- Shipped
- September 4, 2026 at 9:53 PM UTC
- Author
- Kamo
- Commit
- 1352e32
This service exists to redirect, and a redirect is exactly what a health check must never get. kubelet probes the pod IP, so the Host header is something like "10.42.1.89" — four labels, so the isApex test is false, the request falls through to the scheme upgrade, and it is answered with a 308 to https://10.42.1.89. kubelet FOLLOWS that, lands on :443 where nothing is listening, and reports the pod unhealthy. Observed today the moment this deployment gained a readiness probe: 467 failed startup probes and eight restarts on a pod that was perfectly healthy the whole time and answering on :3000. Nothing reached a user — maxUnavailable: 0 kept the two old pods serving throughout, which is the same property this whole programme was about — but the rollout could never finish. Excludes api/ from the matcher, which is what kamo-careers already does, and adds an explicit early return beside the existing ACME pass-through so that widening the matcher later cannot quietly reintroduce it.