init: 폴더구조 설계 및 인프라 설계

k8s/overlays/dev/auth/ingress.yaml

@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: auth-server
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-security-headers@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: auth.local.test
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: auth-server
+                port:
+                  name: http

k8s/overlays/dev/auth/kustomization.yaml

@@ -0,0 +1,50 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: mnt
+
+resources:
+  - ../../../base/app/identity/auth/stateless/auth-server
+  - ../../../base/managing/migration-flyway
+  - ingress.yaml
+  - networkpolicy.yaml
+
+images:
+  - name: registry.example.com/auth-platform/auth-server
+    newName: registry.project.com/auth-platform/auth-server
+    newTag: manual-20260512071751
+
+patches:
+  - target:
+      kind: ConfigMap
+      name: auth-server-config
+    patch: |-
+      - op: add
+        path: /data/APP_SECURITY_KEYCLOAK_ISSUER_URI
+        value: http://keycloak.local.test/realms/platform
+      - op: add
+        path: /data/SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI
+        value: http://keycloak.local.test/realms/platform
+      - op: add
+        path: /data/SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI
+        value: http://keycloak/realms/platform/protocol/openid-connect/certs
+      - op: add
+        path: /data/SERVER_MAX_HTTP_REQUEST_HEADER_SIZE
+        value: 64KB
+  - target:
+      kind: ServiceAccount
+      name: auth-server-sa
+    patch: |-
+      - op: add
+        path: /imagePullSecrets
+        value:
+          - name: docker-registry-pull-credentials
+  - target:
+      kind: Job
+      name: migration-flyway
+    patch: |-
+      - op: add
+        path: /metadata/annotations
+        value:
+          argocd.argoproj.io/sync-wave: "-1"
+          argocd.argoproj.io/hook: PreSync

k8s/overlays/dev/auth/networkpolicy.yaml

@@ -0,0 +1,90 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-server-ingress-traefik
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: auth-server
+      app.kubernetes.io/instance: auth-server
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: auth-server-egress
+  labels:
+    app.kubernetes.io/name: auth-server
+    app.kubernetes.io/instance: auth-server
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: auth-server
+      app.kubernetes.io/instance: auth-server
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: identity-postgres
+              app.kubernetes.io/instance: identity-postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/managed-by: keycloak-operator
+      ports:
+        - protocol: TCP
+          port: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: migration-flyway-egress
+  labels:
+    app.kubernetes.io/name: migration-flyway
+    app.kubernetes.io/instance: migration-flyway
+    app.kubernetes.io/component: migration
+    app.kubernetes.io/part-of: auth-platform
+    app.kubernetes.io/managed-by: kustomize
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: migration-flyway
+      app.kubernetes.io/instance: migration-flyway
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: identity-postgres
+              app.kubernetes.io/instance: identity-postgres
+      ports:
+        - protocol: TCP
+          port: 5432