init

.gitignore

@@ -0,0 +1,18 @@
+### macOS
+# Finder metadata
+.DS_Store
+
+# Thumbnails
+._*
+
+# Custom folder icons
+Icon
+
+
+# Volume root files
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns

README.md

@@ -0,0 +1,32 @@
+# argo-k8s — DBIZ GitOps
+
+Quản lý deploy DBIZ stateless apps lên K8s qua ArgoCD.
+
+## Cấu trúc
+```
+charts/dbiz-springboot/     Chart chung (env-agnostic) cho mọi Spring Boot service
+envs/dev/
+  apps/                     ArgoCD Applications (App-of-Apps)
+    root.yaml               Root app — trỏ tới chính thư mục apps/
+    infra.yaml              External Service+Endpoints
+    sealed-secrets.yaml     Sealed secrets
+    platform-api.yaml       Deploy platform-api (helm + values)
+    tenant-api.yaml         Deploy tenant-api
+  values/                   Values per-service (IP, env, resources)
+  infra/                    Service+Endpoints external (Oracle/Redis/Kafka/S3)
+  sealed-secrets/           Secret đã seal (an toàn commit)
+envs/prod/                  (làm sau — copy dev, đổi config, re-seal secret)
+```
+
+## Bootstrap (lần đầu)
+1. Đảm bảo cluster đã có: ArgoCD, sealed-secrets controller, MetalLB, Traefik.
+2. Seal secret (xem PHASE 3 trong kế hoạch) → đặt vào `envs/dev/sealed-secrets/`.
+3. Apply root app:
+   ```
+   kubectl apply -f envs/dev/apps/root.yaml
+   ```
+4. ArgoCD tự sync: root → infra + secrets + platform-api + tenant-api.
+
+## Lưu ý
+- Sealed secret seal bằng key của TỪNG cluster — dev/prod không dùng chung.
+- `latest` tag ở dev; prod nên pin version.

charts/dbiz-springboot/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: dbiz-springboot
+description: Generic chart for DBIZ Spring Boot stateless services (env-agnostic)
+type: application
+version: 0.1.0
+appVersion: "1.0"

charts/dbiz-springboot/templates/_helpers.tpl

@@ -0,0 +1,9 @@
+{{- define "svc.name" -}}
+{{- .Release.Name -}}
+{{- end -}}
+
+{{- define "svc.labels" -}}
+app: {{ .Release.Name }}
+app.kubernetes.io/name: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}

charts/dbiz-springboot/templates/deployment.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "svc.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "svc.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        {{- include "svc.labels" . | nindent 8 }}
+    spec:
+      containers:
+        - name: {{ include "svc.name" . }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - containerPort: {{ .Values.service.port }}
+          env:
+            {{- range $k, $v := .Values.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+            {{- end }}
+            {{- range $k := .Values.secretKeys }}
+            - name: {{ $k }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $.Release.Name }}-secret
+                  key: {{ $k }}
+            {{- end }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probe.path }}
+              port: {{ .Values.service.port }}
+            initialDelaySeconds: {{ .Values.probe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probe.periodSeconds }}
+            failureThreshold: {{ .Values.probe.failureThreshold }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probe.path }}
+              port: {{ .Values.service.port }}
+            initialDelaySeconds: {{ add .Values.probe.initialDelaySeconds 60 }}
+            periodSeconds: {{ .Values.probe.periodSeconds }}
+            failureThreshold: {{ .Values.probe.failureThreshold }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}

charts/dbiz-springboot/templates/ingress.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "svc.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "svc.labels" . | nindent 4 }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "svc.name" . }}
+                port:
+                  number: {{ .Values.service.port }}
+{{- end }}

charts/dbiz-springboot/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "svc.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "svc.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ .Release.Name }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.port }}
+      protocol: TCP

charts/dbiz-springboot/values.yaml

@@ -0,0 +1,36 @@
+# Default values — mỗi service override trong envs/<env>/values/<service>.yaml
+replicaCount: 1
+
+image:
+  repository: ""        # bắt buộc override
+  tag: "latest"
+  pullPolicy: Always
+
+service:
+  port: 8080
+
+# Health probe — app chỉ có /actuator/health (aggregate)
+probe:
+  path: /actuator/health
+  initialDelaySeconds: 60
+  periodSeconds: 10
+  failureThreshold: 30    # cho phép start chậm (Liquibase migrate)
+
+# Map env tự do — KHÔNG fix tên (mỗi service tên env khác nhau)
+env: {}
+
+# Danh sách key đọc từ Secret <release>-secret
+secretKeys: []
+
+resources:
+  requests:
+    memory: "512Mi"
+    cpu: "250m"
+  limits:
+    memory: "2Gi"
+    cpu: "1"
+
+ingress:
+  enabled: true
+  className: traefik
+  host: ""              # override per-service

envs/dev/apps/infra.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: dbiz-infra-dev
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://git.renolation.com/renolation/argo-k8s.git
+    targetRevision: main
+    path: envs/dev/infra
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dbiz
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

envs/dev/apps/platform-api.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: platform-api-dev
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://git.renolation.com/renolation/argo-k8s.git
+      targetRevision: main
+      path: charts/dbiz-springboot
+      helm:
+        valueFiles:
+          - $values/envs/dev/values/platform-api.yaml
+    - repoURL: https://git.renolation.com/renolation/argo-k8s.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dbiz
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

envs/dev/apps/root.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: dbiz-root-dev
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://git.renolation.com/renolation/argo-k8s.git
+    targetRevision: main
+    path: envs/dev/apps
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

envs/dev/apps/sealed-secrets.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: dbiz-secrets-dev
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://git.renolation.com/renolation/argo-k8s.git
+    targetRevision: main
+    path: envs/dev/sealed-secrets
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dbiz
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

envs/dev/apps/tenant-api.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: tenant-api-dev
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://git.renolation.com/renolation/argo-k8s.git
+      targetRevision: main
+      path: charts/dbiz-springboot
+      helm:
+        valueFiles:
+          - $values/envs/dev/values/tenant-api.yaml
+    - repoURL: https://git.renolation.com/renolation/argo-k8s.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dbiz
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

envs/dev/infra/external-services.yaml

@@ -0,0 +1,83 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: oracle-db
+  namespace: dbiz
+spec:
+  ports:
+  - port: 1521
+    targetPort: 1521
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: oracle-db
+  namespace: dbiz
+subsets:
+- addresses:
+  - ip: 192.168.110.174
+  ports:
+  - port: 1521
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: dbiz
+spec:
+  ports:
+  - port: 6379
+    targetPort: 6379
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: redis
+  namespace: dbiz
+subsets:
+- addresses:
+  - ip: 192.168.110.72
+  ports:
+  - port: 6379
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kafka
+  namespace: dbiz
+spec:
+  ports:
+  - port: 9092
+    targetPort: 9092
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: kafka
+  namespace: dbiz
+subsets:
+- addresses:
+  - ip: 192.168.110.70
+  ports:
+  - port: 9092
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: seaweedfs-s3
+  namespace: dbiz
+spec:
+  ports:
+  - port: 8888
+    targetPort: 8888
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: seaweedfs-s3
+  namespace: dbiz
+subsets:
+- addresses:
+  - ip: 192.168.110.71
+  ports:
+  - port: 8888

envs/dev/values/platform-api.yaml

@@ -0,0 +1,80 @@
+replicaCount: 1          # provisioning PDB → KHÔNG scale
+
+image:
+  repository: renolation/dbiz-platform-api
+  tag: "latest"
+  pullPolicy: Always
+
+service:
+  port: 8080
+
+probe:
+  path: /actuator/health
+  initialDelaySeconds: 90
+  periodSeconds: 10
+  failureThreshold: 40     # platform-api chạy Liquibase golden template, start lâu
+
+resources:
+  requests:
+    memory: "1Gi"
+    cpu: "500m"
+  limits:
+    memory: "3584Mi"       # khớp -Xmx3g + overhead
+    cpu: "2"
+
+ingress:
+  enabled: true
+  className: traefik
+  host: platform.dev.dbiz.local
+
+env:
+  SPRING_PROFILES_ACTIVE: "platform"
+  LOG_FILE: "/tmp/dbiz-platform.log"
+  # Oracle Platform DB
+  SPRING_DATASOURCE_URL: "jdbc:oracle:thin:@//oracle-db:1521/DBIZ_PLATFORM"
+  SPRING_DATASOURCE_USERNAME: "FOUNDATION"
+  SPRING_LIQUIBASE_CHANGE_LOG: "classpath:db/changelog/db.changelog-master.xml"
+  SPRING_LIQUIBASE_DEFAULT_SCHEMA: "FOUNDATION"
+  # Redis
+  SPRING_DATA_REDIS_HOST: "redis"
+  # Kafka
+  SPRING_KAFKA_BOOTSTRAP_SERVERS: "kafka:9092"
+  # S3 (SeaweedFS)
+  S3_ENDPOINT: "http://seaweedfs-s3:8888"
+  S3_ACCESS_KEY: "admin"
+  S3_REGION: "ap-southeast-1"
+  S3_PUBLIC_ENDPOINT: "http://seaweedfs-s3:8888"
+  # Tenant provisioning — Oracle CDB/PDB
+  DBIZ_TENANT_ORACLE_HOST: "oracle-db"
+  DBIZ_TENANT_ORACLE_PORT: "1521"
+  DBIZ_TENANT_ORACLE_PDB: "DBIZ_PLATFORM"
+  DBIZ_CDB_URL: "jdbc:oracle:thin:@//oracle-db:1521/DBIZ"
+  DBIZ_CDB_USERNAME: "sys as sysdba"
+  # Golden template
+  DBIZ_GOLDEN_PDB_NAME: "DBIZ_GOLDEN_TEMPLATE"
+  DBIZ_GOLDEN_SCHEMA: "FOUNDATION"
+  DBIZ_GOLDEN_SNAPSHOT_COPY: "false"
+  DBIZ_GOLDEN_ENT_TIERS: "ENTERPRISE"
+  DBIZ_GOLDEN_DB_LINK: "golden_link"
+  DBIZ_GOLDEN_CREATE_FILE_DEST: "+DATA"
+  # Service URLs
+  DBIZ_TENANT_API_URL: "http://tenant-api:8081"
+  DBIZ_PROMETHEUS_URL: "http://192.168.110.74:9090"
+  DBIZ_AUTONOMOUS_INTERNAL_URL: "https://autonomous-api.dbiz.com/api/v1/internal"
+  # Job queue
+  DBIZ_PLATFORM_JOB_MAX_CONCURRENT: "5"
+  DBIZ_PLATFORM_JOB_TIMEOUT_MINUTES: "60"
+  DBIZ_PLATFORM_GOLDEN_TEMPLATE_LIQUIBASE_UPDATE: "true"
+  DBIZ_STORAGE_TOTAL_BYTES: "5497558138880"
+  # Tắt OpenTelemetry (chưa có collector)
+  OTEL_SDK_DISABLED: "true"
+  # JVM
+  JAVA_TOOL_OPTIONS: "-Xms512m -Xmx3g -XX:+UseG1GC -XX:MaxGCPauseMillis=200"
+
+secretKeys:
+  - SPRING_DATASOURCE_PASSWORD
+  - DBIZ_CDB_PASSWORD
+  - DBIZ_TENANT_PASSWORD
+  - DBIZ_GOLDEN_PDB_ADMIN_PASSWORD
+  - S3_SECRET_KEY
+  - DBIZ_AUTONOMOUS_INTERNAL_API_KEY

envs/dev/values/tenant-api.yaml

@@ -0,0 +1,66 @@
+replicaCount: 1
+
+image:
+  repository: renolation/dbiz-tenant-api
+  tag: "latest"
+  pullPolicy: Always
+
+service:
+  port: 8081
+
+probe:
+  path: /actuator/health
+  initialDelaySeconds: 90
+  periodSeconds: 10
+  failureThreshold: 40
+
+resources:
+  requests:
+    memory: "1Gi"
+    cpu: "500m"
+  limits:
+    memory: "3584Mi"
+    cpu: "2"
+
+ingress:
+  enabled: true
+  className: traefik
+  host: tenant.dev.dbiz.local
+
+env:
+  SPRING_PROFILES_ACTIVE: "tenant"
+  # Oracle Platform DB (tenant resolution)
+  DBIZ_PLATFORM_DB_URL: "jdbc:oracle:thin:@//oracle-db:1521/DBIZ_PLATFORM"
+  DBIZ_PLATFORM_DB_USERNAME: "FOUNDATION"
+  # Tenant DB — Oracle PDB
+  DBIZ_TENANT_DB_DEFAULT_URL: "jdbc:oracle:thin:@//oracle-db:1521/DBIZ_GOLDEN_TEMPLATE"
+  DBIZ_TENANT_DB_DEFAULT_USERNAME: "FOUNDATION"
+  DBIZ_TENANT_ORACLE_HOST: "oracle-db"
+  DBIZ_TENANT_ORACLE_PORT: "1521"
+  DBIZ_TENANT_ORACLE_APP_SCHEMA: "FOUNDATION"
+  # Redis
+  SPRING_DATA_REDIS_HOST: "redis"
+  # Kafka
+  SPRING_KAFKA_BOOTSTRAP_SERVERS: "kafka:9092"
+  # S3
+  S3_ENDPOINT: "http://seaweedfs-s3:8888"
+  S3_ACCESS_KEY: "admin"
+  S3_REGION: "ap-southeast-1"
+  S3_PUBLIC_ENDPOINT: "http://seaweedfs-s3:8888"
+  # App URLs
+  DBIZ_IDP_BASE_URL: "https://id.dbiz.com"
+  DBIZ_APPS_TENANT_ADMIN_URL_PATTERN: "https://{tenantCode}.dbiz.com/admin"
+  DBIZ_APPS_AUTONOMOUS_URL_PATTERN: "https://{tenantCode}.dbiz.com/autonomous"
+  DBIZ_CMS_PUBLIC_TENANT: "OFFICIAL"
+  # Tắt OpenTelemetry
+  OTEL_SDK_DISABLED: "true"
+  # JVM
+  JAVA_TOOL_OPTIONS: "-Xms512m -Xmx3g -XX:+UseG1GC -XX:MaxGCPauseMillis=200"
+
+secretKeys:
+  - DBIZ_PLATFORM_DB_PASSWORD
+  - DBIZ_TENANT_DB_DEFAULT_PASSWORD
+  - DBIZ_TENANT_PASSWORD
+  - SPRING_DATA_REDIS_PASSWORD
+  - S3_SECRET_KEY
+  - EXCHANGE_KEY