refactor(gitops): establish platform ownership boundaries

2026-07-26 01:34:29 +09:00
parent 293ee6fc97
commit a6f6c663e0
121 changed files with 2801 additions and 1204 deletions
@@ -1,22 +0,0 @@
-{
-  "realm": "project-auth",
-  "enabled": true,
-  "displayName": "Project Auth",
-  "sslRequired": "NONE",
-  "registrationAllowed": false,
-  "loginWithEmailAllowed": true,
-  "duplicateEmailsAllowed": false,
-  "resetPasswordAllowed": true,
-  "clients": [
-    {
-      "clientId": "project-auth-server",
-      "name": "project-auth-server",
-      "enabled": true,
-      "protocol": "openid-connect",
-      "publicClient": false,
-      "standardFlowEnabled": true,
-      "directAccessGrantsEnabled": false,
-      "serviceAccountsEnabled": false
-    }
-  ]
-}
@@ -1,19 +0,0 @@
-#!/bin/sh
-set -eu
-
-psql \
-  -v ON_ERROR_STOP=1 \
-  --set=auth_db_user="${AUTH_DB_USER}" \
-  --set=auth_db_password="${AUTH_DB_PASSWORD}" \
-  --set=auth_db_name="${AUTH_DB_NAME}" \
-  --set=keycloak_db_user="${KEYCLOAK_DB_USER}" \
-  --set=keycloak_db_password="${KEYCLOAK_DB_PASSWORD}" \
-  --set=keycloak_db_name="${KEYCLOAK_DB_NAME}" \
-  --username "${POSTGRES_USER}" \
-  --dbname "${POSTGRES_DB}" <<-'EOSQL'
-  CREATE USER :"auth_db_user" WITH PASSWORD :'auth_db_password';
-  CREATE DATABASE :"auth_db_name" OWNER :"auth_db_user";
-
-  CREATE USER :"keycloak_db_user" WITH PASSWORD :'keycloak_db_password';
-  CREATE DATABASE :"keycloak_db_name" OWNER :"keycloak_db_user";
-EOSQL
@@ -1,97 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: keycloak-client-sync
-  annotations:
-    argocd.argoproj.io/hook: Sync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
-    argocd.argoproj.io/sync-wave: "4"
-spec:
-  activeDeadlineSeconds: 600
-  backoffLimit: 1
-  template:
-    metadata:
-      labels:
-        app: keycloak-client-sync
-    spec:
-      serviceAccountName: keycloak-client-sync
-      automountServiceAccountToken: false
-      restartPolicy: Never
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: keycloak-client-sync
-          image: quay.io/keycloak/keycloak:26.5.5@sha256:a7b0cb7a43a1235a61872883414d3f1d9a3ceac9df6e5907bd12202778a6265c
-          command:
-            - /bin/sh
-            - -c
-            - |
-              set -eu
-
-              ready=false
-              for _ in $(seq 1 60); do
-                if /opt/keycloak/bin/kcadm.sh config credentials \
-                  --server http://keycloak.platform.svc.cluster.local \
-                  --realm master \
-                  --user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
-                  --password "$KC_BOOTSTRAP_ADMIN_PASSWORD" >/dev/null 2>&1; then
-                  ready=true
-                  break
-                fi
-                sleep 5
-              done
-              test "$ready" = true
-
-              CLIENT_UUID=$(/opt/keycloak/bin/kcadm.sh get clients \
-                -r project-auth \
-                -q clientId="$KEYCLOAK_CLIENT_ID" | sed -n 's/.*"id" : "\([^"]*\)".*/\1/p' | head -n 1)
-
-              test -n "$CLIENT_UUID"
-
-              /opt/keycloak/bin/kcadm.sh update "clients/${CLIENT_UUID}" \
-                -r project-auth \
-                -s "secret=$KEYCLOAK_CLIENT_SECRET" \
-                -s "baseUrl=$AUTH_SERVER_BASE_URL" \
-                -s 'redirectUris=["'"$AUTH_SERVER_BASE_URL"'/login/oauth2/code/keycloak-google","'"$AUTH_SERVER_BASE_URL"'/login/oauth2/code/keycloak-github"]' \
-                -s 'webOrigins=["'"$AUTH_SERVER_BASE_URL"'"]'
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: false
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 250m
-              memory: 256Mi
-          env:
-            - name: KC_BOOTSTRAP_ADMIN_USERNAME
-              valueFrom:
-                configMapKeyRef:
-                  name: platform-config
-                  key: KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME
-            - name: KC_BOOTSTRAP_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: keycloak-bootstrap-admin
-                  key: KEYCLOAK_BOOTSTRAP_ADMIN_PASSWORD
-            - name: KEYCLOAK_CLIENT_ID
-              valueFrom:
-                configMapKeyRef:
-                  name: platform-config
-                  key: KEYCLOAK_CLIENT_ID
-            - name: KEYCLOAK_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: keycloak-client-auth-server
-                  key: KEYCLOAK_CLIENT_SECRET
-            - name: AUTH_SERVER_BASE_URL
-              valueFrom:
-                configMapKeyRef:
-                  name: platform-config
-                  key: AUTH_SERVER_BASE_URL
@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: keycloak-client-sync
-automountServiceAccountToken: false
@@ -1,104 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: keycloak
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: keycloak
-  template:
-    metadata:
-      labels:
-        app: keycloak
-    spec:
-      serviceAccountName: keycloak
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: keycloak
-          image: quay.io/keycloak/keycloak:26.5.5@sha256:a7b0cb7a43a1235a61872883414d3f1d9a3ceac9df6e5907bd12202778a6265c
-          args:
-            - start-dev
-            - --import-realm
-            - --http-port=8080
-          ports:
-            - containerPort: 8080
-              name: http
-            - containerPort: 9000
-              name: management
-          env:
-            - name: KC_DB
-              value: postgres
-            - name: KC_DB_URL
-              value: jdbc:postgresql://postgres.platform.svc.cluster.local:5432/keycloak
-            - name: KC_DB_USERNAME
-              valueFrom:
-                configMapKeyRef:
-                  name: platform-config
-                  key: KEYCLOAK_DB_USER
-            - name: KC_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-keycloak-credentials
-                  key: KEYCLOAK_DB_PASSWORD
-            - name: KC_HEALTH_ENABLED
-              value: "true"
-            - name: KC_BOOTSTRAP_ADMIN_USERNAME
-              valueFrom:
-                configMapKeyRef:
-                  name: platform-config
-                  key: KEYCLOAK_BOOTSTRAP_ADMIN_USERNAME
-            - name: KC_BOOTSTRAP_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: keycloak-bootstrap-admin
-                  key: KEYCLOAK_BOOTSTRAP_ADMIN_PASSWORD
-          volumeMounts:
-            - name: keycloak-realm-import
-              mountPath: /opt/keycloak/data/import/project-auth-realm.json
-              subPath: project-auth-realm.json
-          readinessProbe:
-            httpGet:
-              path: /health/ready
-              port: management
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 6
-          livenessProbe:
-            httpGet:
-              path: /health/live
-              port: management
-            initialDelaySeconds: 60
-            periodSeconds: 15
-            timeoutSeconds: 3
-            failureThreshold: 6
-          startupProbe:
-            httpGet:
-              path: /health/ready
-              port: management
-            initialDelaySeconds: 20
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 30
-          resources:
-            requests:
-              cpu: 250m
-              memory: 768Mi
-            limits:
-              cpu: 1000m
-              memory: 1536Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-      volumes:
-        - name: keycloak-realm-import
-          configMap:
-            name: keycloak-realm-import
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: keycloak
-spec:
-  selector:
-    app: keycloak
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-  type: ClusterIP
@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: keycloak
-automountServiceAccountToken: false
@@ -1,19 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - postgres-serviceaccount.yaml
-  - keycloak-serviceaccount.yaml
-  - keycloak-client-sync-serviceaccount.yaml
-  - postgres-service.yaml
-  - postgres-statefulset.yaml
-  - keycloak-service.yaml
-  - keycloak-deployment.yaml
-  - keycloak-client-sync-job.yaml
-configMapGenerator:
-  - name: postgres-init-script
-    files:
-      - files/postgres/01-init-project-auth-databases.sh
-  - name: keycloak-realm-import
-    files:
-      - files/keycloak/project-auth-realm.json
@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: postgres
-spec:
-  clusterIP: None
-  selector:
-    app: postgres
-  ports:
-    - name: postgres
-      port: 5432
-      targetPort: 5432
-  type: ClusterIP
@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: postgres
-automountServiceAccountToken: false
@@ -1,131 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: postgres
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  serviceName: postgres
-  replicas: 1
-  selector:
-    matchLabels:
-      app: postgres
-  template:
-    metadata:
-      labels:
-        app: postgres
-    spec:
-      serviceAccountName: postgres
-      securityContext:
-        fsGroup: 999
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: postgres
-          image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
-          ports:
-            - containerPort: 5432
-              name: postgres
-          env:
-            - name: PGDATA
-              value: /var/lib/postgresql/data/pgdata
-            - name: POSTGRES_USER
-              valueFrom:
-                configMapKeyRef:
-                  name: platform-config
-                  key: POSTGRES_SUPERUSER
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-superuser-credentials
-                  key: POSTGRES_SUPERUSER_PASSWORD
-            - name: POSTGRES_DB
-              valueFrom:
-                configMapKeyRef:
-                  name: platform-config
-                  key: POSTGRES_DEFAULT_DB
-            - name: AUTH_DB_NAME
-              valueFrom:
-                configMapKeyRef:
-                  name: platform-config
-                  key: AUTH_DB_NAME
-            - name: AUTH_DB_USER
-              valueFrom:
-                configMapKeyRef:
-                  name: platform-config
-                  key: AUTH_DB_USER
-            - name: AUTH_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-auth-server-credentials
-                  key: AUTH_DB_PASSWORD
-            - name: KEYCLOAK_DB_NAME
-              valueFrom:
-                configMapKeyRef:
-                  name: platform-config
-                  key: KEYCLOAK_DB_NAME
-            - name: KEYCLOAK_DB_USER
-              valueFrom:
-                configMapKeyRef:
-                  name: platform-config
-                  key: KEYCLOAK_DB_USER
-            - name: KEYCLOAK_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-keycloak-credentials
-                  key: KEYCLOAK_DB_PASSWORD
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: false
-          volumeMounts:
-            - name: postgres-data
-              mountPath: /var/lib/postgresql/data
-            - name: postgres-init-script
-              mountPath: /docker-entrypoint-initdb.d/01-init-project-auth-databases.sh
-              subPath: 01-init-project-auth-databases.sh
-            - name: postgres-run
-              mountPath: /var/run/postgresql
-          readinessProbe:
-            exec:
-              command:
-                - sh
-                - -c
-                - pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 3
-          livenessProbe:
-            exec:
-              command:
-                - sh
-                - -c
-                - pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"
-            initialDelaySeconds: 20
-            periodSeconds: 15
-            timeoutSeconds: 3
-          resources:
-            requests:
-              cpu: 250m
-              memory: 512Mi
-            limits:
-              cpu: 1000m
-              memory: 1024Mi
-      volumes:
-        - name: postgres-init-script
-          configMap:
-            name: postgres-init-script
-            defaultMode: 0555
-        - name: postgres-run
-          emptyDir: {}
-  volumeClaimTemplates:
-    - metadata:
-        name: postgres-data
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 5Gi
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - platform-addons.yaml
+  - platform-services.yaml
+  - systems.yaml
+  - workloads.yaml
@@ -0,0 +1,122 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: platform-addons
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-5"
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+spec:
+  goTemplate: true
+  goTemplateOptions:
+    - missingkey=error
+  generators:
+    - list:
+        elements:
+          - component: sealed-secrets
+            cluster: dev-k3s
+            server: https://kubernetes.default.svc
+            namespace: kube-system
+            repoURL: https://bitnami.github.io/sealed-secrets
+            chart: sealed-secrets
+            # renovate: datasource=helm depName=sealed-secrets registryUrl=https://bitnami.github.io/sealed-secrets
+            revision: 2.17.9
+            autoSync: "true"
+            helmValues: |
+              fullnameOverride: sealed-secrets-controller
+              keyrenewperiod: 720h
+              image:
+                # renovate: datasource=docker depName=bitnami/sealed-secrets-controller
+                repository: bitnami/sealed-secrets-controller
+                tag: "0.33.1@sha256:e7fad65c2d2f47e48d9ca17408ed56961bfa6a6dd74ccd4a1a214664156534bc"
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 64Mi
+                limits:
+                  cpu: 250m
+                  memory: 256Mi
+          - component: vault-agent-injector
+            cluster: dev-k3s
+            server: https://kubernetes.default.svc
+            namespace: vault
+            repoURL: https://helm.releases.hashicorp.com
+            chart: vault
+            # renovate: datasource=helm depName=vault registryUrl=https://helm.releases.hashicorp.com
+            revision: 0.32.0
+            autoSync: "false"
+            helmValues: |
+              global:
+                externalVaultAddr: http://vault.vault.svc.cluster.local:8200
+                tlsDisable: true
+              server:
+                enabled: false
+              injector:
+                enabled: true
+                authPath: auth/kubernetes
+                image:
+                  # renovate: datasource=docker depName=hashicorp/vault-k8s
+                  repository: hashicorp/vault-k8s
+                  tag: "1.7.2@sha256:ae3d307658b72a1cf35dab9bdf92c995d45cdc7183af0516857714b5bd0ba84d"
+                webhook:
+                  failurePolicy: Fail
+                  namespaceSelector:
+                    matchLabels:
+                      vault-injection: enabled
+                resources:
+                  requests:
+                    cpu: 100m
+                    memory: 128Mi
+                  limits:
+                    cpu: 250m
+                    memory: 256Mi
+                agentImage:
+                  # renovate: datasource=docker depName=hashicorp/vault
+                  repository: hashicorp/vault
+                  tag: "1.18.5@sha256:750bb37c1638fa194ab37053a81618c61bb0491ddec6fccac87c07a8e6cd8166"
+  template:
+    metadata:
+      name: "{{ .component }}-{{ .cluster }}"
+      annotations:
+        argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+        project-gitops.io/auto-sync-gate: "{{ .autoSync }}"
+      labels:
+        project-gitops.io/cluster: "{{ .cluster }}"
+        project-gitops.io/owner: platform
+    spec:
+      project: platform-addons
+      source:
+        repoURL: "{{ .repoURL }}"
+        chart: "{{ .chart }}"
+        targetRevision: "{{ .revision }}"
+        helm:
+          values: "{{ .helmValues }}"
+      destination:
+        server: "{{ .server }}"
+        namespace: "{{ .namespace }}"
+      syncPolicy:
+        syncOptions:
+          - CreateNamespace=true
+          - Prune=confirm
+          - PruneLast=true
+          - FailOnSharedResource=true
+        retry:
+          limit: 5
+          refresh: true
+          backoff:
+            duration: 5s
+            factor: 2
+            maxDuration: 3m
+      revisionHistoryLimit: 5
+  templatePatch: |
+    {{- if eq .autoSync "true" }}
+    spec:
+      syncPolicy:
+        automated:
+          enabled: true
+          prune: true
+          selfHeal: true
+    {{- end }}
+  syncPolicy:
+    applicationsSync: create-update
+    preserveResourcesOnDeletion: true
@@ -0,0 +1,64 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: platform-services
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-5"
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+spec:
+  goTemplate: true
+  goTemplateOptions:
+    - missingkey=error
+  generators:
+    - list:
+        elements:
+          - component: vault
+            cluster: dev-k3s
+            server: https://kubernetes.default.svc
+            namespace: vault
+            path: clusters/dev-k3s/overlays/platform/vault
+            autoSync: "true"
+  template:
+    metadata:
+      name: "{{ .component }}-{{ .cluster }}"
+      annotations:
+        argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+        project-gitops.io/auto-sync-gate: "{{ .autoSync }}"
+      labels:
+        project-gitops.io/cluster: "{{ .cluster }}"
+        project-gitops.io/owner: platform
+    spec:
+      project: platform-services
+      source:
+        repoURL: https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
+        targetRevision: main
+        path: "{{ .path }}"
+      destination:
+        server: "{{ .server }}"
+        namespace: "{{ .namespace }}"
+      syncPolicy:
+        syncOptions:
+          - CreateNamespace=true
+          - PruneLast=true
+          - FailOnSharedResource=true
+        retry:
+          limit: 5
+          refresh: true
+          backoff:
+            duration: 5s
+            factor: 2
+            maxDuration: 3m
+      revisionHistoryLimit: 5
+  templatePatch: |
+    {{- if eq .autoSync "true" }}
+    spec:
+      syncPolicy:
+        automated:
+          enabled: true
+          prune: true
+          selfHeal: true
+    {{- end }}
+  syncPolicy:
+    applicationsSync: create-update
+    preserveResourcesOnDeletion: true
@@ -0,0 +1,64 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: systems
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-5"
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+spec:
+  goTemplate: true
+  goTemplateOptions:
+    - missingkey=error
+  generators:
+    - list:
+        elements:
+          - component: auth-system
+            cluster: dev-k3s
+            server: https://kubernetes.default.svc
+            namespace: auth-system-dev
+            path: clusters/dev-k3s/overlays/systems/auth-system
+            autoSync: "false"
+  template:
+    metadata:
+      name: "{{ .component }}-{{ .cluster }}"
+      annotations:
+        argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+        project-gitops.io/auto-sync-gate: "{{ .autoSync }}"
+      labels:
+        project-gitops.io/cluster: "{{ .cluster }}"
+        project-gitops.io/owner: systems
+    spec:
+      project: systems
+      source:
+        repoURL: https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
+        targetRevision: main
+        path: "{{ .path }}"
+      destination:
+        server: "{{ .server }}"
+        namespace: "{{ .namespace }}"
+      syncPolicy:
+        syncOptions:
+          - CreateNamespace=true
+          - PruneLast=true
+          - FailOnSharedResource=true
+        retry:
+          limit: 5
+          refresh: true
+          backoff:
+            duration: 5s
+            factor: 2
+            maxDuration: 3m
+      revisionHistoryLimit: 5
+  templatePatch: |
+    {{- if eq .autoSync "true" }}
+    spec:
+      syncPolicy:
+        automated:
+          enabled: true
+          prune: true
+          selfHeal: true
+    {{- end }}
+  syncPolicy:
+    applicationsSync: create-update
+    preserveResourcesOnDeletion: true
@@ -0,0 +1,70 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: workloads
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-5"
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+spec:
+  goTemplate: true
+  goTemplateOptions:
+    - missingkey=error
+  generators:
+    - list:
+        elements:
+          - component: auth-server
+            cluster: dev-k3s
+            server: https://kubernetes.default.svc
+            namespace: auth-dev
+            path: clusters/dev-k3s/overlays/workloads/auth-server
+            autoSync: "false"
+          - component: api-server
+            cluster: dev-k3s
+            server: https://kubernetes.default.svc
+            namespace: api-dev
+            path: clusters/dev-k3s/overlays/workloads/api-server
+            autoSync: "false"
+  template:
+    metadata:
+      name: "{{ .component }}-{{ .cluster }}"
+      annotations:
+        argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+        project-gitops.io/auto-sync-gate: "{{ .autoSync }}"
+      labels:
+        project-gitops.io/cluster: "{{ .cluster }}"
+        project-gitops.io/owner: workloads
+    spec:
+      project: workloads
+      source:
+        repoURL: https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
+        targetRevision: main
+        path: "{{ .path }}"
+      destination:
+        server: "{{ .server }}"
+        namespace: "{{ .namespace }}"
+      syncPolicy:
+        syncOptions:
+          - CreateNamespace=true
+          - PruneLast=true
+          - FailOnSharedResource=true
+        retry:
+          limit: 5
+          refresh: true
+          backoff:
+            duration: 5s
+            factor: 2
+            maxDuration: 3m
+      revisionHistoryLimit: 5
+  templatePatch: |
+    {{- if eq .autoSync "true" }}
+    spec:
+      syncPolicy:
+        automated:
+          enabled: true
+          prune: true
+          selfHeal: true
+    {{- end }}
+  syncPolicy:
+    applicationsSync: create-update
+    preserveResourcesOnDeletion: true
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - projects
+  - application-sets
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - platform-addons.yaml
+  - platform-services.yaml
+  - systems.yaml
+  - workloads.yaml
@@ -0,0 +1,50 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: platform-addons
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-10"
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  description: Cluster-scoped controllers installed from approved Helm repositories
+  sourceRepos:
+    - https://bitnami.github.io/sealed-secrets
+    - https://helm.releases.hashicorp.com
+  destinations:
+    - namespace: kube-system
+      server: https://kubernetes.default.svc
+    - namespace: vault
+      server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+    - group: ""
+      kind: Namespace
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+    - group: rbac.authorization.k8s.io
+      kind: ClusterRole
+    - group: rbac.authorization.k8s.io
+      kind: ClusterRoleBinding
+    - group: admissionregistration.k8s.io
+      kind: MutatingWebhookConfiguration
+  namespaceResourceWhitelist:
+    - group: ""
+      kind: ConfigMap
+    - group: ""
+      kind: Secret
+    - group: ""
+      kind: Service
+    - group: ""
+      kind: ServiceAccount
+    - group: apps
+      kind: Deployment
+    - group: policy
+      kind: PodDisruptionBudget
+    - group: rbac.authorization.k8s.io
+      kind: Role
+    - group: rbac.authorization.k8s.io
+      kind: RoleBinding
+  orphanedResources:
+    warn: true
@@ -0,0 +1,37 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: platform-services
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-10"
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  description: Shared services owned by this standalone reference platform
+  sourceRepos:
+    - https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
+  destinations:
+    - namespace: vault
+      server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+    - group: ""
+      kind: Namespace
+    - group: rbac.authorization.k8s.io
+      kind: ClusterRoleBinding
+  namespaceResourceWhitelist:
+    - group: ""
+      kind: ConfigMap
+    - group: ""
+      kind: PersistentVolumeClaim
+    - group: ""
+      kind: Service
+    - group: ""
+      kind: ServiceAccount
+    - group: apps
+      kind: Deployment
+    - group: networking.k8s.io
+      kind: NetworkPolicy
+  orphanedResources:
+    warn: true
@@ -0,0 +1,39 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: systems
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-10"
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  description: Backing systems dedicated to an example product boundary
+  sourceRepos:
+    - https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
+  destinations:
+    - namespace: auth-system-dev
+      server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+    - group: ""
+      kind: Namespace
+  namespaceResourceWhitelist:
+    - group: ""
+      kind: ConfigMap
+    - group: ""
+      kind: Service
+    - group: ""
+      kind: ServiceAccount
+    - group: apps
+      kind: Deployment
+    - group: apps
+      kind: StatefulSet
+    - group: batch
+      kind: Job
+    - group: networking.k8s.io
+      kind: Ingress
+    - group: networking.k8s.io
+      kind: NetworkPolicy
+  orphanedResources:
+    warn: true
@@ -0,0 +1,41 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: workloads
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-10"
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  description: First-party application workloads
+  sourceRepos:
+    - https://git.learn.hyeonworks.com/donghyeon.kang/project-gitops
+  destinations:
+    - namespace: auth-dev
+      server: https://kubernetes.default.svc
+    - namespace: api-dev
+      server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+    - group: ""
+      kind: Namespace
+  namespaceResourceWhitelist:
+    - group: ""
+      kind: ConfigMap
+    - group: ""
+      kind: Service
+    - group: ""
+      kind: ServiceAccount
+    - group: bitnami.com
+      kind: SealedSecret
+    - group: apps
+      kind: Deployment
+    - group: batch
+      kind: Job
+    - group: networking.k8s.io
+      kind: Ingress
+    - group: networking.k8s.io
+      kind: NetworkPolicy
+  orphanedResources:
+    warn: true
@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault-operator
-automountServiceAccountToken: false
@@ -1,7 +1,5 @@
 ui = true
 disable_mlock = true
-api_addr = "http://vault.vault.svc.cluster.local:8200"
-cluster_addr = "http://vault.vault.svc.cluster.local:8201"

 listener "tcp" {
  address = "0.0.0.0:8200"
@@ -11,5 +9,5 @@ listener "tcp" {

 storage "raft" {
  path = "/vault/data"
-  node_id = "vault-dev-0"
+  node_id = "vault-0"
 }
@@ -3,7 +3,6 @@ kind: Kustomization

 resources:
  - vault-serviceaccount.yaml
-  - vault-operator-serviceaccount.yaml
  - vault-auth-delegator.clusterrolebinding.yaml
  - vault-pvc.yaml
  - vault-service.yaml
@@ -24,6 +24,14 @@ spec:
          env:
            - name: VAULT_ADDR
              value: http://127.0.0.1:8200
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: VAULT_API_ADDR
+              value: http://$(POD_IP):8200
+            - name: VAULT_CLUSTER_ADDR
+              value: http://$(POD_IP):8201
          args:
            - |
              cp /vault/config/vault.hcl /tmp/vault.hcl
@@ -3,7 +3,7 @@ kind: PersistentVolumeClaim
 metadata:
  name: vault-data
  annotations:
-    argocd.argoproj.io/sync-options: Prune=false
+    argocd.argoproj.io/sync-options: Prune=confirm,Delete=confirm
 spec:
  accessModes:
    - ReadWriteOnce