-
[OPIK-6830] [BE] fix: restart pods with a dead outbound HTTP connection pool via liveness health check (#7215)
frostbyte_neo 发布于
2026-06-24 12:46:25 +00:00 -
Connection pool health check
-
fix(auth): detect ConnectionShutdownException by type in dead-pool check
ConnectionShutdownException (httpclient5 5.6.1) extends IllegalStateException
with a null message, so the message-only match let a shut-down shared pool
report healthy. Match it by type in the cause chain; keep the message match as
a fallback for the pool-level IllegalStateException from StrictConnPool.lease().Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
- test(health): include auth_http_client in HealthCheckIntegrationTest aggregate
The new NamedHealthCheck is auto-registered, so the hardcoded 'all' expected
list must include it (healthy + critical + ALIVE; inert because auth is
disabled in config-test).Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
- refactor(health): address review on shared HTTP client liveness check
- Rename AuthHttpClientHealthCheck -> AuthSharedHttpClientHealthCheck
(NAME: auth_shared_http_client) to reflect the shared outbound client - Make the probe timeout configurable via AuthenticationConfig.healthCheckTimeout
(default 1s, env AUTH_HEALTH_CHECK_TIMEOUT) - Walk the cause chain with Guava Throwables.getCausalChain
- Narrow injection to @Config("authentication") AuthenticationConfig
- Move the react-service null/blank check into AuthenticationConfig
- Unit-test the public check() via a mocked Client; make the matcher private
- Replace the redundant auth-disabled integration case with an auth-enabled
one asserting an unreachable upstream stays healthy (no liveness flap) - Reorder config so the alive checks sit together
Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
- fix(health): probe a fixed target in shared HTTP client check
Dead-pool detection is target-independent: the Apache pool throws on lease()
before any I/O when shut down, so the probe needs only a valid route, not the
real auth service. Probe a fixed loopback URI parsed once instead of the
configured reactService URL. This removes the malformed-URL boot crash and the
per-check URI allocation by construction. Keep the int-millis timeout clamp so
an oversized configured Duration cannot overflow at startup.Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
- refactor(health): decouple shared HTTP client check from auth
The probe targets a fixed loopback URI, so dead-pool detection never needed
the auth endpoint. Gating on auth left self-hosted K8s installs (Helm ships
AUTH_ENABLED=false) without protection even though they have a liveness
actuator, and the shared client serves more than auth (online scoring, etc.).- Rename AuthSharedHttpClientHealthCheck -> SharedHttpClientHealthCheck and
move it from infrastructure.auth to infrastructure.http; check name
auth_shared_http_client -> shared_http_client - Drop the auth gate: the check is always active, injecting only the shared
Client and its probe timeout - Move the probe timeout to a dedicated SharedHttpClientHealthCheckConfig with
@NotNull/@MinDuration/@MaxDuration (replaces the clamp) and no Java default;
value provided by config.yml and config-test.yml - Remove the now-unused healthCheckTimeout field and isReactServiceConfigured()
from AuthenticationConfig - Simplify the integration test (always-on, asserted in DefaultConfig)
Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
下载附件
-