OpenFGA command to run health checks (useful for docker compose)

[rhamzeh]

Suggested by: @MidasLamb on Discord
Summary: Currently, there is no way to do a healthcheck of openfga in docker compose from within the image itself

Possible Solutions:

1. Bundle curl into the docker image

• How it helps: It would allow calling our http endpoint for healthcheck requests
• Cons: increased size and attack vector due to more bundled tooling

  healthcheck:
    test: ["CMD", "curl", "-X", "GET", "-d", "'{\"service\":\"openfga.v1.OpenFGAService\"}'" http://localhost:8080/healthz"]
    interval: 10s
    timeout: 20s
    retries: 5

2. Bundle grpc tooling into the docker image

• How it helps: It would allow calling our grpc endpoint for healthcheck requests, it would be consistent with other CNCF projects that utilize grpc
• Cons: increased size and attack vector due to more bundled tooling

  healthcheck:
    test: ["CMD", "grpcurl", "-plaintext", "-d", "'{\"service\":\"openfga.v1.OpenFGAService\"}'" localhost:8081 grpc.health.v1.Health/Check"]
    interval: 10s
    timeout: 20s
    retries: 5

3. Expose a command line (like run, for example is-healthy or check-health)

• How it helps: it would re-use the plumbing we have for the grpc/http endpoint, it wouldn't need additional tools to be installed
• Cons: Why when standard tooling is available?

  healthcheck:
    test: ["CMD", "openfga", "is-healthy"]
    interval: 10s
    timeout: 20s
    retries: 5

What we care about?

• Not re-inventing the wheel
• Following conventions established by other projects in the CNCF and the OSS world
• Reducing security and maintenance impact
• Satisfying the use-case

Let's have a discussion on the best way forward here and start an issue once we reach a decision so that we can move forward

[jon-whit]

In a future release of OpenFGA the OpenFGA container will bundle a grpc-health-probe. This is the defacto standard way of health probes for gRPC based services, and since OpenFGA is a gRPC server with an HTTP proxy ontop of it, I believe this is a good approach. You cannot run OpenFGA without the gRPC server running (notice you cannot disable the gRPC server), and so container based health probes using grpc-health-probe is a a good approach.

This approach is also the defacto standard for the Kubernetes ecosystem and gRPC services as well:
https://kubernetes.io/blog/2018/10/01/health-checking-grpc-servers-on-kubernetes/

[jon-whit]

See openfga/openfga#548