Add VictoriaMetrics observability stack + sync catalog for monitoring test

- VM stack 10 charts: victoria-metrics-cluster/auth, victoria-logs-cluster, victoria-metrics-agent/alert, opentelemetry-collector, kube-state-metrics, prometheus-node-exporter, alertmanager, perses (JWT/OIDC, Infisical-ready) - ArgoCD ApplicationSet (syncWave) + per-chart dip-values overlays - doc/victoria-metrics-architecture.md, define-chart-resources updates - includes pending working-tree changes (mlflow, kubeflow, apisix, CLAUDE.md) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-25 11:10:51 +09:00
parent a55427730e
commit 6290322f1b
514 changed files with 68103 additions and 40 deletions
@@ -0,0 +1,186 @@
+image:
+  repository: paasup/apisix
+  tag: "3.16.0-keycloak-authz"
+  pullPolicy: IfNotPresent
+  
+replicaCount: 1
+
+resources:
+  limits:
+    cpu: "1000m"
+    memory: "1Gi"
+  requests:
+    cpu: "250m"
+    memory: "512Mi"
+
+apisix:
+  enableIPv6: false              # 기본값: true
+
+  # apisix.plugins 명시 시 기본 플러그인 목록을 완전히 대체한다. 전체 목록 유지 필수.
+  plugins:
+    - ai
+    - ai-aliyun-content-moderation
+    - ai-aws-content-moderation
+    - ai-prompt-decorator
+    - ai-prompt-guard
+    - ai-prompt-template
+    - ai-proxy
+    - ai-proxy-multi
+    - ai-rag
+    - ai-rate-limiting
+    - ai-request-rewrite
+    - api-breaker
+    - attach-consumer-label
+    - authz-casbin
+    - authz-casdoor
+    - authz-keycloak
+    - aws-lambda
+    - azure-functions
+    - basic-auth
+    - body-transformer
+    - cas-auth
+    - chaitin-waf
+    - clickhouse-logger
+    - client-control
+    - consumer-restriction
+    - cors
+    - csrf
+    - datadog
+    - degraphql
+    - echo
+    - elasticsearch-logger
+    - example-plugin
+    - ext-plugin-post-req
+    - ext-plugin-post-resp
+    - ext-plugin-pre-req
+    - fault-injection
+    - file-logger
+    - forward-auth
+    - google-cloud-logging
+    - grpc-transcode
+    - grpc-web
+    - gzip
+    - hmac-auth
+    - http-dubbo
+    - http-logger
+    - inspect
+    - ip-restriction
+    - jwe-decrypt
+    - jwt-auth
+    - kafka-logger
+    - kafka-proxy
+    - key-auth
+    - lago
+    - ldap-auth
+    - limit-conn
+    - limit-count
+    - limit-req
+    - loggly
+    - loki-logger
+    - mcp-bridge
+    - mocking
+    - multi-auth
+    - opa
+    - openfunction
+    - openid-connect
+    - openwhisk
+    - prometheus
+    - proxy-cache
+    - proxy-control
+    - proxy-mirror
+    - proxy-rewrite
+    - public-api
+    - real-ip
+    - redirect
+    - referer-restriction
+    - request-id
+    - request-validation
+    - response-rewrite
+    - rocketmq-logger
+    - serverless-post-function
+    - serverless-pre-function
+    - skywalking-logger
+    - sls-logger
+    - splunk-hec-logging
+    - syslog
+    - tcp-logger
+    - tencent-cloud-cls
+    - traffic-split
+    - ua-restriction
+    - udp-logger
+    - uri-blocker
+    - wolf-rbac
+    - workflow
+    - zipkin
+    - keycloak-authz         # 커스텀 플러그인 — Kong 포팅
+
+  # Kong keycloak-authz 포팅: X-Access-Token JWT → preferred_username → 외부 API 권한 확인
+  customPlugins:
+    enabled: true
+    luaPath: "/opts/custom_plugins/?.lua"
+    plugins:
+      - name: keycloak-authz
+        attrs: {}
+        configMap:
+          name: keycloak-authz-plugin
+          mounts:
+            - key: keycloak-authz.lua
+              path: /opts/custom_plugins/apisix/plugins/keycloak-authz.lua
+
+  ssl:
+    enabled: true                # 기본값: false
+    containerPort: 9443
+
+  admin:
+    # SECURITY: 기본 어드민 키 반드시 교체. 운영 배포 전 Secret 또는 Vault로 주입할 것.
+    # 키 생성: openssl rand -hex 16
+    credentials:
+      admin: "edd1c9f034335f136f87ad84b625c8f1"  # 기본값 — 운영 전 변경 필수
+
+service:
+  type: LoadBalancer             # 기본값: NodePort — MetalLB에서 IP 자동 할당
+  http:
+    enabled: true
+    servicePort: 80
+    containerPort: 9080
+  tls:
+    servicePort: 443
+  stream:
+    enabled: true                # 기본값: false — proxy_mode: http&stream 활성화 트리거
+    tcp: []
+    udp: []
+
+# 내장 etcd는 개발/테스트 전용. 운영에서는 externalEtcd를 사용한다.
+etcd:
+  enabled: true
+  replicaCount: 1                # 단일 노드 클러스터 — 운영 HA는 3 권장
+  persistence:
+    enabled: true
+    storageClass: longhorn
+    size: 4Gi
+
+# 외부 etcd 사용 시 etcd.enabled=false로 설정하고 아래 값을 채운다.
+# externalEtcd:
+#   host:
+#     - http://etcd-cluster.platform.svc.cluster.local:2379
+#   user: ""
+#   password: ""
+
+ingress-controller:
+  enabled: true
+  ingressClass: apisix           # Kong의 'kong' class와 분리
+
+  gatewayProxy:
+    createDefault: true          # 기본값: false — v2.0.1+에서 미설정 시 라우트 등록 안 됨
+    publishService: apisix/apisix-gateway   # Ingress STATUS에 External IP 반영
+    provider:
+      type: ControlPlane
+      controlPlane:
+        endpoints:
+          - http://apisix-admin.apisix.svc.cluster.local:9180
+        auth:
+          type: AdminKey
+          adminKey:
+            # SECURITY: admin.credentials.admin과 동일 키 — 운영 전 변경 필수
+            # 키 생성: openssl rand -hex 16
+            value: "edd1c9f034335f136f87ad84b625c8f1"