10장: 실전 프로젝트 - GitOps 기반 Kubernetes 플랫폼 구축

# 관리 클러스터에 ArgoCD 설치
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/ha/install.yaml
 
# 초기 비밀번호 확인
argocd admin initial-password -n argocd
 
# 워크로드 클러스터 등록
argocd cluster add eks-production --name production
argocd cluster add eks-staging --name staging

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: platform-root
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default
  source:
    repoURL: https://github.com/org/infra-manifests.git
    targetRevision: main
    path: platform/apps
  destination:
    server: https://kubernetes.default.svc
    namespace: argocd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - karpenter.yaml
  - kyverno.yaml
  - crossplane.yaml
  - monitoring.yaml
  - ingress.yaml
  - cert-manager.yaml
  - external-secrets.yaml
  - app-applicationset.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: karpenter
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  project: platform
  source:
    repoURL: https://github.com/org/infra-manifests.git
    targetRevision: main
    path: platform/base/karpenter
  destination:
    server: https://production.example.com
    namespace: kube-system
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: general
spec:
  template:
    metadata:
      labels:
        workload-type: general
    spec:
      requirements:
        - key: kubernetes.io/arch
          operator: In
          values: ["amd64"]
        - key: karpenter.sh/capacity-type
          operator: In
          values: ["on-demand", "spot"]
        - key: karpenter.k8s.aws/instance-category
          operator: In
          values: ["c", "m", "r"]
        - key: karpenter.k8s.aws/instance-generation
          operator: Gt
          values: ["5"]
      nodeClassRef:
        group: karpenter.k8s.aws
        kind: EC2NodeClass
        name: default
      expireAfter: 720h
  limits:
    cpu: "500"
    memory: 1000Gi
  disruption:
    consolidationPolicy: WhenEmptyOrUnderutilized
    consolidateAfter: 1m
    budgets:
      - nodes: "10%"
      - nodes: "0"
        schedule: "0 9 * * 1-5"
        duration: 9h

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: applications
  namespace: argocd
spec:
  goTemplate: true
  generators:
    - matrix:
        generators:
          - list:
              elements:
                - cluster: staging
                  server: https://staging.example.com
                  branch: main
                  autoSync: "true"
                - cluster: production
                  server: https://production.example.com
                  branch: release
                  autoSync: "false"
          - git:
              repoURL: https://github.com/org/app-manifests.git
              revision: main
              directories:
                - path: 'apps/*'
  template:
    metadata:
      name: '{{ .path.basename }}-{{ .cluster }}'
      labels:
        app: '{{ .path.basename }}'
        env: '{{ .cluster }}'
    spec:
      project: applications
      source:
        repoURL: https://github.com/org/app-manifests.git
        targetRevision: '{{ .branch }}'
        path: '{{ .path.path }}/overlays/{{ .cluster }}'
      destination:
        server: '{{ .server }}'
        namespace: '{{ .path.basename }}'
      syncPolicy:
        syncOptions:
          - CreateNamespace=true
          - PrunePropagationPolicy=foreground

apiVersion: platform.example.com/v1alpha1
kind: Database
metadata:
  name: app-database
  namespace: production
spec:
  size: large
  engine: postgres
  version: "16.3"
  highAvailability: true
---
apiVersion: platform.example.com/v1alpha1
kind: Cache
metadata:
  name: session-cache
  namespace: production
spec:
  size: medium
  engine: redis
  version: "7.2"

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - require-labels.yaml
  - require-resource-limits.yaml
  - restrict-image-registries.yaml
  - verify-image-signatures.yaml
  - add-security-context.yaml
  - generate-network-policies.yaml
  - restrict-host-namespaces.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-image-registries
  annotations:
    policies.kyverno.io/title: Restrict Image Registries
    policies.kyverno.io/severity: high
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: allowed-registries
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Images must come from approved registries."
        pattern:
          spec:
            containers:
              - image: "ghcr.io/org/* | public.ecr.aws/org/*"
            initContainers:
              - image: "ghcr.io/org/* | public.ecr.aws/org/*"

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: monitoring
  namespace: argocd
spec:
  project: platform
  source:
    repoURL: https://prometheus-community.github.io/helm-charts
    chart: kube-prometheus-stack
    targetRevision: "61.x.x"
    helm:
      valuesObject:
        prometheus:
          prometheusSpec:
            retention: 30d
            storageSpec:
              volumeClaimTemplate:
                spec:
                  storageClassName: gp3
                  resources:
                    requests:
                      storage: 100Gi
            additionalScrapeConfigs:
              - job_name: argocd
                metrics_path: /metrics
                static_configs:
                  - targets: ["argocd-metrics.argocd:8082"]
              - job_name: karpenter
                metrics_path: /metrics
                static_configs:
                  - targets: ["karpenter.kube-system:8000"]
        alertmanager:
          alertmanagerSpec:
            storage:
              volumeClaimTemplate:
                spec:
                  storageClassName: gp3
                  resources:
                    requests:
                      storage: 10Gi
        grafana:
          adminPassword:
            existingSecret: grafana-admin
          dashboardProviders:
            dashboardproviders.yaml:
              apiVersion: 1
              providers:
                - name: custom
                  folder: Platform
                  type: file
                  options:
                    path: /var/lib/grafana/dashboards/custom
  destination:
    server: https://production.example.com
    namespace: monitoring

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: platform-alerts
  namespace: monitoring
spec:
  groups:
    - name: gitops-alerts
      rules:
        - alert: ArgocdAppOutOfSync
          expr: |
            argocd_app_info{sync_status="OutOfSync"} == 1
          for: 30m
          labels:
            severity: warning
          annotations:
            summary: "ArgoCD app {{ $labels.name }} is out of sync"
 
        - alert: ArgocdAppSyncFailed
          expr: |
            argocd_app_info{health_status="Degraded"} == 1
          for: 10m
          labels:
            severity: critical
          annotations:
            summary: "ArgoCD app {{ $labels.name }} sync failed"
 
    - name: karpenter-alerts
      rules:
        - alert: KarpenterNodeNotReady
          expr: |
            karpenter_nodes_terminating > 5
          for: 10m
          labels:
            severity: warning
          annotations:
            summary: "Multiple Karpenter nodes terminating simultaneously"
 
    - name: cost-alerts
      rules:
        - alert: HighClusterCost
          expr: |
            sum(node_total_hourly_cost) * 24 * 30 > 10000
          for: 1h
          labels:
            severity: warning
          annotations:
            summary: "Estimated monthly cluster cost exceeds $10,000"