Skip to content

docs: argocd healthcheck - don't report resources without status as Healthy - #1166

Open
kaessert wants to merge 1 commit into
crossplane:masterfrom
kaessert:argocd-healthcheck-no-status
Open

kaessert wants to merge 1 commit into
crossplane:masterfrom
kaessert:argocd-healthcheck-no-status

Conversation

@kaessert

@kaessert kaessert commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

The health checks in the Argo CD guide report every resource without a status as Healthy, whatever its kind.

if obj.status == nil or next(obj.status) == nil and contains(has_no_status, obj.kind) then

Lua binds and tighter than or, so this evaluates as obj.status == nil or (next(obj.status) == nil and contains(...)).

Effect: a managed resource that was just created has no status yet, so it shows Healthy for a moment. Argo CD gates sync waves and PostSync hooks on health. The next wave or hook can therefore start before the resource is actually ready.

Second bug: the following branch reads obj.status.users when obj.status may be nil.

This PR:

  • Merges the two branches. A resource without conditions is Healthy only if its kind is in the no-status list (message "Resource is in use." when status.users is set). Anything else stays Progressing. This matches the fix in the Argo CD built-in Crossplane checks (crossplane MRs go to Healthy before the MR has been provisioned argoproj/argo-cd#29381, in Argo CD v3.6).
  • Adds EnvironmentConfig and ImageConfig to the *.crossplane.io no-status list. Neither has a status, so they currently stay Progressing.
  • Adds a short note that Argo CD v3.1 and later ship built-in health checks for *.crossplane.io and *.upbound.io. A resource.customizations entry, wildcards included, takes precedence over them.

It applies to master, v2.2, v2.3 and v2.4 (identical files) and v1.20 (same fix, v1 kind list kept), following #1091.

Testing

I ran each snippet through argocd admin settings resource-overrides health (CLI v3.0.6). The wildcard keys were swapped for exact group/Kind keys, because the admin command doesn't resolve wildcards. 21 fixtures:

Resource Before After
MR without status (ec2.aws.upbound.io and ec2.aws.m.upbound.io Instance) Healthy Progressing
kubernetes.crossplane.io Object without status Healthy Progressing
MR Ready=True / Ready=False / Synced=False Healthy / Progressing / Degraded unchanged
ProviderConfig without status, status: {}, status.users Healthy unchanged
ClusterProviderConfig with status.users Healthy unchanged
Composition, DeploymentRuntimeConfig, EnvironmentConfig, ImageConfig Healthy unchanged
CompositionRevision ValidPipeline=True, XRD Established=True, inactive MRD Healthy unchanged
Function Installed=False / healthy, ProviderRevision RevisionHealthy=True Degraded / Healthy / Healthy unchanged

The Vale job reports issues on content/v1.20/.... These are on lines this PR doesn't touch, and #1091 hit the same failure. The other four files lint clean.

…ealthy

In the health.lua snippets, the first status check read

    obj.status == nil or next(obj.status) == nil and contains(has_no_status, obj.kind)

Lua binds `and` tighter than `or`, so this evaluates as
`obj.status == nil or (...)`: every resource without a status was
reported Healthy, regardless of kind. A managed resource or composed
resource that was just created (and has no status yet) therefore shows
Healthy for a moment, which lets Argo CD move on to the next sync wave
or run PostSync hooks before the resource is ready. The following
branch also dereferenced `obj.status.users` when `obj.status` was nil.

Merge the two branches: a resource without conditions is Healthy only
when its kind is in the no-status list (with a "Resource is in use."
message when `status.users` is set), otherwise it stays Progressing.
This matches the fix in the Argo CD built-in Crossplane health checks
(argoproj/argo-cd#29381).

Also add EnvironmentConfig and ImageConfig, which have no status, to the
crossplane.io no-status list, and note that Argo CD v3.1+ ships built-in
health checks for these API groups which a resource.customizations entry
overrides.

Signed-off-by: Tobias Kässer <tobias.kasser@upbound.io>
@netlify

netlify Bot commented Nov 5, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for crossplane ready!

Name Link
🔨 Latest commit 37678bf
🔍 Latest deploy log https://app.netlify.com/projects/crossplane/deploys/6aecb84f526d8ccbf8d2f5cd
😎 Deploy Preview https://deploy-preview-1166--crossplane.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse
1 paths audited
Performance: 92 (🔴 down 2 from production)
Accessibility: 90 (🔴 down 2 from production)
Best Practices: 92 (no change from production)
SEO: 100 (no change from production)
PWA: 70 (no change from production)
View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify project configuration.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant