feat: Implement kyverno health checks

[sandert-k8s]

Feat: Implement Kyverno health checks.

This has been done for the new Kyverno CRD's, and also for one "old" CR, the ClusterPolicy. That one will be deprecated in kyverno 1.20 (current newest version 1.17). I added the ClusterPolicy, since the namespaced Policy was already there.

Resource	Group	Logic
ClusterPolicy	kyverno.io	status.conditions[type=Ready] → True=Healthy, False=Degraded, absent=Progressing
DeletingPolicy	policies.kyverno.io	conditionStatus.ready, first True condition message
GeneratingPolicy	policies.kyverno.io	conditionStatus.ready, first True condition message
ImageValidatingPolicy	policies.kyverno.io	conditionStatus.ready, WebhookConfigured fallback
MutatingPolicy	policies.kyverno.io	conditionStatus.ready, WebhookConfigured fallback
NamespacedDeletingPolicy	policies.kyverno.io	conditionStatus.ready, first True condition message
NamespacedGeneratingPolicy	policies.kyverno.io	conditionStatus.ready, first True condition message
NamespacedImageValidatingPolicy	policies.kyverno.io	conditionStatus.ready, WebhookConfigured fallback
NamespacedMutatingPolicy	policies.kyverno.io	conditionStatus.ready, WebhookConfigured fallback
NamespacedValidatingPolicy	policies.kyverno.io	conditionStatus.ready, WebhookConfigured fallback
ValidatingPolicy	policies.kyverno.io	conditionStatus.ready, WebhookConfigured fallback

Used the same setup/logic as my previous PR for health checks

[bunnyshell]

🔴 Preview Environment stopped on Bunnyshell

See: Environment Details | Pipeline Logs

Available commands (reply to this comment):

• 🔵 /bns:start to start the environment
• 🚀 /bns:deploy to redeploy the environment
• ❌ /bns:delete to remove the environment

[Copilot]

Pull request overview

Adds Argo CD resource customization health checks for Kyverno policy CRDs (new policies.kyverno.io/* types plus kyverno.io/ClusterPolicy), using Lua-based health scripts and corresponding YAML-driven tests so these resources report meaningful Healthy/Degraded/Progressing statuses in the UI.

Changes:

• Added health.lua implementations for Kyverno policy resources to map Kyverno status/conditions into Argo CD health states.
• Added health_test.yaml test suites plus testdata/{progressing,healthy,degraded}.yaml fixtures for each new customization.
• Added a new customization for kyverno.io/ClusterPolicy (in addition to the pre-existing kyverno.io/Policy).

Reviewed changes

Copilot reviewed 55 out of 55 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
resource_customizations/policies.kyverno.io/ValidatingPolicy/health.lua	Health check logic for ValidatingPolicy (ready/conditions-based)
resource_customizations/policies.kyverno.io/ValidatingPolicy/health_test.yaml	Health test cases for ValidatingPolicy
resource_customizations/policies.kyverno.io/ValidatingPolicy/testdata/progressing.yaml	Fixture: no status yet → Progressing
resource_customizations/policies.kyverno.io/ValidatingPolicy/testdata/healthy.yaml	Fixture: ready/condition true → Healthy
resource_customizations/policies.kyverno.io/ValidatingPolicy/testdata/degraded.yaml	Fixture: ready/condition false → Degraded
resource_customizations/policies.kyverno.io/NamespacedValidatingPolicy/health.lua	Health check logic for NamespacedValidatingPolicy
resource_customizations/policies.kyverno.io/NamespacedValidatingPolicy/health_test.yaml	Health test cases for NamespacedValidatingPolicy
resource_customizations/policies.kyverno.io/NamespacedValidatingPolicy/testdata/progressing.yaml	Fixture for Progressing
resource_customizations/policies.kyverno.io/NamespacedValidatingPolicy/testdata/healthy.yaml	Fixture for Healthy
resource_customizations/policies.kyverno.io/NamespacedValidatingPolicy/testdata/degraded.yaml	Fixture for Degraded
resource_customizations/policies.kyverno.io/MutatingPolicy/health.lua	Health check logic for MutatingPolicy
resource_customizations/policies.kyverno.io/MutatingPolicy/health_test.yaml	Health test cases for MutatingPolicy
resource_customizations/policies.kyverno.io/MutatingPolicy/testdata/progressing.yaml	Fixture for Progressing
resource_customizations/policies.kyverno.io/MutatingPolicy/testdata/healthy.yaml	Fixture for Healthy
resource_customizations/policies.kyverno.io/MutatingPolicy/testdata/degraded.yaml	Fixture for Degraded
resource_customizations/policies.kyverno.io/NamespacedMutatingPolicy/health.lua	Health check logic for NamespacedMutatingPolicy
resource_customizations/policies.kyverno.io/NamespacedMutatingPolicy/health_test.yaml	Health test cases for NamespacedMutatingPolicy
resource_customizations/policies.kyverno.io/NamespacedMutatingPolicy/testdata/progressing.yaml	Fixture for Progressing
resource_customizations/policies.kyverno.io/NamespacedMutatingPolicy/testdata/healthy.yaml	Fixture for Healthy
resource_customizations/policies.kyverno.io/NamespacedMutatingPolicy/testdata/degraded.yaml	Fixture for Degraded
resource_customizations/policies.kyverno.io/ImageValidatingPolicy/health.lua	Health check logic for ImageValidatingPolicy
resource_customizations/policies.kyverno.io/ImageValidatingPolicy/health_test.yaml	Health test cases for ImageValidatingPolicy
resource_customizations/policies.kyverno.io/ImageValidatingPolicy/testdata/progressing.yaml	Fixture for Progressing
resource_customizations/policies.kyverno.io/ImageValidatingPolicy/testdata/healthy.yaml	Fixture for Healthy
resource_customizations/policies.kyverno.io/ImageValidatingPolicy/testdata/degraded.yaml	Fixture for Degraded
resource_customizations/policies.kyverno.io/NamespacedImageValidatingPolicy/health.lua	Health check logic for NamespacedImageValidatingPolicy
resource_customizations/policies.kyverno.io/NamespacedImageValidatingPolicy/health_test.yaml	Health test cases for NamespacedImageValidatingPolicy
resource_customizations/policies.kyverno.io/NamespacedImageValidatingPolicy/testdata/progressing.yaml	Fixture for Progressing
resource_customizations/policies.kyverno.io/NamespacedImageValidatingPolicy/testdata/healthy.yaml	Fixture for Healthy
resource_customizations/policies.kyverno.io/NamespacedImageValidatingPolicy/testdata/degraded.yaml	Fixture for Degraded
resource_customizations/policies.kyverno.io/GeneratingPolicy/health.lua	Health check logic for GeneratingPolicy
resource_customizations/policies.kyverno.io/GeneratingPolicy/health_test.yaml	Health test cases for GeneratingPolicy
resource_customizations/policies.kyverno.io/GeneratingPolicy/testdata/progressing.yaml	Fixture for Progressing
resource_customizations/policies.kyverno.io/GeneratingPolicy/testdata/healthy.yaml	Fixture for Healthy
resource_customizations/policies.kyverno.io/GeneratingPolicy/testdata/degraded.yaml	Fixture for Degraded
resource_customizations/policies.kyverno.io/NamespacedGeneratingPolicy/health.lua	Health check logic for NamespacedGeneratingPolicy
resource_customizations/policies.kyverno.io/NamespacedGeneratingPolicy/health_test.yaml	Health test cases for NamespacedGeneratingPolicy
resource_customizations/policies.kyverno.io/NamespacedGeneratingPolicy/testdata/progressing.yaml	Fixture for Progressing
resource_customizations/policies.kyverno.io/NamespacedGeneratingPolicy/testdata/healthy.yaml	Fixture for Healthy
resource_customizations/policies.kyverno.io/NamespacedGeneratingPolicy/testdata/degraded.yaml	Fixture for Degraded
resource_customizations/policies.kyverno.io/DeletingPolicy/health.lua	Health check logic for DeletingPolicy
resource_customizations/policies.kyverno.io/DeletingPolicy/health_test.yaml	Health test cases for DeletingPolicy
resource_customizations/policies.kyverno.io/DeletingPolicy/testdata/progressing.yaml	Fixture for Progressing
resource_customizations/policies.kyverno.io/DeletingPolicy/testdata/healthy.yaml	Fixture for Healthy
resource_customizations/policies.kyverno.io/DeletingPolicy/testdata/degraded.yaml	Fixture for Degraded
resource_customizations/policies.kyverno.io/NamespacedDeletingPolicy/health.lua	Health check logic for NamespacedDeletingPolicy
resource_customizations/policies.kyverno.io/NamespacedDeletingPolicy/health_test.yaml	Health test cases for NamespacedDeletingPolicy
resource_customizations/policies.kyverno.io/NamespacedDeletingPolicy/testdata/progressing.yaml	Fixture for Progressing
resource_customizations/policies.kyverno.io/NamespacedDeletingPolicy/testdata/healthy.yaml	Fixture for Healthy
resource_customizations/policies.kyverno.io/NamespacedDeletingPolicy/testdata/degraded.yaml	Fixture for Degraded
resource_customizations/kyverno.io/ClusterPolicy/health.lua	Health check logic for ClusterPolicy based on Ready condition
resource_customizations/kyverno.io/ClusterPolicy/health_test.yaml	Health test cases for ClusterPolicy
resource_customizations/kyverno.io/ClusterPolicy/testdata/progressing.yaml	Fixture for Progressing
resource_customizations/kyverno.io/ClusterPolicy/testdata/healthy.yaml	Fixture for Healthy
resource_customizations/kyverno.io/ClusterPolicy/testdata/degraded.yaml	Fixture for Degraded

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.41%. Comparing base (6ba0727) to head (dc3a3fd).
⚠️ Report is 31 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #27354      +/-   ##
==========================================
+ Coverage   63.34%   63.41%   +0.07%     
==========================================
  Files         415      417       +2     
  Lines       56697    56981     +284     
==========================================
+ Hits        35917    36137     +220     
- Misses      17395    17450      +55     
- Partials     3385     3394       +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[crenshaw-dev]

Do these resources/conditions expose observedGeneration fields? If so, it's best practice to compare that to metadata.generation and return Progressing on mismatch, since the controller hasn't reconciled the updated spec yet.

[sandert-k8s]

Do these resources/conditions expose observedGeneration fields? If so, it's best practice to compare that to metadata.generation and return Progressing on mismatch, since the controller hasn't reconciled the updated spec yet.

Thanks for the review @crenshaw-dev . Unfortunately, I do not see observedGeneration in all resources of Kyverno, so that doesn't work.

Edit:
I do not see the observedGeneration fields in my deployed manifests, but I do see that the CRD has them. I'll check it why I don't have this field.

[crenshaw-dev]

Check the status field at runtime, it's not in the spec.

[sandert-k8s]

@crenshaw-dev Altough this is in the CRD spec, the kyverno controller does not populate this. I added PR's to add this. 1 and 2
Meanwile, I added it here, but with a safeguard. If the observedGeneration is there, use it. But if it isn't, just don't. So it is backwards compatible with the current way of working, but it is also future proofed with the controller adjustments.