From 6f82e12bb5a8a70ac1c5cdff1dde9ad40fedcfb1 Mon Sep 17 00:00:00 2001
From: atlas-bot <svc-atlas@renner.uno>
Date: Sat, 26 Sep 2026 00:16:10 +0000
Subject: [PATCH] fix(uptime-monitor): guard healthCheckExprs against absent
 status.conditions

An ExternalSecret has no status subresource until ESO's first reconcile
writes one. CEL raises "no such key" on a missing field rather than
returning false, so the unguarded expressions turned the startup window
into an evaluation error instead of "not ready yet".

Adds the same `has(status.conditions)` guard the other nine
healthCheckExprs in kubernetes/clusters/homelab already carry;
wordpress.yaml is the closest match, being the other conditions-based
(rather than phase-based) rule.

Refs REN-6.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 kubernetes/clusters/homelab/uptime-monitor.yaml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/kubernetes/clusters/homelab/uptime-monitor.yaml b/kubernetes/clusters/homelab/uptime-monitor.yaml
index 5336b20b..d3679a2c 100644
--- a/kubernetes/clusters/homelab/uptime-monitor.yaml
+++ b/kubernetes/clusters/homelab/uptime-monitor.yaml
@@ -57,8 +57,15 @@ spec:
   healthCheckExprs:
     - apiVersion: external-secrets.io/v1
       kind: ExternalSecret
-      current: "status.conditions.exists(c, c.type == 'Ready' && c.status == 'True')"
-      failed: "status.conditions.exists(c, c.type == 'Ready' && c.status == 'False')"
+      # `has(status.conditions)` is not decoration. A just-created ExternalSecret
+      # has no `status` subresource until ESO's first reconcile writes one, and
+      # CEL raises "no such key" on a missing field rather than returning false —
+      # an unguarded expression turns that startup window into an evaluation
+      # error instead of "not ready yet". Same guard as the other nine
+      # healthCheckExprs in this directory; `wordpress.yaml` is the closest
+      # match, being the other conditions-based (rather than phase-based) rule.
+      current: "has(status.conditions) && status.conditions.exists(c, c.type == 'Ready' && c.status == 'True')"
+      failed: "has(status.conditions) && status.conditions.exists(c, c.type == 'Ready' && c.status == 'False')"
   dependsOn:
     # ESO itself, and the `uptime-monitor` namespace (declared centrally in
     # kubernetes/infrastructure/namespaces/namespaces.yaml).