Selfhosted: Frontend's readiness probe fails, pod does not start

Community Support Server Deployment
, , ,
1

I could not get selfhosted temporal to deploy, the default readiness probe of grpc on 7233 does not pass.

It might be due to k8s’s grpc check not supporting tls, not 100% sure on that though, I was using helm chart of version v0.73, and that did not have readiness probe.

I have set requireClientAuth: true in tls config when doing helm install. so this is my whole tls section:
```
tls:
frontend:
client:
rootCaFiles:
- /etc/temporal/certs/ca.cert
serverName: temporal-frontend.temporal.svc.cluster.local
server:
certFile: /etc/temporal/certs/cluster.pem
clientCaFiles:
- /etc/temporal/certs/ca.cert
keyFile: /etc/temporal/certs/cluster.key
requireClientAuth: true
internode:
client:
rootCaFiles:
- /etc/temporal/certs/ca.cert
serverName: temporal-frontend.temporal.svc.cluster.local
server:
certFile: /etc/temporal/certs/cluster.pem
clientCaFiles:
- /etc/temporal/certs/ca.cert
keyFile: /etc/temporal/certs/cluster.key
requireClientAuth: true
```

2

This usually breaks because the kubelet gRPC readiness probe can hit 7233, but it cannot present a client cert. With requireClientAuth: true on the frontend listener, the probe gets rejected before the service is considered ready.

I’d check the frontend readiness probe first and move it off the mTLS gRPC path, either use an HTTP health endpoint or a probe that runs with the same certs the frontend expects. If you keep the stock gRPC probe on 7233, it will keep failing even when Temporal itself is healthy.