Config

환경(dev, stage, product) 마다 달라질 수 있는 모든 것들

ex 1 ) DB, Cache, Queue 등의 리소스 정보

ex 2) AWS 등의 외부 서비스 인증 정보

ex 3) Canonical Name

Management

  1. Code 와 Config를 함께 관리하는 경우

    1. raw string

      aws:
  datasource:
    read:
      url: jdbc:mariadb://localhost:3306/cms
      username: root
      password: 1234

    2. KMS Encryption ( + Base64 )

      aws:
  datasource:
    read:
      url: AQICAHgUlbhbxpXionvxPoJJgyYMQHBa2i6Xc9bckpiy3ppp5AE134d2yJ7ojtKvrTfWx/FlAAAAfzB9BgkqhkiG9w0BBwagcDBuAgEAMGkGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM6xd/KnXqeqmYbwhjAgEQgDz+Vjk19lklU6t5T22t8AirkrxNeVSo2i94kHSYRqQJpxQdzbss3JPfbMRNMcvlVDb99xG2Dch2gaYfUlU=
      username: AQICAHgUlbhbxpXionvxPoJJgyYMQHBa2i6Xc9bckpiy3ppp5AFkJ4TL30VYS5K4zn1Y4mlOAAAAYTBfBgkqhkiG9w0BBwagUjBQAgEAMEsGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMgVGXYOlc/EFqyxU+AgEQgB6lBNcFTDKsKaVtB+3HvODI/uPc7P1QzvjCAwSRx1I=
      password: AQICAHgUlbhbxpXionvxPoJJgyYMQHBa2i6Xc9bckpiy3ppp5AEZuyzrVxwDzgFzmuctZaQ7AAAAYTBfBgkqhkiG9w0BBwagUjBQAgEAMEsGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMxhW8KbI9HmENmLrmAgEQgB4QgmB6cK5dVPr2xVVXjHr9SujbNK3MFYGOl3plqAk=

  2. Config 일부 주요 정보를 별도로 보관 ( 대체로 Environment Variable 활용 )

    1. Vault

    2. Docker Swarm

    3. Kubernetes ConfigMap

    4. Github Action Secrets

      스크린샷 2024-02-14 오후 3.17.51.png

    5. AWS - Parameter Store (Free) / Secrets Manager ex) Github Action + Secrets Manager Github action yaml

      - name: Get secrets by name and by ARN
  uses: aws-actions/aws-secretsmanager-get-secrets@v1
  with:
    secret-ids: |
      exampleSecretName
      arn:aws:secretsmanager:us-east-2:123456789012:secret:test1-a1b2c3
      0/test/secret
      /prod/example/secret
      SECRET_ALIAS_1,test/secret
      SECRET_ALIAS_2,arn:aws:secretsmanager:us-east-2:123456789012:secret:test2-a1b2c3

      Generated Environment Variables

      EXAMPLESECRETNAME:secretValue1
TEST1:secretValue2
_0_TEST_SECRET:secretValue3
_PROD_EXAMPLE_SECRET:secretValue4
SECRET_ALIAS_1:secretValue5
SECRET_ALIAS_2:secretValue6

      cf) Spring 에서 환경변수에 접근하는 방법 ( application.yml )

      aws:
  datasource:
    read:
      url: ${db_url}
			username: ${db_username}
      password: ${db_password}

  3. Code와 Config를 분리하여 보관

    1. 고려사항

      1. Config Server 사용시 Service Discovery ( Server Provisioning )를 고려
      2. Dynamic Configuration 필요시 Event Driven Architecture를 고려

    2. Case

      1. AWS Secrets Manager( json, yaml 형태로 저장 )
      2. Config Server

      SpringCloudConfig.drawio.png