Health Checks

using Microsoft.Extensions.Diagnostics.HealthChecks;

var builder = WebApplication.CreateBuilder(args);
var ordersDb = builder.Configuration.GetConnectionString("Orders")
    ?? throw new InvalidOperationException("ConnectionStrings:Orders is not configured");

builder.Services.AddHttpClient("recommendations", c => c.BaseAddress = new Uri("http://recommendations:8080"));
builder.Services.AddHealthChecks()
    .AddNpgSql(ordersDb, name: "orders-db", tags: ["ready"], timeout: TimeSpan.FromSeconds(3))
    .AddCheck<RecommendationsCheck>("recommendations",
        failureStatus: HealthStatus.Degraded, tags: ["ready"], timeout: TimeSpan.FromSeconds(2));

var app = builder.Build();
app.MapHealthChecks("/health/live", new() { Predicate = _ => false });
app.MapHealthChecks("/health/ready", new() { Predicate = c => c.Tags.Contains("ready") });
app.Run();

public sealed class RecommendationsCheck(IHttpClientFactory clients) : IHealthCheck
{
    public async Task<HealthCheckResult> CheckHealthAsync(HealthCheckContext context, CancellationToken ct)
    {
        using var response = await clients.CreateClient("recommendations").GetAsync("/health/live", ct);
        return response.IsSuccessStatusCode
            ? HealthCheckResult.Healthy()
            : new HealthCheckResult(context.Registration.FailureStatus, $"status {(int)response.StatusCode}");
    }
}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: orders-api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: orders-api
  template:
    metadata:
      labels:
        app: orders-api
    spec:
      containers:
        - name: orders-api
          image: registry.example.com/shop/orders-api:1.4.2
          ports:
            - containerPort: 8080
          startupProbe:
            httpGet:
              path: /health/live
              port: 8080
            periodSeconds: 2
            failureThreshold: 30
          readinessProbe:
            httpGet:
              path: /health/ready
              port: 8080
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /health/live
              port: 8080
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 3

using Microsoft.AspNetCore.Authorization;

var builder = WebApplication.CreateBuilder(args);
builder.WebHost.UseUrls("http://+:8080", "http://+:8081"); // 8081: management, no ingress route
builder.Services.AddAuthentication().AddJwtBearer(); // the only scheme, so it is the default challenge
builder.Services.AddAuthorization(options =>
{
    // Every endpoint requires an authenticated user unless it opts out.
    options.FallbackPolicy = new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build();
});
builder.Services.AddHealthChecks();

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();

// The kubelet sends no token, so probes must be anonymous.
app.MapHealthChecks("/health/live", new() { Predicate = _ => false }).AllowAnonymous();
app.MapHealthChecks("/health/ready").AllowAnonymous();

// Full report only on the management port and only for operators.
app.MapHealthChecks("/health/details")
    .AddEndpointFilter(async (ctx, next) =>
        ctx.HttpContext.Connection.LocalPort == 8081 ? await next(ctx) : Results.NotFound())
    .RequireAuthorization(policy => policy.RequireRole("operator"));

app.MapGet("/orders/{id:int}", (int id) => Results.Ok(new { id, status = "shipped" }));
app.Run();