Bind the readiness service to the wildcard address #91329
Conversation
This change allows for configuring the host binding on the readiness service. If the host isn't specified we bind on localhost, same as before.
grcevski
added
>enhancement
:Core/Infra/Core
|
Documentation preview: |
|
Pinging @elastic/es-core-infra (Team:Core/Infra) |
|
Hi @grcevski, I've created a changelog YAML for you. |
|
Since the readiness probe is already opt in, and only for cloud, could we just change the existing binding instead of making it configurable? |
|
Yes you are right, I was originally concerned that we'll break folks because anyone outside of cloud might've used the readiness feature, but you reminded me now that we marked this as experimental, so I think it's fine to change the default behaviour without an option. I'll make the service bind on all addresses if enabled. |
|
@elasticsearchmachine run elasticsearch-ci/packaging-tests-unix-sample |
grcevski
changed the title
| assert portNumber >= 0; | ||
|
|
||
| List<String> httpBindHost = SETTING_HTTP_BIND_HOST.get(settings); | ||
| var bindHosts = (httpBindHost.isEmpty() ? NetworkService.GLOBAL_NETWORK_BIND_HOST_SETTING.get(settings) : httpBindHost).toArray( | ||
| Strings.EMPTY_ARRAY |
There was a problem hiding this comment.
There seems to be two levels of configuration before the fallback to the loopback. Do we need the configuration checks? And should the fallback be to the wildcard address which implies all (rather than to the loopback) ?
There was a problem hiding this comment.
I struggled with this a lot, what's the right address to pick, 0, publish, bound? I borrowed this code from how we setup the bound addresses in AbstractHttpServerTransport, I don't mind binding to 0 (all) as fallback, but if a user doesn't configure any of those above for Elasticsearch, they will get ES bound to localhost for HTTP, unless they configure SETTING_HTTP_PUBLISH_HOST. I don't know if binding to localhost and publishing another host address is a valid configuration?
There was a problem hiding this comment.
I discussed it with @rjernst just now, we decided that perhaps the easiest is to bind for 0 and if there are any concerns firewall rules should be used to limit access to the port.
grcevski
changed the title
…search into fix/readiness_localhost
|
Thanks Chris! |
This change makes the readiness service bind itself to the wildcard host address, e.g 0.
Fixes #90997