zeekayandHanzo Dev
472238ddb0
House rule: /v1/ is the API prefix, everywhere, and /api/ is never added on top of it. The api.* subdomain names the API; a path prefix restating it is noise. This applies it to the whole route surface: /api/v1/* -> /v1/* 106 proto annotations, 109 gateway patterns /api/version -> /v1/version /api/badge -> /v1/badge /api/webhook -> /v1/webhook (server + applicationset controller) /api/dex/* -> /v1/dex/* (constants; dex is built, not deployed) The grpc-gateway .pb.gw.go files are generated, and the plugin toolchain is not on this machine, so they were rewritten by a script that applies exactly the transform codegen would: for /api/v1 paths, drop the leading "api" literal-push opcode pair and decrement every LitPush(2,N)/Capture(5,N) pool index; for /api/version, rename the segment. ConcatN(4,N) operands are counts, not pool indexes, and are untouched. The .proto annotations moved in the same commit, so the next real codegen run is a no-op against these files. MustPattern panics at package init on a malformed pattern, so every rewritten pattern is validated by any import of pkg/apiclient — those tests pass. Also moved: assets/swagger.json (82 paths), the UI's two roots (apiRoot() '/v1', version-service '/v1/version') and its two relative composers (app logs download, badge panel), the five audit-pattern regexes in server.go, and the tests that asserted the old paths. terminal_test's request URL claimed /api/v1/terminal, a route that never existed — the handler is mounted at /terminal; the fixture now says so. NOT touched, deliberately: /api/v3 in GitHub Enterprise base-url examples (GitHub's URL shape, not ours), util/vendored/kubeclientmetrics (parses the KUBERNETES API server's /api/v1 paths), and util/http's cookie-path fixture (arbitrary string exercising slash normalization). go build ./... clean. Pre-existing failures in badge/session/webhook/account tests reproduce identically on the parent commit (rebrand fallout — badge colors, cookie name length, dex issuer) and are not made worse here. External consumers checked: universe has zero references to cd.hanzo.ai/api; the CLI speaks gRPC, not the REST gateway; UI and server ship in one image so they move together. Co-authored-by: Hanzo Dev <[email protected]>
Hanzo CD — declarative continuous delivery for Kubernetes
Git holds the desired state; the controller applies it and reports drift.
Hanzo CD is a hard fork of Argo CD (Apache-2.0 — see NOTICE). The engine is theirs. The packaging, API group and platform integration are ours. Their community, docs, support channels and roadmap are not ours, so this file does not borrow them — the previous version of this README was upstream's with the names replaced, which had the effect of putting our name on other people's conference talks and blog posts.
What differs from upstream
| API group | apps.hanzo.ai — Application, ApplicationSet, AppProject |
| annotations | cd.hanzo.ai/* |
| binaries | cd, cd-server, cd-repo-server, cd-application-controller, cd-applicationset-controller, cd-commit-server, cd-cmp-server, cd-dex, cd-git-ask-pass, cd-k8s-auth |
| module | github.com/hanzoai/cd |
| image | ghcr.io/hanzoai/cd |
| SSO | Hanzo IAM (hanzo.id) over OIDC — dex builds but is not deployed |
| notifications | removed; we use hanzoai/notify |
Where it runs
cd.hanzo.ai, namespace hanzo-cd on hanzo-k8s.
It moves git → CR for the fleet; the Hanzo operator keeps CR → workload. The two never write the same field: Hanzo CD owns CR spec from git, the operator owns CR status and the child workload. Disjoint by construction, which is what lets both run without fighting over field ownership.
Deployment layout, the AppProject fences, and the one-observer/three-enforcer
split live in
hanzoai/universe → infra/k8s/hanzo-cd/.
Build
CGO_ENABLED=0 go build ./... # the gate hanzo.yml runs on every PR
Images build on platform.hanzo.ai from the root
Dockerfile; hanzo.yml declares the target.
Releases are tagged. A branch build publishes sha-<short> and will never
advance a service already pinned to a release, so shipping means cutting a
vX.Y.Z tag — not merging to main.