feat: add healthchecks for capsule resources

resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/health.lua

@@ -0,0 +1,48 @@
+-- GlobalSopsSecret is a cluster-scoped resource that holds an encrypted secret
+-- and replicates the decrypted result into namespaces across multiple tenants.
+--
+-- Documentation:
+--   https://github.com/peak-scale/sops-operator
+--
+-- ArgoCD health mapping:
+--   Ready=True    => Healthy
+--   Ready=False   => Degraded
+--   Ready=Unknown => Progressing
+--   No status     => Progressing
+local hs = {}
+if obj.status == nil or obj.status.conditions == nil then
+  hs.status = "Progressing"
+  hs.message = "Waiting for status"
+  return hs
+end
+
+if obj.metadata ~= nil and obj.metadata.generation ~= nil and obj.status.observedGeneration ~= nil
+    and obj.status.observedGeneration ~= obj.metadata.generation then
+  hs.status = "Progressing"
+  hs.message = "Waiting for reconciliation (generation mismatch)"
+  return hs
+end
+
+for _, condition in ipairs(obj.status.conditions) do
+  if condition.type == "Ready" then
+    if condition.status == "True" then
+      hs.status = "Healthy"
+      hs.message = condition.message
+      return hs
+    end
+    if condition.status == "False" then
+      hs.status = "Degraded"
+      hs.message = condition.message
+      return hs
+    end
+    if condition.status == "Unknown" then
+      hs.status = "Progressing"
+      hs.message = condition.message
+      return hs
+    end
+  end
+end
+
+hs.status = "Progressing"
+hs.message = "Waiting for Ready condition"
+return hs

resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/health_test.yaml

@@ -0,0 +1,21 @@
+tests:
+- healthStatus:
+    status: Progressing
+    message: "Waiting for status"
+  inputPath: testdata/progressing_no_status.yaml
+- healthStatus:
+    status: Progressing
+    message: "Waiting for reconciliation (generation mismatch)"
+  inputPath: testdata/progressing_generation_mismatch.yaml
+- healthStatus:
+    status: Progressing
+    message: "Decryption and replication in progress"
+  inputPath: testdata/progressing_unknown.yaml
+- healthStatus:
+    status: Healthy
+    message: "All managed secrets have been successfully decrypted and replicated into their target namespaces"
+  inputPath: testdata/healthy.yaml
+- healthStatus:
+    status: Degraded
+    message: "Failed to replicate secret into target namespaces"
+  inputPath: testdata/degraded.yaml

resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/testdata/degraded.yaml

@@ -0,0 +1,21 @@
+apiVersion: addons.projectcapsule.dev/v1alpha1
+kind: GlobalSopsSecret
+metadata:
+  name: global-tls-ca
+  generation: 1
+spec:
+  namespaceSelector:
+    matchLabels:
+      capsule.clastix.io/tenant: solar
+  secretTemplates:
+    - name: tls-ca
+      stringData:
+        ca.crt: ENC[AES256_GCM,data:encrypted==,tag:tag==,type:str]
+status:
+  observedGeneration: 1
+  conditions:
+    - type: Ready
+      status: "False"
+      lastTransitionTime: "2024-01-01T00:00:00Z"
+      message: Failed to replicate secret into target namespaces
+      reason: ReplicationError

resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/testdata/healthy.yaml

@@ -0,0 +1,21 @@
+apiVersion: addons.projectcapsule.dev/v1alpha1
+kind: GlobalSopsSecret
+metadata:
+  name: global-tls-ca
+  generation: 1
+spec:
+  namespaceSelector:
+    matchLabels:
+      capsule.clastix.io/tenant: solar
+  secretTemplates:
+    - name: tls-ca
+      stringData:
+        ca.crt: ENC[AES256_GCM,data:encrypted==,tag:tag==,type:str]
+status:
+  observedGeneration: 1
+  conditions:
+    - type: Ready
+      status: "True"
+      lastTransitionTime: "2024-01-01T00:00:00Z"
+      message: All managed secrets have been successfully decrypted and replicated into their target namespaces
+      reason: Ready

resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/testdata/progressing_generation_mismatch.yaml

@@ -0,0 +1,21 @@
+apiVersion: addons.projectcapsule.dev/v1alpha1
+kind: GlobalSopsSecret
+metadata:
+  name: global-tls-ca
+  generation: 2
+spec:
+  namespaceSelector:
+    matchLabels:
+      capsule.clastix.io/tenant: solar
+  secretTemplates:
+    - name: tls-ca
+      stringData:
+        ca.crt: ENC[AES256_GCM,data:encrypted==,tag:tag==,type:str]
+status:
+  observedGeneration: 1
+  conditions:
+    - type: Ready
+      status: "True"
+      lastTransitionTime: "2024-01-01T00:00:00Z"
+      message: All managed secrets have been successfully decrypted and replicated into their target namespaces
+      reason: Ready

resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/testdata/progressing_no_status.yaml

@@ -0,0 +1,12 @@
+apiVersion: addons.projectcapsule.dev/v1alpha1
+kind: GlobalSopsSecret
+metadata:
+  name: global-tls-ca
+spec:
+  namespaceSelector:
+    matchLabels:
+      capsule.clastix.io/tenant: solar
+  secretTemplates:
+    - name: tls-ca
+      stringData:
+        ca.crt: ENC[AES256_GCM,data:encrypted==,tag:tag==,type:str]

resource_customizations/addons.projectcapsule.dev/GlobalSopsSecret/testdata/progressing_unknown.yaml

@@ -0,0 +1,21 @@
+apiVersion: addons.projectcapsule.dev/v1alpha1
+kind: GlobalSopsSecret
+metadata:
+  name: global-tls-ca
+  generation: 1
+spec:
+  namespaceSelector:
+    matchLabels:
+      capsule.clastix.io/tenant: solar
+  secretTemplates:
+    - name: tls-ca
+      stringData:
+        ca.crt: ENC[AES256_GCM,data:encrypted==,tag:tag==,type:str]
+status:
+  observedGeneration: 1
+  conditions:
+    - type: Ready
+      status: "Unknown"
+      lastTransitionTime: "2024-01-01T00:00:00Z"
+      message: Decryption and replication in progress
+      reason: Reconciling

resource_customizations/addons.projectcapsule.dev/SopsProvider/health.lua

@@ -0,0 +1,48 @@
+-- SopsProvider is a cluster-scoped resource that configures a decryption provider
+-- (e.g. AWS KMS, GCP KMS, age) for the SOPS Operator.
+--
+-- Documentation:
+--   https://github.com/peak-scale/sops-operator
+--
+-- ArgoCD health mapping:
+--   Ready=True    => Healthy
+--   Ready=False   => Degraded
+--   Ready=Unknown => Progressing
+--   No status     => Progressing
+local hs = {}
+if obj.status == nil or obj.status.conditions == nil then
+  hs.status = "Progressing"
+  hs.message = "Waiting for status"
+  return hs
+end
+
+if obj.metadata ~= nil and obj.metadata.generation ~= nil and obj.status.observedGeneration ~= nil
+    and obj.status.observedGeneration ~= obj.metadata.generation then
+  hs.status = "Progressing"
+  hs.message = "Waiting for reconciliation (generation mismatch)"
+  return hs
+end
+
+for _, condition in ipairs(obj.status.conditions) do
+  if condition.type == "Ready" then
+    if condition.status == "True" then
+      hs.status = "Healthy"
+      hs.message = condition.message
+      return hs
+    end
+    if condition.status == "False" then
+      hs.status = "Degraded"
+      hs.message = condition.message
+      return hs
+    end
+    if condition.status == "Unknown" then
+      hs.status = "Progressing"
+      hs.message = condition.message
+      return hs
+    end
+  end
+end
+
+hs.status = "Progressing"
+hs.message = "Waiting for Ready condition"
+return hs

resource_customizations/addons.projectcapsule.dev/SopsProvider/health_test.yaml

@@ -0,0 +1,21 @@
+tests:
+- healthStatus:
+    status: Progressing
+    message: "Waiting for status"
+  inputPath: testdata/progressing_no_status.yaml
+- healthStatus:
+    status: Progressing
+    message: "Waiting for reconciliation (generation mismatch)"
+  inputPath: testdata/progressing_generation_mismatch.yaml
+- healthStatus:
+    status: Progressing
+    message: "Validating provider configuration"
+  inputPath: testdata/progressing_unknown.yaml
+- healthStatus:
+    status: Healthy
+    message: "All configured providers are available"
+  inputPath: testdata/healthy.yaml
+- healthStatus:
+    status: Degraded
+    message: "Failed to load decryption provider"
+  inputPath: testdata/degraded.yaml

resource_customizations/addons.projectcapsule.dev/SopsProvider/testdata/degraded.yaml

@@ -0,0 +1,17 @@
+apiVersion: addons.projectcapsule.dev/v1alpha1
+kind: SopsProvider
+metadata:
+  name: aws-kms-provider
+  generation: 1
+spec:
+  provider:
+    awsKms:
+      keyArn: arn:aws:kms:us-east-1:111122223333:key/example-key-id
+status:
+  observedGeneration: 1
+  conditions:
+    - type: Ready
+      status: "False"
+      lastTransitionTime: "2024-01-01T00:00:00Z"
+      message: Failed to load decryption provider
+      reason: ProviderError

resource_customizations/addons.projectcapsule.dev/SopsProvider/testdata/healthy.yaml

@@ -0,0 +1,17 @@
+apiVersion: addons.projectcapsule.dev/v1alpha1
+kind: SopsProvider
+metadata:
+  name: aws-kms-provider
+  generation: 1
+spec:
+  provider:
+    awsKms:
+      keyArn: arn:aws:kms:us-east-1:111122223333:key/example-key-id
+status:
+  observedGeneration: 1
+  conditions:
+    - type: Ready
+      status: "True"
+      lastTransitionTime: "2024-01-01T00:00:00Z"
+      message: All configured providers are available
+      reason: Ready

resource_customizations/addons.projectcapsule.dev/SopsProvider/testdata/progressing_generation_mismatch.yaml

@@ -0,0 +1,17 @@
+apiVersion: addons.projectcapsule.dev/v1alpha1
+kind: SopsProvider
+metadata:
+  name: aws-kms-provider
+  generation: 2
+spec:
+  provider:
+    awsKms:
+      keyArn: arn:aws:kms:us-east-1:111122223333:key/example-key-id
+status:
+  observedGeneration: 1
+  conditions:
+    - type: Ready
+      status: "True"
+      lastTransitionTime: "2024-01-01T00:00:00Z"
+      message: All configured providers are available
+      reason: Ready

resource_customizations/addons.projectcapsule.dev/SopsProvider/testdata/progressing_no_status.yaml

@@ -0,0 +1,8 @@
+apiVersion: addons.projectcapsule.dev/v1alpha1
+kind: SopsProvider
+metadata:
+  name: aws-kms-provider
+spec:
+  provider:
+    awsKms:
+      keyArn: arn:aws:kms:us-east-1:111122223333:key/example-key-id

resource_customizations/addons.projectcapsule.dev/SopsProvider/testdata/progressing_unknown.yaml

@@ -0,0 +1,17 @@
+apiVersion: addons.projectcapsule.dev/v1alpha1
+kind: SopsProvider
+metadata:
+  name: aws-kms-provider
+  generation: 1
+spec:
+  provider:
+    awsKms:
+      keyArn: arn:aws:kms:us-east-1:111122223333:key/example-key-id
+status:
+  observedGeneration: 1
+  conditions:
+    - type: Ready
+      status: "Unknown"
+      lastTransitionTime: "2024-01-01T00:00:00Z"
+      message: Validating provider configuration
+      reason: Reconciling

resource_customizations/addons.projectcapsule.dev/SopsSecret/health.lua

@@ -0,0 +1,49 @@
+-- SopsSecret is a namespace-scoped resource managed by the SOPS Operator
+-- (a Capsule addon) that holds an encrypted secret and decrypts it into
+-- one or more Kubernetes Secrets.
+--
+-- Documentation:
+--   https://github.com/peak-scale/sops-operator
+--
+-- ArgoCD health mapping:
+--   Ready=True    => Healthy
+--   Ready=False   => Degraded
+--   Ready=Unknown => Progressing  (decryption/replication in progress)
+--   No status     => Progressing
+local hs = {}
+if obj.status == nil or obj.status.conditions == nil then
+  hs.status = "Progressing"
+  hs.message = "Waiting for status"
+  return hs
+end
+
+if obj.metadata ~= nil and obj.metadata.generation ~= nil and obj.status.observedGeneration ~= nil
+    and obj.status.observedGeneration ~= obj.metadata.generation then
+  hs.status = "Progressing"
+  hs.message = "Waiting for reconciliation (generation mismatch)"
+  return hs
+end
+
+for _, condition in ipairs(obj.status.conditions) do
+  if condition.type == "Ready" then
+    if condition.status == "True" then
+      hs.status = "Healthy"
+      hs.message = condition.message
+      return hs
+    end
+    if condition.status == "False" then
+      hs.status = "Degraded"
+      hs.message = condition.message
+      return hs
+    end
+    if condition.status == "Unknown" then
+      hs.status = "Progressing"
+      hs.message = condition.message
+      return hs
+    end
+  end
+end
+
+hs.status = "Progressing"
+hs.message = "Waiting for Ready condition"
+return hs