vgui-cicd/Documentation/ARGOCD-INGRESS-FIX.md

ArgoCD Ingress "Progressing" State Fix

Problem

The django Ingress resource in the vorgabenui namespace was stuck in "Progressing" state in ArgoCD and would not transition to "Healthy".

Root Cause

ArgoCD determines Ingress health by checking if the status.loadBalancer.ingress field is populated with an IP address or hostname. Without this field, the Ingress is considered "Progressing" indefinitely.

The issue occurred because Traefik was not configured to report its IP address in the Ingress status field.

Solution

Two changes were made to fix this issue:

1. Update Ingress Annotation (Applied)

File: argocd/ingress.yaml

Change:

# Before
annotations:
  argocd.argoproj.io/ignore-healthcheck: "true"

# After
annotations:
  argocd.argoproj.io/sync-wave: "1"

Rationale:

• The ignore-healthcheck annotation was causing ArgoCD to not monitor the Ingress health at all
• The sync-wave: "1" annotation ensures the Ingress syncs after the Deployment and Service are ready (which have default sync-wave of 0)
• This allows ArgoCD to properly assess the Ingress health status

2. Configure Traefik to Report Ingress Status (Cluster Patch)

Patch Command:

kubectl patch deployment traefik -n traefik --type='json' \
  -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--providers.kubernetesingress.ingressendpoint.publishedservice=traefik/traefik"}]'

Configuration Flag Added:

--providers.kubernetesingress.ingressendpoint.publishedservice=traefik/traefik

Rationale: This flag tells Traefik to:

• Watch for changes to Ingress resources in the cluster
• Monitor the Service traefik/traefik (the Traefik LoadBalancer service)
• Automatically populate status.loadBalancer.ingress[].ip with the service's external IP address
• Allow ArgoCD to detect when the Ingress has been assigned an IP and transition to "Healthy"

Result

✅ Status: RESOLVED

Current State:

• Ingress Address: 192.168.17.53 (Traefik LoadBalancer IP)
• Ingress Health: Healthy
• ArgoCD Application Health: Healthy
• Accessible at: http://vorgabenportal.knowyoursecurity.com/

Verification

To verify the fix is working:

# Check Ingress status
kubectl get ingress django -n vorgabenui -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
# Should output: 192.168.17.53

# Check ArgoCD application health
kubectl get application vorgabenui -n argocd -o jsonpath='{.status.health.status}'
# Should output: Healthy

# Check Traefik configuration
kubectl get deploy traefik -n traefik -o jsonpath='{.spec.template.spec.containers[0].args}' | jq 'map(select(. | contains("publishedservice")))'
# Should output the publishedservice flag

Documentation Location

The Traefik configuration patch is documented in:

• argocd/traefik-middleware.yaml - ConfigMap with patch details and rationale

Notes for Future Maintenance

• If Traefik is upgraded or redeployed via Helm, ensure the --providers.kubernetesingress.ingressendpoint.publishedservice=traefik/traefik flag is preserved
• The flag must point to the correct LoadBalancer Service that has an external IP
• In this case, it's traefik/traefik (namespace/service-name) with external IP 192.168.17.53
• If the Traefik service configuration changes, this flag may need adjustment