Expose healthcheck endpoint on ArgoCD ApplicationSet Controller for GKE Ingress

[patrickblackjr]

Transferred from #19453

Summary

A /healthz or other healthcheck endpoint should be added for the applicationset-controller that returns status code 200 this so it can be easily exposed via an ingress.

Motivation

GKE Ingress requires a GET request to return 200 OK before it will route any traffic. The ArgoCD ApplicationSet Controller should have an endpoint that returns this so it can be easily exposed via an ingress.

Per the Webhook Configurations documentation, this webhook needs to be exposed via a separate ingress to allow for the Git Generator or the Pull Request Generator.

Proposal

A /healthz or other healthcheck endpoint should be added for the applicationset-controller that returns status code 200 this so it can be easily exposed via an ingress.

[WoahitsJoe]

Workaround for GKE Gateway API

The root cause is that GKE health checks require HTTP 200 responses, but the ApplicationSet webhook endpoint returns HTTP 400 for health check requests.

Solution: Use the ApplicationSet metrics endpoint for health checks instead.

1. Enable the ApplicationSet metrics service in your Helm values (applicationSet.metrics.enabled: true)
2. Create a HealthCheckPolicy that targets the argocd-applicationset-controller service (not the metrics service) and configures health checks to use port 8080 path /metrics (which returns HTTP 200)

The metrics service and webhook service both select the same pods. GKE health checks go directly to pod IPs via NEGs, so even though the webhook service doesn't expose port 8080, the healthcheck can still reach it on the pods. Once the health checks pass, webhook traffic flows normally.

This allows webhooks to work with GKE Gateway API without requiring code changes to the ApplicationSet controller.