argoproj / argoproj/argo-cd

OCM Policy is Degraded in ArgoCD When Violated

Open
#23,331 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
24.2k
Forks
7.8k
Avg merge
1d 6h
Merged PRs (30d)
239

Description

Checklist:

* [x] I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
* [x] I've included steps to reproduce the bug.
* [ ] I've pasted the output of `argocd version`.

**Describe the bug**

We use open-cluster-management operator (OCM/ACM) to manage multiple Kubernetes cluster and use the policy CRD to do so. When a policy is non compliant the policy becomes Degraded. The issue is that we check for things like non-secure routes, clusters that use SDN instead OVNKubernetes. When there is a cluster that violates this policy the policy becomes degraded. This make it look like the ArgoCD application has an issue and the OCM Policy is not working properly, when it is deployed and working well.

**To Reproduce**

Use Argocd 1.13+ and any Kubernetes version/OCM operator that are compatible.
Deploy an OCM Policy, a Placement that contains the local cluster, a PlacementBinding that connect the placement and policy, and a ManagedClusterSetBinding that links the default clusterset using ArgoCD, and make sure the policy has a violation.
All of the YAMLs will be added in the comments or this description in the future.

**Expected behavior**

As I see it, the policy should be degraded only if there was an error in the status of the policy. for example, when the policy is configured poorly.

**Screenshots**

**Version**

```shell
Paste the output from `argocd version` here.
```
ArgoCD 2.13

**Reference**
Paste any relevant application logs here:
https://github.com/argoproj/argo-cd/blob/463155b8b4a21583867853f26ab22250c80bc2e4/resource_customizations/policy.open-cluster-management.io/Policy/health.lua#L22-L26

Contributor guide

Open the contributing guide

Research direction

Start at resource_customizations/policy.open-cluster-management.io/Policy/health.lua#L22-L26 and reproduce the behavior with ArgoCD 2.13, an OCM Policy, and a policy violation. The work is done when a non-compliant policy is not reported as degraded unless the policy status contains an actual error; the issue does not yet provide the promised YAML examples or an argocd version output.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes, lua
Domain
devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.