wbsong111
6290322f1b
- VM stack 10 charts: victoria-metrics-cluster/auth, victoria-logs-cluster, victoria-metrics-agent/alert, opentelemetry-collector, kube-state-metrics, prometheus-node-exporter, alertmanager, perses (JWT/OIDC, Infisical-ready) - ArgoCD ApplicationSet (syncWave) + per-chart dip-values overlays - doc/victoria-metrics-architecture.md, define-chart-resources updates - includes pending working-tree changes (mlflow, kubeflow, apisix, CLAUDE.md) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
187 lines
4.5 KiB
YAML
187 lines
4.5 KiB
YAML
image:
|
|
repository: paasup/apisix
|
|
tag: "3.16.0-keycloak-authz"
|
|
pullPolicy: IfNotPresent
|
|
|
|
replicaCount: 1
|
|
|
|
resources:
|
|
limits:
|
|
cpu: "1000m"
|
|
memory: "1Gi"
|
|
requests:
|
|
cpu: "250m"
|
|
memory: "512Mi"
|
|
|
|
apisix:
|
|
enableIPv6: false # 기본값: true
|
|
|
|
# apisix.plugins 명시 시 기본 플러그인 목록을 완전히 대체한다. 전체 목록 유지 필수.
|
|
plugins:
|
|
- ai
|
|
- ai-aliyun-content-moderation
|
|
- ai-aws-content-moderation
|
|
- ai-prompt-decorator
|
|
- ai-prompt-guard
|
|
- ai-prompt-template
|
|
- ai-proxy
|
|
- ai-proxy-multi
|
|
- ai-rag
|
|
- ai-rate-limiting
|
|
- ai-request-rewrite
|
|
- api-breaker
|
|
- attach-consumer-label
|
|
- authz-casbin
|
|
- authz-casdoor
|
|
- authz-keycloak
|
|
- aws-lambda
|
|
- azure-functions
|
|
- basic-auth
|
|
- body-transformer
|
|
- cas-auth
|
|
- chaitin-waf
|
|
- clickhouse-logger
|
|
- client-control
|
|
- consumer-restriction
|
|
- cors
|
|
- csrf
|
|
- datadog
|
|
- degraphql
|
|
- echo
|
|
- elasticsearch-logger
|
|
- example-plugin
|
|
- ext-plugin-post-req
|
|
- ext-plugin-post-resp
|
|
- ext-plugin-pre-req
|
|
- fault-injection
|
|
- file-logger
|
|
- forward-auth
|
|
- google-cloud-logging
|
|
- grpc-transcode
|
|
- grpc-web
|
|
- gzip
|
|
- hmac-auth
|
|
- http-dubbo
|
|
- http-logger
|
|
- inspect
|
|
- ip-restriction
|
|
- jwe-decrypt
|
|
- jwt-auth
|
|
- kafka-logger
|
|
- kafka-proxy
|
|
- key-auth
|
|
- lago
|
|
- ldap-auth
|
|
- limit-conn
|
|
- limit-count
|
|
- limit-req
|
|
- loggly
|
|
- loki-logger
|
|
- mcp-bridge
|
|
- mocking
|
|
- multi-auth
|
|
- opa
|
|
- openfunction
|
|
- openid-connect
|
|
- openwhisk
|
|
- prometheus
|
|
- proxy-cache
|
|
- proxy-control
|
|
- proxy-mirror
|
|
- proxy-rewrite
|
|
- public-api
|
|
- real-ip
|
|
- redirect
|
|
- referer-restriction
|
|
- request-id
|
|
- request-validation
|
|
- response-rewrite
|
|
- rocketmq-logger
|
|
- serverless-post-function
|
|
- serverless-pre-function
|
|
- skywalking-logger
|
|
- sls-logger
|
|
- splunk-hec-logging
|
|
- syslog
|
|
- tcp-logger
|
|
- tencent-cloud-cls
|
|
- traffic-split
|
|
- ua-restriction
|
|
- udp-logger
|
|
- uri-blocker
|
|
- wolf-rbac
|
|
- workflow
|
|
- zipkin
|
|
- keycloak-authz # 커스텀 플러그인 — Kong 포팅
|
|
|
|
# Kong keycloak-authz 포팅: X-Access-Token JWT → preferred_username → 외부 API 권한 확인
|
|
customPlugins:
|
|
enabled: true
|
|
luaPath: "/opts/custom_plugins/?.lua"
|
|
plugins:
|
|
- name: keycloak-authz
|
|
attrs: {}
|
|
configMap:
|
|
name: keycloak-authz-plugin
|
|
mounts:
|
|
- key: keycloak-authz.lua
|
|
path: /opts/custom_plugins/apisix/plugins/keycloak-authz.lua
|
|
|
|
ssl:
|
|
enabled: true # 기본값: false
|
|
containerPort: 9443
|
|
|
|
admin:
|
|
# SECURITY: 기본 어드민 키 반드시 교체. 운영 배포 전 Secret 또는 Vault로 주입할 것.
|
|
# 키 생성: openssl rand -hex 16
|
|
credentials:
|
|
admin: "edd1c9f034335f136f87ad84b625c8f1" # 기본값 — 운영 전 변경 필수
|
|
|
|
service:
|
|
type: LoadBalancer # 기본값: NodePort — MetalLB에서 IP 자동 할당
|
|
http:
|
|
enabled: true
|
|
servicePort: 80
|
|
containerPort: 9080
|
|
tls:
|
|
servicePort: 443
|
|
stream:
|
|
enabled: true # 기본값: false — proxy_mode: http&stream 활성화 트리거
|
|
tcp: []
|
|
udp: []
|
|
|
|
# 내장 etcd는 개발/테스트 전용. 운영에서는 externalEtcd를 사용한다.
|
|
etcd:
|
|
enabled: true
|
|
replicaCount: 1 # 단일 노드 클러스터 — 운영 HA는 3 권장
|
|
persistence:
|
|
enabled: true
|
|
storageClass: longhorn
|
|
size: 4Gi
|
|
|
|
# 외부 etcd 사용 시 etcd.enabled=false로 설정하고 아래 값을 채운다.
|
|
# externalEtcd:
|
|
# host:
|
|
# - http://etcd-cluster.platform.svc.cluster.local:2379
|
|
# user: ""
|
|
# password: ""
|
|
|
|
ingress-controller:
|
|
enabled: true
|
|
ingressClass: apisix # Kong의 'kong' class와 분리
|
|
|
|
gatewayProxy:
|
|
createDefault: true # 기본값: false — v2.0.1+에서 미설정 시 라우트 등록 안 됨
|
|
publishService: apisix/apisix-gateway # Ingress STATUS에 External IP 반영
|
|
provider:
|
|
type: ControlPlane
|
|
controlPlane:
|
|
endpoints:
|
|
- http://apisix-admin.apisix.svc.cluster.local:9180
|
|
auth:
|
|
type: AdminKey
|
|
adminKey:
|
|
# SECURITY: admin.credentials.admin과 동일 키 — 운영 전 변경 필수
|
|
# 키 생성: openssl rand -hex 16
|
|
value: "edd1c9f034335f136f87ad84b625c8f1"
|