fix(balancer): remap grpc/grpcs health check types to http/https

[chaitanyapantheor]

What does this PR do?

Fixes the crash that occurs when an upstream is configured with healthchecks.active.type: grpc or grpcs.

Error (from error.log):

checks.active.type can only be 'http', 'https' or 'tcp', got 'grpc'

This causes declarative reconfigure failed on every worker restart whenever a gRPC upstream has active health checks enabled.

Root cause

lua-resty-healthcheck (v3.1.0, pinned in kong-latest.rockspec) validates checks.active.type and only accepts "tcp", "http", or "https". Kong's upstream schema already allows "grpc" and "grpcs" as valid values, but healthcheckers.lua passes them verbatim to healthcheck.new() — no translation layer existed.

Fix

In healthcheckers_M.create_healthchecker, after the existing subsystem-gating block, remap grpc → http and grpcs → https on a deep copy of the checks table before passing it to healthcheck.new(). gRPC runs over HTTP/2, so these are the correct protocol equivalents for health probing. The stored upstream entity is never mutated.

passive.type is remapped defensively for the same reason.

To avoid an unnecessary double deep-copy when the subsystem-gating block has already made one, a checks_copied flag tracks whether a copy exists.

Changes

• kong/runloop/balancer/healthcheckers.lua — translate grpc/grpcs to http/https before calling the healthcheck library
• spec/01-unit/09-balancer/07-healthcheckers_spec.lua — 10 unit tests: type remapping (active + passive, grpc + grpcs), pass-through for tcp/http/https, no mutation of the original upstream entity, correct interaction with the stream-subsystem gating
• changelog/unreleased/kong/fix-grpc-healthcheck-active-type.yml — bugfix changelog YAML (CHANGELOG.md is not modified, per contributing guidelines)

Pre-submit checklist

• Commit history is clean and atomic
• Rebased on top of master
• Static linting passes: make lint (requires Xcode/Bazel locally; blocked in this environment — please verify in CI)
• Tests pass: make test or bin/busted -v spec/01-unit/09-balancer/07-healthcheckers_spec.lua
• CHANGELOG.md is not modified — a YAML file was added to changelog/unreleased/kong/ instead

How to test manually

1. Configure an upstream with healthchecks.active.type: grpc, healthy.interval: 1, and healthy.successes: 1
2. Start Kong in declarative (DB-less) or traditional mode
3. Confirm error.log does not contain checks.active.type can only be
4. Confirm the upstream health is queryable via Admin API: GET /upstreams/<name>/health

Fixes #13336

[CLAassistant]

All committers have signed the CLA.

[chaitanyapantheor]

Hi @chobits — you were the last to dig into this bug (comment on #13336) so you may have the most context. Would appreciate a review when you get a chance!

Happy to make any changes if the approach needs adjustment.