Does Kubernetes liveness probes support user authentication with PKIs?

Question

I am trying to access some of our rest endpoints to check that our API container is up and running. If I can specify a PKI I can access our endpoints which currently are all behind authentication. Is this possible?

If not I will have to add a new endpoint.

when you say PKI you mean you want to use a token to hit a REST endpoint to do a GET request? — garlicFrancium, Jun 25 '19 at 17:25
I have a cert in my keychain i get prompted for when accessing out site. I would need to pass this cert in with a request or I get a 403 — Dylan, Jun 25 '19 at 17:27
nope I am using openjdk:8-jdk-alpine but can change it if needed slightly — Dylan, Jun 25 '19 at 17:44

score 3 · Accepted Answer · answered Jun 26 '19 at 17:54

Step 1: add curl to your container image REF, Hint: Modify the Docker file to include curl.

Step 2: (in kubernetes deployment) configure the resource to mount the certs needed to query (GET request) the REST endpoint. REF Hint: Follow the way serviceaccount credentials are mounted to a POD.

Step 3: Now use those certs which are mounted to your container. In the liveness probe to curl it the way shown here

At this point if you have curled successfully with status code 200. you will have a linux comand execution code 0 which lead to successfull liveness check else the pod will be restarted.

score 1 · Answer 2 · answered Jun 26 '19 at 11:35

You can try to implement it with an external curl script and a liveness probe with liveness command, adding certs as secrets and mounting it, and exec curl like:

    curl -v --cacert /mounted/cd/secret/ca.pem \
  --key /mounted/secret/key/key.pem --cert /mounted/secret/cert/admin.pem \
  http://liveness/probe/url

Regards.

Does Kubernetes liveness probes support user authentication with PKIs?

2 Answers2