feat: V3 K8S 매니페스트 + ECR Credential Provider + 설계 확정

IaC/3-v3/ansible/inventory/group_vars/all.yml

@@ -19,6 +19,9 @@ gateway_nodeport_https: 30443
 # containerd
 containerd_version: "1.7"
 
+# ECR Credential Provider
+ecr_credential_provider_version: "1.31.1"
+
 # 클러스터
 cluster_name: "dojangkok-v3"
 

IaC/3-v3/ansible/playbooks/site.yml

@@ -11,6 +11,7 @@
     - common
     - containerd
     - kubeadm-prereqs
+    - ecr-credential-provider
 
 # Phase 2: Control Plane 초기화
 - name: Initialize Control Plane

IaC/3-v3/ansible/roles/ecr-credential-provider/handlers/main.yml

@@ -0,0 +1,5 @@
+- name: restart kubelet
+  systemd:
+    name: kubelet
+    state: restarted
+    daemon_reload: true

IaC/3-v3/ansible/roles/ecr-credential-provider/tasks/main.yml

@@ -0,0 +1,50 @@
+# ============================================================
+# V3 K8S Ansible — ECR Credential Provider (kubelet 플러그인)
+# Branch: feat/v3-k8s-iac
+# ============================================================
+# kubelet이 IAM role로 ECR 인증 토큰을 자동 갱신하도록 설정.
+# imagePullSecrets 불필요, 토큰 만료 걱정 없음.
+
+- name: Download ecr-credential-provider binary
+  get_url:
+    url: "https://artifacts.k8s.io/binaries/cloud-provider-aws/v{{ ecr_credential_provider_version }}/linux/arm64/ecr-credential-provider-linux-arm64"
+    dest: /usr/local/bin/ecr-credential-provider
+    mode: "0755"
+    owner: root
+    group: root
+
+- name: Create credential provider config directory
+  file:
+    path: /etc/kubernetes
+    state: directory
+    mode: "0755"
+
+- name: Write credential provider config
+  copy:
+    dest: /etc/kubernetes/ecr-credential-provider-config.yaml
+    mode: "0644"
+    content: |
+      apiVersion: kubelet.config.k8s.io/v1
+      kind: CredentialProviderConfig
+      providers:
+        - name: ecr-credential-provider
+          matchImages:
+            - "*.dkr.ecr.*.amazonaws.com"
+            - "*.dkr.ecr.*.amazonaws.com.cn"
+            - "*.dkr.ecr-fips.*.amazonaws.com"
+          defaultCacheDuration: "12h"
+          apiVersion: credentialprovider.kubelet.k8s.io/v1
+
+- name: Configure kubelet extra args for credential provider
+  copy:
+    dest: /etc/default/kubelet
+    mode: "0644"
+    content: |
+      KUBELET_EXTRA_ARGS=--image-credential-provider-config=/etc/kubernetes/ecr-credential-provider-config.yaml --image-credential-provider-bin-dir=/usr/local/bin
+  notify: restart kubelet
+
+- name: Verify ecr-credential-provider binary
+  command: /usr/local/bin/ecr-credential-provider --version
+  register: ecp_version
+  changed_when: false
+  failed_when: false

IaC/3-v3/ansible/roles/gateway-fabric/tasks/main.yml

@@ -16,8 +16,8 @@
     upgrade --install nginx-gateway
     oci://ghcr.io/nginx/charts/nginx-gateway-fabric
     --namespace nginx-gateway --create-namespace
-    --set service.type=NodePort
-    --set service.ports[0].port=80,service.ports[0].nodePort={{ gateway_nodeport_http }}
-    --set service.ports[1].port=443,service.ports[1].nodePort={{ gateway_nodeport_https }}
+    --set nginx.kind=daemonSet
+    --set nginx.service.type=NodePort
+    --set-json 'nginx.service.nodePorts=[{"port":{{ gateway_nodeport_http }},"listenerPort":80}]'
   register: ngf_install
   changed_when: "'deployed' in ngf_install.stdout or 'upgraded' in ngf_install.stdout"

IaC/3-v3/aws/modules/alb/variables.tf

@@ -27,7 +27,7 @@ variable "gateway_nodeport" {
 
 variable "health_check_path" {
   type    = string
-  default = "/healthz"
+  default = "/"
 }
 
 variable "ssl_certificate_arn" {

k8s/apps/ai-server/configmap.yaml

@@ -0,0 +1,47 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ai-server-config
+  namespace: dojangkok
+  labels:
+    app.kubernetes.io/name: ai-server
+data:
+  # --- App ---
+  APP_ENV: "prod"
+  HTTP_TIMEOUT_SEC: "30"
+  CHROMADB_URL: ""
+
+  # --- vLLM ---
+  VLLM_BASE_URL: "http://63.141.33.33:22140/v1"
+  VLLM_MODEL: "LGAI-EXAONE/EXAONE-3.5-7.8B-Instruct"
+  VLLM_LORA_ADAPTER_CHECKLIST: "checklist"
+  VLLM_LORA_ADAPTER_EASYCONTRACT: "easycontract"
+
+  # --- RabbitMQ 설정 ---
+  RABBITMQ_ENABLED: "true"
+  RABBITMQ_PREFETCH_COUNT: "3"
+  RABBITMQ_DECLARE_PASSIVE: "true"
+
+  # --- RabbitMQ 라우팅 ---
+  RABBITMQ_REQUEST_EXCHANGE_EASY_CONTRACT: "fast.exchange"
+  RABBITMQ_REQUEST_QUEUE_EASY_CONTRACT: "easy-contract.request"
+  RABBITMQ_REQUEST_ROUTING_KEY_EASY_CONTRACT: "easy-contract.request"
+  RABBITMQ_REQUEST_EXCHANGE_CHECKLIST: "fast.exchange"
+  RABBITMQ_REQUEST_QUEUE_CHECKLIST: "checklist.request"
+  RABBITMQ_REQUEST_ROUTING_KEY_CHECKLIST: "checklist.request"
+  RABBITMQ_CANCEL_EXCHANGE_EASY_CONTRACT: "fast.exchange"
+  RABBITMQ_CANCEL_QUEUE_EASY_CONTRACT: "cancel.request"
+  RABBITMQ_CANCEL_ROUTING_KEY_EASY_CONTRACT: "cancel.request"
+  RABBITMQ_RESULT_EXCHANGE: "fast.exchange"
+  RABBITMQ_RESULT_QUEUE: "ai.response"
+  RABBITMQ_RESULT_ROUTING_KEY: "ai.response"
+
+  # --- 재시도 ---
+  WORKER_RETRY_MAX_ATTEMPTS: "3"
+  WORKER_RETRY_BACKOFF_BASE_SEC: "0.5"
+  EXTERNAL_RETRY_MAX_ATTEMPTS: "3"
+  EXTERNAL_RETRY_BACKOFF_BASE_SEC: "0.5"
+
+  # --- 취소 ---
+  EASY_CONTRACT_CANCEL_TTL_SEC: "3600"
+  EASY_CONTRACT_CANCEL_CLEANUP_INTERVAL_SEC: "60"

k8s/apps/ai-server/deployment.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ai-server
+  namespace: dojangkok
+  labels:
+    app.kubernetes.io/name: ai-server
+    app.kubernetes.io/component: ai
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: ai-server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: ai-server
+        app.kubernetes.io/component: ai
+    spec:
+      terminationGracePeriodSeconds: 30
+      containers:
+        - name: ai-server
+          image: 662505429975.dkr.ecr.ap-northeast-2.amazonaws.com/dev-dojangkok-ai:latest
+          ports:
+            - name: http
+              containerPort: 8000
+          envFrom:
+            - configMapRef:
+                name: ai-server-config
+            - secretRef:
+                name: ai-server-secret
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 200m
+              memory: 512Mi
+            limits:
+              cpu: 600m
+              memory: 1024Mi
+          lifecycle:
+            preStop:
+              exec:
+                command: ["sh", "-c", "sleep 10"]

k8s/apps/ai-server/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ai-server
+  namespace: dojangkok
+  labels:
+    app.kubernetes.io/name: ai-server
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: ai-server
+  ports:
+    - name: http
+      port: 8000
+      targetPort: 8000
+      protocol: TCP

k8s/apps/backend/configmap.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: backend-config
+  namespace: dojangkok
+  labels:
+    app.kubernetes.io/name: backend
+data:
+  SPRING_PROFILES_ACTIVE: "dev"
+  LOG_LEVEL: "INFO"

k8s/apps/backend/deployment.yaml

@@ -0,0 +1,77 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: dojangkok
+  labels:
+    app.kubernetes.io/name: backend
+    app.kubernetes.io/component: api
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: backend
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: backend
+        app.kubernetes.io/component: api
+    spec:
+      terminationGracePeriodSeconds: 30
+      containers:
+        - name: backend
+          image: 662505429975.dkr.ecr.ap-northeast-2.amazonaws.com/dev-dojangkok-be:latest
+          ports:
+            - name: http
+              containerPort: 8080
+          envFrom:
+            - configMapRef:
+                name: backend-config
+          env:
+            - name: SPRING_CONFIG_LOCATION
+              value: "file:/app/config/application.yaml"
+          volumeMounts:
+            - name: spring-config
+              mountPath: /app/config
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /actuator/health/readiness
+              port: 8080
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /actuator/health/liveness
+              port: 8080
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          startupProbe:
+            httpGet:
+              path: /actuator/health
+              port: 8080
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 30
+          resources:
+            requests:
+              cpu: 200m
+              memory: 512Mi
+            limits:
+              cpu: 600m
+              memory: 1024Mi
+          lifecycle:
+            preStop:
+              exec:
+                command: ["sh", "-c", "sleep 10"]
+      volumes:
+        - name: spring-config
+          secret:
+            secretName: backend-secret
+            items:
+              - key: application.yaml
+                path: application.yaml

k8s/apps/backend/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: dojangkok
+  labels:
+    app.kubernetes.io/name: backend
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: backend
+  ports:
+    - name: http
+      port: 8080
+      targetPort: 8080
+      protocol: TCP

k8s/apps/frontend/configmap.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: frontend-config
+  namespace: dojangkok
+  labels:
+    app.kubernetes.io/name: frontend
+data: {}
+  # NEXT_PUBLIC_*는 빌드 시 결정 → 런타임 ConfigMap으로는 효과 없음
+  # 런타임에 필요한 env가 확인되면 여기에 추가

k8s/apps/frontend/deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: dojangkok
+  labels:
+    app.kubernetes.io/name: frontend
+    app.kubernetes.io/component: web
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: frontend
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: frontend
+        app.kubernetes.io/component: web
+    spec:
+      terminationGracePeriodSeconds: 30
+      containers:
+        - name: frontend
+          image: 662505429975.dkr.ecr.ap-northeast-2.amazonaws.com/dev-dojangkok-fe:latest
+          ports:
+            - name: http
+              containerPort: 3000
+          envFrom:
+            - configMapRef:
+                name: frontend-config
+          readinessProbe:
+            httpGet:
+              path: /health-check
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health-check
+              port: 3000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 2
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 300m
+              memory: 512Mi
+          lifecycle:
+            preStop:
+              exec:
+                command: ["sh", "-c", "sleep 5"]