From 14fb0d214aff89c89e3100e4eba184c37b22547d Mon Sep 17 00:00:00 2001 From: wbsong111 Date: Thu, 25 Jun 2026 15:01:57 +0900 Subject: [PATCH] perses overlay template: globalAdminUsers note (login=preferred_username) Co-Authored-By: Claude Opus 4.8 (1M context) --- doc/monitoring-deploy-test.md | 54 ++++++++++--------- .../victoria-metrics/1.0.0/perses-values.yaml | 7 +++ 2 files changed, 37 insertions(+), 24 deletions(-) diff --git a/doc/monitoring-deploy-test.md b/doc/monitoring-deploy-test.md index 3f08566..a844151 100644 --- a/doc/monitoring-deploy-test.md +++ b/doc/monitoring-deploy-test.md @@ -241,29 +241,33 @@ kubectl apply -n monitoring -f manifests/helm/perses/0.21.0/files/perses-dashboa --- -## 4. 2단계 — ArgoCD 배포 +## 4. 2단계 — ArgoCD 배포 — ✅ 실행 완료 (2026-06-25) -- [ ] repo 등록: 카탈로그 repo + 값 repo (`argocd repo add`, 사내 CA insecure) - > 🔧 **수동 설정**: `argocd repo add` 명령 기록 → §7 -- [ ] `applicationset.yaml`의 `repoURL`→`dip/service-catalog`, `targetRevision`→`master`로 수정 확인 -- [ ] `kubectl apply -f manifests/applicationset/victoria-metrics/1.0.0/applicationset.yaml` -- [ ] `argocd app list`로 wave 0→1→2 순서 Synced/Healthy, perses가 vmauth 이후 기동 +> ArgoCD는 `platform` ns에 설치(release `argo-cd`). ApplicationSet도 `platform` ns에 apply. -결과 (Application별 Sync/Health): +- [x] repo 등록: `service-catalog`는 기등록(insecure=true). `tenant-catalog`는 기존 repo secret 복제로 신규 등록 + > 🔧 **수동 설정**: `kubectl get secret repo-3724134660 -n platform -o json | jq '.metadata.name="repo-tenant-catalog" | .data.url=("https://gitea.example.org/dip/tenant-catalog"|@base64)' | kubectl apply -f -` → §7 +- [x] `applicationset.yaml` 조정: ns `argocd`→`platform`, repoURL `service-catalog`/`tenant-catalog`, `targetRevision: master` +- [x] 로컬 변경분 `service-catalog` push (`d1f7c77`) 후 `kubectl apply -f .../applicationset.yaml` +- [x] wave 0→1→2 순서 동기화, perses(wave2) vmauth 이후 기동 확인 -| Application | wave | Synced | Healthy | -|-------------|------|--------|---------| -| vmcluster | 0 | | | -| vlogs | 0 | | | -| kube-state-metrics | 0 | | | -| node-exporter | 0 | | | -| alertmanager | 0 | | | -| vmauth | 1 | | | -| vmagent | 1 | | | -| otelcol | 1 | | | -| otelcol-events | 1 | | | -| vmalert | 1 | | | -| perses | 2 | | | +결과: **15/15 파드 Running, PVC 3개 Bound, 11 Application 전부 Healthy**(9 Synced + 2 OutOfSync). + +| Application | wave | Sync | Health | +|-------------|------|------|--------| +| vmcluster | 0 | ⚠️ OutOfSync | ✅ Healthy | +| vlogs | 0 | ⚠️ OutOfSync | ✅ Healthy | +| kube-state-metrics | 0 | ✅ Synced | ✅ Healthy | +| node-exporter | 0 | ✅ Synced | ✅ Healthy | +| alertmanager | 0 | ✅ Synced | ✅ Healthy | +| vmauth | 1 | ✅ Synced | ✅ Healthy | +| vmagent | 1 | ✅ Synced | ✅ Healthy | +| otelcol | 1 | ✅ Synced | ✅ Healthy | +| otelcol-events | 1 | ✅ Synced | ✅ Healthy | +| vmalert | 1 | ✅ Synced | ✅ Healthy | +| perses | 2 | ✅ Synced | ✅ Healthy | + +> ⚠️ **vmcluster/vlogs OutOfSync (무해, 기능 정상)** — 원인: `vmstorage`/`vlstorage` **StatefulSet `volumeClaimTemplates`**에 K8s가 자동 추가하는 `volumeMode: Filesystem`이 차트 렌더본엔 없어 diff 발생. volumeClaimTemplates는 **immutable**이라 sync로 제거 불가 → 영구 OutOfSync(ArgoCD+StatefulSet 전형). 파드 Running·PVC Bound로 **기능 영향 없음**. **개선책**: ApplicationSet에 `ignoreDifferences`(StatefulSet `/spec/volumeClaimTemplates`) 추가 → §8 backlog. --- @@ -306,10 +310,10 @@ vm-stack `test/` 스크립트(`verify-metrics.sh`/`verify-logs.sh`) 패턴(port- | 3 | 3.3 | `monitoring` ns + `alertmanager-notify` + `root-ca-cert`(←cert-manager/root-ca-secret) | ✅ 실행(2026-06-25) | §3.3 | ✅ 예정(Infisical) | | 4 | 3.4 | `vmagent-relabel-configs`(demo01/demo02/platform, 빈 규칙) | ✅ 실행(2026-06-25) | §3.4 | ✅ 예정 | | 5 | 3.5 | `perses-dashboards` ConfigMap apply | ✅ 실행(2026-06-25) | §3.5 | (ArgoCD 경로) | -| 6 | 4 | ArgoCD repo add + ApplicationSet | ⬜ 미수행 (ArgoCD 위치 확인 필요 — platform ns 추정) | §4 | - | +| 6 | 4 | ArgoCD `tenant-catalog` repo secret 등록 + ApplicationSet apply(platform ns) | ✅ 실행(2026-06-25) | §4 | - | | 7 | 6 | teardown | ⬜ 미수행 | §6 | - | -> 진행 메모(2026-06-25): **1단계(3.1~3.5) 전부 실행 완료.** 모두 mock 값. client_secret: perses=`perses-mock-secret-changeme`, perses-vmauth=`perses-vmauth-secret-changeme`. alertmanager webhook·relabel은 mock placeholder. 다음은 2단계(ArgoCD) — `platform` ns에 argocd-tls 존재 → ArgoCD 설치 위치부터 확인 필요. +> 진행 메모(2026-06-25): **0~2단계 완료.** 1단계 mock 값(perses=`perses-mock-secret-changeme`, perses-vmauth=`perses-vmauth-secret-changeme`, alertmanager webhook·relabel placeholder). 2단계: ArgoCD=`platform` ns, `service-catalog`@`d1f7c77`/`tenant-catalog`@`510aa8e`, 11 App Healthy(15/15 파드). 남은 것: 3단계 E2E, 4단계 정리. --- @@ -321,5 +325,7 @@ vm-stack `test/` 스크립트(`verify-metrics.sh`/`verify-logs.sh`) 패턴(port- - **환경**: (클러스터/ArgoCD/Keycloak) - **결과**: 11 Application Synced+Healthy ( / ), E2E ( /7 PASS) - **발견 이슈 / 개선사항**: - - (예: perses ingress 누락 보강, 시크릿 이름 불일치, `$VAR` 렌더 방식 등) -- **자동화 backlog**: §7 수동 설정 목록 참조 + - **vmcluster/vlogs 영구 OutOfSync** — StatefulSet `volumeClaimTemplates`의 `volumeMode` 자동 기본값 diff(immutable). 기능 무해. → ApplicationSet에 `ignoreDifferences`(StatefulSet `/spec/volumeClaimTemplates`) 추가 권장. + - ArgoCD 설치 위치가 `argocd`가 아니라 `platform` ns — ApplicationSet `metadata.namespace`/`template...namespace`를 `platform`으로 조정함. + - (E2E 단계에서 추가 기입) +- **자동화 backlog**: §7 수동 설정 목록 참조 (1단계 전부 dip-console 이관 대상) diff --git a/manifests/applicationset/victoria-metrics/1.0.0/perses-values.yaml b/manifests/applicationset/victoria-metrics/1.0.0/perses-values.yaml index 4ca7c5f..649559a 100644 --- a/manifests/applicationset/victoria-metrics/1.0.0/perses-values.yaml +++ b/manifests/applicationset/victoria-metrics/1.0.0/perses-values.yaml @@ -32,3 +32,10 @@ ingress: - secretName: perses-tls hosts: - "perses.$DOMAIN" + +# Perses global-admin 바인딩 (sidecar 활성 시) — Keycloak 사용자를 기본 admin으로. +# Perses login = OIDC preferred_username (v0.53.1 실측). 따라서 username을 넣는다. +# dip-console이 대상 admin username으로 렌더($PERSES_GLOBAL_ADMIN). +sidecar: + globalAdminUsers: + - "$PERSES_GLOBAL_ADMIN"