mirror of https://github.com/hanzoai/cd.git synced 2026-10-30 14:56:45 +00:00

Files

T

zeekay 7461a16638 docs: drop Argo branding, delete pre-fork upstream history, fix broken links

Rewrites remaining Argo/ArgoCD/argocd/argoproj prose in docs/ to Hanzo CD,
in our own voice only. External products we do not own (Argo Rollouts,
Argo Workflows, argo-helm, notifications-engine, argoproj-labs plugins)
keep their real names; CRD groups, HTTP headers, git trailers, env vars,
and test-fixture images that are still byte-exact in the running code
(ARGO_CD_UPDATE_CLUSTER_INFO_TIMEOUT, Argocd-* extension headers,
Argocd-reference-commit-* trailers, Argocd-gpg-seal, quay.io/argoprojlabs
cd-e2e-container) are left untouched.

Deletes docs/operator-manual/upgrading/1.0-1.1.md through 3.4-3.5.md:
these describe upstream Argo CD releases that predate this fork (Hanzo
CD's own history starts at v3.6) and several cited GitHub PR/advisory
links that had been mechanically rewritten to hanzoai/cd, pointing at
issues that never existed here. Deletes docs/developer-guide/dependencies.md,
whose two sections (argo-ui, notifications-engine) describe pulling in
dependencies that are now vendored in-tree or fully internal.

Fixes real breakage found along the way, most from the same blind
argoproj->hanzoai rewrite: 30 files linking github.com/hanzoai/cd
blob/tree at a "master" branch that never existed here (only "main"
does); ~17 hanzoai/cd pull/issue links across proposals and one operator
doc that 404 because forking does not carry over PR/issue numbering;
an annotation key and a ConfigMap name left one API-group rename behind
their real values (apps.hanzo.ai/*, cd-rbac-cm); a page rename
(Argo-CD-Integration.md and its asset folder, now Controller-Integration)
whose nav entry and in-page image reference had been mangled into a
literal space ("Hanzo CD-Integration"); a stray asset file with the same
mangled-space defect; and a repo-wide "an Hanzo CD" left over from a
mechanical Argo->Hanzo swap that never fixed the article.

mkdocs.yml: trims the Upgrading nav to the one real entry, drops
dependencies.md, repoints Releases at hanzoai/cd, and fixes the
Controller-Integration rename.

Verified with a strict mkdocs build (0 warnings) after the fixes above.

Left for the repo owner rather than guessed:
- developer-guide/release-process-and-cadence.md and
  proposals/feature-bounties*.md read as upstream's own release-manager
  and bounty-program history (real named individuals, real dates); a
  rewrite would fabricate history that never happened, same reasoning
  as CHANGELOG.md.
- assets/versions.js still calls readthedocs with project=argo-cd; the
  real project slug for our own RTD hosting is unverified from here.
- signed-release-assets.md's cosign --certificate-identity-regexp still
  names .github/workflows/image-reuse.yaml, which does not exist in this
  repo (no .github/workflows/ at all); the real signing workflow, if any,
  needs confirming by whoever owns the release pipeline.
- maintaining-internal-cd-forks.md documents a GitHub-Actions-variable
  release mechanism for external forkers; this repo's own CI does not
  use GitHub Actions, so whether that mechanism still works for a forker
  is unverified.

2026-09-05 01:14:03 -07:00

4.5 KiB

Raw Permalink Blame History

ApplicationSet Web UI

For end-user documentation of the UI itself, see Managing ApplicationSets in the Web UI.

The Web UI integrates with ApplicationSets through three layers:

The ApplicationSetService API exposed by the Hanzo CD API server (defined in server/applicationset/applicationset.proto).
The ApplicationSet CR, read through those endpoints. The UI renders fields across both spec and status — spec.template, status.conditions, status.resources, and status.health.
RBAC enforcement, performed by the API server on every request using the same applicationsets resource and actions that the CLI already uses.

API endpoints

The Web UI consumes the following endpoints. RBAC is enforced on every call; the third column shows the action checked.

Endpoint	UI usage	RBAC action enforced
`GET /api/v1/applicationsets`	The list page (`/applicationsets`)	`applicationsets, get` (per item)
`GET /api/v1/applicationsets/{name}`	The details page header and slide-out summary	`applicationsets, get`
`GET /api/v1/applicationsets/{name}/resource-tree`	The resource-tree visualization	`applicationsets, get`
`GET /api/v1/applicationsets/{name}/events`	The Events tab in the slide-out panel	`applicationsets, get`
`GET /api/v1/stream/applicationsets`	Live updates on the list page and details page	`applicationsets, get` (per event)
`POST /api/v1/applicationsets/generate`	The Preview tab	`applicationsets, create`

RBAC

ApplicationSet RBAC objects are scoped by the project of the template's target Application — i.e. Spec.Template.Spec.Project — together with the ApplicationSet's namespace and name. This is the same scoping the CLI and direct API clients see; the UI simply inherits it.

Read paths

Every read endpoint listed above (Get, List, ResourceTree, ListResourceEvents, Watch) checks applicationsets, get against each ApplicationSet before returning it. List and Watch filter the result set per item, so a user sees only the ApplicationSets they have get on.

If a user has get permission on an ApplicationSet, they can see it in every read view in the UI: the list page, the details page, the resource tree, the events tab, and the live watch stream.

Preview

The Preview tab is the one operation that requires more than get. It calls Generate, which renders candidate Applications from a (possibly user-edited) ApplicationSet spec server-side. Because rendering a preview is the same operation the controller would perform when creating Applications, the API server enforces applicationsets, create on the project of the template — the same permission required to actually create the rendered Applications.

A user who can view an ApplicationSet but does not have create on its project's template will see a permission-denied response from the Preview tab. See Security for the full ApplicationSet RBAC model.

`status.health` on the ApplicationSet CR

The ApplicationSet controller writes a status.health field on each ApplicationSet (with status and message), computed from the ApplicationSet's status.conditions. The UI reads this field through the regular Get, List, and Watch endpoints; no separate health-evaluation API call is made.

The rules the controller applies, in order:

If status.conditions is empty → Unknown ("No status conditions found for ApplicationSet").
If an ErrorOccurred condition has status: True → Degraded, with the condition's message.
Otherwise, if a RolloutProgressing condition has status: True → Progressing, with the condition's message.
Otherwise, if a ResourcesUpToDate condition has status: True → Healthy, with the condition's message.
Otherwise → Unknown ("Waiting for health status to be determined").

4.5 KiB Raw Permalink Blame History