Bind tentacle healthz to loopback on Windows to stop firewall prompt#422
Merged
Conversation
The health-check server bound http://*:port/ (all interfaces). On Windows that pops a Defender Firewall "allow access" prompt, and the blue-green versioned layout gives each upgrade a new binary path, so the path-keyed firewall prompts on every upgrade -- bad for unattended SYSTEM-service agents. Default the bind host to loopback on Windows (127.0.0.1 -- firewall-exempt, and the only Windows consumer is the upgrade script, which probes 127.0.0.1). Keep "*" on non-Windows so Linux/docker localhost probes and the Kubernetes agent's kubelet httpGet liveness/readiness probes (over the pod network) still work; the agent's Helm chart sets HealthCheckBindHost=+ explicitly. Configurable via Tentacle__HealthCheckBindHost.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Operator report: a Windows Defender Firewall "allow this app to communicate" prompt appears on every upgrade of a SYSTEM-service Polling Tentacle.
Root cause: the health-check server binds
http://*:{port}/(all interfaces) —HealthCheckServer.cs. Windows prompts when an app opens a listening socket on a public interface, and the blue-green versioned layout gives each upgrade a new binary path, which the path-keyed firewall treats as a new app → fresh prompt every upgrade. For an unattended SYSTEM service, the prompt may even leave the new binary's listener blocked.Fix: default the bind host to loopback on Windows (
127.0.0.1) — firewall-exempt, and the only Windows consumer of healthz is the upgrade script, which probes127.0.0.1. Keep*on non-Windows so Linux/dockerlocalhosthealth checks and the Kubernetes agent's kubelethttpGetliveness/readiness probes (over the pod network) still work — the agent's Helm chart setsTentacle__HealthCheckBindHost: "+"explicitly. Configurable viaTentacle__HealthCheckBindHost.Takes effect on the upgrade to 1.8.16 (the new binary binds loopback → no prompt).
Test plan
HealthCheckServer+TentacleApptests green; new pins: OS-conditional default (Win→127.0.0.1, else*) + explicit-loopback reachable via127.0.0.1helm templaterendersTentacle__HealthCheckBindHost: "+"for the K8s agent