feat: add healthchecks for capsule resources

[sandert-k8s]

We would like to bring our health checks upstream in Argo-CD! 🚀

All healthchecks are currently listed on: https://projectcapsule.dev/ecosystem/integrations/argocd/ . (Explicitly left the Action for the Namespace out of this, because that could potentially have side affect's that we don't oversee. We keep that action on the website for people to add theirselfs)

These health checks are for Capsule itself, for the Capsule Proxy resources, and the SOPS Operator (a Capsule add-on)

capsule.clastix.io

Kind	Health statuses	Actions
Tenant	Healthy (Ready=True), Degraded (Ready=False), Suspended (Cordoned=True), Progressing	cordon / uncordon (toggles spec.cordoned)
CapsuleConfiguration	Healthy, Degraded, Progressing	—
TenantOwner	Healthy, Degraded, Progressing	—
ResourcePool	Healthy, Degraded (Ready=False or pool exhausted), Progressing	—
ResourcePoolClaim	Healthy, Degraded, Suspended (Bound=False), Progressing	—
CustomQuota	Healthy, Degraded, Progressing	—
GlobalCustomQuota	Healthy, Degraded, Progressing	—
TenantResource	Healthy, Degraded, Progressing	—
GlobalTenantResource	Healthy, Degraded, Progressing	—
ProxySetting	Healthy, Degraded, Progressing	—
GlobalProxySettings	Healthy, Degraded, Progressing	—

addons.projectcapsule.dev (SOPS Operator)

Kind	Health statuses	Actions
SopsSecret	Healthy, Degraded, Progressing	—
SopsProvider	Healthy, Degraded, Progressing	—
GlobalSopsSecret	Healthy, Degraded, Progressing	—

All resources include health.lua, health_test.yaml, and testdata fixtures covering each status branch. The Tenant additionally includes action discovery and per-action Lua scripts with corresponding test fixtures.

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
• The title of the PR states what changed and the related issues number (used for the release note).
• The title of the PR conforms to the Title of the PR
• I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
• I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
• Does this PR require documentation updates?
• I've updated documentation as required by this PR.
• I have signed off all my commits as required by DCO
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• My build is green (troubleshooting builds).
• My new feature complies with the feature status guidelines.
• I have added a brief description of why this PR is necessary and/or what this PR solves.
• Optional. My organization is added to USERS.md.
• Optional. For bug fixes, I've indicated what older releases this fix should be cherry-picked into (this may or may not happen depending on risk/complexity).

[bunnyshell]

❗ Preview Environment deployment failed on Bunnyshell

See: Environment Details | Pipeline Logs

Available commands (reply to this comment):

• 🚀 /bns:deploy to redeploy the environment
• ❌ /bns:delete to remove the environment

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[codecov]

Bundle Report

Bundle size has no change ✅

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds Argo CD resource customizations for multiple Capsule CRDs (and Capsule addons) by introducing Lua-based health assessments, action scripts for Tenant cordon/uncordon, and accompanying fixture-driven tests.

Changes:

• Add health.lua implementations for Capsule CRDs and addons (Ready/Bound/Cordoned + generation mismatch handling).
• Add health_test.yaml suites and testdata/*.yaml fixtures covering Healthy/Degraded/Progressing/Suspended states.
• Add Tenant action discovery + cordon/uncordon action scripts with tests and fixtures.

Reviewed changes

Copilot reviewed 93 out of 93 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
resource_customizations/capsule.clastix.io/TenantResource/testdata/progressing_no_status.yaml	Test fixture for TenantResource “no status” progressing case
resource_customizations/capsule.clastix.io/TenantResource/testdata/progressing_generation_mismatch.yaml	Test fixture for TenantResource generation mismatch progressing case
resource_customizations/capsule.clastix.io/TenantResource/testdata/healthy.yaml	Test fixture for TenantResource ready/healthy case
resource_customizations/capsule.clastix.io/TenantResource/testdata/degraded.yaml	Test fixture for TenantResource ready=false/degraded case
resource_customizations/capsule.clastix.io/TenantResource/health_test.yaml	Health test suite for TenantResource
resource_customizations/capsule.clastix.io/TenantResource/health.lua	Argo CD health logic for TenantResource
resource_customizations/capsule.clastix.io/TenantOwner/testdata/progressing_no_status.yaml	Test fixture for TenantOwner “no status” progressing case
resource_customizations/capsule.clastix.io/TenantOwner/testdata/progressing_generation_mismatch.yaml	Test fixture for TenantOwner generation mismatch progressing case
resource_customizations/capsule.clastix.io/TenantOwner/testdata/healthy.yaml	Test fixture for TenantOwner ready/healthy case
resource_customizations/capsule.clastix.io/TenantOwner/testdata/degraded.yaml	Test fixture for TenantOwner ready=false/degraded case
resource_customizations/capsule.clastix.io/TenantOwner/health_test.yaml	Health test suite for TenantOwner
resource_customizations/capsule.clastix.io/TenantOwner/health.lua	Argo CD health logic for TenantOwner
resource_customizations/capsule.clastix.io/Tenant/testdata/suspended_cordoned.yaml	Test fixture for Tenant cordoned/suspended case
resource_customizations/capsule.clastix.io/Tenant/testdata/progressing_no_status.yaml	Test fixture for Tenant “no status” progressing case
resource_customizations/capsule.clastix.io/Tenant/testdata/progressing_generation_mismatch.yaml	Test fixture for Tenant generation mismatch progressing case
resource_customizations/capsule.clastix.io/Tenant/testdata/healthy.yaml	Test fixture for Tenant ready/healthy case
resource_customizations/capsule.clastix.io/Tenant/testdata/degraded.yaml	Test fixture for Tenant ready=false/degraded case
resource_customizations/capsule.clastix.io/Tenant/health_test.yaml	Health test suite for Tenant
resource_customizations/capsule.clastix.io/Tenant/health.lua	Argo CD health logic for Tenant (includes Cordoned => Suspended)
resource_customizations/capsule.clastix.io/Tenant/actions/uncordon/action.lua	Action to uncordon a Tenant (set spec.cordoned=false)
resource_customizations/capsule.clastix.io/Tenant/actions/testdata/normal.yaml	Action test fixture: normal Tenant input
resource_customizations/capsule.clastix.io/Tenant/actions/testdata/cordoned.yaml	Action test fixture: cordoned Tenant input
resource_customizations/capsule.clastix.io/Tenant/actions/testdata/after_uncordon.yaml	Action test fixture: expected output after uncordon
resource_customizations/capsule.clastix.io/Tenant/actions/testdata/after_cordon.yaml	Action test fixture: expected output after cordon
resource_customizations/capsule.clastix.io/Tenant/actions/discovery.lua	Action discovery logic toggling cordon/uncordon availability
resource_customizations/capsule.clastix.io/Tenant/actions/cordon/action.lua	Action to cordon a Tenant (set spec.cordoned=true)
resource_customizations/capsule.clastix.io/Tenant/actions/action_test.yaml	Discovery + action tests for Tenant cordon/uncordon
resource_customizations/capsule.clastix.io/ResourcePoolClaim/testdata/suspended_unbound.yaml	Test fixture for ResourcePoolClaim unbound/suspended case
resource_customizations/capsule.clastix.io/ResourcePoolClaim/testdata/progressing_no_status.yaml	Test fixture for ResourcePoolClaim “no status” progressing case
resource_customizations/capsule.clastix.io/ResourcePoolClaim/testdata/healthy.yaml	Test fixture for ResourcePoolClaim ready/healthy case
resource_customizations/capsule.clastix.io/ResourcePoolClaim/testdata/degraded.yaml	Test fixture for ResourcePoolClaim ready=false/degraded case
resource_customizations/capsule.clastix.io/ResourcePoolClaim/health_test.yaml	Health test suite for ResourcePoolClaim
resource_customizations/capsule.clastix.io/ResourcePoolClaim/health.lua	Argo CD health logic for ResourcePoolClaim (Bound/Ready)
resource_customizations/capsule.clastix.io/ResourcePool/testdata/progressing_no_status.yaml	Test fixture for ResourcePool “no status” progressing case
resource_customizations/capsule.clastix.io/ResourcePool/testdata/healthy.yaml	Test fixture for ResourcePool ready/healthy case
resource_customizations/capsule.clastix.io/ResourcePool/testdata/degraded_ready_false.yaml	Test fixture for ResourcePool ready=false/degraded case
resource_customizations/capsule.clastix.io/ResourcePool/testdata/degraded_exhausted.yaml	Test fixture for ResourcePool “exhaustions set” degraded case
resource_customizations/capsule.clastix.io/ResourcePool/health_test.yaml	Health test suite for ResourcePool
resource_customizations/capsule.clastix.io/ResourcePool/health.lua	Argo CD health logic for ResourcePool (exhaustions + Ready)
resource_customizations/capsule.clastix.io/ProxySetting/testdata/progressing_no_status.yaml	Test fixture for ProxySetting “no status” progressing case
resource_customizations/capsule.clastix.io/ProxySetting/testdata/progressing_generation_mismatch.yaml	Test fixture for ProxySetting generation mismatch progressing case
resource_customizations/capsule.clastix.io/ProxySetting/testdata/healthy.yaml	Test fixture for ProxySetting ready/healthy case
resource_customizations/capsule.clastix.io/ProxySetting/testdata/degraded.yaml	Test fixture for ProxySetting ready=false/degraded case
resource_customizations/capsule.clastix.io/ProxySetting/health_test.yaml	Health test suite for ProxySetting
resource_customizations/capsule.clastix.io/ProxySetting/health.lua	Argo CD health logic for ProxySetting
resource_customizations/capsule.clastix.io/GlobalTenantResource/testdata/progressing_no_status.yaml	Test fixture for GlobalTenantResource “no status” progressing case
resource_customizations/capsule.clastix.io/GlobalTenantResource/testdata/progressing_generation_mismatch.yaml	Test fixture for GlobalTenantResource generation mismatch progressing case
resource_customizations/capsule.clastix.io/GlobalTenantResource/testdata/healthy.yaml	Test fixture for GlobalTenantResource ready/healthy case
resource_customizations/capsule.clastix.io/GlobalTenantResource/testdata/degraded.yaml	Test fixture for GlobalTenantResource ready=false/degraded case
resource_customizations/capsule.clastix.io/GlobalTenantResource/health_test.yaml	Health test suite for GlobalTenantResource
resource_customizations/capsule.clastix.io/GlobalTenantResource/health.lua	Argo CD health logic for GlobalTenantResource
resource_customizations/capsule.clastix.io/GlobalProxySettings/testdata/progressing_no_status.yaml	Test fixture for GlobalProxySettings “no status” progressing case
resource_customizations/capsule.clastix.io/GlobalProxySettings/testdata/progressing_generation_mismatch.yaml	Test fixture for GlobalProxySettings generation mismatch progressing case
resource_customizations/capsule.clastix.io/GlobalProxySettings/testdata/healthy.yaml	Test fixture for GlobalProxySettings ready/healthy case
resource_customizations/capsule.clastix.io/GlobalProxySettings/testdata/degraded.yaml	Test fixture for GlobalProxySettings ready=false/degraded case
resource_customizations/capsule.clastix.io/GlobalProxySettings/health_test.yaml	Health test suite for GlobalProxySettings
resource_customizations/capsule.clastix.io/GlobalProxySettings/health.lua	Argo CD health logic for GlobalProxySettings
resource_customizations/capsule.clastix.io/GlobalCustomQuota/testdata/progressing_no_status.yaml	Test fixture for GlobalCustomQuota “no status” progressing case
resource_customizations/capsule.clastix.io/GlobalCustomQuota/testdata/progressing_generation_mismatch.yaml	Test fixture for GlobalCustomQuota generation mismatch progressing case
resource_customizations/capsule.clastix.io/GlobalCustomQuota/testdata/healthy.yaml	Test fixture for GlobalCustomQuota ready/healthy case
resource_customizations/capsule.clastix.io/GlobalCustomQuota/testdata/degraded.yaml	Test fixture for GlobalCustomQuota ready=false/degraded case
resource_customizations/capsule.clastix.io/GlobalCustomQuota/health_test.yaml	Health test suite for GlobalCustomQuota
resource_customizations/capsule.clastix.io/GlobalCustomQuota/health.lua	Argo CD health logic for GlobalCustomQuota
resource_customizations/capsule.clastix.io/CustomQuota/testdata/progressing_no_status.yaml	Test fixture for CustomQuota “no status” progressing case
resource_customizations/capsule.clastix.io/CustomQuota/testdata/progressing_generation_mismatch.yaml	Test fixture for CustomQuota generation mismatch progressing case
resource_customizations/capsule.clastix.io/CustomQuota/testdata/healthy.yaml	Test fixture for CustomQuota ready/healthy case
resource_customizations/capsule.clastix.io/CustomQuota/testdata/degraded.yaml	Test fixture for CustomQuota ready=false/degraded case
resource_customizations/capsule.clastix.io/CustomQuota/health_test.yaml	Health test suite for CustomQuota
resource_customizations/capsule.clastix.io/CustomQuota/health.lua	Argo CD health logic for CustomQuota
resource_customizations/capsule.clastix.io/CapsuleConfiguration/testdata/progressing_no_status.yaml	Test fixture for CapsuleConfiguration “no status” progressing case
resource_customizations/capsule.clastix.io/CapsuleConfiguration/testdata/progressing_generation_mismatch.yaml	Test fixture for CapsuleConfiguration generation mismatch progressing case
resource_customizations/capsule.clastix.io/CapsuleConfiguration/testdata/healthy.yaml	Test fixture for CapsuleConfiguration ready/healthy case
resource_customizations/capsule.clastix.io/CapsuleConfiguration/testdata/degraded.yaml	Test fixture for CapsuleConfiguration ready=false/degraded case
resource_customizations/capsule.clastix.io/CapsuleConfiguration/health_test.yaml	Health test suite for CapsuleConfiguration
resource_customizations/capsule.clastix.io/CapsuleConfiguration/health.lua	Argo CD health logic for CapsuleConfiguration
resource_customizations/addons.projectcapsule.dev/SopsSecret/testdata/progressing_unknown.yaml	Test fixture for SopsSecret Ready=Unknown progressing case
resource_customizations/addons.projectcapsule.dev/SopsSecret/testdata/progressing_no_status.yaml	Test fixture for SopsSecret “no status” progressing case
resource_customizations/addons.projectcapsule.dev/SopsSecret/testdata/healthy.yaml	Test fixture for SopsSecret ready/healthy case
resource_customizations/addons.projectcapsule.dev/SopsSecret/testdata/degraded.yaml	Test fixture for SopsSecret ready=false/degraded case
resource_customizations/addons.projectcapsule.dev/SopsSecret/health_test.yaml	Health test suite for SopsSecret
resource_customizations/addons.projectcapsule.dev/SopsSecret/health.lua	Argo CD health logic for SopsSecret (True/False/Unknown)
resource_customizations/addons.projectcapsule.dev/SopsProvider/testdata/progressing_unknown.yaml	Test fixture for SopsProvider Ready=Unknown progressing case
resource_customizations/addons.projectcapsule.dev/SopsProvider/testdata/progressing_no_status.yaml	Test fixture for SopsProvider “no status” progressing case
resource_customizations/addons.projectcapsule.dev/SopsProvider/testdata/healthy.yaml	Test fixture for SopsProvider ready/healthy case
resource_customizations/addons.projectcapsule.dev/SopsProvider/testdata/degraded.yaml	Test fixture for SopsProvider ready=false/degraded case
resource_customizations/addons.projectcapsule.dev/SopsProvider/health_test.yaml	Health test suite for SopsProvider
resource_customizations/addons.projectcapsule.dev/SopsProvider/health.lua	Argo CD health logic for SopsProvider (True/False/Unknown)
resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/testdata/progressing_unknown.yaml	Test fixture for GlobalSopsSecret Ready=Unknown progressing case
resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/testdata/progressing_no_status.yaml	Test fixture for GlobalSopsSecret “no status” progressing case
resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/testdata/healthy.yaml	Test fixture for GlobalSopsSecret ready/healthy case
resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/testdata/degraded.yaml	Test fixture for GlobalSopsSecret ready=false/degraded case
resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/health_test.yaml	Health test suite for GlobalSopsSecret
resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/health.lua	Argo CD health logic for GlobalSopsSecret (True/False/Unknown)

Comments suppressed due to low confidence (3)

resource_customizations/capsule.clastix.io/ResourcePool/health.lua:1

• This early return requires status.conditions to be present before any other status signals are evaluated. For ResourcePool, status.exhaustions is a first-class degraded signal; if exhaustions are set but conditions are absent, this will incorrectly report Progressing instead of Degraded. Consider moving the exhaustions check before gating on status.conditions, or only returning early when the entire status is missing (or both conditions and exhaustions are missing).
  resource_customizations/capsule.clastix.io/ResourcePool/health_test.yaml:1
• The ResourcePool health logic includes a generation mismatch check that returns Progressing with message Waiting for reconciliation (generation mismatch), but there is no test case covering that behavior. Add a testdata/progressing_generation_mismatch.yaml fixture and a matching entry here to prevent regressions.
  resource_customizations/capsule.clastix.io/ResourcePoolClaim/health_test.yaml:1
• The ResourcePoolClaim health logic contains a generation mismatch path (Waiting for reconciliation (generation mismatch)), but the test suite doesn’t include a case for it. Add a generation-mismatch fixture + test entry to cover that branch.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 97 out of 97 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

resource_customizations/capsule.clastix.io/Tenant/actions/action_test.yaml:13

• The expected discovery result for the cordoned Tenant omits iconClass, but actions/discovery.lua sets iconClass for both actions. This makes the discovery test fail because the returned actions won’t match the expected structs.

[Copilot]

Pull request overview

Copilot reviewed 99 out of 99 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

resource_customizations/capsule.clastix.io/ResourcePool/health.lua:44

• After relaxing the early status.conditions guard (to allow exhaustions to be evaluated), the code should still handle the case where status.conditions is nil before iterating with ipairs, otherwise it will error.