Liveness probe check

[priyakr-git]

Contour exposes two health endpoints /health and /healthz. On my setup, I have the following:
pod information:
contour-57c5c6647d-jm8x6 1/1 Running 0 9m51s 10.244.1.15 10.1.53.39
contour-57c5c6647d-ttdk2 1/1 Running 0 9m51s 10.244.1.16 10.1.53.39
contour-certgen-v1.20.1-ljsvm 0/1 Completed 0 10m 10.244.1.14 10.1.53.39
envoy-bcvtg 2/2 Running 0 9m49s 10.244.1.17 10.1.53.39

service information:
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
contour ClusterIP 10.96.66.23 8001/TCP 14m
envoy LoadBalancer 10.96.226.89 80:31097/TCP,443:32464/TCP 14m

From within the cluster, say from a worker node, when I curl http://10.244.1.15:8001/health, I get an empty response.
$ curl -i 10.244.1.15:8001/health -k -I -v

• About to connect() to 10.244.1.15 port 8001 (#0)
• Trying 10.244.1.15...
• Connected to 10.244.1.15 (10.244.1.15) port 8001 (#0)

HEAD /health HTTP/1.1
User-Agent: curl/7.29.0
Host: 10.244.1.15:8001
Accept: /

• Empty reply from server
• Connection #0 to host 10.244.1.15 left intact
  curl: (52) Empty reply from server

Is there a way to get a HTTP Response 200, Do I need to use secure port?
Can I look for something specific in the contour or envoy log?

[priyakr-git]

I found that I had to use port 8000

$ curl -i http://10.244.1.27:8000/healthz
HTTP/1.1 200 OK
Date: Thu, 14 Jul 2022 18:56:02 GMT
Content-Length: 3
Content-Type: text/plain; charset=utf-8

OK

So I am confused about the port 8001, Do I need certs for 8001

[youngnick]

Port 8001 is the xDS endpoint, so must use TLS certs by default, yes.