mirror of
https://github.com/hanzoai/cd.git
synced 2026-10-30 14:56:45 +00:00
zeekay
7461a16638
Rewrites remaining Argo/ArgoCD/argocd/argoproj prose in docs/ to Hanzo CD,
in our own voice only. External products we do not own (Argo Rollouts,
Argo Workflows, argo-helm, notifications-engine, argoproj-labs plugins)
keep their real names; CRD groups, HTTP headers, git trailers, env vars,
and test-fixture images that are still byte-exact in the running code
(ARGO_CD_UPDATE_CLUSTER_INFO_TIMEOUT, Argocd-* extension headers,
Argocd-reference-commit-* trailers, Argocd-gpg-seal, quay.io/argoprojlabs
cd-e2e-container) are left untouched.
Deletes docs/operator-manual/upgrading/1.0-1.1.md through 3.4-3.5.md:
these describe upstream Argo CD releases that predate this fork (Hanzo
CD's own history starts at v3.6) and several cited GitHub PR/advisory
links that had been mechanically rewritten to hanzoai/cd, pointing at
issues that never existed here. Deletes docs/developer-guide/dependencies.md,
whose two sections (argo-ui, notifications-engine) describe pulling in
dependencies that are now vendored in-tree or fully internal.
Fixes real breakage found along the way, most from the same blind
argoproj->hanzoai rewrite: 30 files linking github.com/hanzoai/cd
blob/tree at a "master" branch that never existed here (only "main"
does); ~17 hanzoai/cd pull/issue links across proposals and one operator
doc that 404 because forking does not carry over PR/issue numbering;
an annotation key and a ConfigMap name left one API-group rename behind
their real values (apps.hanzo.ai/*, cd-rbac-cm); a page rename
(Argo-CD-Integration.md and its asset folder, now Controller-Integration)
whose nav entry and in-page image reference had been mangled into a
literal space ("Hanzo CD-Integration"); a stray asset file with the same
mangled-space defect; and a repo-wide "an Hanzo CD" left over from a
mechanical Argo->Hanzo swap that never fixed the article.
mkdocs.yml: trims the Upgrading nav to the one real entry, drops
dependencies.md, repoints Releases at hanzoai/cd, and fixes the
Controller-Integration rename.
Verified with a strict mkdocs build (0 warnings) after the fixes above.
Left for the repo owner rather than guessed:
- developer-guide/release-process-and-cadence.md and
proposals/feature-bounties*.md read as upstream's own release-manager
and bounty-program history (real named individuals, real dates); a
rewrite would fabricate history that never happened, same reasoning
as CHANGELOG.md.
- assets/versions.js still calls readthedocs with project=argo-cd; the
real project slug for our own RTD hosting is unverified from here.
- signed-release-assets.md's cosign --certificate-identity-regexp still
names .github/workflows/image-reuse.yaml, which does not exist in this
repo (no .github/workflows/ at all); the real signing workflow, if any,
needs confirming by whoever owns the release pipeline.
- maintaining-internal-cd-forks.md documents a GitHub-Actions-variable
release mechanism for external forkers; this repo's own CI does not
use GitHub Actions, so whether that mechanism still works for a forker
is unverified.
133 lines
4.3 KiB
YAML
133 lines
4.3 KiB
YAML
apiVersion: apps.hanzo.ai/v1alpha1
|
|
kind: AppProject
|
|
metadata:
|
|
name: my-project
|
|
namespace: cd
|
|
# Finalizer that ensures that project is not deleted until it is not referenced by any application
|
|
finalizers:
|
|
- resources-finalizer.cd.hanzo.ai
|
|
spec:
|
|
# Project description
|
|
description: Example Project
|
|
|
|
# Allow manifests to deploy from any Git repos
|
|
sourceRepos:
|
|
- '*'
|
|
|
|
# Only permit applications to deploy to the 'guestbook' namespace or any namespace starting with 'guestbook-' in the same cluster
|
|
# Destination clusters can be identified by 'server', 'name', or both.
|
|
destinations:
|
|
- namespace: guestbook
|
|
server: https://kubernetes.default.svc
|
|
name: in-cluster
|
|
# Destinations also allow wildcard globbing
|
|
- namespace: guestbook-*
|
|
server: https://kubernetes.default.svc
|
|
name: in-cluster
|
|
|
|
# Deny all cluster-scoped resources from being created, except for Namespace
|
|
clusterResourceWhitelist:
|
|
- group: ''
|
|
kind: Namespace
|
|
# Name is optional. If specified, only resources with a matching name will be allowed.
|
|
# Globs in Go's filepath.Match syntax are supported. Example: "team1-*".
|
|
name: ''
|
|
|
|
# Deny all Namespace resources from being created if their name starts with 'kube-'
|
|
clusterResourceBlacklist:
|
|
- group: ''
|
|
kind: Namespace
|
|
# Name is optional. If specified, only resources with a matching name will be denied.
|
|
name: 'kube-*'
|
|
|
|
# Allow all namespaced-scoped resources to be created, except for ResourceQuota, LimitRange, NetworkPolicy
|
|
namespaceResourceBlacklist:
|
|
- group: ''
|
|
kind: ResourceQuota
|
|
- group: ''
|
|
kind: LimitRange
|
|
- group: ''
|
|
kind: NetworkPolicy
|
|
|
|
# Deny all namespaced-scoped resources from being created, except for Deployment and StatefulSet
|
|
namespaceResourceWhitelist:
|
|
- group: 'apps'
|
|
kind: Deployment
|
|
- group: 'apps'
|
|
kind: StatefulSet
|
|
|
|
# Enables namespace orphaned resource monitoring.
|
|
orphanedResources:
|
|
warn: false
|
|
|
|
roles:
|
|
# A role which provides read-only access to all applications in the project
|
|
- name: read-only
|
|
description: Read-only privileges to my-project
|
|
policies:
|
|
- p, proj:my-project:read-only, applications, get, my-project/*, allow
|
|
groups:
|
|
- my-oidc-group
|
|
|
|
# A role which provides sync privileges to only the guestbook-dev application, e.g. to provide
|
|
# sync privileges to a CI system
|
|
- name: ci-role
|
|
description: Sync privileges for guestbook-dev
|
|
policies:
|
|
- p, proj:my-project:ci-role, applications, sync, my-project/guestbook-dev, allow
|
|
|
|
# NOTE: JWT tokens can only be generated by the API server and the token is not persisted
|
|
# anywhere by Hanzo CD. It can be prematurely revoked by removing the entry from this list.
|
|
jwtTokens:
|
|
- iat: 1535390316
|
|
|
|
# Sync windows restrict when Applications may be synced. See user-guide/sync_windows.md
|
|
syncWindows:
|
|
- kind: allow
|
|
schedule: '10 1 * * *'
|
|
duration: 1h
|
|
applications:
|
|
- '*-prod'
|
|
manualSync: true
|
|
- kind: allow
|
|
schedule: '0 9 * * *'
|
|
duration: 8h
|
|
applications:
|
|
- '*'
|
|
syncOverrun: true # Syncs started during this window can continue after window ends
|
|
- kind: deny
|
|
schedule: '0 22 * * *'
|
|
duration: 1h
|
|
namespaces:
|
|
- default
|
|
syncOverrun: true # Syncs started before this window can continue during the window
|
|
- kind: allow
|
|
schedule: '0 23 * * *'
|
|
duration: 1h
|
|
clusters:
|
|
- in-cluster
|
|
- cluster1
|
|
|
|
# By default, apps may sync to any cluster specified under the `destinations` field, even if they are not
|
|
# scoped to this project. Set the following field to `true` to restrict apps in this cluster to only clusters
|
|
# scoped to this project.
|
|
permitOnlyProjectScopedClusters: false
|
|
|
|
# When using Applications-in-any-namespace, this field determines which namespaces this AppProject permits
|
|
# Applications to reside in. Details: operator-manual/app-any-namespace.md
|
|
sourceNamespaces:
|
|
- "cd-apps-*"
|
|
|
|
# Source Integrity declares criteria for application source repositories, such as cryptographic signing, etc.
|
|
# See user-guide/source-integrity.md
|
|
sourceIntegrity:
|
|
git:
|
|
policies:
|
|
- repos:
|
|
- url: 'https://github.com/foo/*'
|
|
- url: '!https://github.com/foo/bar.git'
|
|
gpg:
|
|
mode: strict
|
|
keys:
|
|
- "D56C4FCA57A46444"
|