refactor: 폴더 구조 변경

scripts/bin/bootstrap.sh

@@ -0,0 +1,305 @@
+#!/usr/bin/env bash
+# Deploy one environment through explicit readiness boundaries.
+#
+# Kustomize stages are the deployment contract:
+#   namespaces -> 00-platform -> 10-vault -> 20-secrets
+#              -> 30-data -> MinIO credential provisioning -> 35-registry
+#              -> 40-operations -> 50-apps
+#
+# `gitops/clusters/<env>/main/all` is deliberately not applied. It exists only for local
+# render, schema, and policy validation because Kustomize cannot express CRD
+# establishment, controller readiness, Vault initialization, or one-shot Job
+# completion.
+
+set -Eeuo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../lib/common.sh
+. "$SCRIPT_DIR/../lib/common.sh"
+
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+GITOPS_ROOT="$REPO_ROOT/gitops"
+TASKS_DIR="$SCRIPT_DIR/../tasks"
+FIELD_MANAGER="project-infra-bootstrap"
+NAMESPACE="mnt"
+export REPO_ROOT
+
+VSO_MANAGED_SECRETS=(
+  identity-postgres-superuser
+  keycloak-db
+  keycloak-db-operator
+  auth-server-db
+  keycloak-bootstrap-admin
+  keycloak-bootstrap-admin-operator
+  keycloak-client-auth-server-ingress
+  oauth2-proxy-secrets
+  minio-tenant-env
+  docker-registry-minio
+  docker-registry-basic-auth
+  docker-registry-pull-credentials
+)
+
+PRE_DATA_SECRETS=(
+  identity-postgres-superuser
+  keycloak-db
+  keycloak-db-operator
+  auth-server-db
+  keycloak-bootstrap-admin
+  keycloak-bootstrap-admin-operator
+  keycloak-client-auth-server-ingress
+  oauth2-proxy-secrets
+  minio-tenant-env
+  docker-registry-basic-auth
+  docker-registry-pull-credentials
+)
+
+usage() {
+  cat >&2 <<'EOF'
+Usage: scripts/bin/bootstrap.sh <lab|staging|prod>
+
+The selected overlay must exist. The repository currently ships `lab`.
+
+Required:
+  KUBE_CONTEXT_<ENV> or KUBE_CONTEXT  Expected kubectl context
+
+Options:
+  VAULT_KEYS_FILE=<path>      Vault init result. prod requires a path outside the repo
+  RESET_STALE_SECRETS=yes     Delete VSO-managed Kubernetes Secrets before resync
+  ALLOW_PROD_SECRET_RESET=yes Required with RESET_STALE_SECRETS=yes in prod
+  SKIP_DIFF=yes               Skip kubectl diff (not recommended)
+  CONFIRM=yes                 Approve each stage in non-interactive automation
+EOF
+  exit 1
+}
+
+render_entrypoint() {
+  local entrypoint="$1"
+  local output="$2"
+  kubectl kustomize "$entrypoint" >"$output"
+}
+
+apply_entrypoint() {
+  local label="$1"
+  local entrypoint="$2"
+  [[ -f "$entrypoint/kustomization.yaml" ]] \
+    || die "Kustomize entrypoint 없음: $entrypoint"
+
+  local tmpdir rendered rc=0
+  tmpdir="$(mktemp -d -t project-infra-bootstrap.XXXXXX)"
+  trap_cleanup_path "$tmpdir"
+  rendered="$tmpdir/rendered.yaml"
+
+  render_entrypoint "$entrypoint" "$rendered"
+  log "[$label] render 완료: $(grep -c '^kind:' "$rendered") resources"
+
+  if ! kubectl apply -f "$rendered" \
+    --dry-run=server \
+    --server-side \
+    --field-manager="$FIELD_MANAGER" \
+    >"$tmpdir/dry-run.out" 2>&1; then
+    err "[$label] server-side dry-run 실패"
+    sed 's/^/  /' "$tmpdir/dry-run.out" >&2
+    die "$label 검증 실패"
+  fi
+
+  if [[ "${SKIP_DIFF:-}" == "yes" ]]; then
+    warn "[$label] SKIP_DIFF=yes: diff 생략"
+  else
+    kubectl diff -f "$rendered" \
+      --server-side \
+      --field-manager="$FIELD_MANAGER" \
+      >"$tmpdir/diff.out" 2>&1 || rc=$?
+    case "$rc" in
+      0)
+        log "[$label] 변경 없음"
+        ;;
+      1)
+        log "[$label] diff"
+        sed 's/^/  /' "$tmpdir/diff.out" >&2
+        ;;
+      *)
+        err "[$label] kubectl diff 실패 (exit=$rc)"
+        sed 's/^/  /' "$tmpdir/diff.out" >&2
+        die "$label diff 실패"
+        ;;
+    esac
+  fi
+
+  confirm "[$label] env=$ENV_NAME context='$KUBE_CONTEXT_LOCKED' 에 적용합니까?" \
+    || die "사용자 취소"
+
+  kubectl apply -f "$rendered" \
+    --server-side \
+    --field-manager="$FIELD_MANAGER"
+}
+
+precheck_namespaces() {
+  local phase
+  ns_exists "$NAMESPACE" || return 0
+  phase="$(ns_phase "$NAMESPACE")"
+  [[ "$phase" != "Terminating" ]] \
+    || die "namespace '$NAMESPACE' 가 Terminating 상태입니다. teardown 복구를 먼저 완료하세요."
+}
+
+wait_platform_ready() {
+  log "cert-manager CRD / controller 준비 대기"
+  retry 30 2 kubectl wait --for=condition=Established --timeout=10s \
+    crd/certificates.cert-manager.io \
+    crd/clusterissuers.cert-manager.io
+  kubectl -n cert-manager rollout status deployment/cert-manager --timeout=300s
+  kubectl -n cert-manager rollout status deployment/cert-manager-webhook --timeout=300s
+  kubectl -n cert-manager rollout status deployment/cert-manager-cainjector --timeout=300s
+
+  log "Keycloak Operator 준비 대기"
+  retry 30 2 kubectl wait --for=condition=Established --timeout=10s \
+    crd/keycloaks.k8s.keycloak.org \
+    crd/keycloakrealmimports.k8s.keycloak.org
+  kubectl -n "$NAMESPACE" rollout status deployment/keycloak-operator --timeout=300s
+}
+
+install_helm_operators() {
+  log "MinIO Operator 설치"
+  ENV_NAME="$ENV_NAME" bash "$TASKS_DIR/minio-operator-install.sh"
+
+  log "Vault Secrets Operator 설치"
+  ENV_NAME="$ENV_NAME" bash "$TASKS_DIR/vso-install.sh"
+}
+
+wait_vault_running() {
+  log "Vault 초기화 전 pod/vault-0 Running 대기"
+  retry 3 10 kubectl -n "$NAMESPACE" wait \
+    --for=jsonpath='{.status.phase}'=Running \
+    pod/vault-0 \
+    --timeout=120s
+}
+
+initialize_and_seed_vault() {
+  log "Vault 초기화 / unseal / Kubernetes auth 구성"
+  ENV_NAME="$ENV_NAME" bash "$TASKS_DIR/vault-init.sh"
+
+  log "애플리케이션 Secret seed"
+  ENV_NAME="$ENV_NAME" bash "$TASKS_DIR/vault-seed-apps.sh"
+}
+
+reset_stale_secrets_if_requested() {
+  [[ "${RESET_STALE_SECRETS:-}" == "yes" ]] || return 0
+
+  if [[ "$ENV_NAME" == "prod" && "${ALLOW_PROD_SECRET_RESET:-}" != "yes" ]]; then
+    die "prod Secret 재생성은 ALLOW_PROD_SECRET_RESET=yes 가 추가로 필요합니다."
+  fi
+
+  warn "RESET_STALE_SECRETS=yes: VSO destination Secret 재생성"
+  local secret_name
+  for secret_name in "${VSO_MANAGED_SECRETS[@]}"; do
+    kubectl -n "$NAMESPACE" delete secret "$secret_name" --ignore-not-found
+  done
+}
+
+pre_data_secrets_ready() {
+  local secret_name
+  for secret_name in "${PRE_DATA_SECRETS[@]}"; do
+    kubectl -n "$NAMESPACE" get secret "$secret_name" >/dev/null 2>&1 || return 1
+  done
+}
+
+wait_secrets_ready() {
+  log "30-data 선행 VSO destination Secret 생성 대기"
+  retry 90 2 pre_data_secrets_ready
+}
+
+wait_data_ready() {
+  log "PostgreSQL 준비 대기"
+  kubectl -n "$NAMESPACE" rollout status statefulset/identity-postgres --timeout=600s
+
+  log "MinIO Tenant 준비 대기"
+  retry 24 5 kubectl -n "$NAMESPACE" wait --for=condition=Ready \
+    pod -l v1.min.io/tenant=minio --timeout=20s
+
+  log "Keycloak 준비 대기"
+  retry 24 5 kubectl -n "$NAMESPACE" wait --for=condition=Ready \
+    pod -l app.kubernetes.io/instance=keycloak --timeout=20s
+}
+
+provision_registry() {
+  log "docker-registry용 MinIO bucket / access key 구성"
+  ENV_NAME="$ENV_NAME" bash "$TASKS_DIR/minio-provision-registry.sh"
+
+  apply_entrypoint "35-registry" "$CLUSTER_ROOT/stages/35-registry"
+
+  log "docker-registry MinIO credential Secret 생성 대기"
+  retry 90 2 kubectl -n "$NAMESPACE" get secret docker-registry-minio
+  log "docker-registry 준비 대기"
+  kubectl -n "$NAMESPACE" rollout status deployment/docker-registry --timeout=300s
+}
+
+wait_operations_complete() {
+  log "Flyway migration 완료 대기"
+  kubectl -n "$NAMESPACE" wait --for=condition=Complete \
+    job/auth-server-migrate-0-1-0 --timeout=1800s
+
+  log "Keycloak realm import 완료 대기"
+  kubectl -n "$NAMESPACE" wait --for=condition=Done \
+    keycloakrealmimport/platform-realm-v1 --timeout=600s
+}
+
+wait_apps_ready() {
+  kubectl -n "$NAMESPACE" rollout status deployment/auth-server --timeout=600s
+  kubectl -n "$NAMESPACE" rollout status deployment/oauth2-proxy --timeout=300s
+}
+
+summary() {
+  log "============================================"
+  log "  $ENV_NAME staged bootstrap 완료"
+  log "============================================"
+  log "Vault init material: ${VAULT_KEYS_FILE:-$REPO_ROOT/vault-init-keys.json}"
+  log "이 파일은 Git에서 제외되지만 평문입니다. 오프라인 보관소로 이동하세요."
+  log "검증: kubectl -n $NAMESPACE get pods,jobs,vaultstaticsecrets"
+}
+
+main() {
+  ENV_NAME="${1:-}"
+  case "$ENV_NAME" in
+    lab | staging | prod) ;;
+    *) usage ;;
+  esac
+
+  CLUSTER_ROOT="$GITOPS_ROOT/clusters/$ENV_NAME/main"
+  NAMESPACE_ENTRYPOINT="$CLUSTER_ROOT/namespaces"
+  [[ -f "$CLUSTER_ROOT/all/kustomization.yaml" ]] \
+    || die "클러스터 entrypoint가 없습니다: $CLUSTER_ROOT"
+
+  require_cmd kubectl helm jq openssl mc curl
+  require_kube_context "$ENV_NAME"
+  precheck_namespaces
+
+  log "Project-Infra staged bootstrap: env=$ENV_NAME context=$KUBE_CONTEXT_LOCKED"
+
+  # Namespace first: a server-side dry-run cannot create a Namespace and
+  # validate namespaced resources against it in the same request.
+  apply_entrypoint "namespaces" "$NAMESPACE_ENTRYPOINT"
+  apply_entrypoint "00-platform" "$CLUSTER_ROOT/stages/00-platform"
+  wait_platform_ready
+  install_helm_operators
+
+  apply_entrypoint "10-vault" "$CLUSTER_ROOT/stages/10-vault"
+  wait_vault_running
+  initialize_and_seed_vault
+
+  reset_stale_secrets_if_requested
+  apply_entrypoint "20-secrets" "$CLUSTER_ROOT/stages/20-secrets"
+  wait_secrets_ready
+
+  apply_entrypoint "30-data" "$CLUSTER_ROOT/stages/30-data"
+  wait_data_ready
+  provision_registry
+
+  apply_entrypoint "40-operations" "$CLUSTER_ROOT/stages/40-operations"
+  wait_operations_complete
+
+  apply_entrypoint "50-apps" "$CLUSTER_ROOT/stages/50-apps"
+  wait_apps_ready
+  summary
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  main "$@"
+fi