diff --git a/pkg/clouds/pulumi/kubernetes/caddy.go b/pkg/clouds/pulumi/kubernetes/caddy.go index 857b6493..825868ec 100644 --- a/pkg/clouds/pulumi/kubernetes/caddy.go +++ b/pkg/clouds/pulumi/kubernetes/caddy.go @@ -90,11 +90,21 @@ func DeployCaddyService(ctx *sdk.Context, caddy CaddyDeployment, input api.Resou } defaultCaddyFileEntryStart := `http:// {` + // Default catch-all serves a hard 503 instead of a static "welcome" page. + // Rationale: when all Services with a `simple-container.com/caddyfile-entry` + // annotation for a given Host vanish (e.g. a cascade-deletion from a + // namespace Replace gone wrong), the request used to fall through to a + // `file_server /etc/caddy/pages` block and respond with HTTP 200 + "Default + // page". External monitoring saw healthy 200s while every backend was gone. + // 503 + Retry-After makes the absence of routes loud: CDNs fail over, + // uptime checks alert, oncall sees it. defaultCaddyFileEntry := ` import gzip - import handle_static - root * /etc/caddy/pages - file_server + header Cache-Control "no-store" + header Retry-After "60" + respond "503 Service Unavailable

503 Service Unavailable

No backend route is configured for this host.

If you are an operator, verify the Service has the simple-container.com/caddyfile-entry annotation and that Caddy has been rolled.

" 503 { + close + } ` // if caddy must respect SSL connections only useSSL := caddy.UseSSL == nil || *caddy.UseSSL