feat: add OpenShift deployment manifests

2026-08-21 11:27:45 +09:00
parent b617eaabe4
commit ba2f43cd60
6 changed files with 385 additions and 0 deletions
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -0,0 +1,30 @@
+# dat-was-datmt OpenShift 배포
+
+이 매니페스트는 `was-sal`, `was-cus`, `was-pro`, `was-sys`를 Gateway 전용 내부 Service로 배포합니다. OpenShift Route는 만들지 않습니다.
+
+## 반영 전 준비
+
+1. `k8s/overlays/dev/kustomization.yaml`의 namespace, 내부 Registry 경로, release tag를 실제 개발망 값으로 바꿉니다.
+2. `k8s/base/configmap.yaml`의 `CHANGE_ME` 값을 개발망 MCI/EXTMCI/EAI 주소로 바꿉니다.
+3. Secret 값은 Git에 저장하지 말고, 배포 namespace에서 별도로 만듭니다.
+
+```powershell
+oc -n axhub-datmt-dev create secret generic datmt-runtime-secrets --from-env-file=runtime-secrets.env
+```
+
+`runtime-secrets.env`에는 DB 계정·비밀번호, API 키, 인증서 비밀번호 등 민감값만 넣고 저장소에 추가하지 않습니다. 애플리케이션이 필요한 Secret 키를 사용하지 않는 경우에도 빈 Secret은 먼저 생성해야 Pod의 `envFrom.secretRef`가 정상 해석됩니다.
+
+## 렌더링과 적용
+
+```powershell
+oc kustomize k8s/overlays/dev
+oc kustomize k8s/overlays/dev | oc apply --dry-run=client -f -
+oc apply -k k8s/overlays/dev
+oc get deployment,pod,svc -n axhub-datmt-dev
+```
+
+## Gateway 연결 확인
+
+Gateway가 같은 namespace에 있다면 `http://was-sal:8082`, `http://was-cus:8084`, `http://was-pro:8085`, `http://was-sys:8086`로 호출합니다. 다른 namespace에 있으면 `was-<module>.axhub-datmt-dev.svc` FQDN을 사용하고 NetworkPolicy에서 Gateway namespace의 ingress를 허용합니다.
+
+현재 애플리케이션에는 Actuator health endpoint가 없으므로 TCP readiness/liveness probe를 사용합니다. Actuator를 추가한 뒤에는 HTTP health probe로 바꾸는 것을 권장합니다.
--- a/k8s/base/configmap.yaml
+++ b/k8s/base/configmap.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: datmt-runtime-config
+  labels:
+    app.kubernetes.io/part-of: axhub-datmt
+data:
+  SPRING_PROFILES_ACTIVE: dev
+  TZ: Asia/Seoul
+  AXHUB_GATEWAY_URL: http://gateway:8080
+  GLOW_COMMUNICATION_MCI_HOST: CHANGE_ME
+  GLOW_COMMUNICATION_MCI_PORT: "26160"
+  GLOW_COMMUNICATION_EXTMCI_HOST: CHANGE_ME
+  GLOW_COMMUNICATION_EXTMCI_PORT: "8080"
+  GLOW_COMMUNICATION_EAI_HOST: CHANGE_ME
+  GLOW_COMMUNICATION_EAI_PORT: "9999"
--- a/k8s/base/deployments.yaml
+++ b/k8s/base/deployments.yaml
@@ -0,0 +1,243 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: was-sal
+  labels:
+    app.kubernetes.io/name: was-sal
+    app.kubernetes.io/part-of: axhub-datmt
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: was-sal
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: was-sal
+        app.kubernetes.io/part-of: axhub-datmt
+    spec:
+      containers:
+        - name: was-sal
+          image: was-sal:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8082
+          envFrom:
+            - configMapRef:
+                name: datmt-runtime-config
+            - secretRef:
+                name: datmt-runtime-secrets
+          env:
+            - name: AXHUB_TOOL_URL
+              value: http://was-sal:8082
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          readinessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: was-cus
+  labels:
+    app.kubernetes.io/name: was-cus
+    app.kubernetes.io/part-of: axhub-datmt
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: was-cus
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: was-cus
+        app.kubernetes.io/part-of: axhub-datmt
+    spec:
+      containers:
+        - name: was-cus
+          image: was-cus:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8084
+          envFrom:
+            - configMapRef:
+                name: datmt-runtime-config
+            - secretRef:
+                name: datmt-runtime-secrets
+          env:
+            - name: AXHUB_TOOL_URL
+              value: http://was-cus:8084
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          readinessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: was-pro
+  labels:
+    app.kubernetes.io/name: was-pro
+    app.kubernetes.io/part-of: axhub-datmt
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: was-pro
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: was-pro
+        app.kubernetes.io/part-of: axhub-datmt
+    spec:
+      containers:
+        - name: was-pro
+          image: was-pro:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8085
+          envFrom:
+            - configMapRef:
+                name: datmt-runtime-config
+            - secretRef:
+                name: datmt-runtime-secrets
+          env:
+            - name: AXHUB_TOOL_URL
+              value: http://was-pro:8085
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          readinessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: was-sys
+  labels:
+    app.kubernetes.io/name: was-sys
+    app.kubernetes.io/part-of: axhub-datmt
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: was-sys
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: was-sys
+        app.kubernetes.io/part-of: axhub-datmt
+    spec:
+      containers:
+        - name: was-sys
+          image: was-sys:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8086
+          envFrom:
+            - configMapRef:
+                name: datmt-runtime-config
+            - secretRef:
+                name: datmt-runtime-secrets
+          env:
+            - name: AXHUB_TOOL_URL
+              value: http://was-sys:8086
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          readinessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
--- a/k8s/base/kustomization.yaml
+++ b/k8s/base/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - configmap.yaml
+  - services.yaml
+  - deployments.yaml
--- a/k8s/base/services.yaml
+++ b/k8s/base/services.yaml
@@ -0,0 +1,63 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: was-sal
+  labels:
+    app.kubernetes.io/name: was-sal
+    app.kubernetes.io/part-of: axhub-datmt
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: was-sal
+  ports:
+    - name: http
+      port: 8082
+      targetPort: http
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: was-cus
+  labels:
+    app.kubernetes.io/name: was-cus
+    app.kubernetes.io/part-of: axhub-datmt
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: was-cus
+  ports:
+    - name: http
+      port: 8084
+      targetPort: http
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: was-pro
+  labels:
+    app.kubernetes.io/name: was-pro
+    app.kubernetes.io/part-of: axhub-datmt
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: was-pro
+  ports:
+    - name: http
+      port: 8085
+      targetPort: http
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: was-sys
+  labels:
+    app.kubernetes.io/name: was-sys
+    app.kubernetes.io/part-of: axhub-datmt
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: was-sys
+  ports:
+    - name: http
+      port: 8086
+      targetPort: http
--- a/k8s/overlays/dev/kustomization.yaml
+++ b/k8s/overlays/dev/kustomization.yaml
@@ -0,0 +1,26 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: axhub-datmt-dev
+
+resources:
+  - ../../base
+
+labels:
+  - pairs:
+      environment: dev
+    includeSelectors: true
+
+images:
+  - name: was-sal
+    newName: image-registry.openshift-image-registry.svc:5000/axhub-datmt-dev/was-sal
+    newTag: latest
+  - name: was-cus
+    newName: image-registry.openshift-image-registry.svc:5000/axhub-datmt-dev/was-cus
+    newTag: latest
+  - name: was-pro
+    newName: image-registry.openshift-image-registry.svc:5000/axhub-datmt-dev/was-pro
+    newTag: latest
+  - name: was-sys
+    newName: image-registry.openshift-image-registry.svc:5000/axhub-datmt-dev/was-sys
+    newTag: latest