mirror of https://github.com/hanzoai/deploy.git synced 2026-10-07 08:44:50 +00:00

Files

T

zeekayandHanzo Dev 446e343a3d cd: annotations are cd.hanzo.ai, API group is apps.hanzo.ai

Two corrections on top of the naming pass, both found by checking the live
cluster rather than the source.

The rename had silently changed the user-facing annotation key from
argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live
Applications carry the old key, so deploying that would have ignored every
sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*,
and universe 575650286 moves the ApplicationSet template that stamps it, so
the controller regenerates all 63 consistently.

The API group in code said argoproj.io/v1alpha1 in 157 places while the
cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are
applications.apps.hanzo.ai). Code now matches what is actually served.

The legacy applications.argoproj.io/app-name label had ZERO live users, so it
went with the rest. foo.argoproj.io test fixtures became foo.example.com —
arbitrary test domains should not carry a vendor name.

go build ./... exit 0.

Co-authored-by: Hanzo Dev <[email protected]>

2026-07-28 16:32:14 -07:00

3.3 KiB

Raw Permalink Blame History

Identity Center (AWS SSO)

Note

Are you using this? Please contribute!

If you're using this IdP please consider contributing to this document.

A working Single Sign-On configuration using Identity Center (AWS SSO) has been achieved using the following method:

SAML (with Dex)

SAML (with Dex)

Create a new SAML application in Identity Center and download the certificate.

Click Assign Users after creating the application in Identity Center, and select the users or user groups you wish to grant access to this application.

Copy the Hanzo CD URL into the data.url field in the cd-cm ConfigMap.
```
 data:
   url: https://cd.example.com
```
Configure Attribute mappings.

!!! note "Group attribute mapping is not officially!" Group attribute mapping is not officially supported in the AWS docs, however the workaround is currently working.

Download the CA certificate to use in the cd-cm configuration.
- If using the caData field, you'll need to base64-encode the entire certificate, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- stanzas (e.g., base64 my_cert.pem).
- If using the ca field and storing the CA certificate separately as a secret, you will need to mount the secret onto the dex container in the cd-dex-server Deployment.

Edit the cd-cm and configure the data.dex.config section:

dex.config: |
  logger:
    level: debug
    format: json
  connectors:
  - type: saml
    id: aws
    name: "AWS IAM Identity Center"
    config:
      # You need value of Identity Center APP SAML (IAM Identity Center sign-in URL)
      ssoURL: https://portal.sso.yourregion.amazonaws.com/saml/assertion/id
      # You need `caData` _OR_ `ca`, but not both.
      caData: <CA cert (IAM Identity Center Certificate of Identity Center APP SAML) passed through base64 encoding>
      # Path to mount the secret to the dex container
      entityIssuer: https://external.path.to.cd.io/api/dex/callback
      redirectURI: https://external.path.to.cd.io/api/dex/callback
      usernameAttr: email
      emailAttr: email
      groupsAttr: groups

Connect Identity Center Groups to Hanzo CD Roles

Hanzo CD recognizes user memberships in Identity Center groups that match the Group Attribute Statements regex.

In the example above, the regex cd-* is used, making Hanzo CD aware of a group named cd-admins.

Modify the cd-rbac-cm ConfigMap to connect the Hanzo CD-administrators Identity Center group to the builtin Hanzo CD admin role.

apiVersion: v1
kind: ConfigMap
metadata:
  name: cd-rbac-cm
data:
  policy.csv: |
    g, <Identity Center Group ID>, role:admin
  scopes: '[groups, email]'

3.3 KiB Raw Permalink Blame History

Identity Center (AWS SSO)

SAML (with Dex)

Connect Identity Center Groups to Hanzo CD Roles

3.3 KiB

Raw Permalink Blame History