Healthcheck fails when tls is enabled in the helm chart on v0.15.0 about node-feature-discovery HOT 4 CLOSED

@weikinhuang thanks for reporting this issue. The deprecated gRPC interface and TLS does not have too much coverage. Are you using the gRPC interface (with enableNodeFeatureApi: false in values.yaml)? If not, the TLS isn't really doing anything and you could just drop the tls.enable=true setting.

Nevertheless, this is an issue we need to fix as the K8s built-in gRPC liveness probe doesn't support TLS (afaiu) 🫤 Two options that immediately came to my mind:

1. Revert back to using grpc-health-probe (effectively reverting #1046) until gRPC support is dropped
2. Serve non-TLS gRPC endpoint on a different port, just for liveness probe purposes

/cc @ArangoGutierrez @fmuyassarov

from node-feature-discovery.

@marquiz I am not, I'm just using NFD as a operator with CRDs, most of everything else is the default values. In that case I'll leave the tls flag disabled then.

Thanks for the quick update.

from node-feature-discovery.

@weikinhuang thanks for reporting this issue. The deprecated gRPC interface and TLS does not have too much coverage. Are you using the gRPC interface (with enableNodeFeatureApi: false in values.yaml)? If not, the TLS isn't really doing anything and you could just drop the tls.enable=true setting.

Nevertheless, this is an issue we need to fix as the K8s built-in gRPC liveness probe doesn't support TLS (afaiu) 🫤 Two options that immediately came to my mind:

1. Revert back to using grpc-health-probe (effectively reverting Replace gRPC health probe utility with k8s built-in health probe #1046) until gRPC support is dropped
2. Serve non-TLS gRPC endpoint on a different port, just for liveness probe purposes

/cc @ArangoGutierrez @fmuyassarov

Ah sorry for that. I'm +1 for reverting the #1046 for the time being.

from node-feature-discovery.

@fmuyassarov I decided to try the other option, see #1535

from node-feature-discovery.