refactor: 폴더 구조 변경

2026-08-02 00:22:19 +09:00
parent f9c463f87a
commit be2f8e4863
1869 changed files with 4565 additions and 295591 deletions
@@ -0,0 +1,5 @@
+# gitops/apps/identity-postgres AGENTS
+
+Stateful data services live here. Read the storage, backup, security, and
+component standard before changing a StatefulSet, Tenant, PVC, or retention
+policy. Environment storage classes and deletion behavior belong in overlays.
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: identity-postgres-initdb
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/version: "16.4"
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+data:
+  01-create-databases.sh: |
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    KEYCLOAK_DB_PASSWORD="$(cat /run/secrets/keycloak-db/password)"
+    AUTH_SERVER_DB_PASSWORD="$(cat /run/secrets/auth-server-db/SPRING_DATASOURCE_PASSWORD)"
+
+    psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-'SQL'
+    CREATE ROLE keycloak LOGIN;
+    CREATE DATABASE keycloak OWNER keycloak;
+    CREATE ROLE auth_server LOGIN;
+    CREATE DATABASE auth_server OWNER auth_server;
+    SQL
+
+    psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
+      -c "ALTER ROLE keycloak PASSWORD '$(printf '%s' "$KEYCLOAK_DB_PASSWORD" | sed "s/'/''/g")';"
+    psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
+      -c "ALTER ROLE auth_server PASSWORD '$(printf '%s' "$AUTH_SERVER_DB_PASSWORD" | sed "s/'/''/g")';"
@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - serviceaccount.yaml
+  - configmap-initdb.yaml
+  - service-headless.yaml
+  - service.yaml
+  - statefulset.yaml
+labels:
+  - pairs:
+      app.kubernetes.io/name: identity-postgres
+      app.kubernetes.io/instance: identity-postgres
+      app.kubernetes.io/version: "16.4"
+      app.kubernetes.io/component: database
+      app.kubernetes.io/part-of: auth-platform
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false
+    includeTemplates: true
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: identity-postgres-headless
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/version: "16.4"
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  clusterIP: None
+  selector:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres
+      protocol: TCP
+      appProtocol: postgresql
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: identity-postgres
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/version: "16.4"
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres
+      protocol: TCP
+      appProtocol: postgresql
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: identity-postgres-sa
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/version: "16.4"
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+automountServiceAccountToken: false
@@ -0,0 +1,174 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: identity-postgres
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/version: "16.4"
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  replicas: 1
+  serviceName: identity-postgres-headless
+  podManagementPolicy: OrderedReady
+  updateStrategy:
+    type: RollingUpdate
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: identity-postgres
+      app.kubernetes.io/instance: identity-postgres
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: identity-postgres
+        app.kubernetes.io/instance: identity-postgres
+        app.kubernetes.io/version: "16.4"
+        app.kubernetes.io/component: database
+        app.kubernetes.io/part-of: auth-platform
+        app.kubernetes.io/managed-by: kustomize
+    spec:
+      serviceAccountName: identity-postgres-sa
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+        runAsGroup: 999
+        fsGroup: 999
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: postgres
+          image: postgres:16.4
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          env:
+            - name: POSTGRES_DB
+              value: postgres
+            - name: POSTGRES_USER_FILE
+              value: /run/secrets/superuser/username
+            - name: POSTGRES_PASSWORD_FILE
+              value: /run/secrets/superuser/password
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+            - name: KEYCLOAK_DB_PASSWORD_FILE
+              value: /run/secrets/keycloak-db/password
+            - name: AUTH_SERVER_DB_PASSWORD_FILE
+              value: /run/secrets/auth-server-db/SPRING_DATASOURCE_PASSWORD
+          resources:
+            requests:
+              cpu: 500m
+              memory: 1Gi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          startupProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -U "$(cat "$POSTGRES_USER_FILE")"
+            periodSeconds: 5
+            failureThreshold: 60
+            timeoutSeconds: 3
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -U "$(cat "$POSTGRES_USER_FILE")"
+            periodSeconds: 10
+            failureThreshold: 3
+            timeoutSeconds: 3
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -U "$(cat "$POSTGRES_USER_FILE")"
+            periodSeconds: 30
+            failureThreshold: 3
+            timeoutSeconds: 3
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 999
+            runAsGroup: 999
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+            - name: initdb
+              mountPath: /docker-entrypoint-initdb.d
+              readOnly: true
+            - name: superuser
+              mountPath: /run/secrets/superuser
+              readOnly: true
+            - name: keycloak-db
+              mountPath: /run/secrets/keycloak-db
+              readOnly: true
+            - name: auth-server-db
+              mountPath: /run/secrets/auth-server-db
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+            - name: run
+              mountPath: /var/run/postgresql
+      volumes:
+        - name: initdb
+          configMap:
+            name: identity-postgres-initdb
+            defaultMode: 0755
+        - name: superuser
+          secret:
+            secretName: identity-postgres-superuser
+            defaultMode: 0400
+        - name: keycloak-db
+          secret:
+            secretName: keycloak-db
+            defaultMode: 0400
+        - name: auth-server-db
+          secret:
+            secretName: auth-server-db
+            defaultMode: 0400
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 128Mi
+        - name: run
+          emptyDir:
+            medium: Memory
+            sizeLimit: 64Mi
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+        labels:
+          app.kubernetes.io/name: identity-postgres
+          app.kubernetes.io/instance: identity-postgres
+          app.kubernetes.io/version: "16.4"
+          app.kubernetes.io/component: database
+          app.kubernetes.io/part-of: auth-platform
+          app.kubernetes.io/managed-by: kustomize
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: replace-in-overlay
+        volumeMode: Filesystem
+        resources:
+          requests:
+            storage: 5Gi
@@ -0,0 +1,23 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - ../../base
+  - networkpolicy.yaml
+
+patches:
+  - target:
+      kind: StatefulSet
+      name: identity-postgres
+    patch: |-
+      - op: replace
+        path: /spec/persistentVolumeClaimRetentionPolicy/whenDeleted
+        value: Delete
+      - op: replace
+        path: /spec/persistentVolumeClaimRetentionPolicy/whenScaled
+        value: Delete
+      - op: replace
+        path: /spec/volumeClaimTemplates/0/spec/storageClassName
+        value: local-path
@@ -0,0 +1,34 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: identity-postgres-ingress-clients
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: identity-postgres
+      app.kubernetes.io/instance: identity-postgres
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/managed-by: keycloak-operator
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: auth-server
+              app.kubernetes.io/instance: auth-server
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: auth-server
+              app.kubernetes.io/instance: auth-server-migrate-0-1-0
+      ports:
+        - protocol: TCP
+          port: 5432