OCM Policy is Degraded in ArgoCD When Violated
- Dominant language
- Go
- Stars
- 24.2k
- Forks
- 7.8k
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 239
Description
Checklist:
* [x] I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
* [x] I've included steps to reproduce the bug.
* [ ] I've pasted the output of `argocd version`.
**Describe the bug**
We use open-cluster-management operator (OCM/ACM) to manage multiple Kubernetes cluster and use the policy CRD to do so. When a policy is non compliant the policy becomes Degraded. The issue is that we check for things like non-secure routes, clusters that use SDN instead OVNKubernetes. When there is a cluster that violates this policy the policy becomes degraded. This make it look like the ArgoCD application has an issue and the OCM Policy is not working properly, when it is deployed and working well.
**To Reproduce**
Use Argocd 1.13+ and any Kubernetes version/OCM operator that are compatible.
Deploy an OCM Policy, a Placement that contains the local cluster, a PlacementBinding that connect the placement and policy, and a ManagedClusterSetBinding that links the default clusterset using ArgoCD, and make sure the policy has a violation.
All of the YAMLs will be added in the comments or this description in the future.
**Expected behavior**
As I see it, the policy should be degraded only if there was an error in the status of the policy. for example, when the policy is configured poorly.
**Screenshots**
**Version**
```shell
Paste the output from `argocd version` here.
```
ArgoCD 2.13
**Reference**
Paste any relevant application logs here:
https://github.com/argoproj/argo-cd/blob/463155b8b4a21583867853f26ab22250c80bc2e4/resource_customizations/policy.open-cluster-management.io/Policy/health.lua#L22-L26
Contributor guide
Research direction
Start at resource_customizations/policy.open-cluster-management.io/Policy/health.lua#L22-L26 and reproduce the behavior with ArgoCD 2.13, an OCM Policy, and a policy violation. The work is done when a non-compliant policy is not reported as degraded unless the policy status contains an actual error; the issue does not yet provide the promised YAML examples or an argocd version output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes, lua
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100