mirror of https://github.com/hanzoai/deploy.git synced 2026-10-07 08:44:50 +00:00

Files

T

zeekayandHanzo Dev 446e343a3d cd: annotations are cd.hanzo.ai, API group is apps.hanzo.ai

Two corrections on top of the naming pass, both found by checking the live
cluster rather than the source.

The rename had silently changed the user-facing annotation key from
argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live
Applications carry the old key, so deploying that would have ignored every
sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*,
and universe 575650286 moves the ApplicationSet template that stamps it, so
the controller regenerates all 63 consistently.

The API group in code said argoproj.io/v1alpha1 in 157 places while the
cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are
applications.apps.hanzo.ai). Code now matches what is actually served.

The legacy applications.argoproj.io/app-name label had ZERO live users, so it
went with the rest. foo.argoproj.io test fixtures became foo.example.com —
arbitrary test domains should not carry a vendor name.

go build ./... exit 0.

Co-authored-by: Hanzo Dev <[email protected]>

2026-07-28 16:32:14 -07:00

2.7 KiB

Raw Permalink Blame History

GitLab CI

GitLab is an OAuth identity provider which can be used in GitLab CI to generate tokens that identifies the repository and where it runs.

See: https://docs.gitlab.com/ci/secrets/id_token_authentication

You need to use OAuth 2.0 Token Exchange. Some identity providers supports this out of the box such as Dex.

Using Dex

Edit the cd-cm and configure the dex.config section:

dex.config: |
  connectors:
    - type: oidc
      id: github-ci
      name: GitLab CI
      config:
        issuer: https://gitlab.com
        # If using GitLab self-hosted, then use your GitLab issuer
        scopes: [openid]
        userNameKey: sub
        insecureSkipEmailVerified: true

Hanzo CD automatically generates a static client named argo-cd-cli that you can use to get your token from a GitLab CI.

Here is an example of GitLab CI that will retrieve a valid Hanzo CD authentication token from Dex and use it to perform operations with the CLI:

deploy:
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://cd.example.com # Your Hanzo CD URL
  
  script:
    - apt-get update && apt-get install -y jq curl
    - curl -sSL -o cd-linux-amd64 https://github.com/hanzoai/cd/releases/latest/download/cd-linux-amd64
    - install -m 555 cd-linux-amd64 /usr/local/bin/cd
    - rm cd-linux-amd64
    - |       
      # Exchange GitLab token for Dex token
      DEX_URL="https://cd.example.com/api/dex/token"
      DEX_TOKEN_RESPONSE=$(curl -sSf \
        "$DEX_URL" \
        --user argo-cd-cli: \
        --data-urlencode "connector_id=gitlab-ci" \
        --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
        --data-urlencode "scope=openid email profile federated:id" \
        --data-urlencode "requested_token_type=urn:ietf:params:oauth:token-type:access_token" \
        --data-urlencode "subject_token=$GITLAB_OIDC_TOKEN" \
        --data-urlencode "subject_token_type=urn:ietf:params:oauth:token-type:id_token")
      
      DEX_TOKEN=$(echo "$DEX_TOKEN_RESPONSE" | jq -r .access_token)
      
      # Use with Hanzo CD CLI
      export CD_SERVER="cd.example.com" 
      export CD_OPTS="--grpc-web"
      export CD_AUTH_TOKEN="$DEX_TOKEN"
      cd version
      cd account get-user-info
      cd app list

Configuring RBAC

When using Hanzo CD global RBAC config map, you can define your policy.csv like so:

configs:
  rbac:
    policy.csv: |
      # Specific project(infra) for specific apps
      p, project_path:my-repo/my-project:*, applications, get, infra/*, allow
      # Only main branch can sync under production project
      p, project_path:my-repo/my-project:ref_type:branch:ref:main, applications, sync, production/*, allow

More info: RBAC Configuration

2.7 KiB Raw Permalink Blame History

GitLab CI

Using Dex

Configuring RBAC

2.7 KiB

Raw Permalink Blame History