5장: Golden Path 설계와 구현

templates:
  backend:
    - name: "spring-boot-service"
      language: Java
      framework: Spring Boot 3.4
      includes:
        - "Gradle 빌드 설정"
        - "GitHub Actions CI/CD"
        - "Dockerfile (멀티스테이지)"
        - "Kubernetes 매니페스트"
        - "ArgoCD Application"
        - "Prometheus 메트릭 엔드포인트"
        - "Structured Logging (JSON)"
        - "Health Check 엔드포인트"
        - "OpenAPI 스펙 자동 생성"
        - "catalog-info.yaml"
        - "TechDocs 템플릿"
 
    - name: "go-grpc-service"
      language: Go
      framework: "gRPC + Connect"
      includes:
        - "Go 모듈 설정"
        - "Buf 기반 protobuf 관리"
        - "GitHub Actions CI/CD"
        - "Dockerfile"
        - "Kubernetes 매니페스트"
        - "gRPC 리플렉션"
        - "OpenTelemetry 트레이싱"
 
    - name: "fastapi-service"
      language: Python
      framework: FastAPI
      includes:
        - "uv 기반 의존성 관리"
        - "GitHub Actions CI/CD"
        - "Dockerfile"
        - "Kubernetes 매니페스트"
        - "Pydantic 스키마 검증"
        - "Alembic DB 마이그레이션"
 
  frontend:
    - name: "nextjs-app"
      language: TypeScript
      framework: "Next.js 16 (App Router)"
      includes:
        - "pnpm 기반 의존성 관리"
        - "Tailwind CSS"
        - "GitHub Actions CI/CD"
        - "Dockerfile"
        - "Lighthouse CI"

# 멀티스테이지 빌드
FROM eclipse-temurin:21-jdk AS builder
WORKDIR /app
COPY . .
RUN ./gradlew bootJar --no-daemon
 
FROM eclipse-temurin:21-jre
WORKDIR /app
COPY --from=builder /app/build/libs/*.jar app.jar
 
# 보안: root가 아닌 사용자로 실행
RUN groupadd -r appuser && useradd -r -g appuser appuser
USER appuser
 
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s \
  CMD curl -f http://localhost:8080/actuator/health || exit 1
 
ENTRYPOINT ["java", "-jar", "app.jar"]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${{ values.serviceName }}
  labels:
    app: ${{ values.serviceName }}
    backstage.io/kubernetes-id: ${{ values.serviceName }}
spec:
  replicas: 2
  selector:
    matchLabels:
      app: ${{ values.serviceName }}
  template:
    metadata:
      labels:
        app: ${{ values.serviceName }}
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
        prometheus.io/path: "/actuator/prometheus"
    spec:
      containers:
        - name: ${{ values.serviceName }}
          image: "ghcr.io/mycompany/${{ values.serviceName }}:latest"
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 200m
              memory: 512Mi
            limits:
              cpu: "1"
              memory: 1Gi
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 5
          env:
            - name: SPRING_PROFILES_ACTIVE
              value: "kubernetes"

variable "service_name" {
  description = "서비스 이름"
  type        = string
}
 
variable "environment" {
  description = "배포 환경"
  type        = string
}
 
variable "instance_class" {
  description = "RDS 인스턴스 클래스"
  type        = string
  default     = "db.t4g.medium"
}
 
resource "aws_db_instance" "main" {
  identifier     = "${var.service_name}-${var.environment}"
  engine         = "postgres"
  engine_version = "16.4"
  instance_class = var.instance_class
 
  allocated_storage     = 20
  max_allocated_storage = 100
  storage_encrypted     = true
 
  db_name  = replace(var.service_name, "-", "_")
  username = "app_user"
  password = random_password.db_password.result
 
  vpc_security_group_ids = [aws_security_group.db.id]
  db_subnet_group_name   = aws_db_subnet_group.main.name
 
  backup_retention_period = var.environment == "production" ? 30 : 7
  multi_az               = var.environment == "production" ? true : false
 
  tags = {
    Service     = var.service_name
    Environment = var.environment
    ManagedBy   = "terraform"
    CostCenter  = var.service_name
  }
}
 
resource "random_password" "db_password" {
  length  = 32
  special = false
}
 
resource "aws_secretsmanager_secret" "db_credentials" {
  name = "${var.service_name}/${var.environment}/db-credentials"
}
 
resource "aws_secretsmanager_secret_version" "db_credentials" {
  secret_id = aws_secretsmanager_secret.db_credentials.id
  secret_string = jsonencode({
    host     = aws_db_instance.main.address
    port     = aws_db_instance.main.port
    database = aws_db_instance.main.db_name
    username = aws_db_instance.main.username
    password = random_password.db_password.result
  })
}

steps:
  # ... 이전 스텝 ...
 
  - id: provision-database
    name: "데이터베이스 프로비저닝"
    if: ${{ parameters.database !== 'none' }}
    action: mycompany:terraform:apply
    input:
      module: "rds-postgresql"
      variables:
        service_name: ${{ parameters.serviceName }}
        environment: "dev"
        instance_class: "db.t4g.micro"
      workspace: "${{ parameters.serviceName }}-dev"
 
  - id: inject-db-secret
    name: "DB 시크릿 연결"
    if: ${{ parameters.database !== 'none' }}
    action: mycompany:kubernetes:create-external-secret
    input:
      namespace: ${{ parameters.serviceName }}
      secretName: "db-credentials"
      remoteRef:
        key: "${{ parameters.serviceName }}/dev/db-credentials"

metrics:
  - name: "템플릿 사용률"
    formula: "Scaffolder로 생성한 신규 서비스 / 전체 신규 서비스"
    target: "80% 이상"
    measurement: "월별"
 
  - name: "Golden Path 이탈률"
    formula: "Golden Path에서 eject한 서비스 / 전체 Golden Path 서비스"
    target: "10% 이하"
    measurement: "분기별"
 
  - name: "첫 배포 소요 시간"
    formula: "프로젝트 생성부터 첫 프로덕션 배포까지"
    target: "4시간 이내"
    measurement: "서비스 생성 시"
 
  - name: "개발자 만족도"
    formula: "Golden Path 관련 NPS"
    target: "40 이상"
    measurement: "분기별"

name: CI
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 
jobs:
  build:
    # 조직 공통 워크플로우 재사용
    uses: mycompany/.github/.github/workflows/java-ci.yaml@v3
    with:
      java-version: "21"
      gradle-tasks: "build test"
    secrets: inherit
 
  security:
    uses: mycompany/.github/.github/workflows/security-scan.yaml@v3
    secrets: inherit
 
  deploy:
    if: github.ref == 'refs/heads/main'
    needs: [build, security]
    uses: mycompany/.github/.github/workflows/deploy-argocd.yaml@v3
    with:
      app-name: ${{ github.event.repository.name }}
      environment: dev
    secrets: inherit