Room 10

HEALTH CHECKS

The Medical Bay

A deployment is running but pods are not receiving traffic. The health checks are misconfigured.
Fix the probes to make the application healthy.

📜 Mission Briefing

Apply unhealthy-deploy.yaml - the pod will be Running but not Ready (0/1).
Describe the pod and look at the readiness probe configuration.
The readiness probe checks the wrong path (/healthz instead of /ready).
Fix the deployment with the corrected YAML in healthy-deploy.yaml.
Once the pod is Ready (1/1), curl the /password endpoint from inside the pod.
The response is your password.

Key Commands

Command	Purpose
`kubectl get pods`	Check READY column
`kubectl describe pod NAME`	See probe config and events
`kubectl logs NAME`	Application logs
`kubectl exec NAME -- curl localhost:PORT/PATH`	Test endpoints

Health Probes

apiVersion: v1
kind: Pod
metadata:
  name: probe-demo
spec:
  containers:
    - name: app
      image: nginx:alpine
      ports:
        - containerPort: 80

      # Liveness probe: Is the container alive?
      # If it fails → kubelet RESTARTS the container
      livenessProbe:
        httpGet:
          path: /healthz
          port: 80
        initialDelaySeconds: 5    # Wait before first check
        periodSeconds: 10         # Check every 10 seconds
        failureThreshold: 3       # Fail after 3 consecutive failures

      # Readiness probe: Is the container ready for traffic?
      # If it fails → pod removed from Service endpoints
      readinessProbe:
        httpGet:
          path: /ready
          port: 80
        initialDelaySeconds: 3
        periodSeconds: 5

      # Startup probe: Is the container started?
      # Disables liveness/readiness until it succeeds
      startupProbe:
        httpGet:
          path: /started
          port: 80
        failureThreshold: 30
        periodSeconds: 10

Probe Types:

# HTTP GET probe
livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
    httpHeaders:
      - name: Custom-Header
        value: Awesome

# TCP Socket probe
livenessProbe:
  tcpSocket:
    port: 3306

# Exec probe (exit code 0 = healthy)
livenessProbe:
  exec:
    command:
      - cat
      - /tmp/healthy

# gRPC probe
livenessProbe:
  grpc:
    port: 50051

# Check pod readiness
kubectl get pods -o custom-columns=\
NAME:.metadata.name,\
READY:.status.containerStatuses[0].ready,\
RESTARTS:.status.containerStatuses[0].restartCount

# Describe to see probe failures
kubectl describe pod probe-demo | grep -A 10 "Liveness\|Readiness"

Hints

Hint 1

Check the unhealthy pod’s status:

kubectl get pods
kubectl describe pod -l app=unhealthy

Hint 2

Apply the fixed deployment:

kubectl delete -f unhealthy-deploy.yaml
kubectl apply -f healthy-deploy.yaml

Hint 3

Get the password:

kubectl exec deploy/healthy-app -- curl -s localhost:80/password

The password is probepass.

🔓 Unlock Room 11

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_11/README             \
        -out ../room_11/README.txt        \
        -pass pass:PASSWORD
cat ../room_11/README.txt