- Ya
- 4 Septemba 2026, 21:53 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 1352e32
This service exists to redirect, and a redirect is exactly what a health check must never get. kubelet probes the pod IP, so the Host header is something like "10.42.1.89" — four labels, so the isApex test is false, the request falls through to the scheme upgrade, and it is answered with a 308 to https://10.42.1.89. kubelet FOLLOWS that, lands on :443 where nothing is listening, and reports the pod unhealthy. Observed today the moment this deployment gained a readiness probe: 467 failed startup probes and eight restarts on a pod that was perfectly healthy the whole time and answering on :3000. Nothing reached a user — maxUnavailable: 0 kept the two old pods serving throughout, which is the same property this whole programme was about — but the rollout could never finish. Excludes api/ from the matcher, which is what kamo-careers already does, and adds an explicit early return beside the existing ACME pass-through so that widening the matcher later cannot quietly reintroduce it.