Problem

When SSO is deployed with Istio mutual TLS enabled, the normal liveness checks will not work i.e. these:

livenessProbe:
  httpGet:
    path: /ping
    port: 4180
    scheme: HTTP
readinessProbe:
  httpGet:
    path: /ping
    port: 4180
    scheme: HTTP

If mutual TLS is enabled, http and tcp health checks from the kubelet will not work since the kubelet does not have Istio-issued certificates.

Further reading here: https://istio.io/help/faq/security/#k8s-health-checks

Solution

The above link suggests using a liveness command, e.g. by installing curl and using that instead. curl is not currently available in the built image, so this PR adds it.

It would then be possible to use SSO in a cluster with Istio mutual TLS enabled, i.e. the checks can then be changed to

livenessProbe:
  exec:
    command:
      - curl
      - -f
      - http://localhost:4180/ping
readinessProbe:
  exec:
    command:
      - curl
      - -f
      - http://localhost:4180/ping