Install a probe on Kubernetes

A probe inside the cluster watches its workloads through the apiserver with its own ServiceAccount — no token to create, no kubeconfig to copy — and runs URL, API, TCP and database checks from the cluster network itself. The Helm chart installs it as a single-replica StatefulSet that registers itself with your Webserver on its first start.

What the in-cluster probe runs

The image is the slim probe: no browsers.

Keep a VM or Windows probe for browser journeys.

Before you start

• Kubernetes 1.24 or later, and Helm 3.
• A Webserver API address the pod can reach, as <host>:<port> — a DNS name works.
• The _sharedInternal value from the Webserver’s webserver.json. Every component must carry the same one.
• The chart, from the probe release archive: deploy/helm/mugnsoft-probe.
• The image mugnsoft/monitor:<version>-slim in a registry the cluster can pull from. To build it yourself, from the probe sources:

docker build -f deploy/docker/Dockerfile --build-arg VERSION=4.2.0 -t registry.example.com/mugnsoft/monitor:4.2.0-slim .
docker push registry.example.com/mugnsoft/monitor:4.2.0-slim

Choose how the Webserver reaches the probe

The Webserver always calls the probe on its API port, over HTTPS. Where the Webserver runs decides the Service type:

Install

A Webserver inside the cluster:

helm install probe-k8s ./mugnsoft-probe \
  --namespace mugnsoft --create-namespace \
  --set probe.webserver=webserver.mugnsoft.svc.cluster.local:8050 \
  --set probe.sharedInternal='<the _sharedInternal value>' \
  --set probe.location=eu-west-1

A Webserver outside, through a load balancer restricted to the Webserver’s address:

helm install probe-k8s ./mugnsoft-probe \
  --namespace mugnsoft --create-namespace \
  --set probe.webserver=mugnsoft.example.com:8050 \
  --set probe.sharedInternal='<the _sharedInternal value>' \
  --set service.type=LoadBalancer \
  --set 'service.loadBalancerSourceRanges={203.0.113.10/32}' \
  --set advertise.address=probe-k8s.example.com

With NodePort, add --set service.type=NodePort --set service.nodePort=30851 --set advertise.address=<a node address>.

Keep your settings in a values file rather than on the command line for upgrades: helm upgrade probe-k8s ./mugnsoft-probe -n mugnsoft -f probe-values.yaml.

Approve the probe

The probe registers itself as soon as the Webserver answers, retrying from 15 seconds to every 5 minutes while it does not. Watch it happen:

kubectl -n mugnsoft logs statefulset/probe-k8s-mugnsoft-probe | grep autoRegister

autoRegister - registered probe-k8s-mugnsoft-probe with webserver.mugnsoft.svc.cluster.local:8050; approve it on the Webserver's Components page

Then enable it on the Webserver’s Components page, like any other probe. Until then it is running and healthy, but idle.

Monitor this cluster from it

Add a container host on the Webserver:

The probe uses the ServiceAccount token Kubernetes mounts into the pod, which the kubelet rotates; it is re-read on every check. See Container monitoring for discovery, grading and limits.

Values

What the chart creates

Security

• The container runs as a non-root user (UID 10001) with a read-only root filesystem, no privilege escalation, every capability dropped and the RuntimeDefault seccomp profile. icmp.enabled is the only exception: root with NET_RAW and DAC_OVERRIDE only.
• The ServiceAccount can read and nothing else — it cannot change the cluster.
• rbac.scope=namespace narrows it to one namespace. Node health is then unavailable.
• Put the probe API behind service.loadBalancerSourceRanges or a network policy when it is exposed outside the cluster.

Troubleshooting

Limitations

• No EUM browser journeys in the slim image.
• One replica per release. For redundancy, install a second release under another name and push the same monitors to both probes.
• Changing the advertised address after registration is manual, on the Webserver.
• The probe API is served over HTTPS with a self-signed certificate.

Translations

• fr: Installer une sonde sur Kubernetes