init: 폴더구조 설계 및 인프라 설계

2026-07-24 14:31:53 +09:00
parent 34ad612281
commit f9c463f87a
1839 changed files with 323096 additions and 1 deletions
@@ -0,0 +1,46 @@
+# k8s/base/managing AGENTS
+
+Role:
+- own management and operational Kubernetes base units
+- model bootstrap, migration, backup, restore, maintenance, and admin workloads as declarative Kustomize bases
+- keep operational workloads separate from long-running application serving workloads
+
+Allowed:
+- Job / CronJob base resources for operational tasks
+- maintenance ServiceAccount / RBAC / ConfigMap / Secret reference wiring
+- backup / restore / migration helper workload shapes
+- admin-only service shapes when explicitly justified
+
+Forbidden:
+- long-running product application workloads
+- environment-specific values that belong in `k8s/overlays/<env>`
+- scripts becoming the primary source of YAML truth
+- large heredoc-generated manifests as the default path
+- embedding production secret values
+- hiding environment differences in shell conditionals instead of overlays
+- giant all-in-one jobs that mix unrelated concerns
+
+Read first:
+- `/docs/standards/infra/workload-selection.md`
+- `/docs/standards/infra/db-and-migration.md`
+- `/docs/standards/infra/flyway.md`
+- `/docs/standards/infra/backup-restore.md`
+- `/docs/standards/infra/operations-runbook-upgrade-rollback.md`
+- `/docs/standards/infra/config-and-secrets.md`
+- `/docs/standards/infra/security-hardening.md`
+- `/docs/standards/infra/kustomize.md`
+
+Examples:
+- `/docs/examples/infra/flyway.md`
+- `/docs/examples/infra/backup-restore.md`
+- `/docs/examples/infra/operations-runbook-upgrade-rollback.md`
+- `/docs/examples/infra/db-and-migration.md`
+- `/docs/examples/infra/kustomize.md`
+- `/docs/examples/infra/scripts.md`
+
+Rules:
+- management jobs are explicit operational units, not hidden app startup hooks
+- migrations must stay separate from app startup
+- backup and restore paths must be documented before risky stateful changes
+- destructive operations require explicit opt-in and runbook backing
+- operational workloads must still follow security, resource, secret, and namespace standards