Ensure liveness, readiness and startup probes on all workloads

Every container in every Deployment/StatefulSet now defines all three
probes. The paperless-ngx consume CronJob intentionally has none (batch
workload).

- Add probes: apache-tika, calibre-web-automated, cyberchef, gotenberg,
  homeassistant, patchmon-backend, samba (tcp/445), teamspeak-server
  (tcp/30033), zipline (/api/healthcheck)
- Fix voucher-vault null probe values with real defaults
- Fix startup-probe semantics in template-chart and rallly (no
  initialDelaySeconds, generous failureThreshold)
- Switch outline probes to its /_health endpoint
- Add readiness/startup probes to satisfactory
- Add startup probes to matrix-synapse, matrix-delegation-nginx,
  paperless-server, patchmon-frontend, urlaubsverwaltung
- Major version bump for all published charts

apache-tika/Chart.yaml

@@ -4,5 +4,5 @@ description: A Helm chart to deploy Apache Tika on Kubernetes
 
 type: application
 
-version: 4.0.1+up3.2.3.0.full
+version: 5.0.0+up3.2.3.0.full
 appVersion: "3.2.3.0-full"

apache-tika/templates/deployment.yaml

@@ -24,6 +24,12 @@ spec:
             - containerPort: 9998
               protocol: TCP
               name: tika-port
+          livenessProbe:
+            {{- toYaml .Values.tika.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.tika.readinessProbe | nindent 12 }}
+          startupProbe:
+            {{- toYaml .Values.tika.startupProbe | nindent 12 }}
           resources:
             requests:
               memory: "{{ .Values.tika.resources.requests.memory }}"

apache-tika/values.yaml

@@ -1,4 +1,27 @@
 tika:
+  # Tika answers "GET /" on its server port with HTTP 200.
+  livenessProbe:
+    httpGet:
+      path: /
+      port: tika-port
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  readinessProbe:
+    httpGet:
+      path: /
+      port: tika-port
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
+  startupProbe:
+    httpGet:
+      path: /
+      port: tika-port
+    periodSeconds: 5
+    timeoutSeconds: 5
+    failureThreshold: 30
   resources:
     requests:
       cpu: 0.1

calibre-web-automated/Chart.yaml

@@ -4,7 +4,7 @@ type: application
 name: calibre-web-automated
 description: A Helm chart to deploy calibere-web-automated
 
-version: 1.3.0+upv4.0.6
+version: 2.0.0+upv4.0.6
 appVersion: v4.0.6
 
 maintainers:

calibre-web-automated/templates/calibre-web-automated.sfs.yaml

@@ -54,6 +54,12 @@ spec:
               subPath: customize.py.json
             - mountPath: "/cwa-book-ingest"
               name: cwa-consume
+          livenessProbe:
+            {{- toYaml .Values.cwa.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.cwa.readinessProbe | nindent 12 }}
+          startupProbe:
+            {{- toYaml .Values.cwa.startupProbe | nindent 12 }}
           resources:
             requests:
               memory: "{{ .Values.cwa.resources.requests.memory }}"

calibre-web-automated/values.yaml

@@ -6,6 +6,28 @@ cwa:
   storageClass: longhorn
   timezone: "UTC"
   maxUploadFileSize: "10m"
+  livenessProbe:
+    httpGet:
+      path: /
+      port: http
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  readinessProbe:
+    httpGet:
+      path: /
+      port: http
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  # The startup probe gates liveness/readiness. Startup budget = 10s * 30 = 300s.
+  startupProbe:
+    httpGet:
+      path: /
+      port: http
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 30
   resources:
     requests:
       cpu: 0.1

cyberchef/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart to deploy Cyberchef on Kubernetes
 
 type: application
 
-version: 1.0.0+up10.22.1
+version: 2.0.0+up10.22.1
 appVersion: "10.22.1"
 
 maintainers:

cyberchef/templates/cyberchef.deployment.yaml

@@ -20,11 +20,16 @@ spec:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "ghcr.io/gchq/cyberchef:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
-          # TODO: liveness and readiness probes
           ports:
             - containerPort: 80
               protocol: TCP
               name: http
+          livenessProbe:
+            {{- toYaml .Values.cyberchef.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.cyberchef.readinessProbe | nindent 12 }}
+          startupProbe:
+            {{- toYaml .Values.cyberchef.startupProbe | nindent 12 }}
           resources:
             requests:
               memory: "{{ .Values.cyberchef.resources.requests.memory }}"

cyberchef/values.yaml

@@ -1,4 +1,26 @@
 cyberchef:
+  livenessProbe:
+    httpGet:
+      path: /
+      port: http
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  readinessProbe:
+    httpGet:
+      path: /
+      port: http
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
+  startupProbe:
+    httpGet:
+      path: /
+      port: http
+    periodSeconds: 5
+    timeoutSeconds: 5
+    failureThreshold: 30
   resources:
     requests:
       cpu: 0.1

gotenberg/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart to deploy Gotenberg on Kubernetes
 
 type: application
 
-version: 1.0.2+up8.26.0
+version: 2.0.0+up8.26.0
 appVersion: "8.26.0"
 
 maintainers:

gotenberg/templates/deployment.yaml

@@ -24,6 +24,12 @@ spec:
             - containerPort: 3000
               protocol: TCP
               name: gotenberg-port
+          livenessProbe:
+            {{- toYaml .Values.gotenberg.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.gotenberg.readinessProbe | nindent 12 }}
+          startupProbe:
+            {{- toYaml .Values.gotenberg.startupProbe | nindent 12 }}
           resources:
             requests:
               memory: "{{ .Values.gotenberg.resources.requests.memory }}"

gotenberg/values.yaml

@@ -1,4 +1,27 @@
 gotenberg:
+  # Gotenberg exposes a documented health endpoint at /health.
+  livenessProbe:
+    httpGet:
+      path: /health
+      port: gotenberg-port
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  readinessProbe:
+    httpGet:
+      path: /health
+      port: gotenberg-port
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
+  startupProbe:
+    httpGet:
+      path: /health
+      port: gotenberg-port
+    periodSeconds: 5
+    timeoutSeconds: 5
+    failureThreshold: 30
   resources:
     requests:
       cpu: 0.1

homeassistant/Chart.yaml

@@ -3,7 +3,7 @@ name: homeassistant
 description: A Helm chart to deploy Home Assistant on Kubernetes
 type: application
 
-version: 1.4.2+up2026.2.3
+version: 2.0.0+up2026.2.3
 
 appVersion: "2026.2.3"
 

homeassistant/templates/homeassistant.sfs.yaml

@@ -28,7 +28,12 @@ spec:
             - name: http
               containerPort: 8123
               protocol: TCP
-          # TODO: liveness-probe, readiness-probe
+          livenessProbe:
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.readinessProbe | nindent 12 }}
+          startupProbe:
+            {{- toYaml .Values.startupProbe | nindent 12 }}
           resources:
             limits:
               cpu: {{ .Values.resources.limits.cpu }}

homeassistant/values.yaml

@@ -32,15 +32,30 @@ resources:
      memory: 512Mi
      ephemeralStorage: 128Mi
 
-# This is to setup the liveness and readiness probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
+# This is to setup the liveness, readiness and startup probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
 livenessProbe:
   httpGet:
     path: /
     port: http
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
 readinessProbe:
   httpGet:
     path: /
     port: http
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
+# The startup probe gates liveness/readiness. Home Assistant can take a while to
+# start up, so grant a generous budget: 10s * 30 = 300s.
+startupProbe:
+  httpGet:
+    path: /
+    port: http
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 30
 
 # Additional volumes on the output Deployment definition.
 volumes: []

matrix-synapse/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: matrix-synapse
 description: A Helm chart to deploy a Matrix Synapse server on Kubernetes
 type: application
-version: 1.2.1+upv1.149.1
+version: 2.0.0+upv1.149.1
 appVersion: "v1.149.1"
 maintainers:
   - name: jklein

matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml

@@ -40,7 +40,6 @@ spec:
               path: /.well-known/matrix/server
               port: http
               scheme: HTTP
-            initialDelaySeconds: 5
             periodSeconds: 10
             timeoutSeconds: 3
             failureThreshold: 3
@@ -49,10 +48,18 @@ spec:
               path: /.well-known/matrix/server
               port: http
               scheme: HTTP
-            initialDelaySeconds: 15
             periodSeconds: 10
             timeoutSeconds: 3
             failureThreshold: 3
+          # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
+          startupProbe:
+            httpGet:
+              path: /.well-known/matrix/server
+              port: http
+              scheme: HTTP
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 30
       volumes:
         - name: nginx-config
           configMap:

matrix-synapse/templates/matrix-synapse.sfs.yaml

@@ -43,7 +43,6 @@ spec:
               path: /health
               port: http
               scheme: HTTP
-            initialDelaySeconds: 10
             periodSeconds: 10
             timeoutSeconds: 5
             failureThreshold: 3
@@ -52,10 +51,19 @@ spec:
               path: /health
               port: http
               scheme: HTTP
-            initialDelaySeconds: 30
             periodSeconds: 10
             timeoutSeconds: 5
             failureThreshold: 3
+          # The startup probe gates liveness/readiness. Synapse can take a
+          # while to start (migrations, cache warmup): budget 10s * 30 = 300s.
+          startupProbe:
+            httpGet:
+              path: /health
+              port: http
+              scheme: HTTP
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 30
           resources:
             requests:
               memory: "{{ .Values.matrix.resources.requests.memory }}"

outline/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart to deploy Outline on Kubernetes
 
 type: application
 
-version: 1.4.0+up1.9.2
+version: 2.0.0+up1.9.2
 appVersion: 1.9.2
 
 maintainers:

outline/templates/outline.sfs.yaml

@@ -80,18 +80,31 @@ spec:
             - containerPort: 3000
               protocol: TCP
               name: http
+          # Outline exposes a dedicated health endpoint at /_health
+          # (also used by the upstream Docker HEALTHCHECK).
           livenessProbe:
             httpGet:
-              path: /
+              path: /_health
               port: 3000
-            initialDelaySeconds: 30
             periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
           readinessProbe:
             httpGet:
-              path: /
+              path: /_health
               port: 3000
-            initialDelaySeconds: 10
             periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          # The startup probe gates liveness/readiness. Outline runs database
+          # migrations on startup: budget 10s * 30 = 300s.
+          startupProbe:
+            httpGet:
+              path: /_health
+              port: 3000
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 30
           resources:
             requests:
               memory: "{{ .Values.outline.resources.requests.memory }}"

paperless-ngx/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart to deploy Paperless-NGX on Kubernetes
 
 type: application
 
-version: 4.4.1+up2.20.13
+version: 5.0.0+up2.20.13
 
 appVersion: 2.20.13
 

paperless-ngx/templates/paperless-server.sfs.yaml

@@ -166,7 +166,6 @@ spec:
             httpGet:
               path: /
               port: 8000
-            initialDelaySeconds: 30
             periodSeconds: 10
             failureThreshold: 3
             successThreshold: 1
@@ -175,11 +174,19 @@ spec:
             httpGet:
               path: /
               port: 8000
-            initialDelaySeconds: 90
             periodSeconds: 30
             failureThreshold: 3
             successThreshold: 1
             timeoutSeconds: 5
+          # The startup probe gates liveness/readiness. Paperless runs database
+          # migrations and index checks on startup: budget 10s * 30 = 300s.
+          startupProbe:
+            httpGet:
+              path: /
+              port: 8000
+            periodSeconds: 10
+            failureThreshold: 30
+            timeoutSeconds: 5
       restartPolicy: Always
       volumes:
         - name: paperless-volume

patchmon/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart to deploy Patchmon on Kubernetes
 
 type: application
 
-version: 1.4.0+up1.4.2
+version: 2.0.0+up1.4.2
 appVersion: "1.4.2"
 
 maintainers:

patchmon/templates/patchmon-backend.deployment.yaml

@@ -135,7 +135,30 @@ spec:
               value: "https://{{ .Values.ingress.domain }}"
             - name: TRUST_PROXIES
               value: "1"
-          # TODO: Add liveness and readiness probes
+          # The backend exposes GET /health returning {"status": "ok"}.
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 3001
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 3001
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          # The startup probe gates liveness/readiness. The backend waits for
+          # the database and runs migrations on startup: budget 10s * 30 = 300s.
+          startupProbe:
+            httpGet:
+              path: /health
+              port: 3001
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 30
           {{- with .Values.patchmon.backend.resources }}
           resources:
             {{ toYaml . | nindent 12 }}

patchmon/templates/patchmon-frontend.deployment.yaml

@@ -37,7 +37,6 @@ spec:
             httpGet:
               path: /
               port: 3000
-            initialDelaySeconds: 30
             periodSeconds: 10
             timeoutSeconds: 5
             failureThreshold: 3
@@ -45,10 +44,17 @@ spec:
             httpGet:
               path: /
               port: 3000
-            initialDelaySeconds: 5
             periodSeconds: 10
             timeoutSeconds: 5
             failureThreshold: 3
+          # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
+          startupProbe:
+            httpGet:
+              path: /
+              port: 3000
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 30
           volumeMounts:
             - name: patchmon-volume
               mountPath: /usr/share/nginx/html/assets

rallly/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart to deploy Rallly on Kubernetes
 
 type: application
 
-version: 1.1.1+up4.8.1
+version: 2.0.0+up4.8.1
 appVersion: "4.8.1"
 
 maintainers:

rallly/values.yaml

@@ -27,7 +27,6 @@ rallly:
     httpGet:
       path: /
       port: http
-    initialDelaySeconds: 10
     periodSeconds: 10
     timeoutSeconds: 5
     failureThreshold: 3
@@ -35,18 +34,18 @@ rallly:
     httpGet:
       path: /
       port: http
-    initialDelaySeconds: 10
     periodSeconds: 10
     timeoutSeconds: 5
     failureThreshold: 3
+  # The startup probe gates liveness/readiness, so those need no initialDelaySeconds.
+  # Startup budget = periodSeconds * failureThreshold = 150s.
   startupProbe:
     httpGet:
       path: /
       port: http
-    initialDelaySeconds: 30
-    periodSeconds: 10
+    periodSeconds: 5
     timeoutSeconds: 5
-    failureThreshold: 3
+    failureThreshold: 30
 
 ingress:
   clusterIssuer: null

samba/Chart.yaml

@@ -4,6 +4,6 @@ description: A Helm chart for Samba
 
 type: application
 
-version: 1.2.0+up4.23.5
+version: 2.0.0+up4.23.5
 
 appVersion: 4.23.5

samba/templates/samba.sfs.yaml

@@ -39,6 +39,12 @@ spec:
             - name: "{{ $value.name }}"
               mountPath: "/shares/{{ $value.name }}"
             {{- end }}
+          livenessProbe:
+            {{- toYaml .Values.samba.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.samba.readinessProbe | nindent 12 }}
+          startupProbe:
+            {{- toYaml .Values.samba.startupProbe | nindent 12 }}
           resources:
             requests:
               memory: "{{ .Values.samba.resources.requests.memory }}"

samba/values.yaml

@@ -7,6 +7,26 @@ samba:
       validUsers: null
       description: null
       size: null
+  # SMB is not an HTTP protocol, so probe the main SMB TCP port.
+  livenessProbe:
+    tcpSocket:
+      port: 445
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  readinessProbe:
+    tcpSocket:
+      port: 445
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
+  startupProbe:
+    tcpSocket:
+      port: 445
+    periodSeconds: 5
+    timeoutSeconds: 5
+    failureThreshold: 30
   resources:
     requests:
       memory: 50Mi

satisfactory/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: satisfactory
 description: A Helm chart to deploy a Satisfactory Gameserver on Kubernetes
 type: application
-version: 1.3.0+upv1.9.10
+version: 2.0.0+upv1.9.10
 appVersion: "v1.9.10"
 maintainers:
   - name: jklein

satisfactory/templates/satisfactory-server.sfs.yaml

@@ -52,10 +52,28 @@ spec:
                 - "/bin/sh"
                 - "-c"
                 - "/home/steam/healthcheck.sh"
-            initialDelaySeconds: 300
             failureThreshold: 4
             successThreshold: 1
             periodSeconds: 30
+            timeoutSeconds: 10
+          readinessProbe:
+            tcpSocket:
+              port: api
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          # The startup probe gates liveness/readiness. The server downloads /
+          # updates the game files via Steam on startup, which can take a long
+          # time: budget 30s * 40 = 20 minutes.
+          startupProbe:
+            exec:
+              command:
+                - "/bin/sh"
+                - "-c"
+                - "/home/steam/healthcheck.sh"
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 40
           {{- with .Values.server.resources }}
           resources:
             {{ toYaml . | nindent 12 }}

teamspeak-server/Chart.yaml

@@ -4,5 +4,5 @@ description: A Helm chart for deploying a teamspeak-server on Kubernetes
 
 type: application
 
-version: 1.2.0+upv6.0.0.beta8
+version: 2.0.0+upv6.0.0.beta8
 appVersion: "v6.0.0-beta8"

teamspeak-server/templates/teamspeak-server.sfs.yaml

@@ -35,6 +35,27 @@ spec:
               value: "accept"
             - name: TSSERVER_DEFAULT_PORT
               value: "30987"
+          # The voice service is UDP and cannot be probed; probe the TCP
+          # file-transfer port instead.
+          livenessProbe:
+            tcpSocket:
+              port: file-transfer
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            tcpSocket:
+              port: file-transfer
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
+          startupProbe:
+            tcpSocket:
+              port: file-transfer
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 30
           resources:
             requests:
               cpu: "0.2"

template-chart/values.yaml

@@ -15,7 +15,6 @@ xxx:
     httpGet:
       path: /
       port: http
-    initialDelaySeconds: 10
     periodSeconds: 10
     timeoutSeconds: 5
     failureThreshold: 3
@@ -23,18 +22,18 @@ xxx:
     httpGet:
       path: /
       port: http
-    initialDelaySeconds: 10
     periodSeconds: 10
     timeoutSeconds: 5
     failureThreshold: 3
+  # The startup probe gates liveness/readiness, so those need no initialDelaySeconds.
+  # Startup budget = periodSeconds * failureThreshold = 150s.
   startupProbe:
     httpGet:
       path: /
       port: http
-    initialDelaySeconds: 30
-    periodSeconds: 10
+    periodSeconds: 5
     timeoutSeconds: 5
-    failureThreshold: 3
+    failureThreshold: 30
   securityContext:
     pod:
       runAsNonRoot: true

urlaubsverwaltung/Chart.yaml

@@ -3,5 +3,5 @@ name: urlaubsverwaltung
 description: A Helm chart to deploy urlaubsverwaltung on Kubernetes
 type: application
 
-version: 1.5.0+up6.5.0
+version: 2.0.0+up6.5.0
 appVersion: 6.5.0

urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml

@@ -113,7 +113,6 @@ spec:
             httpGet:
               port: 8080
               path: /actuator/health/readiness
-            initialDelaySeconds: 10
             periodSeconds: 5
             failureThreshold: 3
             successThreshold: 1
@@ -122,9 +121,17 @@ spec:
             httpGet:
               port: 8080
               path: /actuator/health/liveness
-            initialDelaySeconds: 20
             periodSeconds: 10
             failureThreshold: 3
             successThreshold: 1
             timeoutSeconds: 5
+          # The startup probe gates liveness/readiness. Spring Boot startup
+          # (JVM + Liquibase migrations) gets a budget of 10s * 30 = 300s.
+          startupProbe:
+            httpGet:
+              port: 8080
+              path: /actuator/health/liveness
+            periodSeconds: 10
+            failureThreshold: 30
+            timeoutSeconds: 5
       restartPolicy: Always

voucher-vault/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart to deploy VoucherVault on Kubernetes
 
 type: application
 
-version: 1.3.0+up1.27.4
+version: 2.0.0+up1.27.4
 appVersion: "1.27.4"
 
 maintainers:

voucher-vault/values.yaml

@@ -13,10 +13,29 @@ voucherVault:
       cpu: 1
       memory: 384Mi
       ephemeral-storage: 100Mi
-  # TODO: Refine liness, readiness, startup probes
-  livenessProbe: null
-  readinessProbe: null
-  startupProbe: null
+  # "/" answers with a redirect for anonymous users, which httpGet treats as success.
+  livenessProbe:
+    httpGet:
+      path: /
+      port: http
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  readinessProbe:
+    httpGet:
+      path: /
+      port: http
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
+  startupProbe:
+    httpGet:
+      path: /
+      port: http
+    periodSeconds: 5
+    timeoutSeconds: 5
+    failureThreshold: 30
   securityContext:
     pod:
       runAsNonRoot: true

zipline/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.3.0+up4.6.4
+version: 2.0.0+up4.6.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

zipline/templates/zipline.sfs.yaml

@@ -44,6 +44,12 @@ spec:
             - name: "zipline-server"
               containerPort: 3000
               protocol: TCP
+          livenessProbe:
+            {{- toYaml .Values.zipline.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.zipline.readinessProbe | nindent 12 }}
+          startupProbe:
+            {{- toYaml .Values.zipline.startupProbe | nindent 12 }}
           volumeMounts:
             - name: zipline-volume
               mountPath: /zipline/uploads

zipline/values.yaml

@@ -7,6 +7,31 @@ config:
   domain: null
   maxUploadFileSize: 30m
 zipline:
+  # Zipline v4 exposes /api/healthcheck (checks server and database health);
+  # the endpoint is enabled by default (config.features.healthcheck).
+  livenessProbe:
+    httpGet:
+      path: /api/healthcheck
+      port: zipline-server
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  readinessProbe:
+    httpGet:
+      path: /api/healthcheck
+      port: zipline-server
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+  # The startup probe gates liveness/readiness. Zipline runs database
+  # migrations on startup, so grant a generous budget: 10s * 30 = 300s.
+  startupProbe:
+    httpGet:
+      path: /api/healthcheck
+      port: zipline-server
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 30
   resources:
     requests:
       cpu: 0.1