init: 폴더구조 설계 및 인프라 설계

k8s/base/AGENTS.md

@@ -0,0 +1,38 @@
+# k8s/base AGENTS
+
+Role:
+- own environment-neutral Kustomize base resources
+- define reusable workload, namespace, service, storage, policy, and platform/plugin shapes
+- keep environment-specific values out of base
+
+Scope:
+- `app/`: application-facing base units
+- `managing/`: management and operational base units
+- `plugins/`: platform/plugin base resources
+
+Allowed:
+- shared labels/selectors
+- common workload shape
+- common probe/resource shape
+- common service/storage/policy shape
+- unit composition through nested `kustomization.yaml`
+
+Forbidden:
+- environment-specific hostnames
+- production-only replicas/resources
+- environment-specific secret values
+- direct references to a specific cluster context
+- overlay-only patches masquerading as base manifests
+
+Read first:
+- `/docs/standards/infra/kustomize.md`
+- `/docs/standards/infra/architecture-environments.md`
+- `/docs/standards/infra/workload-selection.md`
+- `/docs/standards/infra/config-and-secrets.md`
+- `/docs/standards/infra/security-hardening.md`
+
+Rules:
+- base must be reusable by dev, staging, and prod overlays
+- base may define default shape, but overlays own environment differences
+- unit ownership should be visible in path names
+- large fleets should stay navigable by role first, then domain/unit

k8s/base/README.md

@@ -0,0 +1,13 @@
+# Base Packages
+
+Base packages contain shared Kubernetes definitions.
+
+Boundaries:
+- `managing/` owns infrastructure management resources in the `mnt` namespace.
+- `app/` owns application namespace resources and large-scale workload package contracts.
+- `plugins/` owns plugin namespace resources.
+
+Rules:
+- Base packages must not contain environment-specific values.
+- A base package can be rendered with `kubectl kustomize` through its own `kustomization.yaml`.
+- Parent packages compose child packages; child packages own their internal Kubernetes object files.

k8s/base/app/AGENTS.md

@@ -0,0 +1,69 @@
+# k8s/base/app AGENTS
+
+Role:
+- own application-facing infrastructure base units
+- define environment-neutral app workload, service, config reference, secret reference, storage, network policy, probe, and resource shapes
+- organize many services by domain/service path directly under `k8s/base/app/<domain>/`
+
+Current structure:
+- domains sit directly under `k8s/base/app/` (`identity/`, `storage/`, `test/`)
+- inside each domain, separate by workload role (`stateful/`, `stateless/`)
+- example: `identity/auth/stateful/identity-postgres/`, `identity/auth/stateless/auth-server/`
+
+Allowed:
+- Kustomize base edits for application units
+- Deployment / StatefulSet / Job / CronJob base resources
+- Service / NetworkPolicy / PDB / HPA base resources
+- ConfigMap / Secret reference wiring without secret values
+- probe / resource / PVC / StorageClass reference shape
+- component-specific manifests aligned with standards
+
+Forbidden:
+- environment-specific values that belong in `k8s/overlays/<env>`
+- editing packaged K3s component manifests directly
+- treating server-local manifests as source of truth
+- embedding production secret values in Git
+- generating opaque YAML via script as the primary ownership path
+- merging unrelated app rollout + migration + cluster upgrade into one hidden change
+
+Read first:
+- `/docs/standards/infra/architecture-environments.md`
+- `/docs/standards/infra/kustomize.md`
+- `/docs/standards/infra/config-and-secrets.md`
+- `/docs/standards/infra/workload-selection.md`
+- `/docs/standards/infra/storage-pvc.md`
+- `/docs/standards/infra/network-ingress-tls.md`
+- `/docs/standards/infra/resources-probes-availability.md`
+- `/docs/standards/infra/security-hardening.md`
+- `/docs/standards/infra/observability-health.md`
+- `/docs/standards/infra/db-and-migration.md`
+
+Component-specific routing:
+- paths containing `keycloak` -> `/docs/standards/infra/keycloak.md`
+- paths containing `vault` -> `/docs/standards/infra/vault.md`
+- paths containing `minio` -> `/docs/standards/infra/minio.md`
+- paths containing `flyway` or migration jobs -> `/docs/standards/infra/flyway.md`
+
+Examples:
+- `/docs/examples/infra/kustomize.md`
+- `/docs/examples/infra/config-and-secrets.md`
+- `/docs/examples/infra/workload-selection.md`
+- `/docs/examples/infra/storage-pvc.md`
+- `/docs/examples/infra/network-ingress-tls.md`
+- `/docs/examples/infra/resources-probes-availability.md`
+- `/docs/examples/infra/security-hardening.md`
+- `/docs/examples/infra/observability-health.md`
+- `/docs/examples/infra/db-and-migration.md`
+- `/docs/examples/infra/keycloak.md`
+- `/docs/examples/infra/vault.md`
+- `/docs/examples/infra/minio.md`
+- `/docs/examples/infra/flyway.md`
+
+Rules:
+- base must stay environment-neutral
+- app services default to `ClusterIP`
+- public exposure must be explicit and added through overlays/ingress policy
+- health/metrics/admin endpoints stay non-public by default
+- DB migration must stay separate from app startup
+- stateful workloads must have explicit storage and restore reasoning
+- domain/unit nesting should make ownership clear for large service counts

k8s/base/app/README.md

@@ -0,0 +1,23 @@
+# Application Base
+
+This package owns the `app` namespace and the contract for application workloads.
+
+For large scale, workloads are grouped by unit, domain, workload kind, and workload:
+
+```text
+base/app/units/<unit>/<domain>/<workload-kind>/<workload>/
+```
+
+Examples:
+- `base/app/units/commerce/checkout/services/order-api/`
+- `base/app/units/commerce/checkout/workers/payment-settlement-worker/`
+- `base/app/units/identity/auth/schedulers/token-cleanup-scheduler/`
+- `base/app/units/data/storage/stateful/orders-postgres/`
+
+Rules:
+- The unit folder is the broad ownership boundary for a business unit, platform area, or organization.
+- The domain folder is the bounded context inside a unit.
+- The workload-kind folder groups similar operating models inside one domain.
+- The workload folder is the smallest independently deployable package.
+- Kubernetes object files stay together inside the workload package.
+- Shared namespace-level objects go in `shared/`.

k8s/base/app/identity/auth/stateful/identity-postgres/configmap-initdb.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: identity-postgres-initdb
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/version: "16.4"
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+data:
+  01-create-databases.sh: |
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    KEYCLOAK_DB_PASSWORD="$(cat /run/secrets/keycloak-db/password)"
+    AUTH_SERVER_DB_PASSWORD="$(cat /run/secrets/auth-server-db/SPRING_DATASOURCE_PASSWORD)"
+
+    psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-'SQL'
+    CREATE ROLE keycloak LOGIN;
+    CREATE DATABASE keycloak OWNER keycloak;
+    CREATE ROLE auth_server LOGIN;
+    CREATE DATABASE auth_server OWNER auth_server;
+    SQL
+
+    psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
+      -c "ALTER ROLE keycloak PASSWORD '$(printf '%s' "$KEYCLOAK_DB_PASSWORD" | sed "s/'/''/g")';"
+    psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
+      -c "ALTER ROLE auth_server PASSWORD '$(printf '%s' "$AUTH_SERVER_DB_PASSWORD" | sed "s/'/''/g")';"

k8s/base/app/identity/auth/stateful/identity-postgres/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - serviceaccount.yaml
+  - configmap-initdb.yaml
+  - service-headless.yaml
+  - service.yaml
+  - statefulset.yaml
+labels:
+  - pairs:
+      app.kubernetes.io/name: identity-postgres
+      app.kubernetes.io/instance: identity-postgres
+      app.kubernetes.io/version: "16.4"
+      app.kubernetes.io/component: database
+      app.kubernetes.io/part-of: auth-platform
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false
+    includeTemplates: true

k8s/base/app/identity/auth/stateful/identity-postgres/service-headless.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: identity-postgres-headless
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/version: "16.4"
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  clusterIP: None
+  selector:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres
+      protocol: TCP
+      appProtocol: postgresql

k8s/base/app/identity/auth/stateful/identity-postgres/service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: identity-postgres
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/version: "16.4"
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres
+      protocol: TCP
+      appProtocol: postgresql

k8s/base/app/identity/auth/stateful/identity-postgres/serviceaccount.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: identity-postgres-sa
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/version: "16.4"
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+automountServiceAccountToken: false

k8s/base/app/identity/auth/stateful/identity-postgres/statefulset.yaml

@@ -0,0 +1,174 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: identity-postgres
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/version: "16.4"
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  replicas: 1
+  serviceName: identity-postgres-headless
+  podManagementPolicy: OrderedReady
+  updateStrategy:
+    type: RollingUpdate
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: identity-postgres
+      app.kubernetes.io/instance: identity-postgres
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: identity-postgres
+        app.kubernetes.io/instance: identity-postgres
+        app.kubernetes.io/version: "16.4"
+        app.kubernetes.io/component: database
+        app.kubernetes.io/part-of: auth-platform
+        app.kubernetes.io/managed-by: kustomize
+    spec:
+      serviceAccountName: identity-postgres-sa
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+        runAsGroup: 999
+        fsGroup: 999
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: postgres
+          image: postgres:16.4
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          env:
+            - name: POSTGRES_DB
+              value: postgres
+            - name: POSTGRES_USER_FILE
+              value: /run/secrets/superuser/username
+            - name: POSTGRES_PASSWORD_FILE
+              value: /run/secrets/superuser/password
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+            - name: KEYCLOAK_DB_PASSWORD_FILE
+              value: /run/secrets/keycloak-db/password
+            - name: AUTH_SERVER_DB_PASSWORD_FILE
+              value: /run/secrets/auth-server-db/SPRING_DATASOURCE_PASSWORD
+          resources:
+            requests:
+              cpu: 500m
+              memory: 1Gi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          startupProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -U "$(cat "$POSTGRES_USER_FILE")"
+            periodSeconds: 5
+            failureThreshold: 60
+            timeoutSeconds: 3
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -U "$(cat "$POSTGRES_USER_FILE")"
+            periodSeconds: 10
+            failureThreshold: 3
+            timeoutSeconds: 3
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -U "$(cat "$POSTGRES_USER_FILE")"
+            periodSeconds: 30
+            failureThreshold: 3
+            timeoutSeconds: 3
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 999
+            runAsGroup: 999
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+            - name: initdb
+              mountPath: /docker-entrypoint-initdb.d
+              readOnly: true
+            - name: superuser
+              mountPath: /run/secrets/superuser
+              readOnly: true
+            - name: keycloak-db
+              mountPath: /run/secrets/keycloak-db
+              readOnly: true
+            - name: auth-server-db
+              mountPath: /run/secrets/auth-server-db
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+            - name: run
+              mountPath: /var/run/postgresql
+      volumes:
+        - name: initdb
+          configMap:
+            name: identity-postgres-initdb
+            defaultMode: 0755
+        - name: superuser
+          secret:
+            secretName: identity-postgres-superuser
+            defaultMode: 0400
+        - name: keycloak-db
+          secret:
+            secretName: keycloak-db
+            defaultMode: 0400
+        - name: auth-server-db
+          secret:
+            secretName: auth-server-db
+            defaultMode: 0400
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 128Mi
+        - name: run
+          emptyDir:
+            medium: Memory
+            sizeLimit: 64Mi
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+        labels:
+          app.kubernetes.io/name: identity-postgres
+          app.kubernetes.io/instance: identity-postgres
+          app.kubernetes.io/version: "16.4"
+          app.kubernetes.io/component: database
+          app.kubernetes.io/part-of: auth-platform
+          app.kubernetes.io/managed-by: kustomize
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: local-path
+        volumeMode: Filesystem
+        resources:
+          requests:
+            storage: 5Gi

k8s/base/app/identity/auth/stateless/auth-server/configmap.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: auth-server-config
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+data:
+  SPRING_PROFILES_ACTIVE: dev
+  SPRING_DATASOURCE_URL: jdbc:postgresql://identity-postgres:5432/auth_server
+  APP_DATASOURCE_URL: jdbc:postgresql://identity-postgres:5432/auth_server
+  MANAGEMENT_SERVER_ADDRESS: 0.0.0.0
+  MANAGEMENT_SERVER_PORT: "8081"
+  MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE: health,prometheus
+  SERVER_PORT: "8080"

k8s/base/app/identity/auth/stateless/auth-server/deployment.yaml

@@ -0,0 +1,128 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: auth-server
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  replicas: 1
+  revisionHistoryLimit: 5
+  progressDeadlineSeconds: 600
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: auth-server
+      app.kubernetes.io/instance: auth-server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: auth-server
+        app.kubernetes.io/instance: auth-server
+        app.kubernetes.io/version: "0.1.0"
+        app.kubernetes.io/component: api
+        app.kubernetes.io/part-of: auth-platform
+        app.kubernetes.io/managed-by: kustomize
+    spec:
+      serviceAccountName: auth-server-sa
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 45
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: auth-server
+              app.kubernetes.io/instance: auth-server
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: auth-server
+          image: registry.example.com/auth-platform/auth-server:0.1.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+            - name: metrics
+              containerPort: 8081
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: auth-server-config
+            - secretRef:
+                name: auth-server-db
+          env:
+            - name: JAVA_TOOL_OPTIONS
+              value: "-XX:MaxRAMPercentage=75 -XX:+ExitOnOutOfMemoryError"
+            - name: SPRING_CONFIG_IMPORT
+              value: "optional:configtree:/etc/secrets/"
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              memory: 768Mi
+          startupProbe:
+            httpGet:
+              path: /actuator/health/liveness
+              port: metrics
+            periodSeconds: 5
+            failureThreshold: 24
+            timeoutSeconds: 3
+          readinessProbe:
+            httpGet:
+              path: /actuator/health/readiness
+              port: metrics
+            periodSeconds: 5
+            failureThreshold: 3
+            timeoutSeconds: 2
+          livenessProbe:
+            httpGet:
+              path: /actuator/health/liveness
+              port: metrics
+            periodSeconds: 15
+            failureThreshold: 3
+            timeoutSeconds: 3
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: db-creds
+              mountPath: /etc/secrets
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: db-creds
+          secret:
+            secretName: auth-server-db
+            defaultMode: 0400
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 128Mi

k8s/base/app/identity/auth/stateless/auth-server/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - serviceaccount.yaml
+  - configmap.yaml
+  - deployment.yaml
+  - service.yaml
+labels:
+  - pairs:
+      app.kubernetes.io/name: auth-server
+      app.kubernetes.io/instance: auth-server
+      app.kubernetes.io/version: "0.1.0"
+      app.kubernetes.io/component: api
+      app.kubernetes.io/part-of: auth-platform
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false
+    includeTemplates: true

k8s/base/app/identity/auth/stateless/auth-server/service.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: auth-server
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+      appProtocol: http
+    - name: metrics
+      port: 8081
+      targetPort: metrics
+      protocol: TCP
+      appProtocol: http

k8s/base/app/identity/auth/stateless/auth-server/serviceaccount.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: auth-server-sa
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+automountServiceAccountToken: false

k8s/base/app/identity/keycloak/stateless/keycloak/keycloak.yaml

@@ -0,0 +1,113 @@
+apiVersion: k8s.keycloak.org/v2beta1
+kind: Keycloak
+metadata:
+  name: keycloak
+  labels:
+    app.kubernetes.io/name: keycloak
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/version: "26.6.1"
+    app.kubernetes.io/component: identity-provider
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: keycloak-operator
+spec:
+  instances: 2
+  db:
+    vendor: postgres
+    host: identity-postgres
+    port: 5432
+    database: keycloak
+    usernameSecret:
+      name: keycloak-db-operator
+      key: username
+    passwordSecret:
+      name: keycloak-db-operator
+      key: password
+    poolInitialSize: 5
+    poolMinSize: 5
+    poolMaxSize: 20
+  bootstrapAdmin:
+    user:
+      secret: keycloak-bootstrap-admin-operator # 어떤 시크릿에서 읽을지 지정하는 거
+  hostname:
+    strict: true # 명시된 hostname을 기준으로 URL을 만든다.
+    backchannelDynamic: false # 백URL도 프론트 hostname과 동일하게 고정한다.
+  http:
+    httpEnabled: true
+    httpPort: 8080
+    serviceHttpPort: 80
+    serviceName: keycloak
+    labels:
+      app.kubernetes.io/name: keycloak
+      app.kubernetes.io/instance: keycloak
+      app.kubernetes.io/component: identity-provider
+      app.kubernetes.io/part-of: auth-platform
+      app.kubernetes.io/managed-by: keycloak-operator
+  proxy:
+    headers: xforwarded # X-Forwarded-For  X-Forwarded-Proto  X-Forwarded-Host  X-Forwarded-Port 해당 헤더들을 사용하겠다는 의미 
+  ingress:
+    enabled: false
+  networkPolicy:
+    enabled: false
+  additionalOptions:
+    - name: cache
+      value: ispn # 애플리케이션의 캐시 엔진으로 ispn으로 사용
+    - name: cache-stack
+      value: jdbc-ping # 클러스터링된 서버끼리 서로를 찾는(Discovery) 방식을 JDBC-PING으로 정한 것
+    - name: health-enabled
+      value: "true" # 상태 확인(Health Check) 엔드포인트를 활성화
+    - name: metrics-enabled
+      value: "true" # 메트릭(성능 지표) 수집 기능을 켬
+    - name: log-console-output
+      value: json # 로그 형식을 JSON 구조로 변경
+  env:
+    - name: JAVA_OPTS_APPEND
+      value: "-XX:MaxRAMPercentage=70 -XX:InitialRAMPercentage=50 -XX:+ExitOnOutOfMemoryError"
+  resources:
+    requests:
+      cpu: 500m
+      memory: 1Gi
+    limits:
+      cpu: "2"
+      memory: 2Gi
+  scheduling:
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: keycloak
+            app.kubernetes.io/managed-by: keycloak-operator
+    affinity: # 특정 노드에 다른 pod에 관계에 따라 배치 위치를 결정하는 규칙을 정의한다 
+      podAntiAffinity: # 특정 조건을 만족하는 포드와는 같은 장소에 있지 않는다.
+        preferredDuringSchedulingIgnoredDuringExecution: # 가급적 지켜줘
+          - weight: 100 # 가중치가 100임 매우 중요하다고 알림
+            podAffinityTerm: # 어떤 파드를 피해다닐지
+              topologyKey: kubernetes.io/hostname # 피할 기준은 호스트 네임으로 설정
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/instance: keycloak # keycloak과 피하겠다
+                  app.kubernetes.io/managed-by: keycloak-operator # keycloak-operator에 의해 관리되는
+  unsupported:
+    podTemplate:
+      spec:
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 1000
+          runAsGroup: 1000
+          fsGroup: 1000
+          fsGroupChangePolicy: OnRootMismatch
+          seccompProfile:
+            type: RuntimeDefault
+        containers:
+          - name: keycloak
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                  - ALL
+              runAsNonRoot: true
+              runAsUser: 1000
+              runAsGroup: 1000
+              seccompProfile:
+                type: RuntimeDefault

k8s/base/app/identity/keycloak/stateless/keycloak/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - keycloak.yaml
+labels:
+  - pairs:
+      app.kubernetes.io/name: keycloak
+      app.kubernetes.io/instance: keycloak
+      app.kubernetes.io/version: "26.6.1"
+      app.kubernetes.io/component: identity-provider
+      app.kubernetes.io/part-of: auth-platform
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false
+    includeTemplates: true

k8s/base/app/storage/minio/stateful/minio/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - tenant.yaml
+labels:
+  - pairs:
+      app.kubernetes.io/name: minio
+      app.kubernetes.io/instance: minio
+      app.kubernetes.io/version: "2025.01.20"
+      app.kubernetes.io/component: object-storage
+      app.kubernetes.io/part-of: storage-platform
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false
+    includeTemplates: true

k8s/base/app/storage/minio/stateful/minio/tenant.yaml

@@ -0,0 +1,92 @@
+apiVersion: minio.min.io/v2
+kind: Tenant
+metadata:
+  name: minio
+  labels:
+    app.kubernetes.io/name: minio
+    app.kubernetes.io/instance: minio
+    app.kubernetes.io/version: "2025.01.20"
+    app.kubernetes.io/component: object-storage
+    app.kubernetes.io/part-of: storage-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  image: minio/minio:RELEASE.2025-01-20T14-49-07Z
+  imagePullPolicy: IfNotPresent
+  mountPath: /export
+  configuration:
+    name: minio-tenant-env
+  requestAutoCert: true
+  certConfig:
+    commonName: minio
+    organizationName:
+      - example.com
+    dnsNames:
+      - minio
+      - minio-hl
+  pools:
+    - name: pool-0
+      servers: 4
+      volumesPerServer: 1
+      volumeClaimTemplate:
+        metadata:
+          name: data
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 20Gi
+          storageClassName: local-path
+      resources:
+        requests:
+          cpu: 250m
+          memory: 1Gi
+        limits:
+          cpu: "1"
+          memory: 2Gi
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containerSecurityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        capabilities:
+          drop:
+            - ALL
+  features:
+    bucketDNS: false
+  prometheusOperator: false
+  podManagementPolicy: Parallel
+  exposeServices:
+    minio: false
+    console: false
+  logging:
+    anonymous: false
+    json: true
+    quiet: false
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: minio-pdb
+  labels:
+    app.kubernetes.io/name: minio
+    app.kubernetes.io/instance: minio
+    app.kubernetes.io/version: "2025.01.20"
+    app.kubernetes.io/component: object-storage
+    app.kubernetes.io/part-of: storage-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  maxUnavailable: 1
+  unhealthyPodEvictionPolicy: AlwaysAllow
+  selector:
+    matchLabels:
+      v1.min.io/tenant: minio

k8s/base/managing/AGENTS.md

@@ -0,0 +1,46 @@
+# k8s/base/managing AGENTS
+
+Role:
+- own management and operational Kubernetes base units
+- model bootstrap, migration, backup, restore, maintenance, and admin workloads as declarative Kustomize bases
+- keep operational workloads separate from long-running application serving workloads
+
+Allowed:
+- Job / CronJob base resources for operational tasks
+- maintenance ServiceAccount / RBAC / ConfigMap / Secret reference wiring
+- backup / restore / migration helper workload shapes
+- admin-only service shapes when explicitly justified
+
+Forbidden:
+- long-running product application workloads
+- environment-specific values that belong in `k8s/overlays/<env>`
+- scripts becoming the primary source of YAML truth
+- large heredoc-generated manifests as the default path
+- embedding production secret values
+- hiding environment differences in shell conditionals instead of overlays
+- giant all-in-one jobs that mix unrelated concerns
+
+Read first:
+- `/docs/standards/infra/workload-selection.md`
+- `/docs/standards/infra/db-and-migration.md`
+- `/docs/standards/infra/flyway.md`
+- `/docs/standards/infra/backup-restore.md`
+- `/docs/standards/infra/operations-runbook-upgrade-rollback.md`
+- `/docs/standards/infra/config-and-secrets.md`
+- `/docs/standards/infra/security-hardening.md`
+- `/docs/standards/infra/kustomize.md`
+
+Examples:
+- `/docs/examples/infra/flyway.md`
+- `/docs/examples/infra/backup-restore.md`
+- `/docs/examples/infra/operations-runbook-upgrade-rollback.md`
+- `/docs/examples/infra/db-and-migration.md`
+- `/docs/examples/infra/kustomize.md`
+- `/docs/examples/infra/scripts.md`
+
+Rules:
+- management jobs are explicit operational units, not hidden app startup hooks
+- migrations must stay separate from app startup
+- backup and restore paths must be documented before risky stateful changes
+- destructive operations require explicit opt-in and runbook backing
+- operational workloads must still follow security, resource, secret, and namespace standards

k8s/base/managing/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace

k8s/base/managing/migration-flyway/configmap-sql.yaml

@@ -0,0 +1,80 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: migration-flyway-sql
+  labels:
+    app.kubernetes.io/name: migration-flyway
+    app.kubernetes.io/instance: migration-flyway
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: migration
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+data:
+  V1__create_users_table.sql: |
+    create schema if not exists auth;
+
+    create or replace function auth.set_updated_at()
+    returns trigger as $$
+    begin
+        new.updated_at := current_timestamp;
+        return new;
+    end;
+    $$ language plpgsql;
+
+    create table auth.users (
+        id uuid not null,
+        email text not null,
+        encoded_password text not null,
+        name text not null,
+        provider text not null,
+        created_at timestamp with time zone not null default current_timestamp,
+        updated_at timestamp with time zone not null default current_timestamp,
+        constraint pk_users primary key (id),
+        constraint uq_users__email unique (email),
+        constraint ck_users__provider check (provider in ('LOCAL', 'GOOGLE', 'GITHUB'))
+    );
+
+    create index ix_users__created_at on auth.users (created_at);
+
+    create trigger trg_users__set_updated_at
+    before update on auth.users
+    for each row
+    when (old.* is distinct from new.*)
+    execute function auth.set_updated_at();
+  V2__add_oauth_login_columns.sql: |
+    alter table auth.users alter column encoded_password drop not null;
+
+    alter table auth.users add column provider_subject text;
+
+    alter table auth.users
+        add constraint uq_users__provider_provider_subject unique (provider, provider_subject);
+  V3__add_user_provider_field_constraints.sql: |
+    alter table auth.users
+        add constraint ck_users__local_password_required
+            check (
+                (provider = 'LOCAL' and encoded_password is not null and provider_subject is null)
+                or (provider <> 'LOCAL')
+            );
+
+    alter table auth.users
+        add constraint ck_users__social_subject_required
+            check (
+                (provider <> 'LOCAL' and provider_subject is not null and encoded_password is null)
+                or (provider = 'LOCAL')
+            );
+  V4__add_keycloak_provider.sql: |
+    alter table auth.users drop constraint ck_users__provider;
+
+    alter table auth.users
+        add constraint ck_users__provider check (provider in ('LOCAL', 'KEYCLOAK', 'GOOGLE', 'GITHUB'));
+  V5__keycloak_only_provider.sql: |
+    alter table auth.users drop constraint if exists ck_users__local_password_required;
+    alter table auth.users drop constraint if exists ck_users__social_subject_required;
+    alter table auth.users drop constraint if exists ck_users__provider;
+
+    alter table auth.users drop column if exists encoded_password;
+
+    alter table auth.users alter column provider_subject set not null;
+
+    alter table auth.users
+        add constraint ck_users__provider check (provider = 'KEYCLOAK');

k8s/base/managing/migration-flyway/job.yaml

@@ -0,0 +1,119 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: migration-flyway
+  labels:
+    app.kubernetes.io/name: migration-flyway
+    app.kubernetes.io/instance: migration-flyway
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: migration
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  parallelism: 1
+  completions: 1
+  backoffLimit: 0
+  activeDeadlineSeconds: 1800
+  ttlSecondsAfterFinished: 86400
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: migration-flyway
+        app.kubernetes.io/instance: migration-flyway
+        app.kubernetes.io/version: "0.1.0"
+        app.kubernetes.io/component: migration
+        app.kubernetes.io/part-of: auth-platform
+        app.kubernetes.io/managed-by: kustomize
+    spec:
+      serviceAccountName: migration-flyway-sa
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        - name: flyway-info
+          image: flyway/flyway:10.20.1
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c"]
+          args: ["FLYWAY_USER=\"$(cat /run/secrets/db/SPRING_DATASOURCE_USERNAME)\" FLYWAY_PASSWORD=\"$(cat /run/secrets/db/SPRING_DATASOURCE_PASSWORD)\" exec /flyway/flyway info"]
+          env: &flywayEnv
+            - name: FLYWAY_URL
+              value: jdbc:postgresql://identity-postgres:5432/auth_server
+            - name: FLYWAY_LOCATIONS
+              value: filesystem:/flyway/sql
+            - name: FLYWAY_SCHEMAS
+              value: auth
+            - name: FLYWAY_DEFAULT_SCHEMA
+              value: auth
+            - name: FLYWAY_TABLE
+              value: flyway_schema_history
+            - name: FLYWAY_VALIDATE_ON_MIGRATE
+              value: "true"
+            - name: FLYWAY_BASELINE_ON_MIGRATE
+              value: "false"
+            - name: FLYWAY_OUT_OF_ORDER
+              value: "false"
+            - name: FLYWAY_MIXED
+              value: "false"
+            - name: FLYWAY_CLEAN_DISABLED
+              value: "true"
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              memory: 256Mi
+          securityContext: &flywaySC
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts: &flywayVM
+            - name: sql
+              mountPath: /flyway/sql
+              readOnly: true
+            - name: db-secret
+              mountPath: /run/secrets/db
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      containers:
+        - name: flyway-migrate
+          image: flyway/flyway:10.20.1
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c"]
+          args: ["FLYWAY_USER=\"$(cat /run/secrets/db/SPRING_DATASOURCE_USERNAME)\" FLYWAY_PASSWORD=\"$(cat /run/secrets/db/SPRING_DATASOURCE_PASSWORD)\" exec /flyway/flyway migrate"]
+          env: *flywayEnv
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              memory: 512Mi
+          securityContext: *flywaySC
+          volumeMounts: *flywayVM
+      volumes:
+        - name: sql
+          configMap:
+            name: migration-flyway-sql
+        - name: db-secret
+          secret:
+            secretName: auth-server-db
+            defaultMode: 0400
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 128Mi

k8s/base/managing/migration-flyway/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - serviceaccount.yaml
+  - configmap-sql.yaml
+  - job.yaml
+labels:
+  - pairs:
+      app.kubernetes.io/name: migration-flyway
+      app.kubernetes.io/instance: migration-flyway
+      app.kubernetes.io/version: "0.1.0"
+      app.kubernetes.io/component: migration
+      app.kubernetes.io/part-of: auth-platform
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false
+    includeTemplates: true

k8s/base/managing/migration-flyway/serviceaccount.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: migration-flyway-sa
+  labels:
+    app.kubernetes.io/name: migration-flyway
+    app.kubernetes.io/instance: migration-flyway
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: migration
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+automountServiceAccountToken: false

k8s/base/managing/namespace/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml

k8s/base/managing/namespace/namespace.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mnt
+  labels:
+    app.kubernetes.io/name: mnt
+    app.kubernetes.io/instance: mnt
+    app.kubernetes.io/component: namespace
+    app.kubernetes.io/part-of: infra-platform
+    app.kubernetes.io/managed-by: kustomize
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest

k8s/base/plugins/docker-registry/configmap.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: docker-registry-config
+data:
+  REGISTRY_HTTP_ADDR: "0.0.0.0:5000"
+  REGISTRY_LOG_FORMATTER: "json"
+  REGISTRY_STORAGE: "s3"
+  REGISTRY_STORAGE_S3_REGION: "us-east-1"
+  REGISTRY_STORAGE_S3_REGIONENDPOINT: "http://minio"
+  REGISTRY_STORAGE_S3_BUCKET: "docker-registry"
+  REGISTRY_STORAGE_S3_FORCEPATHSTYLE: "true"
+  REGISTRY_STORAGE_S3_SKIPVERIFY: "true"
+  REGISTRY_STORAGE_REDIRECT_DISABLE: "true"
+  REGISTRY_STORAGE_DELETE_ENABLED: "true"

k8s/base/plugins/docker-registry/deployment.yaml

@@ -0,0 +1,94 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: docker-registry
+spec:
+  replicas: 1
+  revisionHistoryLimit: 5
+  progressDeadlineSeconds: 600
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: docker-registry
+      app.kubernetes.io/instance: docker-registry
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: docker-registry
+        app.kubernetes.io/instance: docker-registry
+    spec:
+      serviceAccountName: docker-registry
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 45
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: registry
+          image: registry:2.8.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 5000
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: docker-registry-config
+            - secretRef:
+                name: docker-registry-minio
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              memory: 512Mi
+          startupProbe:
+            httpGet:
+              path: /v2/
+              port: http
+            periodSeconds: 5
+            failureThreshold: 12
+            timeoutSeconds: 3
+          readinessProbe:
+            httpGet:
+              path: /v2/
+              port: http
+            periodSeconds: 10
+            failureThreshold: 3
+            timeoutSeconds: 3
+          livenessProbe:
+            httpGet:
+              path: /v2/
+              port: http
+            periodSeconds: 30
+            failureThreshold: 3
+            timeoutSeconds: 3
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 64Mi

k8s/base/plugins/docker-registry/kustomization.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - serviceaccount.yaml
+  - configmap.yaml
+  - service.yaml
+  - deployment.yaml
+
+labels:
+  - pairs:
+      app.kubernetes.io/name: docker-registry
+      app.kubernetes.io/instance: docker-registry
+      app.kubernetes.io/version: "2.8.3"
+      app.kubernetes.io/component: registry
+      app.kubernetes.io/part-of: platform-registry
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false
+    includeTemplates: true

k8s/base/plugins/docker-registry/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: docker-registry
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: docker-registry
+    app.kubernetes.io/instance: docker-registry
+  ports:
+    - name: http
+      port: 5000
+      targetPort: http
+      protocol: TCP
+      appProtocol: http

k8s/base/plugins/docker-registry/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: docker-registry
+automountServiceAccountToken: false

k8s/base/plugins/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - vault
+  - docker-registry

k8s/base/plugins/oauth2-proxy/deployment.yaml

@@ -0,0 +1,115 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2-proxy
+spec:
+  replicas: 1
+  revisionHistoryLimit: 5
+  progressDeadlineSeconds: 600
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oauth2-proxy
+      app.kubernetes.io/instance: oauth2-proxy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oauth2-proxy
+        app.kubernetes.io/instance: oauth2-proxy
+    spec:
+      serviceAccountName: oauth2-proxy-sa
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 30
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: oauth2-proxy
+              app.kubernetes.io/instance: oauth2-proxy
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
+          imagePullPolicy: IfNotPresent
+          args:
+            - --config=/etc/oauth2-proxy/oauth2-proxy.cfg
+          ports:
+            - name: http
+              containerPort: 4180
+              protocol: TCP
+            - name: metrics
+              containerPort: 44180
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              memory: 256Mi
+          startupProbe:
+            httpGet:
+              path: /ping
+              port: http
+            periodSeconds: 5
+            failureThreshold: 12
+            timeoutSeconds: 3
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: http
+            periodSeconds: 10
+            failureThreshold: 3
+            timeoutSeconds: 3
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            periodSeconds: 15
+            failureThreshold: 3
+            timeoutSeconds: 3
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: config
+              mountPath: /etc/oauth2-proxy
+              readOnly: true
+            - name: secrets
+              mountPath: /etc/oauth2-proxy-secrets
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: config
+          configMap:
+            name: oauth2-proxy-config
+        - name: secrets
+          secret:
+            secretName: oauth2-proxy-secrets
+            defaultMode: 0400
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 64Mi

k8s/base/plugins/oauth2-proxy/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - serviceaccount.yaml
+  - service.yaml
+  - deployment.yaml
+
+labels:
+  - pairs:
+      app.kubernetes.io/name: oauth2-proxy
+      app.kubernetes.io/instance: oauth2-proxy
+      app.kubernetes.io/version: "7.15.2"
+      app.kubernetes.io/component: auth-proxy
+      app.kubernetes.io/part-of: auth-platform
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false
+    includeTemplates: true

k8s/base/plugins/oauth2-proxy/service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2-proxy
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: oauth2-proxy
+    app.kubernetes.io/instance: oauth2-proxy
+  ports:
+    - name: http
+      port: 4180
+      targetPort: http
+      protocol: TCP
+      appProtocol: http
+    - name: metrics
+      port: 44180
+      targetPort: metrics
+      protocol: TCP
+      appProtocol: http

k8s/base/plugins/oauth2-proxy/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: oauth2-proxy-sa
+automountServiceAccountToken: false

k8s/base/plugins/vault/clusterrolebinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vault-tokenreview-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: vault
+    namespace: mnt

k8s/base/plugins/vault/configmap.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vault-config
+data:
+  vault.hcl: |
+    ui = true
+    disable_mlock = true
+
+    storage "file" {
+      path = "/vault/data"
+    }
+
+    listener "tcp" {
+      address         = "0.0.0.0:8200"
+      cluster_address = "0.0.0.0:8201"
+      tls_disable     = 1
+    }
+
+    api_addr     = "http://vault:8200"
+    cluster_addr = "http://vault:8201"

k8s/base/plugins/vault/kustomization.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - serviceaccount.yaml
+  - clusterrolebinding.yaml
+  - configmap.yaml
+  - service.yaml
+  - statefulset.yaml
+
+labels:
+  - pairs:
+      app.kubernetes.io/name: vault
+      app.kubernetes.io/instance: vault
+      app.kubernetes.io/version: "1.17.2"
+      app.kubernetes.io/component: secret-management
+      app.kubernetes.io/part-of: security-platform
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false
+    includeTemplates: true

k8s/base/plugins/vault/service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vault
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/instance: vault
+  ports:
+    - name: http
+      port: 8200
+      targetPort: http
+      protocol: TCP
+      appProtocol: http
+    - name: cluster
+      port: 8201
+      targetPort: cluster
+      protocol: TCP
+      appProtocol: http

k8s/base/plugins/vault/serviceaccount.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault

k8s/base/plugins/vault/statefulset.yaml

@@ -0,0 +1,128 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: vault
+spec:
+  replicas: 1
+  serviceName: vault
+  podManagementPolicy: OrderedReady
+  updateStrategy:
+    type: RollingUpdate
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: vault
+      app.kubernetes.io/instance: vault
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: vault
+        app.kubernetes.io/instance: vault
+    spec:
+      serviceAccountName: vault
+      automountServiceAccountToken: true
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 100
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: vault
+          image: hashicorp/vault:1.17.2
+          imagePullPolicy: IfNotPresent
+          command:
+            - vault
+            - server
+            - -config=/vault/config/vault.hcl
+          ports:
+            - name: http
+              containerPort: 8200
+              protocol: TCP
+            - name: cluster
+              containerPort: 8201
+              protocol: TCP
+          env:
+            - name: VAULT_ADDR
+              value: "http://127.0.0.1:8200"
+            - name: VAULT_API_ADDR
+              value: "http://vault:8200"
+            - name: SKIP_SETCAP
+              value: "true"
+          resources:
+            requests:
+              cpu: 250m
+              memory: 256Mi
+            limits:
+              memory: 512Mi
+          startupProbe:
+            httpGet:
+              path: /v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200
+              port: http
+            periodSeconds: 5
+            failureThreshold: 30
+            timeoutSeconds: 3
+          readinessProbe:
+            httpGet:
+              path: /v1/sys/health?standbyok=true&sealedcode=503&uninitcode=503
+              port: http
+            periodSeconds: 10
+            failureThreshold: 3
+            timeoutSeconds: 3
+          livenessProbe:
+            httpGet:
+              path: /v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200
+              port: http
+            periodSeconds: 30
+            failureThreshold: 3
+            timeoutSeconds: 3
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 100
+            runAsGroup: 1000
+            allowPrivilegeEscalation: false
+            privileged: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: data
+              mountPath: /vault/data
+            - name: config
+              mountPath: /vault/config
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+            - name: home
+              mountPath: /home/vault
+      volumes:
+        - name: config
+          configMap:
+            name: vault-config
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 64Mi
+        - name: home
+          emptyDir:
+            medium: Memory
+            sizeLimit: 64Mi
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: local-path
+        volumeMode: Filesystem
+        resources:
+          requests:
+            storage: 5Gi

k8s/base/plugins/vso/helm/values.yaml

@@ -0,0 +1,39 @@
+defaultVaultConnection:
+  enabled: false
+
+controller:
+  # VSO 는 mnt namespace 에 설치되고 mnt 는 PSS restricted enforce 상태이므로
+  # chart 의 Operator Pod 도 Restricted 프로필을 만족해야 한다.
+  podSecurityContext:
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+
+  manager:
+    resources:
+      limits:
+        cpu: 500m
+        memory: 128Mi
+      requests:
+        cpu: 10m
+        memory: 64Mi
+    securityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop:
+          - ALL
+      seccompProfile:
+        type: RuntimeDefault
+
+  kubeRbacProxy:
+    securityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop:
+          - ALL
+      seccompProfile:
+        type: RuntimeDefault
+
+# kubeRBACProxy : metrics 접근 제어

k8s/base/plugins/vso/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - serviceaccount.yaml
+  - vault-connection.yaml
+  - vault-auth.yaml
+
+labels:
+  - pairs:
+      app.kubernetes.io/name: vault-secrets-operator
+      app.kubernetes.io/instance: vso
+      app.kubernetes.io/version: "0.9.0"
+      app.kubernetes.io/component: secret-delivery
+      app.kubernetes.io/part-of: security-platform
+      app.kubernetes.io/managed-by: kustomize
+    includeSelectors: false
+    includeTemplates: true

k8s/base/plugins/vso/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault-secrets-operator
+automountServiceAccountToken: true

k8s/base/plugins/vso/vault-auth.yaml

@@ -0,0 +1,27 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: vault-auth-auth-platform
+spec:
+  vaultConnectionRef: vault-connection
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: vso-auth-platform
+    serviceAccount: vault-secrets-operator
+    audiences:
+      - vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: vault-auth-storage
+spec:
+  vaultConnectionRef: vault-connection
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: vso-storage
+    serviceAccount: vault-secrets-operator
+    audiences:
+      - vault

k8s/base/plugins/vso/vault-connection.yaml

@@ -0,0 +1,7 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultConnection
+metadata:
+  name: vault-connection
+spec:
+  address: http://vault.mnt.svc.cluster.local:8200
+  skipTLSVerify: false