Add platform infrastructure configuration

2026-08-28 17:35:41 +09:00
parent fa76531e5b
commit 16c337bcc9
302 changed files with 83259 additions and 1 deletions
@@ -0,0 +1,7 @@
+# 기본 확장 지점
+
+공통 ObjectStore Helm baseline은 base/deployment에 있다. 저장소, resource,
+ClusterIP와 root 비상 계정 경계만 이 계층이 소유한다.
+
+OIDC 환경 변수와 Console Ingress는 profiles/admin-oidc에서만 추가한다.
+Chart 템플릿을 저장소에 복제하거나 직접 수정하지 않는다.
@@ -0,0 +1,6 @@
+# AIStor ObjectStore baseline
+
+AIStor ObjectStore의 공통 Helm baseline입니다. 저장소, root 비상 계정,
+리소스 제한과 ClusterIP 경계만 정의합니다.
+
+Console Ingress와 Keycloak OIDC는 profiles/admin-oidc에서만 추가합니다.
@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: object-storage
+
+helmGlobals:
+  chartHome: .helm/charts
+
+helmCharts:
+  - name: aistor-objectstore
+    repo: https://helm.min.io/
+    version: 1.0.16
+    releaseName: minio-aistor
+    namespace: object-storage
+    valuesFile: values/home.yaml
+    includeCRDs: false
+    skipTests: true
@@ -0,0 +1,67 @@
+secrets:
+  name: aistor-root-configuration
+  existingSecret: true
+  disableRoot: false
+
+objectStore:
+  name: minio-aistor
+
+  configuration:
+    name: aistor-root-configuration
+
+  pools:
+    - name: pool-0
+      servers: 1
+      volumesPerServer: 1
+      storageNamePrefix: data
+      size: 900Gi
+      storageClassName: aistor-local-xfs-retain
+      nodeSelector:
+        kubernetes.io/hostname: donghyeon-system-product-name
+      resources:
+        requests:
+          cpu: 500m
+          memory: 2Gi
+        limits:
+          cpu: "3"
+          memory: 8Gi
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+      containerSecurityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+        seccompProfile:
+          type: RuntimeDefault
+
+  mountPath: /export
+  subPath: /data
+
+  certificates:
+    disableAutoCert: true
+
+  services:
+    minio:
+      serviceType: ClusterIP
+    console:
+      serviceType: ClusterIP
+
+  pvcProtection: true
+  prometheusOperator: false
+
+  sideCars:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 128Mi
+      limits:
+        cpu: 500m
+        memory: 512Mi