diff --git a/k8s/README.md b/k8s/README.md new file mode 100644 index 000000000..ac428c16c --- /dev/null +++ b/k8s/README.md @@ -0,0 +1,30 @@ +# dat-was-datmt OpenShift 배포 + +이 매니페스트는 `was-sal`, `was-cus`, `was-pro`, `was-sys`를 Gateway 전용 내부 Service로 배포합니다. OpenShift Route는 만들지 않습니다. + +## 반영 전 준비 + +1. `k8s/overlays/dev/kustomization.yaml`의 namespace, 내부 Registry 경로, release tag를 실제 개발망 값으로 바꿉니다. +2. `k8s/base/configmap.yaml`의 `CHANGE_ME` 값을 개발망 MCI/EXTMCI/EAI 주소로 바꿉니다. +3. Secret 값은 Git에 저장하지 말고, 배포 namespace에서 별도로 만듭니다. + +```powershell +oc -n axhub-datmt-dev create secret generic datmt-runtime-secrets --from-env-file=runtime-secrets.env +``` + +`runtime-secrets.env`에는 DB 계정·비밀번호, API 키, 인증서 비밀번호 등 민감값만 넣고 저장소에 추가하지 않습니다. 애플리케이션이 필요한 Secret 키를 사용하지 않는 경우에도 빈 Secret은 먼저 생성해야 Pod의 `envFrom.secretRef`가 정상 해석됩니다. + +## 렌더링과 적용 + +```powershell +oc kustomize k8s/overlays/dev +oc kustomize k8s/overlays/dev | oc apply --dry-run=client -f - +oc apply -k k8s/overlays/dev +oc get deployment,pod,svc -n axhub-datmt-dev +``` + +## Gateway 연결 확인 + +Gateway가 같은 namespace에 있다면 `http://was-sal:8082`, `http://was-cus:8084`, `http://was-pro:8085`, `http://was-sys:8086`로 호출합니다. 다른 namespace에 있으면 `was-.axhub-datmt-dev.svc` FQDN을 사용하고 NetworkPolicy에서 Gateway namespace의 ingress를 허용합니다. + +현재 애플리케이션에는 Actuator health endpoint가 없으므로 TCP readiness/liveness probe를 사용합니다. Actuator를 추가한 뒤에는 HTTP health probe로 바꾸는 것을 권장합니다. diff --git a/k8s/base/configmap.yaml b/k8s/base/configmap.yaml new file mode 100644 index 000000000..3e0fdc3bc --- /dev/null +++ b/k8s/base/configmap.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: datmt-runtime-config + labels: + app.kubernetes.io/part-of: axhub-datmt +data: + SPRING_PROFILES_ACTIVE: dev + TZ: Asia/Seoul + AXHUB_GATEWAY_URL: http://gateway:8080 + GLOW_COMMUNICATION_MCI_HOST: CHANGE_ME + GLOW_COMMUNICATION_MCI_PORT: "26160" + GLOW_COMMUNICATION_EXTMCI_HOST: CHANGE_ME + GLOW_COMMUNICATION_EXTMCI_PORT: "8080" + GLOW_COMMUNICATION_EAI_HOST: CHANGE_ME + GLOW_COMMUNICATION_EAI_PORT: "9999" diff --git a/k8s/base/deployments.yaml b/k8s/base/deployments.yaml new file mode 100644 index 000000000..0556f984e --- /dev/null +++ b/k8s/base/deployments.yaml @@ -0,0 +1,243 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: was-sal + labels: + app.kubernetes.io/name: was-sal + app.kubernetes.io/part-of: axhub-datmt +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: was-sal + template: + metadata: + labels: + app.kubernetes.io/name: was-sal + app.kubernetes.io/part-of: axhub-datmt + spec: + containers: + - name: was-sal + image: was-sal:latest + imagePullPolicy: IfNotPresent + ports: + - name: http + containerPort: 8082 + envFrom: + - configMapRef: + name: datmt-runtime-config + - secretRef: + name: datmt-runtime-secrets + env: + - name: AXHUB_TOOL_URL + value: http://was-sal:8082 + resources: + requests: + cpu: 250m + memory: 512Mi + limits: + cpu: "1" + memory: 1Gi + readinessProbe: + tcpSocket: + port: http + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 6 + livenessProbe: + tcpSocket: + port: http + initialDelaySeconds: 60 + periodSeconds: 20 + timeoutSeconds: 3 + failureThreshold: 3 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: RuntimeDefault +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: was-cus + labels: + app.kubernetes.io/name: was-cus + app.kubernetes.io/part-of: axhub-datmt +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: was-cus + template: + metadata: + labels: + app.kubernetes.io/name: was-cus + app.kubernetes.io/part-of: axhub-datmt + spec: + containers: + - name: was-cus + image: was-cus:latest + imagePullPolicy: IfNotPresent + ports: + - name: http + containerPort: 8084 + envFrom: + - configMapRef: + name: datmt-runtime-config + - secretRef: + name: datmt-runtime-secrets + env: + - name: AXHUB_TOOL_URL + value: http://was-cus:8084 + resources: + requests: + cpu: 250m + memory: 512Mi + limits: + cpu: "1" + memory: 1Gi + readinessProbe: + tcpSocket: + port: http + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 6 + livenessProbe: + tcpSocket: + port: http + initialDelaySeconds: 60 + periodSeconds: 20 + timeoutSeconds: 3 + failureThreshold: 3 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: RuntimeDefault +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: was-pro + labels: + app.kubernetes.io/name: was-pro + app.kubernetes.io/part-of: axhub-datmt +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: was-pro + template: + metadata: + labels: + app.kubernetes.io/name: was-pro + app.kubernetes.io/part-of: axhub-datmt + spec: + containers: + - name: was-pro + image: was-pro:latest + imagePullPolicy: IfNotPresent + ports: + - name: http + containerPort: 8085 + envFrom: + - configMapRef: + name: datmt-runtime-config + - secretRef: + name: datmt-runtime-secrets + env: + - name: AXHUB_TOOL_URL + value: http://was-pro:8085 + resources: + requests: + cpu: 250m + memory: 512Mi + limits: + cpu: "1" + memory: 1Gi + readinessProbe: + tcpSocket: + port: http + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 6 + livenessProbe: + tcpSocket: + port: http + initialDelaySeconds: 60 + periodSeconds: 20 + timeoutSeconds: 3 + failureThreshold: 3 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: RuntimeDefault +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: was-sys + labels: + app.kubernetes.io/name: was-sys + app.kubernetes.io/part-of: axhub-datmt +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: was-sys + template: + metadata: + labels: + app.kubernetes.io/name: was-sys + app.kubernetes.io/part-of: axhub-datmt + spec: + containers: + - name: was-sys + image: was-sys:latest + imagePullPolicy: IfNotPresent + ports: + - name: http + containerPort: 8086 + envFrom: + - configMapRef: + name: datmt-runtime-config + - secretRef: + name: datmt-runtime-secrets + env: + - name: AXHUB_TOOL_URL + value: http://was-sys:8086 + resources: + requests: + cpu: 250m + memory: 512Mi + limits: + cpu: "1" + memory: 1Gi + readinessProbe: + tcpSocket: + port: http + initialDelaySeconds: 20 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 6 + livenessProbe: + tcpSocket: + port: http + initialDelaySeconds: 60 + periodSeconds: 20 + timeoutSeconds: 3 + failureThreshold: 3 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: RuntimeDefault diff --git a/k8s/base/kustomization.yaml b/k8s/base/kustomization.yaml new file mode 100644 index 000000000..a0de3ad19 --- /dev/null +++ b/k8s/base/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - configmap.yaml + - services.yaml + - deployments.yaml diff --git a/k8s/base/services.yaml b/k8s/base/services.yaml new file mode 100644 index 000000000..746a35b05 --- /dev/null +++ b/k8s/base/services.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: was-sal + labels: + app.kubernetes.io/name: was-sal + app.kubernetes.io/part-of: axhub-datmt +spec: + type: ClusterIP + selector: + app.kubernetes.io/name: was-sal + ports: + - name: http + port: 8082 + targetPort: http +--- +apiVersion: v1 +kind: Service +metadata: + name: was-cus + labels: + app.kubernetes.io/name: was-cus + app.kubernetes.io/part-of: axhub-datmt +spec: + type: ClusterIP + selector: + app.kubernetes.io/name: was-cus + ports: + - name: http + port: 8084 + targetPort: http +--- +apiVersion: v1 +kind: Service +metadata: + name: was-pro + labels: + app.kubernetes.io/name: was-pro + app.kubernetes.io/part-of: axhub-datmt +spec: + type: ClusterIP + selector: + app.kubernetes.io/name: was-pro + ports: + - name: http + port: 8085 + targetPort: http +--- +apiVersion: v1 +kind: Service +metadata: + name: was-sys + labels: + app.kubernetes.io/name: was-sys + app.kubernetes.io/part-of: axhub-datmt +spec: + type: ClusterIP + selector: + app.kubernetes.io/name: was-sys + ports: + - name: http + port: 8086 + targetPort: http diff --git a/k8s/overlays/dev/kustomization.yaml b/k8s/overlays/dev/kustomization.yaml new file mode 100644 index 000000000..58121185f --- /dev/null +++ b/k8s/overlays/dev/kustomization.yaml @@ -0,0 +1,26 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +namespace: axhub-datmt-dev + +resources: + - ../../base + +labels: + - pairs: + environment: dev + includeSelectors: true + +images: + - name: was-sal + newName: image-registry.openshift-image-registry.svc:5000/axhub-datmt-dev/was-sal + newTag: latest + - name: was-cus + newName: image-registry.openshift-image-registry.svc:5000/axhub-datmt-dev/was-cus + newTag: latest + - name: was-pro + newName: image-registry.openshift-image-registry.svc:5000/axhub-datmt-dev/was-pro + newTag: latest + - name: was-sys + newName: image-registry.openshift-image-registry.svc:5000/axhub-datmt-dev/was-sys + newTag: latest