Tobi Nehrlich 0920a991f9

Use new restricted liveness probe endpoint ...

The `--health-port` option is deprecated and `--http-endpoint` the new
option to use. Since `--http-endpoint` additionally exposes metrics, the
liveness probe is limited to only listen on localhost by default. With
this only processes on the host network, like kubelet, can call the
endpoint. Regular pods can no longer access the liveness probe via the
node IP address.

Signed-off-by: Tobi Nehrlich <tobi.nehrlich@amazee.io>

2024-03-28 13:17:40 +01:00

11 KiB

Raw History

View Raw