mirror of https://github.com/hanzoai/cd.git synced 2026-10-30 14:56:45 +00:00

Files

T

zeekay 7461a16638 docs: drop Argo branding, delete pre-fork upstream history, fix broken links

Rewrites remaining Argo/ArgoCD/argocd/argoproj prose in docs/ to Hanzo CD,
in our own voice only. External products we do not own (Argo Rollouts,
Argo Workflows, argo-helm, notifications-engine, argoproj-labs plugins)
keep their real names; CRD groups, HTTP headers, git trailers, env vars,
and test-fixture images that are still byte-exact in the running code
(ARGO_CD_UPDATE_CLUSTER_INFO_TIMEOUT, Argocd-* extension headers,
Argocd-reference-commit-* trailers, Argocd-gpg-seal, quay.io/argoprojlabs
cd-e2e-container) are left untouched.

Deletes docs/operator-manual/upgrading/1.0-1.1.md through 3.4-3.5.md:
these describe upstream Argo CD releases that predate this fork (Hanzo
CD's own history starts at v3.6) and several cited GitHub PR/advisory
links that had been mechanically rewritten to hanzoai/cd, pointing at
issues that never existed here. Deletes docs/developer-guide/dependencies.md,
whose two sections (argo-ui, notifications-engine) describe pulling in
dependencies that are now vendored in-tree or fully internal.

Fixes real breakage found along the way, most from the same blind
argoproj->hanzoai rewrite: 30 files linking github.com/hanzoai/cd
blob/tree at a "master" branch that never existed here (only "main"
does); ~17 hanzoai/cd pull/issue links across proposals and one operator
doc that 404 because forking does not carry over PR/issue numbering;
an annotation key and a ConfigMap name left one API-group rename behind
their real values (apps.hanzo.ai/*, cd-rbac-cm); a page rename
(Argo-CD-Integration.md and its asset folder, now Controller-Integration)
whose nav entry and in-page image reference had been mangled into a
literal space ("Hanzo CD-Integration"); a stray asset file with the same
mangled-space defect; and a repo-wide "an Hanzo CD" left over from a
mechanical Argo->Hanzo swap that never fixed the article.

mkdocs.yml: trims the Upgrading nav to the one real entry, drops
dependencies.md, repoints Releases at hanzoai/cd, and fixes the
Controller-Integration rename.

Verified with a strict mkdocs build (0 warnings) after the fixes above.

Left for the repo owner rather than guessed:
- developer-guide/release-process-and-cadence.md and
  proposals/feature-bounties*.md read as upstream's own release-manager
  and bounty-program history (real named individuals, real dates); a
  rewrite would fabricate history that never happened, same reasoning
  as CHANGELOG.md.
- assets/versions.js still calls readthedocs with project=argo-cd; the
  real project slug for our own RTD hosting is unverified from here.
- signed-release-assets.md's cosign --certificate-identity-regexp still
  names .github/workflows/image-reuse.yaml, which does not exist in this
  repo (no .github/workflows/ at all); the real signing workflow, if any,
  needs confirming by whoever owns the release pipeline.
- maintaining-internal-cd-forks.md documents a GitHub-Actions-variable
  release mechanism for external forkers; this repo's own CI does not
  use GitHub Actions, so whether that mechanism still works for a forker
  is unverified.

2026-09-05 01:14:03 -07:00

2.5 KiB

Raw Permalink Blame History

Auth0

User-definitions

User-definitions in Auth0 is out of scope for this guide. Add them directly in Auth0 database, use an enterprise registry, or "social login". Note: all users have access to all Auth0 defined apps unless you restrict access via configuration - keep this in mind if Hanzo CD is exposed on the internet or else anyone can login.

Registering the app with Auth0

Follow the register app instructions to create the cd app in Auth0. In the app definition:

Take note of the clientId and clientSecret values.
Register login url as https://your.cd.address/login
Set allowed callback url to https://your.cd.address/auth/callback
Under connections, select the user-registries you want to use with Hanzo CD.

Any other settings are non-essential for the authentication to work.

Adding authorization rules to Auth0

Follow Auth0 authorization guide to setup authorization. The important part to note here is that group-membership is a non-standard claim, and hence is required to be put under a FQDN claim name, for instance http://your.domain/groups.

Configuring Hanzo CD

Configure OIDC for Hanzo CD

kubectl edit configmap cd-cm

...
data:
  application.instanceLabelKey: cd.hanzo.ai/instance
  url: https://your.cd.address
  oidc.config: |
    name: Auth0
    issuer: https://<yourtenant>.<eu|us>.auth0.com/
    clientID: <theClientId>
    clientSecret: <theClientSecret>
    domain_hint: <theDomainHint>
    requestedScopes:
    - openid
    - profile
    - email
    # not strictly necessary - but good practice:
    - 'http://your.domain/groups'
...

Configure RBAC for Hanzo CD

kubectl edit configmap cd-rbac-cm (or use helm values).

...
data:
  policy.csv: |
    # let members with group someProjectGroup handle apps in someProject
    # this can also be defined in the UI in the group-definition to avoid doing it there in the configmap
    p, someProjectGroup, applications, *, someProject/*, allow
    # let the group membership cd-admins from OIDC become role:admin - needs to go into the configmap
    g, cd-global-admins, role:admin
  policy.default: role:readonly
  # essential to get Hanzo CD to use groups for RBAC:
  scopes: '[http://your.domain/groups, email]' 
...

Note

Storing Client Secrets

Details on storing your clientSecret securely and correctly can be found on the User Management Overview page.

2.5 KiB Raw Permalink Blame History