refactor: reorganize GitOps control plane

2026-07-25 23:55:31 +09:00
parent d507ac6ee9
commit 293ee6fc97
191 changed files with 7046 additions and 9034 deletions
@@ -0,0 +1,9 @@
+POSTGRES_SUPERUSER=postgres
+POSTGRES_DEFAULT_DB=postgres
+AUTH_DB_NAME=project_auth
+AUTH_DB_USER=project_auth
+KEYCLOAK_DB_NAME=keycloak
+KEYCLOAK_DB_USER=keycloak
+KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME=admin
+KEYCLOAK_CLIENT_ID=project-auth-server
+AUTH_SERVER_BASE_URL=http://auth-public.auth-dev.svc.cluster.local
@@ -0,0 +1,86 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: keycloak-client-sync
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
+        vault.hashicorp.com/agent-inject-perms-keycloak-sync-env: "0644"
+        vault.hashicorp.com/agent-inject-secret-keycloak-sync-env: kv/data/dev/platform/keycloak/bootstrap-admin
+        vault.hashicorp.com/agent-inject-template-keycloak-sync-env: |
+          {{ with secret "kv/data/dev/platform/keycloak/bootstrap-admin" }}
+          export KC_BOOTSTRAP_ADMIN_PASSWORD={{ printf "%q" .Data.data.KC_BOOTSTRAP_ADMIN_PASSWORD }}
+          {{ end }}
+
+          {{ with secret "kv/data/dev/platform/keycloak/client-auth-server" }}
+          export KEYCLOAK_CLIENT_SECRET={{ printf "%q" .Data.data.KEYCLOAK_CLIENT_SECRET }}
+          {{ end }}
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/role: keycloak-client-sync-dev
+    spec:
+      automountServiceAccountToken: false
+      volumes:
+        - name: vault-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  audience: vault
+                  expirationSeconds: 3600
+                  path: token
+      containers:
+        - name: keycloak-client-sync
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - |
+              . /vault/secrets/keycloak-sync-env
+              set -eu
+
+              ready=false
+              for _ in $(seq 1 60); do
+                if /opt/keycloak/bin/kcadm.sh config credentials \
+                  --server http://keycloak.platform.svc.cluster.local \
+                  --realm master \
+                  --user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
+                  --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" >/dev/null 2>&1; then
+                  ready=true
+                  break
+                fi
+                sleep 5
+              done
+              test "$ready" = true
+
+              CLIENT_UUID=$(/opt/keycloak/bin/kcadm.sh get clients \
+                -r project-auth \
+                -q clientId="$KEYCLOAK_CLIENT_ID" | sed -n 's/.*"id" : "\([^"]*\)".*/\1/p' | head -n 1)
+
+              test -n "$CLIENT_UUID"
+
+              /opt/keycloak/bin/kcadm.sh update "clients/${CLIENT_UUID}" \
+                -r project-auth \
+                -s "secret=$KEYCLOAK_CLIENT_SECRET" \
+                -s "baseUrl=$AUTH_SERVER_BASE_URL" \
+                -s 'redirectUris=["'"$AUTH_SERVER_BASE_URL"'/login/oauth2/code/keycloak-google","'"$AUTH_SERVER_BASE_URL"'/login/oauth2/code/keycloak-github"]' \
+                -s 'webOrigins=["'"$AUTH_SERVER_BASE_URL"'"]'
+          env:
+            - $patch: replace
+            - name: KC_BOOTSTRAP_ADMIN_USERNAME
+              valueFrom:
+                configMapKeyRef:
+                  name: platform-config
+                  key: KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME
+            - name: KEYCLOAK_CLIENT_ID
+              valueFrom:
+                configMapKeyRef:
+                  name: platform-config
+                  key: KEYCLOAK_CLIENT_ID
+            - name: AUTH_SERVER_BASE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: platform-config
+                  key: AUTH_SERVER_BASE_URL
@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keycloak
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: keycloak-public.platform.svc.cluster.local
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: keycloak
+                port:
+                  number: 80
@@ -0,0 +1,16 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keycloak
+spec:
+  template:
+    spec:
+      containers:
+        - name: keycloak
+          env:
+            - name: KC_HOSTNAME
+              value: keycloak-public.platform.svc.cluster.local
+            - name: KC_HOSTNAME_STRICT
+              value: "false"
+            - name: KC_PROXY_HEADERS
+              value: xforwarded
@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keycloak
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
+        vault.hashicorp.com/agent-inject-perms-keycloak-env: "0644"
+        vault.hashicorp.com/agent-inject-secret-keycloak-env: kv/data/dev/platform/postgres/keycloak
+        vault.hashicorp.com/agent-inject-template-keycloak-env: |
+          {{ with secret "kv/data/dev/platform/postgres/keycloak" }}
+          export KC_DB_PASSWORD={{ printf "%q" .Data.data.KEYCLOAK_DB_PASSWORD }}
+          {{ end }}
+
+          {{ with secret "kv/data/dev/platform/keycloak/bootstrap-admin" }}
+          export KC_BOOTSTRAP_ADMIN_PASSWORD={{ printf "%q" .Data.data.KC_BOOTSTRAP_ADMIN_PASSWORD }}
+          {{ end }}
+        vault.hashicorp.com/role: keycloak-dev
+    spec:
+      automountServiceAccountToken: false
+      volumes:
+        - name: vault-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  audience: vault
+                  expirationSeconds: 3600
+                  path: token
+      containers:
+        - name: keycloak
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - |
+              . /vault/secrets/keycloak-env
+              exec /opt/keycloak/bin/kc.sh start-dev --import-realm --http-port=8080
+          env:
+            - $patch: replace
+            - name: KC_DB
+              value: postgres
+            - name: KC_DB_URL
+              value: jdbc:postgresql://postgres.platform.svc.cluster.local:5432/keycloak
+            - name: KC_DB_USERNAME
+              valueFrom:
+                configMapKeyRef:
+                  name: platform-config
+                  key: KEYCLOAK_DB_USER
+            - name: KC_HEALTH_ENABLED
+              value: "true"
+            - name: KC_BOOTSTRAP_ADMIN_USERNAME
+              valueFrom:
+                configMapKeyRef:
+                  name: platform-config
+                  key: KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME
@@ -0,0 +1,26 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: platform
+
+resources:
+  - ../../../../platform/auth-system/base
+  - namespace.yaml
+  - keycloak-ingress.yaml
+  - public-access.yaml
+  - networkpolicy.yaml
+
+generatorOptions:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+
+configMapGenerator:
+  - name: platform-config
+    envs:
+      - config.env
+
+patches:
+  - path: postgres.vault-patch.yaml
+  - path: keycloak.vault-patch.yaml
+  - path: keycloak-client-sync.vault-patch.yaml
+  - path: keycloak.public-url-patch.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: platform
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+  labels:
+    vault-injection: enabled
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest
@@ -0,0 +1,161 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: platform-default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: platform-allow-dns-egress
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: platform-allow-vault-egress
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault
+          podSelector:
+            matchLabels:
+              app: vault
+      ports:
+        - protocol: TCP
+          port: 8200
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: platform-allow-keycloak-egress-to-postgres
+spec:
+  podSelector:
+    matchLabels:
+      app: keycloak
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app: postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: platform-allow-keycloak-client-sync-to-keycloak
+spec:
+  podSelector:
+    matchLabels:
+      app: keycloak-client-sync
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app: keycloak
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: platform-allow-keycloak-ingress
+spec:
+  podSelector:
+    matchLabels:
+      app: keycloak
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
+    - from:
+        - podSelector:
+            matchLabels:
+              app: keycloak-client-sync
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: platform-allow-postgres-ingress
+spec:
+  podSelector:
+    matchLabels:
+      app: postgres
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: auth-dev
+          podSelector:
+            matchExpressions:
+              - key: app
+                operator: In
+                values:
+                  - auth-server
+                  - auth-db-migration
+      ports:
+        - protocol: TCP
+          port: 5432
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault
+          podSelector:
+            matchLabels:
+              app: vault
+      ports:
+        - protocol: TCP
+          port: 5432
+    - from:
+        - podSelector:
+            matchLabels:
+              app: keycloak
+      ports:
+        - protocol: TCP
+          port: 5432
@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
+        vault.hashicorp.com/agent-inject-perms-postgres-env: "0644"
+        vault.hashicorp.com/agent-inject-secret-postgres-env: kv/data/dev/platform/postgres/superuser
+        vault.hashicorp.com/agent-inject-template-postgres-env: |
+          {{ with secret "kv/data/dev/platform/postgres/superuser" }}
+          export POSTGRES_PASSWORD={{ printf "%q" .Data.data.POSTGRES_SUPERUSER_PASSWORD }}
+          {{ end }}
+
+          {{ with secret "kv/data/dev/platform/postgres/auth-server" }}
+          export AUTH_DB_PASSWORD={{ printf "%q" .Data.data.AUTH_DB_PASSWORD }}
+          {{ end }}
+
+          {{ with secret "kv/data/dev/platform/postgres/keycloak" }}
+          export KEYCLOAK_DB_PASSWORD={{ printf "%q" .Data.data.KEYCLOAK_DB_PASSWORD }}
+          {{ end }}
+        vault.hashicorp.com/role: postgres-dev
+    spec:
+      automountServiceAccountToken: false
+      volumes:
+        - name: vault-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  audience: vault
+                  expirationSeconds: 3600
+                  path: token
+      containers:
+        - name: postgres
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - |
+              . /vault/secrets/postgres-env
+              exec docker-entrypoint.sh postgres
+          env:
+            - $patch: replace
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+            - name: POSTGRES_USER
+              valueFrom:
+                configMapKeyRef:
+                  name: platform-config
+                  key: POSTGRES_SUPERUSER
+            - name: POSTGRES_DB
+              valueFrom:
+                configMapKeyRef:
+                  name: platform-config
+                  key: POSTGRES_DEFAULT_DB
+            - name: AUTH_DB_NAME
+              valueFrom:
+                configMapKeyRef:
+                  name: platform-config
+                  key: AUTH_DB_NAME
+            - name: AUTH_DB_USER
+              valueFrom:
+                configMapKeyRef:
+                  name: platform-config
+                  key: AUTH_DB_USER
+            - name: KEYCLOAK_DB_NAME
+              valueFrom:
+                configMapKeyRef:
+                  name: platform-config
+                  key: KEYCLOAK_DB_NAME
+            - name: KEYCLOAK_DB_USER
+              valueFrom:
+                configMapKeyRef:
+                  name: platform-config
+                  key: KEYCLOAK_DB_USER
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak-public
+spec:
+  type: ExternalName
+  externalName: traefik.kube-system.svc.cluster.local
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80