refactor(gitops): establish platform ownership boundaries

2026-07-26 01:34:29 +09:00
parent 293ee6fc97
commit a6f6c663e0
121 changed files with 2801 additions and 1204 deletions
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: vault
+
+resources:
+  - ../../../../../platform/shared-services/vault/base
+  - namespace.yaml
+  - networkpolicy.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vault
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest
@@ -0,0 +1,118 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: vault-server-default-deny
+spec:
+  podSelector:
+    matchLabels:
+      app: vault
+  policyTypes:
+    - Ingress
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: vault-server-allow-dns-egress
+spec:
+  podSelector:
+    matchLabels:
+      app: vault
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: vault-server-allow-postgres-egress
+spec:
+  podSelector:
+    matchLabels:
+      app: vault
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: auth-system-dev
+          podSelector:
+            matchLabels:
+              app: postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: vault-server-allow-kubernetes-api-egress
+spec:
+  podSelector:
+    matchLabels:
+      app: vault
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 10.43.0.1/32
+      ports:
+        - protocol: TCP
+          port: 443
+    - to:
+        - ipBlock:
+            cidr: 10.208.141.98/32
+      ports:
+        - protocol: TCP
+          port: 6443
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: vault-server-allow-ingress-from-workloads
+spec:
+  podSelector:
+    matchLabels:
+      app: vault
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: auth-dev
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: auth-system-dev
+      ports:
+        - protocol: TCP
+          port: 8200
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: vault-agent-injector-webhook-ingress
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: vault-agent-injector
+  policyTypes:
+    - Ingress
+  ingress:
+    - ports:
+        - protocol: TCP
+          port: 8080
@@ -0,0 +1,9 @@
+POSTGRES_SUPERUSER=postgres
+POSTGRES_DEFAULT_DB=postgres
+AUTH_DB_NAME=project_auth
+AUTH_DB_USER=project_auth
+KEYCLOAK_DB_NAME=keycloak
+KEYCLOAK_DB_USER=keycloak
+KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME=admin
+KEYCLOAK_CLIENT_ID=project-auth-server
+AUTH_SERVER_BASE_URL=http://auth-public.auth-dev.svc.cluster.local
@@ -0,0 +1,86 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: keycloak-client-sync
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
+        vault.hashicorp.com/agent-inject-perms-keycloak-sync-env: "0644"
+        vault.hashicorp.com/agent-inject-secret-keycloak-sync-env: kv/data/dev/systems/auth-system/keycloak/bootstrap-admin
+        vault.hashicorp.com/agent-inject-template-keycloak-sync-env: |
+          {{ with secret "kv/data/dev/systems/auth-system/keycloak/bootstrap-admin" }}
+          export KC_BOOTSTRAP_ADMIN_PASSWORD={{ printf "%q" .Data.data.KC_BOOTSTRAP_ADMIN_PASSWORD }}
+          {{ end }}
+
+          {{ with secret "kv/data/dev/workloads/auth-server/keycloak-client" }}
+          export KEYCLOAK_CLIENT_SECRET={{ printf "%q" .Data.data.KEYCLOAK_CLIENT_SECRET }}
+          {{ end }}
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/role: keycloak-client-sync-dev
+    spec:
+      automountServiceAccountToken: false
+      volumes:
+        - name: vault-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  audience: vault
+                  expirationSeconds: 3600
+                  path: token
+      containers:
+        - name: keycloak-client-sync
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - |
+              . /vault/secrets/keycloak-sync-env
+              set -eu
+
+              ready=false
+              for _ in $(seq 1 60); do
+                if /opt/keycloak/bin/kcadm.sh config credentials \
+                  --server http://keycloak \
+                  --realm master \
+                  --user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
+                  --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" >/dev/null 2>&1; then
+                  ready=true
+                  break
+                fi
+                sleep 5
+              done
+              test "$ready" = true
+
+              CLIENT_UUID=$(/opt/keycloak/bin/kcadm.sh get clients \
+                -r project-auth \
+                -q clientId="$KEYCLOAK_CLIENT_ID" | sed -n 's/.*"id" : "\([^"]*\)".*/\1/p' | head -n 1)
+
+              test -n "$CLIENT_UUID"
+
+              /opt/keycloak/bin/kcadm.sh update "clients/${CLIENT_UUID}" \
+                -r project-auth \
+                -s "secret=$KEYCLOAK_CLIENT_SECRET" \
+                -s "baseUrl=$AUTH_SERVER_BASE_URL" \
+                -s 'redirectUris=["'"$AUTH_SERVER_BASE_URL"'/login/oauth2/code/keycloak-google","'"$AUTH_SERVER_BASE_URL"'/login/oauth2/code/keycloak-github"]' \
+                -s 'webOrigins=["'"$AUTH_SERVER_BASE_URL"'"]'
+          env:
+            - $patch: replace
+            - name: KC_BOOTSTRAP_ADMIN_USERNAME
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-system-config
+                  key: KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME
+            - name: KEYCLOAK_CLIENT_ID
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-system-config
+                  key: KEYCLOAK_CLIENT_ID
+            - name: AUTH_SERVER_BASE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-system-config
+                  key: AUTH_SERVER_BASE_URL
@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keycloak
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: keycloak-public.auth-system-dev.svc.cluster.local
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: keycloak
+                port:
+                  number: 80
@@ -0,0 +1,16 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keycloak
+spec:
+  template:
+    spec:
+      containers:
+        - name: keycloak
+          env:
+            - name: KC_HOSTNAME
+              value: keycloak-public.auth-system-dev.svc.cluster.local
+            - name: KC_HOSTNAME_STRICT
+              value: "false"
+            - name: KC_PROXY_HEADERS
+              value: xforwarded
@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keycloak
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
+        vault.hashicorp.com/agent-inject-perms-keycloak-env: "0644"
+        vault.hashicorp.com/agent-inject-secret-keycloak-env: kv/data/dev/systems/auth-system/postgres/keycloak
+        vault.hashicorp.com/agent-inject-template-keycloak-env: |
+          {{ with secret "kv/data/dev/systems/auth-system/postgres/keycloak" }}
+          export KC_DB_PASSWORD={{ printf "%q" .Data.data.KEYCLOAK_DB_PASSWORD }}
+          {{ end }}
+
+          {{ with secret "kv/data/dev/systems/auth-system/keycloak/bootstrap-admin" }}
+          export KC_BOOTSTRAP_ADMIN_PASSWORD={{ printf "%q" .Data.data.KC_BOOTSTRAP_ADMIN_PASSWORD }}
+          {{ end }}
+        vault.hashicorp.com/role: keycloak-dev
+    spec:
+      automountServiceAccountToken: false
+      volumes:
+        - name: vault-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  audience: vault
+                  expirationSeconds: 3600
+                  path: token
+      containers:
+        - name: keycloak
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - |
+              . /vault/secrets/keycloak-env
+              exec /opt/keycloak/bin/kc.sh start-dev --import-realm --http-port=8080
+          env:
+            - $patch: replace
+            - name: KC_DB
+              value: postgres
+            - name: KC_DB_URL
+              value: jdbc:postgresql://postgres:5432/keycloak
+            - name: KC_DB_USERNAME
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-system-config
+                  key: KEYCLOAK_DB_USER
+            - name: KC_HEALTH_ENABLED
+              value: "true"
+            - name: KC_BOOTSTRAP_ADMIN_USERNAME
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-system-config
+                  key: KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME
@@ -0,0 +1,26 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: auth-system-dev
+
+resources:
+  - ../../../../../systems/auth-system/base
+  - namespace.yaml
+  - keycloak-ingress.yaml
+  - public-access.yaml
+  - networkpolicy.yaml
+
+generatorOptions:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+
+configMapGenerator:
+  - name: auth-system-config
+    envs:
+      - config.env
+
+patches:
+  - path: postgres.vault-patch.yaml
+  - path: keycloak.vault-patch.yaml
+  - path: keycloak-client-sync.vault-patch.yaml
+  - path: keycloak.public-url-patch.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth-system-dev
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+  labels:
+    vault-injection: enabled
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest
@@ -0,0 +1,161 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-system-default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-system-allow-dns-egress
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-system-allow-vault-egress
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault
+          podSelector:
+            matchLabels:
+              app: vault
+      ports:
+        - protocol: TCP
+          port: 8200
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-system-allow-keycloak-egress-to-postgres
+spec:
+  podSelector:
+    matchLabels:
+      app: keycloak
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app: postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-system-allow-keycloak-client-sync-to-keycloak
+spec:
+  podSelector:
+    matchLabels:
+      app: keycloak-client-sync
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app: keycloak
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-system-allow-keycloak-ingress
+spec:
+  podSelector:
+    matchLabels:
+      app: keycloak
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
+    - from:
+        - podSelector:
+            matchLabels:
+              app: keycloak-client-sync
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-system-allow-postgres-ingress
+spec:
+  podSelector:
+    matchLabels:
+      app: postgres
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: auth-dev
+          podSelector:
+            matchExpressions:
+              - key: app
+                operator: In
+                values:
+                  - auth-server
+                  - auth-db-migration
+      ports:
+        - protocol: TCP
+          port: 5432
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault
+          podSelector:
+            matchLabels:
+              app: vault
+      ports:
+        - protocol: TCP
+          port: 5432
+    - from:
+        - podSelector:
+            matchLabels:
+              app: keycloak
+      ports:
+        - protocol: TCP
+          port: 5432
@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
+        vault.hashicorp.com/agent-inject-perms-postgres-env: "0644"
+        vault.hashicorp.com/agent-inject-secret-postgres-env: kv/data/dev/systems/auth-system/postgres/superuser
+        vault.hashicorp.com/agent-inject-template-postgres-env: |
+          {{ with secret "kv/data/dev/systems/auth-system/postgres/superuser" }}
+          export POSTGRES_PASSWORD={{ printf "%q" .Data.data.POSTGRES_SUPERUSER_PASSWORD }}
+          {{ end }}
+
+          {{ with secret "kv/data/dev/systems/auth-system/postgres/auth-server" }}
+          export AUTH_DB_PASSWORD={{ printf "%q" .Data.data.AUTH_DB_PASSWORD }}
+          {{ end }}
+
+          {{ with secret "kv/data/dev/systems/auth-system/postgres/keycloak" }}
+          export KEYCLOAK_DB_PASSWORD={{ printf "%q" .Data.data.KEYCLOAK_DB_PASSWORD }}
+          {{ end }}
+        vault.hashicorp.com/role: postgres-dev
+    spec:
+      automountServiceAccountToken: false
+      volumes:
+        - name: vault-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  audience: vault
+                  expirationSeconds: 3600
+                  path: token
+      containers:
+        - name: postgres
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - |
+              . /vault/secrets/postgres-env
+              exec docker-entrypoint.sh postgres
+          env:
+            - $patch: replace
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+            - name: POSTGRES_USER
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-system-config
+                  key: POSTGRES_SUPERUSER
+            - name: POSTGRES_DB
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-system-config
+                  key: POSTGRES_DEFAULT_DB
+            - name: AUTH_DB_NAME
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-system-config
+                  key: AUTH_DB_NAME
+            - name: AUTH_DB_USER
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-system-config
+                  key: AUTH_DB_USER
+            - name: KEYCLOAK_DB_NAME
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-system-config
+                  key: KEYCLOAK_DB_NAME
+            - name: KEYCLOAK_DB_USER
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-system-config
+                  key: KEYCLOAK_DB_USER
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak-public
+spec:
+  type: ExternalName
+  externalName: traefik.kube-system.svc.cluster.local
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
@@ -0,0 +1,2 @@
+APP_SERVER_PORT=8082
+APP_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI=http://auth-public.auth-dev.svc.cluster.local
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-regcred
+  namespace: api-dev
+spec:
+  encryptedData:
+    .dockerconfigjson: AgC7O6nq0aej7pxKXYyJy01HomK4s4jqkrwJ2iiVqjWrv4LjMqYY/8XiPnv7eyOAhBlpnSjULZ0pNPnQjUh6TUkcfbV0VOXjha6qkFIRZXLTlySvooS4FJH3lGjYBlli5bDfVw2KZTy9zR3qcpclOVJo5eEGJ+3rrl6NCUV7CzXfhpMsdATXtDRK1reSlpS2qWgLYJ8Dt0mdaz9yt1baGC3PwjeohnbmeCxRDi8HWOgWTXj0NqBtnpHnzQz5dox5NduQQCDh4ZrP7XK4CgeC3OIuTy1BokpTD5xfN3e0apiiZcUKQCN2I4NJ+B/JqgxceLxVXl3kYswlH+MjkzuejB3OPcGJsfQAs3gJUPB460mzT2S21xm4GloqL73utz+JuyE4pmCuPbFzgaJFNEamtAWtwZRiUwpjBG0HHLg2JPuLc07ljzfSiO9IqOA2zFmgYTX1dLdhrgSzIO6jaWFvctKTqavPxTRHNjBG9as+9gbQ7caH7vcV4k7q7XyEWpeEv9rCyVWcuRvZ7QNkHU1ss44uimr5I43JkEnsmacFRanxIlB80t357iGNiGNGCJFgfiVnh1PqmPlCvEtA42iTt+++2aU+x1SmiS4LYEs4YowVmanm0t1dBWSOMC7y6kM91W/fGPEo5i0lWbdvDKFuNS8RAWu4mXTgLjgbWz9a5PMcdioh0JMxV78FkDkU1jte/hFeIMOmA/xwrzIXVu7JTJK5a+6A9Dmhjpuiunv1nhDsxg1okPjiJ7W4T2pc0JpU+7XjhsXipE0FCwiNxwsh0GvI5MFGmipQwKbcSJuQJrXqAbTZZyDpa+0rUyc9YhYxAgxKf8AzxffMgDKm68MuS8KVdvIhC0dKUOccRnmrSYN8GMJSlZE065MOjY5FGsVfPRPHMYLhQnkNQPXSDB34UXl97mrUIz6mR3mnZar0PKqm9d5vZ19ujIwV7ZQEar8Sf6ZbT8n25hLUmq6JkGzsRiHo42S2JoVl1QlHgzQbv6i/JPsjzQcKfVhtAIXiyMIMvsbYLCjX9df6yVU3e0pCBVl3sGSMbOf4/QVrJtCqog==
+  template:
+    metadata:
+      name: ghcr-regcred
+      namespace: api-dev
+    type: kubernetes.io/dockerconfigjson
@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api-server
+  annotations:
+    argocd.argoproj.io/sync-wave: "20"
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: api-public.api-dev.svc.cluster.local
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: api-server
+                port:
+                  number: 80
@@ -0,0 +1,26 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: api-dev
+
+resources:
+  - ../../../../../workloads/api-server/base
+  - namespace.yaml
+  - ingress.yaml
+  - public-access.yaml
+  - networkpolicy.yaml
+  - ghcr-regcred.sealedsecret.yaml
+
+generatorOptions:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+
+configMapGenerator:
+  - name: api-server-config
+    envs:
+      - config.env
+
+images:
+  - name: ghcr.io/donghyeonka/project-api-server
+    newName: ghcr.io/donghyeonka/project-api-server
+    newTag: fd097c9
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: api-dev
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest
@@ -0,0 +1,75 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: api-dev-default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: api-dev-allow-dns-egress
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: api-dev-allow-public-egress
+spec:
+  podSelector:
+    matchLabels:
+      app: api-server
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: api-dev-allow-ingress-from-traefik
+spec:
+  podSelector:
+    matchLabels:
+      app: api-server
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8082
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-public
+spec:
+  type: ExternalName
+  externalName: traefik.kube-system.svc.cluster.local
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
@@ -0,0 +1,21 @@
+SPRING_PROFILES_ACTIVE=dev
+SERVER_FORWARD_HEADERS_STRATEGY=framework
+APP_DOCS_TITLE=Project Auth Server API
+APP_DOCS_DESCRIPTION=dev auth-server OpenAPI
+APP_DOCS_VERSION=v1
+APP_DATASOURCE_URL=jdbc:postgresql://postgres.auth-system-dev.svc.cluster.local:5432/project_auth
+APP_PERSISTENCE_MIGRATION_RUN_ON_STARTUP=false
+APP_SECURITY_OAUTH2_KEYCLOAK_ISSUER_URI=http://keycloak-public.auth-system-dev.svc.cluster.local/realms/project-auth
+APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_ID=project-auth-server
+APP_SECURITY_OAUTH2_GOOGLE_REGISTRATION_ID=keycloak-google
+APP_SECURITY_OAUTH2_GOOGLE_IDP_HINT=google
+APP_SECURITY_OAUTH2_GITHUB_REGISTRATION_ID=keycloak-github
+APP_SECURITY_OAUTH2_GITHUB_IDP_HINT=github
+APP_SECURITY_JWT_ISSUER=http://auth-public.auth-dev.svc.cluster.local
+APP_SECURITY_JWT_ACTIVE_KEY_ID=dev-vault-rsa-1
+APP_SECURITY_JWT_GENERATE_KEY_PAIR_ON_STARTUP=false
+APP_SECURITY_JWT_ACCESS_TOKEN_EXPIRATION=PT30M
+APP_SECURITY_JWT_VAULT_ENABLED=true
+APP_SECURITY_JWT_VAULT_ADDRESS=http://vault.vault.svc.cluster.local:8200
+APP_SECURITY_JWT_VAULT_MOUNT_PATH=transit
+APP_SECURITY_JWT_VAULT_TRANSIT_KEY_NAME=project-auth-jwt
@@ -0,0 +1,55 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: auth-db-migration
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
+        vault.hashicorp.com/agent-inject-secret-migration-env: database/creds/auth-db-migration-dev
+        vault.hashicorp.com/agent-inject-template-migration-env: |
+          {{- with secret "database/creds/auth-db-migration-dev" -}}
+          export APP_DATASOURCE_USERNAME={{ printf "%q" .Data.username }}
+          export APP_DATASOURCE_PASSWORD={{ printf "%q" .Data.password }}
+          {{- end }}
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/agent-run-as-group: "10001"
+        vault.hashicorp.com/agent-run-as-user: "10001"
+        vault.hashicorp.com/role: auth-db-migration-dev
+    spec:
+      automountServiceAccountToken: false
+      volumes:
+        - name: vault-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  audience: vault
+                  expirationSeconds: 3600
+                  path: token
+      containers:
+        - name: auth-db-migration
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - |
+              . /vault/secrets/migration-env
+              exec java -jar /app/migration.jar
+          env:
+            - $patch: replace
+            - name: SPRING_MAIN_WEB_APPLICATION_TYPE
+              value: none
+            - name: APP_PERSISTENCE_MIGRATION_RUN_ON_STARTUP
+              value: "true"
+            - name: APP_PERSISTENCE_MIGRATION_LOCATION
+              value: classpath:db/migration
+            - name: APP_DATASOURCE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-server-config
+                  key: APP_DATASOURCE_URL
+            - name: APP_DATASOURCE_DRIVER_CLASS_NAME
+              value: org.postgresql.Driver
@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: auth-server
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-cache-enable: "true"
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
+        vault.hashicorp.com/agent-inject-secret-runtime-env: kv/data/dev/systems/auth-system/postgres/auth-server
+        vault.hashicorp.com/agent-inject-template-runtime-env: |
+          {{ with secret "kv/data/dev/systems/auth-system/postgres/auth-server" }}
+          export APP_DATASOURCE_USERNAME={{ printf "%q" .Data.data.APP_DATASOURCE_USERNAME }}
+          export APP_DATASOURCE_PASSWORD={{ printf "%q" .Data.data.APP_DATASOURCE_PASSWORD }}
+          {{ end }}
+
+          {{ with secret "kv/data/dev/workloads/auth-server/keycloak-client" }}
+          export APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET={{ printf "%q" .Data.data.APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET }}
+          {{ end }}
+        vault.hashicorp.com/agent-inject-token: "true"
+        vault.hashicorp.com/agent-run-as-group: "10001"
+        vault.hashicorp.com/agent-run-as-user: "10001"
+        vault.hashicorp.com/role: auth-server-dev
+    spec:
+      automountServiceAccountToken: false
+      volumes:
+        - name: vault-token
+          projected:
+            defaultMode: 0444
+            sources:
+              - serviceAccountToken:
+                  audience: vault
+                  expirationSeconds: 3600
+                  path: token
+      containers:
+        - name: auth-server
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - |
+              . /vault/secrets/runtime-env
+              export APP_SECURITY_JWT_VAULT_TOKEN="$(cat /vault/secrets/token)"
+              exec java -jar /app/application.jar
+          envFrom:
+            - configMapRef:
+                name: auth-server-config
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-regcred
+  namespace: auth-dev
+spec:
+  encryptedData:
+    .dockerconfigjson: AgAIKHR/abtMIrkphJPG63jmOCXIMSBdDMdMUYjx37FRV9SpCA/j3UTHhhZlDSK5gXK/p9FGsR1mBjME+imHEa7/rqBMzfSoJjRQCln3TjD1GT+XJ9J8/qS9AQl+GG9kcJfVMTfGslFbQc1993uURdb/CDupe8XsJosMfzvV5h+SpSdytU2Y8CrhZSDNtz7/2Y+x0LQNfyafjXCxsc1kS5qt3WzPFD/zyk70+e2oq868ETBaij2dHEAQXH+XVz2ilqyzLE633X3/Wf/ADRMJ1i7XWaMir01mSXaB97U2+OPaSRJDf1TAfikn6D4BydNsTgI2UQ839edrgr9EXz1Sr4oYdpWjOpNmtH6OjfiiRj2r0LMvNKR/C1ruROfBcEV7y3kXpKRM5kwG+WM1/1B0ziodu0LZJl23QAgfNnTJrYlJJXJNSFNapPMWEcq91TMeauSIyRgbtLUZEemmlTVybt2SV86Yr+w9SlNAsBJGQaW34Ljfmu7X9H0JwTDkphWUotSPmmKj2GFdpVaNwL0Xvi6OoytiWu0rJWVkGar3mnyLPrkVLb5AlOZYPKxfPhZJfwZxPXBqgWj+6kHGs1SpH6v55wVIz1MdMoGcVqcjlOiMNFd2leOyejYQvRBXKRW3wgzgB6J0OdL1S8z1cOfblO4egx9C6RsaxDC//VDK36aAYvdc55Hsk2GC4iZKsug6EAdXWiiJjdM9yfAcGcv7LemQneA3OslJTdDTpWUdbREiIDXBX4PjEQz0G4oI5YDNYvS8NxUOWZ1ly0BH+uHbcm69tnD9ATSVvjvtKlLiP7/BCYZAguCzNEYkmf1neTtHYlVsoPmIuTkifaf9qRPU831MYj8wTfz56YVT1+aSbfQBK4XP49+bIf5AVo9K5JuEQETqMhZ0G05VjmlwUrgtQ60oZLu8dbvFyt/0VxfWBGcCi+AW+nmro3c14XmA4k1d09xtuoa+8QEObtOTEow3+tyqL46FlJgl7UjX8dd4p7gUAF/iADw8a0M32kIN0NHJ9o2EsFe85rn9qBoDLGrogDXRXJ4iCxE0Zgf7bw6tFA==
+  template:
+    metadata:
+      name: ghcr-regcred
+      namespace: auth-dev
+    type: kubernetes.io/dockerconfigjson
@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: auth-server
+  annotations:
+    argocd.argoproj.io/sync-wave: "20"
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: auth-public.auth-dev.svc.cluster.local
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: auth-server
+                port:
+                  number: 80
@@ -0,0 +1,30 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: auth-dev
+
+resources:
+  - ../../../../../workloads/auth-server/base
+  - namespace.yaml
+  - ingress.yaml
+  - public-access.yaml
+  - networkpolicy.yaml
+  - ghcr-regcred.sealedsecret.yaml
+
+patches:
+  - path: deployment.vault-patch.yaml
+  - path: db-migration-job.vault-patch.yaml
+
+generatorOptions:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+
+configMapGenerator:
+  - name: auth-server-config
+    envs:
+      - config.env
+
+images:
+  - name: ghcr.io/donghyeonka/project-auth-server
+    newName: ghcr.io/donghyeonka/project-auth-server
+    newTag: 1f47f2c
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth-dev
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+  labels:
+    vault-injection: enabled
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest
@@ -0,0 +1,105 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-dev-default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-dev-allow-dns-egress
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-dev-allow-auth-system-and-vault-egress
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: auth-system-dev
+          podSelector:
+            matchLabels:
+              app: postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault
+          podSelector:
+            matchLabels:
+              app: vault
+      ports:
+        - protocol: TCP
+          port: 8200
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-dev-allow-public-egress
+spec:
+  podSelector:
+    matchLabels:
+      app: auth-server
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-dev-allow-ingress-from-traefik
+spec:
+  podSelector:
+    matchLabels:
+      app: auth-server
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: auth-public
+spec:
+  type: ExternalName
+  externalName: traefik.kube-system.svc.cluster.local
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80