[Feat/#27] ES 구축하기

.env.example

@@ -8,6 +8,15 @@ REDIS_HOST=
 REDIS_PORT=6379
 REDIS_PASSWORD=
 
+ES_HOST=
+ES_PORT=9200
+SEARCH_ENABLED=true
+SEARCH_SYNC_FIXED_DELAY_MS=300000
+SEARCH_SYNC_BATCH_SIZE=500
+
+# 최초 전체 색인을 실행할 배포에서만 true로 설정한 뒤 다시 false로 돌린다.
+SEARCH_INITIAL_INDEX_ENABLED=false
+
 SERVER_URL=
 
 JWT_SECRET=
@@ -26,4 +35,4 @@ DDL_AUTO_SET=update
 MYSQL_ROOT_PASSWORD=
 MYSQL_DATABASE=
 MYSQL_USER=
-MYSQL_PASSWORD=
+MYSQL_PASSWORD=

.github/workflows/cd.yml

@@ -15,6 +15,8 @@ permissions:
 
 env:
   IMAGE_NAME: mingkiboo/amumal-amon
+  ES_IMAGE_NAME: mingkiboo/amumal-es-nori
+  ES_VERSION: 9.4.2
 
 ## Docker blue/green
 #jobs:
@@ -131,6 +133,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: docker/elasticsearch 변경 감지
+        uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            es:
+              - 'docker/elasticsearch/**'
       - name: Docker Hub 로그인
         uses: docker/login-action@v3
         with:
@@ -140,6 +151,16 @@ jobs:
         run: |
           docker build -t ${{ env.IMAGE_NAME }}:${{ github.sha }} .
           docker push ${{ env.IMAGE_NAME }}:${{ github.sha }}
+      # docker/elasticsearch 경로가 바뀔 때만 빌드/push (ES_VERSION 태그 고정이라 매번 돌리면 낭비)
+      - name: Nori Elasticsearch 이미지 빌드 & push
+        if: steps.filter.outputs.es == 'true'
+        run: |
+          docker build \
+            --build-arg ES_VERSION=${{ env.ES_VERSION }} \
+            -f docker/elasticsearch/Dockerfile \
+            -t ${{ env.ES_IMAGE_NAME }}:${{ env.ES_VERSION }} \
+            .
+          docker push ${{ env.ES_IMAGE_NAME }}:${{ env.ES_VERSION }}
 
   update-manifest:
     needs: build-push
@@ -157,4 +178,4 @@ jobs:
           git config user.email "actions@github.com"
           git add argocd/amumal-backend/values.yaml
           git commit -m "chore: bump image ${{ github.sha }} [skip ci]" || echo "변경 없음"
-          git push
+          git push

.github/workflows/ci-merge.yml

@@ -33,6 +33,8 @@ jobs:
       SERVER_URL: http://localhost
       REDIS_HOST: 127.0.0.1
       REDIS_PORT: 6379
+      ES_HOST: 127.0.0.1
+      ES_PORT: 9200
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-java@v4

.gitignore

@@ -44,6 +44,8 @@ tmp/
 *.seed
 *.tmp
 argocd/monitoring-chart/charts/
+argocd/elasticsearch-chart/charts/
+argocd/eck-operator-chart/charts/
 
 # Secrets and certificates
 *.pem

argocd/amumal-backend/templates/deployment.yaml

@@ -44,6 +44,13 @@ spec:
           envFrom:
             - secretRef:
                 name: {{ .Values.envSecret }}
+          env:
+            # ES가 다른 네임스페이스(es-ns)에 있어 FQDN으로 접근한다.
+            # X-Pack 보안을 꺼둔 내부 통신이라 인증 정보는 필요 없다 (argocd/elasticsearch-chart/values.yaml 참고).
+            - name: ES_HOST
+              value: amumal-search-es-http.es-ns.svc.cluster.local
+            - name: ES_PORT
+              value: "9200"
           lifecycle:
             preStop:
               exec:

argocd/argocd-apps/app-eck-operator.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: eck-operator
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/kbt-practice/KBT.git
+    targetRevision: main
+    path: argocd/eck-operator-chart
+    helm:
+      releaseName: eck-operator
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: elastic-system
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    automated:
+      # ECK CRD 삭제는 클러스터의 모든 Elastic 리소스를 제거할 수 있어 prune하지 않는다.
+      prune: false
+      selfHeal: true

argocd/argocd-apps/app-edge.yaml

@@ -3,8 +3,6 @@ kind: Application
 metadata:
   name: amumal-edge
   namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
 spec:
   project: default
   source:

argocd/argocd-apps/app-elasticsearch.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: amumal-elasticsearch
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/kbt-practice/KBT.git
+    targetRevision: main
+    path: argocd/elasticsearch-chart
+    helm:
+      releaseName: amumal-search
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: es-ns
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=false
+      - SkipDryRunOnMissingResource=true
+      - ServerSideApply=true
+    automated:
+      # PVC를 보호하기 위해 Elasticsearch CR은 자동 prune하지 않는다.
+      prune: false
+      selfHeal: true

argocd/argocd-apps/app-monitoring.yaml

@@ -3,8 +3,6 @@ kind: Application
 metadata:
   name: amumal-monitoring
   namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
 spec:
   project: default
   source:

argocd/argocd-apps/app-namespaces.yaml

@@ -3,8 +3,6 @@ kind: Application
 metadata:
   name: amumal-namespaces
   namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "-2"
 spec:
   project: default
   source:

argocd/argocd-apps/app-portainer.yaml

@@ -3,8 +3,6 @@ kind: Application
 metadata:
   name: amumal-portainer
   namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
 spec:
   project: default
   source:

argocd/eck-operator-chart/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: eck-operator
+  repository: https://helm.elastic.co
+  version: 3.5.0
+digest: sha256:cc2e67cd04e4f5a6be392d16045b4cadae310f73ba3e4d725e2d6d3b717dbb10
+generated: "2026-08-06T14:06:47.329141+09:00"

argocd/eck-operator-chart/Chart.yaml

@@ -0,0 +1,10 @@
+apiVersion: v2
+name: amumal-eck-operator
+description: ECK (Elastic Cloud on Kubernetes) operator
+type: application
+version: 0.1.0
+appVersion: "3.5.0"
+dependencies:
+  - name: eck-operator
+    version: 3.5.0
+    repository: https://helm.elastic.co

argocd/eck-operator-chart/values.yaml

@@ -0,0 +1,18 @@
+# =====================================================================
+# eck-operator 3.5.0
+# =====================================================================
+eck-operator:
+  installCRDs: true
+  replicaCount: 1
+  managedNamespaces:
+    - es-ns
+  resources:
+    requests:
+      cpu: 100m
+      memory: 150Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+  config:
+    metrics:
+      port: "0"

argocd/elasticsearch-chart/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: eck-elasticsearch
+  repository: https://helm.elastic.co
+  version: 0.20.0
+digest: sha256:f34833df7de4ff85e626d071d02c220c27e2af75be594d4851ae05f4f2d1b63a
+generated: "2026-08-06T13:33:45.95534+09:00"

argocd/elasticsearch-chart/Chart.yaml

@@ -0,0 +1,10 @@
+apiVersion: v2
+name: amumal-elasticsearch
+description: Elasticsearch (ECK) for Amumal search
+type: application
+version: 0.1.0
+appVersion: "9.4.2"
+dependencies:
+  - name: eck-elasticsearch
+    version: 0.20.0
+    repository: https://helm.elastic.co

argocd/elasticsearch-chart/values.yaml

@@ -0,0 +1,57 @@
+# =====================================================================
+# eck-elasticsearch 0.20.0
+#  - backend(backend-ns)와 다른 네임스페이스(es-ns)에 있어 ECK가 만드는 elastic 유저 Secret을 backend가 못 참조한다.
+#    클러스터 내부 통신만 쓰는 전제로 X-Pack 보안(인증/TLS)을 아예 비활성화해 이 문제를 피한다.
+# =====================================================================
+eck-elasticsearch:
+  fullnameOverride: amumal-search
+  version: 9.4.2
+  image: mingkiboo/amumal-es-nori:9.4.2
+
+  http:
+    service:
+      spec:
+        type: ClusterIP
+
+  volumeClaimDeletePolicy: DeleteOnScaledownOnly
+
+  nodeSets:
+    - name: default
+      count: 1
+      config:
+        node.store.allow_mmap: false
+        xpack.security.enabled: false
+        xpack.security.http.ssl.enabled: false
+        xpack.security.transport.ssl.enabled: false
+      podTemplate:
+        spec:
+          # regcred는 backend-ns에 있는 Secret이라 여기서 못 쓴다 (Secret은 네임스페이스 간 참조 불가).
+          # es-ns에 동일한 이름으로 별도 생성해서 쓴다 (kubectl로 수동 생성, git에는 안 커밋).
+          imagePullSecrets:
+            - name: regcred
+          # 컨테이너 레벨(allowPrivilegeEscalation/capabilities/readOnlyRootFilesystem)은
+          # ES 8.8+부터 ECK가 기본으로 넣어줘서 여기선 ECK가 안 채워주는 pod 레벨만 명시한다.
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            fsGroup: 1000
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: elasticsearch
+              resources:
+                requests:
+                  cpu: 500m
+                  memory: 2Gi
+                limits:
+                  cpu: "2"
+                  memory: 2Gi
+      volumeClaimTemplates:
+        - metadata:
+            name: elasticsearch-data
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 20Gi

argocd/namespaces-chart/values.yaml

@@ -6,6 +6,7 @@
 namespaces:
   - name: backend-ns
     quota:
+      # Backend 2개 + rolling surge 1개
       pods: "3"
       requests.cpu: "300m"
       requests.memory: 1536Mi
@@ -15,6 +16,19 @@ namespaces:
       defaultRequest: { cpu: 100m, memory: 512Mi }
       default:        { cpu: 1000m, memory: 1280Mi }
 
+  - name: es-ns
+    quota:
+      # Elasticsearch 1개 + 운영 여유 1개
+      pods: "2"
+      requests.cpu: "500m"
+      requests.memory: 2Gi
+      limits.cpu: "2"
+      limits.memory: 2Gi
+    limitRange:
+      defaultRequest: { cpu: 200m, memory: 512Mi }
+      default:        { cpu: 1000m, memory: 2Gi }
+
+  # Ingress
   - name: edge-ns
     quota:
       pods: "4"

build.gradle

@@ -47,6 +47,9 @@ dependencies {
 	// Redis
 	implementation 'org.springframework.boot:spring-boot-starter-data-redis'
 
+	// Elasticsearch
+	implementation 'org.springframework.boot:spring-boot-starter-data-elasticsearch'
+
 	// QueryDSL
 	implementation 'com.querydsl:querydsl-jpa:5.0.0:jakarta'
 	annotationProcessor "com.querydsl:querydsl-apt:5.0.0:jakarta"