refactor: 폴더 구조 변경
This commit is contained in:
donghyeon-ka
@@ -0,0 +1,45 @@
|
||||
# gitops/clusters AGENTS
|
||||
|
||||
Role:
|
||||
- own environment-specific Kustomize composition
|
||||
- express only the differences between environments and reusable bases
|
||||
- make environment-level render, diff, apply, audit, and GitOps sync straightforward
|
||||
|
||||
Scope:
|
||||
- `<environment>/<region-or-cluster>/stages/`
|
||||
- `<environment>/<region-or-cluster>/all/`
|
||||
|
||||
Allowed:
|
||||
- namespace selection
|
||||
- replicas
|
||||
- resource requests/limits overrides
|
||||
- image tags or image references
|
||||
- ingress host/TLS differences
|
||||
- environment-specific patches
|
||||
- environment-specific secret references
|
||||
- storage class and retention differences
|
||||
|
||||
Forbidden:
|
||||
- copying full base manifests into overlays
|
||||
- redefining base resources wholesale without a clear environment-only reason
|
||||
- placing production secret values in Git
|
||||
- changing service ownership or workload kind without updating the base and standards
|
||||
- mixing multiple environments in one overlay
|
||||
|
||||
Read first:
|
||||
- `/docs/standards/infra/kustomize.md`
|
||||
- `/docs/standards/infra/architecture-environments.md`
|
||||
- `/docs/standards/infra/config-and-secrets.md`
|
||||
- `/docs/standards/infra/network-ingress-tls.md`
|
||||
- `/docs/standards/infra/resources-probes-availability.md`
|
||||
- `/docs/standards/infra/security-hardening.md`
|
||||
- `/docs/standards/infra/operations-runbook-upgrade-rollback.md`
|
||||
|
||||
Rules:
|
||||
- cluster entrypoints are environment-first by design
|
||||
- `stages/*` are deployable entrypoints; `all/` is validation-only
|
||||
- controller readiness and one-shot completion belong between stage applies
|
||||
- keep patches small and named by target and intent
|
||||
- render and diff the target environment before apply
|
||||
- prod overlays must be the most conservative environment
|
||||
- if an overlay starts re-declaring most of a resource, move common shape back into its catalog `base`
|
||||
@@ -0,0 +1,37 @@
|
||||
# Cluster Entrypoints
|
||||
|
||||
클러스터별 최종 desired state 진입점입니다. GitOps controller의 root는 이
|
||||
디렉터리 아래 **하나의 실제 cluster leaf**만 가리킵니다.
|
||||
|
||||
소규모:
|
||||
|
||||
```text
|
||||
clusters/
|
||||
└── dev/
|
||||
└── main/
|
||||
└── kustomization.yaml
|
||||
```
|
||||
|
||||
다중 환경·리전:
|
||||
|
||||
```text
|
||||
clusters/
|
||||
├── dev/ap-northeast-2/dev-a/
|
||||
├── staging/ap-northeast-2/staging-a/
|
||||
└── prod/
|
||||
├── ap-northeast-2/prod-a/
|
||||
└── ap-southeast-1/prod-b/
|
||||
```
|
||||
|
||||
cluster leaf에는 catalog 구현을 복사하지 않고 선택 목록과 cluster 고유 patch만
|
||||
둡니다. 계정 또는 조직 경계가 필요하면 경로 segment를 추가할 수 있지만 자동화가
|
||||
고정 depth에 의존하지 않도록 합니다.
|
||||
|
||||
`_template`을 실제 경로로 복사해 시작합니다.
|
||||
|
||||
## Current lab exception
|
||||
|
||||
`lab/main`은 CRD, Vault, Secret과 one-shot operation의 readiness 경계 때문에
|
||||
단일 direct leaf 대신 `namespaces`와 ordered `stages/*` leaf를 사용합니다.
|
||||
현재는 `scripts/bin/bootstrap.sh`가 순서를 보장합니다. `all/`은 감사
|
||||
aggregate이므로 controller root로 지정하거나 apply하지 않습니다.
|
||||
@@ -0,0 +1,31 @@
|
||||
# __REPLACE_ME_CLUSTER_NAME__
|
||||
|
||||
## 대상
|
||||
|
||||
- Environment: __REPLACE_ME_ENVIRONMENT__
|
||||
- Region: __REPLACE_ME_REGION__
|
||||
- Cluster: __REPLACE_ME_CLUSTER_NAME__
|
||||
- Owner: __REPLACE_ME_OWNER__
|
||||
|
||||
## 구성
|
||||
|
||||
`kustomization.yaml`의 `resources`에 필요한 platform, policy, tenant와 app의
|
||||
base 또는 overlay를 추가합니다. 예:
|
||||
|
||||
```yaml
|
||||
resources:
|
||||
- ../../../platform/core/base
|
||||
- ../../../policies/baseline/base
|
||||
- ../../../apps/example-api/overlays/prod
|
||||
```
|
||||
|
||||
위 예시는 `clusters/dev/main` 경로를 기준으로 합니다. 실제 상대 경로는 cluster
|
||||
leaf 깊이에 맞게 조정합니다.
|
||||
|
||||
## 규칙
|
||||
|
||||
- 이 디렉터리가 해당 클러스터의 유일한 root입니다.
|
||||
- 공통 manifest를 복사하지 않습니다.
|
||||
- 클러스터 고유 차이만 local patch로 둡니다.
|
||||
- dependency/sync 순서와 장애 시 reconcile 중지 절차를 문서화합니다.
|
||||
- `_template` 자체를 GitOps controller에 연결하지 않습니다.
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
# Add reusable platform, policy, tenant and app paths after copying this template.
|
||||
resources: []
|
||||
@@ -0,0 +1,22 @@
|
||||
# lab / main cluster entrypoints
|
||||
|
||||
현재 `lab`은 readiness 경계를 가진 push-based staged deployment를 사용합니다.
|
||||
|
||||
```text
|
||||
namespaces
|
||||
stages/
|
||||
├── 00-platform
|
||||
├── 10-vault
|
||||
├── 20-secrets
|
||||
├── 30-data
|
||||
├── 35-registry
|
||||
├── 40-operations
|
||||
└── 50-apps
|
||||
```
|
||||
|
||||
- `namespaces`와 각 stage는 독립적으로 렌더 가능한 cluster 배포 entrypoint입니다.
|
||||
- `scripts/bin/bootstrap.sh lab`만 준비 상태를 확인하며 순차 적용합니다.
|
||||
- `all/`은 모든 stage를 합친 감사용 Kustomization입니다. apply하거나 GitOps
|
||||
controller root로 연결하지 않습니다.
|
||||
- Argo CD를 채택하면 stage별 Application/sync-wave/health gate를, Flux를
|
||||
채택하면 Kustomization `dependsOn`/`healthChecks`를 먼저 설계한 뒤 전환합니다.
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
# Audit/render entrypoint only. Do not apply this aggregate: controllers and
|
||||
# one-shot operations have readiness boundaries that Kustomize cannot express.
|
||||
resources:
|
||||
- ../stages/00-platform
|
||||
- ../stages/10-vault
|
||||
- ../stages/20-secrets
|
||||
- ../stages/30-data
|
||||
- ../stages/35-registry
|
||||
- ../stages/40-operations
|
||||
- ../stages/50-apps
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
# Namespace creation is a separate cluster entrypoint because server-side
|
||||
# dry-run cannot create a Namespace and validate namespaced resources against
|
||||
# it in the same request.
|
||||
resources:
|
||||
- ../../../../tenants/mnt/base
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
example.com/environment: lab
|
||||
example.com/owner-team: platform
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
# Cluster prerequisites and the deny-by-default policy are applied before any
|
||||
# workload. This stage is intentionally free of application CRs.
|
||||
resources:
|
||||
- ../../../../../tenants/mnt/base
|
||||
- ../../../../../platform/cert-manager/overlays/lab
|
||||
- ../../../../../platform/keycloak-operator/overlays/lab
|
||||
- ../../../../../platform/traefik/overlays/lab
|
||||
- ../../../../../policies/baseline/overlays/lab
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
example.com/environment: lab
|
||||
example.com/owner-team: platform
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../../../platform/vault/overlays/lab
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
example.com/environment: lab
|
||||
example.com/owner-team: platform
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
# The VSO controller is installed by the bootstrap task before this stage.
|
||||
resources:
|
||||
- ../../../../../platform/secret-delivery/overlays/lab/operator
|
||||
- ../../../../../platform/secret-delivery/overlays/lab/identity
|
||||
- ../../../../../platform/secret-delivery/overlays/lab/storage
|
||||
- ../../../../../platform/secret-delivery/overlays/lab/apps
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
example.com/environment: lab
|
||||
example.com/owner-team: platform
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../../../apps/identity-postgres/overlays/lab
|
||||
- ../../../../../platform/minio/overlays/lab
|
||||
- ../../../../../platform/keycloak/overlays/lab
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
example.com/environment: lab
|
||||
example.com/owner-team: platform
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../../../platform/secret-delivery/overlays/lab/storage/registry-minio
|
||||
- ../../../../../platform/registry/overlays/lab
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
example.com/environment: lab
|
||||
example.com/owner-team: platform
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
# One-shot resources. bootstrap.sh waits for their prerequisites before apply.
|
||||
resources:
|
||||
- ../../../../../apps/auth-migration/overlays/lab
|
||||
- ../../../../../apps/keycloak-realm-import/overlays/lab
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
example.com/environment: lab
|
||||
example.com/owner-team: platform
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../../../apps/auth-server/overlays/lab
|
||||
- ../../../../../platform/forward-auth/overlays/lab
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
example.com/environment: lab
|
||||
example.com/owner-team: platform
|
||||
includeSelectors: false
|
||||
includeTemplates: true
|
||||
Reference in New Issue
Block a user