자체 빌드 이미지 3종(cloudnative-pg/cnpg-postgresql/etcd) + 대응 헬름 차트 도입

security-catalog 프로젝트에서 첫 실사용 자체 빌드 이미지 3종을 포팅한다 — 전부 상위 태그·베이스 OS 교체로 해소 안 되는 CVE(Go 모듈 정적 링크 또는 미수정 CRITICAL/ HIGH)를 자체 빌드(소스 컴파일 또는 SUSE BCI 재설치)로 대응한다: - images/cloudnative-pg: CNPG operator, release-1.30 소스 컴파일 + bci-micro - images/cnpg-postgresql: PostgreSQL 18.4, bci-base + zypper 재설치 - images/etcd: etcd v3.7.1, 소스 컴파일(x/text 강제 업그레이드) + bci-micro 함께 추가: - manifests/helm/{cloudnative-pg,cnpg-cluster,etcd} — 위 이미지를 참조하는 카탈로그 차트 - scripts/deploy-test/*.sh, .claude/deploy-test-procedure.md — CVE 0건과 별개로 "실제로 뜨는가"를 검증하는 배포 스모크 테스트 - .claude/pitfalls.md — 자체 빌드/배포 테스트 중 실측한 함정 모음 검토 중 발견해 반영한 수정: - cloudnative-pg 차트의 image 블록을 etcd와 동일한 registry/repository/tag 3필드+ 따옴표 포맷으로 통일 — 기존 포맷(repository에 registry+repo 결합, 따옴표 없음)은 patch-catalog-tag.py 의 split 패처가 tag만 갱신하고 repository는 그대로 남기는 조용한 부분 치환을 일으켜, 향후 레지스트리 마이그레이션 시 깨진 참조를 만들 수 있었다 - cnpg-cluster 차트의 SLES 커버리지 코멘트를 최신 실측(trivy가 SLES 15.7을 정상 커버함, 2026-07-29 재측정)에 맞게 정정 — 폐기된 "측정 불가/OVAL 우회 필요" 결론이 남아있었다 - CLAUDE.md/MEMORY.md 의 "images/ 디렉토리 없음" 서술을 갱신하고, 레지스트리 마이그레이션(docker.io/wbsong111 → docker.io/paasup)·decisions/analysis 문서 이관· 리소스 프로파일 추가를 다음 작업으로 기록 이 3개 이미지는 아직 dip-catalog 자체 CI(build-image.yml)로 빌드·게이트·push 를 실행해본 적이 없다 — 현재 참조 태그는 security-catalog 쪽에서 이미 검증된 것이다. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-03 12:03:37 +09:00
parent a168a3c7e6
commit 6878b61efa
89 changed files with 36608 additions and 11 deletions
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
@@ -0,0 +1,6 @@
+apiVersion: v2
+appVersion: 1.16.0
+description: CloudNativePG Grafana Cluster Dashboard.
+name: cluster
+type: application
+version: 0.0.5
@@ -0,0 +1,59 @@
+<!-- THIS FILE IS AUTOMATICALLY GENERATED. Make changes to README.md.gotmpl instead. -->
+
+# cluster
+
+![Version: 0.0.5](https://img.shields.io/badge/Version-0.0.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.16.0](https://img.shields.io/badge/AppVersion-1.16.0-informational?style=flat-square)
+
+![Grafana CloudNativePG Cluster Overview](../../images/overview.png)
+
+Getting Started
+---------------
+
+_**Note,** this dashboard is already included in the [CloudNativePG Operator Helm Chart][operator]._
+
+There are 4 ways to use the CloudNativePG Grafana Cluster Dashboard:
+
+0. Install the [CloudNativePG Operator Helm Chart][operator]
+
+1. Install manually via [Grafana.com](https://grafana.com/grafana/dashboards/20417-cloudnativepg/).
+
+2. Install manually via the [Grafana JSON](https://github.com/cloudnative-pg/grafana-dashboards/blob/main/charts/cluster/grafana-dashboard.json):
+
+```
+https://raw.githubusercontent.com/cloudnative-pg/grafana-dashboards/main/charts/cluster/grafana-dashboard.json
+```
+
+3. Install directly in your cluster as a Helm Chart:
+
+```bash
+helm repo add cnpg-grafana https://cloudnative-pg.github.io/grafana-dashboards
+helm upgrade
+  --install \
+  --namespace monitoring \
+  cnpg-grafana-cluster cnpg-grafana/cluster
+```
+
+2. As as a dependency to an existing chart:
+
+```yaml
+dependencies:
+  - name: cluster
+    alias: cnpg-grafana-cluster-dashboard
+    version: "0.0"
+    repository: https://cloudnative-pg.github.io/grafana-dashboards
+```
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| fullnameOverride | string | `""` |  |
+| grafanaDashboard.annotations | object | `{}` | Annotations that ConfigMaps can have to get configured in Grafana. |
+| grafanaDashboard.configMapName | string | `"cnpg-grafana-dashboard"` | The name of the ConfigMap containing the dashboard. |
+| grafanaDashboard.labels | object | `{}` | Labels that ConfigMaps should have to get configured in Grafana. |
+| grafanaDashboard.namespace | string | `""` | Allows overriding the namespace where the ConfigMap will be created, defaulting to the same one as the Release. |
+| grafanaDashboard.sidecarLabel | string | `"grafana_dashboard"` | Label that ConfigMaps should have to be loaded as dashboards. DEPRECATED: Use labels instead. |
+| grafanaDashboard.sidecarLabelValue | string | `"1"` | Label value that ConfigMaps should have to be loaded as dashboards. DEPRECATED: Use labels instead. |
+| nameOverride | string | `""` |  |
+
+[operator]: https://github.com/cloudnative-pg/charts/tree/main/charts/cloudnative-pg
@@ -0,0 +1,59 @@
+<!-- THIS FILE IS AUTOMATICALLY GENERATED. Make changes to README.md.gotmpl instead. -->
+
+{{ template "chart.header" . }}
+
+{{ template "chart.deprecationWarning" . }}
+
+{{ template "chart.badgesSection" . }}
+
+![Grafana CloudNativePG Cluster Overview](../../images/overview.png)
+
+Getting Started
+---------------
+
+_**Note,** this dashboard is already included in the [CloudNativePG Operator Helm Chart][operator]._
+
+There are 4 ways to use the CloudNativePG Grafana Cluster Dashboard:
+
+0. Install the [CloudNativePG Operator Helm Chart][operator]
+
+1. Install manually via [Grafana.com](https://grafana.com/grafana/dashboards/20417-cloudnativepg/).
+
+2. Install manually via the [Grafana JSON](https://github.com/cloudnative-pg/grafana-dashboards/blob/main/charts/cluster/grafana-dashboard.json):
+
+```
+https://raw.githubusercontent.com/cloudnative-pg/grafana-dashboards/main/charts/cluster/grafana-dashboard.json
+```
+
+3. Install directly in your cluster as a Helm Chart:
+
+```bash
+helm repo add cnpg-grafana https://cloudnative-pg.github.io/grafana-dashboards
+helm upgrade
+  --install \
+  --namespace monitoring \
+  cnpg-grafana-cluster cnpg-grafana/cluster
+```
+
+2. As as a dependency to an existing chart:
+
+```yaml
+dependencies:
+  - name: cluster
+    alias: cnpg-grafana-cluster-dashboard
+    version: "0.0"
+    repository: https://cloudnative-pg.github.io/grafana-dashboards
+```
+
+
+{{ template "chart.requirementsSection" . }}
+
+
+{{ template "chart.valuesSection" . }}
+
+
+{{ template "chart.maintainersSection" . }}
+
+{{ template "helm-docs.versionFooter" . }}
+
+[operator]: https://github.com/cloudnative-pg/charts/tree/main/charts/cloudnative-pg
@@ -0,0 +1,5 @@
+CloudNativePG Grafana Dashboard installed successfully.
+
+{{- if (or .Values.grafanaDashboard.sidecarLabel .Values.grafanaDashboard.sidecarLabelValue) }}
+DEPRECATION NOTICE: The grafanaDashboard.sidecarLabel is deprecated and will be removed in a future release. Use the grafanaDashboard.labels instead.
+{{- end }}
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Values.grafanaDashboard.configMapName }}
+  namespace: {{ default .Release.Namespace .Values.grafanaDashboard.namespace }}
+  {{- if (or .Values.grafanaDashboard.labels .Values.grafanaDashboard.sidecarLabel) }}
+  labels:
+    {{- if .Values.grafanaDashboard.sidecarLabel }}
+    {{ .Values.grafanaDashboard.sidecarLabel }}: {{ .Values.grafanaDashboard.sidecarLabelValue | quote }}
+    {{- end }}
+    {{- with .Values.grafanaDashboard.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  {{- with .Values.grafanaDashboard.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+data:
+    cnp.json: |-
+{{ .Files.Get "grafana-dashboard.json" | indent 6 }}
@@ -0,0 +1,35 @@
+{
+    "$schema": "http://json-schema.org/schema#",
+    "type": "object",
+    "properties": {
+        "fullnameOverride": {
+            "type": "string"
+        },
+        "grafanaDashboard": {
+            "type": "object",
+            "properties": {
+                "annotations": {
+                    "type": "object"
+                },
+                "configMapName": {
+                    "type": "string"
+                },
+                "labels": {
+                    "type": "object"
+                },
+                "namespace": {
+                    "type": "string"
+                },
+                "sidecarLabel": {
+                    "type": "string"
+                },
+                "sidecarLabelValue": {
+                    "type": "string"
+                }
+            }
+        },
+        "nameOverride": {
+            "type": "string"
+        }
+    }
+}
@@ -0,0 +1,20 @@
+# Default values for cluster.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+nameOverride: ""
+fullnameOverride: ""
+
+grafanaDashboard:
+  # -- Allows overriding the namespace where the ConfigMap will be created, defaulting to the same one as the Release.
+  namespace: ""
+  # -- The name of the ConfigMap containing the dashboard.
+  configMapName: "cnpg-grafana-dashboard"
+  # -- Label that ConfigMaps should have to be loaded as dashboards. DEPRECATED: Use labels instead.
+  sidecarLabel: "grafana_dashboard"
+  # -- Label value that ConfigMaps should have to be loaded as dashboards. DEPRECATED: Use labels instead.
+  sidecarLabelValue: "1"
+  # -- Labels that ConfigMaps should have to get configured in Grafana.
+  labels: {}
+  # -- Annotations that ConfigMaps can have to get configured in Grafana.
+  annotations: {}