harbor 설치

export ENV=dev
helm repo add harbor https://helm.goharbor.io
helm install eden-harbor harbor/harbor  --namespace harbor  --create-namespace -f values-${ENV}.yaml

expose:
  type: nodePort
  tls:
    enabled: false

# external-ip 는  get nodes -o wide
externalURL: http://198.19.249.2:30011

harborAdminPassword: "1234"

persistence:
  persistentVolumeClaim:
    registry:
      size: 5Gi
    jobservice:
      size: 1Gi
    database:
      size: 1Gi
    redis:
      size: 1Gi
    trivy:
      size: 1Gi

jenkins 설치

helm repo add jenkinsci https://charts.jenkins.io/
helm install eden-jenkins jenkinsci/jenkins --version 5.8.43 --namespace jenkins --create-namespace -f values-${ENV}.yaml

controller:
  admin:
    username: admin
    password: "1234"

  resources:
    requests:
      cpu: "100m"
      memory: "256Mi"
    limits:
      cpu: "500m"
      memory: "512Mi"

  replicaCount: 1

  serviceType: NodePort
  servicePort: 8080
  nodePort: 30012

  persistence:
    enabled: true
    size: 2Gi
    storageClass: "local-path"

  installPlugins: []

  securityRealm: "jenkins.security.HudsonPrivateSecurityRealm"
  authorizationStrategy: "jenkins.security.FullControlOnceLoggedInAuthorizationStrategy"

  javaOpts: "-Djenkins.install.runSetupWizard=false"

argoCD

k create ns argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

kubectl patch svc argocd-server -n argocd \
  -p '{"spec": {"type": "NodePort", "ports": [{"port": 443, "targetPort": 8080, "protocol": "TCP", "nodePort": 30013}]}}'

kubectl get secret argocd-initial-admin-secret -n argocd \
  -o jsonpath="{.data.password}" | base64 -d && echo

1. GitHub에서 토큰 만들기
GitHub 접속 → 우측 상단 프로필 > Settings

좌측 메뉴에서 Developer settings → Personal access tokens → Fine-grained tokens 또는 Classic tokens

Generate new token

권한:

repo (private이라면)

또는 read-only로 충분

유효기간: 30일 또는 무제한 선택

🔑 복사된 토큰은 한 번만 보여지니 꼭 메모!

2. Jenkins에 자격 증명 추가
Jenkins → Manage Jenkins → Credentials → (global) 클릭

"Add Credentials" 클릭

항목	값
Kind	Username with password
Username	GitHub 아이디
Password	위에서 복사한 Token
ID (중요)	예: github-creds
Description	GitHub Personal Access Token 등

github 토큰 생성시 contentsㄹ랑 metadata 올려야된

sso : github oauth

작업 프로세스 요약

1. 개발자 Git Push
   ↓
2. Jenkins (CI)
   • 코드 Checkout
   • 테스트 실행
   • Docker Build
   • Harbor Push
   • GitOps repo에 manifest 자동 commit
     ↓
3. Argo CD (CD)
   • Git 변경 감지
   • Kubernetes 자동 배포
     ↓
4. K8s 클러스터에 파드 배포

✅ GitHub OAuth로 Jenkins, Argo CD, Harbor, Grafana 통합 로그인 구성

---

🔐 공통 준비: GitHub OAuth App 생성

1. 접속: https://github.com/settings/developers → OAuth Apps → New OAuth App
2. 입력 값 (각 서비스마다 다름)

예: Argo CD용

• App name: argocd
• Homepage URL: https://argocd.example.com
• Authorization callback URL: https://argocd.example.com/auth/callback

OAuth App을 4개 각각 생성하거나, redirect URI만 다르게 등록해서 한 개로 다 써도 됨.

---

✅ 1. Jenkins + GitHub OAuth

🔧 플러그인 설치

• Jenkins → Manage Plugins → GitHub Authentication plugin 설치

🔧 설정 경로

• Jenkins → Manage Jenkins → Configure Global Security
• Security Realm → GitHub Authentication 선택

입력 정보:

• Client ID / Secret: GitHub OAuth App에서 발급
• GitHub Web URI: https://github.com
• GitHub API URI: https://api.github.com
• OAuth Scopes: read:org (조직 제한 가능)
• Optional: Only allow members of "MadungAI"

---

✅ 2. Argo CD + GitHub OAuth (Dex)

🔧 argocd-cm ConfigMap 수정

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  dex.config: |
    connectors:
      - type: github
        id: github
        name: GitHub
        config:
          clientID: YOUR_CLIENT_ID
          clientSecret: YOUR_CLIENT_SECRET
          orgs:
            - name: MadungAI

kubectl apply -f argocd-cm.yaml
kubectl rollout restart deployment argocd-server -n argocd

---

✅ 3. Harbor + GitHub OAuth

Harbor는 GitHub OAuth를 OIDC로 간접 연동 (Keycloak or Auth0 중계 사용)해야 했지만, 최근 버전은 직접 OIDC 연동 가능

🔧 Admin → Configuration → Authentication → OIDC 설정

• OIDC Provider Name: GitHub
• OIDC Endpoint: https://github.com
• Client ID: GitHub OAuth App Client ID
• Client Secret: GitHub OAuth App Secret
• Scope: openid profile email
• Redirect URI: https://harbor.example.com/c/oidc/callback
• Verify Certificate: Optional

필요 시 /etc/harbor/harbor.yml 내 auth 설정 변경 후 재시작

---

✅ 4. Grafana + GitHub OAuth

🔧 grafana.ini 설정

[auth.github]
enabled = true
allow_sign_up = true
client_id = YOUR_CLIENT_ID
client_secret = YOUR_CLIENT_SECRET
scopes = user:email,read:org
auth_url = https://github.com/login/oauth/authorize
token_url = https://github.com/login/oauth/access_token
api_url = https://api.github.com/user
allowed_organizations = MadungAI

또는 Docker 환경변수로:

GF_AUTH_GITHUB_ENABLED=true
GF_AUTH_GITHUB_CLIENT_ID=YOUR_CLIENT_ID
GF_AUTH_GITHUB_CLIENT_SECRET=YOUR_CLIENT_SECRET
GF_AUTH_GITHUB_ALLOWED_ORGANIZATIONS=MadungAI

---

✅ 마무리 체크리스트

• GitHub OAuth App 각각 등록됨
• 각 서비스에 Client ID/Secret 반영됨
• 조직 제한 (allowed_organizations: MadungAI) 설정 완료
• 개발자는 한 번 로그인으로 4개 도구 접근 가능

---

grafana:
grafana.ini:
server:
root_url: "%(protocol)s://%(domain)s/grafana/"
serve_from_sub_path: true

104 apt update
105 curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/$distribution/x86_64/3bf863cc.pub | sudo gpg --dearmor -o /usr/share/keyrings/nvidia.gpg
106 curl -fsSL https://developer.download.nvidia.com/compute/cuda/repos/$distribution/x86_64/3bf863cc.pub | gpg --dearmor -o /usr/share/keyrings/nvidia.gpg
107 echo "deb [signed-by=/usr/share/keyrings/nvidia.gpg] https://developer.download.nvidia.com/compute/cuda/repos/$distribution/x86_64 /" | tee /etc/apt/sources.list.d/nvidia-cuda.list
108 apt update
109 apt install nvidia-mig-manager
110 apt install nvidia-mig-manager
111 ls -l /proc/driver/nvidia/capabilities/*
112 nvidia-smi mig -lgipp
113 sudo nvidia-smi mig -cgi 0 -C
114 nvidia-smi mig -cgi 0 -C
115 nvidia-smi
116 nvidia-smi mig -dci --gpu-instance-id=0
117 nvidia-smi mig -dgi --id=0
118 nvidia-smi mig -cgi 14 -C -i 0
119 nvidia-smi mig -cgi 9 -C -i 0
120 nvidia-smi mig -cgi 5 -C -i 0
121 nvidia-smi
122 nvidia-smi -L
123 history