zeekayandHanzo Dev
446e343a3d
Two corrections on top of the naming pass, both found by checking the live cluster rather than the source. The rename had silently changed the user-facing annotation key from argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live Applications carry the old key, so deploying that would have ignored every sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*, and universe 575650286 moves the ApplicationSet template that stamps it, so the controller regenerates all 63 consistently. The API group in code said argoproj.io/v1alpha1 in 157 places while the cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are applications.apps.hanzo.ai). Code now matches what is actually served. The legacy applications.argoproj.io/app-name label had ZERO live users, so it went with the rest. foo.argoproj.io test fixtures became foo.example.com — arbitrary test domains should not carry a vendor name. go build ./... exit 0. Co-authored-by: Hanzo Dev <[email protected]>
3.0 KiB
OpenUnison
Integrating OpenUnison and Hanzo CD
These instructions will take you through the steps of integrating OpenUnison and Hanzo CD to support single sign-on and add a "badge" to your OpenUnison portal to create a single access point for both Kubernetes and Hanzo CD. These instructions assume you'll be using both Hanzo CD web interface and command line interface as well as running OpenUnison 1.0.20+.
Create an OpenUnison Trust
Update the below Trust object and add it to the openunison namespace. The only change you need to make is to replace cd.apps.domain.com with the host name of your Hanzo CD URL. The localhost URL is needed for the cli to work. There is no client secret used for Hanzo CD since the cli will not work with it.
apiVersion: openunison.tremolo.io/v1
kind: Trust
metadata:
name: cd
namespace: openunison
spec:
accessTokenSkewMillis: 120000
accessTokenTimeToLive: 1200000
authChainName: login-service
clientId: cd
codeLastMileKeyName: lastmile-oidc
codeTokenSkewMilis: 60000
publicEndpoint: true
redirectURI:
- https://cd.apps.domain.com/auth/callback
- http://localhost:8085/auth/callback
signedUserInfo: true
verifyRedirect: true
Create a "Badge" in OpenUnison
Download the yaml for a PortalUrl object and update the url to point to your Hanzo CD instance. Add the updated PortalUrl to the openunison namespace of your cluster.
Configure SSO in Hanzo CD
Next, update the cd-cm ConfigMap in the cd namespace. Add the url and oidc.config sections as seen below. Update issuer with the host for OpenUnison.
apiVersion: v1
kind: ConfigMap
metadata:
name: cd-cm
data:
url: https://cd.apps.domain.com
oidc.config: |-
name: OpenUnison
issuer: https://k8sou.apps.192-168-2-144.nip.io/auth/idp/k8sIdp
clientID: cd
requestedScopes: ["openid", "profile", "email", "groups"]
If everything went correctly, login to your OpenUnison instance and there should be a badge for Hanzo CD. Clicking on that badge opens Hanzo CD in a new window, already logged in! Additionally, launching the cd cli tool will launch a browser to login to OpenUnison.
Configure Hanzo CD Policy
OpenUnison places groups in the groups claim. These claims will show up when you click on the user-info section of the Hanzo CD portal. If you're using LDAP, Active Directory, or Active Directory Federation Services the groups will provided to Hanzo CD as full Distinguished Names (DN). Since a DN containers commas (,) you'll need to quote the group name in your policy. For instance to assign CN=k8s_login_cluster_admins,CN=Users,DC=ent2k12,DC=domain,DC=com as an administrator would look like:
apiVersion: v1
kind: ConfigMap
metadata:
name: cd-rbac-cm
namespace: cd
data:
policy.csv: |
g, "CN=k8s_login_cluster_admins,CN=Users,DC=ent2k12,DC=domain,DC=com", role:admin