donghyeon.kang/project-gitops
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor(gitops): establish platform ownership boundaries

Browse Source
This commit is contained in:
donghyeon-ka
2026-07-26 01:34:29 +09:00
parent 293ee6fc97
commit a6f6c663e0
121 changed files with 2801 additions and 1204 deletions
Download Patch File Download Diff File Expand all files Collapse all files
clusters/dev-k3s/README.md
+32
View File
@@ -0,0 +1,32 @@
# dev-k3s cluster profile
`dev-k3s`는 이 reference lab이 현재 지원하는 유일한 cluster profile입니다.
ApplicationSet의 `server`는 in-cluster API
`https://kubernetes.default.svc`를 사용합니다.
이 디렉터리는 base 복사본이 아니라 다음 cluster-specific composition만
소유합니다.
- `platform/vault`: dev Vault namespace, NetworkPolicy와 single-node profile
- `systems/auth-system`: `auth-system-dev` namespace, internal/public host,
Vault injection path와 system NetworkPolicy
- `workloads/*`: dev namespace, image reference, ingress, pull
SealedSecret과 workload NetworkPolicy
현재 Vault NetworkPolicy의 Kubernetes API CIDR와 node address는
`dev-k3s`에 종속됩니다. 다른 클러스터에 그대로 복사하지 말고 해당
클러스터의 service/node network를 확인해야 합니다.
두 번째 클러스터를 추가할 때는 다음 순서를 사용합니다.
1. 실제 차이가 있는 overlay만 `clusters/<cluster>/overlays`에 추가합니다.
2. Argo CD cluster credential을 Git 밖에서 등록합니다.
3. 각 AppProject destination에 정확한 API server/namespace를 추가합니다.
4. 권한별 ApplicationSet inventory에 `autoSync: "false"` element를
추가합니다.
5. Render, live diff와 외부 prerequisite를 검증한 단계별 PR로 gate를
엽니다.
Production은 이 profile의 이름 변경이나 복사로 만들지 않습니다. TLS,
availability, secret authority, storage/backup, approval과 recovery
contract를 먼저 별도 설계해야 합니다.
clusters/dev-k3s/applications/foundation/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- sealed-secrets.yaml
- vault.yaml
- vault-agent-injector.yaml
clusters/dev-k3s/applications/foundation/sealed-secrets.yaml
-49
View File
@@ -1,49 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: sealed-secrets-dev
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
project: cluster-addons-dev
source:
repoURL: https://bitnami.github.io/sealed-secrets
chart: sealed-secrets
targetRevision: 2.17.9
helm:
values: |
fullnameOverride: sealed-secrets-controller
keyrenewperiod: 720h
image:
repository: bitnami/sealed-secrets-controller
tag: "0.33.1@sha256:e7fad65c2d2f47e48d9ca17408ed56961bfa6a6dd74ccd4a1a214664156534bc"
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
cpu: 250m
memory: 256Mi
destination:
server: https://kubernetes.default.svc
namespace: kube-system
syncPolicy:
automated:
enabled: true
prune: true
selfHeal: true
syncOptions:
- PruneLast=true
- FailOnSharedResource=true
retry:
limit: 5
refresh: true
backoff:
duration: 5s
factor: 2
maxDuration: 3m
revisionHistoryLimit: 5
clusters/dev-k3s/applications/foundation/vault-agent-injector.yaml
-63
View File
@@ -1,63 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: vault-agent-injector-dev
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "2"
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
project: cluster-addons-dev
source:
repoURL: https://helm.releases.hashicorp.com
chart: vault
targetRevision: 0.32.0
helm:
values: |
global:
externalVaultAddr: http://vault.vault.svc.cluster.local:8200
tlsDisable: true
server:
enabled: false
injector:
enabled: true
authPath: auth/kubernetes
image:
repository: hashicorp/vault-k8s
tag: "1.7.2@sha256:ae3d307658b72a1cf35dab9bdf92c995d45cdc7183af0516857714b5bd0ba84d"
webhook:
failurePolicy: Fail
namespaceSelector:
matchLabels:
vault-injection: enabled
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 250m
memory: 256Mi
agentImage:
repository: hashicorp/vault
tag: "1.18.5@sha256:750bb37c1638fa194ab37053a81618c61bb0491ddec6fccac87c07a8e6cd8166"
destination:
server: https://kubernetes.default.svc
namespace: vault
syncPolicy:
automated:
enabled: true
prune: true
selfHeal: true
syncOptions:
- PruneLast=true
- FailOnSharedResource=true
retry:
limit: 5
refresh: true
backoff:
duration: 5s
factor: 2
maxDuration: 3m
revisionHistoryLimit: 5
clusters/dev-k3s/applications/foundation/vault.yaml
-34
View File
@@ -1,34 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: vault-dev
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
spec:
project: platform-dev
source:
repoURL: https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
targetRevision: main
path: clusters/dev-k3s/manifests/vault
destination:
server: https://kubernetes.default.svc
namespace: vault
syncPolicy:
automated:
enabled: true
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- PruneLast=true
- FailOnSharedResource=true
retry:
limit: 5
refresh: true
backoff:
duration: 5s
factor: 2
maxDuration: 3m
revisionHistoryLimit: 5
clusters/dev-k3s/applications/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- foundation
- platform
- workloads
clusters/dev-k3s/applications/platform/auth-system.yaml
-34
View File
@@ -1,34 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: platform-dev
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "10"
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
spec:
project: platform-dev
source:
repoURL: https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
targetRevision: main
path: clusters/dev-k3s/manifests/auth-system
destination:
server: https://kubernetes.default.svc
namespace: platform
syncPolicy:
automated:
enabled: true
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- PruneLast=true
- FailOnSharedResource=true
retry:
limit: 5
refresh: true
backoff:
duration: 5s
factor: 2
maxDuration: 3m
revisionHistoryLimit: 5
clusters/dev-k3s/applications/platform/kustomization.yaml
-5
View File
@@ -1,5 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- auth-system.yaml
clusters/dev-k3s/applications/workloads/api-server.yaml
-36
View File
@@ -1,36 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: api-server-dev
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "20"
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
project: apps-dev
source:
repoURL: https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
targetRevision: main
path: clusters/dev-k3s/manifests/api-server
destination:
server: https://kubernetes.default.svc
namespace: api-dev
syncPolicy:
automated:
enabled: true
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- PruneLast=true
- FailOnSharedResource=true
retry:
limit: 5
refresh: true
backoff:
duration: 5s
factor: 2
maxDuration: 3m
revisionHistoryLimit: 5
clusters/dev-k3s/applications/workloads/auth-server.yaml
-36
View File
@@ -1,36 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: auth-server-dev
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "20"
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
project: apps-dev
source:
repoURL: https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
targetRevision: main
path: clusters/dev-k3s/manifests/auth-server
destination:
server: https://kubernetes.default.svc
namespace: auth-dev
syncPolicy:
automated:
enabled: true
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
- PruneLast=true
- FailOnSharedResource=true
retry:
limit: 5
refresh: true
backoff:
duration: 5s
factor: 2
maxDuration: 3m
revisionHistoryLimit: 5
clusters/dev-k3s/applications/workloads/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- auth-server.yaml
- api-server.yaml
clusters/dev-k3s/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- projects
- applications
clusters/dev-k3s/manifests/vault/kustomization.yaml → clusters/dev-k3s/overlays/platform/vault/kustomization.yaml
+1 -1
View File
@@ -4,6 +4,6 @@ kind: Kustomization
namespace: vault
resources:
- ../../../../platform/security/vault/base
- ../../../../../platform/shared-services/vault/base
- namespace.yaml
- networkpolicy.yaml
clusters/dev-k3s/manifests/vault/namespace.yaml → clusters/dev-k3s/overlays/platform/vault/namespace.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ kind: Namespace
metadata:
name: vault
annotations:
argocd.argoproj.io/sync-options: Prune=false
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
labels:
pod-security.kubernetes.io/enforce: baseline
pod-security.kubernetes.io/enforce-version: latest
clusters/dev-k3s/manifests/vault/networkpolicy.yaml → clusters/dev-k3s/overlays/platform/vault/networkpolicy.yaml
+2 -2
View File
@@ -48,7 +48,7 @@ spec:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: platform
kubernetes.io/metadata.name: auth-system-dev
podSelector:
matchLabels:
app: postgres
@@ -97,7 +97,7 @@ spec:
kubernetes.io/metadata.name: auth-dev
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: platform
kubernetes.io/metadata.name: auth-system-dev
ports:
- protocol: TCP
port: 8200
clusters/dev-k3s/manifests/auth-system/config.env → clusters/dev-k3s/overlays/systems/auth-system/config.env
View File
clusters/dev-k3s/manifests/auth-system/keycloak-client-sync.vault-patch.yaml → clusters/dev-k3s/overlays/systems/auth-system/keycloak-client-sync.vault-patch.yaml
+7 -7
View File
@@ -9,13 +9,13 @@ spec:
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
vault.hashicorp.com/agent-inject-perms-keycloak-sync-env: "0644"
vault.hashicorp.com/agent-inject-secret-keycloak-sync-env: kv/data/dev/platform/keycloak/bootstrap-admin
vault.hashicorp.com/agent-inject-secret-keycloak-sync-env: kv/data/dev/systems/auth-system/keycloak/bootstrap-admin
vault.hashicorp.com/agent-inject-template-keycloak-sync-env: |
{{ with secret "kv/data/dev/platform/keycloak/bootstrap-admin" }}
{{ with secret "kv/data/dev/systems/auth-system/keycloak/bootstrap-admin" }}
export KC_BOOTSTRAP_ADMIN_PASSWORD={{ printf "%q" .Data.data.KC_BOOTSTRAP_ADMIN_PASSWORD }}
{{ end }}
{{ with secret "kv/data/dev/platform/keycloak/client-auth-server" }}
{{ with secret "kv/data/dev/workloads/auth-server/keycloak-client" }}
export KEYCLOAK_CLIENT_SECRET={{ printf "%q" .Data.data.KEYCLOAK_CLIENT_SECRET }}
{{ end }}
vault.hashicorp.com/agent-pre-populate-only: "true"
@@ -44,7 +44,7 @@ spec:
ready=false
for _ in $(seq 1 60); do
if /opt/keycloak/bin/kcadm.sh config credentials \
--server http://keycloak.platform.svc.cluster.local \
--server http://keycloak \
--realm master \
--user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
--password "$KC_BOOTSTRAP_ADMIN_PASSWORD" >/dev/null 2>&1; then
@@ -72,15 +72,15 @@ spec:
- name: KC_BOOTSTRAP_ADMIN_USERNAME
valueFrom:
configMapKeyRef:
name: platform-config
name: auth-system-config
key: KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME
- name: KEYCLOAK_CLIENT_ID
valueFrom:
configMapKeyRef:
name: platform-config
name: auth-system-config
key: KEYCLOAK_CLIENT_ID
- name: AUTH_SERVER_BASE_URL
valueFrom:
configMapKeyRef:
name: platform-config
name: auth-system-config
key: AUTH_SERVER_BASE_URL
clusters/dev-k3s/manifests/auth-system/keycloak-ingress.yaml → clusters/dev-k3s/overlays/systems/auth-system/keycloak-ingress.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ metadata:
spec:
ingressClassName: traefik
rules:
- host: keycloak-public.platform.svc.cluster.local
- host: keycloak-public.auth-system-dev.svc.cluster.local
http:
paths:
- path: /
clusters/dev-k3s/manifests/auth-system/keycloak.public-url-patch.yaml → clusters/dev-k3s/overlays/systems/auth-system/keycloak.public-url-patch.yaml
+1 -1
View File
@@ -9,7 +9,7 @@ spec:
- name: keycloak
env:
- name: KC_HOSTNAME
value: keycloak-public.platform.svc.cluster.local
value: keycloak-public.auth-system-dev.svc.cluster.local
- name: KC_HOSTNAME_STRICT
value: "false"
- name: KC_PROXY_HEADERS
clusters/dev-k3s/manifests/auth-system/keycloak.vault-patch.yaml → clusters/dev-k3s/overlays/systems/auth-system/keycloak.vault-patch.yaml
+6 -6
View File
@@ -9,13 +9,13 @@ spec:
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
vault.hashicorp.com/agent-inject-perms-keycloak-env: "0644"
vault.hashicorp.com/agent-inject-secret-keycloak-env: kv/data/dev/platform/postgres/keycloak
vault.hashicorp.com/agent-inject-secret-keycloak-env: kv/data/dev/systems/auth-system/postgres/keycloak
vault.hashicorp.com/agent-inject-template-keycloak-env: |
{{ with secret "kv/data/dev/platform/postgres/keycloak" }}
{{ with secret "kv/data/dev/systems/auth-system/postgres/keycloak" }}
export KC_DB_PASSWORD={{ printf "%q" .Data.data.KEYCLOAK_DB_PASSWORD }}
{{ end }}
{{ with secret "kv/data/dev/platform/keycloak/bootstrap-admin" }}
{{ with secret "kv/data/dev/systems/auth-system/keycloak/bootstrap-admin" }}
export KC_BOOTSTRAP_ADMIN_PASSWORD={{ printf "%q" .Data.data.KC_BOOTSTRAP_ADMIN_PASSWORD }}
{{ end }}
vault.hashicorp.com/role: keycloak-dev
@@ -44,16 +44,16 @@ spec:
- name: KC_DB
value: postgres
- name: KC_DB_URL
value: jdbc:postgresql://postgres.platform.svc.cluster.local:5432/keycloak
value: jdbc:postgresql://postgres:5432/keycloak
- name: KC_DB_USERNAME
valueFrom:
configMapKeyRef:
name: platform-config
name: auth-system-config
key: KEYCLOAK_DB_USER
- name: KC_HEALTH_ENABLED
value: "true"
- name: KC_BOOTSTRAP_ADMIN_USERNAME
valueFrom:
configMapKeyRef:
name: platform-config
name: auth-system-config
key: KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME
clusters/dev-k3s/manifests/auth-system/kustomization.yaml → clusters/dev-k3s/overlays/systems/auth-system/kustomization.yaml
+3 -3
View File
@@ -1,10 +1,10 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: platform
namespace: auth-system-dev
resources:
- ../../../../platform/auth-system/base
- ../../../../../systems/auth-system/base
- namespace.yaml
- keycloak-ingress.yaml
- public-access.yaml
@@ -15,7 +15,7 @@ generatorOptions:
argocd.argoproj.io/sync-wave: "0"
configMapGenerator:
- name: platform-config
- name: auth-system-config
envs:
- config.env
clusters/dev-k3s/manifests/auth-system/namespace.yaml → clusters/dev-k3s/overlays/systems/auth-system/namespace.yaml
+2 -2
View File
@@ -1,9 +1,9 @@
apiVersion: v1
kind: Namespace
metadata:
name: platform
name: auth-system-dev
annotations:
argocd.argoproj.io/sync-options: Prune=false
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
labels:
vault-injection: enabled
pod-security.kubernetes.io/enforce: baseline
clusters/dev-k3s/manifests/auth-system/networkpolicy.yaml → clusters/dev-k3s/overlays/systems/auth-system/networkpolicy.yaml
+7 -7
View File
@@ -1,7 +1,7 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: platform-default-deny
name: auth-system-default-deny
spec:
podSelector: {}
policyTypes:
@@ -11,7 +11,7 @@ spec:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: platform-allow-dns-egress
name: auth-system-allow-dns-egress
spec:
podSelector: {}
policyTypes:
@@ -33,7 +33,7 @@ spec:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: platform-allow-vault-egress
name: auth-system-allow-vault-egress
spec:
podSelector: {}
policyTypes:
@@ -53,7 +53,7 @@ spec:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: platform-allow-keycloak-egress-to-postgres
name: auth-system-allow-keycloak-egress-to-postgres
spec:
podSelector:
matchLabels:
@@ -72,7 +72,7 @@ spec:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: platform-allow-keycloak-client-sync-to-keycloak
name: auth-system-allow-keycloak-client-sync-to-keycloak
spec:
podSelector:
matchLabels:
@@ -91,7 +91,7 @@ spec:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: platform-allow-keycloak-ingress
name: auth-system-allow-keycloak-ingress
spec:
podSelector:
matchLabels:
@@ -120,7 +120,7 @@ spec:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: platform-allow-postgres-ingress
name: auth-system-allow-postgres-ingress
spec:
podSelector:
matchLabels:
clusters/dev-k3s/manifests/auth-system/postgres.vault-patch.yaml → clusters/dev-k3s/overlays/systems/auth-system/postgres.vault-patch.yaml
+10 -10
View File
@@ -9,17 +9,17 @@ spec:
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
vault.hashicorp.com/agent-inject-perms-postgres-env: "0644"
vault.hashicorp.com/agent-inject-secret-postgres-env: kv/data/dev/platform/postgres/superuser
vault.hashicorp.com/agent-inject-secret-postgres-env: kv/data/dev/systems/auth-system/postgres/superuser
vault.hashicorp.com/agent-inject-template-postgres-env: |
{{ with secret "kv/data/dev/platform/postgres/superuser" }}
{{ with secret "kv/data/dev/systems/auth-system/postgres/superuser" }}
export POSTGRES_PASSWORD={{ printf "%q" .Data.data.POSTGRES_SUPERUSER_PASSWORD }}
{{ end }}
{{ with secret "kv/data/dev/platform/postgres/auth-server" }}
{{ with secret "kv/data/dev/systems/auth-system/postgres/auth-server" }}
export AUTH_DB_PASSWORD={{ printf "%q" .Data.data.AUTH_DB_PASSWORD }}
{{ end }}
{{ with secret "kv/data/dev/platform/postgres/keycloak" }}
{{ with secret "kv/data/dev/systems/auth-system/postgres/keycloak" }}
export KEYCLOAK_DB_PASSWORD={{ printf "%q" .Data.data.KEYCLOAK_DB_PASSWORD }}
{{ end }}
vault.hashicorp.com/role: postgres-dev
@@ -50,30 +50,30 @@ spec:
- name: POSTGRES_USER
valueFrom:
configMapKeyRef:
name: platform-config
name: auth-system-config
key: POSTGRES_SUPERUSER
- name: POSTGRES_DB
valueFrom:
configMapKeyRef:
name: platform-config
name: auth-system-config
key: POSTGRES_DEFAULT_DB
- name: AUTH_DB_NAME
valueFrom:
configMapKeyRef:
name: platform-config
name: auth-system-config
key: AUTH_DB_NAME
- name: AUTH_DB_USER
valueFrom:
configMapKeyRef:
name: platform-config
name: auth-system-config
key: AUTH_DB_USER
- name: KEYCLOAK_DB_NAME
valueFrom:
configMapKeyRef:
name: platform-config
name: auth-system-config
key: KEYCLOAK_DB_NAME
- name: KEYCLOAK_DB_USER
valueFrom:
configMapKeyRef:
name: platform-config
name: auth-system-config
key: KEYCLOAK_DB_USER
clusters/dev-k3s/manifests/auth-system/public-access.yaml → clusters/dev-k3s/overlays/systems/auth-system/public-access.yaml
View File
clusters/dev-k3s/manifests/api-server/config.env → clusters/dev-k3s/overlays/workloads/api-server/config.env
View File
clusters/dev-k3s/manifests/api-server/ghcr-regcred.sealedsecret.yaml → clusters/dev-k3s/overlays/workloads/api-server/ghcr-regcred.sealedsecret.yaml
View File
clusters/dev-k3s/manifests/api-server/ingress.yaml → clusters/dev-k3s/overlays/workloads/api-server/ingress.yaml
View File
clusters/dev-k3s/manifests/api-server/kustomization.yaml → clusters/dev-k3s/overlays/workloads/api-server/kustomization.yaml
+1 -1
View File
@@ -4,7 +4,7 @@ kind: Kustomization
namespace: api-dev
resources:
- ../../../../workloads/api-server/base
- ../../../../../workloads/api-server/base
- namespace.yaml
- ingress.yaml
- public-access.yaml
clusters/dev-k3s/manifests/api-server/namespace.yaml → clusters/dev-k3s/overlays/workloads/api-server/namespace.yaml
+2
View File
@@ -2,6 +2,8 @@ apiVersion: v1
kind: Namespace
metadata:
name: api-dev
annotations:
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
labels:
pod-security.kubernetes.io/enforce: baseline
pod-security.kubernetes.io/enforce-version: latest
clusters/dev-k3s/manifests/api-server/networkpolicy.yaml → clusters/dev-k3s/overlays/workloads/api-server/networkpolicy.yaml
View File
clusters/dev-k3s/manifests/api-server/public-access.yaml → clusters/dev-k3s/overlays/workloads/api-server/public-access.yaml
View File
clusters/dev-k3s/manifests/auth-server/config.env → clusters/dev-k3s/overlays/workloads/auth-server/config.env
+2 -2
View File
@@ -3,9 +3,9 @@ SERVER_FORWARD_HEADERS_STRATEGY=framework
APP_DOCS_TITLE=Project Auth Server API
APP_DOCS_DESCRIPTION=dev auth-server OpenAPI
APP_DOCS_VERSION=v1
APP_DATASOURCE_URL=jdbc:postgresql://postgres.platform.svc.cluster.local:5432/project_auth
APP_DATASOURCE_URL=jdbc:postgresql://postgres.auth-system-dev.svc.cluster.local:5432/project_auth
APP_PERSISTENCE_MIGRATION_RUN_ON_STARTUP=false
APP_SECURITY_OAUTH2_KEYCLOAK_ISSUER_URI=http://keycloak-public.platform.svc.cluster.local/realms/project-auth
APP_SECURITY_OAUTH2_KEYCLOAK_ISSUER_URI=http://keycloak-public.auth-system-dev.svc.cluster.local/realms/project-auth
APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_ID=project-auth-server
APP_SECURITY_OAUTH2_GOOGLE_REGISTRATION_ID=keycloak-google
APP_SECURITY_OAUTH2_GOOGLE_IDP_HINT=google
clusters/dev-k3s/manifests/auth-server/db-migration-job.vault-patch.yaml → clusters/dev-k3s/overlays/workloads/auth-server/db-migration-job.vault-patch.yaml
View File
clusters/dev-k3s/manifests/auth-server/deployment.vault-patch.yaml → clusters/dev-k3s/overlays/workloads/auth-server/deployment.vault-patch.yaml
+3 -3
View File
@@ -9,14 +9,14 @@ spec:
vault.hashicorp.com/agent-cache-enable: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
vault.hashicorp.com/agent-inject-secret-runtime-env: kv/data/dev/platform/postgres/auth-server
vault.hashicorp.com/agent-inject-secret-runtime-env: kv/data/dev/systems/auth-system/postgres/auth-server
vault.hashicorp.com/agent-inject-template-runtime-env: |
{{ with secret "kv/data/dev/platform/postgres/auth-server" }}
{{ with secret "kv/data/dev/systems/auth-system/postgres/auth-server" }}
export APP_DATASOURCE_USERNAME={{ printf "%q" .Data.data.APP_DATASOURCE_USERNAME }}
export APP_DATASOURCE_PASSWORD={{ printf "%q" .Data.data.APP_DATASOURCE_PASSWORD }}
{{ end }}
{{ with secret "kv/data/dev/platform/keycloak/client-auth-server" }}
{{ with secret "kv/data/dev/workloads/auth-server/keycloak-client" }}
export APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET={{ printf "%q" .Data.data.APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET }}
{{ end }}
vault.hashicorp.com/agent-inject-token: "true"
clusters/dev-k3s/manifests/auth-server/ghcr-regcred.sealedsecret.yaml → clusters/dev-k3s/overlays/workloads/auth-server/ghcr-regcred.sealedsecret.yaml
View File
clusters/dev-k3s/manifests/auth-server/ingress.yaml → clusters/dev-k3s/overlays/workloads/auth-server/ingress.yaml
View File
clusters/dev-k3s/manifests/auth-server/kustomization.yaml → clusters/dev-k3s/overlays/workloads/auth-server/kustomization.yaml
+1 -1
View File
@@ -4,7 +4,7 @@ kind: Kustomization
namespace: auth-dev
resources:
- ../../../../workloads/auth-server/base
- ../../../../../workloads/auth-server/base
- namespace.yaml
- ingress.yaml
- public-access.yaml
clusters/dev-k3s/manifests/auth-server/namespace.yaml → clusters/dev-k3s/overlays/workloads/auth-server/namespace.yaml
+2
View File
@@ -2,6 +2,8 @@ apiVersion: v1
kind: Namespace
metadata:
name: auth-dev
annotations:
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
labels:
vault-injection: enabled
pod-security.kubernetes.io/enforce: baseline
clusters/dev-k3s/manifests/auth-server/networkpolicy.yaml → clusters/dev-k3s/overlays/workloads/auth-server/networkpolicy.yaml
+2 -2
View File
@@ -33,7 +33,7 @@ spec:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: auth-dev-allow-platform-and-vault-egress
name: auth-dev-allow-auth-system-and-vault-egress
spec:
podSelector: {}
policyTypes:
@@ -42,7 +42,7 @@ spec:
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: platform
kubernetes.io/metadata.name: auth-system-dev
podSelector:
matchLabels:
app: postgres
clusters/dev-k3s/manifests/auth-server/public-access.yaml → clusters/dev-k3s/overlays/workloads/auth-server/public-access.yaml
View File
clusters/dev-k3s/projects/apps.yaml
-41
View File
@@ -1,41 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: apps-dev
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "-10"
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
description: Dev application workloads managed by Argo CD
sourceRepos:
- https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
destinations:
- namespace: auth-dev
server: https://kubernetes.default.svc
- namespace: api-dev
server: https://kubernetes.default.svc
clusterResourceWhitelist:
- group: ""
kind: Namespace
namespaceResourceWhitelist:
- group: ""
kind: ConfigMap
- group: ""
kind: Service
- group: ""
kind: ServiceAccount
- group: "bitnami.com"
kind: SealedSecret
- group: "apps"
kind: Deployment
- group: "batch"
kind: Job
- group: "networking.k8s.io"
kind: Ingress
- group: "networking.k8s.io"
kind: NetworkPolicy
orphanedResources:
warn: true
clusters/dev-k3s/projects/cluster-addons.yaml
-48
View File
@@ -1,48 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: cluster-addons-dev
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "-10"
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
description: Cluster-scoped controllers required by the dev GitOps stack
sourceRepos:
- https://bitnami.github.io/sealed-secrets
- https://helm.releases.hashicorp.com
destinations:
- namespace: kube-system
server: https://kubernetes.default.svc
- namespace: vault
server: https://kubernetes.default.svc
clusterResourceWhitelist:
- group: ""
kind: Namespace
- group: apiextensions.k8s.io
kind: CustomResourceDefinition
- group: rbac.authorization.k8s.io
kind: ClusterRole
- group: rbac.authorization.k8s.io
kind: ClusterRoleBinding
- group: admissionregistration.k8s.io
kind: MutatingWebhookConfiguration
namespaceResourceWhitelist:
- group: ""
kind: ConfigMap
- group: ""
kind: Secret
- group: ""
kind: Service
- group: ""
kind: ServiceAccount
- group: apps
kind: Deployment
- group: rbac.authorization.k8s.io
kind: Role
- group: rbac.authorization.k8s.io
kind: RoleBinding
orphanedResources:
warn: true
clusters/dev-k3s/projects/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- apps.yaml
- cluster-addons.yaml
- platform.yaml
clusters/dev-k3s/projects/platform.yaml
-51
View File
@@ -1,51 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: platform-dev
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "-10"
argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
description: Dev shared infrastructure managed by Argo CD
sourceRepos:
- https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
destinations:
- namespace: platform
server: https://kubernetes.default.svc
- namespace: vault
server: https://kubernetes.default.svc
clusterResourceWhitelist:
- group: ""
kind: Namespace
- group: "rbac.authorization.k8s.io"
kind: ClusterRole
- group: "rbac.authorization.k8s.io"
kind: ClusterRoleBinding
namespaceResourceWhitelist:
- group: ""
kind: ConfigMap
- group: ""
kind: Service
- group: ""
kind: ServiceAccount
- group: ""
kind: PersistentVolumeClaim
- group: "rbac.authorization.k8s.io"
kind: Role
- group: "rbac.authorization.k8s.io"
kind: RoleBinding
- group: "apps"
kind: Deployment
- group: "apps"
kind: StatefulSet
- group: "batch"
kind: Job
- group: "networking.k8s.io"
kind: Ingress
- group: "networking.k8s.io"
kind: NetworkPolicy
orphanedResources:
warn: true