Metadata Healthcheck is a node-side agent that converts metadata healthcheck declarations into HAProxy probes and reports stable state changes to a compatible control API.
PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.
Upstream: rancher/healthcheck. This GitHub fork retains the upstream Git history, authorship, dates, and license notices unchanged; PastureStack maintenance is consolidated into one commit after the preserved upstream boundary.
The default metadata endpoint is the control plane's link-local endpoint, http://169.254.169.250/2015-12-19. This avoids depending on a deployment-specific DNS alias during system-stack upgrades. Override it with --metadata-url only when the compatible metadata service is exposed elsewhere.
Control API reporting requires:
PLATFORM_URLPLATFORM_ACCESS_KEYPLATFORM_SECRET_KEY
The agent reads /services, /containers, /self/host, and the long-polling /version endpoint. It creates serviceEvents with healthcheckUuid, reportedHealth, and externalTimestamp fields.
The release container runs the agent and its private HAProxy process. It does not require a Docker socket or additional Linux capabilities, but it currently runs as root inside the container so it can validate, install, and reload HAProxy configuration before HAProxy drops privileges.
For managed system stacks, the container includes a narrow compatibility adapter for the per-instance credential names emitted by the compatible control plane. Operators should continue to configure PLATFORM_*; explicit neutral values take precedence. TCP 42 is used only as an un-published container readiness endpoint for the system-stack health monitor.
docker run --rm \
--network platform-system \
-e PLATFORM_URL=https://control.example \
-e PLATFORM_ACCESS_KEY=replace-me \
-e PLATFORM_SECRET_KEY=replace-me \
ghcr.io/pasturestack/metadata-healthcheck:v0.3.15 \
--metadata-url http://169.254.169.250/2015-12-19Use scoped runtime credentials and route the link-local metadata address only inside the managed host network. Do not place credentials in an image, Compose file committed to Git, or command history.
make test
make validate
make build
IMAGE=ghcr.io/pasturestack/metadata-healthcheck:v0.3.15 make integrationThe integration target verifies the HAProxy process and Unix socket, metadata long polling, authenticated service-event reporting, and the container argument contract on an isolated Docker network.
Do not use production credentials for development. See SECURITY.md for reporting guidance and COMPATIBILITY.md for the preserved protocol boundary.
This project is distributed under the Apache License 2.0. See LICENSE, ORIGIN.md, and THIRD_PARTY_NOTICES.md.