feat: K8S 매니페스트 Kustomize 전환 + ESO/ArgoCD 부트스트랩 구성 - #280
Closed
WAFriend3416 wants to merge 9 commits into
Closed
Conversation
- node-sizing, monitoring-plan, iac-plan, cicd-plan, cost-comparison을 reference/로 이동 - design-step5.md 하이브리드 모니터링 반영 및 수치 정합 수정
- Plain YAML → Kustomize base/overlays 구조로 재배치 - dev overlay: base 그대로 (CI용 image tag 관리) - prod overlay: replicas 증가, 리소스 상향, ECR prod 이미지 전환 - chatting-be 서비스 추가 (Spring Boot, /chat placeholder 라우팅) - ESO ExternalSecret 리소스 추가 (backend, ai-server, chatting-be)
- k8s/infra/: ArgoCD, ESO, Gateway Fabric, kube-state-metrics, Alloy Helm values - ClusterSecretStore: AWS Secrets Manager 연동 리소스 - ArgoCD Ansible role: Phase 4에서 Helm 설치 + rollout 대기 - site.yml: argocd role 추가 (gateway-fabric 다음 실행)
- external-secrets Helm 설치 Ansible role 작성 - site.yml Phase 4에 external-secrets role 추가 - IAM에 secretsmanager:GetSecretValue/DescribeSecret 정책 추가 (dojangkok/* 스코프) - IAM 모듈에 aws_region, aws_account_id 변수 추가
- ClusterSecretStore에서 jwt auth 제거 → EC2 Instance Profile 사용 - ArgoCD Application (apps-dev) 생성 — k8s/apps/overlays/dev 자동 sync - ESO Ansible role에 ClusterSecretStore apply task 추가 - ArgoCD Ansible role에 Application apply task 추가 - site.yml에서 external-secrets를 argocd보다 먼저 실행하도록 순서 변경
Contributor
Terraform Plan Result
Plan Outputdata.aws_vpc.existing: Reading...
data.aws_subnet.existing_public_2c: Reading...
data.aws_internet_gateway.existing: Reading...
data.aws_caller_identity.current: Reading...
module.k8s_nodes.data.aws_ami.ubuntu: Reading...
data.aws_subnet.existing_public_2a: Reading...
module.nat_instance.data.aws_ami.ubuntu: Reading...
data.aws_caller_identity.current: Read complete after 0s [id=662505429975]
data.aws_internet_gateway.existing: Read complete after 1s [id=igw-09f0f9ca0e2253420]
data.aws_subnet.existing_public_2c: Read complete after 1s [id=subnet-08e037b9fbd856118]
data.aws_subnet.existing_public_2a: Read complete after 1s [id=subnet-0d0295b4a08a503a9]
module.k8s_nodes.data.aws_ami.ubuntu: Read complete after 1s [id=ami-0bbcd617c4dcdf5a7]
module.nat_instance.data.aws_ami.ubuntu: Read complete after 1s [id=ami-0bbcd617c4dcdf5a7]
data.aws_vpc.existing: Read complete after 2s [id=vpc-08b809f7d33f0f9b1]
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# aws_security_group_rule.alb_to_worker_nodeport will be created
+ resource "aws_security_group_rule" "alb_to_worker_nodeport" {
+ description = "ALB to Worker Gateway NodePort"
+ from_port = 30080
+ id = (known after apply)
+ protocol = "tcp"
+ security_group_id = (known after apply)
+ security_group_rule_id = (known after apply)
+ self = false
+ source_security_group_id = (known after apply)
+ to_port = 30080
+ type = "ingress"
}
# module.alb.aws_lb.this will be created
+ resource "aws_lb" "this" {
+ arn = (known after apply)
+ arn_suffix = (known after apply)
+ client_keep_alive = 3600
+ desync_mitigation_mode = "defensive"
+ dns_name = (known after apply)
+ drop_invalid_header_fields = false
+ enable_deletion_protection = false
+ enable_http2 = true
+ enable_tls_version_and_cipher_suite_headers = false
+ enable_waf_fail_open = false
+ enable_xff_client_port = false
+ enable_zonal_shift = false
+ enforce_security_group_inbound_rules_on_private_link_traffic = (known after apply)
+ id = (known after apply)
+ idle_timeout = 60
+ internal = false
+ ip_address_type = (known after apply)
+ load_balancer_type = "application"
+ name = "k8s-dev-k8s-alb"
+ name_prefix = (known after apply)
+ preserve_host_header = false
+ security_groups = (known after apply)
+ subnets = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-alb"
+ "Project" = "dojangkok"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-alb"
+ "Project" = "dojangkok"
}
+ vpc_id = (known after apply)
+ xff_header_processing_mode = "append"
+ zone_id = (known after apply)
+ subnet_mapping (known after apply)
}
# module.alb.aws_lb_listener.http will be created
+ resource "aws_lb_listener" "http" {
+ arn = (known after apply)
+ id = (known after apply)
+ load_balancer_arn = (known after apply)
+ port = 80
+ protocol = "HTTP"
+ routing_http_request_x_amzn_mtls_clientcert_header_name = (known after apply)
+ routing_http_request_x_amzn_mtls_clientcert_issuer_header_name = (known after apply)
+ routing_http_request_x_amzn_mtls_clientcert_leaf_header_name = (known after apply)
+ routing_http_request_x_amzn_mtls_clientcert_serial_number_header_name = (known after apply)
+ routing_http_request_x_amzn_mtls_clientcert_subject_header_name = (known after apply)
+ routing_http_request_x_amzn_mtls_clientcert_validity_header_name = (known after apply)
+ routing_http_request_x_amzn_tls_cipher_suite_header_name = (known after apply)
+ routing_http_request_x_amzn_tls_version_header_name = (known after apply)
+ routing_http_response_access_control_allow_credentials_header_value = (known after apply)
+ routing_http_response_access_control_allow_headers_header_value = (known after apply)
+ routing_http_response_access_control_allow_methods_header_value = (known after apply)
+ routing_http_response_access_control_allow_origin_header_value = (known after apply)
+ routing_http_response_access_control_expose_headers_header_value = (known after apply)
+ routing_http_response_access_control_max_age_header_value = (known after apply)
+ routing_http_response_content_security_policy_header_value = (known after apply)
+ routing_http_response_server_enabled = (known after apply)
+ routing_http_response_strict_transport_security_header_value = (known after apply)
+ routing_http_response_x_content_type_options_header_value = (known after apply)
+ routing_http_response_x_frame_options_header_value = (known after apply)
+ ssl_policy = (known after apply)
+ tags_all = (known after apply)
+ tcp_idle_timeout_seconds = (known after apply)
+ default_action {
+ order = (known after apply)
+ type = "redirect"
+ redirect {
+ host = "#{host}"
+ path = "/#{path}"
+ port = "443"
+ protocol = "HTTPS"
+ query = "#{query}"
+ status_code = "HTTP_301"
}
}
+ mutual_authentication (known after apply)
}
# module.alb.aws_lb_listener.https[0] will be created
+ resource "aws_lb_listener" "https" {
+ arn = (known after apply)
+ certificate_arn = "arn:aws:acm:ap-northeast-2:662505429975:certificate/dd1460c6-2aff-4b27-83e8-a7504b87de4d"
+ id = (known after apply)
+ load_balancer_arn = (known after apply)
+ port = 443
+ protocol = "HTTPS"
+ routing_http_request_x_amzn_mtls_clientcert_header_name = (known after apply)
+ routing_http_request_x_amzn_mtls_clientcert_issuer_header_name = (known after apply)
+ routing_http_request_x_amzn_mtls_clientcert_leaf_header_name = (known after apply)
+ routing_http_request_x_amzn_mtls_clientcert_serial_number_header_name = (known after apply)
+ routing_http_request_x_amzn_mtls_clientcert_subject_header_name = (known after apply)
+ routing_http_request_x_amzn_mtls_clientcert_validity_header_name = (known after apply)
+ routing_http_request_x_amzn_tls_cipher_suite_header_name = (known after apply)
+ routing_http_request_x_amzn_tls_version_header_name = (known after apply)
+ routing_http_response_access_control_allow_credentials_header_value = (known after apply)
+ routing_http_response_access_control_allow_headers_header_value = (known after apply)
+ routing_http_response_access_control_allow_methods_header_value = (known after apply)
+ routing_http_response_access_control_allow_origin_header_value = (known after apply)
+ routing_http_response_access_control_expose_headers_header_value = (known after apply)
+ routing_http_response_access_control_max_age_header_value = (known after apply)
+ routing_http_response_content_security_policy_header_value = (known after apply)
+ routing_http_response_server_enabled = (known after apply)
+ routing_http_response_strict_transport_security_header_value = (known after apply)
+ routing_http_response_x_content_type_options_header_value = (known after apply)
+ routing_http_response_x_frame_options_header_value = (known after apply)
+ ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
+ tags_all = (known after apply)
+ tcp_idle_timeout_seconds = (known after apply)
+ default_action {
+ order = (known after apply)
+ target_group_arn = (known after apply)
+ type = "forward"
}
+ mutual_authentication (known after apply)
}
# module.alb.aws_lb_target_group.gateway will be created
+ resource "aws_lb_target_group" "gateway" {
+ arn = (known after apply)
+ arn_suffix = (known after apply)
+ connection_termination = (known after apply)
+ deregistration_delay = "300"
+ id = (known after apply)
+ ip_address_type = (known after apply)
+ lambda_multi_value_headers_enabled = false
+ load_balancer_arns = (known after apply)
+ load_balancing_algorithm_type = (known after apply)
+ load_balancing_anomaly_mitigation = (known after apply)
+ load_balancing_cross_zone_enabled = (known after apply)
+ name = "k8s-dev-k8s-gw"
+ name_prefix = (known after apply)
+ port = 30080
+ preserve_client_ip = (known after apply)
+ protocol = "HTTP"
+ protocol_version = (known after apply)
+ proxy_protocol_v2 = false
+ slow_start = 0
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-gateway-tg"
+ "Project" = "dojangkok"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-gateway-tg"
+ "Project" = "dojangkok"
}
+ target_type = "instance"
+ vpc_id = "vpc-08b809f7d33f0f9b1"
+ health_check {
+ enabled = true
+ healthy_threshold = 3
+ interval = 30
+ matcher = (known after apply)
+ path = "/"
+ port = "30080"
+ protocol = "HTTP"
+ timeout = 5
+ unhealthy_threshold = 3
}
+ stickiness (known after apply)
+ target_failover (known after apply)
+ target_group_health (known after apply)
+ target_health_state (known after apply)
}
# module.alb.aws_lb_target_group_attachment.workers["w-2a-1"] will be created
+ resource "aws_lb_target_group_attachment" "workers" {
+ id = (known after apply)
+ port = 30080
+ target_group_arn = (known after apply)
+ target_id = (known after apply)
}
# module.alb.aws_lb_target_group_attachment.workers["w-2b-1"] will be created
+ resource "aws_lb_target_group_attachment" "workers" {
+ id = (known after apply)
+ port = 30080
+ target_group_arn = (known after apply)
+ target_id = (known after apply)
}
# module.alb.aws_lb_target_group_attachment.workers["w-2c-1"] will be created
+ resource "aws_lb_target_group_attachment" "workers" {
+ id = (known after apply)
+ port = 30080
+ target_group_arn = (known after apply)
+ target_id = (known after apply)
}
# module.iam.aws_iam_instance_profile.k8s_node will be created
+ resource "aws_iam_instance_profile" "k8s_node" {
+ arn = (known after apply)
+ create_date = (known after apply)
+ id = (known after apply)
+ name = "k8s-dev-k8s-node-profile"
+ name_prefix = (known after apply)
+ path = "/"
+ role = "k8s-dev-k8s-node-role"
+ tags_all = (known after apply)
+ unique_id = (known after apply)
}
# module.iam.aws_iam_role.k8s_node will be created
+ resource "aws_iam_role" "k8s_node" {
+ arn = (known after apply)
+ assume_role_policy = jsonencode(
{
+ Statement = [
+ {
+ Action = "sts:AssumeRole"
+ Effect = "Allow"
+ Principal = {
+ Service = "ec2.amazonaws.com"
}
},
]
+ Version = "2012-10-17"
}
)
+ create_date = (known after apply)
+ force_detach_policies = false
+ id = (known after apply)
+ managed_policy_arns = (known after apply)
+ max_session_duration = 3600
+ name = "k8s-dev-k8s-node-role"
+ name_prefix = (known after apply)
+ path = "/"
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Project" = "dojangkok"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Project" = "dojangkok"
}
+ unique_id = (known after apply)
+ inline_policy (known after apply)
}
# module.iam.aws_iam_role_policy.ebs_csi will be created
+ resource "aws_iam_role_policy" "ebs_csi" {
+ id = (known after apply)
+ name = "ebs-csi"
+ name_prefix = (known after apply)
+ policy = jsonencode(
{
+ Statement = [
+ {
+ Action = [
+ "ec2:CreateVolume",
+ "ec2:DeleteVolume",
+ "ec2:AttachVolume",
+ "ec2:DetachVolume",
+ "ec2:DescribeVolumes",
+ "ec2:DescribeInstances",
+ "ec2:DescribeAvailabilityZones",
+ "ec2:ModifyVolume",
+ "ec2:DescribeVolumesModifications",
+ "ec2:CreateTags",
]
+ Effect = "Allow"
+ Resource = "*"
},
]
+ Version = "2012-10-17"
}
)
+ role = (known after apply)
}
# module.iam.aws_iam_role_policy.ecr_pull will be created
+ resource "aws_iam_role_policy" "ecr_pull" {
+ id = (known after apply)
+ name = "ecr-pull"
+ name_prefix = (known after apply)
+ policy = jsonencode(
{
+ Statement = [
+ {
+ Action = [
+ "ecr:GetDownloadUrlForLayer",
+ "ecr:BatchGetImage",
+ "ecr:BatchCheckLayerAvailability",
+ "ecr:GetAuthorizationToken",
]
+ Effect = "Allow"
+ Resource = "*"
},
]
+ Version = "2012-10-17"
}
)
+ role = (known after apply)
}
# module.iam.aws_iam_role_policy.secrets_manager will be created
+ resource "aws_iam_role_policy" "secrets_manager" {
+ id = (known after apply)
+ name = "secrets-manager-read"
+ name_prefix = (known after apply)
+ policy = jsonencode(
{
+ Statement = [
+ {
+ Action = [
+ "secretsmanager:GetSecretValue",
+ "secretsmanager:DescribeSecret",
]
+ Effect = "Allow"
+ Resource = "arn:aws:secretsmanager:ap-northeast-2:662505429975:secret:dojangkok/*"
},
]
+ Version = "2012-10-17"
}
)
+ role = (known after apply)
}
# module.iam.aws_iam_role_policy.ssm_s3 will be created
+ resource "aws_iam_role_policy" "ssm_s3" {
+ id = (known after apply)
+ name = "ssm-s3-transfer"
+ name_prefix = (known after apply)
+ policy = jsonencode(
{
+ Statement = [
+ {
+ Action = [
+ "s3:GetObject",
+ "s3:PutObject",
+ "s3:DeleteObject",
+ "s3:GetBucketLocation",
+ "s3:ListBucket",
]
+ Effect = "Allow"
+ Resource = [
+ "arn:aws:s3:::dojangkok-v3-ansible-ssm",
+ "arn:aws:s3:::dojangkok-v3-ansible-ssm/*",
]
},
]
+ Version = "2012-10-17"
}
)
+ role = (known after apply)
}
# module.iam.aws_iam_role_policy_attachment.ssm will be created
+ resource "aws_iam_role_policy_attachment" "ssm" {
+ id = (known after apply)
+ policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+ role = "k8s-dev-k8s-node-role"
}
# module.k8s_networking.aws_route_table.private["a"] will be created
+ resource "aws_route_table" "private" {
+ arn = (known after apply)
+ id = (known after apply)
+ owner_id = (known after apply)
+ propagating_vgws = (known after apply)
+ route = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-private-rt-a"
+ "Project" = "dojangkok"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-private-rt-a"
+ "Project" = "dojangkok"
}
+ vpc_id = "vpc-08b809f7d33f0f9b1"
}
# module.k8s_networking.aws_route_table.private["b"] will be created
+ resource "aws_route_table" "private" {
+ arn = (known after apply)
+ id = (known after apply)
+ owner_id = (known after apply)
+ propagating_vgws = (known after apply)
+ route = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-private-rt-b"
+ "Project" = "dojangkok"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-private-rt-b"
+ "Project" = "dojangkok"
}
+ vpc_id = "vpc-08b809f7d33f0f9b1"
}
# module.k8s_networking.aws_route_table.private["c"] will be created
+ resource "aws_route_table" "private" {
+ arn = (known after apply)
+ id = (known after apply)
+ owner_id = (known after apply)
+ propagating_vgws = (known after apply)
+ route = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-private-rt-c"
+ "Project" = "dojangkok"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-private-rt-c"
+ "Project" = "dojangkok"
}
+ vpc_id = "vpc-08b809f7d33f0f9b1"
}
# module.k8s_networking.aws_route_table.public[0] will be created
+ resource "aws_route_table" "public" {
+ arn = (known after apply)
+ id = (known after apply)
+ owner_id = (known after apply)
+ propagating_vgws = (known after apply)
+ route = [
+ {
+ cidr_block = "0.0.0.0/0"
+ gateway_id = "igw-09f0f9ca0e2253420"
# (11 unchanged attributes hidden)
},
]
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-public-rt"
+ "Project" = "dojangkok"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-public-rt"
+ "Project" = "dojangkok"
}
+ vpc_id = "vpc-08b809f7d33f0f9b1"
}
# module.k8s_networking.aws_route_table_association.private["k8s-2a"] will be created
+ resource "aws_route_table_association" "private" {
+ id = (known after apply)
+ route_table_id = (known after apply)
+ subnet_id = (known after apply)
}
# module.k8s_networking.aws_route_table_association.private["k8s-2b"] will be created
+ resource "aws_route_table_association" "private" {
+ id = (known after apply)
+ route_table_id = (known after apply)
+ subnet_id = (known after apply)
}
# module.k8s_networking.aws_route_table_association.private["k8s-2c"] will be created
+ resource "aws_route_table_association" "private" {
+ id = (known after apply)
+ route_table_id = (known after apply)
+ subnet_id = (known after apply)
}
# module.k8s_networking.aws_route_table_association.public["public-2b"] will be created
+ resource "aws_route_table_association" "public" {
+ id = (known after apply)
+ route_table_id = (known after apply)
+ subnet_id = (known after apply)
}
# module.k8s_networking.aws_subnet.subnets["k8s-2a"] will be created
+ resource "aws_subnet" "subnets" {
+ arn = (known after apply)
+ assign_ipv6_address_on_creation = false
+ availability_zone = "ap-northeast-2a"
+ availability_zone_id = (known after apply)
+ cidr_block = "10.0.32.0/22"
+ enable_dns64 = false
+ enable_resource_name_dns_a_record_on_launch = false
+ enable_resource_name_dns_aaaa_record_on_launch = false
+ id = (known after apply)
+ ipv6_cidr_block_association_id = (known after apply)
+ ipv6_native = false
+ map_public_ip_on_launch = false
+ owner_id = (known after apply)
+ private_dns_hostname_type_on_launch = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-2a"
+ "Project" = "dojangkok"
+ "Tier" = "private"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-2a"
+ "Project" = "dojangkok"
+ "Tier" = "private"
}
+ vpc_id = "vpc-08b809f7d33f0f9b1"
}
# module.k8s_networking.aws_subnet.subnets["k8s-2b"] will be created
+ resource "aws_subnet" "subnets" {
+ arn = (known after apply)
+ assign_ipv6_address_on_creation = false
+ availability_zone = "ap-northeast-2b"
+ availability_zone_id = (known after apply)
+ cidr_block = "10.0.36.0/22"
+ enable_dns64 = false
+ enable_resource_name_dns_a_record_on_launch = false
+ enable_resource_name_dns_aaaa_record_on_launch = false
+ id = (known after apply)
+ ipv6_cidr_block_association_id = (known after apply)
+ ipv6_native = false
+ map_public_ip_on_launch = false
+ owner_id = (known after apply)
+ private_dns_hostname_type_on_launch = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-2b"
+ "Project" = "dojangkok"
+ "Tier" = "private"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-2b"
+ "Project" = "dojangkok"
+ "Tier" = "private"
}
+ vpc_id = "vpc-08b809f7d33f0f9b1"
}
# module.k8s_networking.aws_subnet.subnets["k8s-2c"] will be created
+ resource "aws_subnet" "subnets" {
+ arn = (known after apply)
+ assign_ipv6_address_on_creation = false
+ availability_zone = "ap-northeast-2c"
+ availability_zone_id = (known after apply)
+ cidr_block = "10.0.40.0/22"
+ enable_dns64 = false
+ enable_resource_name_dns_a_record_on_launch = false
+ enable_resource_name_dns_aaaa_record_on_launch = false
+ id = (known after apply)
+ ipv6_cidr_block_association_id = (known after apply)
+ ipv6_native = false
+ map_public_ip_on_launch = false
+ owner_id = (known after apply)
+ private_dns_hostname_type_on_launch = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-2c"
+ "Project" = "dojangkok"
+ "Tier" = "private"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-k8s-2c"
+ "Project" = "dojangkok"
+ "Tier" = "private"
}
+ vpc_id = "vpc-08b809f7d33f0f9b1"
}
# module.k8s_networking.aws_subnet.subnets["public-2b"] will be created
+ resource "aws_subnet" "subnets" {
+ arn = (known after apply)
+ assign_ipv6_address_on_creation = false
+ availability_zone = "ap-northeast-2b"
+ availability_zone_id = (known after apply)
+ cidr_block = "10.0.1.0/24"
+ enable_dns64 = false
+ enable_resource_name_dns_a_record_on_launch = false
+ enable_resource_name_dns_aaaa_record_on_launch = false
+ id = (known after apply)
+ ipv6_cidr_block_association_id = (known after apply)
+ ipv6_native = false
+ map_public_ip_on_launch = false
+ owner_id = (known after apply)
+ private_dns_hostname_type_on_launch = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-public-2b"
+ "Project" = "dojangkok"
+ "Tier" = "public"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-public-2b"
+ "Project" = "dojangkok"
+ "Tier" = "public"
}
+ vpc_id = "vpc-08b809f7d33f0f9b1"
}
# module.k8s_nodes.aws_instance.control_plane will be created
+ resource "aws_instance" "control_plane" {
+ ami = "ami-0bbcd617c4dcdf5a7"
+ arn = (known after apply)
+ associate_public_ip_address = (known after apply)
+ availability_zone = (known after apply)
+ cpu_core_count = (known after apply)
+ cpu_threads_per_core = (known after apply)
+ disable_api_stop = (known after apply)
+ disable_api_termination = (known after apply)
+ ebs_optimized = (known after apply)
+ enable_primary_ipv6 = (known after apply)
+ get_password_data = false
+ host_id = (known after apply)
+ host_resource_group_arn = (known after apply)
+ iam_instance_profile = "k8s-dev-k8s-node-profile"
+ id = (known after apply)
+ instance_initiated_shutdown_behavior = (known after apply)
+ instance_lifecycle = (known after apply)
+ instance_state = (known after apply)
+ instance_type = "t4g.medium"
+ ipv6_address_count = (known after apply)
+ ipv6_addresses = (known after apply)
+ key_name = (known after apply)
+ monitoring = (known after apply)
+ outpost_arn = (known after apply)
+ password_data = (known after apply)
+ placement_group = (known after apply)
+ placement_partition_number = (known after apply)
+ primary_network_interface_id = (known after apply)
+ private_dns = (known after apply)
+ private_ip = (known after apply)
+ public_dns = (known after apply)
+ public_ip = (known after apply)
+ secondary_private_ips = (known after apply)
+ security_groups = (known after apply)
+ source_dest_check = false
+ spot_instance_request_id = (known after apply)
+ subnet_id = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-cp"
+ "Project" = "dojangkok"
+ "k8s:cluster-name" = "dojangkok-v3"
+ "k8s:nodepool" = "system"
+ "k8s:role" = "control-plane"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-cp"
+ "Project" = "dojangkok"
+ "k8s:cluster-name" = "dojangkok-v3"
+ "k8s:nodepool" = "system"
+ "k8s:role" = "control-plane"
}
+ tenancy = (known after apply)
+ user_data = "36a3c6492d421275603efbd5b55ddb59396bf446"
+ user_data_base64 = (known after apply)
+ user_data_replace_on_change = false
+ vpc_security_group_ids = (known after apply)
+ capacity_reservation_specification (known after apply)
+ cpu_options (known after apply)
+ ebs_block_device (known after apply)
+ enclave_options (known after apply)
+ ephemeral_block_device (known after apply)
+ instance_market_options (known after apply)
+ maintenance_options (known after apply)
+ metadata_options {
+ http_endpoint = "enabled"
+ http_protocol_ipv6 = "disabled"
+ http_put_response_hop_limit = 2
+ http_tokens = "required"
+ instance_metadata_tags = (known after apply)
}
+ network_interface (known after apply)
+ private_dns_name_options (known after apply)
+ root_block_device {
+ delete_on_termination = true
+ device_name = (known after apply)
+ encrypted = true
+ iops = (known after apply)
+ kms_key_id = (known after apply)
+ tags_all = (known after apply)
+ throughput = (known after apply)
+ volume_id = (known after apply)
+ volume_size = 30
+ volume_type = "gp3"
}
}
# module.k8s_nodes.aws_instance.workers["w-2a-1"] will be created
+ resource "aws_instance" "workers" {
+ ami = "ami-0bbcd617c4dcdf5a7"
+ arn = (known after apply)
+ associate_public_ip_address = (known after apply)
+ availability_zone = (known after apply)
+ cpu_core_count = (known after apply)
+ cpu_threads_per_core = (known after apply)
+ disable_api_stop = (known after apply)
+ disable_api_termination = (known after apply)
+ ebs_optimized = (known after apply)
+ enable_primary_ipv6 = (known after apply)
+ get_password_data = false
+ host_id = (known after apply)
+ host_resource_group_arn = (known after apply)
+ iam_instance_profile = "k8s-dev-k8s-node-profile"
+ id = (known after apply)
+ instance_initiated_shutdown_behavior = (known after apply)
+ instance_lifecycle = (known after apply)
+ instance_state = (known after apply)
+ instance_type = "t4g.large"
+ ipv6_address_count = (known after apply)
+ ipv6_addresses = (known after apply)
+ key_name = (known after apply)
+ monitoring = (known after apply)
+ outpost_arn = (known after apply)
+ password_data = (known after apply)
+ placement_group = (known after apply)
+ placement_partition_number = (known after apply)
+ primary_network_interface_id = (known after apply)
+ private_dns = (known after apply)
+ private_ip = (known after apply)
+ public_dns = (known after apply)
+ public_ip = (known after apply)
+ secondary_private_ips = (known after apply)
+ security_groups = (known after apply)
+ source_dest_check = false
+ spot_instance_request_id = (known after apply)
+ subnet_id = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-w-2a-1"
+ "Project" = "dojangkok"
+ "k8s:cluster-name" = "dojangkok-v3"
+ "k8s:nodepool" = "default"
+ "k8s:role" = "worker"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-w-2a-1"
+ "Project" = "dojangkok"
+ "k8s:cluster-name" = "dojangkok-v3"
+ "k8s:nodepool" = "default"
+ "k8s:role" = "worker"
}
+ tenancy = (known after apply)
+ user_data = "36a3c6492d421275603efbd5b55ddb59396bf446"
+ user_data_base64 = (known after apply)
+ user_data_replace_on_change = false
+ vpc_security_group_ids = (known after apply)
+ capacity_reservation_specification (known after apply)
+ cpu_options (known after apply)
+ credit_specification {
+ cpu_credits = "unlimited"
}
+ ebs_block_device (known after apply)
+ enclave_options (known after apply)
+ ephemeral_block_device (known after apply)
+ instance_market_options (known after apply)
+ maintenance_options (known after apply)
+ metadata_options {
+ http_endpoint = "enabled"
+ http_protocol_ipv6 = "disabled"
+ http_put_response_hop_limit = 2
+ http_tokens = "required"
+ instance_metadata_tags = (known after apply)
}
+ network_interface (known after apply)
+ private_dns_name_options (known after apply)
+ root_block_device {
+ delete_on_termination = true
+ device_name = (known after apply)
+ encrypted = true
+ iops = (known after apply)
+ kms_key_id = (known after apply)
+ tags_all = (known after apply)
+ throughput = (known after apply)
+ volume_id = (known after apply)
+ volume_size = 30
+ volume_type = "gp3"
}
}
# module.k8s_nodes.aws_instance.workers["w-2b-1"] will be created
+ resource "aws_instance" "workers" {
+ ami = "ami-0bbcd617c4dcdf5a7"
+ arn = (known after apply)
+ associate_public_ip_address = (known after apply)
+ availability_zone = (known after apply)
+ cpu_core_count = (known after apply)
+ cpu_threads_per_core = (known after apply)
+ disable_api_stop = (known after apply)
+ disable_api_termination = (known after apply)
+ ebs_optimized = (known after apply)
+ enable_primary_ipv6 = (known after apply)
+ get_password_data = false
+ host_id = (known after apply)
+ host_resource_group_arn = (known after apply)
+ iam_instance_profile = "k8s-dev-k8s-node-profile"
+ id = (known after apply)
+ instance_initiated_shutdown_behavior = (known after apply)
+ instance_lifecycle = (known after apply)
+ instance_state = (known after apply)
+ instance_type = "t4g.large"
+ ipv6_address_count = (known after apply)
+ ipv6_addresses = (known after apply)
+ key_name = (known after apply)
+ monitoring = (known after apply)
+ outpost_arn = (known after apply)
+ password_data = (known after apply)
+ placement_group = (known after apply)
+ placement_partition_number = (known after apply)
+ primary_network_interface_id = (known after apply)
+ private_dns = (known after apply)
+ private_ip = (known after apply)
+ public_dns = (known after apply)
+ public_ip = (known after apply)
+ secondary_private_ips = (known after apply)
+ security_groups = (known after apply)
+ source_dest_check = false
+ spot_instance_request_id = (known after apply)
+ subnet_id = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-w-2b-1"
+ "Project" = "dojangkok"
+ "k8s:cluster-name" = "dojangkok-v3"
+ "k8s:nodepool" = "default"
+ "k8s:role" = "worker"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-w-2b-1"
+ "Project" = "dojangkok"
+ "k8s:cluster-name" = "dojangkok-v3"
+ "k8s:nodepool" = "default"
+ "k8s:role" = "worker"
}
+ tenancy = (known after apply)
+ user_data = "36a3c6492d421275603efbd5b55ddb59396bf446"
+ user_data_base64 = (known after apply)
+ user_data_replace_on_change = false
+ vpc_security_group_ids = (known after apply)
+ capacity_reservation_specification (known after apply)
+ cpu_options (known after apply)
+ credit_specification {
+ cpu_credits = "unlimited"
}
+ ebs_block_device (known after apply)
+ enclave_options (known after apply)
+ ephemeral_block_device (known after apply)
+ instance_market_options (known after apply)
+ maintenance_options (known after apply)
+ metadata_options {
+ http_endpoint = "enabled"
+ http_protocol_ipv6 = "disabled"
+ http_put_response_hop_limit = 2
+ http_tokens = "required"
+ instance_metadata_tags = (known after apply)
}
+ network_interface (known after apply)
+ private_dns_name_options (known after apply)
+ root_block_device {
+ delete_on_termination = true
+ device_name = (known after apply)
+ encrypted = true
+ iops = (known after apply)
+ kms_key_id = (known after apply)
+ tags_all = (known after apply)
+ throughput = (known after apply)
+ volume_id = (known after apply)
+ volume_size = 30
+ volume_type = "gp3"
}
}
# module.k8s_nodes.aws_instance.workers["w-2c-1"] will be created
+ resource "aws_instance" "workers" {
+ ami = "ami-0bbcd617c4dcdf5a7"
+ arn = (known after apply)
+ associate_public_ip_address = (known after apply)
+ availability_zone = (known after apply)
+ cpu_core_count = (known after apply)
+ cpu_threads_per_core = (known after apply)
+ disable_api_stop = (known after apply)
+ disable_api_termination = (known after apply)
+ ebs_optimized = (known after apply)
+ enable_primary_ipv6 = (known after apply)
+ get_password_data = false
+ host_id = (known after apply)
+ host_resource_group_arn = (known after apply)
+ iam_instance_profile = "k8s-dev-k8s-node-profile"
+ id = (known after apply)
+ instance_initiated_shutdown_behavior = (known after apply)
+ instance_lifecycle = (known after apply)
+ instance_state = (known after apply)
+ instance_type = "t4g.large"
+ ipv6_address_count = (known after apply)
+ ipv6_addresses = (known after apply)
+ key_name = (known after apply)
+ monitoring = (known after apply)
+ outpost_arn = (known after apply)
+ password_data = (known after apply)
+ placement_group = (known after apply)
+ placement_partition_number = (known after apply)
+ primary_network_interface_id = (known after apply)
+ private_dns = (known after apply)
+ private_ip = (known after apply)
+ public_dns = (known after apply)
+ public_ip = (known after apply)
+ secondary_private_ips = (known after apply)
+ security_groups = (known after apply)
+ source_dest_check = false
+ spot_instance_request_id = (known after apply)
+ subnet_id = (known after apply)
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-w-2c-1"
+ "Project" = "dojangkok"
+ "k8s:cluster-name" = "dojangkok-v3"
+ "k8s:nodepool" = "default"
+ "k8s:role" = "worker"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-w-2c-1"
+ "Project" = "dojangkok"
+ "k8s:cluster-name" = "dojangkok-v3"
+ "k8s:nodepool" = "default"
+ "k8s:role" = "worker"
}
+ tenancy = (known after apply)
+ user_data = "36a3c6492d421275603efbd5b55ddb59396bf446"
+ user_data_base64 = (known after apply)
+ user_data_replace_on_change = false
+ vpc_security_group_ids = (known after apply)
+ capacity_reservation_specification (known after apply)
+ cpu_options (known after apply)
+ credit_specification {
+ cpu_credits = "unlimited"
}
+ ebs_block_device (known after apply)
+ enclave_options (known after apply)
+ ephemeral_block_device (known after apply)
+ instance_market_options (known after apply)
+ maintenance_options (known after apply)
+ metadata_options {
+ http_endpoint = "enabled"
+ http_protocol_ipv6 = "disabled"
+ http_put_response_hop_limit = 2
+ http_tokens = "required"
+ instance_metadata_tags = (known after apply)
}
+ network_interface (known after apply)
+ private_dns_name_options (known after apply)
+ root_block_device {
+ delete_on_termination = true
+ device_name = (known after apply)
+ encrypted = true
+ iops = (known after apply)
+ kms_key_id = (known after apply)
+ tags_all = (known after apply)
+ throughput = (known after apply)
+ volume_id = (known after apply)
+ volume_size = 30
+ volume_type = "gp3"
}
}
# module.nat_instance.aws_autoscaling_group.nat will be created
+ resource "aws_autoscaling_group" "nat" {
+ arn = (known after apply)
+ availability_zones = (known after apply)
+ default_cooldown = (known after apply)
+ desired_capacity = 1
+ force_delete = false
+ force_delete_warm_pool = false
+ health_check_grace_period = 120
+ health_check_type = "EC2"
+ id = (known after apply)
+ ignore_failed_scaling_activities = false
+ load_balancers = (known after apply)
+ max_size = 1
+ metrics_granularity = "1Minute"
+ min_size = 1
+ name = "k8s-dev-nat-asg"
+ name_prefix = (known after apply)
+ predicted_capacity = (known after apply)
+ protect_from_scale_in = false
+ service_linked_role_arn = (known after apply)
+ target_group_arns = (known after apply)
+ vpc_zone_identifier = (known after apply)
+ wait_for_capacity_timeout = "10m"
+ warm_pool_size = (known after apply)
+ availability_zone_distribution (known after apply)
+ capacity_reservation_specification (known after apply)
+ launch_template {
+ id = (known after apply)
+ name = (known after apply)
+ version = "$Latest"
}
+ mixed_instances_policy (known after apply)
+ tag {
+ key = "Name"
+ propagate_at_launch = false
+ value = "k8s-dev-nat"
}
+ traffic_source (known after apply)
}
# module.nat_instance.aws_iam_instance_profile.nat will be created
+ resource "aws_iam_instance_profile" "nat" {
+ arn = (known after apply)
+ create_date = (known after apply)
+ id = (known after apply)
+ name = "k8s-dev-nat-profile"
+ name_prefix = (known after apply)
+ path = "/"
+ role = "k8s-dev-nat-role"
+ tags_all = (known after apply)
+ unique_id = (known after apply)
}
# module.nat_instance.aws_iam_role.nat will be created
+ resource "aws_iam_role" "nat" {
+ arn = (known after apply)
+ assume_role_policy = jsonencode(
{
+ Statement = [
+ {
+ Action = "sts:AssumeRole"
+ Effect = "Allow"
+ Principal = {
+ Service = "ec2.amazonaws.com"
}
},
]
+ Version = "2012-10-17"
}
)
+ create_date = (known after apply)
+ force_detach_policies = false
+ id = (known after apply)
+ managed_policy_arns = (known after apply)
+ max_session_duration = 3600
+ name = "k8s-dev-nat-role"
+ name_prefix = (known after apply)
+ path = "/"
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Project" = "dojangkok"
}
+ tags_all = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Project" = "dojangkok"
}
+ unique_id = (known after apply)
+ inline_policy (known after apply)
}
# module.nat_instance.aws_iam_role_policy.nat_self_heal will be created
+ resource "aws_iam_role_policy" "nat_self_heal" {
+ id = (known after apply)
+ name = "nat-self-heal"
+ name_prefix = (known after apply)
+ policy = jsonencode(
{
+ Statement = [
+ {
+ Action = [
+ "ec2:ModifyInstanceAttribute",
+ "ec2:ReplaceRoute",
+ "ec2:CreateRoute",
]
+ Effect = "Allow"
+ Resource = "*"
},
]
+ Version = "2012-10-17"
}
)
+ role = (known after apply)
}
# module.nat_instance.aws_iam_role_policy_attachment.nat_ssm will be created
+ resource "aws_iam_role_policy_attachment" "nat_ssm" {
+ id = (known after apply)
+ policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+ role = "k8s-dev-nat-role"
}
# module.nat_instance.aws_launch_template.nat will be created
+ resource "aws_launch_template" "nat" {
+ arn = (known after apply)
+ default_version = (known after apply)
+ id = (known after apply)
+ image_id = "ami-0bbcd617c4dcdf5a7"
+ instance_type = "t4g.nano"
+ latest_version = (known after apply)
+ name = (known after apply)
+ name_prefix = "k8s-dev-nat-"
+ tags_all = (known after apply)
+ user_data = (known after apply)
+ block_device_mappings {
+ device_name = "/dev/sda1"
+ ebs {
+ encrypted = "true"
+ iops = (known after apply)
+ throughput = (known after apply)
+ volume_initialization_rate = (known after apply)
+ volume_size = 8
+ volume_type = "gp3"
}
}
+ iam_instance_profile {
+ name = "k8s-dev-nat-profile"
}
+ metadata_options {
+ http_endpoint = "enabled"
+ http_protocol_ipv6 = (known after apply)
+ http_put_response_hop_limit = 2
+ http_tokens = "required"
+ instance_metadata_tags = (known after apply)
}
+ network_interfaces {
+ associate_public_ip_address = "true"
+ security_groups = (known after apply)
}
+ tag_specifications {
+ resource_type = "instance"
+ tags = {
+ "Environment" = "k8s-dev"
+ "ManagedBy" = "terraform"
+ "Name" = "k8s-dev-nat"
+ "Project" = "dojangkok"
}
}
}
# module.nat_instance.aws_security_group.nat will be created
+ resource "aws_security_group" "nat" {
+ arn = (known after apply)
+ description = "NAT Instance SG"
+ egress = [
+ {
+ cidr_blocks = [
+ "0.0.0.0/0",
]
+ description = "All outbound"
+ from_port = 0
+ ipv6_cidr_blocks = []
+ prefix_list_ids = []
+ protocol = "-1"
+ security_groups = []
+ self = false
+ to_port = 0
},
]
+ id = (known after apply)
+ ingress = [
+ {
+ cidr_blocks = [
+ "10.0.0.0/18",
]
+ description = "All from VPC"
+ from_port = 0
+ ipv6_cidr_blocks = []
+ prefix_list_ids = []
+ protocol = "-1"
+ security_groups = []
+ self = false
+ to_port = 0
},
]
+ name = "k8s-dev-nat-sg"
... (truncated)Pushed by: @WAFriend3416 |
Contributor
Ansible Syntax Check Result ✅
Pushed by: @WAFriend3416 |
Contributor
Author
|
추가 코드 검토 이후 머지 진행하겠습니다. |
- BE/FE/AI/CHATTING 4개 서비스 workflow_dispatch CI/CD - CI: lint/test → Docker build (arm64) → ECR push - CD: Kustomize image tag 업데이트 → cloud repo push → ArgoCD auto-sync - dev/prod 환경 선택 (GitHub Environments) - 클러스터 비상시 운용 대응 (수동 트리거)
- dev: `name:tag` 문법 (newTag만 변경) - prod: `name=newName:tag` 문법 (newName + newTag 변경) - git pull --rebase 추가로 concurrent deploy push 경합 방지 - CLOUD_BRANCH를 main으로 변경
- ArgoCD Application targetRevision: feat/v3-k8s-iac → main - AI server configmap: APP_ENV prod→dev, HTTP_TIMEOUT 30→180, quorum 큐 접두사 적용 - chatting-be base에서 임시 제외 (레포 미준비)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/chat)k8s/apps/overlays/dev자동 sync주요 변경
Kustomize 구조
k8s/apps/base/— 4개 서비스(backend, frontend, ai-server, chatting-be) + networkingk8s/apps/overlays/dev/— 이미지 태그만 관리k8s/apps/overlays/prod/— replicas, resources, SM 경로 패치 (10개 patch)ESO 연동
secretsmanager:GetSecretValue/DescribeSecretondojangkok/*ArgoCD
Ansible site.yml 순서
calico → ebs-csi → gateway-fabric → external-secrets → argocd
Test plan
terraform plan으로 IAM 정책 변경 확인ansible-playbook --check site.ymldry-runkubectl get externalsecret -n dojangkok)kubectl get applications -n argocd)