mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-07 08:44:50 +00:00
zeekayandHanzo Dev
446e343a3d
Two corrections on top of the naming pass, both found by checking the live cluster rather than the source. The rename had silently changed the user-facing annotation key from argocd.argoproj.io/sync-wave to cd.argoproj.io/sync-wave — 63 live Applications carry the old key, so deploying that would have ignored every sync-wave and broken fleet deploy ordering. The key is now cd.hanzo.ai/*, and universe 575650286 moves the ApplicationSet template that stamps it, so the controller regenerates all 63 consistently. The API group in code said argoproj.io/v1alpha1 in 157 places while the cluster has served apps.hanzo.ai/v1alpha1 since 2026-07-23 (the CRDs are applications.apps.hanzo.ai). Code now matches what is actually served. The legacy applications.argoproj.io/app-name label had ZERO live users, so it went with the rest. foo.argoproj.io test fixtures became foo.example.com — arbitrary test domains should not carry a vendor name. go build ./... exit 0. Co-authored-by: Hanzo Dev <[email protected]>
151 lines
4.0 KiB
YAML
151 lines
4.0 KiB
YAML
# A minimal aggregated (extension) API server based on the Kubernetes
|
|
# "sample-apiserver" (wardle). It registers the wardle.example.com/v1alpha1 group
|
|
# (Flunder/Fischer kinds) via an APIService. These manifests are intentionally
|
|
# NOT part of any Hanzo CD application path; the e2e test applies them directly
|
|
# with kubectl AFTER Hanzo CD is already running, to verify that the cluster cache
|
|
# picks up the newly served kinds without a manual cache invalidation.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: wardle
|
|
# e2e.apps.hanzo.ai lets fixture EnsureCleanState catch leaks if t.Cleanup fails.
|
|
labels:
|
|
e2e.apps.hanzo.ai: "true"
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: apiserver
|
|
namespace: wardle
|
|
---
|
|
# Allows the aggregated apiserver to delegate authn/authz to the kube-apiserver.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: wardle:system:auth-delegator
|
|
labels:
|
|
e2e.apps.hanzo.ai: "true"
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: system:auth-delegator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: apiserver
|
|
namespace: wardle
|
|
---
|
|
# Allows the aggregated apiserver to read the extension-apiserver-authentication
|
|
# configmap (front-proxy CA / requestheader config) from kube-system.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: wardle-auth-reader
|
|
namespace: kube-system
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: extension-apiserver-authentication-reader
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: apiserver
|
|
namespace: wardle
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: wardle-aggregated-apiserver-clusterrole
|
|
labels:
|
|
e2e.apps.hanzo.ai: "true"
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get", "watch", "list"]
|
|
- apiGroups: ["admissionregistration.k8s.io"]
|
|
resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
|
|
verbs: ["get", "watch", "list"]
|
|
- apiGroups: ["flowcontrol.apiserver.k8s.io"]
|
|
resources: ["prioritylevelconfigurations", "flowschemas"]
|
|
verbs: ["get", "watch", "list"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: wardle-aggregated-apiserver-clusterrolebinding
|
|
labels:
|
|
e2e.apps.hanzo.ai: "true"
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: wardle-aggregated-apiserver-clusterrole
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: apiserver
|
|
namespace: wardle
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: wardle-server
|
|
namespace: wardle
|
|
labels:
|
|
apiserver: "true"
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
apiserver: "true"
|
|
template:
|
|
metadata:
|
|
labels:
|
|
apiserver: "true"
|
|
spec:
|
|
serviceAccountName: apiserver
|
|
containers:
|
|
- name: wardle-server
|
|
image: registry.k8s.io/e2e-test-images/sample-apiserver:1.29.2
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- --etcd-servers=http://127.0.0.1:2379
|
|
- --secure-port=8443
|
|
ports:
|
|
- containerPort: 8443
|
|
- name: etcd
|
|
image: registry.k8s.io/etcd:3.5.16-0
|
|
imagePullPolicy: IfNotPresent
|
|
command: ["/usr/local/bin/etcd"]
|
|
args:
|
|
- --data-dir=/tmp/etcd
|
|
- --listen-client-urls=http://127.0.0.1:2379
|
|
- --advertise-client-urls=http://127.0.0.1:2379
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: api
|
|
namespace: wardle
|
|
spec:
|
|
ports:
|
|
- port: 443
|
|
protocol: TCP
|
|
targetPort: 8443
|
|
selector:
|
|
apiserver: "true"
|
|
---
|
|
apiVersion: apiregistration.k8s.io/v1
|
|
kind: APIService
|
|
metadata:
|
|
name: v1alpha1.wardle.example.com
|
|
# e2e.apps.hanzo.ai lets fixture EnsureCleanState clean up this cluster-scoped
|
|
# APIService between tests; a dangling APIService degrades discovery.
|
|
labels:
|
|
e2e.apps.hanzo.ai: "true"
|
|
spec:
|
|
insecureSkipTLSVerify: true
|
|
group: wardle.example.com
|
|
groupPriorityMinimum: 1000
|
|
versionPriority: 15
|
|
service:
|
|
name: api
|
|
namespace: wardle
|
|
version: v1alpha1
|