* fix(proxy): use events endpoint (not cluster id) for the readyz NATS check
The proxy readiness handler passed Events.Cluster (the cluster ID) to
NewNatsCheck, which forwards it to nats.Connect as an address. NATS then tried
to resolve the cluster ID as a host name and always failed, so /readyz reported
the proxy as not ready regardless of NATS reachability. Every other service
passes Events.Endpoint; the proxy now does too.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Walter <david.walter@kiteworks.com>
* test: drop now-passing proxy readiness expected-failure
The proxy /readyz fix makes serviceAvailabilityCheck.feature:115 ("check default
services readiness (graph, idp, proxy)") pass, so remove it from the expected
failures. The auth-bearer health/readiness entries (:124, :135) remain, as they
are a separate part of #10661 not addressed here.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Walter <david.walter@kiteworks.com>
---------
Signed-off-by: David Walter <david.walter@kiteworks.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TLS for the services can be configure by setting the "OCIS_HTTP_TLS_ENABLED",
"OCIS_HTTP_TLS_CERTIFICATE" and "OCIS_HTTP_TLS_KEY" environment variables.
Currently the ocis proxy is this only service that directly accesses backend
services. It determines whether to use TLS or not by looking a the new registry
metadata "use_tls". As specific CA Cert for certificate verification
can be set with the "PROXY_HTTPS_CACERT" environment variable.
