풀스택 개발자를 위한 CI/CD 12강 — GitOps와 Kubernetes 배포

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  labels: { app: web }
spec:
  replicas: 3
  selector:
    matchLabels: { app: web }
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1           # 교체 중 최대 1개 추가 생성
      maxUnavailable: 0     # 교체 중 가용 파드가 줄지 않게
  template:
    metadata:
      labels: { app: web }
    spec:
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
      containers:
        - name: web
          image: harbor.internal/s-app/web@sha256:<digest>
          ports:
            - containerPort: 3000
          envFrom:
            - configMapRef: { name: web-config }
            - secretRef: { name: web-secrets }
          readinessProbe:
            httpGet: { path: /api/health, port: 3000 }
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /api/health, port: 3000 }
            initialDelaySeconds: 15
            periodSeconds: 10
          resources:
            requests: { cpu: 100m, memory: 256Mi }
            limits: { memory: 512Mi }
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}

- run: kubectl set image deployment/web web=harbor.internal/s-app/web@${DIGEST}
- run: kubectl rollout status deployment/web --timeout=5m

개발자 ──PR──▶ [설정 저장소 (Git)] ◀──주기적 확인── [Argo CD (클러스터 내부)]
                                                         │
                                                         ▼ 동기화
                                                   [Kubernetes 리소스]

app 저장소 (my-app)               설정 저장소 (my-app-config)
├── src/                          └── apps/web/
├── Dockerfile                        ├── base/
└── .github/workflows/                │   ├── deployment.yaml
    └── ci.yml                        │   ├── service.yaml
                                      │   └── kustomization.yaml
                                      └── overlays/
                                          ├── staging/
                                          │   └── kustomization.yaml
                                          └── production/
                                              └── kustomization.yaml

# apps/web/base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - deployment.yaml
  - service.yaml

# apps/web/overlays/production/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: web-prod
resources:
  - ../../base
images:
  - name: harbor.internal/s-app/web
    digest: sha256:<운영 digest>
replicas:
  - name: web
    count: 3

  update-staging:
    needs: image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          repository: my-org/my-app-config
          token: ${{ secrets.CONFIG_REPO_TOKEN }}
 
      - name: 스테이징 이미지 갱신
        env:
          DIGEST: ${{ needs.image.outputs.digest }}
        run: |
          cd apps/web/overlays/staging
          kustomize edit set image "harbor.internal/s-app/web@${DIGEST}"
 
      - name: 커밋 & push
        env:
          SHA: ${{ github.sha }}
        run: |
          git config user.name "ci-bot"
          git config user.email "ci-bot@users.noreply.github.com"
          git commit -am "web(staging): ${SHA::7}"
          git push

스테이징: CI가 직접 커밋 → Argo CD 자동 동기화
운영:     CI가 PR 생성 → 리뷰·승인 → 머지 → Argo CD 동기화

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: web-production
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://git.internal/my-org/my-app-config.git
    targetRevision: main
    path: apps/web/overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: web-prod
  syncPolicy:
    automated:
      prune: true        # Git에서 지운 리소스는 클러스터에서도 삭제
      selfHeal: true     # 클러스터에서 직접 바꾼 내용은 Git 상태로 복구
    syncOptions:
      - CreateNamespace=true

apiVersion: batch/v1
kind: Job
metadata:
  name: web-migrate
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
  backoffLimit: 0
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: migrate
          image: harbor.internal/s-app/web@sha256:<digest>   # 앱과 같은 이미지
          command: ["npx", "prisma", "migrate", "deploy"]
          envFrom:
            - secretRef: { name: web-secrets }

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: web
spec:
  replicas: 5
  strategy:
    canary:
      steps:
        - setWeight: 10
        - pause: { duration: 5m }
        - analysis:
            templates:
              - templateName: error-rate     # Prometheus 오류율 조회
        - setWeight: 50
        - pause: { duration: 10m }
        - setWeight: 100
  # selector, template은 Deployment와 동일