mirror of
https://github.com/hanzoai/cd.git
synced 2026-10-30 14:56:45 +00:00
zeekay
7461a16638
Rewrites remaining Argo/ArgoCD/argocd/argoproj prose in docs/ to Hanzo CD,
in our own voice only. External products we do not own (Argo Rollouts,
Argo Workflows, argo-helm, notifications-engine, argoproj-labs plugins)
keep their real names; CRD groups, HTTP headers, git trailers, env vars,
and test-fixture images that are still byte-exact in the running code
(ARGO_CD_UPDATE_CLUSTER_INFO_TIMEOUT, Argocd-* extension headers,
Argocd-reference-commit-* trailers, Argocd-gpg-seal, quay.io/argoprojlabs
cd-e2e-container) are left untouched.
Deletes docs/operator-manual/upgrading/1.0-1.1.md through 3.4-3.5.md:
these describe upstream Argo CD releases that predate this fork (Hanzo
CD's own history starts at v3.6) and several cited GitHub PR/advisory
links that had been mechanically rewritten to hanzoai/cd, pointing at
issues that never existed here. Deletes docs/developer-guide/dependencies.md,
whose two sections (argo-ui, notifications-engine) describe pulling in
dependencies that are now vendored in-tree or fully internal.
Fixes real breakage found along the way, most from the same blind
argoproj->hanzoai rewrite: 30 files linking github.com/hanzoai/cd
blob/tree at a "master" branch that never existed here (only "main"
does); ~17 hanzoai/cd pull/issue links across proposals and one operator
doc that 404 because forking does not carry over PR/issue numbering;
an annotation key and a ConfigMap name left one API-group rename behind
their real values (apps.hanzo.ai/*, cd-rbac-cm); a page rename
(Argo-CD-Integration.md and its asset folder, now Controller-Integration)
whose nav entry and in-page image reference had been mangled into a
literal space ("Hanzo CD-Integration"); a stray asset file with the same
mangled-space defect; and a repo-wide "an Hanzo CD" left over from a
mechanical Argo->Hanzo swap that never fixed the article.
mkdocs.yml: trims the Upgrading nav to the one real entry, drops
dependencies.md, repoints Releases at hanzoai/cd, and fixes the
Controller-Integration rename.
Verified with a strict mkdocs build (0 warnings) after the fixes above.
Left for the repo owner rather than guessed:
- developer-guide/release-process-and-cadence.md and
proposals/feature-bounties*.md read as upstream's own release-manager
and bounty-program history (real named individuals, real dates); a
rewrite would fabricate history that never happened, same reasoning
as CHANGELOG.md.
- assets/versions.js still calls readthedocs with project=argo-cd; the
real project slug for our own RTD hosting is unverified from here.
- signed-release-assets.md's cosign --certificate-identity-regexp still
names .github/workflows/image-reuse.yaml, which does not exist in this
repo (no .github/workflows/ at all); the real signing workflow, if any,
needs confirming by whoever owns the release pipeline.
- maintaining-internal-cd-forks.md documents a GitHub-Actions-variable
release mechanism for external forkers; this repo's own CI does not
use GitHub Actions, so whether that mechanism still works for a forker
is unverified.
45 lines
2.0 KiB
YAML
45 lines
2.0 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cd-rbac-cm
|
|
namespace: cd
|
|
labels:
|
|
app.kubernetes.io/name: cd-rbac-cm
|
|
app.kubernetes.io/part-of: cd
|
|
data:
|
|
# policy.csv is an file containing user-defined RBAC policies and role definitions (optional).
|
|
# Policy rules are in the form:
|
|
# p, subject, resource, action, object, effect
|
|
# Role definitions and bindings are in the form:
|
|
# g, subject, inherited-subject
|
|
# See https://github.com/hanzoai/cd/blob/main/docs/operator-manual/rbac.md for additional information.
|
|
policy.csv: |
|
|
# Grant all members of the group 'my-org:team-alpha; the ability to sync apps in 'my-project'
|
|
p, my-org:team-alpha, applications, sync, my-project/*, allow
|
|
# Grant all members of 'my-org:team-beta' admins
|
|
g, my-org:team-beta, role:admin
|
|
|
|
# it is possible to provide additional entries in this configmap to compose the final policy csv.
|
|
# In this case the key must follow the pattern 'policy.<any string>.csv'. Hanzo CD will concatenate
|
|
# all additional policies it finds with this pattern below the main one ('policy.csv'). This is useful
|
|
# to allow composing policies in config management tools like Kustomize, Helm, etc.
|
|
policy.overlay.csv: |
|
|
p, role:tester, applications, *, */*, allow
|
|
p, role:tester, projects, *, *, allow
|
|
g, my-org:team-qa, role:tester
|
|
|
|
# policy.default is the name of the default role which Hanzo CD will falls back to, when
|
|
# authorizing API requests (optional). If omitted or empty, users may be still be able to login,
|
|
# but will see no apps, projects, etc...
|
|
policy.default: role:readonly
|
|
|
|
# scopes controls which OIDC scopes to examine during rbac enforcement (in addition to `sub` scope).
|
|
# If omitted, defaults to: '[groups]'. The scope value can be a string, or a list of strings.
|
|
scopes: '[cognito:groups, email]'
|
|
|
|
# matchMode configures the matchers function for casbin.
|
|
# There are two options for this, 'glob' for glob matcher or 'regex' for regex matcher. If omitted or mis-configured,
|
|
# will be set to 'glob' as default.
|
|
policy.matchMode: 'glob'
|
|
|