Documentation
¶
Overview ¶
Package deploy is Hanzo CD: see what each app is running, sync it, and roll back a bad release.
It is the GitOps plane at /v1/deploy — observe the operator-managed fleet (applications, resource tree, per-object health, live diff, logs), and reconcile it (sync, rollback, git → cluster with prune-safe self-heal).
Each operator hanzo.ai/v1 App CR IS a GitOps Application: the desired state declared for one workload, which the Hanzo operator reconciles into a Deployment + Service + Ingress (+ HPA/PDB/Pods). This plane OBSERVES that reconciliation the way a CD controller observes a synced Application —
GET /v1/deploy/applications — the fleet list: name, declared version,
health, sync, per app.
GET /v1/deploy/{name}/tree — the owned-resource tree (ownerRef edges)
with per-node health + sync.
GET /v1/deploy/{name}/resource/{ref} — one node's live manifest + a
desired-vs-live diff.
GET /v1/deploy/{name}/logs — the app's current pod logs.
POST /v1/deploy/{name}/rollback — pin the CR image tag to a prior semver
(the operator reconciles the rollout).
POST /v1/deploy/{name}/sync — request an operator reconcile now.
SECURITY — the projection READS are TENANT-SCOPED and the WRITES stay SuperAdmin- only, all fail-closed on the SAME identity boundary the rest of cloud trusts (resolveScope, scope.go — validated principal + injective namespace.Sanitize + the c.IsAdmin() SuperAdmin predicate): a SuperAdmin sees/mutates the whole fleet, a validated org member sees ONLY its own org's apps (hanzo.ai/org label), and the reconcile writes (sync/rollback) remain SuperAdmin-only. Secret objects are never surfaced (no node, no manifest) so the tree can never leak materialized env. The user-facing per-org PaaS is /v1/platform; this is the platform-operator console the admin dashboard consumes, now also serving a read-only per-org reflection.
GitOps note (the follow-on seam): today the CR is the desired-state source and a rollback/rollout PATCHES it directly (P1's RegisterServiceReleaser), so deploys work now. The end-state is true GitOps on OUR native git — RegisterPushBuilder commits the CR image-tag change to the manifest repo on git.hanzo.ai (github.com/hanzoai/git) and this engine syncs that repo → cluster with self-heal. The desired-vs-live diff below is already structured for that: it reads a desired source that is "cluster last-applied" now and becomes the git.hanzo.ai manifest later, with no shape change. See deployDesiredTODO.
Index ¶
Constants ¶
const ( SyncSynced = "synced" SyncOutOfSync = "out-of-sync" SyncUnknown = "unknown" )
Sync codes — the ArgoCD sync vocabulary, lowercased for the wire.
const ( HealthHealthy = "healthy" HealthProgressing = "progressing" HealthDegraded = "degraded" HealthSuspended = "suspended" HealthMissing = "missing" HealthUnknown = "unknown" )
Health codes — the ArgoCD health vocabulary, lowercased for the wire.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Application ¶
type Application struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Env string `json:"env"` // main|test|dev
Role string `json:"role,omitempty"` // spec.role after the kind collapse (App)
Repository string `json:"repository"`
Version string `json:"version"` // declared: spec.image.tag
RunningVersion string `json:"runningVersion"` // observed from the Deployment
Health string `json:"health"` // healthy|progressing|degraded|suspended|missing|unknown
HealthMessage string `json:"healthMessage,omitempty"`
Sync string `json:"sync"` // synced|out-of-sync|unknown
Phase string `json:"phase,omitempty"`
Endpoints []string `json:"endpoints"`
}
Application is one fleet row. Shapes the exact fields the console list consumes.
type GitOpsApp ¶
type GitOpsApp struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
Project string `json:"project,omitempty"`
RepoURL string `json:"repoURL,omitempty"`
Path string `json:"path,omitempty"`
TargetRevision string `json:"targetRevision,omitempty"`
Revision string `json:"revision,omitempty"` // the commit last applied
Sync string `json:"sync"` // Synced|OutOfSync|Unknown
Health string `json:"health"` // Healthy|Degraded|Progressing|…
ReconciledAt string `json:"reconciledAt,omitempty"`
Automated bool `json:"automated"`
SelfHeal bool `json:"selfHeal"`
Resources int `json:"resources"`
Operation *GitOpsOperation `json:"operation,omitempty"`
History []GitOpsDeploy `json:"history"`
}
GitOpsApp is one CD Application: what it tracks, what it has applied, and how that went.
type GitOpsDeploy ¶
type GitOpsDeploy struct {
ID int64 `json:"id"`
Revision string `json:"revision"`
StartedAt string `json:"startedAt,omitempty"`
DeployedAt string `json:"deployedAt,omitempty"`
Automated bool `json:"automated"`
}
GitOpsDeploy is one revision Hanzo CD actually applied.
type GitOpsOperation ¶
type GitOpsOperation struct {
Phase string `json:"phase"`
Message string `json:"message,omitempty"`
StartedAt string `json:"startedAt,omitempty"`
FinishedAt string `json:"finishedAt,omitempty"`
Revision string `json:"revision,omitempty"`
}
GitOpsOperation is the LAST sync operation and how it ended — the honest answer to "did the most recent attempt succeed", which the sync verdict alone does not give (an Application is "Synced" to whatever revision it managed to apply).
type GitOpsPlane ¶
type GitOpsPlane struct {
Installed bool `json:"installed"`
Reason string `json:"reason,omitempty"`
Applications []GitOpsApp `json:"applications"`
}
GitOpsPlane is the reply. `installed` is false — with an empty list and a reason — when the CD CRD is not served in this cluster. That is a FACT about the cluster, not a failure of this request, so the caller can say "no CD plane here" instead of rendering an error it cannot act on. A genuine transport or RBAC failure still errors (k8sErr).
type Node ¶
type Node struct {
ResourceRef
UID string `json:"uid,omitempty"`
CreatedAt string `json:"createdAt,omitempty"`
Health string `json:"health"`
HealthMessage string `json:"healthMessage,omitempty"`
Sync string `json:"sync,omitempty"`
Version string `json:"version,omitempty"` // image tag for a workload node
ParentRefs []ResourceRef `json:"parentRefs,omitempty"`
}
Node is one resource in the tree: its ref, ownerRef parents, and derived health/sync (+ image version for a workload). ArgoCD ResourceNode shape.
type PruneFuse ¶
type PruneFuse struct {
MaxDeletions int // absolute cap on objects pruned in one reconcile
MaxRatio float64 // cap as a fraction of the managed set (0..1)
}
PruneFuse bounds how much a single reconcile may delete — the circuit breaker against a silent empty/partial render sweeping the fleet. Both limits are checked; either one trips the fuse. Zero disables that check.
type ResourceRef ¶
type ResourceRef struct {
Group string `json:"group"`
Version string `json:"version"`
Kind string `json:"kind"`
Namespace string `json:"namespace"`
Name string `json:"name"`
Ref string `json:"ref"`
}
ResourceRef identifies one node — the round-trip token the resource endpoint parses. Ref is the canonical "group:kind:namespace:name" string.
Source Files