From 5c5fc60537ffb0ff6069a17b7cf0f8ad01be9323 Mon Sep 17 00:00:00 2001 From: renolation Date: Fri, 19 Jun 2026 14:29:28 +0700 Subject: [PATCH] init --- .gitignore | 18 ++++ README.md | 32 +++++++ charts/dbiz-springboot/Chart.yaml | 6 ++ charts/dbiz-springboot/templates/_helpers.tpl | 9 ++ .../dbiz-springboot/templates/deployment.yaml | 51 ++++++++++++ charts/dbiz-springboot/templates/ingress.yaml | 22 +++++ charts/dbiz-springboot/templates/service.yaml | 15 ++++ charts/dbiz-springboot/values.yaml | 36 ++++++++ envs/dev/apps/infra.yaml | 20 +++++ envs/dev/apps/platform-api.yaml | 24 ++++++ envs/dev/apps/root.yaml | 20 +++++ envs/dev/apps/sealed-secrets.yaml | 20 +++++ envs/dev/apps/tenant-api.yaml | 24 ++++++ envs/dev/infra/external-services.yaml | 83 +++++++++++++++++++ envs/dev/sealed-secrets/.gitkeep | 0 envs/dev/values/platform-api.yaml | 80 ++++++++++++++++++ envs/dev/values/tenant-api.yaml | 66 +++++++++++++++ 17 files changed, 526 insertions(+) create mode 100644 .gitignore create mode 100644 README.md create mode 100644 charts/dbiz-springboot/Chart.yaml create mode 100644 charts/dbiz-springboot/templates/_helpers.tpl create mode 100644 charts/dbiz-springboot/templates/deployment.yaml create mode 100644 charts/dbiz-springboot/templates/ingress.yaml create mode 100644 charts/dbiz-springboot/templates/service.yaml create mode 100644 charts/dbiz-springboot/values.yaml create mode 100644 envs/dev/apps/infra.yaml create mode 100644 envs/dev/apps/platform-api.yaml create mode 100644 envs/dev/apps/root.yaml create mode 100644 envs/dev/apps/sealed-secrets.yaml create mode 100644 envs/dev/apps/tenant-api.yaml create mode 100644 envs/dev/infra/external-services.yaml create mode 100644 envs/dev/sealed-secrets/.gitkeep create mode 100644 envs/dev/values/platform-api.yaml create mode 100644 envs/dev/values/tenant-api.yaml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..0fbf0b2 --- /dev/null +++ b/.gitignore @@ -0,0 +1,18 @@ +### macOS +# Finder metadata +.DS_Store + +# Thumbnails +._* + +# Custom folder icons +Icon + +# Volume root files +.DocumentRevisions-V100 +.fseventsd +.Spotlight-V100 +.TemporaryItems +.Trashes +.VolumeIcon.icns +.com.apple.timemachine.donotpresent \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..67c980a --- /dev/null +++ b/README.md @@ -0,0 +1,32 @@ +# argo-k8s — DBIZ GitOps + +Quản lý deploy DBIZ stateless apps lên K8s qua ArgoCD. + +## Cấu trúc +``` +charts/dbiz-springboot/ Chart chung (env-agnostic) cho mọi Spring Boot service +envs/dev/ + apps/ ArgoCD Applications (App-of-Apps) + root.yaml Root app — trỏ tới chính thư mục apps/ + infra.yaml External Service+Endpoints + sealed-secrets.yaml Sealed secrets + platform-api.yaml Deploy platform-api (helm + values) + tenant-api.yaml Deploy tenant-api + values/ Values per-service (IP, env, resources) + infra/ Service+Endpoints external (Oracle/Redis/Kafka/S3) + sealed-secrets/ Secret đã seal (an toàn commit) +envs/prod/ (làm sau — copy dev, đổi config, re-seal secret) +``` + +## Bootstrap (lần đầu) +1. Đảm bảo cluster đã có: ArgoCD, sealed-secrets controller, MetalLB, Traefik. +2. Seal secret (xem PHASE 3 trong kế hoạch) → đặt vào `envs/dev/sealed-secrets/`. +3. Apply root app: + ``` + kubectl apply -f envs/dev/apps/root.yaml + ``` +4. ArgoCD tự sync: root → infra + secrets + platform-api + tenant-api. + +## Lưu ý +- Sealed secret seal bằng key của TỪNG cluster — dev/prod không dùng chung. +- `latest` tag ở dev; prod nên pin version. diff --git a/charts/dbiz-springboot/Chart.yaml b/charts/dbiz-springboot/Chart.yaml new file mode 100644 index 0000000..09aba09 --- /dev/null +++ b/charts/dbiz-springboot/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: dbiz-springboot +description: Generic chart for DBIZ Spring Boot stateless services (env-agnostic) +type: application +version: 0.1.0 +appVersion: "1.0" diff --git a/charts/dbiz-springboot/templates/_helpers.tpl b/charts/dbiz-springboot/templates/_helpers.tpl new file mode 100644 index 0000000..28ea8e1 --- /dev/null +++ b/charts/dbiz-springboot/templates/_helpers.tpl @@ -0,0 +1,9 @@ +{{- define "svc.name" -}} +{{- .Release.Name -}} +{{- end -}} + +{{- define "svc.labels" -}} +app: {{ .Release.Name }} +app.kubernetes.io/name: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} diff --git a/charts/dbiz-springboot/templates/deployment.yaml b/charts/dbiz-springboot/templates/deployment.yaml new file mode 100644 index 0000000..c273b8d --- /dev/null +++ b/charts/dbiz-springboot/templates/deployment.yaml @@ -0,0 +1,51 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "svc.name" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "svc.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ .Release.Name }} + template: + metadata: + labels: + {{- include "svc.labels" . | nindent 8 }} + spec: + containers: + - name: {{ include "svc.name" . }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - containerPort: {{ .Values.service.port }} + env: + {{- range $k, $v := .Values.env }} + - name: {{ $k }} + value: {{ $v | quote }} + {{- end }} + {{- range $k := .Values.secretKeys }} + - name: {{ $k }} + valueFrom: + secretKeyRef: + name: {{ $.Release.Name }}-secret + key: {{ $k }} + {{- end }} + readinessProbe: + httpGet: + path: {{ .Values.probe.path }} + port: {{ .Values.service.port }} + initialDelaySeconds: {{ .Values.probe.initialDelaySeconds }} + periodSeconds: {{ .Values.probe.periodSeconds }} + failureThreshold: {{ .Values.probe.failureThreshold }} + livenessProbe: + httpGet: + path: {{ .Values.probe.path }} + port: {{ .Values.service.port }} + initialDelaySeconds: {{ add .Values.probe.initialDelaySeconds 60 }} + periodSeconds: {{ .Values.probe.periodSeconds }} + failureThreshold: {{ .Values.probe.failureThreshold }} + resources: + {{- toYaml .Values.resources | nindent 12 }} diff --git a/charts/dbiz-springboot/templates/ingress.yaml b/charts/dbiz-springboot/templates/ingress.yaml new file mode 100644 index 0000000..0c5fce9 --- /dev/null +++ b/charts/dbiz-springboot/templates/ingress.yaml @@ -0,0 +1,22 @@ +{{- if .Values.ingress.enabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "svc.name" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "svc.labels" . | nindent 4 }} +spec: + ingressClassName: {{ .Values.ingress.className }} + rules: + - host: {{ .Values.ingress.host }} + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: {{ include "svc.name" . }} + port: + number: {{ .Values.service.port }} +{{- end }} diff --git a/charts/dbiz-springboot/templates/service.yaml b/charts/dbiz-springboot/templates/service.yaml new file mode 100644 index 0000000..5bd880b --- /dev/null +++ b/charts/dbiz-springboot/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "svc.name" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "svc.labels" . | nindent 4 }} +spec: + type: ClusterIP + selector: + app: {{ .Release.Name }} + ports: + - port: {{ .Values.service.port }} + targetPort: {{ .Values.service.port }} + protocol: TCP diff --git a/charts/dbiz-springboot/values.yaml b/charts/dbiz-springboot/values.yaml new file mode 100644 index 0000000..57ea24c --- /dev/null +++ b/charts/dbiz-springboot/values.yaml @@ -0,0 +1,36 @@ +# Default values — mỗi service override trong envs//values/.yaml +replicaCount: 1 + +image: + repository: "" # bắt buộc override + tag: "latest" + pullPolicy: Always + +service: + port: 8080 + +# Health probe — app chỉ có /actuator/health (aggregate) +probe: + path: /actuator/health + initialDelaySeconds: 60 + periodSeconds: 10 + failureThreshold: 30 # cho phép start chậm (Liquibase migrate) + +# Map env tự do — KHÔNG fix tên (mỗi service tên env khác nhau) +env: {} + +# Danh sách key đọc từ Secret -secret +secretKeys: [] + +resources: + requests: + memory: "512Mi" + cpu: "250m" + limits: + memory: "2Gi" + cpu: "1" + +ingress: + enabled: true + className: traefik + host: "" # override per-service diff --git a/envs/dev/apps/infra.yaml b/envs/dev/apps/infra.yaml new file mode 100644 index 0000000..4f9fefa --- /dev/null +++ b/envs/dev/apps/infra.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: dbiz-infra-dev + namespace: argocd +spec: + project: default + source: + repoURL: https://git.renolation.com/renolation/argo-k8s.git + targetRevision: main + path: envs/dev/infra + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: dbiz + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/envs/dev/apps/platform-api.yaml b/envs/dev/apps/platform-api.yaml new file mode 100644 index 0000000..c43b8b1 --- /dev/null +++ b/envs/dev/apps/platform-api.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: platform-api-dev + namespace: argocd +spec: + project: default + sources: + - repoURL: https://git.renolation.com/renolation/argo-k8s.git + targetRevision: main + path: charts/dbiz-springboot + helm: + valueFiles: + - $values/envs/dev/values/platform-api.yaml + - repoURL: https://git.renolation.com/renolation/argo-k8s.git + targetRevision: main + ref: values + destination: + server: https://kubernetes.default.svc + namespace: dbiz + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/envs/dev/apps/root.yaml b/envs/dev/apps/root.yaml new file mode 100644 index 0000000..f50089c --- /dev/null +++ b/envs/dev/apps/root.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: dbiz-root-dev + namespace: argocd +spec: + project: default + source: + repoURL: https://git.renolation.com/renolation/argo-k8s.git + targetRevision: main + path: envs/dev/apps + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/envs/dev/apps/sealed-secrets.yaml b/envs/dev/apps/sealed-secrets.yaml new file mode 100644 index 0000000..3ba5515 --- /dev/null +++ b/envs/dev/apps/sealed-secrets.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: dbiz-secrets-dev + namespace: argocd +spec: + project: default + source: + repoURL: https://git.renolation.com/renolation/argo-k8s.git + targetRevision: main + path: envs/dev/sealed-secrets + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: dbiz + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/envs/dev/apps/tenant-api.yaml b/envs/dev/apps/tenant-api.yaml new file mode 100644 index 0000000..bbec63d --- /dev/null +++ b/envs/dev/apps/tenant-api.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: tenant-api-dev + namespace: argocd +spec: + project: default + sources: + - repoURL: https://git.renolation.com/renolation/argo-k8s.git + targetRevision: main + path: charts/dbiz-springboot + helm: + valueFiles: + - $values/envs/dev/values/tenant-api.yaml + - repoURL: https://git.renolation.com/renolation/argo-k8s.git + targetRevision: main + ref: values + destination: + server: https://kubernetes.default.svc + namespace: dbiz + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/envs/dev/infra/external-services.yaml b/envs/dev/infra/external-services.yaml new file mode 100644 index 0000000..620cc45 --- /dev/null +++ b/envs/dev/infra/external-services.yaml @@ -0,0 +1,83 @@ +apiVersion: v1 +kind: Service +metadata: + name: oracle-db + namespace: dbiz +spec: + ports: + - port: 1521 + targetPort: 1521 +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: oracle-db + namespace: dbiz +subsets: +- addresses: + - ip: 192.168.110.174 + ports: + - port: 1521 +--- +apiVersion: v1 +kind: Service +metadata: + name: redis + namespace: dbiz +spec: + ports: + - port: 6379 + targetPort: 6379 +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: redis + namespace: dbiz +subsets: +- addresses: + - ip: 192.168.110.72 + ports: + - port: 6379 +--- +apiVersion: v1 +kind: Service +metadata: + name: kafka + namespace: dbiz +spec: + ports: + - port: 9092 + targetPort: 9092 +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: kafka + namespace: dbiz +subsets: +- addresses: + - ip: 192.168.110.70 + ports: + - port: 9092 +--- +apiVersion: v1 +kind: Service +metadata: + name: seaweedfs-s3 + namespace: dbiz +spec: + ports: + - port: 8888 + targetPort: 8888 +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: seaweedfs-s3 + namespace: dbiz +subsets: +- addresses: + - ip: 192.168.110.71 + ports: + - port: 8888 diff --git a/envs/dev/sealed-secrets/.gitkeep b/envs/dev/sealed-secrets/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/envs/dev/values/platform-api.yaml b/envs/dev/values/platform-api.yaml new file mode 100644 index 0000000..d062c31 --- /dev/null +++ b/envs/dev/values/platform-api.yaml @@ -0,0 +1,80 @@ +replicaCount: 1 # provisioning PDB → KHÔNG scale + +image: + repository: renolation/dbiz-platform-api + tag: "latest" + pullPolicy: Always + +service: + port: 8080 + +probe: + path: /actuator/health + initialDelaySeconds: 90 + periodSeconds: 10 + failureThreshold: 40 # platform-api chạy Liquibase golden template, start lâu + +resources: + requests: + memory: "1Gi" + cpu: "500m" + limits: + memory: "3584Mi" # khớp -Xmx3g + overhead + cpu: "2" + +ingress: + enabled: true + className: traefik + host: platform.dev.dbiz.local + +env: + SPRING_PROFILES_ACTIVE: "platform" + LOG_FILE: "/tmp/dbiz-platform.log" + # Oracle Platform DB + SPRING_DATASOURCE_URL: "jdbc:oracle:thin:@//oracle-db:1521/DBIZ_PLATFORM" + SPRING_DATASOURCE_USERNAME: "FOUNDATION" + SPRING_LIQUIBASE_CHANGE_LOG: "classpath:db/changelog/db.changelog-master.xml" + SPRING_LIQUIBASE_DEFAULT_SCHEMA: "FOUNDATION" + # Redis + SPRING_DATA_REDIS_HOST: "redis" + # Kafka + SPRING_KAFKA_BOOTSTRAP_SERVERS: "kafka:9092" + # S3 (SeaweedFS) + S3_ENDPOINT: "http://seaweedfs-s3:8888" + S3_ACCESS_KEY: "admin" + S3_REGION: "ap-southeast-1" + S3_PUBLIC_ENDPOINT: "http://seaweedfs-s3:8888" + # Tenant provisioning — Oracle CDB/PDB + DBIZ_TENANT_ORACLE_HOST: "oracle-db" + DBIZ_TENANT_ORACLE_PORT: "1521" + DBIZ_TENANT_ORACLE_PDB: "DBIZ_PLATFORM" + DBIZ_CDB_URL: "jdbc:oracle:thin:@//oracle-db:1521/DBIZ" + DBIZ_CDB_USERNAME: "sys as sysdba" + # Golden template + DBIZ_GOLDEN_PDB_NAME: "DBIZ_GOLDEN_TEMPLATE" + DBIZ_GOLDEN_SCHEMA: "FOUNDATION" + DBIZ_GOLDEN_SNAPSHOT_COPY: "false" + DBIZ_GOLDEN_ENT_TIERS: "ENTERPRISE" + DBIZ_GOLDEN_DB_LINK: "golden_link" + DBIZ_GOLDEN_CREATE_FILE_DEST: "+DATA" + # Service URLs + DBIZ_TENANT_API_URL: "http://tenant-api:8081" + DBIZ_PROMETHEUS_URL: "http://192.168.110.74:9090" + DBIZ_AUTONOMOUS_INTERNAL_URL: "https://autonomous-api.dbiz.com/api/v1/internal" + # Job queue + DBIZ_PLATFORM_JOB_MAX_CONCURRENT: "5" + DBIZ_PLATFORM_JOB_TIMEOUT_MINUTES: "60" + DBIZ_PLATFORM_GOLDEN_TEMPLATE_LIQUIBASE_UPDATE: "true" + DBIZ_STORAGE_TOTAL_BYTES: "5497558138880" + # Tắt OpenTelemetry (chưa có collector) + OTEL_SDK_DISABLED: "true" + # JVM + JAVA_TOOL_OPTIONS: "-Xms512m -Xmx3g -XX:+UseG1GC -XX:MaxGCPauseMillis=200" + +secretKeys: + - SPRING_DATASOURCE_PASSWORD + - DBIZ_CDB_PASSWORD + - DBIZ_TENANT_PASSWORD + - DBIZ_GOLDEN_PDB_ADMIN_PASSWORD + - S3_SECRET_KEY + - DBIZ_AUTONOMOUS_INTERNAL_API_KEY diff --git a/envs/dev/values/tenant-api.yaml b/envs/dev/values/tenant-api.yaml new file mode 100644 index 0000000..ac5037f --- /dev/null +++ b/envs/dev/values/tenant-api.yaml @@ -0,0 +1,66 @@ +replicaCount: 1 + +image: + repository: renolation/dbiz-tenant-api + tag: "latest" + pullPolicy: Always + +service: + port: 8081 + +probe: + path: /actuator/health + initialDelaySeconds: 90 + periodSeconds: 10 + failureThreshold: 40 + +resources: + requests: + memory: "1Gi" + cpu: "500m" + limits: + memory: "3584Mi" + cpu: "2" + +ingress: + enabled: true + className: traefik + host: tenant.dev.dbiz.local + +env: + SPRING_PROFILES_ACTIVE: "tenant" + # Oracle Platform DB (tenant resolution) + DBIZ_PLATFORM_DB_URL: "jdbc:oracle:thin:@//oracle-db:1521/DBIZ_PLATFORM" + DBIZ_PLATFORM_DB_USERNAME: "FOUNDATION" + # Tenant DB — Oracle PDB + DBIZ_TENANT_DB_DEFAULT_URL: "jdbc:oracle:thin:@//oracle-db:1521/DBIZ_GOLDEN_TEMPLATE" + DBIZ_TENANT_DB_DEFAULT_USERNAME: "FOUNDATION" + DBIZ_TENANT_ORACLE_HOST: "oracle-db" + DBIZ_TENANT_ORACLE_PORT: "1521" + DBIZ_TENANT_ORACLE_APP_SCHEMA: "FOUNDATION" + # Redis + SPRING_DATA_REDIS_HOST: "redis" + # Kafka + SPRING_KAFKA_BOOTSTRAP_SERVERS: "kafka:9092" + # S3 + S3_ENDPOINT: "http://seaweedfs-s3:8888" + S3_ACCESS_KEY: "admin" + S3_REGION: "ap-southeast-1" + S3_PUBLIC_ENDPOINT: "http://seaweedfs-s3:8888" + # App URLs + DBIZ_IDP_BASE_URL: "https://id.dbiz.com" + DBIZ_APPS_TENANT_ADMIN_URL_PATTERN: "https://{tenantCode}.dbiz.com/admin" + DBIZ_APPS_AUTONOMOUS_URL_PATTERN: "https://{tenantCode}.dbiz.com/autonomous" + DBIZ_CMS_PUBLIC_TENANT: "OFFICIAL" + # Tắt OpenTelemetry + OTEL_SDK_DISABLED: "true" + # JVM + JAVA_TOOL_OPTIONS: "-Xms512m -Xmx3g -XX:+UseG1GC -XX:MaxGCPauseMillis=200" + +secretKeys: + - DBIZ_PLATFORM_DB_PASSWORD + - DBIZ_TENANT_DB_DEFAULT_PASSWORD + - DBIZ_TENANT_PASSWORD + - SPRING_DATA_REDIS_PASSWORD + - S3_SECRET_KEY + - EXCHANGE_KEY