Add the health engine: through-proxy probes, thresholds, channel-fed transitions

Co-Authored-By: Claude <noreply@anthropic.com>

internal/controller/proxy_controller.go

@@ -27,18 +27,30 @@ import (
 	apimeta "k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	"sigs.k8s.io/controller-runtime/pkg/source"
 
 	crawlv1alpha1 "gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/api/v1alpha1"
+	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/health"
 	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider"
 )
 
+// HealthSnapshotter provides the current probe verdict for a proxy. The
+// health engine implements it; the reconciler is its only consumer, turning
+// snapshots into the Healthy condition — the engine owns health state, the
+// reconciler owns its representation.
+type HealthSnapshotter interface {
+	Snapshot(key types.NamespacedName) (health.Snapshot, bool)
+}
+
 // ProxyReconciler reconciles Proxy objects as a state machine: every
 // reconcile derives exactly one action from (spec, status, provider Get),
 // performs it, and requeues. Status is written at most once per reconcile,
@@ -50,6 +62,13 @@ type ProxyReconciler struct {
 	// Providers maps spec.provider values to configured backends.
 	Providers map[string]provider.Provider
 
+	// Health supplies probe verdicts; nil disables health representation
+	// (the Healthy condition simply never appears).
+	Health HealthSnapshotter
+	// HealthEvents, when non-nil, is watched as a raw source so the health
+	// engine can enqueue proxies on status-affecting transitions.
+	HealthEvents <-chan event.GenericEvent
+
 	// Poll intervals are struct fields, never consts, so tests can shrink
 	// them to milliseconds.
 	ProvisioningPoll time.Duration // while waiting for an instance to reach Running
@@ -142,6 +161,12 @@ func (r *ProxyReconciler) reconcileManaged(ctx context.Context, p *crawlv1alpha1
 		p.Status.ProviderID = id
 		p.Status.IP = ""
 		setProvisioned(p, metav1.ConditionFalse, ReasonProvisioning, "instance created; waiting for it to run")
+		// Any Healthy verdict belonged to the previous instance; the health
+		// engine starts fresh for the new one (its state was pruned while
+		// the proxy had no IP), and so must the status.
+		apimeta.RemoveStatusCondition(&p.Status.Conditions, crawlv1alpha1.ConditionHealthy)
+		p.Status.LatencyMillis = 0
+		p.Status.LastHealthCheckTime = nil
 		return ctrl.Result{RequeueAfter: r.ProvisioningPoll}, nil
 	}
 
@@ -176,6 +201,7 @@ func (r *ProxyReconciler) reconcileManaged(ctx context.Context, p *crawlv1alpha1
 	case provider.StateRunning:
 		p.Status.IP = inst.IP
 		setProvisioned(p, metav1.ConditionTrue, ReasonCreated, "instance is running")
+		r.applyHealth(p)
 		return ctrl.Result{RequeueAfter: r.DriftPoll}, nil
 	default: // Stopped, Terminated: cattle, not pets — delete and recreate.
 		if err := prov.Delete(ctx, p.Status.ProviderID); err != nil {
@@ -262,6 +288,7 @@ func (r *ProxyReconciler) reconcileExternal(_ context.Context, p *crawlv1alpha1.
 	}
 	p.Status.IP = p.Spec.Endpoint.Host
 	setProvisioned(p, metav1.ConditionTrue, ReasonExternalEndpoint, "tracking an external endpoint")
+	r.applyHealth(p)
 	return ctrl.Result{}, nil
 }
 
@@ -371,12 +398,15 @@ func (r *ProxyReconciler) proxiesForSecret(ctx context.Context, obj client.Objec
 // (cmd/main.go) restricts that cache to labelled cloud-init Secrets.
 func (r *ProxyReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	r.applyDefaults()
-	return ctrl.NewControllerManagedBy(mgr).
+	b := ctrl.NewControllerManagedBy(mgr).
 		For(&crawlv1alpha1.Proxy{}).
 		Named("proxy").
 		Watches(&corev1.Secret{}, handler.EnqueueRequestsFromMapFunc(r.proxiesForSecret)).
-		WithOptions(controller.Options{MaxConcurrentReconciles: 3}).
-		Complete(r)
+		WithOptions(controller.Options{MaxConcurrentReconciles: 3})
+	if r.HealthEvents != nil {
+		b = b.WatchesRawSource(source.Channel(r.HealthEvents, &handler.EnqueueRequestForObject{}))
+	}
+	return b.Complete(r)
 }
 
 func (r *ProxyReconciler) applyDefaults() {