiness.initialDelaySeconds` | Configure initial delay for yhub readiness probe | `5` |
|
||||
| `yhub.probes.liveness.targetPort` | Configure port for yhub HTTP liveness probe | |
|
||||
| `yhub.probes.liveness.timeoutSeconds` | Configure timeout for yhub liveness probe | |
|
||||
| `yhub.probes.readiness.targetPort` | Configure port for yhub HTTP readiness probe | |
|
||||
| `yhub.probes.readiness.timeoutSeconds` | Configure timeout for yhub readiness probe | |
|
||||
| `yhub.probes.startup.path` | Configure path for yhub HTTP startup probe | |
|
||||
| `yhub.probes.startup.targetPort` | Configure port for yhub HTTP startup probe | |
|
||||
| `yhub.probes.startup.initialDelaySeconds` | Configure initial delay for yhub startup probe | |
|
||||
| `yhub.probes.startup.timeoutSeconds` | Configure timeout for yhub startup probe | |
|
||||
| `yhub.resources` | Resource requirements for the yhub container | `{}` |
|
||||
| `yhub.nodeSelector` | Node selector for the yhub Pod | `{}` |
|
||||
| `yhub.tolerations` | Tolerations for the yhub Pod | `[]` |
|
||||
| `yhub.affinity` | Affinity for the yhub Pod | `{}` |
|
||||
| `yhub.persistence` | Additional volumes to create and mount on the yhub. Used for debugging purposes | `{}` |
|
||||
| `yhub.persistence.volume-name.size` | Size of the additional volume | |
|
||||
| `yhub.persistence.volume-name.type` | Type of the additional volume, persistentVolumeClaim or emptyDir | |
|
||||
| `yhub.persistence.volume-name.mountPath` | Path where the volume should be mounted to | |
|
||||
| `yhub.extraVolumeMounts` | Additional volumes to mount on the yhub. Mounted on the init-db job too | `[]` |
|
||||
| `yhub.extraVolumes` | Additional volumes to mount on the yhub. Mounted on the init-db job too | `[]` |
|
||||
| `yhub.pdb.enabled` | Enable pdb on yhub | `true` |
|
||||
| `yhub.serviceAccountName` | Optional service account name to use for yhub pods | `nil` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------- |
|
||||
| `yhub.enabled` | Enable the yhub collaboration server, its service and its init-db job | `true` |
|
||||
| `yhub.image.repository` | Repository to use to pull the yhub container image | `lasuite/impress-yhub` |
|
||||
| `yhub.image.tag` | yhub container tag | `latest` |
|
||||
| `yhub.image.pullPolicy` | yhub container image pull policy | `IfNotPresent` |
|
||||
| `yhub.command` | Override the yhub container command | `[]` |
|
||||
| `yhub.args` | Override the yhub container args | `[]` |
|
||||
| `yhub.replicas` | Amount of yhub replicas | `3` |
|
||||
| `yhub.shareProcessNamespace` | Enable share process namespace between containers | `false` |
|
||||
| `yhub.sidecars` | Add sidecars containers to yhub deployment | `[]` |
|
||||
| `yhub.terminationGracePeriodSeconds` | Grace period given to a yhub pod to drain before it is killed | `60` |
|
||||
| `yhub.securityContext.allowPrivilegeEscalation` | Whether to allow privilege escalation for the yhub container | `false` |
|
||||
| `yhub.securityContext.capabilities.drop` | List of capabilities to drop for the yhub container | `["ALL"]` |
|
||||
| `yhub.securityContext.runAsNonRoot` | Whether to run the yhub container as a non-root user | `true` |
|
||||
| `yhub.securityContext.runAsUser` | User the yhub container runs as | `1000` |
|
||||
| `yhub.securityContext.runAsGroup` | Group the yhub container runs as | `1000` |
|
||||
| `yhub.securityContext.seccompProfile.type` | Seccomp profile type for the yhub container | `RuntimeDefault` |
|
||||
| `yhub.envVars` | Configure yhub container environment variables | `undefined` |
|
||||
| `yhub.envVars.REDIS` | Required, redis/valkey url holding the live document state (e.g. redis://valkey:6379/0) | |
|
||||
| `yhub.envVars.POSTGRES` | Required, url of the yhub database, created by the init-db job (e.g. postgres://user:pass@postgres:5432/yhub) | |
|
||||
| `yhub.envVars.REDIS_PREFIX` | Namespace of the redis keys, when the instance is shared (default: yhub) | |
|
||||
| `yhub.envVars.COLLABORATION_BACKEND_BASE_URL` | Base url of the Docs backend, which yhub asks about users and document access rights | |
|
||||
| `yhub.envVars.COLLABORATION_SERVER_ORIGIN` | Comma separated list of the origins allowed to open a websocket | |
|
||||
| `yhub.envVars.YHUB_JWT_PRIVATE_KEY_FILE` | Path to the RSA private key (PEM) yhub signs its calls to the backend with, mounted from a secret | |
|
||||
| `yhub.envVars.SOFT_MIGRATION` | Set to "true" to seed rooms from the legacy Django/S3 document store on first access | |
|
||||
| `yhub.envVars.BY_VALUE` | Example environment variable by setting value directly | |
|
||||
| `yhub.envVars.FROM_CONFIGMAP.configMapKeyRef.name` | Name of a ConfigMap when configuring env vars from a ConfigMap | |
|
||||
| `yhub.envVars.FROM_CONFIGMAP.configMapKeyRef.key` | Key within a ConfigMap when configuring env vars from a ConfigMap | |
|
||||
| `yhub.envVars.FROM_SECRET.secretKeyRef.name` | Name of a Secret when configuring env vars from a Secret | |
|
||||
| `yhub.envVars.FROM_SECRET.secretKeyRef.key` | Key within a Secret when configuring env vars from a Secret | |
|
||||
| `yhub.podAnnotations` | Annotations to add to the yhub Pod | `{}` |
|
||||
| `yhub.dpAnnotations` | Annotations to add to the yhub Deployment | `{}` |
|
||||
| `yhub.initDbJobAnnotations` | Annotations for the yhub init-db job | `{}` |
|
||||
| `yhub.jobs.ttlSecondsAfterFinished` | Period to wait before removing the init-db job | `30` |
|
||||
| `yhub.jobs.backoffLimit` | Numbers of init-db job retries | `2` |
|
||||
| `yhub.initDb.enabled` | Run the job creating and upgrading the yhub schema | `true` |
|
||||
| `yhub.initDb.command` | Override the command creating and upgrading the yhub schema | `[]` |
|
||||
| `yhub.initDb.retries` | How many times the schema script is retried while the postgres server does not answer | `60` |
|
||||
| `yhub.initDb.retryDelaySeconds` | Seconds between two attempts | `5` |
|
||||
| `yhub.initDb.restartPolicy` | Restart policy of the init-db job | `Never` |
|
||||
| `yhub.service.type` | yhub Service type | `ClusterIP` |
|
||||
| `yhub.service.port` | yhub Service listening port | `443` |
|
||||
| `yhub.service.targetPort` | yhub container listening port | `3002` |
|
||||
| `yhub.service.annotations` | Annotations to add to the yhub Service | `{}` |
|
||||
| `yhub.probes.liveness.path` | Configure path for yhub HTTP liveness probe | `/collaboration/ping/v1` |
|
||||
| `yhub.probes.liveness.initialDelaySeconds` | Configure initial delay for yhub liveness probe | `10` |
|
||||
| `yhub.probes.liveness.timeoutSeconds` | Configure timeout for yhub liveness probe | `2` |
|
||||
| `yhub.probes.readiness.path` | Configure path for yhub HTTP readiness probe | `/collaboration/ready/v1` |
|
||||
| `yhub.probes.readiness.initialDelaySeconds` | Configure initial delay for yhub readiness probe | `5` |
|
||||
| `yhub.probes.readiness.timeoutSeconds` | Configure timeout for yhub readiness probe | `3` |
|
||||
| `yhub.probes.liveness.targetPort` | Configure port for yhub HTTP liveness probe | |
|
||||
| `yhub.probes.readiness.targetPort` | Configure port for yhub HTTP readiness probe | |
|
||||
| `yhub.probes.startup.path` | Configure path for yhub HTTP startup probe | |
|
||||
| `yhub.probes.startup.targetPort` | Configure port for yhub HTTP startup probe | |
|
||||
| `yhub.probes.startup.initialDelaySeconds` | Configure initial delay for yhub startup probe | |
|
||||
| `yhub.probes.startup.timeoutSeconds` | Configure timeout for yhub startup probe | |
|
||||
| `yhub.resources` | Resource requirements for the yhub container | `{}` |
|
||||
| `yhub.nodeSelector` | Node selector for the yhub Pod | `{}` |
|
||||
| `yhub.tolerations` | Tolerations for the yhub Pod | `[]` |
|
||||
| `yhub.affinity` | Affinity for the yhub Pod | `{}` |
|
||||
| `yhub.persistence` | Additional volumes to create and mount on the yhub. Used for debugging purposes | `{}` |
|
||||
| `yhub.persistence.volume-name.size` | Size of the additional volume | |
|
||||
| `yhub.persistence.volume-name.type` | Type of the additional volume, persistentVolumeClaim or emptyDir | |
|
||||
| `yhub.persistence.volume-name.mountPath` | Path where the volume should be mounted to | |
|
||||
| `yhub.extraVolumeMounts` | Additional volumes to mount on the yhub. Mounted on the init-db job too | `[]` |
|
||||
| `yhub.extraVolumes` | Additional volumes to mount on the yhub. Mounted on the init-db job too | `[]` |
|
||||
| `yhub.pdb.enabled` | Enable pdb on yhub | `true` |
|
||||
| `yhub.serviceAccountName` | Optional service account name to use for yhub pods | `nil` |
|
||||
|
||||
### docSpec
|
||||
|
||||
|
||||
@@ -1036,27 +1036,38 @@ yhub:
|
||||
|
||||
## @param yhub.probes.liveness.path Configure path for yhub HTTP liveness probe
|
||||
## @param yhub.probes.liveness.initialDelaySeconds Configure initial delay for yhub liveness probe
|
||||
## @param yhub.probes.liveness.timeoutSeconds Configure timeout for yhub liveness probe
|
||||
## @param yhub.probes.readiness.path Configure path for yhub HTTP readiness probe
|
||||
## @param yhub.probes.readiness.initialDelaySeconds Configure initial delay for yhub readiness probe
|
||||
## @param yhub.probes.readiness.timeoutSeconds Configure timeout for yhub readiness probe
|
||||
## @extra yhub.probes.liveness.targetPort Configure port for yhub HTTP liveness probe
|
||||
## @extra yhub.probes.liveness.timeoutSeconds Configure timeout for yhub liveness probe
|
||||
## @extra yhub.probes.readiness.targetPort Configure port for yhub HTTP readiness probe
|
||||
## @extra yhub.probes.readiness.timeoutSeconds Configure timeout for yhub readiness probe
|
||||
## @extra yhub.probes.startup.path Configure path for yhub HTTP startup probe
|
||||
## @extra yhub.probes.startup.targetPort Configure port for yhub HTTP startup probe
|
||||
## @extra yhub.probes.startup.initialDelaySeconds Configure initial delay for yhub startup probe
|
||||
## @extra yhub.probes.startup.timeoutSeconds Configure timeout for yhub startup probe
|
||||
##
|
||||
## The JWKS route is the only one yhub serves unauthenticated: it answers 200
|
||||
## with the public keys it signs its calls to the backend with (an empty set
|
||||
## when no key is configured), and reads neither redis nor postgres.
|
||||
## Two routes yhub serves unauthenticated, and they answer different
|
||||
## questions on purpose:
|
||||
##
|
||||
## - `ping` returns 200 without touching anything. Being answered at all is
|
||||
## the proof the http channel and the event loop are alive, which is as far
|
||||
## as a liveness probe should ever go: restarting a server over a store it
|
||||
## does not reach would drop the websockets it is happily serving.
|
||||
## - `ready` asks postgres and redis whether they answer, and returns 503
|
||||
## when either does not. That takes the pod out of the service endpoints
|
||||
## and leaves its siblings serving, which is what readiness is for. Its
|
||||
## timeout is above the two seconds the server itself gives each store, so
|
||||
## an unreachable one is reported rather than cut off.
|
||||
probes:
|
||||
liveness:
|
||||
path: /collaboration/jwks/v1
|
||||
path: /collaboration/ping/v1
|
||||
initialDelaySeconds: 10
|
||||
timeoutSeconds: 2
|
||||
readiness:
|
||||
path: /collaboration/jwks/v1
|
||||
path: /collaboration/ready/v1
|
||||
initialDelaySeconds: 5
|
||||
timeoutSeconds: 3
|
||||
|
||||
## @param yhub.resources Resource requirements for the yhub container
|
||||
resources: {}
|
||||
|
||||
Reference in New Issue
Block a user