mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-30 14:56:59 +00:00
zeekayandHanzo Dev
446e343a3d
Two corrections on top of the naming pass, both found by checking the live cluster rather than the source. The rename had silently changed the user-facing annotation key from argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live Applications carry the old key, so deploying that would have ignored every sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*, and universe 575650286 moves the ApplicationSet template that stamps it, so the controller regenerates all 63 consistently. The API group in code said argoproj.io/v1alpha1 in 157 places while the cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are applications.apps.hanzo.ai). Code now matches what is actually served. The legacy applications.argoproj.io/app-name label had ZERO live users, so it went with the rest. foo.argoproj.io test fixtures became foo.example.com — arbitrary test domains should not carry a vendor name. go build ./... exit 0. Co-authored-by: Hanzo Dev <[email protected]>
53 lines
1.7 KiB
YAML
53 lines
1.7 KiB
YAML
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: Policy
|
|
metadata:
|
|
annotations:
|
|
cd.hanzo.ai/compare-options: IgnoreExtraneous
|
|
cd.hanzo.ai/sync-options: SkipDryRunOnMissingResource=true
|
|
labels:
|
|
cd.hanzo.ai/instance: acm
|
|
name: acm-hub-ca-policy
|
|
namespace: open-cluster-management
|
|
spec:
|
|
disabled: false
|
|
policy-templates:
|
|
- objectDefinition:
|
|
apiVersion: policy.open-cluster-management.io/v1
|
|
kind: ConfigurationPolicy
|
|
metadata:
|
|
name: acm-hub-ca-config-policy
|
|
spec:
|
|
namespaceSelector:
|
|
include:
|
|
- default
|
|
object-templates:
|
|
- complianceType: mustonlyhave
|
|
objectDefinition:
|
|
apiVersion: v1
|
|
data:
|
|
hub-kube-root-ca.crt: '{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt"
|
|
| base64enc hub}}'
|
|
hub-openshift-service-ca.crt: '{{hub fromConfigMap "" "openshift-service-ca.crt"
|
|
"service-ca.crt" | base64enc hub}}'
|
|
kind: Secret
|
|
metadata:
|
|
name: hub-ca
|
|
namespace: golang-external-secrets
|
|
type: Opaque
|
|
- complianceType: mustonlyhave
|
|
objectDefinition:
|
|
apiVersion: v1
|
|
data:
|
|
hub-kube-root-ca.crt: |
|
|
{{hub fromConfigMap "" "kube-root-ca.crt" "ca.crt" | autoindent hub}}
|
|
hub-openshift-service-ca.crt: |
|
|
{{hub fromConfigMap "" "openshift-service-ca.crt" "service-ca.crt" | autoindent hub}}
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: trusted-hub-bundle
|
|
namespace: imperative
|
|
remediationAction: enforce
|
|
severity: medium
|
|
remediationAction: enforce
|
|
status: {}
|