"/livez", "/readyz", "/healthz",
					"/version", "/version/",
					"/openapi", "/openapi/*",
					"/api", "/api/*",
					"/apis", "/apis/*",
				).RuleOrDie(),
			},
		},
		{
			// a role which provides minimal read access to the monitoring endpoints
			// (i.e. /metrics, /livez/*, /readyz/*, /healthz/*, /livez, /readyz, /healthz)

				{name: "kube-apiserver", url: "https://127.0.0.1:1111/healthz"},
				{name: "kube-controller-manager", url: "https://127.0.0.1:2222/healthz"},
				{name: "kube-scheduler", url: "https://127.0.0.1:3333/healthz"},
			},
		},
		{
			name: "default ports",
			cfg:  &kubeadmapi.ClusterConfiguration{},
			expected: []controlPlaneComponent{
				{name: "kube-apiserver", url: "https://127.0.0.1:6443/healthz"},

## Liveness probe

This probe always responds with '200 OK'. Only fails if 'etcd' is configured and unreachable. When liveness probe fails, Kubernetes like platforms restart the container.

```
livenessProbe:
  httpGet:
    path: /minio/health/live
    port: 9000
    scheme: HTTP
  initialDelaySeconds: 120

          MYSQL_RANDOM_ROOT_PASSWORD: "yes"
        ports:
          - 9910:3306
        options: >-
          --health-cmd "mysqladmin ping -ugorm -pgorm"
          --health-interval 10s
          --health-start-period 10s
          --health-timeout 5s
          --health-retries 10

    steps:
    - name: Set up Go 1.x
      uses: actions/setup-go@v4
      with:
        go-version: ${{ matrix.go }}

- Fixes #115825. Kube-proxy will now include the `healthz` state in its response to the LB HC as to avoid indicating to the LB that it should use the node in question when Kube-proxy is not healthy. ([#111661](https://github.com/kubernetes/kubernetes/pull/111661), [@alexanderConstantinescu](https://github.com/alexanderConstantinescu)) [SIG Network]

// app probers.
func FormatProberURL(container string) (string, string, string) {
	return fmt.Sprintf("/app-health/%v/readyz", container),
		fmt.Sprintf("/app-health/%v/livez", container),
		fmt.Sprintf("/app-health/%v/startupz", container)
}

// Run opens a the status port and begins accepting probes.
func (s *Server) Run(ctx context.Context) {

				t.Fatal(err)
			}
			health, output, err := prober.Probe(req, 1*time.Second)
			if test.health == probe.Unknown && err == nil {
				t.Errorf("case %d: expected error", i)
			}
			if test.health != probe.Unknown && err != nil {
				t.Errorf("case %d: unexpected error: %v", i, err)
			}
			if health != test.health {
				t.Errorf("case %d: expected %v, got %v", i, test.health, health)
			}

}

// UpdateHealth updates the associated WorkloadEntries health status
// based on the corresponding health check performed by istio-agent.
func (s *Store) UpdateHealth(proxyID, entryName, entryNs string, condition *v1alpha1.IstioCondition) error {
	// get previous status
	cfg := s.store.Get(gvk.WorkloadEntry, entryName, entryNs)
	if cfg == nil {
		return fmt.Errorf("failed to update health status for %v: WorkloadEntry %v not found", proxyID, entryNs)
	}

// limitations under the License.

package health

import (
	"istio.io/api/meta/v1alpha1"
	"istio.io/istio/pilot/pkg/model/status"
	"istio.io/istio/pkg/config"
)

// IsEligibleForHealthStatusUpdates returns true if a given WorkloadEntry
// is allowed to receive health status updates sent by an Istio Proxy.
//
// Consider a workload eligible for health status updates as long as the

issue:
- 36390

releaseNotes:
- |
  **Improved** istio-agent health probe rewrite to not re-use connections, mirring Kubernetes' probing behavior.

upgradeNotes:
- title: Health Probes will no longer re-use connections
  content: |
    Health probes using the istio-agent [health probe rewrite](https://istio.io/latest/docs/ops/configuration/mesh/app-health-check/) will