From ce4694f7e75c8fa3bd8d5705034d2916a2cedf12 Mon Sep 17 00:00:00 2001
From: Jared Burns <Ghazgkull@users.noreply.github.com>
Date: Tue, 12 Mar 2019 00:40:38 -0700
Subject: [PATCH] Allow to disable liveness and readiness probes for Istio mTLS
 (#11757)

Signed-off-by: Jared Burns <jaredburns3000@gmail.com>
---
 stable/oauth2-proxy/Chart.yaml                |  2 +-
 stable/oauth2-proxy/README.md                 | 10 +++++++++-
 stable/oauth2-proxy/templates/deployment.yaml | 10 ++++++++++
 stable/oauth2-proxy/values.yaml               | 15 +++++++++++++++
 4 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/stable/oauth2-proxy/Chart.yaml b/stable/oauth2-proxy/Chart.yaml
index 2b47e39c23..da649c70b9 100644
--- a/stable/oauth2-proxy/Chart.yaml
+++ b/stable/oauth2-proxy/Chart.yaml
@@ -1,5 +1,5 @@
 name: oauth2-proxy
-version: 0.9.1
+version: 0.10.0
 apiVersion: v1
 appVersion: 3.1.0
 home: http://www.videntity.com/
diff --git a/stable/oauth2-proxy/README.md b/stable/oauth2-proxy/README.md
index e42f46a3bd..c3deef9854 100644
--- a/stable/oauth2-proxy/README.md
+++ b/stable/oauth2-proxy/README.md
@@ -53,12 +53,20 @@ Parameter | Description | Default
 `image.tag` | Image tag | `v3.1.0`
 `imagePullSecrets` | Specify image pull secrets | `nil` (does not add image pull secrets to deployed pods)
 `ingress.enabled` | enable ingress | `false`
+`livenessProbe.enabled`  | enable Kubernetes livenessProbe. Disable to use oauth2-proxy with Istio mTLS. See [Istio FAQ](https://istio.io/help/faq/security/#k8s-health-checks) | `true`
+`livenessProbe.initialDelaySeconds` | number of seconds | 0
+`livenessProbe.timeoutSeconds` | number of seconds | 1
 `nodeSelector` | node labels for pod assignment | `{}`
 `podAnnotations` | annotations to add to each pod | `{}`
 `podLabels` | additional labesl to add to each pod | `{}`
+`priorityClassName` | priorityClassName | `nil`
+`readinessProbe.enabled` | enable Kubernetes readinessProbe. Disable to use oauth2-proxy with Istio mTLS. See [Istio FAQ](https://istio.io/help/faq/security/#k8s-health-checks) | `true`
+`readinessProbe.initialDelaySeconds` | number of seconds | 0
+`readinessProbe.timeoutSeconds` | number of seconds | 1
+`readinessProbe.periodSeconds` | number of seconds | 10
+`readinessProbe.successThreshold` | number of successes | 1
 `replicaCount` | desired number of pods | `1`
 `resources` | pod resource requests & limits | `{}`
-`priorityClassName` | priorityClassName | `nil`
 `service.port` | port for the service | `80`
 `service.type` | type of service | `ClusterIP`
 `tolerations` | List of node taints to tolerate | `[]`
diff --git a/stable/oauth2-proxy/templates/deployment.yaml b/stable/oauth2-proxy/templates/deployment.yaml
index ce057c5a4b..e46d03cbdb 100644
--- a/stable/oauth2-proxy/templates/deployment.yaml
+++ b/stable/oauth2-proxy/templates/deployment.yaml
@@ -71,14 +71,24 @@ spec:
           - containerPort: 4180
             name: http
             protocol: TCP
+{{- if .Values.livenessProbe.enabled }}
         livenessProbe:
           httpGet:
             path: /ping
             port: http
+          initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
+          timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
+{{- end }}
+{{- if .Values.readinessProbe.enabled }}
         readinessProbe:
           httpGet:
             path: /ping
             port: http
+          initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+          timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
+          successThreshold: {{ .Values.readinessProbe.successThreshold }}
+          periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+{{- end }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
         volumeMounts:
diff --git a/stable/oauth2-proxy/values.yaml b/stable/oauth2-proxy/values.yaml
index e20c3ddd01..af52d395ce 100644
--- a/stable/oauth2-proxy/values.yaml
+++ b/stable/oauth2-proxy/values.yaml
@@ -92,6 +92,21 @@ tolerations: []
 # Ref: https://kubernetes.io/docs/user-guide/node-selection/
 nodeSelector: {}
 
+# Configure Kubernetes liveness and readiness probes.
+# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
+# Disable both when deploying with Istio 1.0 mTLS. https://istio.io/help/faq/security/#k8s-health-checks
+livenessProbe:
+  enabled: true
+  initialDelaySeconds: 0
+  timeoutSeconds: 1
+
+readinessProbe:
+  enabled: true
+  initialDelaySeconds: 0
+  timeoutSeconds: 1
+  periodSeconds: 10
+  successThreshold: 1
+
 podAnnotations: {}
 podLabels: {}
 replicaCount: 1