init: 아르고cd, vault 기반 인프라 설계

2026-07-24 14:31:09 +09:00
parent 8879d0a3fe
commit d507ac6ee9
137 changed files with 11431 additions and 1 deletions
@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: auth-server
+spec:
+  template:
+    metadata:
+      annotations:
+        vault.hashicorp.com/agent-cache-enable: "true"
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-inject-secret-runtime-env: kv/data/dev/platform/postgres/auth-server
+        vault.hashicorp.com/agent-inject-template-runtime-env: |
+          {{ with secret "kv/data/dev/platform/postgres/auth-server" }}
+          export APP_DATASOURCE_USERNAME={{ printf "%q" .Data.data.APP_DATASOURCE_USERNAME }}
+          export APP_DATASOURCE_PASSWORD={{ printf "%q" .Data.data.APP_DATASOURCE_PASSWORD }}
+          {{ end }}
+
+          {{ with secret "kv/data/dev/platform/keycloak/client-auth-server" }}
+          export APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET={{ printf "%q" .Data.data.APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET }}
+          {{ end }}
+        vault.hashicorp.com/agent-inject-token: "true"
+        vault.hashicorp.com/agent-run-as-group: "10001"
+        vault.hashicorp.com/agent-run-as-user: "10001"
+        vault.hashicorp.com/role: auth-server-dev
+    spec:
+      automountServiceAccountToken: true
+      containers:
+        - name: auth-server
+          command:
+            - /bin/sh
+            - -ec
+          args:
+            - |
+              . /vault/secrets/runtime-env
+              export APP_SECURITY_JWT_VAULT_TOKEN="$(cat /vault/secrets/token)"
+              exec java -jar /app/application.jar
+          envFrom:
+            - configMapRef:
+                name: auth-server-config