Issue#138 add probes and resource limits

[amaanx86]

Fix Cloud Guard Container Security Findings by Adding Health Probes

Subject

Resolve OCI Cloud Guard findings (missing health probes) in OCI Native Ingress Controller by adding readiness and liveness probes to the deployment template.

Problem Statement

Cloud Guard was flagging multiple Container Security findings against the OCI Native Ingress Controller deployed as an OKE managed add-on, specifically:

• Container without readiness probe (Medium risk)
• Container without liveness probe (Medium risk)

This issue persisted across our OCI environment and could not be resolved by end users since the controller is deployed as a managed add-on (Deployment spec cannot be safely modified). However, these same findings would affect Helm-based deployments as well.

Solution

Added TCP socket-based health probes to the Helm deployment template:

Readiness Probe:

• Port: webhook-server (9443)
• Initial Delay: 30 seconds (allows controller startup time)
• Period: 10 seconds (frequent health checks)
• Timeout: 5 seconds
• Failure Threshold: 3 attempts

Liveness Probe:

• Port: webhook-server (9443)
• Initial Delay: 60 seconds (allows stabilization)
• Period: 20 seconds
• Timeout: 5 seconds
• Failure Threshold: 3 attempts

Implementation Details

• Probes use TCP socket checks on the webhook server port (simpler, more reliable than HTTP for control plane components)
• Conservative timing prevents flapping while ensuring quick failure detection
• No breaking changes; existing deployments will inherit health probes from updated Helm chart

Testing

• Verified probes are correctly configured in deployment template
• Tested with probe timings to ensure no false positives
• Cloud Guard findings should resolve after deployment update

Relates To

Closes #138

Commits

1. Fix OCI Native Ingress Controller (OKE managed add-on) flagged by Cloud Guard for missing probes and resource limits #138: Add readiness probe to OCI Native Ingress Controller
2. Fix OCI Native Ingress Controller (OKE managed add-on) flagged by Cloud Guard for missing probes and resource limits #138: Add liveness probe to OCI Native Ingress Controller
3. Fix OCI Native Ingress Controller (OKE managed add-on) flagged by Cloud Guard for missing probes and resource limits #138: Document health probes configuration in values.yaml

[amaanx86]

Thank you @AkarshES for approving the changes, let me know what is further required to finalize this pull request!

[amaanx86]

Hi @nirpai, @AkarshES,
As requested, I’ve replaced the webhook TCP probes with dedicated HTTP health check endpoints and controller readiness logic.

Helm Deployment Test

Controller deployed from my branch image:
https://hub.docker.com/r/amaanx86/oci-native-ingress-controller

Health endpoints verified inside the pod

Ingress Functional Test

[AkarshES]

Thanks for adding the HTTP healthcheck as Niranjan requested

[nirpai]

The comment is misplaced on webhook Port.

[amaanx86]

i have moved it to metrics server @nirpai

requesting approval on PR @nirpai @AkarshES

[amaanx86]

Hi @nirpai @AkarshES Can we merge this now ?

[AkarshES]

We are doing some validation in OKE environment so that we can go ahead and merge this change. Thank you for your effort and patience on this

[amaanx86]

@AkarshES Thank you for keeping me updated

[amaanx86]

What this fixes

Cloud Guard was flagging the OCI Native Ingress Controller for missing readiness and liveness probes (Medium risk, Container Security). This affects both managed OKE add-on deployments and Helm-based ones.

---

What changed

Initial implementation (TCP probes)

Added readiness and liveness probes to the Helm deployment template using TCP socket checks on the webhook server port (9443):

• Readiness: TCP on port 9443, initial delay 30s, period 10s, timeout 5s, failure threshold 3
• Liveness: TCP on port 9443, initial delay 60s, period 20s, timeout 5s, failure threshold 3
• Documented probe configuration in values.yaml

Moved to HTTP probes with dedicated health endpoints

After reviewer feedback, replaced the TCP probes with proper HTTP health endpoints for more reliable checks:

• Added pkg/server/health.go - a HealthChecker that tracks informer cache sync state and controller readiness, exposing /healthz/ready and /healthz/live handlers
• Updated pkg/server/server.go - registers both endpoints on the existing metrics server (port 2223)
• Updated main.go - signals cache sync after informer setup so readiness only returns healthy once the controller is warmed up
• Updated deployment.yaml - probes now use HTTP GET /healthz/ready and HTTP GET /healthz/live on the metrics port instead of TCP on the webhook port
• Moved probe comments in values.yaml to the metrics section where they belong

---

Testing

• Deployed from branch image: amaanx86/oci-native-ingress-controller (Docker Hub)
• Verified /healthz/ready and /healthz/live respond correctly inside the pod
• Tested ingress creation end-to-end after deployment

---

Note on PR description

Updating the description here for visibility and documentation - the initial PR body described the original TCP probe approach. Since then the implementation evolved significantly based on reviewer feedback, so this updated description reflects the full picture of what was done.

---

@nirpai @AkarshES - the PR is already approved and from what I understand just pending your OKE environment validation. Could you share an update on where that stands? Happy to help with anything if needed. Once validation is good, would appreciate a merge when you get a chance. Thank you both for your time and feedback throughout this.

Closes #138