127.0.0.1:15020                                  HEALTHY                  agent
10.244.0.156:9402                                HEALTHY                  outbound|9402||cert-manager-istio-csr-metrics.cert-manager.svc.cluster.local
10.244.0.156:6443                                HEALTHY                  outbound|443||cert-manager-istio-csr.cert-manager.svc.cluster.local

		expectedHTTPEvents := [4]*ProbeEvent{
			{Healthy: true},
			{Healthy: false},
			{Healthy: true},
			{Healthy: false},
		}

		eventNum := atomic.NewInt32(0)
		go httpHealthChecker.PerformApplicationHealthCheck(func(event *ProbeEvent) {
			if event.Healthy != expectedHTTPEvents[eventNum.Load()].Healthy {
				t.Errorf("tcp: got event healthy: %v at idx %v when expected healthy: %v",

		// probe target
		healthy, err := w.prober.Probe(w.config.ProbeTimeout)
		if healthy.IsHealthy() {
			healthCheckLog.Debug("probe completed with healthy status")
			// we were healthy, increment success counter
			numSuccess++
			// wipe numFail (need consecutive success)
			numFail = 0
			// if we reached the threshold, mark the target as healthy
			if numSuccess == w.config.SuccessThresh && lastState != lastStateHealthy {

	nodeEligible := h.hs.NodeEligible()
	healthy, lastUpdated := h.hs.isHealthy()
	currentTime := h.hs.clock.Now()

	healthy = healthy && nodeEligible
	resp.Header().Set("Content-Type", "application/json")
	resp.Header().Set("X-Content-Type-Options", "nosniff")
	if !healthy {
		metrics.ProxyHealthzTotal.WithLabelValues("503").Inc()
		resp.WriteHeader(http.StatusServiceUnavailable)
	} else {

		desc                string
		statusCode          int
		expectedProbeResult ProbeResult
		expectedError       error
	}{
		{
			desc:                "Healthy - 200 status code",
			statusCode:          200,
			expectedProbeResult: Healthy,
			expectedError:       nil,
		},
		{
			desc:                "Unhealthy - 500 status code",
			statusCode:          500,
			expectedProbeResult: Unhealthy,

	// but not yet healthy can be evicted only if the guarded application is not
	// disrupted (status.currentHealthy is at least equal to status.desiredHealthy).
	// Healthy pods will be subject to the PDB for eviction.
	//
	// AlwaysAllow policy means that all running pods (status.phase="Running"),
	// but not yet healthy are considered disrupted and can be evicted regardless

const (
	Healthy   ProbeResult = "HEALTHY"
	Unhealthy ProbeResult = "UNHEALTHY"
	Unknown   ProbeResult = "UNKNOWN"
)

func (p *ProbeResult) IsHealthy() bool {
	return *p == Healthy
}

type HTTPProber struct {
	Config    *v1alpha3.HTTPHealthCheckConfig
	Transport *http.Transport
}

var _ Prober = &HTTPProber{}

func NewHTTPProber(cfg *v1alpha3.HTTPHealthCheckConfig, ipv6 bool) *HTTPProber {

	// health checks are enabled.
	// If this annotation is present, a WorkloadEntry with the condition Healthy=False or Healthy not set
	// should be treated as unhealthy and not sent to proxies
	WorkloadEntryHealthCheckAnnotation = "proxy.istio.io/health-checks-enabled"

	// ConditionHealthy defines a status field to declare if a WorkloadEntry is healthy or not
	ConditionHealthy = "Healthy"

		poolIDL, setIDL)
	erasureSetReadHealthMD = NewGaugeMD(erasureSetReadHealth,
		"Health of the erasure set in a pool for read operations (1=healthy, 0=unhealthy)",
		poolIDL, setIDL)
	erasureSetWriteHealthMD = NewGaugeMD(erasureSetWriteHealth,
		"Health of the erasure set in a pool for write operations (1=healthy, 0=unhealthy)",
		poolIDL, setIDL)
)

func b2f(v bool) float64 {
	if v {
		return 1
	}

type HealthEvent struct {
	// whether or not the agent thought the target is healthy
	Healthy bool `json:"healthy,omitempty"`
	// error message propagated
	Message string `json:"errMessage,omitempty"`
}

type HealthCondition struct {
	proxy     *model.Proxy
	entryName string
	condition *v1alpha1.IstioCondition
}

// Controller knows how to update health status of a workload.
type Controller struct {
	stateStore *state.Store