init: 폴더구조 설계 및 인프라 설계

k8s/overlays/dev/auth/ingress.yaml

@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: auth-server
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-security-headers@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: auth.local.test
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: auth-server
+                port:
+                  name: http

k8s/overlays/dev/auth/kustomization.yaml

@@ -0,0 +1,50 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - ../../../base/app/identity/auth/stateless/auth-server
+  - ../../../base/managing/migration-flyway
+  - ingress.yaml
+  - networkpolicy.yaml
+
+images:
+  - name: registry.example.com/auth-platform/auth-server
+    newName: registry.project.com/auth-platform/auth-server
+    newTag: manual-20260512071751
+
+patches:
+  - target:
+      kind: ConfigMap
+      name: auth-server-config
+    patch: |-
+      - op: add
+        path: /data/APP_SECURITY_KEYCLOAK_ISSUER_URI
+        value: http://keycloak.local.test/realms/platform
+      - op: add
+        path: /data/SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI
+        value: http://keycloak.local.test/realms/platform
+      - op: add
+        path: /data/SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI
+        value: http://keycloak/realms/platform/protocol/openid-connect/certs
+      - op: add
+        path: /data/SERVER_MAX_HTTP_REQUEST_HEADER_SIZE
+        value: 64KB
+  - target:
+      kind: ServiceAccount
+      name: auth-server-sa
+    patch: |-
+      - op: add
+        path: /imagePullSecrets
+        value:
+          - name: docker-registry-pull-credentials
+  - target:
+      kind: Job
+      name: migration-flyway
+    patch: |-
+      - op: add
+        path: /metadata/annotations
+        value:
+          argocd.argoproj.io/sync-wave: "-1"
+          argocd.argoproj.io/hook: PreSync

k8s/overlays/dev/auth/networkpolicy.yaml

@@ -0,0 +1,90 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-server-ingress-traefik
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: auth-server
+      app.kubernetes.io/instance: auth-server
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-server-egress
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: auth-server
+      app.kubernetes.io/instance: auth-server
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: identity-postgres
+              app.kubernetes.io/instance: identity-postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/managed-by: keycloak-operator
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: migration-flyway-egress
+  labels:
+    app.kubernetes.io/name: migration-flyway
+    app.kubernetes.io/instance: migration-flyway
+    app.kubernetes.io/component: migration
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: migration-flyway
+      app.kubernetes.io/instance: migration-flyway
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: identity-postgres
+              app.kubernetes.io/instance: identity-postgres
+      ports:
+        - protocol: TCP
+          port: 5432

k8s/overlays/dev/database/kustomization.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - ../../../base/app/identity/auth/stateful/identity-postgres
+  - vault-secrets.yaml
+  - networkpolicy.yaml
+
+patches:
+  - target:
+      kind: StatefulSet
+      name: identity-postgres
+    patch: |-
+      - op: replace
+        path: /spec/persistentVolumeClaimRetentionPolicy/whenDeleted
+        value: Delete
+      - op: replace
+        path: /spec/persistentVolumeClaimRetentionPolicy/whenScaled
+        value: Delete

k8s/overlays/dev/database/networkpolicy.yaml

@@ -0,0 +1,34 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: identity-postgres-ingress-clients
+  labels:
+    app.kubernetes.io/name: identity-postgres
+    app.kubernetes.io/instance: identity-postgres
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: identity-postgres
+      app.kubernetes.io/instance: identity-postgres
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/managed-by: keycloak-operator
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: auth-server
+              app.kubernetes.io/instance: auth-server
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: migration-flyway
+              app.kubernetes.io/instance: migration-flyway
+      ports:
+        - protocol: TCP
+          port: 5432

k8s/overlays/dev/database/vault-secrets.yaml

@@ -0,0 +1,63 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: identity-postgres-superuser
+spec:
+  vaultAuthRef: vault-auth-auth-platform
+  mount: secret
+  type: kv-v2
+  path: identity-postgres/superuser
+  refreshAfter: 60s
+  destination:
+    name: identity-postgres-superuser
+    create: true
+    labels:
+      app.kubernetes.io/name: identity-postgres
+      app.kubernetes.io/component: database
+      app.kubernetes.io/managed-by: vault-secrets-operator
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: keycloak-db-creds
+spec:
+  vaultAuthRef: vault-auth-auth-platform
+  mount: secret
+  type: kv-v2
+  path: keycloak/db
+  refreshAfter: 60s
+  destination:
+    name: keycloak-db
+    create: true
+    labels:
+      app.kubernetes.io/name: keycloak
+      app.kubernetes.io/component: database
+      app.kubernetes.io/managed-by: vault-secrets-operator
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: auth-server-db-creds
+spec:
+  vaultAuthRef: vault-auth-auth-platform
+  mount: secret
+  type: kv-v2
+  path: auth-server/db
+  refreshAfter: 60s
+  destination:
+    name: auth-server-db
+    create: true
+    labels:
+      app.kubernetes.io/name: auth-server
+      app.kubernetes.io/component: database
+      app.kubernetes.io/managed-by: vault-secrets-operator
+    transformation:
+      templates:
+        SPRING_DATASOURCE_USERNAME:
+          text: '{{ index .Secrets "SPRING_DATASOURCE_USERNAME" }}'
+        SPRING_DATASOURCE_PASSWORD:
+          text: '{{ index .Secrets "SPRING_DATASOURCE_PASSWORD" }}'
+        APP_DATASOURCE_USERNAME:
+          text: '{{ index .Secrets "SPRING_DATASOURCE_USERNAME" }}'
+        APP_DATASOURCE_PASSWORD:
+          text: '{{ index .Secrets "SPRING_DATASOURCE_PASSWORD" }}'

k8s/overlays/dev/keycloak-realm/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - platform-realm-import.yaml

k8s/overlays/dev/keycloak-realm/platform-realm-import.yaml

@@ -0,0 +1,62 @@
+apiVersion: k8s.keycloak.org/v2beta1
+kind: KeycloakRealmImport
+metadata:
+  name: platform-realm
+  labels:
+    app.kubernetes.io/name: keycloak
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/version: "26.6.1"
+    app.kubernetes.io/component: identity-provider
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  keycloakCRName: keycloak
+  placeholders:
+    AUTH_SERVER_INGRESS_CLIENT_SECRET:
+      secret:
+        name: keycloak-client-auth-server-ingress
+        key: client-secret
+  realm:
+    realm: platform
+    enabled: true
+    sslRequired: external
+    registrationAllowed: true
+    loginWithEmailAllowed: true
+    accessTokenLifespan: 300
+    defaultRoles:
+      - user
+    roles:
+      realm:
+        - name: user
+    clients:
+      - clientId: auth-server-ingress
+        name: auth-server-ingress
+        protocol: openid-connect
+        publicClient: false
+        clientAuthenticatorType: client-secret
+        secret: ${AUTH_SERVER_INGRESS_CLIENT_SECRET}
+        standardFlowEnabled: true
+        directAccessGrantsEnabled: false
+        serviceAccountsEnabled: false
+        defaultClientScopes:
+          - profile
+          - email
+          - roles
+        protocolMappers:
+          - name: realm roles in id token
+            protocol: openid-connect
+            protocolMapper: oidc-usermodel-realm-role-mapper
+            config:
+              user.attribute: foo
+              claim.name: realm_access.roles
+              jsonType.label: String
+              multivalued: "true"
+              access.token.claim: "true"
+              id.token.claim: "true"
+              introspection.token.claim: "true"
+        redirectUris:
+          - http://auth.local.test/oauth2/callback
+        webOrigins:
+          - http://auth.local.test
+        rootUrl: http://auth.local.test
+        baseUrl: http://auth.local.test

k8s/overlays/dev/keycloak/ingress-admin.yaml

@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keycloak-admin
+  labels:
+    app.kubernetes.io/name: keycloak
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/version: "26.6.1"
+    app.kubernetes.io/component: identity-provider
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.middlewares: mnt-keycloak-security-headers@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: keycloak-admin.local.test
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: keycloak
+                port:
+                  name: http

k8s/overlays/dev/keycloak/ingress-public.yaml

@@ -0,0 +1,48 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keycloak-public
+  labels:
+    app.kubernetes.io/name: keycloak
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/version: "26.6.1"
+    app.kubernetes.io/component: identity-provider
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.middlewares: mnt-keycloak-security-headers@kubernetescrd # frameDeny 제외 — admin 콘솔의 silent SSO iframe 허용
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: keycloak.local.test
+      http:
+        paths:
+          - path: /realms/
+            pathType: Prefix
+            backend:
+              service:
+                name: keycloak
+                port:
+                  name: http
+          - path: /resources/
+            pathType: Prefix
+            backend:
+              service:
+                name: keycloak
+                port:
+                  name: http
+          - path: /.well-known/
+            pathType: Prefix
+            backend:
+              service:
+                name: keycloak
+                port:
+                  name: http
+          - path: /js/
+            pathType: Prefix
+            backend:
+              service:
+                name: keycloak
+                port:
+                  name: http

k8s/overlays/dev/keycloak/keycloak-hostname-patch.yaml

@@ -0,0 +1,8 @@
+apiVersion: k8s.keycloak.org/v2beta1
+kind: Keycloak
+metadata:
+  name: keycloak
+spec:
+  hostname:
+    hostname: http://keycloak.local.test
+    admin: http://keycloak-admin.local.test

k8s/overlays/dev/keycloak/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - ../../../base/app/identity/keycloak/stateless/keycloak
+  - vault-secrets.yaml
+  - middleware.yaml
+  - ingress-public.yaml
+  - ingress-admin.yaml
+  - networkpolicy.yaml
+
+patches:
+  - target:
+      kind: Keycloak
+      name: keycloak
+    path: keycloak-hostname-patch.yaml

k8s/overlays/dev/keycloak/middleware.yaml

@@ -0,0 +1,15 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: keycloak-security-headers
+  labels:
+    app.kubernetes.io/name: keycloak
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/component: identity-provider
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  headers:
+    browserXssFilter: true
+    contentTypeNosniff: true
+    referrerPolicy: strict-origin-when-cross-origin

k8s/overlays/dev/keycloak/networkpolicy.yaml

@@ -0,0 +1,140 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: keycloak-peer
+  labels:
+    app.kubernetes.io/name: keycloak
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/component: identity-provider
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: keycloak
+      app.kubernetes.io/managed-by: keycloak-operator
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/managed-by: keycloak-operator
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/managed-by: keycloak-operator
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: keycloak-ingress-traefik
+  labels:
+    app.kubernetes.io/name: keycloak
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/component: identity-provider
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: keycloak
+      app.kubernetes.io/managed-by: keycloak-operator
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: keycloak-egress-postgres
+  labels:
+    app.kubernetes.io/name: keycloak
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/component: identity-provider
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: keycloak
+      app.kubernetes.io/managed-by: keycloak-operator
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: identity-postgres
+              app.kubernetes.io/instance: identity-postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: keycloak-ingress-auth-server
+  labels:
+    app.kubernetes.io/name: keycloak
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/component: identity-provider
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: keycloak
+      app.kubernetes.io/managed-by: keycloak-operator
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: auth-server
+              app.kubernetes.io/instance: auth-server
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: keycloak-ingress-oauth2-proxy
+  labels:
+    app.kubernetes.io/name: keycloak
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/component: identity-provider
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: keycloak
+      app.kubernetes.io/managed-by: keycloak-operator
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: oauth2-proxy
+              app.kubernetes.io/instance: oauth2-proxy
+      ports:
+        - protocol: TCP
+          port: 8080

k8s/overlays/dev/keycloak/vault-secrets.yaml

@@ -0,0 +1,90 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: keycloak-bootstrap-admin
+spec:
+  vaultAuthRef: vault-auth-auth-platform
+  mount: secret
+  type: kv-v2
+  path: keycloak/bootstrap-admin
+  refreshAfter: 60s
+  destination:
+    name: keycloak-bootstrap-admin
+    create: true
+    labels:
+      app.kubernetes.io/name: keycloak
+      app.kubernetes.io/component: identity-provider
+      app.kubernetes.io/managed-by: vault-secrets-operator
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: keycloak-bootstrap-admin-operator
+spec:
+  vaultAuthRef: vault-auth-auth-platform
+  mount: secret
+  type: kv-v2
+  path: keycloak/bootstrap-admin
+  refreshAfter: 60s
+  destination:
+    name: keycloak-bootstrap-admin-operator
+    create: true
+    labels:
+      app.kubernetes.io/name: keycloak
+      app.kubernetes.io/component: identity-provider
+      app.kubernetes.io/managed-by: vault-secrets-operator
+    transformation:
+      excludeRaw: true
+      templates:
+        username:
+          text: '{{ .Secrets.KEYCLOAK_ADMIN }}'
+        password:
+          text: '{{ .Secrets.KEYCLOAK_ADMIN_PASSWORD }}'
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: keycloak-db-operator
+spec:
+  vaultAuthRef: vault-auth-auth-platform
+  mount: secret
+  type: kv-v2
+  path: keycloak/db
+  refreshAfter: 60s
+  destination:
+    name: keycloak-db-operator
+    create: true
+    labels:
+      app.kubernetes.io/name: keycloak
+      app.kubernetes.io/component: database
+      app.kubernetes.io/managed-by: vault-secrets-operator
+    transformation:
+      excludeRaw: true
+      templates:
+        username:
+          text: keycloak
+        password:
+          text: '{{ .Secrets.password }}'
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: keycloak-client-auth-server-ingress
+spec:
+  vaultAuthRef: vault-auth-auth-platform
+  mount: secret
+  type: kv-v2
+  path: keycloak/clients/auth-server-ingress
+  refreshAfter: 60s
+  destination:
+    name: keycloak-client-auth-server-ingress
+    create: true
+    labels:
+      app.kubernetes.io/name: keycloak
+      app.kubernetes.io/component: identity-provider
+      app.kubernetes.io/managed-by: vault-secrets-operator
+    transformation:
+      excludeRaw: true
+      templates:
+        client-secret:
+          text: '{{ .Secrets.client_secret }}'

k8s/overlays/dev/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - ../../base/managing
+  - networkpolicy-baseline.yaml
+  - vault
+  - registry
+  - database
+  - auth
+  - keycloak
+  - storage
+  - keycloak-realm
+
+components:
+  - ../../components/forward-auth

k8s/overlays/dev/networkpolicy-baseline.yaml

@@ -0,0 +1,43 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-all
+  labels:
+    app.kubernetes.io/name: namespace-baseline
+    app.kubernetes.io/instance: mnt
+    app.kubernetes.io/component: network-policy
+    app.kubernetes.io/part-of: infra-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-dns-egress
+  labels:
+    app.kubernetes.io/name: namespace-baseline
+    app.kubernetes.io/instance: mnt
+    app.kubernetes.io/component: network-policy
+    app.kubernetes.io/part-of: infra-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53

k8s/overlays/dev/platform/cert-manager/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml

k8s/overlays/dev/platform/keycloak-operator/kustomization.yaml

@@ -0,0 +1,39 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.6.1/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
+  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.6.1/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
+  - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.6.1/kubernetes/kubernetes.yml
+  - networkpolicy.yaml
+
+patches:
+  - target:
+      kind: ClusterRoleBinding
+      name: keycloak-operator-clusterrole-binding
+    patch: |-
+      - op: replace
+        path: /subjects/0/namespace
+        value: mnt
+  - target:
+      kind: Deployment
+      name: keycloak-operator
+    patch: |-
+      - op: add
+        path: /spec/template/spec/securityContext
+        value:
+          runAsNonRoot: true
+          seccompProfile:
+            type: RuntimeDefault
+      - op: add
+        path: /spec/template/spec/containers/0/securityContext
+        value:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+      - op: replace
+        path: /spec/template/spec/containers/0/startupProbe/failureThreshold
+        value: 18

k8s/overlays/dev/platform/keycloak-operator/networkpolicy.yaml

@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: keycloak-operator-egress-kubernetes-api
+  labels:
+    app.kubernetes.io/name: keycloak-operator
+    app.kubernetes.io/instance: keycloak-operator
+    app.kubernetes.io/component: identity-operator
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: keycloak-operator
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 10.43.0.0/16
+      ports:
+        - protocol: TCP
+          port: 443
+    - to:
+        - ipBlock:
+            cidr: 10.208.141.0/24
+      ports:
+        - protocol: TCP
+          port: 6443

k8s/overlays/dev/platform/traefik/dashboard-service.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-dashboard
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-dev
+    app.kubernetes.io/component: ingress-controller
+    app.kubernetes.io/part-of: platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-kube-system
+  ports:
+    - name: admin
+      port: 8080
+      targetPort: traefik
+      protocol: TCP
+      appProtocol: http

k8s/overlays/dev/platform/traefik/helmchartconfig.yaml

@@ -0,0 +1,44 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-dev
+    app.kubernetes.io/component: ingress-controller
+    app.kubernetes.io/part-of: platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  valuesContent: |-
+    api:
+      dashboard: true
+    deployment:
+      replicas: 2
+    ingressRoute:
+      dashboard:
+        enabled: true
+        entryPoints:
+          - traefik
+    service:
+      spec:
+        externalTrafficPolicy: Local
+    ports:
+      web:
+        tls:
+          enabled: false
+      websecure:
+        tls:
+          enabled: false
+    ingressClass:
+      enabled: true
+      isDefaultClass: true
+    additionalArguments:
+      - "--providers.kubernetesingress.ingressclass=traefik"
+      - "--metrics.prometheus=true"
+    resources:
+      requests:
+        cpu: 100m
+        memory: 128Mi
+      limits:
+        cpu: 500m
+        memory: 256Mi

k8s/overlays/dev/platform/traefik/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: kube-system
+
+resources:
+  - dashboard-service.yaml
+  - helmchartconfig.yaml
+  - middleware.yaml

k8s/overlays/dev/platform/traefik/middleware.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: security-headers
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-dev
+    app.kubernetes.io/component: ingress-controller
+    app.kubernetes.io/part-of: platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  headers:
+    contentTypeNosniff: true
+    browserXssFilter: true
+    referrerPolicy: strict-origin-when-cross-origin
+    frameDeny: true

k8s/overlays/dev/registry/ingress-public.yaml

@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: docker-registry-public
+  labels:
+    app.kubernetes.io/name: docker-registry
+    app.kubernetes.io/instance: docker-registry
+    app.kubernetes.io/version: "2.8.3"
+    app.kubernetes.io/component: registry
+    app.kubernetes.io/part-of: platform-registry
+    app.kubernetes.io/managed-by: kustomize
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-security-headers@kubernetescrd,mnt-docker-registry-basic-auth@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: registry.project.com
+      http:
+        paths:
+          - path: /v2
+            pathType: Prefix
+            backend:
+              service:
+                name: docker-registry
+                port:
+                  name: http

k8s/overlays/dev/registry/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - ../../../base/plugins/docker-registry
+  - vault-secrets.yaml
+  - middleware.yaml
+  - ingress-public.yaml
+  - networkpolicy.yaml

k8s/overlays/dev/registry/middleware.yaml

@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: docker-registry-basic-auth
+  labels:
+    app.kubernetes.io/name: docker-registry
+    app.kubernetes.io/instance: docker-registry
+    app.kubernetes.io/component: registry
+    app.kubernetes.io/part-of: platform-registry
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  basicAuth:
+    secret: docker-registry-basic-auth
+    realm: docker-registry

k8s/overlays/dev/registry/networkpolicy.yaml

@@ -0,0 +1,82 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: docker-registry-ingress-intra
+  labels:
+    app.kubernetes.io/name: docker-registry
+    app.kubernetes.io/instance: docker-registry
+    app.kubernetes.io/component: registry
+    app.kubernetes.io/part-of: platform-registry
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: docker-registry
+      app.kubernetes.io/instance: docker-registry
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector: {}
+      ports:
+        - protocol: TCP
+          port: 5000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: docker-registry-ingress-traefik
+  labels:
+    app.kubernetes.io/name: docker-registry
+    app.kubernetes.io/instance: docker-registry
+    app.kubernetes.io/component: registry
+    app.kubernetes.io/part-of: platform-registry
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: docker-registry
+      app.kubernetes.io/instance: docker-registry
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 5000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: docker-registry-egress-minio
+  labels:
+    app.kubernetes.io/name: docker-registry
+    app.kubernetes.io/instance: docker-registry
+    app.kubernetes.io/component: registry
+    app.kubernetes.io/part-of: platform-registry
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: docker-registry
+      app.kubernetes.io/instance: docker-registry
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              v1.min.io/tenant: minio
+      ports:
+        - protocol: TCP
+          port: 80
+        - protocol: TCP
+          port: 443
+        - protocol: TCP
+          port: 9000

k8s/overlays/dev/registry/vault-secrets.yaml

@@ -0,0 +1,83 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: docker-registry-minio
+spec:
+  vaultAuthRef: vault-auth-storage
+  mount: secret
+  type: kv-v2
+  path: docker-registry/minio
+  refreshAfter: 60s
+  destination:
+    name: docker-registry-minio
+    create: true
+    labels:
+      app.kubernetes.io/name: docker-registry
+      app.kubernetes.io/component: registry
+      app.kubernetes.io/managed-by: vault-secrets-operator
+    transformation:
+      excludeRaw: true
+      templates:
+        REGISTRY_STORAGE_S3_ACCESSKEY:
+          text: '{{ .Secrets.access_key }}'
+        REGISTRY_STORAGE_S3_SECRETKEY:
+          text: '{{ .Secrets.secret_key }}'
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: docker-registry-basic-auth
+spec:
+  vaultAuthRef: vault-auth-storage
+  mount: secret
+  type: kv-v2
+  path: docker-registry/basic-auth
+  refreshAfter: 60s
+  destination:
+    name: docker-registry-basic-auth
+    create: true
+    overwrite: true
+    labels:
+      app.kubernetes.io/name: docker-registry
+      app.kubernetes.io/component: registry
+      app.kubernetes.io/managed-by: vault-secrets-operator
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        users:
+          text: '{{ .Secrets.users }}'
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: docker-registry-pull-credentials
+spec:
+  vaultAuthRef: vault-auth-storage
+  mount: secret
+  type: kv-v2
+  path: docker-registry/basic-auth
+  refreshAfter: 60s
+  destination:
+    name: docker-registry-pull-credentials
+    create: true
+    type: kubernetes.io/dockerconfigjson
+    labels:
+      app.kubernetes.io/name: docker-registry
+      app.kubernetes.io/component: registry
+      app.kubernetes.io/managed-by: vault-secrets-operator
+    transformation:
+      excludeRaw: true
+      templates:
+        .dockerconfigjson:
+          text: |
+            {
+              "auths": {
+                "registry.project.com": {
+                  "username": "{{ .Secrets.username }}",
+                  "password": "{{ .Secrets.password }}",
+                  "auth": "{{ printf "%s:%s" .Secrets.username .Secrets.password | b64enc }}"
+                }
+              }
+            }

k8s/overlays/dev/storage/kustomization.yaml

@@ -0,0 +1,27 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - ../../../base/app/storage/minio/stateful/minio
+  - vault-secrets.yaml
+  - networkpolicy.yaml
+
+patches:
+  - target:
+      group: minio.min.io
+      version: v2
+      kind: Tenant
+      name: minio
+    patch: |-
+      - op: replace
+        path: /spec/certConfig/dnsNames
+        value:
+          - minio
+          - minio-hl
+          - minio.mnt.svc.cluster.local
+          - "*.minio-hl.mnt.svc.cluster.local"
+      - op: replace
+        path: /spec/requestAutoCert
+        value: false

k8s/overlays/dev/storage/networkpolicy.yaml

@@ -0,0 +1,140 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: minio-ingress-peer
+  labels:
+    app.kubernetes.io/name: minio
+    app.kubernetes.io/instance: minio
+    app.kubernetes.io/component: object-storage
+    app.kubernetes.io/part-of: storage-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      v1.min.io/tenant: minio
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              v1.min.io/tenant: minio
+      ports:
+        - protocol: TCP
+          port: 9000
+        - protocol: TCP
+          port: 9001
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: minio-ingress-operator
+  labels:
+    app.kubernetes.io/name: minio
+    app.kubernetes.io/instance: minio
+    app.kubernetes.io/component: object-storage
+    app.kubernetes.io/part-of: storage-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      v1.min.io/tenant: minio
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: minio-operator
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/instance: minio-operator
+              app.kubernetes.io/name: operator
+      ports:
+        - protocol: TCP
+          port: 9000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: minio-ingress-clients
+  labels:
+    app.kubernetes.io/name: minio
+    app.kubernetes.io/instance: minio
+    app.kubernetes.io/component: object-storage
+    app.kubernetes.io/part-of: storage-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      v1.min.io/tenant: minio
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/part-of: auth-platform
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/part-of: platform-registry
+      ports:
+        - protocol: TCP
+          port: 9000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: minio-egress-peer
+  labels:
+    app.kubernetes.io/name: minio
+    app.kubernetes.io/instance: minio
+    app.kubernetes.io/component: object-storage
+    app.kubernetes.io/part-of: storage-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      v1.min.io/tenant: minio
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              v1.min.io/tenant: minio
+      ports:
+        - protocol: TCP
+          port: 9000
+        - protocol: TCP
+          port: 9001
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: minio-egress-kubernetes-api
+  labels:
+    app.kubernetes.io/name: minio
+    app.kubernetes.io/instance: minio
+    app.kubernetes.io/component: object-storage
+    app.kubernetes.io/part-of: storage-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      v1.min.io/tenant: minio
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 10.43.0.0/16
+      ports:
+        - protocol: TCP
+          port: 443
+    - to:
+        - ipBlock:
+            cidr: 10.208.141.0/24
+      ports:
+        - protocol: TCP
+          port: 6443

k8s/overlays/dev/storage/vault-secrets.yaml

@@ -0,0 +1,17 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: minio-tenant-env
+spec:
+  vaultAuthRef: vault-auth-storage
+  mount: secret
+  type: kv-v2
+  path: minio/tenant-env
+  refreshAfter: 60s
+  destination:
+    name: minio-tenant-env
+    create: true
+    labels:
+      app.kubernetes.io/name: minio
+      app.kubernetes.io/component: object-storage
+      app.kubernetes.io/managed-by: vault-secrets-operator

k8s/overlays/dev/vault/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - ../../../base/plugins/vault
+  - networkpolicy.yaml
+
+patches:
+  - target:
+      kind: StatefulSet
+      name: vault
+    patch: |-
+      - op: replace
+        path: /spec/volumeClaimTemplates/0/spec/resources/requests/storage
+        value: 1Gi

k8s/overlays/dev/vault/networkpolicy.yaml

@@ -0,0 +1,76 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: vault-ingress-clients
+  labels:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/instance: vault
+    app.kubernetes.io/component: secret-management
+    app.kubernetes.io/part-of: security-platform
+    app.kubernetes.io/managed-by: kustomize
+# -----------------------------------------------------------------------------
+# Vault 정책 — 두 방향 통제
+#
+# (1) Ingress: VSO Controller Pod 에서만 8200 수신
+#     VSO 가 `vault-secrets-operator-system` ns 와 `mnt` ns 양쪽에서 접근할
+#     가능성 (과거 설치 잔존 + 신규 전용 ns) 이 있어 둘 다 허용.
+#
+# (2) Egress: kube-apiserver 의 TokenReview 호출만 허용
+#     Vault k8s auth 는 클라이언트가 보낸 SA JWT 를 검증하기 위해
+#     `authentication.k8s.io/v1/tokenreviews` 를 호출한다. kube-apiserver 는
+#     host network 프로세스이므로 Pod/Namespace 라벨로 selector 를 못 쓰고
+#     ipBlock 이 불가피 (stock NetworkPolicy 의 한계; Cilium 이면
+#     `toEntities: [kube-apiserver]` 로 해결됨).
+#
+#     두 CIDR 이 필요한 이유:
+#       - 443/TCP → `kubernetes.default.svc` (Service ClusterIP). Vault 가
+#         먼저 보내는 목적지. Service CIDR 에서 할당됨.
+#       - 6443/TCP → control-plane 노드의 실제 kube-apiserver 포트. k3s 의
+#         kube-proxy(iptables) 가 Service → node DNAT 를 수행하는데, 기본
+#         CNI (flannel + kube-router) 는 NetworkPolicy 를 veth iptables 단에서
+#         평가하면서 DNAT 전/후 시점이 엇갈려 두 쪽 모두 허용해야 안전.
+#
+#     CIDR 값의 출처:
+#       - 10.43.0.0/16 → k3s `service-cidr` 기본값. `/etc/rancher/k3s/config.yaml`
+#         의 값과 동기화. 커스텀 service-cidr 를 쓰면 이 값을 맞춰 변경.
+#       - 10.208.141.0/24 → **이 overlay 의 control-plane 노드 서브넷**.
+#         노드를 추가/교체하거나 staging/prod overlay 를 만들 때 실제 값으로
+#         반드시 재지정. dev 단일 노드 기준으로 /24 여유를 둠.
+#
+#     staging/prod overlay 는 이 파일을 그대로 복붙하지 말고 각자의 서브넷으로
+#     교체. 재사용 구조가 필요해지면 base + per-env patch 로 분리할 것.
+# -----------------------------------------------------------------------------
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: vault
+      app.kubernetes.io/instance: vault
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: vault-secrets-operator
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault-secrets-operator-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: vault-secrets-operator
+      ports:
+        - protocol: TCP
+          port: 8200
+  egress:
+    # Vault → kube-apiserver (TokenReview 용)
+    - to:
+        - ipBlock:
+            cidr: 10.43.0.0/16        # k3s service-cidr — kubernetes.default.svc 포함
+        - ipBlock:
+            cidr: 10.208.141.0/24     # dev control-plane 노드 서브넷 (env-specific)
+      ports:
+        - protocol: TCP
+          port: 443                   # Service ClusterIP 경유
+        - protocol: TCP
+          port: 6443                  # node DNAT 후 kube-apiserver 실포트

k8s/overlays/dev/vso/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - ../../../base/plugins/vso