🐛 Supervise background processes in AuthBridge entrypoints

[huang195]

Summary

• Replace fragile exec envoy pattern with wait -n supervision loop in both entrypoint scripts
• Shell stays PID 1 and monitors all critical background processes (go-processor, spiffe-helper, envoy)
• If any critical process exits, the container terminates so Kubernetes restarts it
• Client-registration remains unmonitored (one-shot, failure is non-fatal by design)

Fixes #278

Test plan

• Build both Docker images (Dockerfile.envoy, Dockerfile.authbridge) and verify they start correctly
• Deploy to Kind cluster, verify all processes are running
• Kill go-processor inside the envoy-proxy container — container should restart
• Kill go-processor inside the combined sidecar container — container should restart
• Send SIGTERM to the container — all processes should terminate cleanly (graceful shutdown)

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[cwiklik]

Review Summary

Great fix for process supervision — replacing exec envoy with a wait -n loop correctly addresses the invisible background process failure problem (#278). The pattern is clean: shell stays PID 1, monitors critical children, trap handles graceful shutdown.

However, entrypoint-envoy.sh will fail at runtime because its container image (Dockerfile.envoy) is based on ubi9/ubi-minimal which does not include bash.

Areas reviewed: Shell scripts, Dockerfiles (base image compatibility)
Commits: 1 commit, signed-off ✓
CI status: all passing (Shell Script Lint doesn't catch runtime availability)

[cwiklik]

must-fix: #!/bin/bash + wait -n will fail at runtime. Dockerfile.envoy uses ubi9/ubi-minimal which only installs ca-certificates — no bash. The container will crash on startup.

Two options:

1. Add microdnf install -y bash to Dockerfile.envoy
2. Rewrite using POSIX sh (e.g., background both processes, poll with kill -0 in a loop)

Option 1 is simpler but adds ~5MB to the image. Option 2 keeps the minimal image but is more complex.

entrypoint-authbridge.sh is fine — Dockerfile.authbridge is based on envoyproxy/envoy (Debian), which includes bash.

[huang195]

ubi9/ubi-minimal ships with bash 5.1.8 out of the box — no microdnf install needed:

$ podman run --rm ubi9/ubi-minimal bash --version
GNU bash, version 5.1.8(1)-release (aarch64-redhat-linux-gnu)

Verified end-to-end on a Kind cluster: built the image, deployed the quickstart demo, confirmed both processes start under the supervision loop, killed go-processor inside the container, and watched Kubernetes restart it. No issues.

[cwiklik]

👍 Clean pattern — CRITICAL_PIDS accumulation, wait -n, trap with cleanup. Client-registration correctly excluded from monitoring. The ${SPIRE_ENABLED:-} default is a good defensive fix too.

[pdettori]

One additional issue not covered by prior reviews: the envoy entrypoint has an uninitialized-variable race in the cleanup handler.

Areas reviewed: Signal handling, variable lifecycle under set -u
Commits: 1 commit, signed-off ✓
CI status: all passing

[pdettori]

must-fix: GO_PROCESSOR_PID and ENVOY_PID are referenced here but not yet defined when the trap is installed (line 15). If SIGTERM arrives before both PID assignments (lines 20 and 29), set -u triggers a fatal unbound-variable error that bypasses || true — the error occurs at variable expansion, before kill runs.

Initialize both to empty before the trap, matching the CRITICAL_PIDS="" pattern in entrypoint-authbridge.sh:

GO_PROCESSOR_PID=""
ENVOY_PID=""

cleanup() {
  ...
}
trap cleanup TERM INT

My mistake — ubi9/ubi-minimal ships with bash 5.1.8 out of the box. Verified by PR author on a Kind cluster end-to-end. Dismissing and approving.

[cwiklik]

Review Summary (updated)

My earlier REQUEST_CHANGES was incorrect — ubi9/ubi-minimal ships with bash 5.1.8 out of the box. Apologies for the false flag.

The supervision pattern is solid: shell stays PID 1, wait -n monitors critical children, trap handles graceful SIGTERM shutdown. Both entrypoint scripts are consistent in approach. Client-registration correctly excluded from monitoring (one-shot, non-fatal). The ${SPIRE_ENABLED:-} default fixes are a good defensive improvement.

Author verified end-to-end on Kind: built image, deployed quickstart, killed go-processor, confirmed Kubernetes restart.

Areas reviewed: Shell scripts, Dockerfiles
Commits: 1 commit, signed-off ✓
CI status: all passing