feat: add readiness probe

README.md

@@ -55,19 +55,11 @@ make docker-buildx
 # load the image into kind
 make kind-load-image
 
-# Choose one of the following ways to deploy the external data provider:
-
-# 1. client and server auth enabled (recommended)
-helm install attest-provider charts/external-data-provider \
+# deploy attest provider
+helm install attest-provider charts/attest-provider \
     --set provider.tls.caBundle="$(cat certs/ca.crt | base64 | tr -d '\n\r')" \
+    --set image="docker/attest-provider:dev" \
     --namespace "${NAMESPACE:-gatekeeper-system}"
-
-# 2. client auth disabled and server auth enabled
-helm install attest-provider charts/external-data-provider \
-    --set clientCAFile="" \
-    --set provider.tls.caBundle="$(cat certs/ca.crt | base64 | tr -d '\n\r')" \
-    --namespace "${NAMESPACE:-gatekeeper-system}" \
-    --create-namespace
 ```
 
 4. Install constraint template and constraint.

charts/attest-provider/templates/attest-provider-deployment.yaml

@@ -68,6 +68,11 @@ spec:
           mountPath: {{ .Values.certDir }}
           readOnly: true
         {{- end }}
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: {{ .Values.port }}
+            scheme: HTTPS
       restartPolicy: Always
       nodeSelector:
         kubernetes.io/os: linux

main.go

@@ -101,8 +101,15 @@ func main() {
 		os.Exit(1)
 	}
 
+	readyHandler, err := handler.NewReadyHandler()
+	if err != nil {
+		klog.ErrorS(err, "unable to create ready handler")
+		os.Exit(1)
+	}
+
 	mux.Handle("POST /validate", http.TimeoutHandler(validateHandler, handlerTimeout, timeoutError))
 	mux.Handle("POST /mutate", http.TimeoutHandler(mutateHandler, handlerTimeout, timeoutError))
+	mux.Handle("GET /ready", readyHandler)
 
 	server := &http.Server{
 		Addr:              fmt.Sprintf(":%d", port),
@@ -125,7 +132,7 @@ func main() {
 		clientCAs.AppendCertsFromPEM(caCert)
 
 		config.ClientCAs = clientCAs
-		config.ClientAuth = tls.RequireAndVerifyClientCert
+		config.ClientAuth = tls.VerifyClientCertIfGiven
 		server.TLSConfig = config
 	}
 

pkg/handler/ready.go

@@ -0,0 +1,16 @@
+package handler
+
+import (
+	"net/http"
+)
+
+type readyHandler struct{}
+
+// NewReadyHandler returns a readiness probe handler.
+func NewReadyHandler() (http.Handler, error) {
+	return &readyHandler{}, nil
+}
+
+func (h *readyHandler) ServeHTTP(w http.ResponseWriter, _ *http.Request) {
+	w.WriteHeader(http.StatusOK)
+}