dip/service-catalog
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
443 Commits 2 Branches 0 Tags
64f049a00a272735c6fa8d0dbc9727285949b921
Commit Graph

443 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
wbsong111 2af7fcb43d feat(sbom): add Helm catalog SBOM+vuln pipeline (CycloneDX) 
manifests/helm 카탈로그 전 이미지의 SBOM(CycloneDX)과 취약점 리포트를
생성하는 파이프라인 추가. 컨테이너 내부 trivy/helm 바이너리 직접 호출.

- doc/scripts/extract-helm-images.sh: helm template 렌더로 이미지 인벤토리 추출
- doc/scripts/generate-sbom.sh: trivy image --format cyclonedx (이미지 1회 pull)
- doc/scripts/scan-sbom.sh: trivy sbom 로 SBOM 기반 오프라인 취약점 스캔
- .github/workflows/sbom.yml: 스케줄(전체)+PR(증분)+수동, 산출물은 아티팩트
- doc/sbom-pipeline.md: 파이프라인 설계·운영 문서(단일)
- latest/무태그 digest 고정: mlflow postgresql, vllm-openai(v0.24.0)
- .gitignore: 파이프라인 산출물 제외

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-08 12:15:58 +09:00
wbsong111 9676fec2f3 docs: correct VictoriaLogs tenant header to AccountID/ProjectID across docs 
otelcol 헤더 수정(aef6439)에 맞춰 아키텍처 문서·vlogs/otelcol CUSTOM-README·
vlogs custom-values 주석의 VictoriaLogs-AccountID 참조를 AccountID/ProjectID 로 정정.
VictoriaLogs-* 접두 헤더 무시(전량 acct0) 경고 추가.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 15:45:10 +09:00
wbsong111 aef64390f1 fix(otelcol): use AccountID/ProjectID headers for VictoriaLogs multitenancy 
로그 테넌트 라우팅이 동작하지 않던 결함 수정. otelcol exporter가
'VictoriaLogs-AccountID' 헤더를 사용했으나 VictoriaLogs는 이를 인식하지 못해
모든 로그가 account 0 으로 적재됨(dev 실측: AccountID:1 쓰기는 acct1,
VictoriaLogs-AccountID:1 쓰기는 acct0). 올바른 헤더 AccountID/ProjectID 로 교체.

- opentelemetry-collector custom-values(로그 3파이프라인) + events(acct0)
- docs: deploy-guide §1.4 relabel '[]'=격리아님 경고+예시, vmagent CUSTOM-README keep 규칙 예시
- .gitignore: tenant-verification/ (로컬 검증 산출물)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 15:37:46 +09:00
wbsong111 b022204004 docs: formalize monitoring deploy runbook; move test record to issue #2 
배포 라이프사이클 3단계(배포 전 사전조건 / 배포 시 ApplicationSet / 배포 후
테넌트 관리)로 운영 런북(monitoring-deploy-guide.md) 신규 작성.
테스트 검증 기록(monitoring-deploy-test.md)은 GitHub 이슈 #2로 분리 후 close,
레포에서는 삭제. 아키텍처 문서에 런북 링크 추가.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 16:45:01 +09:00
wbsong111 d35117a976 docs: capture internal-CA trust requirement for vmauth/perses OIDC + perses login=preferred_username 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 16:11:18 +09:00
wbsong111 9fab760992 vmauth: mount internal root CA + SSL_CERT_FILE for Keycloak OIDC discovery (fix x509) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 16:06:14 +09:00
wbsong111 7ddb1f062d improvements: ApplicationSet ignoreDifferences(SS VCT) + vmauth drop unauthorized_user 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 15:16:21 +09:00
wbsong111 14fb0d214a perses overlay template: globalAdminUsers note (login=preferred_username) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 15:01:57 +09:00
wbsong111 d1f7c77201 Adjust VM ApplicationSet for test env + per-URL tenant routing rationale 
- applicationset: ns argocd→platform, repoURL service-catalog/tenant-catalog @master
- vmagent custom-values/CUSTOM-README: per-URL 채택 근거 정정(인라인 가능하나 보안·격리 위해 per-URL)
- architecture doc: §5.1 테넌트 라우팅 결정 기록 + monitoring 배포 테스트 문서

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 14:36:58 +09:00
wbsong111 6290322f1b Add VictoriaMetrics observability stack + sync catalog for monitoring test 
- VM stack 10 charts: victoria-metrics-cluster/auth, victoria-logs-cluster,
  victoria-metrics-agent/alert, opentelemetry-collector, kube-state-metrics,
  prometheus-node-exporter, alertmanager, perses (JWT/OIDC, Infisical-ready)
- ArgoCD ApplicationSet (syncWave) + per-chart dip-values overlays
- doc/victoria-metrics-architecture.md, define-chart-resources updates
- includes pending working-tree changes (mlflow, kubeflow, apisix, CLAUDE.md)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 11:10:51 +09:00
ychangkim a55427730e dip quotas yaml add 2026-06-18 15:23:09 +09:00
ychangkim 6805aa652f dip questions yaml add 2026-06-16 16:37:07 +09:00
wbsong111 f4d287abef update lakekeeper/0.11.0 
- chart 0.8.1 → 0.11.0 (appVersion 0.10.4 → 0.12.2)
- deps: postgres 1.5.8 → 1.5.13, openfga 0.2.44 → 0.2.62
- ingress: Kong → APISIX (use-regex + path /.*, cluster-issuer)
- openfga.playground 비활성화 (preshared 인증 패닉 방지)
- breaking=false, custom-values 키 전부 호환

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 09:13:31 +09:00
ychangkim 1ab3d4d31c mlflow dip values 2026-06-10 15:10:47 +09:00
ychangkim 4064cd8971 dip values add 2026-06-09 16:30:22 +09:00
ychangkim 409536ee7c dip values add 2026-06-09 14:53:33 +09:00
ychangkim 3da2d3b4b8 dip-values add 2026-06-09 13:07:22 +09:00
ychangkim 5590af0ec5 dip-values add 2026-06-09 13:06:40 +09:00
ychangkim e64f933901 dip-values add 2026-06-09 11:51:43 +09:00
wbsong111 162d9b2c2a Update jupyter configuration for network connection 2026-05-06 09:00:16 +09:00
wbsong111 547dc58e8b patch before_request.py to allow workspace creation with EDIT permission 2026-04-27 16:58:04 +09:00
wbsong111 5fac7175a5 Update mlflow REAMD.md 2026-04-27 11:10:33 +09:00
wbsong111 bc4396a62e Merge remote-tracking branch with mlflow 1.9.0 README conflict resolved 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-27 10:44:11 +09:00
wbsong111 b897f0ad37 Add multi-tenant feature 2026-04-27 10:39:55 +09:00
wbsong111 e678775672 Update README.md 2026-04-24 09:59:57 +09:00
wbsong111 ba0a4b19bc Update CUSTOM-README.md 2026-04-23 16:34:40 +09:00
wbsong111 8e68b1d603 Update CUSTOM-README.md 2026-04-23 16:32:52 +09:00
wbsong111 d31a1fae18 Add service account and role/rolebinding 2026-04-23 16:30:38 +09:00
wbsong111 ed0542e36d Add service account and role/rolebinding 2026-04-23 16:23:37 +09:00
wbsong111 502e7f8e2b Replace hardcoded resource names with Helm template helpers 2026-04-23 14:35:15 +09:00
wbsong111 9c30bf0a80 Replace hardcoded resource names with Helm template helpers 2026-04-23 14:22:02 +09:00
wbsong111 aec5bc74ac Replace hardcoded resource names with Helm template helpers 2026-04-23 14:15:58 +09:00
wbsong111 3a78d39b7a Add chart mlflow 1.9.0 2026-04-22 17:08:02 +09:00
wbsong111 b8942c5f46 Modify image name 2026-04-22 17:04:56 +09:00
wbsong111 24ee4ec731 Add chart flink cdc job 2026-04-21 16:43:09 +09:00
wbsong111 bae49f352c Update BUILD-README.md 2026-04-21 16:13:00 +09:00
wbsong111 03460b4fa6 Add chart flink cdc session cluster chart 2026-04-21 16:10:10 +09:00
ychangkim 8aca1e74f9 fix: prevent root-owned .cache files by adding --no-cache-dir to pip upgrade 
Running pip as root (runAsUser: 0) created /home/jovyan/.cache with root
ownership, causing permission issues for the jovyan user at runtime.
 2026-04-20 14:37:27 +09:00
wbsong111 baba7dcf55 Define resource profiles for cloudbeaver 2026-04-13 16:23:08 +09:00
wbsong111 83c61ee0e2 Add chart cloudbeaver 1.1.4 2026-04-13 13:09:02 +09:00
wbsong111 c6ed7cb4e9 Remove tracked Python bytecode files and add .gitignore 2026-04-13 13:07:07 +09:00
ychangkim eb11d74e9f feat: add configurable shmSizeLimit for /dev/shm in jupyterlab chart 
Introduce shmSizeLimit value (default 512Mi) to control the size of the
RAM-backed /dev/shm volume. Leave empty to apply no limit.
 2026-04-01 17:40:33 +09:00
ychangkim 9be83c6f3a feat: support inline tag in image.repository for jupyterlab chart 
Allow repository field to include a tag (e.g. "repo:tag"), in which case
the tag field is ignored. Update docs and custom-values to reflect the
new behavior and add dshm volume notes.
 2026-03-31 12:29:23 +09:00
ychangkim b4213e4872 feat: add /dev/shm shared memory volume to jupyterlab deployment 
Mount RAM-backed emptyDir at /dev/shm to remove the default 64MB limit,
preventing Bus errors when using PyTorch DataLoader or NumPy multiprocessing.
 2026-03-26 18:13:44 +09:00
ychangkim af34d9280e jupyterlab 2026-03-26 15:14:05 +09:00
ychangkim d3d3ee8496 openmetadata applicationset 2026-03-15 18:03:29 +09:00
ychangkim 65c7f6b319 openmetadata applicationset 2026-03-14 18:04:37 +09:00
ychangkim 91919232ed openmetadata applicationset 2026-03-14 16:09:39 +09:00
wbsong111 ba3704dade Add applicationset for openmetadata 2026-03-10 17:11:25 +09:00
wbsong111 21addb6e88 Move directory 2026-03-06 17:08:31 +09:00