refactor: 폴더 구조 변경

2026-08-02 00:22:19 +09:00
parent f9c463f87a
commit be2f8e4863
1869 changed files with 4565 additions and 295591 deletions
@@ -0,0 +1,5 @@
+# gitops/apps/auth-migration AGENTS
+
+Jobs and CronJobs live here. Operations are versioned, independently runnable
+units and must not be hidden inside an application base. Define completion,
+retry, timeout, rollback, and rerun semantics before changing them.
@@ -0,0 +1,80 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: auth-server-migrate-sql
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server-migrate-0-1-0
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: migration
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+data:
+  V1__create_users_table.sql: |
+    create schema if not exists auth;
+
+    create or replace function auth.set_updated_at()
+    returns trigger as $$
+    begin
+        new.updated_at := current_timestamp;
+        return new;
+    end;
+    $$ language plpgsql;
+
+    create table auth.users (
+        id uuid not null,
+        email text not null,
+        encoded_password text not null,
+        name text not null,
+        provider text not null,
+        created_at timestamp with time zone not null default current_timestamp,
+        updated_at timestamp with time zone not null default current_timestamp,
+        constraint pk_users primary key (id),
+        constraint uq_users__email unique (email),
+        constraint ck_users__provider check (provider in ('LOCAL', 'GOOGLE', 'GITHUB'))
+    );
+
+    create index ix_users__created_at on auth.users (created_at);
+
+    create trigger trg_users__set_updated_at
+    before update on auth.users
+    for each row
+    when (old.* is distinct from new.*)
+    execute function auth.set_updated_at();
+  V2__add_oauth_login_columns.sql: |
+    alter table auth.users alter column encoded_password drop not null;
+
+    alter table auth.users add column provider_subject text;
+
+    alter table auth.users
+        add constraint uq_users__provider_provider_subject unique (provider, provider_subject);
+  V3__add_user_provider_field_constraints.sql: |
+    alter table auth.users
+        add constraint ck_users__local_password_required
+            check (
+                (provider = 'LOCAL' and encoded_password is not null and provider_subject is null)
+                or (provider <> 'LOCAL')
+            );
+
+    alter table auth.users
+        add constraint ck_users__social_subject_required
+            check (
+                (provider <> 'LOCAL' and provider_subject is not null and encoded_password is null)
+                or (provider = 'LOCAL')
+            );
+  V4__add_keycloak_provider.sql: |
+    alter table auth.users drop constraint ck_users__provider;
+
+    alter table auth.users
+        add constraint ck_users__provider check (provider in ('LOCAL', 'KEYCLOAK', 'GOOGLE', 'GITHUB'));
+  V5__keycloak_only_provider.sql: |
+    alter table auth.users drop constraint if exists ck_users__local_password_required;
+    alter table auth.users drop constraint if exists ck_users__social_subject_required;
+    alter table auth.users drop constraint if exists ck_users__provider;
+
+    alter table auth.users drop column if exists encoded_password;
+
+    alter table auth.users alter column provider_subject set not null;
+
+    alter table auth.users
+        add constraint ck_users__provider check (provider = 'KEYCLOAK');
@@ -0,0 +1,119 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: auth-server-migrate-0-1-0
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server-migrate-0-1-0
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: migration
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  parallelism: 1
+  completions: 1
+  backoffLimit: 0
+  activeDeadlineSeconds: 1800
+  ttlSecondsAfterFinished: 86400
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: auth-server
+        app.kubernetes.io/instance: auth-server-migrate-0-1-0
+        app.kubernetes.io/version: "0.1.0"
+        app.kubernetes.io/component: migration
+        app.kubernetes.io/part-of: auth-platform
+        app.kubernetes.io/managed-by: kustomize
+    spec:
+      serviceAccountName: auth-server-migrate-sa
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        - name: flyway-info
+          image: flyway/flyway:10.20.1
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c"]
+          args: ["FLYWAY_USER=\"$(cat /run/secrets/db/SPRING_DATASOURCE_USERNAME)\" FLYWAY_PASSWORD=\"$(cat /run/secrets/db/SPRING_DATASOURCE_PASSWORD)\" exec /flyway/flyway info"]
+          env: &flywayEnv
+            - name: FLYWAY_URL
+              value: jdbc:postgresql://identity-postgres:5432/auth_server
+            - name: FLYWAY_LOCATIONS
+              value: filesystem:/flyway/sql
+            - name: FLYWAY_SCHEMAS
+              value: auth
+            - name: FLYWAY_DEFAULT_SCHEMA
+              value: auth
+            - name: FLYWAY_TABLE
+              value: flyway_schema_history
+            - name: FLYWAY_VALIDATE_ON_MIGRATE
+              value: "true"
+            - name: FLYWAY_BASELINE_ON_MIGRATE
+              value: "false"
+            - name: FLYWAY_OUT_OF_ORDER
+              value: "false"
+            - name: FLYWAY_MIXED
+              value: "false"
+            - name: FLYWAY_CLEAN_DISABLED
+              value: "true"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              memory: 256Mi
+          securityContext: &flywaySC
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts: &flywayVM
+            - name: sql
+              mountPath: /flyway/sql
+              readOnly: true
+            - name: db-secret
+              mountPath: /run/secrets/db
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      containers:
+        - name: flyway-migrate
+          image: flyway/flyway:10.20.1
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c"]
+          args: ["FLYWAY_USER=\"$(cat /run/secrets/db/SPRING_DATASOURCE_USERNAME)\" FLYWAY_PASSWORD=\"$(cat /run/secrets/db/SPRING_DATASOURCE_PASSWORD)\" exec /flyway/flyway migrate"]
+          env: *flywayEnv
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              memory: 512Mi
+          securityContext: *flywaySC
+          volumeMounts: *flywayVM
+      volumes:
+        - name: sql
+          configMap:
+            name: auth-server-migrate-sql
+        - name: db-secret
+          secret:
+            secretName: auth-server-db
+            defaultMode: 0400
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 128Mi
@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - serviceaccount.yaml
+  - configmap-sql.yaml
+  - job.yaml
+labels:
+  - pairs:
+      app.kubernetes.io/name: auth-server
+      app.kubernetes.io/instance: auth-server-migrate-0-1-0
+      app.kubernetes.io/version: "0.1.0"
+      app.kubernetes.io/component: migration
+      app.kubernetes.io/part-of: auth-platform
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false
+    includeTemplates: true
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: auth-server-migrate-sa
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server-migrate-0-1-0
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: migration
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+automountServiceAccountToken: false
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - ../../base
+  - networkpolicy.yaml
@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-server-migrate-egress-postgres
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server-migrate-0-1-0
+    app.kubernetes.io/component: migration
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: auth-server
+      app.kubernetes.io/instance: auth-server-migrate-0-1-0
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: identity-postgres
+              app.kubernetes.io/instance: identity-postgres
+      ports:
+        - protocol: TCP
+          port: 5432