前言ArgoCD 的 Health Status 告诉你应用是否真正健康——不只是 YAML 是否同步了而是 Pod 是否就绪、服务是否可用。本篇讲解 ArgoCD 内置健康检查的工作原理以及如何为自定义资源编写健康检查脚本。一、Health Status 的五种状态Healthy → 所有资源都健康服务正常运行 Progressing → 正在滚动更新部分 Pod 还在启动 Degraded → 有资源不健康可能有 Pod 崩溃 Suspended → 资源被暂停如 CronJob 暂停 Missing → 资源不存在Git 中有但集群中没有状态流转─────────── | OutOfSync | (Git 和集群有差异) ──────┬───── ↓ 同步 ─────────── | Progressing | (滚动更新中) ──────┬───── ↙ ↘ ──────── ─────────── | Healthy | | Degraded | ──────── ─────────── ↑ ↓ 修复 └─────────────────────┘二、内置健康检查ArgoCD 内置支持的资源类型资源类型健康判断逻辑DeploymentreadyReplicas replicasStatefulSetreadyReplicas replicasDaemonSetdesiredNumberScheduled numberReadyService类型为 LoadBalancer 时检查 ingress 是否分配Ingress检查是否有 assigned IP/hostnameJob成功完成CronJob最近一次调度成功PDBdisruptionsAllowed 0HPA当前指标可用检查示例argocd app get myapp # Health Status: Healthy # NAME KIND STATUS HEALTH # myapp Deployment Synced Healthy # myapp Service Synced Healthy # myapp-ingress Ingress Synced Healthy# 如果 Pod 在滚动更新中 argocd app get myapp # Health Status: Progressing # NAME KIND STATUS HEALTH # myapp Deployment Synced Progressing # → 2/4 pods ready, waiting for 2 more# 如果 Pod 崩溃 argocd app get myapp # Health Status: Degraded # NAME KIND STATUS HEALTH # myapp Deployment Synced Degraded # → 2/4 pods ready, 2 pods crashloopbackoff三、自定义健康检查Lua 脚本为什么需要自定义ArgoCD 不认识 CRD自定义资源定义的健康状态。比如你用了 Argo Rollouts金丝雀控制器ArgoCD 不知道一个 Rollout 资源什么时候算健康。用 Lua 编写健康检查# argocd-cm ConfigMap apiVersion: v1 kind: ConfigMap metadata: name: argocd-cm namespace: argocd data: # 自定义健康检查脚本 resource.customizations.health.argoproj.io_Rollout: | hs {} if obj.status ~ nil then if obj.status.phase Healthy then hs.status Healthy hs.message Rollout is healthy elseif obj.status.phase Progressing then hs.status Progressing hs.message Rollout is in progress: .. (obj.status.message or ) elseif obj.status.phase Degraded then hs.status Degraded hs.message Rollout is degraded: .. (obj.status.message or ) else hs.status Progressing hs.message Rollout phase: .. (obj.status.phase or Unknown) end else hs.status Progressing hs.message Waiting for rollout status end return hs为 CertManager Certificate 编写健康检查resource.customizations.health.cert-manager.io_Certificate: | hs {} if obj.status ~ nil and obj.status.conditions ~ nil then for i, condition in ipairs(obj.status.conditions) do if condition.type Ready then if condition.status True then hs.status Healthy hs.message Certificate is ready else hs.status Progressing hs.message Certificate is not ready: .. (condition.message or ) end return hs end end end hs.status Progressing hs.message Waiting for certificate status return hs为 ExternalSecret 编写健康检查resource.customizations.health.external-secrets.io_ExternalSecret: | hs {} if obj.status ~ nil and obj.status.conditions ~ nil then for i, condition in ipairs(obj.status.conditions) do if condition.type Ready then if condition.status True then hs.status Healthy hs.message ExternalSecret synced successfully else hs.status Degraded hs.message ExternalSecret sync failed: .. (condition.message or ) end return hs end end end hs.status Progressing hs.message Waiting for ExternalSecret to sync return hs培训要点Lua 脚本中的obj对象就是 K8s API 返回的资源 JSON。你可以检查obj.status中的任何字段。编写时先用kubectl get crd -o yaml查看实际状态结构。四、资源忽略差异IgnoreDifferences什么时候需要场景1: HPA 自动调整了副本数 Git: replicas3 集群: replicas5HPA 扩容了 → ArgoCD 报告 OutOfSync → 但这是预期行为不应该被修复 场景2: Mutating Webhook 注入了 sidecar Git: 没有 sidecar 集群: 有 sidecarIstio 注入的 → ArgoCD 报告 OutOfSync → 但这是自动注入不应该被删除配置忽略差异apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: myapp-prod namespace: argocd spec: ignoreDifferences: # 忽略 Deployment 副本数差异HPA 管理 - group: apps kind: Deployment jsonPointers: - /spec/replicas # 忽略 Pod 的 sidecar 注入 - group: kind: Pod jsonPointers: - /spec/initContainers - /spec/containers # 忽略 Service 的 clusterIPK8s 自动分配 - group: kind: Service jsonPointers: - /spec/clusterIP - /spec.clusterIPs # 用 jq 表达式忽略复杂字段 - group: apps kind: Deployment jqPathExpressions: - .spec.template.spec.containers[].resources全局忽略差异# argocd-cm ConfigMap — 全局配置 apiVersion: v1 kind: ConfigMap metadata: name: argocd-cm namespace: argocd data: resource.customizations.ignoreDifferences.apps_Deployment: | jsonPointers: - /spec/replicas - /spec/template/spec/containers/0/resources五、资源动作Resource Actions什么是资源动作ArgoCD 允许对资源定义自定义操作如重启 Pod、暂停 CronJob通过 UI 或 CLI 触发。定义资源动作# argocd-cm resource.customizations.actions.argoproj.io_Rollout: | # 定义可用动作 discovery: | actions [] -- 如果 Rollout 暂停了提供恢复动作 if obj.spec.paused ~ nil and obj.spec.paused then table.insert(actions, {name resume, label Resume, icon play}) else -- 如果没暂停提供暂停动作 table.insert(actions, {name pause, label Pause, icon: pause}) end -- 提供重启动作 table.insert(actions, {name restart, label Restart, icon reload}) return actions # 定义动作执行逻辑 definitions: - name: resume action.lua: | obj.spec.paused false return obj - name: pause action.lua: | obj.spec.paused true return obj - name: restart action.lua: | -- 设置 annotation 触发重启 if obj.spec.template.metadata.annotations nil then obj.spec.template.metadata.annotations {} end obj.spec.template.metadata.annotations[kubectl.kubernetes.io/restartedAt] os.date(!%Y-%m-%dT%H:%M:%SZ) return obj触发资源动作# CLI 触发 argocd app actions myapp-prod --action restart # Web UI # → 应用页面 → 右键资源 → Actions → 选择操作六、本篇要点回顾Health Status 五状态Healthy / Progressing / Degraded / Suspended / MissingArgoCD 内置常见资源类型的健康检查Deployment/Service/Job等CRD 需要自定义 Lua 健康检查检查obj.status字段ignoreDifferences忽略 HPA 副本数、Webhook 注入等预期差异资源动作Resource Actions在 UI/CLI 中触发自定义操作暂停/恢复/重启下一篇预告ArgoCD 篇结束接下来进入 Flux 实战篇《环境搭建安装配置与首次 GitRepository》。
