fix: make readiness probeable and parse charts in CI - #613
Merged
Conversation
It is gated with /metrics, so a kubelet probe got 401 and the pod never went Ready. Probe headers are literal strings, so a token cannot be injected.
Charts render client-side, so a syntax error never fails the build — the page just ships with a hole in it.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (15)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
📝 WalkthroughWalkthroughThe server now supports configurable unauthenticated ChangesPublic readiness probes
Documentation diagram validation
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Kubernetes
participant TaskitoReadiness
participant StorageAndWorkers
Kubernetes->>TaskitoReadiness: Request /readiness
TaskitoReadiness->>StorageAndWorkers: Run storage and worker-registration checks
StorageAndWorkers-->>TaskitoReadiness: Return check results
TaskitoReadiness-->>Kubernetes: Return readiness response
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
kartikeya-27
approved these changes
Aug 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The two follow-ups left open by #612.
A readiness probe that can actually run
/readinessis the route that checks storage, and it is gated alongside/metrics. A Kubernetes probe carries no credential and cannot be given one — a probe header is a literal string in the manifest, so authenticating it would mean copying the token out of its Secret into the Deployment spec. The result was a probe that returned401and a pod that never went Ready, so #612 shipped with readiness pointed at/health, which passes as long as the process is alive and checks nothing.TASKITO_DASHBOARD_PUBLIC_READINESS=1answers that one route without a credential./metricsstays gated — the switch is scoped to the probe, not to every unauthenticated reader. What it publishes to anything that can reach the port: whether storage answers, and how many workers are registered. That is the trade, and it is the smaller of the two: the alternative leaks a bearer token to anyone withget deployment.The chart sets it by default and probes
/readiness.--set dashboard.publicReadiness=falsereverts to/healthfor both.Every Mermaid chart is parsed in CI
Charts render inside
<Mermaid>'s effect, in the browser.pnpm buildprerenders the page around a broken one and exits 0, so a syntax error ships silently and the page has a hole in it — which is how the clipped node in #612 got as far as a screenshot.pnpm check:diagramsextracts every<Mermaid chart={...}/>indocs/contentand runsmermaid.parseover it. Wired intodocs.ymlbeside the parity check. Mermaid needs a DOM even to parse, hencejsdomas a docs devDependency.Current state: 50 charts across 38 files, all parse.
Verification
cargo test -p taskito-server— 197 lib + every integration suite, 0 failures. Clippy clean./readiness401s under session auth, answers with a real storage check once opted out, and/metricsstays 401 in both.TASKITO_DASHBOARD_AUTH=session: without the flag/readiness→ 401; with it → 200 and{"storage": "ok"}, while/metrics→ 401 throughout.ci-chart.ymlgains an assertion that the rendered probe path and the env var move together — the two halves have to agree or the pod hangs NotReady, and nothing else would catch them drifting apart.Summary by CodeRabbit
New Features
/readinessby default, while/metricsremains protected./healthwhen public access is disabled.Documentation
Quality Improvements