Skip to content

feat: add healthchecks for TenantResource and GlobalTenantResource #2000

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
LorenzBischof wants to merge 1 commit into
base: main
Choose a base branch
from
+1,559 −110
Draft

feat: add healthchecks for TenantResource and GlobalTenantResource #2000

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions api/v1beta2/tenantresource_global.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ type GlobalTenantResourceStatus struct {
// +kubebuilder:resource:scope=Cluster,shortName=gtr
// +kubebuilder:printcolumn:name="Items",type="integer",JSONPath=".status.size",description="The total amount of items being replicated"
// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description="Reconcile Status for the tenant"
// +kubebuilder:printcolumn:name="Healthy",type="string",JSONPath=".status.conditions[?(@.type==\"Healthy\")].status",description="Health Status of the replicated objects"
// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description="Reconcile Message for the tenant"
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="Age"

Expand Down
1 change: 1 addition & 0 deletions api/v1beta2/tenantresource_namespaced.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ type TenantResourceStatus struct {
// +kubebuilder:subresource:status
// +kubebuilder:printcolumn:name="Items",type="integer",JSONPath=".status.size",description="The total amount of items being replicated"
// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description="Reconcile Status for the tenant"
// +kubebuilder:printcolumn:name="Healthy",type="string",JSONPath=".status.conditions[?(@.type==\"Healthy\")].status",description="Health Status of the replicated objects"
// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description="Reconcile Message for the tenant"
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="Age"

Expand Down
35 changes: 35 additions & 0 deletions api/v1beta2/tenantresource_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,41 @@ type TenantResourceCommonSpec struct {
Cordoned *bool `json:"cordoned,omitempty"`
// Defines the rules to select targeting Namespace, along with the objects that must be replicated.
Resources []ResourceSpec `json:"resources"`
// Define health checks against the replicated resources. Objects matching an
// entry (by apiVersion and kind) are evaluated with the given CEL expressions;
// objects without a matching entry are evaluated using kstatus. The outcome is
// aggregated into the Healthy condition and is re-evaluated on each resyncPeriod.
// +optional
HealthChecks []HealthCheckSpec `json:"healthChecks,omitempty"`
}

// HealthCheckSpec defines how objects of a given apiVersion/kind are evaluated
// for health. The CEL expressions follow the Flux healthCheckExprs convention:
// the object's top-level fields (status, metadata, spec, ...) are exposed
// directly, so an expression such as
// `status.conditions.filter(e, e.type == 'Ready').all(e, e.status == 'True')`
// can be used as-is. Expressions must evaluate to a boolean.
type HealthCheckSpec struct {
// APIVersion of the objects this health check applies to (e.g. "apps/v1").
// +required
APIVersion string `json:"apiVersion"`
// Kind of the objects this health check applies to (e.g. "Deployment").
// +required
Kind string `json:"kind"`
// Current is a CEL expression which is true when the object has reached its
// desired state (healthy).
// +optional
Current string `json:"current,omitempty"`
// Failed is a CEL expression which is true when the object has permanently
// failed (unhealthy).
// +optional
Failed string `json:"failed,omitempty"`
// InProgress is a CEL expression which is true when the object is still
// progressing. It is evaluated after failed and before current, so a matching
// inProgress holds back a premature healthy verdict. Optional; when omitted,
// "not failed and not current" is already treated as in progress.
// +optional
InProgress string `json:"inProgress,omitempty"`
}

type TenantResourceCommonSpecSettings struct {
Expand Down
20 changes: 20 additions & 0 deletions api/v1beta2/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 8 additions & 0 deletions charts/capsule/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -374,6 +374,14 @@ The following Values have changed key or Value:
| webhooks.hooks.services.objectSelector | object | `{}` | [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector) |
| webhooks.hooks.services.opts | object | `{}` | Capsule Hook Options |
| webhooks.hooks.tenantResourceObjects | object | `{}` | Deprecated, use webhooks.hooks.replications instead |
| webhooks.hooks.tenantresources | object | `{"enabled":true,"failurePolicy":"Fail","matchConditions":[],"matchPolicy":"Equivalent","namespaceSelector":{},"objectSelector":{},"rules":[{"apiGroups":["capsule.clastix.io"],"apiVersions":["v1beta2"],"operations":["CREATE","UPDATE"],"resources":["tenantresources"],"scope":"Namespaced"},{"apiGroups":["capsule.clastix.io"],"apiVersions":["v1beta2"],"operations":["CREATE","UPDATE"],"resources":["globaltenantresources"],"scope":"Cluster"}]}` | Webhook for TenantResource/GlobalTenantResource healthChecks validation |
| webhooks.hooks.tenantresources.enabled | bool | `true` | Enable the Hook |
| webhooks.hooks.tenantresources.failurePolicy | string | `"Fail"` | [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy) |
| webhooks.hooks.tenantresources.matchConditions | list | `[]` | [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy) |
| webhooks.hooks.tenantresources.matchPolicy | string | `"Equivalent"` | [MatchPolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy) |
| webhooks.hooks.tenantresources.namespaceSelector | object | `{}` | [NamespaceSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector) |
| webhooks.hooks.tenantresources.objectSelector | object | `{}` | [ObjectSelector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector) |
| webhooks.hooks.tenantresources.rules | list | `[{"apiGroups":["capsule.clastix.io"],"apiVersions":["v1beta2"],"operations":["CREATE","UPDATE"],"resources":["tenantresources"],"scope":"Namespaced"},{"apiGroups":["capsule.clastix.io"],"apiVersions":["v1beta2"],"operations":["CREATE","UPDATE"],"resources":["globaltenantresources"],"scope":"Cluster"}]` | [Rules](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-rules) |
| webhooks.hooks.tenants.enabled | bool | `true` | Enable the Hook |
| webhooks.hooks.tenants.failurePolicy | string | `"Fail"` | [FailurePolicy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy) |
| webhooks.hooks.tenants.matchConditions | list | `[]` | [MatchConditions](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy) |
Expand Down
64 changes: 64 additions & 0 deletions charts/capsule/crds/capsule.clastix.io_globaltenantresources.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,10 @@ spec:
jsonPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- description: Health Status of the replicated objects
jsonPath: .status.conditions[?(@.type=="Healthy")].status
name: Healthy
type: string
- description: Reconcile Message for the tenant
jsonPath: .status.conditions[?(@.type=="Ready")].message
name: Status
Expand Down Expand Up @@ -83,6 +87,51 @@ spec:
- name
type: object
type: array
healthChecks:
description: |-
Define health checks against the replicated resources. Objects matching an
entry (by apiVersion and kind) are evaluated with the given CEL expressions;
objects without a matching entry are evaluated using kstatus. The outcome is
aggregated into the Healthy condition and is re-evaluated on each resyncPeriod.
items:
description: |-
HealthCheckSpec defines how objects of a given apiVersion/kind are evaluated
for health. The CEL expressions follow the Flux healthCheckExprs convention:
the object's top-level fields (status, metadata, spec, ...) are exposed
directly, so an expression such as
`status.conditions.filter(e, e.type == 'Ready').all(e, e.status == 'True')`
can be used as-is. Expressions must evaluate to a boolean.
properties:
apiVersion:
description: APIVersion of the objects this health check applies
to (e.g. "apps/v1").
type: string
current:
description: |-
Current is a CEL expression which is true when the object has reached its
desired state (healthy).
type: string
failed:
description: |-
Failed is a CEL expression which is true when the object has permanently
failed (unhealthy).
type: string
inProgress:
description: |-
InProgress is a CEL expression which is true when the object is still
progressing. It is evaluated after failed and before current, so a matching
inProgress holds back a premature healthy verdict. Optional; when omitted,
"not failed and not current" is already treated as in progress.
type: string
kind:
description: Kind of the objects this health check applies to
(e.g. "Deployment").
type: string
required:
- apiVersion
- kind
type: object
type: array
pruningOnDelete:
default: true
description: |-
Expand Down Expand Up @@ -547,6 +596,21 @@ spec:
description: Indicates wether the resource was created or
adopted
type: boolean
healthMessage:
description: |-
HealthMessage is a human readable message with details about the health of
this individual replicated object.
type: string
healthy:
description: |-
Healthy reports the health of this individual replicated object, as evaluated
via the resource's healthChecks (CEL) or the kstatus fallback. One of True,
False, Unknown. Unset when no health evaluation has run yet.
enum:
- "True"
- "False"
- Unknown
type: string
lastApply:
description: |-
An opaque value that represents the internal version of this object that can
Expand Down
64 changes: 64 additions & 0 deletions charts/capsule/crds/capsule.clastix.io_tenantresources.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ spec:
jsonPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- description: Health Status of the replicated objects
jsonPath: .status.conditions[?(@.type=="Healthy")].status
name: Healthy
type: string
- description: Reconcile Message for the tenant
jsonPath: .status.conditions[?(@.type=="Ready")].message
name: Status
Expand Down Expand Up @@ -83,6 +87,51 @@ spec:
- name
type: object
type: array
healthChecks:
description: |-
Define health checks against the replicated resources. Objects matching an
entry (by apiVersion and kind) are evaluated with the given CEL expressions;
objects without a matching entry are evaluated using kstatus. The outcome is
aggregated into the Healthy condition and is re-evaluated on each resyncPeriod.
items:
description: |-
HealthCheckSpec defines how objects of a given apiVersion/kind are evaluated
for health. The CEL expressions follow the Flux healthCheckExprs convention:
the object's top-level fields (status, metadata, spec, ...) are exposed
directly, so an expression such as
`status.conditions.filter(e, e.type == 'Ready').all(e, e.status == 'True')`
can be used as-is. Expressions must evaluate to a boolean.
properties:
apiVersion:
description: APIVersion of the objects this health check applies
to (e.g. "apps/v1").
type: string
current:
description: |-
Current is a CEL expression which is true when the object has reached its
desired state (healthy).
type: string
failed:
description: |-
Failed is a CEL expression which is true when the object has permanently
failed (unhealthy).
type: string
inProgress:
description: |-
InProgress is a CEL expression which is true when the object is still
progressing. It is evaluated after failed and before current, so a matching
inProgress holds back a premature healthy verdict. Optional; when omitted,
"not failed and not current" is already treated as in progress.
type: string
kind:
description: Kind of the objects this health check applies to
(e.g. "Deployment").
type: string
required:
- apiVersion
- kind
type: object
type: array
pruningOnDelete:
default: true
description: |-
Expand Down Expand Up @@ -482,6 +531,21 @@ spec:
description: Indicates wether the resource was created or
adopted
type: boolean
healthMessage:
description: |-
HealthMessage is a human readable message with details about the health of
this individual replicated object.
type: string
healthy:
description: |-
Healthy reports the health of this individual replicated object, as evaluated
via the resource's healthChecks (CEL) or the kstatus fallback. One of True,
False, Unknown. Unset when no health evaluation has run yet.
enum:
- "True"
- "False"
- Unknown
type: string
lastApply:
description: |-
An opaque value that represents the internal version of this object that can
Expand Down
32 changes: 32 additions & 0 deletions charts/capsule/templates/configuration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -889,6 +889,38 @@ spec:
timeoutSeconds: {{ $.Values.webhooks.validatingWebhooksTimeoutSeconds }}
{{- end }}
{{- end }}
{{- with .Values.webhooks.hooks.tenantresources }}
{{- if .enabled }}
{{- $any = true }}
- name: tenantresources.validating.projectcapsule.dev
{{- with .opts }}
opts:
{{- toYaml . | nindent 10 }}
{{- end }}
admissionReviewVersions:
- v1
- v1beta1
path: "/tenantresources/validating"
failurePolicy: {{ .failurePolicy }}
matchPolicy: {{ .matchPolicy }}
{{- with .namespaceSelector }}
namespaceSelector:
{{- toYaml . | nindent 10 }}
{{- end }}
{{- with .objectSelector }}
objectSelector:
{{- toYaml . | nindent 10 }}
{{- end }}
{{- with .matchConditions }}
matchConditions:
{{- toYaml . | nindent 10 }}
{{- end }}
rules:
{{- toYaml .rules | nindent 10 }}
sideEffects: None
timeoutSeconds: {{ $.Values.webhooks.validatingWebhooksTimeoutSeconds }}
{{- end }}
{{- end }}
{{- with .Values.webhooks.hooks.calculations }}
{{- if .enabled }}
{{- $any = true }}
Expand Down
Loading