Two corrections on top of the naming pass, both found by checking the live
cluster rather than the source.
The rename had silently changed the user-facing annotation key from
argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live
Applications carry the old key, so deploying that would have ignored every
sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*,
and universe 575650286 moves the ApplicationSet template that stamps it, so
the controller regenerates all 63 consistently.
The API group in code said argoproj.io/v1alpha1 in 157 places while the
cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are
applications.apps.hanzo.ai). Code now matches what is actually served.
The legacy applications.argoproj.io/app-name label had ZERO live users, so it
went with the rest. foo.argoproj.io test fixtures became foo.example.com —
arbitrary test domains should not carry a vendor name.
go build ./... exit 0.
Co-authored-by: Hanzo Dev <[email protected]>
Every command is cd-*: cd, cd-server, cd-repo-server,
cd-application-controller, cd-applicationset-controller, cd-cmp-server,
cd-commit-server, cd-dex, cd-git-ask-pass, cd-k8s-auth, cd-notification.
util/argo is util/cd; util/notification/argocd is util/notification/cd.
Preserved deliberately: github.com/argoproj/argocd-example-apps is an
EXTERNAL repo used as an e2e fixture, and notifications-engine + pkg/v2 are
real dependencies. Renaming a URL we do not own would break the tests.
Two bugs I made and caught, both from a careless sed:
- s/argo/cd/g turned 'argocd' into 'cdcd' in two directory names
- renaming the package declaration left every call site saying argo.X
go build ./... exit 0.
Co-authored-by: Hanzo Dev <[email protected]>
The fork was already ours everywhere that matters — our image, our IAM (dex
is not deployed), hanzo kv behind what the env still called REDIS. Only the
vocabulary was upstream's: ARGOCD_* across the Go, the manifests, the docs
and the plugin contract, and mkdocs still titled 'Argo CD' pointing at
argoproj/argo-cd.
ARGOCD_ -> CD_ and REDIS_ -> KV_ across 345 files, plus the 8 e2e/cmp
fixtures that assert the plugin env contract — those had to move with the
binary, which now emits CD_APP_NAME where they expected ARGOCD_APP_NAME.
Left alone deliberately, because renaming them would be wrong:
- util/helm/testdata/redis/ and gitops-engine/.../statefulset*.yaml are
fixtures for a THIRD-PARTY chart named redis, not our config
- util/kustomize/testdata/ likewise
- generated.proto regenerates from types.go, which is already clean
go build ./... exit 0.
LOCKSTEP: the live StatefulSet sets 47 ARGOCD_* names the binary no longer
reads. universe 4a5375735 carries the matching manifest change; they deploy
together or the controller falls back to defaults.
Co-authored-by: Hanzo Dev <[email protected]>
* Adding skipSchemaValidation flag
Signed-off-by: Daniel Mosesson (soandos) <[email protected]>
* Adding specific test for skip schema validation
Signed-off-by: Daniel Mosesson (soandos) <[email protected]>
* Fix merge conflict
Signed-off-by: Daniel Mosesson (soandos) <[email protected]>
* Fixing index.yaml to support helm 3.16
Signed-off-by: Daniel Mosesson (soandos) <[email protected]>
---------
Signed-off-by: Daniel Mosesson (soandos) <[email protected]>
Co-authored-by: Daniel Mosesson (soandos) <[email protected]>
* fix: make managed namespaces more 'prune-proof'
In the cases where someone would want to set resource tracking on a
managed namespace, or if someone would want to migrate from having a
namespace in Git to using `managedNamespaceMetadata`, we need to take
steps to ensure that the namespace does not get pruned.
In order to do that, we add the live namespace to the list of
`targetObjs` (so that it's considered a part of the source even though
it's not).
Finally, we need to also ensure that the managed namespace is not
considered `OutOfSync` (due to the same reason as above).
This is a subset of #11350, the main difference being that this commit
does not set resource tracking on its own, but can be opted into if
people choose to do so.
Signed-off-by: Blake Pettersson <[email protected]>
* refactor: extract managed namespace check
Signed-off-by: Blake Pettersson <[email protected]>
---------
Signed-off-by: Blake Pettersson <[email protected]>
* fix: loosen source not permitted helm errors
With #12255, we check if a source is first permitted before running
`helm template`. This works a bit too well, since this may break
previously working manifests. If an `AppProject` has a set of
`sourceRepos` which are more restrictive than `*`, and it also has Helm
public dependencies (repos with credentials would not work with 2.7x
due to the fact they get filtered out before ending up on the repo
server). Whereas before this would work, this currently fails on
`HEAD` but not in `2.7x`.
What we instead do here is that we only run this check if the chart
failed to download - if it does then we run a check to see if the repo
is in the allowed repos list. If the repo is not in the allowed repos
list, we return the same error as in #12555, otherwise we bubble up the
error.
Should fix#13833.
Signed-off-by: Blake Pettersson <[email protected]>
* fix: check for 401 unauthorized in error
The regex check works fine for OCI artifacts, but the flow is slightly
different for standard Helm charts (specifically when running
`helm repo add`). To get around that, we also check the error for
`401 Unauthorized`.
Signed-off-by: Blake Pettersson <[email protected]>
* fix: loosen string check
Signed-off-by: Blake Pettersson <[email protected]>
* Revert "chore: revert #12255 (#14858)"
This reverts commit 72aaf710e4.
Signed-off-by: Blake Pettersson <[email protected]>
* wip
Signed-off-by: Blake Pettersson <[email protected]>
* wip
Signed-off-by: Blake Pettersson <[email protected]>
* chore: reword test to reduce confusion
Signed-off-by: Blake Pettersson <[email protected]>
---------
Signed-off-by: Blake Pettersson <[email protected]>
This reverts commit 432cf9aecd.
Due to the imminent release of 2.8, this needs to be rolled back since
the proposed fix in #14210 cannot make it in time.
Signed-off-by: Blake Pettersson <[email protected]>
* Kind wildcard support in health customizations
Signed-off-by: reggie <[email protected]>
* Updated health customizations docs to using the correct field with a /
Signed-off-by: reggie <[email protected]>
* Updated health customizations docs to using the correct field with a /
Signed-off-by: reggie <[email protected]>
* Document resource kind wildcard for custom health check
Signed-off-by: reggie <[email protected]>
* Implemented wildcard * support in API Group and Resource Kind and updated docs
Signed-off-by: reggie <[email protected]>
* Implemented wildcard * support in API Group and Resource Kind and updated docs
Signed-off-by: reggie <[email protected]>
* Implemented wildcard * support in API Group and Resource Kind and updated docs
Signed-off-by: reggie <[email protected]>
* Added a custom create-from CronJob action
Signed-off-by: reggie <[email protected]>
* in progress
Signed-off-by: reggie <[email protected]>
* in progress
Signed-off-by: reggie <[email protected]>
* in progress
Signed-off-by: reggie <[email protected]>
* in progress
Signed-off-by: reggie <[email protected]>
* added a ns in the action.lua and fixed tests
Signed-off-by: reggie <[email protected]>
* create-job
Signed-off-by: reggie <[email protected]>
* in progress
Signed-off-by: reggie <[email protected]>
* more changes
Signed-off-by: reggie <[email protected]>
* full unit tests and action returning an array
Signed-off-by: reggie <[email protected]>
* cleanup
Signed-off-by: reggie <[email protected]>
* fix the custom tests
Signed-off-by: reggie <[email protected]>
* e2e tests
Signed-off-by: reggie <[email protected]>
* json marshaling annotations ImpactedResource, e2e tests and docs
Signed-off-by: reggie <[email protected]>
* more docs and tests
Signed-off-by: reggie <[email protected]>
* upstream sync
Signed-off-by: reggie <[email protected]>
* fix wrong return upon going over the impacted resources + docs + fixing e2e tests
Signed-off-by: reggie <[email protected]>
* docs
Signed-off-by: reggie <[email protected]>
* better error handling
Signed-off-by: reggie <[email protected]>
* K8SOperation as an enum
Signed-off-by: reggie <[email protected]>
* added dry-run for create operation
Signed-off-by: reggie <[email protected]>
* small changes
Signed-off-by: Michael Crenshaw <[email protected]>
* ref to my gitops-engine fork out
Signed-off-by: reggie <[email protected]>
* ref to my gitops-engine fork out
Signed-off-by: reggie <[email protected]>
* ref to my gitops-engine fork out
Signed-off-by: reggie <[email protected]>
* ref to my gitops-engine fork out
Signed-off-by: reggie <[email protected]>
* ref to my gitops-engine fork out
Signed-off-by: reggie <[email protected]>
* gitops engine dependency and test fixes
Signed-off-by: reggie <[email protected]>
* add workflows action
Signed-off-by: Michael Crenshaw <[email protected]>
* cronworkflow and workflowtemplate actions
Signed-off-by: Michael Crenshaw <[email protected]>
* update gitops-engine
Signed-off-by: Michael Crenshaw <[email protected]>
---------
Signed-off-by: reggie <[email protected]>
Signed-off-by: Michael Crenshaw <[email protected]>
Co-authored-by: Michael Crenshaw <[email protected]>
* refactor(util/git/client): make runCredentialedCmd() signature coherent with runCmd() one
Signed-off-by: Yann Soubeyrand <[email protected]>
* fix(repo-server): completely clean up Git working directory
In some cases, for example when a Git submodule wasn’t present anymore
in a Git revision, the repo-server didn’t completely clean up its Git
working directory.
Fixes#3683
Signed-off-by: Yann Soubeyrand <[email protected]>
---------
Signed-off-by: Yann Soubeyrand <[email protected]>
* chore: surface source not permitted errors
For Git and Helm repositories, we filter out non-permitted urls before
submitting a `ManifestRequest` to the repo-server. While that works
fine, this also leads to very hard to debug issues in particular when
using Helm dependencies.
This (very) WIP PR adds `ProjectSourceRepos` as a parameter to
`ManifestRequest`, so we can verify that a source is in fact
permitted in order to distinguish between actual 40x errors (caused
by e.g misconfiguration) and "source not permitted" caused by not
adding the relevant sources to the AppProject config.
This still needs documentation, tests and some basic sanity checking
before proceeding further, as well as resolving whatever is causing
`make codegen` to not properly work.
Signed-off-by: Blake Pettersson <[email protected]>
* chore: propagate project values to repo-server
Signed-off-by: Blake Pettersson <[email protected]>
* test: fix failing unit tests
now onto the e2e tests...
Signed-off-by: Blake Pettersson <[email protected]>
* test: fix failing e2e test(s)
Signed-off-by: Blake Pettersson <[email protected]>
* fix: add project params
Signed-off-by: Blake Pettersson <[email protected]>
* test: add e2e test
Add Helm dependency check test.
Signed-off-by: Blake Pettersson <[email protected]>
* chore: remove git source check
Discussed over Slack and deemed this to not be necessary at this time.
Signed-off-by: Blake Pettersson <[email protected]>
* make codegen
Signed-off-by: Blake Pettersson <[email protected]>
* chore: cr tweaks
Signed-off-by: Blake Pettersson <[email protected]>
* chore: code review tweaks
Signed-off-by: Blake Pettersson <[email protected]>
* test: fix
Signed-off-by: Blake Pettersson <[email protected]>
* test: wip
Signed-off-by: Blake Pettersson <[email protected]>
* test: wip
Signed-off-by: Blake Pettersson <[email protected]>
* chore: wip
Signed-off-by: Blake Pettersson <[email protected]>
* chore: typo
Signed-off-by: Blake Pettersson <[email protected]>
* fix: typo
Signed-off-by: Blake Pettersson <[email protected]>
* chore: rebase fixes
Signed-off-by: Blake Pettersson <[email protected]>
* test: oci:// is not prefixed
Signed-off-by: Blake Pettersson <[email protected]>
---------
Signed-off-by: Blake Pettersson <[email protected]>
* namespace labels
Signed-off-by: pashavictorovich <[email protected]>
* create namespace should support annotations
Signed-off-by: pashavictorovich <[email protected]>
* handle also modification hook
Signed-off-by: pashavictorovich <[email protected]>
* regenerate entity on modify hook
Signed-off-by: pashavictorovich <[email protected]>
* manifests
Signed-off-by: pashavictorovich <[email protected]>
* feat: enable metadata to be set on namespaces
This builds upon the work that @pasha-codefresh did in #10288.
The main differences between this PR and the previous one is that we use
SSA to diff between different versions of the namespace, as well as
having a slightly different API in gitops-engine for setting the
namespace modifier.
We now also set the ownership of the namespace in ArgoCD.
Closes#4628Closes#6215Closes#7799
Signed-off-by: Blake Pettersson <[email protected]>
* fix: don't always track namespaces
For now, only allow namespaces managed with `managedNamespaceMetadata`
to have tracking set by Argo. Ideally we'd like new namespaces to also
be tracked by Argo, but there's currently an issue with a failing
integration test.
Also wrap error message if setting the app instance errors on the
namespace.
Signed-off-by: Blake Pettersson <[email protected]>
* fix: always return true with `hasManagedMetadata`
If `hasManagedMetadata` is set, `true` should always be returned.
Signed-off-by: Blake Pettersson <[email protected]>
* docs: add clarifying docs on resource tracking
Signed-off-by: Blake Pettersson <[email protected]>
* style: pr tweaks
Signed-off-by: Blake Pettersson <[email protected]>
* fix: re-add label unsetting
Signed-off-by: Blake Pettersson <[email protected]>
* Update gitops-engine to current master
Signed-off-by: Leonardo Luz Almeida <[email protected]>
Signed-off-by: pashavictorovich <[email protected]>
Signed-off-by: Blake Pettersson <[email protected]>
Signed-off-by: Leonardo Luz Almeida <[email protected]>
Co-authored-by: pashavictorovich <[email protected]>
Co-authored-by: Leonardo Luz Almeida <[email protected]>
zeekayandHanzo Dev