seon
1db68b643f
WP-14(Terraform 설계서 7.3, 실험·앱 설계서 3.1·4.3). - apps/ingress-nginx: baremetal 매니페스트(controller-v1.15.1)를 kustomize로 가져와 NodePort 30080/30443 고정(ALB TG와 일치). - apps/demo-app + workloads/demo-app: front(nginx-unprivileged 1.31.6, 정적 페이지 + /api/ 프록시) 2, api(demo-api:8f5378b) 3 + PDB minAvailable 2, Service, Ingress(/ front, /api api). DB_DSN은 Secret demo-db(make k8s-secrets로 생성, git 밖). - apps/chaos-mesh: Helm chart 2.8.4(containerd 소켓, dashboard 없음). - vm/observability/grafana/provisioning/alerting: contact point harness-webhook (10.20.0.11:8080/hooks/alert), 루트 정책, 규칙 8건(ProbeDown·ApiLatencyHigh· ApiErrorRateHigh·PodCrashLooping·LegacyUnhealthy·DbReplicationLag·DbPrimaryDown· GitOpsDrift, 라벨 layer/signature).
selfheal-lab-gitops
GitOps and configuration repository for the self-healing verification lab
(VM + container mixed environment). Infrastructure lives in
seon-labs/selfheal-lab-terraform; this repository holds everything that runs
on top of it.
This repository is public on purpose: every EC2 node and GCE VM clones it anonymously at first boot (cloud-init / startup script), and MIG instances are recreated by autohealing without an operator. Never commit secrets here; values live in GCP Secret Manager and are fetched at runtime.
| Path | Owner | Filled in |
|---|---|---|
bootstrap/kubeadm/ |
operator, run once | WP-07: containerd/kubeadm init+join, flannel, Argo CD install, root-app |
argocd/root-app.yaml |
Argo CD app-of-apps root | WP-07 |
apps/ |
child Argo CD Applications | WP-14 |
workloads/{demo-app,ingress-nginx,chaos-mesh,alloy}/ |
Argo CD | WP-14, WP-15 |
vm/<role>/apply.sh |
GCE startup script and make vm-sync |
WP-08..12 |
vm/<role> matches the role metadata each VM gets from Terraform:
observability, harness, ai-env, postgres-primary, postgres-replica,
legacy-api. The startup script runs vm/<role>/apply.sh when it exists and is
executable; apply.sh must be idempotent because make vm-sync re-runs it.