add HTTP and GRPC health check endpoints

cmd/app/grpc.go

@@ -40,6 +40,7 @@ import (
 	"github.com/spf13/viper"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
+	health "google.golang.org/grpc/health/grpc_health_v1"
 )
 
 const (
@@ -105,6 +106,8 @@ func createGRPCServer(cfg *config.FulcioConfig, ctClient *ctclient.LogClient, ba
 	myServer := grpc.NewServer(serverOpts...)
 
 	grpcCAServer := server.NewGRPCCAServer(ctClient, baseca, ip)
+
+	health.RegisterHealthServer(myServer, grpcCAServer)
 	// Register your gRPC service implementations.
 	gw.RegisterCAServer(myServer, grpcCAServer)
 
@@ -161,6 +164,10 @@ func (g *grpcServer) startUnixListener() {
 	}()
 }
 
+func (g *grpcServer) ExposesGRPCTLS() bool {
+	return viper.IsSet("grpc-tls-certificate") && viper.IsSet("grpc-tls-key")
+}
+
 func createLegacyGRPCServer(cfg *config.FulcioConfig, v2Server gw.CAServer) (*grpcServer, error) {
 	logger, opts := log.SetupGRPCLogging()
 

cmd/app/http.go

@@ -17,6 +17,7 @@
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"net/http"
@@ -32,7 +33,9 @@
 	"github.com/sigstore/fulcio/pkg/log"
 	"github.com/sigstore/fulcio/pkg/server"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
+	health "google.golang.org/grpc/health/grpc_health_v1"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/protobuf/proto"
 )
@@ -48,10 +51,21 @@
 }
 
 func createHTTPServer(ctx context.Context, serverEndpoint string, grpcServer, legacyGRPCServer *grpcServer) httpServer {
+	opts := []grpc.DialOption{}
+	if grpcServer.ExposesGRPCTLS() {
+		opts = append(opts, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{InsecureSkipVerify: true})))
+	} else {
+		opts = append(opts, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	}
+	cc, err := grpc.Dial(grpcServer.grpcServerEndpoint, opts...)
+	if err != nil {
+		log.Logger.Fatal(err)
+	}
+
 	mux := runtime.NewServeMux(runtime.WithMetadata(extractOIDCTokenFromAuthHeader),
-		runtime.WithForwardResponseOption(setResponseCodeModifier))
+		runtime.WithForwardResponseOption(setResponseCodeModifier),
+		runtime.WithHealthzEndpoint(health.NewHealthClient(cc)))
 
-	opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}
 	if err := gw.RegisterCAHandlerFromEndpoint(ctx, mux, grpcServer.grpcServerEndpoint, opts); err != nil {
 		log.Logger.Fatal(err)
 	}

config/deployment.yaml

@@ -65,6 +65,11 @@ spec:
           readOnly: true
         - name: oidc-info
           mountPath: /var/run/fulcio
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 5555
+          initialDelaySeconds: 5
         resources:
           requests:
             memory: "1G"

docker-compose.yml

@@ -39,7 +39,7 @@ services:
       - ~/.config/gcloud:/root/.config/gcloud/:z # for GCP authentication
       - ./config/config.jsn:/etc/fulcio-config/config.json:z
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:5555/ping"]
+      test: ["CMD", "curl", "-f", "http://localhost:5555/healthz"]
       interval: 10s
       timeout: 3s
       retries: 3
@@ -62,7 +62,7 @@ services:
     volumes:
       - ./config/dex:/etc/config/:ro
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8888/auth/healthz"]
+      test: ["CMD", "wget", "-O", "/dev/null", "http://localhost:8888/auth/healthz"]
       interval: 10s
       timeout: 3s
       retries: 3

pkg/server/grpc_server.go

@@ -32,17 +32,20 @@
 	"github.com/sigstore/fulcio/pkg/log"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"google.golang.org/grpc/codes"
+	health "google.golang.org/grpc/health/grpc_health_v1"
 	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
 )
 
 type grpcCAServer struct {
 	fulciogrpc.UnimplementedCAServer
+	health.HealthServer
 	ct *ctclient.LogClient
 	ca certauth.CertificateAuthority
 	identity.IssuerPool
 }
 
-func NewGRPCCAServer(ct *ctclient.LogClient, ca certauth.CertificateAuthority, ip identity.IssuerPool) fulciogrpc.CAServer {
+func NewGRPCCAServer(ct *ctclient.LogClient, ca certauth.CertificateAuthority, ip identity.IssuerPool) *grpcCAServer {
 	return &grpcCAServer{
 		ct:         ct,
 		ca:         ca,
@@ -263,3 +266,11 @@
 		Issuers: cfg.ToIssuers(),
 	}, nil
 }
+
+func (g *grpcCAServer) Check(_ context.Context, _ *health.HealthCheckRequest) (*health.HealthCheckResponse, error) {
+	return &health.HealthCheckResponse{Status: health.HealthCheckResponse_SERVING}, nil
+}
+
+func (g *grpcCAServer) Watch(_ *health.HealthCheckRequest, _ health.Health_WatchServer) error {
+	return status.Error(codes.Unimplemented, "unimplemented")
+}