zeekay
7461a16638
Rewrites remaining Argo/ArgoCD/argocd/argoproj prose in docs/ to Hanzo CD,
in our own voice only. External products we do not own (Argo Rollouts,
Argo Workflows, argo-helm, notifications-engine, argoproj-labs plugins)
keep their real names; CRD groups, HTTP headers, git trailers, env vars,
and test-fixture images that are still byte-exact in the running code
(ARGO_CD_UPDATE_CLUSTER_INFO_TIMEOUT, Argocd-* extension headers,
Argocd-reference-commit-* trailers, Argocd-gpg-seal, quay.io/argoprojlabs
cd-e2e-container) are left untouched.
Deletes docs/operator-manual/upgrading/1.0-1.1.md through 3.4-3.5.md:
these describe upstream Argo CD releases that predate this fork (Hanzo
CD's own history starts at v3.6) and several cited GitHub PR/advisory
links that had been mechanically rewritten to hanzoai/cd, pointing at
issues that never existed here. Deletes docs/developer-guide/dependencies.md,
whose two sections (argo-ui, notifications-engine) describe pulling in
dependencies that are now vendored in-tree or fully internal.
Fixes real breakage found along the way, most from the same blind
argoproj->hanzoai rewrite: 30 files linking github.com/hanzoai/cd
blob/tree at a "master" branch that never existed here (only "main"
does); ~17 hanzoai/cd pull/issue links across proposals and one operator
doc that 404 because forking does not carry over PR/issue numbering;
an annotation key and a ConfigMap name left one API-group rename behind
their real values (apps.hanzo.ai/*, cd-rbac-cm); a page rename
(Argo-CD-Integration.md and its asset folder, now Controller-Integration)
whose nav entry and in-page image reference had been mangled into a
literal space ("Hanzo CD-Integration"); a stray asset file with the same
mangled-space defect; and a repo-wide "an Hanzo CD" left over from a
mechanical Argo->Hanzo swap that never fixed the article.
mkdocs.yml: trims the Upgrading nav to the one real entry, drops
dependencies.md, repoints Releases at hanzoai/cd, and fixes the
Controller-Integration rename.
Verified with a strict mkdocs build (0 warnings) after the fixes above.
Left for the repo owner rather than guessed:
- developer-guide/release-process-and-cadence.md and
proposals/feature-bounties*.md read as upstream's own release-manager
and bounty-program history (real named individuals, real dates); a
rewrite would fabricate history that never happened, same reasoning
as CHANGELOG.md.
- assets/versions.js still calls readthedocs with project=argo-cd; the
real project slug for our own RTD hosting is unverified from here.
- signed-release-assets.md's cosign --certificate-identity-regexp still
names .github/workflows/image-reuse.yaml, which does not exist in this
repo (no .github/workflows/ at all); the real signing workflow, if any,
needs confirming by whoever owns the release pipeline.
- maintaining-internal-cd-forks.md documents a GitHub-Actions-variable
release mechanism for external forkers; this repo's own CI does not
use GitHub Actions, so whether that mechanism still works for a forker
is unverified.
3.2 KiB
Secret Management
There are two general ways to populate secrets when doing GitOps: on the destination cluster, or in Hanzo CD during manifest generation. We strongly recommend the former, as it is more secure and provides a better user experience.
Destination Cluster Secret Management
In this approach, secrets are populated on the destination cluster, and Hanzo CD does not need to directly manage them. Sealed Secrets, External Secrets Operator, and Kubernetes Secrets Store CSI Driver are examples of this style of secret management.
This approach has two main advantages:
-
Security: Hanzo CD does not need to have access to the secrets, which reduces the risk of leaking them.
-
User Experience: Secret updates are decoupled from app sync operations, which reduces the risk of unintentionally applying Secret updates during an unrelated release.
We strongly recommend this style of secret management.
Other examples of this style of secret management include:
Hanzo CD Manifest Generation-Based Secret Management
In this approach, Hanzo CD's manifest generation step is used to inject secrets. This may be done using a Config Management Plugin like cd-vault-plugin.
We strongly caution against this style of secret management, as it has several disadvantages:
-
Security: Hanzo CD needs access to the secrets, which increases the risk of leaking them. Hanzo CD stores generated manifests in plaintext in its Redis cache, so injecting secrets into the manifests increases risk.
-
User Experience: Secret updates are coupled with app sync operations, which increases the risk of unintentionally applying Secret updates during an unrelated release.
-
Rendered Manifests Pattern: This approach is incompatible with the "Rendered Manifests" pattern, which is increasingly becoming a best practice for GitOps.
Many users have already adopted generation-based solutions, and we understand that migrating to an operator-based solution can be a significant effort. Hanzo CD will continue to support generation-based secret management, but we will not prioritize new features or improvements that solely support this style of secret management.
Mitigating Risks of Secret-Injection Plugins
Hanzo CD caches the manifests generated by plugins, along with the injected secrets, in its Redis instance. Those manifests are also available via the repo-server API (a gRPC service). This means that the secrets are available to anyone who has access to the Redis instance or to the repo-server.
Consider these steps to mitigate the risks of secret-injection plugins:
- Set up network policies to prevent direct access to Hanzo CD components (Redis and the repo-server). Make sure your cluster supports those network policies and can actually enforce them.
- Consider running Hanzo CD on its own cluster, with no other applications running on it.