refactor: 폴더 구조 변경

AGENTS.md

@@ -11,26 +11,38 @@ Read order:
 > **WARNING TO AI AGENTS**: You MUST READ the files in `/docs/standards/infra/` and `/docs/examples/infra/` using your file reading tools BEFORE proposing or writing any K8s manifests. DO NOT rely on generic Kubernetes knowledge. The standard documents contain mandatory strict rules (e.g., probe settings, security contexts, non-root constraints, resource limits, namespace strategies) that MUST be hardcoded into your output. Generating plain boilerplate YAML without strict standards compliance is a critical failure.
 
 Repo role:
-- this repository owns Kubernetes/K3s infrastructure source
-- source of truth is Git + Kustomize directories under `k8s/`
+- this repository owns infrastructure lifecycle and Kubernetes/K3s desired state
+- source of truth is Git + IaC under `infrastructure/` + Kustomize under `gitops/`
 - scripts are helper tools, not the source of truth
 - runtime cluster state or server-local manifest files are not authoritative
 
 Primary directories:
-- `k8s/base/`: environment-neutral Kustomize bases
-- `k8s/base/app/`: application-facing workload units
-- `k8s/base/managing/`: management/operations units such as bootstrap, migration, backup, restore, and admin jobs
-- `k8s/base/plugins/`: platform/plugin-style base resources
-- `k8s/overlays/<env>/`: environment overlays such as `dev`, `staging`, and `prod`
-- `k8s/scripts/`: render, diff, apply, validate, backup, and restore helpers
+- `bootstrap/`: foundation and selected GitOps controller bootstrap
+- `infrastructure/components/`: reusable IaC primitives
+- `infrastructure/stacks/`: optional reusable compositions
+- `infrastructure/live/`: the only IaC plan/apply and state entrypoints
+- `gitops/apps/`: app-owned workloads, data, and one-shot operations
+- `gitops/platform/`: shared services, operators, ingress, mesh, storage, and secret delivery
+- `gitops/policies/`: reusable governance and security policy
+- `gitops/tenants/`: namespace, RBAC, quota, and tenant boundaries
+- `gitops/clusters/<env>/<cluster>/namespaces` and `stages/`: current deployable Kubernetes entrypoints
+- `gitops/clusters/<env>/<cluster>/all/`: render/audit aggregate; never apply it
+- `scripts/`: render, diff, apply, validate, backup, and restore helpers
 - `docs/standards/infra/`: infra standards
 - `docs/examples/infra/`: approved examples
 
+Current runtime exception:
+- `lab` has no Argo CD/Flux controller; `scripts/bin/bootstrap.sh` applies the
+  cluster `namespaces` entrypoint and ordered `stages/*`; `all/` remains audit-only
+
 Structure principle:
-- `k8s/base` is organized by operational ownership and workload role, not by environment.
-- `k8s/overlays` is organized by environment first, so large fleets can be rendered, diffed, applied, and audited environment-by-environment.
-- This repo intentionally does not use the small-project “each service owns its own base and overlays” pattern as the primary layout.
-- Service ownership still exists under `k8s/base/app/<domain>/<workload>/**`; environment rollout ownership lives under `k8s/overlays/<env>`.
+- catalogs are organized by ownership; every unit may contain an environment-neutral `base` and focused `overlays/<env>`
+- catalog directories are never deployment/controller roots
+- `infrastructure/live` and `gitops/clusters` are environment-first entrypoint trees
+- current `lab` rollout ownership lives under `gitops/clusters/lab/main/namespaces`
+  and `gitops/clusters/lab/main/stages`
+- `_template` is copied to start new units and is never imported by live/cluster roots
+- approved manifest examples live only under `docs/examples/infra`
 
 Hard bans:
 - do not treat `/var/lib/rancher/k3s/server/manifests` as source of truth
@@ -38,6 +50,7 @@ Hard bans:
 - do not put production secrets in Git/plain manifests
 - do not bypass Kustomize with ad-hoc generated YAML as the primary path
 - do not mix app rollout, DB migration, and control-plane upgrade in one opaque step
+- do not apply `gitops/clusters/<env>/<cluster>/all`; deploy ordered stage entrypoints
 - do not expose health, metrics, admin, or management endpoints publicly by default
 - do not use `hostPath` as an operating default
 - do not use `start-dev`/dev-mode style configs for production components
@@ -84,16 +97,17 @@ Component routing:
   -> `/docs/standards/infra/flyway.md`
 
 Before editing:
-- identify target environment: dev / staging / prod
-- identify target unit: app / managing / plugin / script / docs
-- identify whether the change belongs in `k8s/base`, `k8s/overlays/<env>`, `k8s/scripts`, or docs
+- identify target environment: lab / staging / prod
+- identify target unit: app / data / platform / operation / script / docs
+- identify whether the change belongs in `bootstrap`, `infrastructure`, a `gitops` catalog,
+  `gitops/clusters`, `scripts`, or docs
 - identify workload type: Deployment / StatefulSet / Job / CronJob
 - identify whether storage, secret delivery, ingress, migration, or rollback path changes
 - identify whether the change touches a K3s-specific rule
 
 Default execution flow:
 - read the owning standard first
-- prefer changing Kustomize source under `k8s/` over live cluster state
+- prefer changing IaC/Kustomize source under `infrastructure/` or `gitops/` over live state
 - prefer render -> validate -> diff -> apply thinking
 - prefer explicit rollback/restore path before risky changes