rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

Browse Source
This commit is contained in:
Ryan Blundon
2025-03-30 15:46:16 -05:00
parent 68785684d5 fe564d7227
commit d76d8f8e05
346 changed files with 11754 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cluster-config/components/gitops-operator/overlays/shared/README.md Normal file
View File

@@ -0,0 +1,2 @@
This is a shared GitOps instance intended for tenants leveraging the new
Applications in Any Namespace feature GA in OpenShift GitOps 1.13

184
cluster-config/components/gitops-operator/overlays/shared/argocd-cluster-role.yaml Normal file
View File

@@ -0,0 +1,184 @@
# ClusterRole to aggregate permissions needed to use respectRBAC
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: gitops-shared-cluster-access
aggregationRule:
clusterRoleSelectors:
- matchLabels:
gitops/aggregate-to-gitops-shared: "true"
rules: []
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: gitops-shared-cluster-access-view
labels:
gitops/aggregate-to-gitops-shared: "true"
# Use the aggrated view permission to determine what resources can be deployed.
#
# Note that write permissions for these resources in specific namespaces
# are determined by the cluster role granted via the "managed-by" label.
# You still need to grant the controller cluster level list permissions
# to pass the SubjectAccessReview. The view role gives get and watch as well
# so if you want to restrict permissions to just list you need to maintain
# your own hand-crafted list which turns out to be burdensome.
aggregationRule:
clusterRoleSelectors:
- matchLabels:
rbac.authorization.k8s.io/aggregate-to-view: "true"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: gitops-shared-cluster-access-base
labels:
gitops/aggregate-to-gitops-shared: "true"
rules:
# Base permissions the applicaton-controller needs for respectRBAC separate from resources
# grant read/write permissions so Argo CD UI and controllers can update status of resources.
- apiGroups:
- argoproj.io
resources:
- applications
- applicationsets
- appprojects
- rolloutmanagers
- rollouts
verbs:
- "*"
# SubjectAccessReview needed for respectRBAC=strict setting in Argo CD
- apiGroups:
- authorization.k8s.io
resources:
- selfsubjectaccessreviews
verbs:
- create
# Needs ability to list projects for some reason
- apiGroups:
- config.openshift.io
resources:
- "*"
verbs:
- get
- list
- watch
# Hand-crafted list of what we want to have Argo CD be able to use, turns
# out list becomes huge and hard to maintain so I have opted to just leverage
# the built-in view role. However if you want total control over permissions
# you can use these instead
# # Limited resource permissions here for tenants to deploy things
# - apiGroups:
# - ""
# resources:
# - configmaps
# - endpoints
# - persistentvolumeclaims
# - persistentvolumeclaims/status
# - pods
# - replicationcontrollers
# - replicationcontrollers/scale
# - serviceaccounts
# - services
# - services/status
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - ""
# resources:
# - bindings
# - events
# - limitranges
# - namespaces/status
# - pods/log
# - pods/status
# - replicationcontrollers/status
# - resourcequotas
# - resourcequotas/status
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - apps
# resources:
# - controllerrevisions
# - daemonsets
# - daemonsets/status
# - deployments
# - deployments/scale
# - deployments/status
# - replicasets
# - replicasets/scale
# - replicasets/status
# - statefulsets
# - statefulsets/scale
# - statefulsets/status
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - ""
# - route.openshift.io
# resources:
# - routes
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - ""
# - route.openshift.io
# resources:
# - routes/status
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - networking.k8s.io
# resources:
# - networkpolicies
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - rbac.authorization.k8s.io
# resources:
# - roles
# - rolebindings
# verbs:
# - get
# - list
# - watch
# - apiGroups:
# - monitoring.coreos.com
# resources:
# - servicemonitors
# verbs:
# - get
# - list
# - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: gitops-shared-cluster-access
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: gitops-shared-cluster-access
subjects:
- kind: ServiceAccount
name: argocd-argocd-application-controller
namespace: gitops
- kind: ServiceAccount
name: argocd-argocd-server
namespace: gitops
- kind: ServiceAccount
name: argocd-applicationset-controller
namespace: gitops

557
cluster-config/components/gitops-operator/overlays/shared/argocd-notifications-cm.yaml Normal file
View File

@@ -0,0 +1,557 @@
apiVersion: v1
data:
template.app-created: |-
email:
subject: Application {{.app.metadata.name}} has been created.
message: Application {{.app.metadata.name}} has been created.
teams:
title: Application {{.app.metadata.name}} has been created.
template.app-deleted: |-
email:
subject: Application {{.app.metadata.name}} has been deleted.
message: Application {{.app.metadata.name}} has been deleted.
teams:
title: Application {{.app.metadata.name}} has been deleted.
template.app-deployed: |-
email:
subject: New version of an application {{.app.metadata.name}} is up and running.
message: |
{{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} is now running new version of deployments manifests.
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#18be52",
"fields": [
{
"title": "Sync Status",
"value": "{{.app.status.sync.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
},
{
"title": "Revision",
"value": "{{.app.status.sync.revision}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Sync Status",
"value": "{{.app.status.sync.status}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
},
{
"name": "Revision",
"value": "{{.app.status.sync.revision}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |-
[{
"@type":"OpenUri",
"name":"Operation Application",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
themeColor: '#000080'
title: New version of an application {{.app.metadata.name}} is up and running.
template.app-health-degraded: |-
email:
subject: Application {{.app.metadata.name}} has degraded.
message: |
{{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} has degraded.
Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#f4c030",
"fields": [
{
"title": "Health Status",
"value": "{{.app.status.health.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Health Status",
"value": "{{.app.status.health.status}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |
[{
"@type":"OpenUri",
"name":"Open Application",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
themeColor: '#FF0000'
title: Application {{.app.metadata.name}} has degraded.
template.app-sync-failed: |-
email:
subject: Failed to sync application {{.app.metadata.name}}.
message: |
{{if eq .serviceType "slack"}}:exclamation:{{end}} The sync operation of application {{.app.metadata.name}} has failed at {{.app.status.operationState.finishedAt}} with the following error: {{.app.status.operationState.message}}
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#E96D76",
"fields": [
{
"title": "Sync Status",
"value": "{{.app.status.sync.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Sync Status",
"value": "{{.app.status.sync.status}}"
},
{
"name": "Failed at",
"value": "{{.app.status.operationState.finishedAt}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |-
[{
"@type":"OpenUri",
"name":"Open Operation",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
themeColor: '#FF0000'
title: Failed to sync application {{.app.metadata.name}}.
template.app-sync-running: |-
email:
subject: Start syncing application {{.app.metadata.name}}.
message: |
The sync operation of application {{.app.metadata.name}} has started at {{.app.status.operationState.startedAt}}.
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#0DADEA",
"fields": [
{
"title": "Sync Status",
"value": "{{.app.status.sync.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Sync Status",
"value": "{{.app.status.sync.status}}"
},
{
"name": "Started at",
"value": "{{.app.status.operationState.startedAt}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |-
[{
"@type":"OpenUri",
"name":"Open Operation",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
title: Start syncing application {{.app.metadata.name}}.
template.app-sync-status-unknown: |-
email:
subject: Application {{.app.metadata.name}} sync status is 'Unknown'
message: |
{{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} sync is 'Unknown'.
Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.
{{if ne .serviceType "slack"}}
{{range $c := .app.status.conditions}}
* {{$c.message}}
{{end}}
{{end}}
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#E96D76",
"fields": [
{
"title": "Sync Status",
"value": "{{.app.status.sync.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Sync Status",
"value": "{{.app.status.sync.status}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |-
[{
"@type":"OpenUri",
"name":"Open Application",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
title: Application {{.app.metadata.name}} sync status is 'Unknown'
template.app-sync-succeeded: |-
email:
subject: Application {{.app.metadata.name}} has been successfully synced.
message: |
{{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} has been successfully synced at {{.app.status.operationState.finishedAt}}.
Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .
slack:
attachments: |
[{
"title": "{{ .app.metadata.name}}",
"title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
"color": "#18be52",
"fields": [
{
"title": "Sync Status",
"value": "{{.app.status.sync.status}}",
"short": true
},
{
"title": "Repository",
"value": "{{.app.spec.source.repoURL}}",
"short": true
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"title": "{{$c.type}}",
"value": "{{$c.message}}",
"short": true
}
{{end}}
]
}]
deliveryPolicy: Post
groupingKey: ""
notifyBroadcast: false
teams:
facts: |
[{
"name": "Sync Status",
"value": "{{.app.status.sync.status}}"
},
{
"name": "Synced at",
"value": "{{.app.status.operationState.finishedAt}}"
},
{
"name": "Repository",
"value": "{{.app.spec.source.repoURL}}"
}
{{range $index, $c := .app.status.conditions}}
{{if not $index}},{{end}}
{{if $index}},{{end}}
{
"name": "{{$c.type}}",
"value": "{{$c.message}}"
}
{{end}}
]
potentialAction: |-
[{
"@type":"OpenUri",
"name":"Operation Details",
"targets":[{
"os":"default",
"uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
}]
},
{
"@type":"OpenUri",
"name":"Open Repository",
"targets":[{
"os":"default",
"uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}"
}]
}]
themeColor: '#000080'
title: Application {{.app.metadata.name}} has been successfully synced
trigger.on-created: |-
- description: Application is created.
oncePer: app.metadata.name
send:
- app-created
when: "true"
trigger.on-deleted: |-
- description: Application is deleted.
oncePer: app.metadata.name
send:
- app-deleted
when: app.metadata.deletionTimestamp != nil
trigger.on-deployed: |-
- description: Application is synced and healthy. Triggered once per commit.
oncePer: app.status.operationState.syncResult.revision
send:
- app-deployed
when: app.status.operationState.phase in ['Succeeded'] and app.status.health.status
== 'Healthy'
trigger.on-health-degraded: |-
- description: Application has degraded
send:
- app-health-degraded
when: app.status.health.status == 'Degraded'
trigger.on-sync-failed: |-
- description: Application syncing has failed
send:
- app-sync-failed
when: app.status.operationState.phase in ['Error', 'Failed']
trigger.on-sync-running: |-
- description: Application is being synced
send:
- app-sync-running
when: app.status.operationState.phase in ['Running']
trigger.on-sync-status-unknown: |-
- description: Application status is 'Unknown'
end:
- app-sync-status-unknown
when: app.status.sync.status == 'Unknown'
trigger.on-sync-succeeded: |-
- description: Application syncing has succeeded
send:
- app-sync-succeeded
- server-post-prod-app-sync
when: app.status.operationState.phase in ['Succeeded']
# Tekton Webhook Definitions
service.webhook.server-post-prod: |-
url: http://el-server-post-prod.product-catalog-cicd.svc:8080
template.server-post-prod-app-sync: |-
webhook:
server-post-prod:
method: POST
path: /
body: |
{
{{if eq .app.status.operationState.phase "Running"}} "state": "pending"{{end}}
{{if eq .app.status.operationState.phase "Succeeded"}} "state": "success"{{end}}
{{if eq .app.status.operationState.phase "Error"}} "state": "error"{{end}}
{{if eq .app.status.operationState.phase "Failed"}} "state": "error"{{end}},
"description": "ArgoCD",
"application": "{{.app.metadata.name}}"
}
kind: ConfigMap
metadata:
labels:
app.kubernetes.io/managed-by: argocd
app.kubernetes.io/name: argocd-notifications-cm
app.kubernetes.io/part-of: argocd
name: argocd-notifications-cm
namespace: product-catalog-gitops

12
cluster-config/components/gitops-operator/overlays/shared/console-link.yaml Normal file
View File

File diff suppressed because one or more lines are too long

14
cluster-config/components/gitops-operator/overlays/shared/gitops-monitoring-cluster-role.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: gitops-monitoring-cluster-role
labels:
gitops/aggregate-to-controller: "true"
rules:
- apiGroups:
- monitoring.coreos.com
resources:
- servicemonitors
- podmonitors
verbs:
- '*'

28
cluster-config/components/gitops-operator/overlays/shared/global-appproject.yaml Normal file
View File

@@ -0,0 +1,28 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: global
spec:
description: Global Configuration
clusterResourceBlacklist:
- group: '*'
kind: '*'
namespaceResourceBlacklist:
- group: ''
kind: Namespace
- group: ''
kind: ResourceQuota
- group: ''
kind: LimitRange
- group: operators.coreos.com
kind: '*'
- group: operator.openshift.io
kind: '*'
- group: storage.k8s.io
kind: '*'
- group: machine.openshift.io
kind: '*'
- group: machineconfiguration.openshift.io
kind: '*'
- group: compliance.openshift.io
kind: '*'

73
cluster-config/components/gitops-operator/overlays/shared/kustomization.yaml Normal file
View File

@@ -0,0 +1,73 @@
namespace: gitops
resources:
- ../../base
- argocd-cluster-role.yaml
- gitops-monitoring-cluster-role.yaml
- namespace.yaml
- argocd-notifications-cm.yaml
- console-link.yaml
- global-appproject.yaml
- prometheus-rules.yaml
patches:
# Update permissions for tenants and local accounts, note ACCOUNT_NAMESPACES is space separated
- patch: |-
- op: replace
path: /spec/template/spec/containers/0/env
value:
- name: ACCOUNTS_NAMESPACES
value: "product-catalog-pipeline=product-catalog-cicd rollouts-demo-pipeline=rollouts-demo-cicd"
- name: ARGO_SERVER_HOST
value: "argocd-server-gitops.${SUB_DOMAIN}"
target:
kind: Job
name: create-pipeline-local-user
- target:
kind: ArgoCD
name: argocd
patch: |-
- op: add
path: /spec/defaultClusterScopedRoleDisabled
value: true
- op: add
path: /spec/extraConfig
value:
resource.respectRBAC: "strict"
exec.enabled: "true"
globalProjects: |-
- labelSelector:
matchExpressions:
- key: argocd.argoproj.io/project-inherit
operator: In
values:
- global
projectName: global
accounts.product-catalog-pipeline: apiKey
accounts.rollouts-demo-pipeline: apiKey
oidc.config: |
name: Keycloak
issuer: https://sso.ocplab.com/realms/ocplab
clientID: argocd
clientSecret: $oidc.keycloak.clientSecret
requestedScopes: ["openid", "profile", "email", "groups"]
- op: add
path: /spec/sourceNamespaces
value:
- product-catalog-gitops
- rollouts-demo-gitops
- op: add
path: /spec/rbac
value:
defaultPolicy: 'role:none'
policy: |
p, role:none, *, *, */*, deny
g, system:cluster-admins, role:admin
g, cluster-admins, role:admin
p, role:developers, clusters, get, *, allow
p, role:developers, repositories, get, *, allow
g, developers, role:developers
scopes: "[accounts,groups]"
- op: add
path: /spec/server/host
value: "argocd-server-gitops.${SUB_DOMAIN}"

7
cluster-config/components/gitops-operator/overlays/shared/namespace.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
annotations:
openshift.io/description: Project for tenants GitOps Operator instance
openshift.io/display-name: GitOps
name: gitops

35
cluster-config/components/gitops-operator/overlays/shared/prometheus-rules.yaml Normal file
View File

@@ -0,0 +1,35 @@
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: argocd-unhealthy-alert
annotations:
policy.open-cluster-management.io/disable-templates: "true"
spec:
groups:
- name: ArgoCD
rules:
- alert: ArgoCDHealthAlert
annotations:
message: ArgoCD application {{ $labels.name }} is not healthy
expr: argocd_app_info{namespace="openshift-gitops", health_status!~"Healthy|Suspended|Progressing|Degraded"} > 0
for: 5m
labels:
severity: warning
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: argocd-degraded-alert
annotations:
policy.open-cluster-management.io/disable-templates: "true"
spec:
groups:
- name: ArgoCD
rules:
- alert: ArgoCDDegradedAlert
annotations:
message: ArgoCD application {{ $labels.name }} is degraded
expr: argocd_app_info{namespace="openshift-gitops", health_status="Degraded"} > 0
for: 5m
labels:
severity: critical