dip/service-catalog
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
449 Commits 2 Branches 0 Tags
981d36daa47b906b09f232fbad891b923e7ec40c
Commit Graph

449 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
wbsong111 18ca8cd979 fix(catalog): exclude windowsExporter from rancher-monitoring 
Windows 노드 미사용 + Windows 이미지라 trivy 스캔 불가 → windowsExporter.enabled=false
로 SBOM/패키징 대상에서 제외.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-08 16:32:22 +09:00
wbsong111 1d8e68eaf5 fix(catalog): repoint dead upstream image refs to existing coordinates 
미러 없이 이미지 목록으로 오프라인 패키징하므로, 레지스트리에서 사라진 참조는
패키징을 깨뜨림. 존재 검증된 좌표로 정정:
- kafka:      bitnami/kafka        → bitnamilegacy/kafka
- kyverno:    bitnami/kubectl      → bitnamilegacy/kubectl (webhooks/policyReports cleanup)
- strimzi:    defaultImageRegistry ""(→docker.io) → quay.io (strimzi 는 quay 발행)
- nemo:       gcr.io/kubebuilder/kube-rbac-proxy → quay.io/brancz/kube-rbac-proxy
- unitycatalog: tag ""(→appVersion SNAPSHOT, 미발행) → v0.3.0

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-08 16:21:53 +09:00
wbsong111 c36edb3015 sbom-ci: meaningful stage timings, dynamic severity cols, doc update 
- scan-sbom: 요약에 단계별 소요(SBOM 생성 vs 취약점 스캔) 표시, 오해 주던 "총 소요"·
  항상 0인 per-SBOM Sec·min/max 라인 제거. 스캔한 SEVERITY 만 동적 컬럼.
- generate-sbom: 생성 소요시간을 .sbom-gen-seconds 로 기록(요약 단계별 시간용).
- doc/sbom-pipeline.md: 실행 이미지(Dockerfile)·빌드/푸시·GitHub 설정·결과 확인/대응 보강.
- .gitignore: .sbom-gen-seconds.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-08 14:29:07 +09:00
wbsong111 f8ca673630 fix(sbom-ci): summary shows only scanned severities (drop always-zero MED/LOW) 
SEVERITY 로 스캔한 심각도만 요약표 컬럼으로 동적 출력. 기본(HIGH,CRITICAL)에서
항상 0이던 MED/LOW 컬럼 제거. SEVERITY 에 MEDIUM/LOW 추가 시에만 해당 컬럼 표시.
TSV 는 CRITICAL 을 첫 카운트 열로 유지(게이트 호환).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-08 14:14:27 +09:00
wbsong111 a61d6730dd fix(sbom-ci): clean artifact layout + add limit input for test runs 
- 아티팩트: 요약(trivy-summary.md/tsv)·sbom-index.tsv 를 최상위,
  이미지별 상세 SBOM 을 sbom/ 하위로 배치. 절대경로 업로드 시 v4 가 전체
  경로트리를 보존하던 문제를 스테이징 디렉토리 + 상대경로 업로드로 해결.
- workflow_dispatch 에 limit 입력 추가(0=전체, 테스트 시 소수만 생성).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-08 14:08:03 +09:00
wbsong111 d6e3d0af79 docs(sbom): add pipeline image Dockerfile + cross-reference from workflow 
.github/workflows/sbom.yml 의 SBOM_PIPELINE_IMAGE 로 사용하는 실행 이미지
Dockerfile 을 doc/scripts/Dockerfile 로 추가(debian/glibc + helm/trivy/python3/git).
워크플로·sbom-pipeline.md 에서 상호 참조하도록 갱신.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-08 13:26:04 +09:00
wbsong111 2af7fcb43d feat(sbom): add Helm catalog SBOM+vuln pipeline (CycloneDX) 
manifests/helm 카탈로그 전 이미지의 SBOM(CycloneDX)과 취약점 리포트를
생성하는 파이프라인 추가. 컨테이너 내부 trivy/helm 바이너리 직접 호출.

- doc/scripts/extract-helm-images.sh: helm template 렌더로 이미지 인벤토리 추출
- doc/scripts/generate-sbom.sh: trivy image --format cyclonedx (이미지 1회 pull)
- doc/scripts/scan-sbom.sh: trivy sbom 로 SBOM 기반 오프라인 취약점 스캔
- .github/workflows/sbom.yml: 스케줄(전체)+PR(증분)+수동, 산출물은 아티팩트
- doc/sbom-pipeline.md: 파이프라인 설계·운영 문서(단일)
- latest/무태그 digest 고정: mlflow postgresql, vllm-openai(v0.24.0)
- .gitignore: 파이프라인 산출물 제외

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-08 12:15:58 +09:00
wbsong111 9676fec2f3 docs: correct VictoriaLogs tenant header to AccountID/ProjectID across docs 
otelcol 헤더 수정(aef6439)에 맞춰 아키텍처 문서·vlogs/otelcol CUSTOM-README·
vlogs custom-values 주석의 VictoriaLogs-AccountID 참조를 AccountID/ProjectID 로 정정.
VictoriaLogs-* 접두 헤더 무시(전량 acct0) 경고 추가.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 15:45:10 +09:00
wbsong111 aef64390f1 fix(otelcol): use AccountID/ProjectID headers for VictoriaLogs multitenancy 
로그 테넌트 라우팅이 동작하지 않던 결함 수정. otelcol exporter가
'VictoriaLogs-AccountID' 헤더를 사용했으나 VictoriaLogs는 이를 인식하지 못해
모든 로그가 account 0 으로 적재됨(dev 실측: AccountID:1 쓰기는 acct1,
VictoriaLogs-AccountID:1 쓰기는 acct0). 올바른 헤더 AccountID/ProjectID 로 교체.

- opentelemetry-collector custom-values(로그 3파이프라인) + events(acct0)
- docs: deploy-guide §1.4 relabel '[]'=격리아님 경고+예시, vmagent CUSTOM-README keep 규칙 예시
- .gitignore: tenant-verification/ (로컬 검증 산출물)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 15:37:46 +09:00
wbsong111 b022204004 docs: formalize monitoring deploy runbook; move test record to issue #2 
배포 라이프사이클 3단계(배포 전 사전조건 / 배포 시 ApplicationSet / 배포 후
테넌트 관리)로 운영 런북(monitoring-deploy-guide.md) 신규 작성.
테스트 검증 기록(monitoring-deploy-test.md)은 GitHub 이슈 #2로 분리 후 close,
레포에서는 삭제. 아키텍처 문서에 런북 링크 추가.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 16:45:01 +09:00
wbsong111 d35117a976 docs: capture internal-CA trust requirement for vmauth/perses OIDC + perses login=preferred_username 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 16:11:18 +09:00
wbsong111 9fab760992 vmauth: mount internal root CA + SSL_CERT_FILE for Keycloak OIDC discovery (fix x509) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 16:06:14 +09:00
wbsong111 7ddb1f062d improvements: ApplicationSet ignoreDifferences(SS VCT) + vmauth drop unauthorized_user 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 15:16:21 +09:00
wbsong111 14fb0d214a perses overlay template: globalAdminUsers note (login=preferred_username) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 15:01:57 +09:00
wbsong111 d1f7c77201 Adjust VM ApplicationSet for test env + per-URL tenant routing rationale 
- applicationset: ns argocd→platform, repoURL service-catalog/tenant-catalog @master
- vmagent custom-values/CUSTOM-README: per-URL 채택 근거 정정(인라인 가능하나 보안·격리 위해 per-URL)
- architecture doc: §5.1 테넌트 라우팅 결정 기록 + monitoring 배포 테스트 문서

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 14:36:58 +09:00
wbsong111 6290322f1b Add VictoriaMetrics observability stack + sync catalog for monitoring test 
- VM stack 10 charts: victoria-metrics-cluster/auth, victoria-logs-cluster,
  victoria-metrics-agent/alert, opentelemetry-collector, kube-state-metrics,
  prometheus-node-exporter, alertmanager, perses (JWT/OIDC, Infisical-ready)
- ArgoCD ApplicationSet (syncWave) + per-chart dip-values overlays
- doc/victoria-metrics-architecture.md, define-chart-resources updates
- includes pending working-tree changes (mlflow, kubeflow, apisix, CLAUDE.md)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 11:10:51 +09:00
ychangkim a55427730e dip quotas yaml add 2026-06-18 15:23:09 +09:00
ychangkim 6805aa652f dip questions yaml add 2026-06-16 16:37:07 +09:00
wbsong111 f4d287abef update lakekeeper/0.11.0 
- chart 0.8.1 → 0.11.0 (appVersion 0.10.4 → 0.12.2)
- deps: postgres 1.5.8 → 1.5.13, openfga 0.2.44 → 0.2.62
- ingress: Kong → APISIX (use-regex + path /.*, cluster-issuer)
- openfga.playground 비활성화 (preshared 인증 패닉 방지)
- breaking=false, custom-values 키 전부 호환

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 09:13:31 +09:00
ychangkim 1ab3d4d31c mlflow dip values 2026-06-10 15:10:47 +09:00
ychangkim 4064cd8971 dip values add 2026-06-09 16:30:22 +09:00
ychangkim 409536ee7c dip values add 2026-06-09 14:53:33 +09:00
ychangkim 3da2d3b4b8 dip-values add 2026-06-09 13:07:22 +09:00
ychangkim 5590af0ec5 dip-values add 2026-06-09 13:06:40 +09:00
ychangkim e64f933901 dip-values add 2026-06-09 11:51:43 +09:00
wbsong111 162d9b2c2a Update jupyter configuration for network connection 2026-05-06 09:00:16 +09:00
wbsong111 547dc58e8b patch before_request.py to allow workspace creation with EDIT permission 2026-04-27 16:58:04 +09:00
wbsong111 5fac7175a5 Update mlflow REAMD.md 2026-04-27 11:10:33 +09:00
wbsong111 bc4396a62e Merge remote-tracking branch with mlflow 1.9.0 README conflict resolved 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-27 10:44:11 +09:00
wbsong111 b897f0ad37 Add multi-tenant feature 2026-04-27 10:39:55 +09:00
wbsong111 e678775672 Update README.md 2026-04-24 09:59:57 +09:00
wbsong111 ba0a4b19bc Update CUSTOM-README.md 2026-04-23 16:34:40 +09:00
wbsong111 8e68b1d603 Update CUSTOM-README.md 2026-04-23 16:32:52 +09:00
wbsong111 d31a1fae18 Add service account and role/rolebinding 2026-04-23 16:30:38 +09:00
wbsong111 ed0542e36d Add service account and role/rolebinding 2026-04-23 16:23:37 +09:00
wbsong111 502e7f8e2b Replace hardcoded resource names with Helm template helpers 2026-04-23 14:35:15 +09:00
wbsong111 9c30bf0a80 Replace hardcoded resource names with Helm template helpers 2026-04-23 14:22:02 +09:00
wbsong111 aec5bc74ac Replace hardcoded resource names with Helm template helpers 2026-04-23 14:15:58 +09:00
wbsong111 3a78d39b7a Add chart mlflow 1.9.0 2026-04-22 17:08:02 +09:00
wbsong111 b8942c5f46 Modify image name 2026-04-22 17:04:56 +09:00
wbsong111 24ee4ec731 Add chart flink cdc job 2026-04-21 16:43:09 +09:00
wbsong111 bae49f352c Update BUILD-README.md 2026-04-21 16:13:00 +09:00
wbsong111 03460b4fa6 Add chart flink cdc session cluster chart 2026-04-21 16:10:10 +09:00
ychangkim 8aca1e74f9 fix: prevent root-owned .cache files by adding --no-cache-dir to pip upgrade 
Running pip as root (runAsUser: 0) created /home/jovyan/.cache with root
ownership, causing permission issues for the jovyan user at runtime.
 2026-04-20 14:37:27 +09:00
wbsong111 baba7dcf55 Define resource profiles for cloudbeaver 2026-04-13 16:23:08 +09:00
wbsong111 83c61ee0e2 Add chart cloudbeaver 1.1.4 2026-04-13 13:09:02 +09:00
wbsong111 c6ed7cb4e9 Remove tracked Python bytecode files and add .gitignore 2026-04-13 13:07:07 +09:00
ychangkim eb11d74e9f feat: add configurable shmSizeLimit for /dev/shm in jupyterlab chart 
Introduce shmSizeLimit value (default 512Mi) to control the size of the
RAM-backed /dev/shm volume. Leave empty to apply no limit.
 2026-04-01 17:40:33 +09:00
ychangkim 9be83c6f3a feat: support inline tag in image.repository for jupyterlab chart 
Allow repository field to include a tag (e.g. "repo:tag"), in which case
the tag field is ignored. Update docs and custom-values to reflect the
new behavior and add dshm volume notes.
 2026-03-31 12:29:23 +09:00
ychangkim b4213e4872 feat: add /dev/shm shared memory volume to jupyterlab deployment 
Mount RAM-backed emptyDir at /dev/shm to remove the default 64MB limit,
preventing Bus errors when using PyTorch DataLoader or NumPy multiprocessing.
 2026-03-26 18:13:44 +09:00