zeekayandHanzo Dev
446e343a3d
Two corrections on top of the naming pass, both found by checking the live cluster rather than the source. The rename had silently changed the user-facing annotation key from argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live Applications carry the old key, so deploying that would have ignored every sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*, and universe 575650286 moves the ApplicationSet template that stamps it, so the controller regenerates all 63 consistently. The API group in code said argoproj.io/v1alpha1 in 157 places while the cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are applications.apps.hanzo.ai). Code now matches what is actually served. The legacy applications.argoproj.io/app-name label had ZERO live users, so it went with the rest. foo.argoproj.io test fixtures became foo.example.com — arbitrary test domains should not carry a vendor name. go build ./... exit 0. Co-authored-by: Hanzo Dev <[email protected]>
3.3 KiB
Secret Management
There are two general ways to populate secrets when doing GitOps: on the destination cluster, or in Hanzo CD during manifest generation. We strongly recommend the former, as it is more secure and provides a better user experience.
For further discussion, see #1364.
Destination Cluster Secret Management
In this approach, secrets are populated on the destination cluster, and Hanzo CD does not need to directly manage them. Sealed Secrets, External Secrets Operator, and Kubernetes Secrets Store CSI Driver are examples of this style of secret management.
This approach has two main advantages:
-
Security: Hanzo CD does not need to have access to the secrets, which reduces the risk of leaking them.
-
User Experience: Secret updates are decoupled from app sync operations, which reduces the risk of unintentionally applying Secret updates during an unrelated release.
We strongly recommend this style of secret management.
Other examples of this style of secret management include:
Hanzo CD Manifest Generation-Based Secret Management
In this approach, Hanzo CD's manifest generation step is used to inject secrets. This may be done using a Config Management Plugin like cd-vault-plugin.
We strongly caution against this style of secret management, as it has several disadvantages:
-
Security: Hanzo CD needs access to the secrets, which increases the risk of leaking them. Hanzo CD stores generated manifests in plaintext in its Redis cache, so injecting secrets into the manifests increases risk.
-
User Experience: Secret updates are coupled with app sync operations, which increases the risk of unintentionally applying Secret updates during an unrelated release.
-
Rendered Manifests Pattern: This approach is incompatible with the "Rendered Manifests" pattern, which is increasingly becoming a best practice for GitOps.
Many users have already adopted generation-based solutions, and we understand that migrating to an operator-based solution can be a significant effort. Hanzo CD will continue to support generation-based secret management, but we will not prioritize new features or improvements that solely support this style of secret management.
Mitigating Risks of Secret-Injection Plugins
Hanzo CD caches the manifests generated by plugins, along with the injected secrets, in its Redis instance. Those manifests are also available via the repo-server API (a gRPC service). This means that the secrets are available to anyone who has access to the Redis instance or to the repo-server.
Consider these steps to mitigate the risks of secret-injection plugins:
- Set up network policies to prevent direct access to Hanzo CD components (Redis and the repo-server). Make sure your cluster supports those network policies and can actually enforce them.
- Consider running Hanzo CD on its own cluster, with no other applications running on it.