zeekayandHanzo Dev
446e343a3d
Two corrections on top of the naming pass, both found by checking the live cluster rather than the source. The rename had silently changed the user-facing annotation key from argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live Applications carry the old key, so deploying that would have ignored every sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*, and universe 575650286 moves the ApplicationSet template that stamps it, so the controller regenerates all 63 consistently. The API group in code said argoproj.io/v1alpha1 in 157 places while the cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are applications.apps.hanzo.ai). Code now matches what is actually served. The legacy applications.argoproj.io/app-name label had ZERO live users, so it went with the rest. foo.argoproj.io test fixtures became foo.example.com — arbitrary test domains should not carry a vendor name. go build ./... exit 0. Co-authored-by: Hanzo Dev <[email protected]>
2.3 KiB
v2.9 to 2.10
managedNamespaceMetadata no longer preserves client-side-applied labels or annotations
Hanzo CD 2.10 upgraded kubectl from 1.24 to 1.26. This upgrade introduced a change where client-side-applied labels and
annotations are no longer preserved when using a server-side kubectl apply. This change affects the
managedNamespaceMetadata field of the Application CRD. Previously, labels and annotations applied via a client-side
apply would be preserved when managedNamespaceMetadata was enabled. Now, those existing labels and annotation will be
removed.
To avoid unexpected behavior, follow the client-side to server-side resource upgrade guide
before enabling managedNamespaceMetadata on an existing namespace.
Upgraded Helm Version
Note that bundled Helm version has been upgraded from 3.13.2 to 3.14.3.
Egress NetworkPolicy for cd-redis and cd-redis-ha-haproxy
Starting with Hanzo CD 2.10.11, the NetworkPolicy for the cd-redis and cd-redis-ha-haproxy dropped Egress restrictions. This change was made
to allow access to the Kubernetes API to create a secret to secure Redis access.
To retain similar networking restrictions as before 2.10.11, you can add an Egress rule to allow access only to the
Kubernetes API and access needed by Redis itself. The Egress rule for Kubernetes access will depend entirely on your
Kubernetes setup. The access for Redis itself can be allowed by adding the following to the
cd-redis-network-policy NetworkPolicy:
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: cd-redis-network-policy
spec:
policyTypes:
- Ingress
+ - Egress
+ egress:
+ - ports:
+ - port: 53
+ protocol: UDP
+ - port: 53
+ protocol: TCP
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: cd-redis-ha-haproxy
spec:
policyTypes:
- Ingress
+ - Egress
+ egress:
+ - ports:
+ - port: 6379
+ protocol: TCP
+ - port: 26379
+ protocol: TCP
+ to:
+ - podSelector:
+ matchLabels:
+ app.kubernetes.io/name: cd-redis-ha
+ - ports:
+ - port: 53
+ protocol: UDP
+ - port: 53
+ protocol: TCP