feat(envs): add staging and prod environments

Clone dev into envs/staging and envs/prod, deploying to namespaces dbiz-staging and dbiz-prod on the same cluster. App names suffixed per env, destination namespaces + external-services namespaces + ingress hosts adjusted. Monitoring kept as a single cluster-wide stack in dev (not duplicated). Sealed secrets left empty pending per-namespace re-seal (sealed secrets are namespace-scoped).
2026-06-30 16:43:13 +07:00
parent 8af179f7a6
commit 46927b01b6
18 changed files with 688 additions and 0 deletions
--- a/envs/staging/apps/infra.yaml
+++ b/envs/staging/apps/infra.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: dbiz-infra-staging
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://git.renolation.com/renolation/argo-k8s.git
+    targetRevision: main
+    path: envs/staging/infra
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dbiz-staging
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
--- a/envs/staging/apps/platform-api.yaml
+++ b/envs/staging/apps/platform-api.yaml
@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: platform-api-staging
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://git.renolation.com/renolation/argo-k8s.git
+      targetRevision: main
+      path: charts/dbiz-springboot
+      helm:
+        valueFiles:
+          - $values/envs/staging/values/platform-api.yaml
+    - repoURL: https://git.renolation.com/renolation/argo-k8s.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dbiz-staging
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
--- a/envs/staging/apps/root.yaml
+++ b/envs/staging/apps/root.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: dbiz-root-staging
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://git.renolation.com/renolation/argo-k8s.git
+    targetRevision: main
+    path: envs/staging/apps
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
--- a/envs/staging/apps/sealed-secrets.yaml
+++ b/envs/staging/apps/sealed-secrets.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: dbiz-secrets-staging
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://git.renolation.com/renolation/argo-k8s.git
+    targetRevision: main
+    path: envs/staging/sealed-secrets
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dbiz-staging
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
--- a/envs/staging/apps/tenant-api.yaml
+++ b/envs/staging/apps/tenant-api.yaml
@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: tenant-api-staging
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://git.renolation.com/renolation/argo-k8s.git
+      targetRevision: main
+      path: charts/dbiz-springboot
+      helm:
+        valueFiles:
+          - $values/envs/staging/values/tenant-api.yaml
+    - repoURL: https://git.renolation.com/renolation/argo-k8s.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dbiz-staging
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
--- a/envs/staging/infra/external-services.yaml
+++ b/envs/staging/infra/external-services.yaml
@@ -0,0 +1,83 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: oracle-db
+  namespace: dbiz-staging
+spec:
+  ports:
+  - port: 1521
+    targetPort: 1521
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: oracle-db
+  namespace: dbiz-staging
+subsets:
+- addresses:
+  - ip: 192.168.110.174
+  ports:
+  - port: 1521
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: dbiz-staging
+spec:
+  ports:
+  - port: 6379
+    targetPort: 6379
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: redis
+  namespace: dbiz-staging
+subsets:
+- addresses:
+  - ip: 192.168.110.72
+  ports:
+  - port: 6379
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kafka
+  namespace: dbiz-staging
+spec:
+  ports:
+  - port: 9092
+    targetPort: 9092
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: kafka
+  namespace: dbiz-staging
+subsets:
+- addresses:
+  - ip: 192.168.110.70
+  ports:
+  - port: 9092
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: seaweedfs-s3
+  namespace: dbiz-staging
+spec:
+  ports:
+  - port: 8888
+    targetPort: 8888
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: seaweedfs-s3
+  namespace: dbiz-staging
+subsets:
+- addresses:
+  - ip: 192.168.110.71
+  ports:
+  - port: 8888
--- a/envs/staging/sealed-secrets/.gitkeep
+++ b/envs/staging/sealed-secrets/.gitkeep
--- a/envs/staging/values/platform-api.yaml
+++ b/envs/staging/values/platform-api.yaml
@@ -0,0 +1,86 @@
+secretName: platform-api-secret
+replicaCount: 2          # provisioning PDB → KHÔNG scale
+
+image:
+  repository: renolation/dbiz-platform-api
+  tag: "latest"
+  pullPolicy: Always
+
+service:
+  port: 8080
+
+probe:
+  path: /actuator/health
+  initialDelaySeconds: 90
+  periodSeconds: 10
+  failureThreshold: 40     # platform-api chạy Liquibase golden template, start lâu
+
+resources:
+  requests:
+    memory: "1Gi"
+    cpu: "500m"
+  limits:
+    memory: "3584Mi"       # khớp -Xmx3g + overhead
+    cpu: "2"
+
+ingress:
+  enabled: true
+  className: traefik
+  host: platform.staging.dbiz.local
+
+env:
+  SPRING_PROFILES_ACTIVE: "platform"
+  LOG_FILE: "/tmp/dbiz-platform.log"
+  # Oracle — Platform DB (L1 app → user dbiz_platform, schema DBIZ_PLATFORM)
+  # CORE_FOUNDATION PDB chứa cả user dbiz_platform (L1) lẫn FOUNDATION (tenant L2)
+  SPRING_DATASOURCE_URL: "jdbc:oracle:thin:@//192.168.110.174:1521/CORE_FOUNDATION"
+  SPRING_DATASOURCE_USERNAME: "dbiz_platform"
+  SPRING_LIQUIBASE_CHANGE_LOG: "classpath:db/changelog/db.changelog-master.xml"
+  SPRING_LIQUIBASE_DEFAULT_SCHEMA: "DBIZ_PLATFORM"
+  # Redis / Valkey
+  SPRING_DATA_REDIS_HOST: "192.168.110.72"
+  # Kafka
+  SPRING_KAFKA_BOOTSTRAP_SERVERS: "192.168.110.70:9092"
+  # S3 (SeaweedFS)
+  S3_ENDPOINT: "http://192.168.110.71:8888"
+  S3_ACCESS_KEY: "admin"
+  S3_REGION: "ap-southeast-1"
+  S3_PUBLIC_ENDPOINT: "http://192.168.110.71:8888"
+  # Tenant provisioning — Oracle CDB/PDB (CDB service TESTDB, PDB CORE_FOUNDATION)
+  DBIZ_TENANT_ORACLE_HOST: "192.168.110.174"
+  DBIZ_TENANT_ORACLE_PORT: "1521"
+  DBIZ_TENANT_ORACLE_PDB: "CORE_FOUNDATION"
+  DBIZ_CDB_URL: "jdbc:oracle:thin:@//192.168.110.174:1521/TESTDB"
+  DBIZ_CDB_USERNAME: "sys as sysdba"
+  # Golden template (PDB clone source)
+  DBIZ_GOLDEN_PDB_NAME: "CORE_FOUNDATION"
+  DBIZ_GOLDEN_SCHEMA: "FOUNDATION"
+  DBIZ_GOLDEN_FILE_PATH: "/opt/oracle/oradata/FREE/golden/"
+  DBIZ_GOLDEN_ENT_FILE_PATH: "/opt/oracle/oradata/FREE/"
+  DBIZ_GOLDEN_SNAPSHOT_COPY: "false"
+  DBIZ_GOLDEN_ENT_TIERS: "ENTERPRISE"
+  DBIZ_GOLDEN_DB_LINK: "golden_link"
+  DBIZ_GOLDEN_CREATE_FILE_DEST: "+DATA"
+  # Service URLs
+  DBIZ_TENANT_API_URL: "http://192.168.110.174:8081"
+  DBIZ_PROMETHEUS_URL: "http://192.168.110.74:9090"
+  DBIZ_AUTONOMOUS_INTERNAL_URL: "https://autonomous-api.dbiz.com/api/v1/internal"
+  # Job queue
+  DBIZ_PLATFORM_JOB_MAX_CONCURRENT: "5"
+  DBIZ_PLATFORM_JOB_TIMEOUT_MINUTES: "60"
+  DBIZ_PLATFORM_GOLDEN_TEMPLATE_LIQUIBASE_UPDATE: "true"
+  DBIZ_STORAGE_TOTAL_BYTES: "5497558138880"
+  # OpenTelemetry — chưa có collector ở dev, tắt
+  OTEL_EXPORTER_OTLP_ENDPOINT: ""
+  OTEL_SDK_DISABLED: "true"
+  # JVM
+  JAVA_TOOL_OPTIONS: "-Xms512m -Xmx3g -XX:+UseG1GC -XX:MaxGCPauseMillis=200"
+
+secretKeys:
+  - SPRING_DATASOURCE_PASSWORD
+  - SPRING_DATA_REDIS_PASSWORD
+  - DBIZ_CDB_PASSWORD
+  - DBIZ_TENANT_PASSWORD
+  - DBIZ_GOLDEN_PDB_ADMIN_PASSWORD
+  - S3_SECRET_KEY
+  - DBIZ_AUTONOMOUS_INTERNAL_API_KEY
--- a/envs/staging/values/tenant-api.yaml
+++ b/envs/staging/values/tenant-api.yaml
@@ -0,0 +1,67 @@
+secretName: tenant-api-secret
+replicaCount: 2
+
+image:
+  repository: renolation/dbiz-tenant-api
+  tag: "latest"
+  pullPolicy: Always
+
+service:
+  port: 8081
+
+probe:
+  path: /actuator/health
+  initialDelaySeconds: 90
+  periodSeconds: 10
+  failureThreshold: 40
+
+resources:
+  requests:
+    memory: "1Gi"
+    cpu: "500m"
+  limits:
+    memory: "3584Mi"
+    cpu: "2"
+
+ingress:
+  enabled: true
+  className: traefik
+  host: tenant.staging.dbiz.local
+
+env:
+  SPRING_PROFILES_ACTIVE: "tenant"
+  # Oracle Platform DB (tenant resolution)
+  DBIZ_PLATFORM_DB_URL: "jdbc:oracle:thin:@//oracle-db:1521/DBIZ_PLATFORM"
+  DBIZ_PLATFORM_DB_USERNAME: "FOUNDATION"
+  # Tenant DB — Oracle PDB
+  DBIZ_TENANT_DB_DEFAULT_URL: "jdbc:oracle:thin:@//oracle-db:1521/DBIZ_GOLDEN_TEMPLATE"
+  DBIZ_TENANT_DB_DEFAULT_USERNAME: "FOUNDATION"
+  DBIZ_TENANT_ORACLE_HOST: "oracle-db"
+  DBIZ_TENANT_ORACLE_PORT: "1521"
+  DBIZ_TENANT_ORACLE_APP_SCHEMA: "FOUNDATION"
+  # Redis
+  SPRING_DATA_REDIS_HOST: "redis"
+  # Kafka
+  SPRING_KAFKA_BOOTSTRAP_SERVERS: "kafka:9092"
+  # S3
+  S3_ENDPOINT: "http://seaweedfs-s3:8888"
+  S3_ACCESS_KEY: "admin"
+  S3_REGION: "ap-southeast-1"
+  S3_PUBLIC_ENDPOINT: "http://seaweedfs-s3:8888"
+  # App URLs
+  DBIZ_IDP_BASE_URL: "https://id.dbiz.com"
+  DBIZ_APPS_TENANT_ADMIN_URL_PATTERN: "https://{tenantCode}.dbiz.com/admin"
+  DBIZ_APPS_AUTONOMOUS_URL_PATTERN: "https://{tenantCode}.dbiz.com/autonomous"
+  DBIZ_CMS_PUBLIC_TENANT: "OFFICIAL"
+  # Tắt OpenTelemetry
+  OTEL_SDK_DISABLED: "true"
+  # JVM
+  JAVA_TOOL_OPTIONS: "-Xms512m -Xmx3g -XX:+UseG1GC -XX:MaxGCPauseMillis=200"
+
+secretKeys:
+  - DBIZ_PLATFORM_DB_PASSWORD
+  - DBIZ_TENANT_DB_DEFAULT_PASSWORD
+  - DBIZ_TENANT_PASSWORD
+  - SPRING_DATA_REDIS_PASSWORD
+  - S3_SECRET_KEY
+  - EXCHANGE_KEY