Back to Checks
kubernetes

Pod containers have liveness probes configured

core_liveness_probe_configured
Service: coreSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:KubernetesPod

Ensure each regular pod container has a liveness probe configured to detect and restart unhealthy containers.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without liveness probes, failed containers may remain running causing degraded service or resource waste.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_liveness_probe_configured

Recommendation

Add and tune liveness probes for containers to allow Kubernetes to detect and restart unhealthy containers.

Remediation

CLI

kubectl patch deployment/<name> -n <namespace> --type='json' -p='[{"op":"add","path":"/spec/template/spec/containers/0/livenessProbe","value":{"httpGet":{"path":"/healthz","port":8080},"initialDelaySeconds":10,"periodSeconds":10}}]'

NativeIaC

# Example: add a livenessProbe to your container spec
livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 10
  periodSeconds: 10

Other

1Edit the Pod/Deployment manifest and add a `livenessProbe` to each container.
2Tune `initialDelaySeconds`, `periodSeconds` and failure thresholds to your app.

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_liveness_probe_configured(Check):
    """Check whether regular pod containers have liveness probes configured."""

    def execute(self) -> list[Check_Report_Kubernetes]:
        """Execute the Kubernetes pod liveness probe check.

        Returns:
            List of check reports for Kubernetes pods.
        """
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Pod {pod.name} has liveness probes configured for all regular containers."

            for container in (pod.containers or {}).values():
                if not container.liveness_probe:
                    report.status = "FAIL"
                    report.status_extended = f"Pod {pod.name} container {container.name} does not have a liveness probe configured."
                    break

            findings.append(report)

        return findings

References