{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/5892","labels_url":"https://api.github.com/repos/openshift/origin/issues/5892/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/5892/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/5892/events","html_url":"https://github.com/openshift/origin/pull/5892","id":116807461,"number":5892,"title":"Reenabled registry dc's liveness probe","user":{"login":"miminar","id":1478803,"avatar_url":"https://avatars.githubusercontent.com/u/1478803?v=3","gravatar_id":"","url":"https://api.github.com/users/miminar","html_url":"https://github.com/miminar","followers_url":"https://api.github.com/users/miminar/followers","following_url":"https://api.github.com/users/miminar/following{/other_user}","gists_url":"https://api.github.com/users/miminar/gists{/gist_id}","starred_url":"https://api.github.com/users/miminar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miminar/subscriptions","organizations_url":"https://api.github.com/users/miminar/orgs","repos_url":"https://api.github.com/users/miminar/repos","events_url":"https://api.github.com/users/miminar/events{/privacy}","received_events_url":"https://api.github.com/users/miminar/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-11-13T16:58:07Z","updated_at":"2015-11-16T12:45:44Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/5892","html_url":"https://github.com/openshift/origin/pull/5892","diff_url":"https://github.com/openshift/origin/pull/5892.diff","patch_url":"https://github.com/openshift/origin/pull/5892.patch"},"body":"Reverts 12f4a35e98f7a358a9763e06444083dddd3a29b0\n\nResolves #5116"},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/157016677","html_url":"https://github.com/openshift/origin/pull/5892#issuecomment-157016677","issue_url":"https://api.github.com/repos/openshift/origin/issues/5892","id":157016677,"user":{"login":"miminar","id":1478803,"avatar_url":"https://avatars.githubusercontent.com/u/1478803?v=3","gravatar_id":"","url":"https://api.github.com/users/miminar","html_url":"https://github.com/miminar","followers_url":"https://api.github.com/users/miminar/followers","following_url":"https://api.github.com/users/miminar/following{/other_user}","gists_url":"https://api.github.com/users/miminar/gists{/gist_id}","starred_url":"https://api.github.com/users/miminar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miminar/subscriptions","organizations_url":"https://api.github.com/users/miminar/orgs","repos_url":"https://api.github.com/users/miminar/repos","events_url":"https://api.github.com/users/miminar/events{/privacy}","received_events_url":"https://api.github.com/users/miminar/received_events","type":"User","site_admin":false},"created_at":"2015-11-16T12:45:44Z","updated_at":"2015-11-16T12:45:44Z","body":"@soltysh I made a wrong assumption based on unsecured upstream registry and didn't run tests to verify it. They [say](https://docs.docker.com/registry/deploying/#load-balancing-considerations):\r\n\r\n> A properly secured registry should return 401 when the “/v2/” endpoint is hit without credentials. The response should include a WWW-Authenticate challenge, providing guidance on how to authenticate, such as with basic auth or a token service. If the load balancer has health checks, it is recommended to configure it to consider a 401 response as healthy and any other as down. This will secure your registry by ensuring that configuration problems with authentication don’t accidentally expose an unprotected registry. If you’re using a less sophisticated load balancer, such as Amazon’s Elastic Load Balancer, that doesn’t allow one to change the healthy response code, health checks can be directed at “/”, which will always return a 200 OK response.\r\n\r\n`/` endpoint is not yet supported in `v2.0.1` registry. Therefor it should be correct to check `/v2/` which in our case returns 401. Unfortunately we can't use `probe.Handler.HTTPGet` action on it because the action considers endpoint ready if it returns `status >= 200 && status < 400`. So we would have to use an ExecAction like:\r\n\r\n    /bin/bash -c 'curl -i -s 127.0.0.1:5000/v2/ | grep -q \"HTTP/1\\.[0-9]\\s\\+401\\>\"'\r\n\r\nWhich isn't much pretty. To sum up our options:\r\n\r\n1. use `/v2/` option and expect 401 in probes and tests\r\n2. stick with our custom `/healthz` route until the registry is rebased ... then switch to `/`\r\n3. use `/v2` route which returns 301 which is considered *alive* by kubernetes probe handler\r\n4. modify our [authorization check](https://github.com/openshift/origin/blob/master/pkg/dockerregistry/server/auth.go#L119) to return 200 for `/v2/` route\r\n\r\nTo avoid violating upstream's REST API, I'm now more inclined to stick with our `/healthz` route (opt. 2). WDYT?\r\n"}}