🔐 Fixing Service Account Key Creation Constraint in Google Cloud Console

When working with Google Cloud, you might encounter this frustrating error while trying to create a service account key:

The organization policy constraint ‘iam.disableServiceAccountKeyCreation’ is enforced. This constraint disables the creation of new service account keys

This constraint is typically enforced at the organization level as a security measure, but it can block legitimate use cases. In this guide, I’ll walk you through the solution to bypass this policy without using the CLI.

🤔 Why Does This Happen?

Organizations enforce the iam.disableServiceAccountKeyCreation policy to:

• Prevent unauthorized key creation
• Reduce credential sprawl
• Enforce security best practices

However, legitimate administrators or service accounts sometimes need to create keys. The solution requires appropriate IAM roles.

✅ Solution: Step-by-Step Guide

Step 1: Navigate to Google Cloud Console

1. Go to Google Cloud Console
2. Click on the project selector dropdown at the top (showing your current project name)
3. Select the Organization you need to modify (if you’re at the project level, you need to go to the organization level)

Step 2: Access More Actions

1. Click the “More Actions” button (the three vertical dots ⋮) on the right side of the project/organization selector
2. A dropdown menu will appear with various options

Step 3: Navigate to IAM Permissions

1. From the dropdown menu, click on “IAM & Admin” or “IAM/PERMISSIONS”
2. This will take you to the IAM roles management page

Step 4: Assign Necessary Roles

1. Find your user account in the list of members
2. Click on the Edit button (pencil icon) next to your user
3. In the side panel that appears, click ”+ Add Another Role”
4. Add these two roles:
   • Organization Policy Administrator — required to manage organization policies
   • Organization Administrator — grants administrative access at the organization level

⚠️ Important: These roles must be assigned at the organization level, not the project level. If you’re at the project level, the “Organization Policy Administrator” option won’t appear in the role list.

Step 5: Access Organization Policies

After assigning the roles (wait a few moments for the roles to propagate):

1. Click on “Organization Policies” in the left sidebar under IAM & Admin

   OR

   Repeat Steps 1-2 above and select “Organization Policies” from the dropdown menu

Step 6: Edit the Service Account Key Creation Policy

1. On the Organization Policies page, use the search bar to find: “Disable service account key creation”
2. Click on the matching policy
3. Click the “Edit Policy” button
4. Modify the rule to either:
   • Remove the policy entirely (if you want to allow all service account key creation)
   • Add exceptions for specific service accounts or projects
   • Change the enforcement level to “advisory only” instead of “enforced”
5. Click “Save” to apply changes

Step 7: Verify the Fix

1. Navigate back to your project
2. Go to IAM & Admin → Service Accounts
3. Select your service account
4. Go to the Keys tab
5. Click “Add Key” → “Create new key”
6. You should now be able to create a new key!

🎯 Alternative Approaches

If you need a more granular solution:

Option A: Exempt Specific Projects

Instead of disabling the policy entirely, you can add exemptions:

1. In Organization Policies, edit the “Disable service account key creation” policy
2. Under Enforcement, add exceptions for specific projects or service accounts
3. This allows key creation only where needed

Option B: Use Service Account Impersonation

Instead of creating new keys:

1. Keep the constraint enabled
2. Use Service Account Impersonation with short-lived credentials
3. Generate access tokens via the IAM API

Option C: Manage Keys via Terraform/IaC

If using Infrastructure as Code, the policy might be less restrictive for automated deployments through trusted CI/CD pipelines.

🔒 Security Best Practices

Once you’ve enabled service account key creation, remember:

✅ Limit key creation — Only create keys when necessary
✅ Rotate regularly — Delete unused keys and rotate active ones quarterly
✅ Use minimal permissions — Apply principle of least privilege to service accounts
✅ Monitor key usage — Check audit logs for service account key usage
✅ Consider alternatives — Use Workload Identity or service account impersonation when possible

🧪 Testing Your Setup

After making these changes:

# List service accounts in your project
gcloud iam service-accounts list

# Create a key for a service account (if using gcloud CLI)
gcloud iam service-accounts keys create key.json \
  --iam-account=SERVICE_ACCOUNT_EMAIL@PROJECT_ID.iam.gserviceaccount.com

# Verify key was created
gcloud iam service-accounts keys list \
  --iam-account=SERVICE_ACCOUNT_EMAIL@PROJECT_ID.iam.gserviceaccount.com

🚨 Common Issues

“Organization Policy Administrator role not visible”

• Cause: You’re at the project level instead of the organization level
• Solution: Make sure you’re assigning roles at the organization level in IAM & Admin

“Permission denied” after adding roles

• Cause: Role propagation takes time
• Solution: Wait 5-10 minutes and try again, or log out and back in

Policy change not taking effect

• Cause: Cache or role synchronization delay
• Solution: Clear browser cache or use incognito mode to test

📚 Related Resources

• Google Cloud Organization Policies Documentation
• Service Account Best Practices
• Workload Identity Federation

📝 Summary

The iam.disableServiceAccountKeyCreation constraint is a powerful security control, but with the right IAM roles, you can manage it when needed:

1. ✅ Assign yourself Organization Policy Administrator and Organization Administrator roles at the organization level
2. ✅ Navigate to Organization Policies
3. ✅ Edit the “Disable service account key creation” policy
4. ✅ Modify the enforcement rule to suit your needs
5. ✅ Create service account keys as needed

Remember: With great power comes great responsibility — use this capability carefully and monitor key creation activities!

Happy cloud engineering! ☁️

Are you juggling multiple Google Calendars? Perhaps one for work, one for personal life, and another for a side project or a team you’re on. It’s a common scenario, but it often leads to a fragmented view of your time, making it easy to double-book yourself or miss important commitments. What if you could see all your busy times in one central place, without having to make all your private calendars public?

This guide will walk you through setting up a powerful Google Apps Script that automatically syncs your free/busy information from several private calendars to a single, master calendar.

Why You Need This Solution

Imagine these common scenarios:

• The Consultant: You work with multiple clients, each with their own Google Workspace. You need to block off time on your primary work calendar when you have a meeting in a client’s calendar, but you can’t share your client’s calendar publicly.
• The Work-Life Balancer: You want your colleagues to see when you’re busy with a personal appointment (like a doctor’s visit or a parent-teacher conference) without them seeing the actual details of the event. You need to block off the time on your work calendar as simply “Busy”.
• The Team Player: You’re part of a project team, and you need to share your availability with the project manager. Instead of giving them access to your detailed personal and work calendars, you can provide them with a single calendar that only shows when you are free or busy.

This script solves these problems by creating “shadow” events. It looks at your source calendars and, for every event it finds, it creates a corresponding event on your master calendar with a generic title like “Busy”. This way, your availability is accurately reflected everywhere, but the sensitive details of your appointments remain private.

The Synchronization Script

This is the complete Google Apps Script you will be using. You don’t need to understand every line to use it, but it’s provided here for transparency and for those who wish to customize it further.

/**
 * @fileoverview Syncs multiple Google Calendars to a single calendar.
 *
 * This script is designed to sync events from multiple source calendars
 * (including private, unshared calendars via iCal URLs) to a single 
 * destination calendar. It only syncs the free/busy status, creating 
 * "Busy" events on the destination calendar.
 *
 * @version 2.0
 */

// --- START OF CONFIGURATION ---

const SOURCE_CALENDARS = [
  // Example for a shared calendar:
  // { id: 'work_calendar@your_domain.com', type: 'id' }, 
  
  // Example for a private calendar from another account:
  // { id: 'SECRET_ICAL_URL_FROM_ANOTHER_ACCOUNT', type: 'ical' }, 
];

const DESTINATION_CALENDAR_ID = 'YOUR_DESTINATION_CALENDAR_ID@group.calendar.google.com';
const DAYS_IN_PAST = 2;
const DAYS_IN_FUTURE = 30;
const EVENT_TITLE = 'Busy';
const SYNC_TAG = '#gcal_sync';

// --- END OF CONFIGURATION ---

function getSourceCalendar(source) {
  try {
    let calendar = CalendarApp.getCalendarById(source.id);
    if (!calendar && source.type === 'ical') {
      Logger.log(`Subscribing to iCal calendar: ${source.id}`);
      calendar = CalendarApp.subscribeToCalendar(source.id, { hidden: true, selected: false });
    }
    if (!calendar) {
      Logger.log(`Could not find or subscribe to calendar with ID: ${source.id}`);
      return null;
    }
    return calendar;
  } catch (e) {
    Logger.log(`Error accessing or subscribing to calendar ${source.id}: ${e.toString()}`);
    return null;
  }
}

function syncCalendars() {
  const now = new Date();
  const startDate = new Date(now.getTime() - DAYS_IN_PAST * 24 * 60 * 60 * 1000);
  const endDate = new Date(now.getTime() + DAYS_IN_FUTURE * 24 * 60 * 60 * 1000);
  const destinationCalendar = CalendarApp.getCalendarById(DESTINATION_CALENDAR_ID);

  if (!destinationCalendar) {
    Logger.log('Destination calendar not found.');
    return;
  }

  deleteSyncedEvents(destinationCalendar, startDate, endDate);

  SOURCE_CALENDARS.forEach(source => {
    const sourceCalendar = getSourceCalendar(source);
    if (sourceCalendar) {
      syncSingleCalendar(sourceCalendar, destinationCalendar, startDate, endDate);
    } else {
      Logger.log(`Skipping source calendar: ${source.id}`);
    }
  });

  Logger.log('Calendar sync complete.');
}

function deleteSyncedEvents(calendar, startDate, endDate) {
  const syncedEvents = calendar.getEvents(startDate, endDate, { search: SYNC_TAG });
  syncedEvents.forEach(event => {
    try {
      event.deleteEvent();
    } catch (e) {
      Logger.log(`Error deleting event: ${e.toString()}`);
    }
  });
}

function syncSingleCalendar(sourceCalendar, destinationCalendar, startDate, endDate) {
  const events = sourceCalendar.getEvents(startDate, endDate);
  events.forEach(event => {
    if (event.getMyStatus() === CalendarApp.GuestStatus.NO || event.isAllDayEvent()) {
      return;
    }
    try {
      destinationCalendar.createEvent(
        EVENT_TITLE,
        event.getStartTime(),
        event.getEndTime(),
        { description: `Synced from ${sourceCalendar.getName()}\n${SYNC_TAG}` }
      ).setVisibility(CalendarApp.Visibility.PRIVATE);
    } catch (e) {
      Logger.log(`Error creating event: ${e.toString()}`);
    }
  });
}

function createTrigger() {
  const allTriggers = ScriptApp.getProjectTriggers();
  allTriggers.forEach(trigger => {
    if (trigger.getHandlerFunction() === 'syncCalendars') {
      ScriptApp.deleteTrigger(trigger);
    }
  });
  ScriptApp.newTrigger('syncCalendars').timeBased().everyHours(1).create();
  Logger.log('Trigger created successfully.');
}

Step-by-Step Configuration Guide

Here’s how to set up your automated calendar synchronization.

Step 1: Open Google Apps Script and Paste the Code

1. Navigate to script.google.com and click New project.
2. Delete any placeholder code in the Code.gs file.
3. Copy the entire script from the section above and paste it into the editor.
4. Click the save icon and give your project a name, such as “Master Calendar Sync”.

Step 2: Share Your Source Calendars

For the script to read events from calendars you own (or have direct access to), you must share them with the Google account that will run the script. You only need to do this for calendars you configure with type: 'id'. You can skip this for calendars you are syncing via the secret iCal URL.

1. Open Google Calendar.
2. On the left, find a source calendar you want to sync. Hover over it and click the three-dot menu (⋮).
3. Select Settings and sharing.
4. Under the Share with specific people or groups section, click Add people and groups.
5. Enter the email address of the Google account where you are setting up this script.
6. In the permissions dropdown, select See all event details.
7. Click Send. On you destination account, open received Email and click Join shared calendar. Add calendar in new window.
8. Repeat this process for all source calendars that you are syncing by their ID.

Step 3: Configure Your Calendars in the Script

This is the most crucial part. You need to tell the script which calendars to read from and which one to write to by editing the CONFIGURATION section at the top of the script.

Locate the SOURCE_CALENDARS array. This is where you’ll list all the calendars you want to sync from. You can add two types:

Calendars You Own or Have Access To (id): For your primary calendar or any calendar shared with your Google account as described in Step 2.

{ id: 'your.email@gmail.com', type: 'id' }

Private, Unshared Calendars (ical): For calendars from other accounts (like a client’s or a separate personal account).

How to get the iCal URL:

1. In the Google account that owns the private calendar, open Google Calendar.
2. Find the calendar on the left, click the three-dot menu (⋮), and select Settings and sharing.
3. Scroll to Integrate calendar and copy the URL under Secret address in iCal format.
4. Add it to the script like this:

{ id: 'https://calendar.google.com/calendar/ical/..../private-..../basic.ics', type: 'ical' }

Set Your Destination Calendar:

1. Find the DESTINATION_CALENDAR_ID variable.
2. Replace the placeholder value with the ID of the calendar you want all the “Busy” events to be created on. It’s recommended to create a new, separate calendar for this purpose.

Step 4: For Google Workspace Users (Administrator Steps)

If you are using a Google Workspace account (e.g., you@yourcompany.com) and can’t find the “Secret address in iCal format” for a private calendar, your administrator has likely disabled external sharing. You will need to ask your Google Workspace administrator to perform the following steps:

1. Log in to the Google Admin console at admin.google.com.
2. Navigate to Apps > Google Workspace > Calendar.
3. Click on Sharing settings.
4. In the External Sharing options section, choose a setting that allows sharing information. The recommended setting for this use case is “Share all information, but outsiders cannot change calendars”.
5. Click Save.

After the administrator makes this change (it may take a few minutes to apply), the “Secret address in iCal format” will become available in your calendar’s settings page.

Step 5: First Run and Authorization

1. In the Apps Script editor toolbar, ensure the syncCalendars function is selected in the dropdown menu.
2. Click Run.
3. A popup will appear asking for authorization. Click Review permissions.
4. Choose your Google account.
5. You’ll likely see a screen saying “Google hasn’t verified this app”. This is normal for personal scripts. Click Advanced, and then click Go to (your project name) (unsafe).
6. Click Allow to grant the script the necessary permissions to manage your calendars.
7. The script will now run for the first time, syncing your calendars.

Step 6: Set Up Automatic Syncing

To keep your master calendar up-to-date automatically, you need to create a trigger.

1. In the Apps Script editor, select the createTrigger function from the dropdown menu.
2. Click Run. You’ll see a confirmation log once the trigger is created.

That’s it! The script will now run every hour, deleting the old “Busy” events and creating new ones to perfectly reflect the current state of all your source calendars. You now have a single, reliable view of your true availability across all your commitments.

Scientific research is an exciting but complex process. It requires structure, creativity, and careful attention to detail. In this article, I describe my own scientific “flow” — the sequence of steps I follow, and show how artificial intelligence (AI) tools can dramatically improve each stage.

1. My Personal Scientific Flow

My approach to research can be represented as five main stages. Each step logically follows from the previous one, creating a cohesive process — from the birth of an idea to final conclusions.

Here’s what this scheme looks like:

graph TD;
    A[Stage 1: Topic and Hypothesis Formulation] --> B[Stage 2: Deep Literature Review];
    B --> C[Stage 3: Research Planning and Data Collection];
    C --> D[Stage 4: Data Analysis];
    D --> E[Stage 5: Interpretation, Writing, and Publication];

2. AI Application Points in My Flow

AI is not a replacement for the researcher, but a powerful assistant that automates routine tasks, accelerates analysis, and helps identify non-obvious connections. Let’s examine its role at each stage.

Stage 1: Topic and Hypothesis Formulation

At this stage, the main task is to find a relevant and not fully studied problem.

• Tool/Approach: Generative models (ChatGPT, Gemini), trend analysis tools (Scite, ResearchRabbit).
• Tasks: Brainstorming, searching for “white spots” in research, formulating initial hypotheses. You can ask the model: “What are the open questions in the field of [your field] at the intersection with [another field]?”
• Benefits: Acceleration. AI quickly generates dozens of ideas and summarizes the latest publications, which would take days to do manually.

Stage 2: Deep Literature Review

Traditional literature review is one of the most labor-intensive stages.

• Tool/Approach: Retrieval-Augmented Generation (RAG) systems, such as Elicit, Consensus, or specialized AI tools for scientists.
• Tasks: Quick search, summarization, and systematization of dozens and hundreds of scientific articles. A RAG system can answer a specific question (“Which treatment methods for disease X showed the highest effectiveness in clinical trials?”), providing a summarized answer with source references.
• Benefits: Depth of analysis and automation. Instead of reading 100 articles, you can analyze their key findings in an hour. This frees up time for critical thinking.

Stage 3: Research Planning and Data Collection

Proper experimental or research design is the key to reliable results.

• Tool/Approach: AI assistants (Copilot), statistical simulators.
• Tasks: Help in choosing appropriate statistical methods, calculating required sample size, generating code for data collection from open sources (parsing).
• Benefits: Accuracy and efficiency. AI helps avoid common methodological errors and automates data collection.

Stage 4: Data Analysis

This is the area where AI and machine learning (ML) reveal their full potential.

• Tool/Approach: ML models (regression, classification, clustering), Python libraries (Pandas, Scikit-learn), AI tools for visualization.
• Tasks: Identifying complex, non-linear dependencies in data that are difficult to notice with traditional statistical methods. Building predictive models.
• Benefits: Deeper analysis. ML can find hidden patterns in large datasets, leading to new scientific discoveries.

Stage 5: Interpretation, Writing, and Publication

Writing a scientific article requires clarity, logic, and adherence to academic style.

• Tool/Approach: Generative models (GPT for drafts), grammar and style checking tools (Grammarly), AI assistants for translation and formatting.
• Tasks: Creating drafts of individual sections (introduction, methods description), rephrasing sentences for clarity, checking text for plagiarism, preparing abstracts.
• Benefits: Speed and quality. AI significantly accelerates the writing process, allowing focus on content rather than form.

3. & 4. Practical Example: Dataset Analysis in Google Colab

For demonstration, I took the classic “Wine Quality” dataset from the UCI repository. It contains chemical characteristics of white wine and its quality rating on a 10-point scale.

Task: Calculate basic descriptive statistics and visualize the distribution of wine quality to understand which ratings are most common.

Here’s the code that can be executed in Google Colab:

# Import necessary libraries
import pandas as pd
import matplotlib.pyplot as plt
import seaborn as sns

# URL to the white wine dataset
url = 'https://archive.ics.uci.edu/ml/machine-learning-databases/wine-quality/winequality-white.csv'

# Load data into DataFrame, using semicolon as separator
try:
    wine_df = pd.read_csv(url, sep=';')
    print("Data loaded successfully.")
except Exception as e:
    print(f"Data loading error: {e}")

# Display first 5 rows for familiarization
print("First 5 rows of data:")
print(wine_df.head())

# 1. Calculate descriptive statistics for all indicators
print("\nDescriptive statistics:")
# .T transposes the output, making it more readable
print(wine_df.describe().T)

# 2. Calculate mode for quality indicator
quality_mode = wine_df['quality'].mode()[0]
print(f"\nMode for 'quality' indicator: {quality_mode}")

# 3. Build visualization - histogram of wine quality distribution
plt.style.use('seaborn-v0_8-whitegrid') # Use modern style
fig, ax = plt.subplots(figsize=(10, 6))

sns.histplot(wine_df['quality'], bins=6, kde=False, ax=ax, color='skyblue', discrete=True)

ax.set_title('Distribution of White Wine Quality Ratings', fontsize=16)
ax.set_xlabel('Quality Rating (from 3 to 9)', fontsize=12)
ax.set_ylabel('Number of Samples', fontsize=12)
ax.set_xticks(range(wine_df['quality'].min(), wine_df['quality'].max() + 1)) # Clear marks on X axis

# Add labels with counts on each bar
for p in ax.patches:
    ax.annotate(f'{int(p.get_height())}', (p.get_x() + p.get_width() / 2., p.get_height()),
                ha='center', va='center', xytext=(0, 9), textcoords='offset points')

plt.show()

Download PDF with Jupyter notebook execution results

5. Brief Interpretation of Results

Analysis of the provided data allows us to draw several key conclusions:

1. Central tendencies:

   • Mean value of wine quality is approximately 5.88.
   • Median (50%) equals 6. This means that half of the wines have a rating of 6 or lower, and the other half — 6 or higher.
   • Mode, or the most frequent rating, also equals 6.

2. Data spread:

   • Standard deviation (std) for quality is 0.88. This indicates that most ratings are grouped quite close to the mean value (mainly in the 5-7 range).
   • Quality ratings range from 3 (min) to 9 (max). There are no wines with the highest (10) or lowest (1/2) ratings in the dataset.

3. Conclusions from visualization:

   • The histogram clearly shows that the distribution of quality ratings is not uniform. It resembles a normal distribution with a left skew.
   • The vast majority of wines (2198 samples) have a rating of 6. Second place goes to wines with a rating of 5 (1457 samples).
   • Wines with very high (8, 9) or very low (3, 4) ratings are significantly fewer.

General conclusion: Based on this statistics, we can assert that most white wines in this dataset are of “average” quality. This changes the initial understanding, since without analysis one might assume that ratings are distributed uniformly. Now we see that extreme ratings (very good or very bad) are rare. This can become a starting point for the next step: identifying chemical characteristics that most distinguish “outstanding” wines (rating 8+) from “average” ones.

This is a test post to verify that Mermaid diagrams are working correctly on the site.

Simple Flowchart

graph TD;
    A[Start] --> B[Initialize];
    B --> C{Check Status};
    C -->|Success| D[Process Data];
    C -->|Error| E[Handle Error];
    D --> F[Complete];
    E --> F;

Sequence Diagram

sequenceDiagram
    participant User
    participant Browser
    participant Server
    User->>Browser: Click button
    Browser->>Server: Send request
    Server-->>Browser: Return response
    Browser-->>User: Display result

Simple Timeline

gantt
    title Development Timeline
    dateFormat  YYYY-MM-DD
    section Planning
    Research        :done, research, 2025-07-01, 2025-07-05
    Design          :done, design, after research, 3d
    section Development
    Setup           :active, setup, 2025-07-12, 1d
    Implementation  :impl, after setup, 5d
    Testing         :test, after impl, 2d

The diagrams above should render correctly if Mermaid support is working properly.

Learn how to implement Prometheus-based health checks in Kuma using a sidecar container. This guide covers everything from metric evaluation to Docker and Kubernetes setup for reliable service mesh monitoring.

🧩 Using Prometheus Metrics for Health Checks in Kuma via a Sidecar Pattern

In service meshes like Kuma, health checks typically rely on TCP or HTTP probes.
But what if your service’s health depends on a Prometheus metric, such as my_app_up == 1?

Kuma doesn’t support metric-based health checks natively — but you can bridge the gap with a lightweight sidecar container that interprets Prometheus metrics and exposes a simple /health endpoint for Kuma to consume.

This post shows you how.

🗺️ Architecture Overview

         +----------------+
         |  Your Service  |
         | (Prometheus    |
         |  metrics here) |
         +-------+--------+
                 |
                 | exposes /metrics
                 |
         +-------v--------+
         | Sidecar Proxy  |
         | /health --> 200|
         | if metric OK   |
         +----------------+
                 |
        Kuma probes /health on port 9000

🛠️ Step 1: Create the Sidecar Health Proxy

This proxy reads your app’s Prometheus metrics and returns HTTP 200 only if the metric my_app_up is 1.

health_proxy.py:

from flask import Flask, Response
import requests

app = Flask(__name__)

@app.route('/health')
def health_check():
    try:
        resp = requests.get("http://localhost:8080/metrics")  # Replace with your app port
        if 'my_app_up 1' in resp.text:
            return Response("OK", status=200)
        else:
            return Response("Unhealthy", status=500)
    except:
        return Response("Unhealthy", status=500)

app.run(host='0.0.0.0', port=9000)

🐳 Step 2: Build the Docker Image

Dockerfile:

FROM python:3.10-slim

WORKDIR /app
COPY health_proxy.py .

RUN pip install flask requests

EXPOSE 9000
CMD ["python", "health_proxy.py"]

Build and push:

docker build -t yourdockerhub/health-proxy:latest .
docker push yourdockerhub/health-proxy:latest

🎯 Step 3: Deploy to Kubernetes

Here’s a sample deployment with the main app and health proxy sidecar.
It also includes a Kuma HealthCheck policy.

kuma-metric-health.yaml:

apiVersion: v1
kind: Namespace
metadata:
  name: kuma-demo
  labels:
    kuma.io/mesh: default

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-app
  namespace: kuma-demo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo
  template:
    metadata:
      labels:
        app: demo
        kuma.io/service: demo
    spec:
      containers:
        - name: app
          image: your-app-image  # Replace with your actual app image
          ports:
            - containerPort: 8080
        - name: health-proxy
          image: yourdockerhub/health-proxy:latest
          ports:
            - containerPort: 9000
---
apiVersion: kuma.io/v1alpha1
kind: HealthCheck
metadata:
  name: demo-metric-health
  namespace: kuma-demo
spec:
  sources:
    - match:
        service: demo
  destinations:
    - match:
        service: demo
  conf:
    interval: 10s
    timeout: 2s
    unhealthyThreshold: 3
    healthyThreshold: 1
    http:
      path: /health
      port: 9000

🧪 Step 4: Validate the Setup

1. Ensure Prometheus metrics are available at /metrics on port 8080.
2. Deploy the app and sidecar.
3. Kuma will ping the proxy’s /health every 10s.
4. Test failure conditions by changing the metric:
   • my_app_up 1 → sidecar returns 200 OK → Kuma marks healthy.
   • my_app_up 0 → sidecar returns 500 → Kuma marks as unhealthy.

🎓 Conclusion

While Kuma doesn’t natively support Prometheus-based health checks, you can convert metrics into HTTP health signals with this sidecar pattern.

✅ Lightweight
✅ Language-agnostic
✅ Works in any environment

Now Kuma will automatically remove services from the mesh when your custom metric signals a problem.

🔁 Ideas for Extension

• Use multiple metrics in the health logic
• Add caching to avoid high metric polling rates
• Build a Helm chart for easier reuse

Happy meshing!