From 4a781ace496928a5d5c0b999111bb303c79e781b Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sun, 23 Aug 2026 23:57:31 -0500 Subject: [PATCH] =?UTF-8?q?fix(vpn):=20exec=20(localhost)=20liveness=20pro?= =?UTF-8?q?be=20=E2=80=94=20VPN=20routing=20breaks=20kubelet=20HTTP=20prob?= =?UTF-8?q?e?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Once the tunnel redirects the pod default route via tun0, the pod's response to the kubelet's httpGet liveness probe egresses the tunnel and never returns → probe times out → pod restarts ~every 2min despite the tunnel being up (PIA egress IP confirmed). Switch to a local wget exec probe (stays on lo). Co-Authored-By: Claude Opus 4.8 --- platform/vpn-egress/gluetun-gateway.yaml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml index b63ce4a..4e30848 100644 --- a/platform/vpn-egress/gluetun-gateway.yaml +++ b/platform/vpn-egress/gluetun-gateway.yaml @@ -72,9 +72,14 @@ spec: - name: control containerPort: 8000 # Gluetun control API (health + tunnel-state lookup) livenessProbe: - httpGet: { path: /v1/openvpn/status, port: 8000 } # Gluetun control API health - initialDelaySeconds: 20 + # EXEC (localhost) not httpGet: once the tunnel redirects the default route via tun0, the pod's + # response to a kubelet HTTP probe would egress the tunnel and never return → probe times out → + # needless restarts. A local wget stays on lo, unaffected by the VPN routing. + exec: + command: ["/bin/sh", "-c", "wget -qO- http://127.0.0.1:8000/v1/vpn/status | grep -q running"] + initialDelaySeconds: 30 periodSeconds: 30 + timeoutSeconds: 5 resources: requests: cpu: 50m