Project: Kuma (Orchestration & Management / Service Mesh)
File: 013-health-check-policy.md

Status: accepted Technical Story: https://github.com/kumahq/kuma/issues/4735 We want to create a new policy for Health Checking that uses TargetRef . We want to extend the current list of supported protocols (TCP, HTTP) with GRPC. As a reminder: this is active health checking so this policy will attach to an outbound. The way active health checking works is by sending outgoing requests, I don't think it makes sense to have "from" section. `Top` and `to` levels look to me as mirror cases, so I think it's worth talking about them together. `MeshGatewayRoute` and `MeshHTTPRoute` do not make sense as on its own they do not have "health", also Envoy does set health on a route only per Cluster/Endpoint. `MeshService` is a natural fit, but I think we should be careful when allowing other targets combinations. Flexibility Can avoid DOS-ing by using reachable services Users might accidentally DOS their infra by making Everything HC service X Without reachable services using `targetRef=Mesh` and `to.targetRef=Mesh` does not make sense Cases that might produce a lot of traffic need to be documented Flexibility (without 1 case) Can avoid DOS-ing by using reachable services Users might accidentally DOS their infra by making Everything HC service X Cases that might produce a lot of traffic need to be documented Harder to accidentally DOS infrastructure by running too aggressive health checks Inflexibility As we don't pose any restrictions on HC right now I would go with option 1 and an entry in docs about possible problems. GRPC support seems pretty straight forward, just need to use a different health checking type - There are some features that we currently do not expose (like pass through mode / caching, redis / thrift protocol), but currently this MADR does not aim to change that, if you think something critical is missing from this functionality, let us know in the

For the first iteration we will add `servicename`, `authority` and leave out `initialmetadata` (can be added later). Pick the most specific protocol depending on the service annotation (`kuma.io/protocol` or `appProtocol`), fallback to more general protocol when specific protocol has `disabled=true`. Example algorithm flow: service annotation = http http.disabled == true try tcp (more general proto) tcp.disabled == false use tcp ```yaml default: interval: 10s timeout: 2s unhealthyThreshold: 3 healthyThreshold: 1 initialJitter: 5s # optional intervalJitter: 6s # optional intervalJitterPercent: 10 # optional healthyPanicThreshold: 60 # optional, by default 50 failTrafficOnPanic: true # optional, by default false noTrafficInterval: 10s # optional, by default 60s eventLogPath: "/tmp/health-check.log" # optional alwaysLogHealthCheckFailures: true # optional, by default false reuseConnection: false # optional, by default true tcp: # it will pick the protocol as described in 'protocol selection' section disabled: true # new, default false, can be disabled for override send: Zm9v # optional, empty payloads imply a connect-only health check receive: # optional YmFy YmF6 http: disabled: true # new, default false, can be disabled for override path: /health requestHeadersToAdd: # optional, empty by default append: false header: key: Content-Type value: application/json header: key: Accept value: application/json expectedStatuses: [200, 201] # optional, by default [200] grpc: # new disabled: false # new, default false, can be disabled for override serviceName: "" # optional, service name parameter which will be sent to gRPC service authority: "" # optional, the value of the :authority header in the gRPC health check request, by default name of the cluster this health check is associated with ``` ```yaml type: MeshHealthCheck mesh: default name: hc-all-grpc spec: targetRef: kind: Mesh to: targetRef: kind: Mesh name: default default: grpc: {} ``` ```yaml type: MeshHealthCheck mesh: default name: hc-all-tcp spec: targetRef: kind: Mesh to: targetRef: kind: Mesh name: default default: tcp: {} ``` ```yaml type: MeshHealthCheck mesh: default name: hc-front-to-back-http spec: targetRef: kind: MeshService name: frontend to: targetRef: kind: MeshService name: backend default: tcp: disabled: true http: path: /health ```