#!/bin/bash
# Readiness of kube-apiserver = the process LISTENS: its secure port (6443 unless
# --secure-port says otherwise) accepts a TCP connection on the bind address
# (--bind-address; a wildcard is checked on 127.0.0.1).
#
# Measured 23.09.2026 in a throwaway container (1.34.7): without a reachable
# etcd the apiserver binds 6443 within seconds, then exits after about 20 s
# ("Error creating leases: error creating storage factory: context deadline
# exceeded"). So this readiness does not wait for etcd -- quorum must never
# bind a node's boot transition or the s6-rc lock -- and a missing etcd shows
# up as deaths (.permafail stops the loop after five in 120 s), not as a
# hanging boot. Whether the API answers (/readyz) is measured by monitoring.
#
# The flags come from /etc/default/kube-apiserver (DAEMON_ARGS), the same file
# run-script-daemon sources. Source it before "set -u": it may reference
# variables that are unset here.
DAEMON_ARGS=
[ -r /etc/default/kube-apiserver ] && . /etc/default/kube-apiserver 2>/dev/null
set -u
flag() { printf '%s\n' $DAEMON_ARGS | sed -n "s/^$1=//p" | tail -n 1; }
port=$(flag --secure-port); port=${port:-6443}
host=$(flag --bind-address)
case "$host" in ''|0.0.0.0|'::'|'[::]') host=127.0.0.1 ;; esac
if ! { exec 3<>"/dev/tcp/$host/$port"; } 2>/dev/null; then
  echo "port $host:$port does not accept connections"
  exit 1
fi
exec 3<&- 3>&-
exit 0
