REFACTOR(cert-manager): move from platform repo

- Add cert-manager Application and helm values
- Add ClusterIssuer manifests
- Update kustomization references

authelia/helm-values.yaml

@@ -8,16 +8,12 @@ ingress:
 # Pod configuration
 pod:
   kind: DaemonSet
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
   resources:
     requests:
       cpu: 15m
-      memory: 256Mi
+      memory: 194Mi
     limits:
-      memory: 256Mi
+      memory: 194Mi
   extraVolumes:
     - name: users-database
       configMap:
@@ -30,6 +26,8 @@ pod:
             path: HEADLAMP_CLIENT_SECRET
           - key: VAULT_CLIENT_SECRET
             path: VAULT_CLIENT_SECRET
+          - key: ZOT_CLIENT_SECRET
+            path: ZOT_CLIENT_SECRET
           - key: identity_providers.oidc.jwks.key
             path: jwks.pem
   extraVolumeMounts:
@@ -45,6 +43,10 @@ pod:
       mountPath: /secrets/VAULT_CLIENT_SECRET
       subPath: VAULT_CLIENT_SECRET
       readOnly: true
+    - name: oidc-secrets
+      mountPath: /secrets/ZOT_CLIENT_SECRET
+      subPath: ZOT_CLIENT_SECRET
+      readOnly: true
     - name: oidc-secrets
       mountPath: /secrets/jwks.pem
       subPath: jwks.pem
@@ -122,6 +124,12 @@ configMap:
           use: 'sig'
           key:
             path: /secrets/jwks.pem
+      claims_policies:
+        default:
+          id_token:
+            - name
+            - preferred_username
+            - email
       cors:
         endpoints:
           - authorization
@@ -137,13 +145,13 @@ configMap:
             path: /secrets/HEADLAMP_CLIENT_SECRET
           public: false
           authorization_policy: one_factor
+          claims_policy: default
           redirect_uris:
             - https://kubernetes0213.kro.kr/oidc-callback
           scopes:
             - openid
             - profile
             - email
-            - groups
           token_endpoint_auth_method: client_secret_basic
         - client_id: vault
           client_name: Vault
@@ -158,7 +166,20 @@ configMap:
             - openid
             - profile
             - email
-            - groups
+          token_endpoint_auth_method: client_secret_post
+        - client_id: zot
+          client_name: Zot Registry
+          client_secret:
+            path: /secrets/ZOT_CLIENT_SECRET
+          public: false
+          authorization_policy: one_factor
+          claims_policy: default
+          redirect_uris:
+            - https://zot0213.kro.kr/zot/auth/callback/oidc
+          scopes:
+            - openid
+            - profile
+            - email
           token_endpoint_auth_method: client_secret_post
 
 # Secret configuration - use existing secret from Vault
@@ -176,9 +197,9 @@ redis:
   master:
     resources:
       requests:
-        cpu: 10m
+        cpu: 23m
-        memory: 64Mi
+        memory: 100Mi
       limits:
-        memory: 64Mi
+        memory: 100Mi
 
 # No persistence needed - using PostgreSQL

authelia/manifests/secret.yaml

@@ -52,3 +52,8 @@ spec:
       remoteRef:
         key: authelia
         property: VAULT_CLIENT_SECRET
+    # Zot OIDC client secret
+    - secretKey: ZOT_CLIENT_SECRET
+      remoteRef:
+        key: authelia
+        property: ZOT_CLIENT_SECRET

cert-manager/argocd.yaml

@@ -0,0 +1,44 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  sources:
+  - repoURL: https://charts.jetstack.io
+    chart: cert-manager
+    targetRevision: v1.16.2
+    helm:
+      valueFiles:
+      - $values/cert-manager/helm-values.yaml
+  - repoURL: https://github.com/K3S-HOME/security.git
+    targetRevision: main
+    ref: values
+  - repoURL: https://github.com/K3S-HOME/security.git
+    targetRevision: main
+    path: cert-manager
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      allowEmpty: false
+    syncOptions:
+    - CreateNamespace=true
+    - PrunePropagationPolicy=foreground
+    - PruneLast=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m
+    managedNamespaceMetadata:
+      labels:
+        goldilocks.fairwinds.com/enabled: 'true'
+  revisionHistoryLimit: 10

cert-manager/helm-values.yaml

@@ -0,0 +1,70 @@
+# Cert-Manager Helm Values
+# Chart: https://github.com/cert-manager/cert-manager/tree/master/deploy/charts/cert-manager
+
+# Install CRDs with Helm
+installCRDs: true
+
+replicaCount: 1
+
+resources:
+  requests:
+    cpu: 23m
+    memory: 115Mi
+  limits:
+    memory: 115Mi
+
+webhook:
+  replicaCount: 1
+  resources:
+    requests:
+      cpu: 23m
+      memory: 115Mi
+    limits:
+      memory: 115Mi
+  # Affinity - Soft Anti-Affinity to spread pods across nodes
+  affinity:
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+        - weight: 100
+          podAffinityTerm:
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: cert-manager-webhook
+            topologyKey: kubernetes.io/hostname
+
+cainjector:
+  replicaCount: 1
+  resources:
+    requests:
+      cpu: 23m
+      memory: 230Mi
+    limits:
+      memory: 230Mi
+  # Affinity - Soft Anti-Affinity to spread pods across nodes
+  affinity:
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+        - weight: 100
+          podAffinityTerm:
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: cert-manager-cainjector
+            topologyKey: kubernetes.io/hostname
+
+# Affinity - Soft Anti-Affinity to spread pods across nodes
+affinity:
+  podAntiAffinity:
+    preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 100
+        podAffinityTerm:
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: cert-manager
+          topologyKey: kubernetes.io/hostname
+
+# Prometheus metrics
+prometheus:
+  enabled: true
+  servicemonitor:
+    enabled: false
+

cert-manager/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- manifests/cluster-issuer.yaml

cert-manager/manifests/cluster-issuer.yaml

@@ -0,0 +1,41 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    # Let's Encrypt Production 서버
+    # 실제 운영 환경에서 사용
+    # Rate limit: 50 certificates per registered domain per week
+    server: https://acme-v02.api.letsencrypt.org/directory
+
+    # 인증서 만료 알림을 받을 이메일 주소
+    email: bluemayne0213@icloud.com
+
+    # ACME 계정의 private key를 저장할 Secret 이름
+    privateKeySecretRef:
+      name: letsencrypt-prod
+
+    # HTTP-01 challenge를 사용하여 도메인 소유권 검증
+    # Traefik Ingress를 통해 /.well-known/acme-challenge/ 경로로 검증
+    solvers:
+    - http01:
+        ingress:
+          class: traefik
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    # Let's Encrypt Staging 서버
+    # 테스트용 - 브라우저에서 신뢰하지 않지만 rate limit 없음
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: bluemayne0213@icloud.com
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+    - http01:
+        ingress:
+          class: traefik

external-secrets/helm-values.yaml

@@ -2,16 +2,15 @@
 # Chart: https://github.com/external-secrets/external-secrets
 
 # Replica count
-replicaCount: 2
+replicaCount: 1
 
-# 리소스 제한
+# 리소스 제한 (20% increase from original)
 resources:
   requests:
-    cpu: 5m  # Reduced from 20m based on actual usage (1m)
+    cpu: 5m
-    memory: 64Mi
+    memory: 154Mi
   limits:
-    # cpu: removed to prevent throttling
+    memory: 154Mi
-    memory: 64Mi
 
 # 동시 실행 제한
 concurrent: 3
@@ -25,14 +24,13 @@ installCRDs: false
 
 # Webhook 설정
 webhook:
-  replicaCount: 2
+  replicaCount: 1
   resources:
     requests:
-      cpu: 2m  # Reduced from 10m based on actual usage (1m)
+      cpu: 2m
-      memory: 64Mi
+      memory: 154Mi
     limits:
-      # cpu: removed to prevent throttling
+      memory: 154Mi
-      memory: 64Mi
   # Affinity - Soft Anti-Affinity to spread pods across nodes
   affinity:
     podAntiAffinity:
@@ -46,14 +44,13 @@ webhook:
 
 # CertController 설정
 certController:
-  replicaCount: 2
+  replicaCount: 1
   resources:
     requests:
-      cpu: 2m  # Reduced from 10m based on actual usage (1m)
+      cpu: 2m
-      memory: 128Mi
+      memory: 307Mi
     limits:
-      # cpu: removed to prevent throttling
+      memory: 307Mi
-      memory: 128Mi
   # Affinity - Soft Anti-Affinity to spread pods across nodes
   affinity:
     podAntiAffinity:

falco/helm-values.yaml

@@ -16,10 +16,10 @@ image:
 resources:
   requests:
     cpu: 49m
-    memory: 263Mi
+    memory: 283Mi
   limits:
     cpu: null  # Disable chart default (1 core)
-    memory: 263Mi
+    memory: 283Mi
 
 # Falco configuration
 falco:
@@ -121,14 +121,14 @@ grafanaDashboard:
 falcosidekick:
   enabled: true
   fullfqdn: false
-  replicaCount: 2
+  replicaCount: 1
 
   resources:
     requests:
-      cpu: 10m
+      cpu: 15m
-      memory: 128Mi
+      memory: 100Mi
     limits:
-      memory: 128Mi
+      memory: 100Mi
 
   config:
     # Output to stdout/logs
@@ -174,14 +174,6 @@ serviceAccount:
   create: true
   name: falco
 
-# Node selector to run on all nodes
-nodeSelector: {}
-
-# Tolerations to run on all nodes including control-plane
-tolerations:
-  - effect: NoSchedule
-    key: node-role.kubernetes.io/control-plane
-
 # Run as DaemonSet on all nodes
 daemonset:
   updateStrategy:

kustomization.yaml

@@ -5,6 +5,7 @@ resources:
   # Self-reference for App of Apps pattern
   - application.yaml
 
+  - cert-manager/argocd.yaml
   - authelia/argocd.yaml
   - vault/argocd.yaml
   - external-secrets/argocd.yaml

vault/helm-values.yaml

@@ -46,10 +46,10 @@ server:
   # 리소스 제한
   resources:
     requests:
-      cpu: 35m
+      cpu: 49m
-      memory: 263Mi
+      memory: 175Mi
     limits:
-      memory: 263Mi
+      memory: 175Mi
 
   # Ingress 설정
   ingress:
@@ -72,11 +72,8 @@ server:
     type: ClusterIP
     port: 8200
 
-  # Tolerations for control-plane node
+  # High priority for critical secrets management
-  tolerations:
+  priorityClassName: high-priority
-    - key: "node-role.kubernetes.io/control-plane"
-      operator: "Exists"
-      effect: "NoSchedule"
 
 # UI 활성화
 ui:

vault/kustomization.yaml

@@ -5,4 +5,3 @@ resources:
 - manifests/external-secret.yaml
 - manifests/rbac.yaml
 - manifests/oidc-secret.yaml
-- manifests/oidc-setup-job.yaml

vault/manifests/oidc-setup-job.yaml

@@ -1,89 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: vault-oidc-setup
-  namespace: vault
-  annotations:
-    argocd.argoproj.io/hook: PostSync
-    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
-spec:
-  ttlSecondsAfterFinished: 300
-  template:
-    spec:
-      serviceAccountName: vault
-      restartPolicy: OnFailure
-      containers:
-        - name: vault-oidc-setup
-          image: hashicorp/vault:1.17.2
-          env:
-            - name: VAULT_ADDR
-              value: "http://vault.vault.svc.cluster.local:8200"
-            - name: VAULT_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: vault-oidc-secret
-                  key: VAULT_CLIENT_SECRET
-          command:
-            - /bin/sh
-            - -c
-            - |
-              set -e
-
-              # Login with Kubernetes auth
-              echo "Logging in with Kubernetes auth..."
-              VAULT_TOKEN=$(vault write -field=token auth/kubernetes/login \
-                role=vault-setup \
-                jwt=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token))
-              export VAULT_TOKEN
-
-              # Check if OIDC is already enabled
-              if vault auth list | grep -q "oidc/"; then
-                echo "OIDC auth method already enabled"
-              else
-                echo "Enabling OIDC auth method..."
-                vault auth enable oidc
-              fi
-
-              # Configure OIDC with Authelia
-              echo "Configuring OIDC..."
-              vault write auth/oidc/config \
-                oidc_discovery_url="https://auth0213.kro.kr" \
-                oidc_client_id="vault" \
-                oidc_client_secret="${VAULT_CLIENT_SECRET}" \
-                default_role="default"
-
-              # Create default role
-              echo "Creating default role..."
-              vault write auth/oidc/role/default \
-                user_claim="sub" \
-                groups_claim="" \
-                allowed_redirect_uris="https://vault0213.kro.kr/ui/vault/auth/oidc/oidc/callback" \
-                allowed_redirect_uris="http://localhost:8250/oidc/callback" \
-                token_policies="admin" \
-                token_ttl="1h" \
-                token_max_ttl="24h"
-
-              # Create admin policy
-              echo "Creating admin policy..."
-              vault policy write admin - <<POLICY
-              path "*" {
-                capabilities = ["create", "read", "update", "delete", "list", "sudo"]
-              }
-              POLICY
-
-              # Create admin role
-              echo "Creating admin role..."
-              vault write auth/oidc/role/admin \
-                user_claim="sub" \
-                groups_claim="" \
-                allowed_redirect_uris="https://vault0213.kro.kr/ui/vault/auth/oidc/oidc/callback" \
-                allowed_redirect_uris="http://localhost:8250/oidc/callback" \
-                token_policies="admin" \
-                token_ttl="1h" \
-                token_max_ttl="24h"
-
-              echo "OIDC setup complete!"
-      tolerations:
-        - key: "node-role.kubernetes.io/control-plane"
-          operator: "Exists"
-          effect: "NoSchedule"