This topic describes the symptoms, cause, and solution for failed or invalid health checks after sidecar injection.
Symptoms
After sidecar injection, health checks may fail or become invalid. This topic uses a TCP health check on port 8087 as an example. After you enable mTLS, no health check information for port 8087 is displayed on the Events tab of the pod details page in the Container Service for Kubernetes (ACK) console.
Cause
After you enable mTLS in Service Mesh, the sidecar intercepts health check requests from the kubelet to the pod. The health check fails because the kubelet does not have a corresponding TLS certificate.
Solution
To resolve this issue, configure traffic on the health check port to bypass the sidecar proxy.
Bypass health check traffic
-
Log on to the ASM console.
-
In the left-side navigation pane, choose .
-
On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.
-
On the details page of the ASM instance, choose in the left-side navigation pane.
-
On the Namespace tab, select the namespace, click the Enable/Disable Sidecar Proxy by Ports or IP Addresses tab, and configure the parameters.
The following table describes the parameters.
Parameter
Description
Ports on Which Inbound Traffic Not Redirected to Sidecar Proxy
The port for inbound traffic that bypasses the sidecar proxy. This example uses 8087.
Ports on Which Outbound Traffic Not Redirected to Sidecar Proxy
The port for outbound traffic that bypasses the sidecar proxy. This example uses 8087.
-
After you finish the configuration, click Update Settings.
Verify the health check results
-
Log on to the ACK console. In the left navigation pane, click Clusters.
On the Cluster List page, click the name of the destination cluster or click Details in the Actions column.
In the left navigation pane of the cluster management page, choose .
-
Click the pod name or click Details on the right.
-
On the pod details page, click the Events tab. Verify that health check events for port 8087 appear.