init: 아르고cd, vault 기반 인프라 설계
This commit is contained in:
DongHyeonka
@@ -0,0 +1,18 @@
|
||||
## Argo CD Structure
|
||||
|
||||
`argocd/` 디렉터리는 환경(`dev`, `prod`)과 성격(`apps`, `infra`) 기준으로 나눠 관리합니다.
|
||||
|
||||
- `applications/<env>/apps`: 서비스 애플리케이션 선언
|
||||
- `applications/<env>/infra`: 공용 인프라/컨트롤러 선언
|
||||
- `projects/<env>/apps-project.yaml`: 서비스 애플리케이션용 AppProject
|
||||
- `projects/<env>/infra-project.yaml`: 공용 인프라용 AppProject
|
||||
|
||||
현재 `dev`에는 실제 선언을 두고, `prod`는 이후 운영 확장을 위한 구조와 프로젝트 골격을 먼저 유지합니다.
|
||||
|
||||
현재 dev `infra`에는 대표적으로 아래 Application이 포함됩니다.
|
||||
|
||||
- `vault-transit`: workload Vault transit auto-unseal provider
|
||||
- `vault`: workload Vault
|
||||
- `platform`: postgres, keycloak
|
||||
- `vault-agent-injector`: workload secret injection
|
||||
- `sealed-secrets`: image pull secret 같은 예외 secret 처리
|
||||
@@ -0,0 +1,34 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: api-server-dev
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "40"
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
project: apps-dev
|
||||
source:
|
||||
repoURL: https://github.com/DongHyeonka/Project-Auth-GitOps
|
||||
targetRevision: main
|
||||
path: apps/api-server/overlays/dev
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: api-dev
|
||||
syncPolicy:
|
||||
automated:
|
||||
enabled: true
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- PruneLast=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
retry:
|
||||
limit: 5
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
revisionHistoryLimit: 5
|
||||
@@ -0,0 +1,34 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: auth-server-dev
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "30"
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
project: apps-dev
|
||||
source:
|
||||
repoURL: https://github.com/DongHyeonka/Project-Auth-GitOps
|
||||
targetRevision: main
|
||||
path: apps/auth-server/overlays/dev
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: auth-dev
|
||||
syncPolicy:
|
||||
automated:
|
||||
enabled: true
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- PruneLast=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
retry:
|
||||
limit: 5
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
revisionHistoryLimit: 5
|
||||
@@ -0,0 +1,34 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: platform-dev
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "20"
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
project: infra-dev
|
||||
source:
|
||||
repoURL: https://github.com/DongHyeonka/Project-Auth-GitOps
|
||||
targetRevision: main
|
||||
path: infra/platform/overlays/dev
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: platform
|
||||
syncPolicy:
|
||||
automated:
|
||||
enabled: true
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- PruneLast=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
retry:
|
||||
limit: 5
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
revisionHistoryLimit: 5
|
||||
@@ -0,0 +1,35 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: sealed-secrets-dev
|
||||
namespace: argocd
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
project: infra-dev
|
||||
source:
|
||||
repoURL: https://bitnami-labs.github.io/sealed-secrets
|
||||
chart: sealed-secrets
|
||||
targetRevision: 2.17.9
|
||||
helm:
|
||||
values: |
|
||||
fullnameOverride: sealed-secrets-controller
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: kube-system
|
||||
syncPolicy:
|
||||
automated:
|
||||
enabled: true
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- PruneLast=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
retry:
|
||||
limit: 5
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
revisionHistoryLimit: 5
|
||||
@@ -0,0 +1,59 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: vault-agent-injector-dev
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "10"
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
project: infra-dev
|
||||
source:
|
||||
repoURL: https://helm.releases.hashicorp.com
|
||||
chart: vault
|
||||
targetRevision: 0.32.0
|
||||
helm:
|
||||
values: |
|
||||
global:
|
||||
externalVaultAddr: http://vault.vault.svc.cluster.local:8200
|
||||
tlsDisable: true
|
||||
server:
|
||||
enabled: false
|
||||
injector:
|
||||
enabled: true
|
||||
authPath: auth/kubernetes
|
||||
webhook:
|
||||
failurePolicy: Fail
|
||||
namespaceSelector:
|
||||
matchLabels:
|
||||
vault-injection: enabled
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
agentImage:
|
||||
repository: hashicorp/vault
|
||||
tag: "1.18"
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: vault
|
||||
syncPolicy:
|
||||
automated:
|
||||
enabled: true
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- PruneLast=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
retry:
|
||||
limit: 5
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
revisionHistoryLimit: 5
|
||||
@@ -0,0 +1,34 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: vault-transit-dev
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "10"
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
project: infra-dev
|
||||
source:
|
||||
repoURL: https://github.com/DongHyeonka/Project-Auth-GitOps
|
||||
targetRevision: main
|
||||
path: infra/vault-transit/overlays/dev
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: vault-transit
|
||||
syncPolicy:
|
||||
automated:
|
||||
enabled: true
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- PruneLast=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
retry:
|
||||
limit: 5
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
revisionHistoryLimit: 5
|
||||
@@ -0,0 +1,34 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: vault-dev
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "10"
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
project: infra-dev
|
||||
source:
|
||||
repoURL: https://github.com/DongHyeonka/Project-Auth-GitOps
|
||||
targetRevision: main
|
||||
path: infra/vault/overlays/dev
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: vault
|
||||
syncPolicy:
|
||||
automated:
|
||||
enabled: true
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- PruneLast=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
retry:
|
||||
limit: 5
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
revisionHistoryLimit: 5
|
||||
@@ -0,0 +1 @@
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: apps-dev
|
||||
namespace: argocd
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
description: Dev application workloads managed by Argo CD
|
||||
sourceRepos:
|
||||
- https://github.com/DongHyeonka/Project-Auth-GitOps
|
||||
destinations:
|
||||
- namespace: auth-dev
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: api-dev
|
||||
server: https://kubernetes.default.svc
|
||||
clusterResourceWhitelist:
|
||||
- group: ""
|
||||
kind: Namespace
|
||||
namespaceResourceWhitelist:
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- group: ""
|
||||
kind: Service
|
||||
- group: ""
|
||||
kind: ServiceAccount
|
||||
- group: ""
|
||||
kind: PersistentVolumeClaim
|
||||
- group: "bitnami.com"
|
||||
kind: SealedSecret
|
||||
- group: "apps"
|
||||
kind: Deployment
|
||||
- group: "apps"
|
||||
kind: StatefulSet
|
||||
- group: "apps"
|
||||
kind: ReplicaSet
|
||||
- group: "autoscaling"
|
||||
kind: HorizontalPodAutoscaler
|
||||
- group: "batch"
|
||||
kind: Job
|
||||
- group: "networking.k8s.io"
|
||||
kind: Ingress
|
||||
- group: "networking.k8s.io"
|
||||
kind: NetworkPolicy
|
||||
- group: "policy"
|
||||
kind: PodDisruptionBudget
|
||||
orphanedResources:
|
||||
warn: true
|
||||
@@ -0,0 +1,68 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: infra-dev
|
||||
namespace: argocd
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
description: Dev shared infrastructure managed by Argo CD
|
||||
sourceRepos:
|
||||
- https://github.com/DongHyeonka/Project-Auth-GitOps
|
||||
- https://bitnami-labs.github.io/sealed-secrets
|
||||
- https://helm.releases.hashicorp.com
|
||||
destinations:
|
||||
- namespace: platform
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: vault
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: vault-transit
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: kube-system
|
||||
server: https://kubernetes.default.svc
|
||||
clusterResourceWhitelist:
|
||||
- group: ""
|
||||
kind: Namespace
|
||||
- group: "apiextensions.k8s.io"
|
||||
kind: CustomResourceDefinition
|
||||
- group: "rbac.authorization.k8s.io"
|
||||
kind: ClusterRole
|
||||
- group: "rbac.authorization.k8s.io"
|
||||
kind: ClusterRoleBinding
|
||||
- group: "admissionregistration.k8s.io"
|
||||
kind: MutatingWebhookConfiguration
|
||||
namespaceResourceWhitelist:
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- group: ""
|
||||
kind: Service
|
||||
- group: ""
|
||||
kind: ServiceAccount
|
||||
- group: ""
|
||||
kind: PersistentVolumeClaim
|
||||
- group: "bitnami.com"
|
||||
kind: SealedSecret
|
||||
- group: "rbac.authorization.k8s.io"
|
||||
kind: Role
|
||||
- group: "rbac.authorization.k8s.io"
|
||||
kind: RoleBinding
|
||||
- group: "apps"
|
||||
kind: Deployment
|
||||
- group: "apps"
|
||||
kind: StatefulSet
|
||||
- group: "apps"
|
||||
kind: ReplicaSet
|
||||
- group: "autoscaling"
|
||||
kind: HorizontalPodAutoscaler
|
||||
- group: "batch"
|
||||
kind: Job
|
||||
- group: "networking.k8s.io"
|
||||
kind: Ingress
|
||||
- group: "networking.k8s.io"
|
||||
kind: NetworkPolicy
|
||||
- group: "policy"
|
||||
kind: PodDisruptionBudget
|
||||
orphanedResources:
|
||||
warn: true
|
||||
@@ -0,0 +1,50 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: apps-prod
|
||||
namespace: argocd
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
description: Prod application workloads managed by Argo CD
|
||||
sourceRepos:
|
||||
- https://github.com/DongHyeonka/Project-Auth-GitOps
|
||||
destinations:
|
||||
- namespace: auth-prod
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: api-prod
|
||||
server: https://kubernetes.default.svc
|
||||
clusterResourceWhitelist:
|
||||
- group: ""
|
||||
kind: Namespace
|
||||
namespaceResourceWhitelist:
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- group: ""
|
||||
kind: Service
|
||||
- group: ""
|
||||
kind: ServiceAccount
|
||||
- group: ""
|
||||
kind: PersistentVolumeClaim
|
||||
- group: "bitnami.com"
|
||||
kind: SealedSecret
|
||||
- group: "apps"
|
||||
kind: Deployment
|
||||
- group: "apps"
|
||||
kind: StatefulSet
|
||||
- group: "apps"
|
||||
kind: ReplicaSet
|
||||
- group: "autoscaling"
|
||||
kind: HorizontalPodAutoscaler
|
||||
- group: "batch"
|
||||
kind: Job
|
||||
- group: "networking.k8s.io"
|
||||
kind: Ingress
|
||||
- group: "networking.k8s.io"
|
||||
kind: NetworkPolicy
|
||||
- group: "policy"
|
||||
kind: PodDisruptionBudget
|
||||
orphanedResources:
|
||||
warn: true
|
||||
@@ -0,0 +1,61 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: AppProject
|
||||
metadata:
|
||||
name: infra-prod
|
||||
namespace: argocd
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
description: Prod shared infrastructure managed by Argo CD
|
||||
sourceRepos:
|
||||
- https://github.com/DongHyeonka/Project-Auth-GitOps
|
||||
- https://bitnami-labs.github.io/sealed-secrets
|
||||
destinations:
|
||||
- namespace: platform-prod
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: kube-system
|
||||
server: https://kubernetes.default.svc
|
||||
clusterResourceWhitelist:
|
||||
- group: ""
|
||||
kind: Namespace
|
||||
- group: "apiextensions.k8s.io"
|
||||
kind: CustomResourceDefinition
|
||||
- group: "rbac.authorization.k8s.io"
|
||||
kind: ClusterRole
|
||||
- group: "rbac.authorization.k8s.io"
|
||||
kind: ClusterRoleBinding
|
||||
namespaceResourceWhitelist:
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- group: ""
|
||||
kind: Service
|
||||
- group: ""
|
||||
kind: ServiceAccount
|
||||
- group: ""
|
||||
kind: PersistentVolumeClaim
|
||||
- group: "bitnami.com"
|
||||
kind: SealedSecret
|
||||
- group: "rbac.authorization.k8s.io"
|
||||
kind: Role
|
||||
- group: "rbac.authorization.k8s.io"
|
||||
kind: RoleBinding
|
||||
- group: "apps"
|
||||
kind: Deployment
|
||||
- group: "apps"
|
||||
kind: StatefulSet
|
||||
- group: "apps"
|
||||
kind: ReplicaSet
|
||||
- group: "autoscaling"
|
||||
kind: HorizontalPodAutoscaler
|
||||
- group: "batch"
|
||||
kind: Job
|
||||
- group: "networking.k8s.io"
|
||||
kind: Ingress
|
||||
- group: "networking.k8s.io"
|
||||
kind: NetworkPolicy
|
||||
- group: "policy"
|
||||
kind: PodDisruptionBudget
|
||||
orphanedResources:
|
||||
warn: true
|
||||
Reference in New Issue
Block a user