Skip to content

Ensure that all workloads have liveness and readiness probes

An XCCDF Rule

Description

Configuring Kubernetes liveness and readiness probes is essential for ensuring the security and reliability of a system. These probes actively monitor container health and readiness, facilitating automatic actions like restarting or rescheduling unresponsive instances for improved reliability. They play a proactive role in issue detection, allowing timely problem resolution and contribute to efficient scaling and traffic distribution.

Rationale

Many applications running for long periods of time eventually transition to broken states, and cannot recover except by being restarted. Kubernetes provides liveness probes to detect and remedy such situations. Sometimes, applications are temporarily unable to serve traffic. For example, an application might need to load large data or configuration files during startup, or depend on external services after startup. In such cases, you don't want to kill the application, but you don't want to send it requests either. Kubernetes provides readiness probes to detect and mitigate these situations. A pod with containers reporting that they are not ready does not receive traffic through Kubernetes Services.

ID
xccdf_org.ssgproject.content_rule_liveness_readiness_probe_in_workload
Severity
Medium
References
Updated