Dex: Dex pod crashlooping because liveness probe fails when using

[eroji]

I am trying to deploy Dex into my local K8s cluster with a path, namely, cluster.domain.com/dex. However, the pod is created and soon after start up begins to crash loop. The reason shows that the URL check returning a 404 and is therefore killed. Is there a way to configure it so that this would work? Or is it just not supported at all?

For additional clarification, I am running Dex behind Nginx Ingress. The Dex pod starts up without any issue. I can even query it and get the expected response back. None the less, the liveness probe triggers the pod being killed off repeatedly.

> curl https://cluster.domain.com/dex/.well-known/openid-configuration
{
  "issuer": "https://cluster.domain.com/dex",
  "authorization_endpoint": "https://cluster.domain.com/dex/auth",
  "token_endpoint": "https://cluster.domain.com/dex/token",
  "jwks_uri": "https://cluster.domain.com/dex/keys",
  "response_types_supported": [
    "code",
    "id_token",
    "token"
  ],
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "scopes_supported": [
    "openid",
    "email",
    "groups",
    "profile",
    "offline_access"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic"
  ],
  "claims_supported": [
    "aud",
    "email",
    "email_verified",
    "exp",
    "iat",
    "iss",
    "locale",
    "name",
    "sub"
  ]
}

NAME                       READY     STATUS             RESTARTS   AGE
pod/dex-65bfc84df8-h4xbk   0/1       CrashLoopBackOff   6          5m

NAME          TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)    AGE
service/dex   ClusterIP   10.99.17.40   <none>        5556/TCP   5m

NAME                  DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/dex   1         1         1            0           5m

NAME                             DESIRED   CURRENT   READY     AGE
replicaset.apps/dex-65bfc84df8   1         1         0         5m

[srenatus]

Which URL are you checking? Can you configure that to point to /dex/.well-known/openid-configuration instead? (Or is the check part of this repo somewhere I'm not aware of?)

[srenatus]

⏳ I'm cleaning this up. Feel free to reopen if this still bugs you.

[k3a]

Just to make it a bit faster for those seeing CrashLoopBackOff due to 404 and using Helm chart.

The Helm chart creates /healthz liveness probe on the deployment and Dex uses issuer path to determine the "base URI" of all its handlers. So any issuer with a sub-directory suffix or is without a scheme (https:// or http://) prefix results in this crashloop as the /healthz endpoint would be installed under the issuer's sub-directory.

If someone needs an issuer with a sub-directory, liveness probe (livenessProbe.httpPath helm value) needs to be modified.

Maybe Dex should also check Host and/or Scheme of the parsed issuer URL because by default, url.Parse parses any string without producing an error. The parsed url has an empty Scheme and Host and the whole string is parsed as a "path" part of URL! https://play.golang.org/p/9zrVbPq-DV9

[ariz-kargo]

Just to make it a bit faster for those seeing CrashLoopBackOff due to 404 and using Helm chart.

The Helm chart creates /healthz liveness probe on the deployment and Dex uses issuer path to determine the "base URI" of all its handlers. So any issuer with a sub-directory suffix or is without a scheme (https:// or http://) prefix results in this crashloop as the /healthz endpoint would be installed under the issuer's sub-directory.

If someone needs an issuer with a sub-directory, liveness probe (livenessProbe.httpPath helm value) needs to be modified.

Maybe Dex should also check Host and/or Scheme of the parsed issuer URL because by default, url.Parse parses any string without producing an error. The parsed url has an empty Scheme and Host and the whole string is parsed as a "path" part of URL! https://play.golang.org/p/9zrVbPq-DV9

This is correct, thank you for your reply. I add a prefix /dex to my issuer, so I modify the livenessProbe.httpPath to become /dex/healthz and it works like charm!