When the liveness probe is configured the citadel server will include two checks

• a filesystem controller which regularly touches a file on the filesystem, checked by the kubernetes liveness probe
• a liveness check controller which tries to connect to the service's VIP on port 8060

The first works as intended whereas the second fails. The reason the second fails is because it is trying to access the VIP from within the pod and this is not possible, at least on OpenShift. The second controller needs to be checking the pod's IP address and not the service's VIP.

We will need to add an option to the istio_ca command to override the fqdn() function used by this probe.