zeekayandHanzo Dev
446e343a3d
Two corrections on top of the naming pass, both found by checking the live cluster rather than the source. The rename had silently changed the user-facing annotation key from argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live Applications carry the old key, so deploying that would have ignored every sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*, and universe 575650286 moves the ApplicationSet template that stamps it, so the controller regenerates all 63 consistently. The API group in code said argoproj.io/v1alpha1 in 157 places while the cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are applications.apps.hanzo.ai). Code now matches what is actually served. The legacy applications.argoproj.io/app-name label had ZERO live users, so it went with the rest. foo.argoproj.io test fixtures became foo.example.com — arbitrary test domains should not carry a vendor name. go build ./... exit 0. Co-authored-by: Hanzo Dev <[email protected]>
1.7 KiB
Overview
Hanzo CD permits declaring criteria for application sources integrity that, when not met, will prevent an application from syncing with a ResourceComparison error.
This is useful to verify the sources have not been tampered with by an unauthorized contributor.
Each Application Project can have its criteria configured in AppProject's .spec.sourceIntegrity.
The criteria distinguish a type of verification they perform, and to which sources they apply.
Each application can be a subject of multiple checks, and the sync will be enabled only when all criteria are met.
Note
Source Integrity Verification is only configured through
AppProjectmanifests or CLI. UI is not supported yet.
Note
Signature verification is not supported for the Application Sets populated by the git generator when they have the
projectfield templated.
Warning
If source integrity is enforced, you will not be able to sync from local sources (i.e.
cd app sync --local) anymore.
Supported methods
- Git GnuPG verification verifies that Git commits are GnuPG Signed. This is a modern method of the commit signature verification originally configured in
AppProjects'ssignatureKeys.
Multi-source applications
Each individual application source can be a subject of a different set of source integrity criteria, if desirable. This is necessary if the sources are of a different type, such as Git and Helm. But even different repositories of the same type can utilize different methods of verification, or their different configurations. This is useful when an application combines sources maintained by different groups of people, or according to different contribution (and signing) guidelines.