when create a Server resource for some pods,the probe check failed

[wuzhuoquan]

1. Create the deployment by applying the yaml with readinessProbe

readinessProbe:
    failureThreshold: 1
    httpGet:
      path: /check
      port: 8080
      scheme: HTTP
    periodSeconds: 5
    successThreshold: 1
    timeoutSeconds: 5

2. Create a Server for the deployment pods

apiVersion: policy.linkerd.io/v1beta1
kind: Server
metadata:
  namespace: linkerd-test
  name: test-app-1-v1-8080
spec:
  podSelector:
    matchLabels: 
      app: test-app-1
      version: v1
  port: 8080 
  proxyProtocol: HTTP/1

3. After I do that，the readinesProbe check failed and return 403，because onece the user set a Server for some pod's port, the port is mTLS-ed
4. Create a HTTPRoute and set the parentRef to the Server.If I don't set any rules match the probe check path, kubelet request to the probe path returned 404
5. Then I add a rule to match the probe path, this time kubelet get 403 again 😂
6. If I don't use the Server for the HTTPRoute parentRef, I can't use the mTLS and Authorization
7. If I use the Server for the HTTPRoute parentRef, the probe check failed, and event can't use the route feature to route to diffrent version of my app.

So, how can i slove the probe?
[裂开][裂开][裂开][裂开][裂开][裂开][裂开][裂开]

[alpeb]

Note that, unlike regular traffic, probe requests are not mTLS'd (because the kubelet cannot be injected by linkerd). It seems however that you're doing the right thing. If you declare an HTTPRoute for your service, you're right you require to also declare an entry with the probe's path.
One great way to diagnose whether these rules are getting applied is using the command linkerd diagnostics policy -n linkerd-test po/<pod-name> 8080.

[wuzhuoquan]

Thanks for your answer. You mean, after I create a Server instance for the pods, and declare an HTTPRoute with setting the Server as the parentRef, and also I need to declare an entry with the probe's path?

[wuzhuoquan]

I declare the HTTPRoute like below, but still return 403 to kubelet

apiVersion: policy.linkerd.io/v1beta3
kind: HTTPRoute
metadata:
  name: test-app-1
  namespace: linkerd-test
spec:
  parentRefs:
  - group: policy.linkerd.io
    kind: Server
    name: test-app-1-v1-8080
  rules:
  - matches:
    - path:
        type: Exact
        value: /check

403 return:

  Warning  Unhealthy  2m16s (x15 over 3m8s)  kubelet            Readiness probe failed: HTTP probe failed with statuscode: 403

[alpeb]

That seems right to me... Can you provide the output of the linkerd diagnostics command I mentioned above? Also, it'd be very helpfull if you could provide a self-contained minimal repro for this issue.

[wuzhuoquan]

diagnostics info：

labels:
  group: policy.linkerd.io
  kind: server
  name: test-app-1-v1-8080
protocol:
  Kind:
    Http1:
      routes:
      - authorizations:
        - authentication:
            Permit:
              MeshTLS:
                Clients:
                  Identities:
                    identities:
                    - name: default.linkerd-test.serviceaccount.identity.linkerd.cluster.local
                    suffixes:
                    - {}
          labels:
            group: policy.linkerd.io
            kind: authorizationpolicy
            name: test-app-1
          metadata:
            Kind:
              Resource:
                group: policy.linkerd.io
                kind: authorizationpolicy
                name: test-app-1
          networks:
          - net:
              ip:
                Ip:
                  Ipv4: 0
          - net:
              ip:
                Ip:
                  Ipv6: {}
        metadata:
          Kind:
            Resource:
              group: policy.linkerd.io
              kind: HTTPRoute
              name: test-app-1
        rules:
        - matches:
          - path:
              Kind:
                Prefix: /
        - matches:
          - path:
              Kind:
                Exact: /check

[alpeb]

I think we're indeed missing something here. You've got an AuthorizationPolicy that permits traffic from the identity default.linkerd-test.serviceaccount.identity.linkerd.cluster.local. That won't work to authorize traffic from the kubelet. You'll also need to create an extra AuthorizationPolicy with requiredAuthenticationRefs pointing to a NetworkAuthentication resource that allows traffic from the kubelet. We've got a tutorial on the docs with a sample app setting all of this, that I recommend you get familiar with in order to get a grasp of all this setup.