kura: add gRPC health checking (grpc.health.v1.Health) service + route it on the single-host ingress

Background

Kura’s gRPC server (kura/src/reapi/mod.rs:133-136) registers only the four Bazel REAPI services — Capabilities, ActionCache, ContentAddressableStorage, ByteStream. It does not register a grpc.health.v1.Health service (nor server reflection). Health is currently exposed only over HTTP (/up, /ready on the axum router).

Raised in review of #11356 (single-host gRPC + HTTP): https://github.com/tuist/tuist/pull/11356#discussion_r3440813039

Motivation

The standard gRPC health checking protocol (grpc.health.v1.Health/Check / Watch) is how gRPC-native infrastructure checks a gRPC server: Envoy/Linkerd sidecars, gRPC load balancers, and grpc_health_probe (k8s gRPC liveness/readiness). Today none of that can health-check Kura’s gRPC port — they’d have to fall back to the HTTP probes.

No current breakage: stock Bazel doesn’t probe gRPC health on the remote cache, and the CLI-generated .bazelrc.tuist doesn’t enable it. This is forward-looking robustness.

Scope (two coupled parts)

1. Kura (Rust): register a grpc.health.v1.Health service on the tonic server (e.g. via the tonic-health crate), reporting SERVING once the runtime is ready (and ideally NOT_SERVING while draining, mirroring /ready). Decide whether to also add server reflection.

2. kura-controller (Go): route the health (and reflection) path prefix(es) to the gRPC backend on the single-host ingress. Currently grpcREAPIPathPrefixes only routes /build.bazel.remote.execution.v2. and /google.bytestream.; a /grpc.health.v1.Health/Check request would fall through to the HTTP / location and get proxy_pass over HTTP/1.1, corrupting framing on the h2 stream. Add /grpc\. (covering grpc.health.v1. and grpc.reflection.*) so health/reflection reach the gRPC backend. The code comment in grpcREAPIPathPrefixes already flags this.

Acceptance

• grpc.health.v1.Health/Check returns SERVING (and reflects readiness/drain state).
• Reachable through the single-host ingress (grpcs://<host>), verified end-to-end.
• Decide and document whether reflection is also enabled.

References

• #11356 (single-host gRPC routing; grpcREAPIPathPrefixes)

No GitHub comments yet.