Skip to content

feat(operations): separate liveness and readiness on current main - #446

Closed
seonghobae wants to merge 2 commits into
mainfrom
feat/availability-probes-current-main-20260814
Closed

feat(operations): separate liveness and readiness on current main#446
seonghobae wants to merge 2 commits into
mainfrom
feat/availability-probes-current-main-20260814

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator

Superseded by #458

This stale-base branch is closed without merge. PR #458 reconstructs the same reviewed three-file availability result directly on current protected main eb0a32e87e7470469c8fa0f8c67d9583654bef57 as exactly one commit with zero behind commits. Both modified protected-main input blobs were byte-identical to this branch's construction inputs, and all three reconstructed output blobs are byte-identical to this reviewed result.

No checks, reviews, or approvals from #446 transfer to #458.

Historical objective

Separate process liveness from traffic readiness through controlled /healthz and /readyz endpoints and operator guidance.

@coderabbitai

coderabbitai Bot commented Aug 14, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e1dddd71-d728-44d6-ae3e-9c9a0b70be5b

📥 Commits

Reviewing files that changed from the base of the PR and between 961f44a and eacd105.

📒 Files selected for processing (3)
  • docs/operations/2026-08-05-availability-probes.md
  • src/main/java/com/clearfolio/viewer/controller/HealthController.java
  • src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java

📝 Walkthrough

Walkthrough

Spring Boot ApplicationAvailability 상태를 기준으로 /healthz/readyz를 제공한다. 정상 응답은 HTTP 200, 비정상 응답은 HTTP 503이다. 모든 응답은 Cache-Control: no-store를 사용한다. 테스트와 Kubernetes 운영 절차를 추가했다.

Changes

가용성 프로브

Layer / File(s) Summary
프로브 계약과 컨트롤러
docs/operations/2026-08-05-availability-probes.md, src/main/java/com/clearfolio/viewer/controller/HealthController.java
ApplicationAvailability을 필수 의존성으로 주입한다. /healthz는 liveness 상태를 반환하고 /readyz는 readiness 상태를 반환한다. 상태에 따라 HTTP 200 또는 503과 JSON 상태를 반환하며 캐시를 사용하지 않는다.
HTTP 계약 검증
src/test/java/com/clearfolio/viewer/controller/HealthControllerTest.java
WebTestClient로 두 엔드포인트의 정상·비정상 상태 코드, JSON 응답과 캐시 헤더를 검증한다. null 가용성 제공자 거부도 검증한다.
Kubernetes 운영 절차
docs/operations/2026-08-05-availability-probes.md
startup, liveness, readiness probe 설정 예시를 추가한다. 보안 제한, CI 검증 조건과 롤백 절차를 정의한다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to eacd1

The localized probe behavior change has no actionable merge-blocking risk remaining beyond normal checks and approval.

Sequence Diagram(s)

sequenceDiagram
  participant Kubernetes
  participant HealthController
  participant ApplicationAvailability
  Kubernetes->>HealthController: GET /healthz 또는 /readyz
  HealthController->>ApplicationAvailability: liveness/readiness 상태 조회
  ApplicationAvailability-->>HealthController: 상태 반환
  HealthController-->>Kubernetes: HTTP 200 또는 503과 JSON 응답
Loading
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed 제목은 /healthz/readyz를 분리하는 PR의 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/availability-probes-current-main-20260814

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@seonghobae
seonghobae marked this pull request as ready for review August 14, 2026 09:29
@seonghobae
seonghobae enabled auto-merge (squash) August 14, 2026 09:29

Copy link
Copy Markdown
Collaborator Author

Exact-current-head read-only review request for eacd105cf655f539c8eb951f14bce57fadece112 on protected main 961f44a19c4ced87f8062b3ab9842a9a08d05235. CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; the three-file availability-probe delta is mergeable with zero unresolved threads. Verify controlled liveness/readiness status, no-cache and unauthenticated probe semantics, fail-closed construction, and absence of sensitive operational disclosure. Do not mutate the branch or bypass independent approval.

@opencode-agent review
@cwl-noema-review review
@strix review
@coderabbitai review

@coderabbitai

coderabbitai Bot commented Aug 14, 2026

Copy link
Copy Markdown

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 3 minutes and 32 seconds before sending another message.

Copy link
Copy Markdown
Collaborator Author

@opencode-agent review
@coderabbitai review
@cwl-noema-review review
@strix review

Review exact head eacd105cf655f539c8eb951f14bce57fadece112 only. Current exact-head CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; unresolved review threads are zero. Review read-only and preserve independent reviewer identity. Do not mutate the branch, synthesize author approval, weaken protection, or merge.

@coderabbitai

coderabbitai Bot commented Aug 15, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

target='eacd105cf655f539c8eb951f14bce57fadece112'
base='961f44a19c4ced87f8062b3ab9842a9a08d05235'

printf '%s\n' '== HEAD =='
git rev-parse HEAD
git status --short
printf '%s\n' '== target commit =='
git show -s --format='%H%n%P%n%s' "$target"
printf '%s\n' '== changed paths =='
git diff --name-status "$base" "$target"
printf '%s\n' '== diff =='
git diff --find-renames --find-copies --unified=80 "$base" "$target"

printf '%s\n' '== Java outlines =='
fd -e java . | while IFS= read -r f; do
  ast-grep outline "$f" --lang java --items all --match 'Health|Probe|Availability|Security' 2>/dev/null || true
done

printf '%s\n' '== endpoint and security references =='
rg -n -i -C 5 \
  '(healthz|readyz|ApplicationAvailability|LivenessState|ReadinessState|requestMatchers|authorizeHttpRequests|permitAll|Cache-Control|no-cache|no-store)' \
  -g '*.java' -g '*.kt' -g '*.yml' -g '*.yaml' -g '*.properties' -g '*.md' .

printf '%s\n' '== test references =='
rg -n -C 4 \
  '(healthz|readyz|ApplicationAvailability|LivenessState|ReadinessState|Cache-Control|unauthenticated|permitAll)' \
  -g '*Test.java' -g '*Tests.java' -g '*.java' .

Length of output: 111088


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '== configuration and application outlines =='
ast-grep outline src/main/java/com/clearfolio/viewer/config/ProductionAuthReadinessConfig.java --lang java --items all
ast-grep outline src/main/java/com/clearfolio/viewer/ClearfolioViewerApplication.java --lang java --items all

printf '%s\n' '== authentication and WebFilter implementation =='
nl -ba src/main/java/com/clearfolio/viewer/config/ProductionAuthReadinessConfig.java
printf '%s\n' '== application bootstrap =='
nl -ba src/main/java/com/clearfolio/viewer/ClearfolioViewerApplication.java

printf '%s\n' '== all WebFilter and tenant-authentication implementations =='
rg -n -i -C 8 \
  '(WebFilter|WebFilterChain|TenantContext|TenantAccessService|X-Clearfolio|ServerWebExchange|pathWithinApplication|request\.getPath|exclude|skip|healthz|readyz)' \
  src/main/java src/test/java

printf '%s\n' '== documentation classification and conflicting active references =='
for f in README.md CLAUDE.md docs/architecture.md docs/deployment/2026-07-02-buyer-deployment-integration-playbook.md docs/qa/smoke_test_plan.md docs/trd-integrated-document-viewer-platform.md; do
  if [ -f "$f" ]; then
    echo "--- $f ---"
    sed -n '1,35p' "$f"
    rg -n -C 2 '/healthz|/readyz|readiness|liveness' "$f" || true
  fi
done

printf '%s\n' '== commit-level scope check =='
git diff --check 961f44a19c4ced87f8062b3ab9842a9a08d05235 eacd105cf655f539c8eb951f14bce57fadece112
git status --short

Length of output: 2666


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '== production auth readiness configuration =='
sed -n '1,240p' src/main/java/com/clearfolio/viewer/config/ProductionAuthReadinessConfig.java
printf '%s\n' '== application bootstrap =='
sed -n '1,160p' src/main/java/com/clearfolio/viewer/ClearfolioViewerApplication.java

printf '%s\n' '== authentication and WebFilter references =='
rg -n -i -C 8 \
  '(WebFilter|WebFilterChain|TenantContext|TenantAccessService|X-Clearfolio|ServerWebExchange|pathWithinApplication|request\.getPath|exclude|skip|healthz|readyz)' \
  src/main/java src/test/java || true

printf '%s\n' '== documentation classification and probe references =='
for f in README.md CLAUDE.md docs/architecture.md docs/deployment/2026-07-02-buyer-deployment-integration-playbook.md docs/qa/smoke_test_plan.md docs/trd-integrated-document-viewer-platform.md; do
  if [ -f "$f" ]; then
    echo "--- $f [opening] ---"
    sed -n '1,35p' "$f"
    echo "--- $f [probe references] ---"
    rg -n -C 2 '/healthz|/readyz|readiness|liveness' "$f" || true
  fi
done

printf '%s\n' '== commit scope and whitespace =='
git diff --check 961f44a19c4ced87f8062b3ab9842a9a08d05235 eacd105cf655f539c8eb951f14bce57fadece112
git status --short

Length of output: 201096


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '== production readiness configuration =='
sed -n '1,220p' src/main/java/com/clearfolio/viewer/config/ProductionAuthReadinessConfig.java

printf '%s\n' '== all application filter implementations =='
rg -n -l -i '(implements\s+WebFilter|WebFilterChain|`@Order`|SecurityWebFilterChain|ServerHttpSecurity)' \
  src/main/java
while IFS= read -r f; do
  echo "--- $f ---"
  sed -n '1,260p' "$f"
done < <(rg -l -i '(implements\s+WebFilter|WebFilterChain|`@Order`|SecurityWebFilterChain|ServerHttpSecurity)' src/main/java)

printf '%s\n' '== security dependencies =='
rg -n -C 3 '(spring-boot-starter-security|spring-security|oauth2|webflux)' pom.xml

printf '%s\n' '== precise current documentation claims =='
rg -n -C 2 '(/healthz.*readiness|[Rr]eadiness.*healthz|/readyz)' \
  README.md CLAUDE.md docs/architecture.md docs/deployment/2026-07-02-buyer-deployment-integration-playbook.md \
  docs/qa/smoke_test_plan.md docs/trd-integrated-document-viewer-platform.md docs/operations/2026-08-05-availability-probes.md

printf '%s\n' '== exact changed documentation paths =='
git diff --name-only 961f44a19c4ced87f8062b3ab9842a9a08d05235 eacd105cf655f539c8eb951f14bce57fadece112 -- '*.md'

Length of output: 2696


@seonghobae I reviewed only commit eacd105cf655f539c8eb951f14bce57fadece112.

Finding — blocking operational-documentation mismatch

README.md Line 15 and Line 34, and docs/architecture.md Line 25, still describe /healthz as the readiness probe. The deployment playbook also checks only /healthz. After this change, /healthz reports liveness and /readyz reports readiness. Operators who follow the current guidance can route traffic based on liveness and send traffic to an instance that returns 503 from /readyz.

Update the active README, architecture, and deployment guidance to use /readyz for traffic readiness and retain /healthz only for liveness or startup behavior.

The implementation otherwise meets the requested probe checks:

  • Liveness and readiness return the controlled 200 and 503 status mappings.
  • Both responses use Cache-Control: no-store.
  • The routes are unauthenticated. No application authorization filter or Spring Security dependency applies to them.
  • Construction fails when ApplicationAvailability is absent.
  • The response body contains only the controlled status label.

I did not modify the branch, alter protections, synthesize approval, or merge.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Collaborator Author

Exact-current-head independent review request for eacd105cf655f539c8eb951f14bce57fadece112.

The bounded availability-probe slice is mergeable; CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; unresolved inline findings are zero. /healthz and /readyz are non-cacheable, disclose only controlled state values, and preserve restart-versus-traffic semantics. Protected main has advanced since construction, so any base update must regenerate all exact-head evidence.

@opencode-agent review
@coderabbitai review
@cwl-noema-review review
@strix review

Review this exact head read-only. Do not mutate the branch, synthesize author approval, weaken protection, or merge.

@coderabbitai

coderabbitai Bot commented Aug 15, 2026

Copy link
Copy Markdown

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 8 minutes and 23 seconds before sending another message.

Copy link
Copy Markdown
Collaborator Author

Exact-head review/update request for eacd105cf655f539c8eb951f14bce57fadece112.

The availability-probe slice has terminal-success CI, Security Scan, SAST Semgrep, and fuzz, is mergeable, and has zero unresolved threads. Its construction base predates current protected main; update it to the current base and regenerate base-sensitive evidence before approval or protected merge if required. Preserve the bounded /healthz liveness and /readyz traffic-readiness contract without importing unrelated changes.

@coderabbitai review
@opencode-agent review
@cwl-noema-review review
@strix review

@coderabbitai

coderabbitai Bot commented Aug 15, 2026

Copy link
Copy Markdown

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 10 minutes and 32 seconds before sending another message.

@seonghobae seonghobae closed this Aug 15, 2026
auto-merge was automatically disabled August 15, 2026 13:03

Pull request was closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant