From b8e53a9eed930f1decf813a36d638e2b799001e0 Mon Sep 17 00:00:00 2001
From: Michele Baldessari <michele@acksyn.org>
Date: Mon, 23 Dec 2024 09:04:21 +0100
Subject: [PATCH] Fix policy healthcheck

We can drop this once https://www.github.com/argoproj/argo-cd/pull/21297
merges
---
 templates/plumbing/argocd.yaml | 60 +++++++++++++++++++++++++++++++++-
 1 file changed, 59 insertions(+), 1 deletion(-)

diff --git a/templates/plumbing/argocd.yaml b/templates/plumbing/argocd.yaml
index bc9ac33..1dbda87 100644
--- a/templates/plumbing/argocd.yaml
+++ b/templates/plumbing/argocd.yaml
@@ -14,6 +14,64 @@ spec:
 # Adding health checks to argocd to prevent pvc resources
 # that aren't bound state from blocking deployments
   resourceHealthChecks:
+  # Drop once https://www.github.com/argoproj/argo-cd/pull/21297 merges
+  - kind: Policy
+    group: policy.open-cluster-management.io
+    check: |
+      hs = {}
+      if obj.status == nil then
+        hs.status = "Progressing"
+        hs.message = "Waiting for the status to be reported"
+        return hs
+      end
+
+      -- A policy will not have a compliant field but will have a placement key set if
+      -- it is not being applied to any clusters
+      if obj.status.compliant == nil and #obj.status.placement > 0 then
+        hs.status = "Healthy"
+        hs.message = "No clusters match this policy"
+        return hs
+      end
+
+      if obj.status.compliant == nil or obj.status.compliant == "Pending" then
+        hs.status = "Progressing"
+        hs.message = "Waiting for the status to be reported"
+        return hs
+      end
+
+      if obj.status.compliant == "Compliant" then
+        hs.status = "Healthy"
+      else
+        hs.status = "Degraded"
+      end
+      noncompliants = {}
+      if obj.status.status ~= nil then
+        -- "root" policy
+        for i, entry in ipairs(obj.status.status) do
+          if entry.compliant ~= "Compliant" then
+            table.insert(noncompliants, entry.clustername)
+          end
+        end
+        if #noncompliants == 0 then
+          hs.message = "All clusters are compliant"
+        else
+          hs.message = "NonCompliant clusters: " .. table.concat(noncompliants, ", ")
+        end
+      elseif obj.status.details ~= nil then
+        -- "replicated" policy
+        for i, entry in ipairs(obj.status.details) do
+          if entry.compliant ~= "Compliant" then
+            table.insert(noncompliants, entry.templateMeta.name)
+          end
+        end
+        if #noncompliants == 0 then
+          hs.message = "All templates are compliant"
+        else
+          hs.message = "NonCompliant templates: " .. table.concat(noncompliants, ", ")
+        end
+      end
+      return hs
+
   - kind: PersistentVolumeClaim
     check: |
       hs = {}
@@ -35,7 +93,7 @@ spec:
       return hs
 
   # FIXME(bandini): To be dropped once 49431b9add9393ef2ece78d4f63968b6c10276e0 in argocd is in a relased version
-  - kind: InferenceService 
+  - kind: InferenceService
     group: serving.kserve.io
     check: |
       local health_status = {}