Basic Healthchecks

Dockerfile

@@ -6,6 +6,7 @@ RUN poetry build
 
 FROM python:3.10-slim
 COPY --from=0 /app/dist/*.whl /
+ADD healthcheck.sh /
 RUN pip install keyvault2kube-*.*.*-py3-none-any.whl
 
 ENV PYTHONUNBUFFERED=1

deploy/deploy.yaml

@@ -25,10 +25,22 @@ spec:
           env:
             - name: KEY_VAULT_URLS
               value: https://foo.vault.azure.net/
+          securityContext:
+            readOnlyRootFilesystem: true
+          startupProbe:
+            exec:
+              command: ["test", "-f", "/tmp/done"]
+            periodSeconds: 120
           resources:
             requests:
               cpu: 100m
               memory: 64Mi
             limits:
               cpu: 1000m
               memory: 64Mi
+          volumeMounts:
+            - mountPath: /tmp
+              name: tmp
+      volumes:
+        - name: tmp
+          emptyDir: {}

keyvault2kube/server.py

@@ -3,6 +3,7 @@
 import signal
 import sys
 import time
+from pathlib import Path
 
 import pylogrus
 
@@ -71,6 +72,7 @@ def stop_signal_handler(signal_number, frame) -> None:
 
         try:
             kube.update_secrets(secrets)
+            Path("/tmp/done").touch()
         except Exception as err:
             logger.exception("Failed to update Kubernetes secrets", exc_info=err)