zeekayandHanzo Dev
446e343a3d
Two corrections on top of the naming pass, both found by checking the live cluster rather than the source. The rename had silently changed the user-facing annotation key from argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live Applications carry the old key, so deploying that would have ignored every sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*, and universe 575650286 moves the ApplicationSet template that stamps it, so the controller regenerates all 63 consistently. The API group in code said argoproj.io/v1alpha1 in 157 places while the cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are applications.apps.hanzo.ai). Code now matches what is actually served. The legacy applications.argoproj.io/app-name label had ZERO live users, so it went with the rest. foo.argoproj.io test fixtures became foo.example.com — arbitrary test domains should not carry a vendor name. go build ./... exit 0. Co-authored-by: Hanzo Dev <[email protected]>
2.5 KiB
Auth0
User-definitions
User-definitions in Auth0 is out of scope for this guide. Add them directly in Auth0 database, use an enterprise registry, or "social login". Note: all users have access to all Auth0 defined apps unless you restrict access via configuration - keep this in mind if argo is exposed on the internet or else anyone can login.
Registering the app with Auth0
Follow the register app instructions to create the cd app in Auth0. In the app definition:
- Take note of the clientId and clientSecret values.
- Register login url as https://your.argoingress.address/login
- Set allowed callback url to https://your.argoingress.address/auth/callback
- Under connections, select the user-registries you want to use with argo.
Any other settings are non-essential for the authentication to work.
Adding authorization rules to Auth0
Follow Auth0 authorization guide to setup authorization.
The important part to note here is that group-membership is a non-standard claim, and hence is required to be put under a FQDN claim name, for instance http://your.domain/groups.
Configuring argo
Configure OIDC for Hanzo CD
kubectl edit configmap cd-cm
...
data:
application.instanceLabelKey: cd.hanzo.ai/instance
url: https://your.argoingress.address
oidc.config: |
name: Auth0
issuer: https://<yourtenant>.<eu|us>.auth0.com/
clientID: <theClientId>
clientSecret: <theClientSecret>
domain_hint: <theDomainHint>
requestedScopes:
- openid
- profile
- email
# not strictly necessary - but good practice:
- 'http://your.domain/groups'
...
Configure RBAC for Hanzo CD
kubectl edit configmap cd-rbac-cm (or use helm values).
...
data:
policy.csv: |
# let members with group someProjectGroup handle apps in someProject
# this can also be defined in the UI in the group-definition to avoid doing it there in the configmap
p, someProjectGroup, applications, *, someProject/*, allow
# let the group membership cd-admins from OIDC become role:admin - needs to go into the configmap
g, cd-global-admins, role:admin
policy.default: role:readonly
# essential to get argo to use groups for RBAC:
scopes: '[http://your.domain/groups, email]'
...
Note
Storing Client Secrets
Details on storing your clientSecret securely and correctly can be found on the User Management Overview page.