init: 아르고cd, vault 기반 인프라 설계

2026-07-24 14:31:09 +09:00
parent 8879d0a3fe
commit d507ac6ee9
137 changed files with 11431 additions and 1 deletions
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: auth-db-migration
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/sync-wave: "-2"
+automountServiceAccountToken: false
+imagePullSecrets:
+  - name: ghcr-regcred
@@ -0,0 +1,69 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: auth-db-migration
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  backoffLimit: 1
+  template:
+    metadata:
+      labels:
+        app: auth-db-migration
+    spec:
+      serviceAccountName: auth-db-migration
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: auth-db-migration
+          image: ghcr.io/donghyeonka/project-auth-server
+          imagePullPolicy: IfNotPresent
+          command:
+            - java
+            - -jar
+            - /app/migration.jar
+          env:
+            - name: SPRING_MAIN_WEB_APPLICATION_TYPE
+              value: none
+            - name: APP_PERSISTENCE_MIGRATION_RUN_ON_STARTUP
+              value: "true"
+            - name: APP_PERSISTENCE_MIGRATION_LOCATION
+              value: classpath:db/migration
+            - name: APP_DATASOURCE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-server-config
+                  key: APP_DATASOURCE_URL
+            - name: APP_DATASOURCE_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-auth-server-credentials
+                  key: APP_DATASOURCE_USERNAME
+            - name: APP_DATASOURCE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-auth-server-credentials
+                  key: APP_DATASOURCE_PASSWORD
+            - name: APP_DATASOURCE_DRIVER_CLASS_NAME
+              value: org.postgresql.Driver
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: false
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
@@ -0,0 +1,78 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: auth-server
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: auth-server
+  
+  template:
+    metadata:
+      labels:
+        app: auth-server
+  
+    spec:
+      serviceAccountName: auth-server
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: auth-server
+          image: ghcr.io/donghyeonka/project-auth-server
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+          envFrom:
+            - configMapRef:
+                name: auth-server-config
+            - secretRef:
+                name: postgres-auth-server-credentials
+            - secretRef:
+                name: keycloak-client-auth-server
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: false
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: 1000m
+              memory: 1024Mi
+          readinessProbe:
+            httpGet:
+              path: /actuator/health/readiness
+              port: http
+            initialDelaySeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /actuator/health/liveness
+              port: http
+            initialDelaySeconds: 30
+            timeoutSeconds: 3
+            failureThreshold: 5
+            periodSeconds: 15
+          startupProbe:
+            httpGet:
+              path: /actuator/health/liveness
+              port: http
+            initialDelaySeconds: 10
+            timeoutSeconds: 3
+            periodSeconds: 10
+            failureThreshold: 12
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - serviceaccount.yaml
+  - auth-db-migration-serviceaccount.yaml
+  - service.yaml
+  - db-migration-job.yaml
+  - deployment.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: auth-server
+spec:
+  selector:
+    app: auth-server
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8080
+  type: ClusterIP
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: auth-server
+automountServiceAccountToken: false
+imagePullSecrets:
+  - name: ghcr-regcred
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: auth-server-config
+data:
+  SPRING_PROFILES_ACTIVE: dev
+  SERVER_FORWARD_HEADERS_STRATEGY: framework
+  APP_DOCS_TITLE: Project Auth Server API
+  APP_DOCS_DESCRIPTION: dev auth-server OpenAPI
+  APP_DOCS_VERSION: v1
+  APP_DATASOURCE_URL: jdbc:postgresql://postgres.platform.svc.cluster.local:5432/project_auth
+  APP_PERSISTENCE_MIGRATION_RUN_ON_STARTUP: "false"
+  APP_SECURITY_OAUTH2_KEYCLOAK_ISSUER_URI: http://keycloak-public.platform.svc.cluster.local/realms/project-auth
+  APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_ID: project-auth-server
+  APP_SECURITY_OAUTH2_GOOGLE_REGISTRATION_ID: keycloak-google
+  APP_SECURITY_OAUTH2_GOOGLE_IDP_HINT: google
+  APP_SECURITY_OAUTH2_GITHUB_REGISTRATION_ID: keycloak-github
+  APP_SECURITY_OAUTH2_GITHUB_IDP_HINT: github
+  APP_SECURITY_JWT_ISSUER: http://auth-public.auth-dev.svc.cluster.local
+  APP_SECURITY_JWT_ACTIVE_KEY_ID: dev-vault-rsa-1
+  APP_SECURITY_JWT_GENERATE_KEY_PAIR_ON_STARTUP: "false"
+  APP_SECURITY_JWT_ACCESS_TOKEN_EXPIRATION: PT30M
+  APP_SECURITY_JWT_VAULT_ENABLED: "true"
+  APP_SECURITY_JWT_VAULT_ADDRESS: http://vault.vault.svc.cluster.local:8200
+  APP_SECURITY_JWT_VAULT_MOUNT_PATH: transit
+  APP_SECURITY_JWT_VAULT_TRANSIT_KEY_NAME: project-auth-jwt
@@ -0,0 +1,45 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: auth-db-migration
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-inject-secret-migration-env: database/creds/auth-db-migration-dev
+        vault.hashicorp.com/agent-inject-template-migration-env: |
+          {{- with secret "database/creds/auth-db-migration-dev" -}}
+          export APP_DATASOURCE_USERNAME={{ printf "%q" .Data.username }}
+          export APP_DATASOURCE_PASSWORD={{ printf "%q" .Data.password }}
+          {{- end }}
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/agent-run-as-group: "10001"
+        vault.hashicorp.com/agent-run-as-user: "10001"
+        vault.hashicorp.com/role: auth-db-migration-dev
+    spec:
+      automountServiceAccountToken: true
+      containers:
+        - name: auth-db-migration
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - |
+              . /vault/secrets/migration-env
+              exec java -jar /app/migration.jar
+          env:
+            - $patch: replace
+            - name: SPRING_MAIN_WEB_APPLICATION_TYPE
+              value: none
+            - name: APP_PERSISTENCE_MIGRATION_RUN_ON_STARTUP
+              value: "true"
+            - name: APP_PERSISTENCE_MIGRATION_LOCATION
+              value: classpath:db/migration
+            - name: APP_DATASOURCE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: auth-server-config
+                  key: APP_DATASOURCE_URL
+            - name: APP_DATASOURCE_DRIVER_CLASS_NAME
+              value: org.postgresql.Driver
@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: auth-server
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-cache-enable: "true"
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-inject-secret-runtime-env: kv/data/dev/platform/postgres/auth-server
+        vault.hashicorp.com/agent-inject-template-runtime-env: |
+          {{ with secret "kv/data/dev/platform/postgres/auth-server" }}
+          export APP_DATASOURCE_USERNAME={{ printf "%q" .Data.data.APP_DATASOURCE_USERNAME }}
+          export APP_DATASOURCE_PASSWORD={{ printf "%q" .Data.data.APP_DATASOURCE_PASSWORD }}
+          {{ end }}
+
+          {{ with secret "kv/data/dev/platform/keycloak/client-auth-server" }}
+          export APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET={{ printf "%q" .Data.data.APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET }}
+          {{ end }}
+        vault.hashicorp.com/agent-inject-token: "true"
+        vault.hashicorp.com/agent-run-as-group: "10001"
+        vault.hashicorp.com/agent-run-as-user: "10001"
+        vault.hashicorp.com/role: auth-server-dev
+    spec:
+      automountServiceAccountToken: true
+      containers:
+        - name: auth-server
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - |
+              . /vault/secrets/runtime-env
+              export APP_SECURITY_JWT_VAULT_TOKEN="$(cat /vault/secrets/token)"
+              exec java -jar /app/application.jar
+          envFrom:
+            - configMapRef:
+                name: auth-server-config
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-regcred
+  namespace: auth-dev
+spec:
+  encryptedData:
+    .dockerconfigjson: AgAIKHR/abtMIrkphJPG63jmOCXIMSBdDMdMUYjx37FRV9SpCA/j3UTHhhZlDSK5gXK/p9FGsR1mBjME+imHEa7/rqBMzfSoJjRQCln3TjD1GT+XJ9J8/qS9AQl+GG9kcJfVMTfGslFbQc1993uURdb/CDupe8XsJosMfzvV5h+SpSdytU2Y8CrhZSDNtz7/2Y+x0LQNfyafjXCxsc1kS5qt3WzPFD/zyk70+e2oq868ETBaij2dHEAQXH+XVz2ilqyzLE633X3/Wf/ADRMJ1i7XWaMir01mSXaB97U2+OPaSRJDf1TAfikn6D4BydNsTgI2UQ839edrgr9EXz1Sr4oYdpWjOpNmtH6OjfiiRj2r0LMvNKR/C1ruROfBcEV7y3kXpKRM5kwG+WM1/1B0ziodu0LZJl23QAgfNnTJrYlJJXJNSFNapPMWEcq91TMeauSIyRgbtLUZEemmlTVybt2SV86Yr+w9SlNAsBJGQaW34Ljfmu7X9H0JwTDkphWUotSPmmKj2GFdpVaNwL0Xvi6OoytiWu0rJWVkGar3mnyLPrkVLb5AlOZYPKxfPhZJfwZxPXBqgWj+6kHGs1SpH6v55wVIz1MdMoGcVqcjlOiMNFd2leOyejYQvRBXKRW3wgzgB6J0OdL1S8z1cOfblO4egx9C6RsaxDC//VDK36aAYvdc55Hsk2GC4iZKsug6EAdXWiiJjdM9yfAcGcv7LemQneA3OslJTdDTpWUdbREiIDXBX4PjEQz0G4oI5YDNYvS8NxUOWZ1ly0BH+uHbcm69tnD9ATSVvjvtKlLiP7/BCYZAguCzNEYkmf1neTtHYlVsoPmIuTkifaf9qRPU831MYj8wTfz56YVT1+aSbfQBK4XP49+bIf5AVo9K5JuEQETqMhZ0G05VjmlwUrgtQ60oZLu8dbvFyt/0VxfWBGcCi+AW+nmro3c14XmA4k1d09xtuoa+8QEObtOTEow3+tyqL46FlJgl7UjX8dd4p7gUAF/iADw8a0M32kIN0NHJ9o2EsFe85rn9qBoDLGrogDXRXJ4iCxE0Zgf7bw6tFA==
+  template:
+    metadata:
+      name: ghcr-regcred
+      namespace: auth-dev
+    type: kubernetes.io/dockerconfigjson
@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: auth-server
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: auth-public.auth-dev.svc.cluster.local
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: auth-server
+                port:
+                  number: 80
@@ -0,0 +1,25 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: auth-dev
+
+resources:
+  - ../../base
+  - namespace.yaml
+  - configmap.yaml
+  - ingress.yaml
+  - public-access.yaml
+  - networkpolicy.yaml
+  - ghcr-regcred.sealedsecret.yaml
+
+patches:
+  - path: deployment.vault-patch.yaml
+  - path: db-migration-job.vault-patch.yaml
+
+generatorOptions:
+  disableNameSuffixHash: true
+
+images:
+- name: ghcr.io/donghyeonka/project-auth-server
+  newName: ghcr.io/donghyeonka/project-auth-server
+  newTag: 1f47f2c
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth-dev
+  labels:
+    vault-injection: enabled
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest
@@ -0,0 +1,105 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-dev-default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-dev-allow-dns-egress
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-dev-allow-platform-and-vault-egress
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: platform
+          podSelector:
+            matchLabels:
+              app: postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault
+          podSelector:
+            matchLabels:
+              app: vault
+      ports:
+        - protocol: TCP
+          port: 8200
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-dev-allow-public-egress
+spec:
+  podSelector:
+    matchLabels:
+      app: auth-server
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-dev-allow-ingress-from-traefik
+spec:
+  podSelector:
+    matchLabels:
+      app: auth-server
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: auth-public
+spec:
+  type: ExternalName
+  externalName: traefik.kube-system.svc.cluster.local
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: auth-prod
+
+resources:
+  - ../../base
+  - namespace.yaml
+
+images:
+  - name: ghcr.io/donghyeonka/project-auth-server
+    newName: ghcr.io/donghyeonka/project-auth-server
+    newTag: 5648fd2
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth-prod
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest