Skip to content

Bind internal status check port 9021 to loopback only #700

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stephanme merged 2 commits into from
Oct 12, 2026
Merged

Bind internal status check port 9021 to loopback only #700

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3ce5056
Bind internal status check port 9021 to loopback only
stephanme Oct 2, 2026
b24773e
Fix curl exit code capture in ccng monit healthcheck
stephanme Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 3 additions & 6 deletions jobs/cloud_controller_ng/templates/ccng_monit_http_healthcheck.sh.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,18 +30,15 @@ trap log_failure EXIT

<% if p('cc.use_status_check') %>
# Use /internal/v4/status readiness endpoint
HOST=<%= p('cc.nginx.ip').empty? ? discover_external_ip : p('cc.nginx.ip') %>
PORT=9021
PROTOCOL="http"
READINESS_URL="${PROTOCOL}://${HOST}:${PORT}/internal/v4/status"
READINESS_URL="http://127.0.0.1:9021/internal/v4/status"

last_ok_response=$(date +%s)

while true; do
set +e
readiness_code=$(curl --fail -sS -o /dev/null -w "%{http_code}" --max-time 2 -A "ccng_monit_http_healthcheck" "${READINESS_URL}")
set -e
status=$?
set -e

now=$(date +%s)
elapsed=$((now - last_ok_response))
Expand All @@ -60,7 +57,7 @@ while true; do

if [[ "$readiness_code" == "503" ]]; then
echo "$(date --rfc-3339=ns) ccng_monit_http_healthcheck: readiness endpoint returned 503 (unhealthy), exiting to trigger restart"
exit $status
exit 1
elif [[ "$readiness_code" == "429" ]]; then
echo "$(date --rfc-3339=ns) ccng_monit_http_healthcheck: readiness endpoint returned 429 (busy), not restarting"
# Do not exit, just log and continue
Expand Down
2 changes: 1 addition & 1 deletion jobs/cloud_controller_ng/templates/nginx.conf.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,7 +184,7 @@ limit_req_zone $http_authorization zone=<%= zone['name'] %>:10m rate=<%= zone['l
<% if p('cc.use_status_check') %>
# This block handles the /internal/v4/status endpoint for health checks, which is called by ccng_monit_http_healthcheck.
server {
listen 9021;
listen 127.0.0.1:9021;
Comment thread
stephanme marked this conversation as resolved.
Resolved
server_name _;
server_name_in_redirect off;

Expand Down
Loading