HealthCheck

Health endpoint

The Health Check endpoint can be optionally enabled for load balancer backend health checks. This allows the load balancer to verify the gateway is up and listening on the configured port, and only use gateways that are up and alive.

The health endpoint is configured with the option:

   --health value             health check endpoint path. Health endpoint will be configured on GET http method: GET <health>
                              NOTICE: the path has to be specified with '/'. e.g /health [$VGW_HEALTH]

When set, the configured endpoint will return 200 status (OK) for unauthenticated http GET. This will mask bucket actions at that endpoint. For example, if --health is set to /health then a bucket called "health" cannot be created or contents listed (if already created).

Example:

% curl http://127.0.0.1:7070/health
OK%                

S3 client access is expected to fail, since this is not a valid bucket endpoint:

% aws s3 ls s3://health

Unable to parse response (syntax error: line 1, column 0), invalid XML received. Further retries may succeed:
b'OK'

Standalone IAM service

--health is a global option, so it configures the standalone IAM service's public listener too. It goes before the iam subcommand:

versitygw --port :7071 --health /health --access myaccess --secret mysecret iam --dir /var/lib/versitygw-iam

The private endpoint has no health route; the S3 gateway probes it with its own /private/version call at startup instead. See Setup & Gateway Integration.

Example load balancer config

HAProxy

The uri option should match the configured health endpoint. Other options may be needed for SSL enabled gateways.

backend gateways
  option httpchk
  http-check send meth GET  uri /health
  server server1 192.168.0.1:7070 check
  server server2 192.168.0.2:7070 check
  server server3 192.168.0.3:7070 check

If the deployment runs a separately scaled standalone IAM tier, give it its own backend:

backend iam
  option httpchk
  http-check send meth GET  uri /health
  server iam1 192.168.0.10:7071 check
  server iam2 192.168.0.11:7071 check

Warning

• Load balance only the public IAM API. The private endpoint the S3 gateway uses is a point-to-point mutually authenticated channel, and each gateway addresses one IAM service directly.
• More than one IAM instance requires Vault storage. The file-backed --dir store is single-process and must not be shared between IAM servers.