mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-07 08:44:50 +00:00
zeekayandHanzo Dev
446e343a3d
Two corrections on top of the naming pass, both found by checking the live cluster rather than the source. The rename had silently changed the user-facing annotation key from argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live Applications carry the old key, so deploying that would have ignored every sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*, and universe 575650286 moves the ApplicationSet template that stamps it, so the controller regenerates all 63 consistently. The API group in code said argoproj.io/v1alpha1 in 157 places while the cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are applications.apps.hanzo.ai). Code now matches what is actually served. The legacy applications.argoproj.io/app-name label had ZERO live users, so it went with the rest. foo.argoproj.io test fixtures became foo.example.com — arbitrary test domains should not carry a vendor name. go build ./... exit 0. Co-authored-by: Hanzo Dev <[email protected]>
133 lines
4.4 KiB
YAML
133 lines
4.4 KiB
YAML
apiVersion: apps.hanzo.ai/v1alpha1
|
|
kind: AppProject
|
|
metadata:
|
|
name: my-project
|
|
namespace: cd
|
|
# Finalizer that ensures that project is not deleted until it is not referenced by any application
|
|
finalizers:
|
|
- resources-finalizer.cd.hanzo.ai
|
|
spec:
|
|
# Project description
|
|
description: Example Project
|
|
|
|
# Allow manifests to deploy from any Git repos
|
|
sourceRepos:
|
|
- '*'
|
|
|
|
# Only permit applications to deploy to the 'guestbook' namespace or any namespace starting with 'guestbook-' in the same cluster
|
|
# Destination clusters can be identified by 'server', 'name', or both.
|
|
destinations:
|
|
- namespace: guestbook
|
|
server: https://kubernetes.default.svc
|
|
name: in-cluster
|
|
# Destinations also allow wildcard globbing
|
|
- namespace: guestbook-*
|
|
server: https://kubernetes.default.svc
|
|
name: in-cluster
|
|
|
|
# Deny all cluster-scoped resources from being created, except for Namespace
|
|
clusterResourceWhitelist:
|
|
- group: ''
|
|
kind: Namespace
|
|
# Name is optional. If specified, only resources with a matching name will be allowed.
|
|
# Globs in Go's filepath.Match syntax are supported. Example: "team1-*".
|
|
name: ''
|
|
|
|
# Deny all Namespace resources from being created if their name starts with 'kube-'
|
|
clusterResourceBlacklist:
|
|
- group: ''
|
|
kind: Namespace
|
|
# Name is optional. If specified, only resources with a matching name will be denied.
|
|
name: 'kube-*'
|
|
|
|
# Allow all namespaced-scoped resources to be created, except for ResourceQuota, LimitRange, NetworkPolicy
|
|
namespaceResourceBlacklist:
|
|
- group: ''
|
|
kind: ResourceQuota
|
|
- group: ''
|
|
kind: LimitRange
|
|
- group: ''
|
|
kind: NetworkPolicy
|
|
|
|
# Deny all namespaced-scoped resources from being created, except for Deployment and StatefulSet
|
|
namespaceResourceWhitelist:
|
|
- group: 'apps'
|
|
kind: Deployment
|
|
- group: 'apps'
|
|
kind: StatefulSet
|
|
|
|
# Enables namespace orphaned resource monitoring.
|
|
orphanedResources:
|
|
warn: false
|
|
|
|
roles:
|
|
# A role which provides read-only access to all applications in the project
|
|
- name: read-only
|
|
description: Read-only privileges to my-project
|
|
policies:
|
|
- p, proj:my-project:read-only, applications, get, my-project/*, allow
|
|
groups:
|
|
- my-oidc-group
|
|
|
|
# A role which provides sync privileges to only the guestbook-dev application, e.g. to provide
|
|
# sync privileges to a CI system
|
|
- name: ci-role
|
|
description: Sync privileges for guestbook-dev
|
|
policies:
|
|
- p, proj:my-project:ci-role, applications, sync, my-project/guestbook-dev, allow
|
|
|
|
# NOTE: JWT tokens can only be generated by the API server and the token is not persisted
|
|
# anywhere by Hanzo CD. It can be prematurely revoked by removing the entry from this list.
|
|
jwtTokens:
|
|
- iat: 1535390316
|
|
|
|
# Sync windows restrict when Applications may be synced. https://argo-cd.readthedocs.io/en/stable/user-guide/sync_windows/
|
|
syncWindows:
|
|
- kind: allow
|
|
schedule: '10 1 * * *'
|
|
duration: 1h
|
|
applications:
|
|
- '*-prod'
|
|
manualSync: true
|
|
- kind: allow
|
|
schedule: '0 9 * * *'
|
|
duration: 8h
|
|
applications:
|
|
- '*'
|
|
syncOverrun: true # Syncs started during this window can continue after window ends
|
|
- kind: deny
|
|
schedule: '0 22 * * *'
|
|
duration: 1h
|
|
namespaces:
|
|
- default
|
|
syncOverrun: true # Syncs started before this window can continue during the window
|
|
- kind: allow
|
|
schedule: '0 23 * * *'
|
|
duration: 1h
|
|
clusters:
|
|
- in-cluster
|
|
- cluster1
|
|
|
|
# By default, apps may sync to any cluster specified under the `destinations` field, even if they are not
|
|
# scoped to this project. Set the following field to `true` to restrict apps in this cluster to only clusters
|
|
# scoped to this project.
|
|
permitOnlyProjectScopedClusters: false
|
|
|
|
# When using Applications-in-any-namespace, this field determines which namespaces this AppProject permits
|
|
# Applications to reside in. Details: https://argo-cd.readthedocs.io/en/stable/operator-manual/app-any-namespace/
|
|
sourceNamespaces:
|
|
- "cd-apps-*"
|
|
|
|
# Source Integrity declares criteria for application source repositories, such as cryptographic signing, etc.
|
|
# https://argo-cd.readthedocs.io/en/latest/user-guide/source-integrity/
|
|
sourceIntegrity:
|
|
git:
|
|
policies:
|
|
- repos:
|
|
- url: 'https://github.com/foo/*'
|
|
- url: '!https://github.com/foo/bar.git'
|
|
gpg:
|
|
mode: strict
|
|
keys:
|
|
- "D56C4FCA57A46444"
|