mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-07 08:44:50 +00:00
zeekayandHanzo Dev
446e343a3d
Two corrections on top of the naming pass, both found by checking the live cluster rather than the source. The rename had silently changed the user-facing annotation key from argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live Applications carry the old key, so deploying that would have ignored every sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*, and universe 575650286 moves the ApplicationSet template that stamps it, so the controller regenerates all 63 consistently. The API group in code said argoproj.io/v1alpha1 in 157 places while the cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are applications.apps.hanzo.ai). Code now matches what is actually served. The legacy applications.argoproj.io/app-name label had ZERO live users, so it went with the rest. foo.argoproj.io test fixtures became foo.example.com — arbitrary test domains should not carry a vendor name. go build ./... exit 0. Co-authored-by: Hanzo Dev <[email protected]>
45 lines
2.1 KiB
YAML
45 lines
2.1 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cd-rbac-cm
|
|
namespace: cd
|
|
labels:
|
|
app.kubernetes.io/name: cd-rbac-cm
|
|
app.kubernetes.io/part-of: cd
|
|
data:
|
|
# policy.csv is an file containing user-defined RBAC policies and role definitions (optional).
|
|
# Policy rules are in the form:
|
|
# p, subject, resource, action, object, effect
|
|
# Role definitions and bindings are in the form:
|
|
# g, subject, inherited-subject
|
|
# See https://github.com/hanzoai/cd/blob/master/docs/operator-manual/rbac.md for additional information.
|
|
policy.csv: |
|
|
# Grant all members of the group 'my-org:team-alpha; the ability to sync apps in 'my-project'
|
|
p, my-org:team-alpha, applications, sync, my-project/*, allow
|
|
# Grant all members of 'my-org:team-beta' admins
|
|
g, my-org:team-beta, role:admin
|
|
|
|
# it is possible to provide additional entries in this configmap to compose the final policy csv.
|
|
# In this case the key must follow the pattern 'policy.<any string>.csv'. Hanzo CD will concatenate
|
|
# all additional policies it finds with this pattern below the main one ('policy.csv'). This is useful
|
|
# to allow composing policies in config management tools like Kustomize, Helm, etc.
|
|
policy.overlay.csv: |
|
|
p, role:tester, applications, *, */*, allow
|
|
p, role:tester, projects, *, *, allow
|
|
g, my-org:team-qa, role:tester
|
|
|
|
# policy.default is the name of the default role which Hanzo CD will falls back to, when
|
|
# authorizing API requests (optional). If omitted or empty, users may be still be able to login,
|
|
# but will see no apps, projects, etc...
|
|
policy.default: role:readonly
|
|
|
|
# scopes controls which OIDC scopes to examine during rbac enforcement (in addition to `sub` scope).
|
|
# If omitted, defaults to: '[groups]'. The scope value can be a string, or a list of strings.
|
|
scopes: '[cognito:groups, email]'
|
|
|
|
# matchMode configures the matchers function for casbin.
|
|
# There are two options for this, 'glob' for glob matcher or 'regex' for regex matcher. If omitted or mis-configured,
|
|
# will be set to 'glob' as default.
|
|
policy.matchMode: 'glob'
|
|
|