Spring Cloud Kubernetes — 쿠버네티스 네이티브 서비스 디스커버리와 설정 관리

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-kubernetes-client-all</artifactId>
</dependency>

@Service
@RequiredArgsConstructor
public class ServiceRegistry {

    private final DiscoveryClient discoveryClient;

    public List<String> getAllServices() {
        // K8s Service 목록을 그대로 반환
        return discoveryClient.getServices();
    }

    public List<ServiceInstance> getInstances(String serviceId) {
        // 특정 서비스의 Pod 인스턴스 목록
        return discoveryClient.getInstances(serviceId);
    }
}

spring:
  cloud:
    kubernetes:
      discovery:
        enabled: true
        all-namespaces: false  # true면 모든 네임스페이스 검색
        namespaces:            # 특정 네임스페이스만 검색
          - production
          - staging
        service-labels:        # 라벨 기반 필터링
          environment: production
          team: backend

# K8s RBAC 설정
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: service-discovery-role
rules:
  - apiGroups: [""]
    resources: ["services", "endpoints", "pods"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["configmaps", "secrets"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: service-discovery-binding
subjects:
  - kind: ServiceAccount
    name: my-app-sa
    namespace: default
roleRef:
  kind: ClusterRole
  name: service-discovery-role
  apiGroup: rbac.authorization.k8s.io

# K8s ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: order-service  # 애플리케이션 이름과 일치시키기
  namespace: default
data:
  application.yml: |
    order:
      max-items: 50
      timeout-seconds: 30
    feature:
      new-payment: true

@Component
@ConfigurationProperties(prefix = "order")
@Getter @Setter
public class OrderProperties {
    private int maxItems;
    private int timeoutSeconds;
}

spring:
  cloud:
    kubernetes:
      config:
        enabled: true
        sources:
          - name: order-service-config
            namespace: default
          - name: shared-config  # 공통 설정 ConfigMap
            namespace: common

# K8s Secret
apiVersion: v1
kind: Secret
metadata:
  name: order-service-secrets
type: Opaque
data:
  db-password: cGFzc3dvcmQxMjM=  # base64 인코딩

spring:
  cloud:
    kubernetes:
      secrets:
        enabled: true
        sources:
          - name: order-service-secrets

@Value("${db-password}")
private String dbPassword;  // 자동으로 base64 디코딩

spring:
  cloud:
    kubernetes:
      config:
        enabled: true
      reload:
        enabled: true
        mode: polling       # polling 또는 event
        period: 15000       # polling 주기 (ms)
        strategy: refresh   # refresh 또는 restart_context

@RefreshScope
@Component
@ConfigurationProperties(prefix = "feature")
@Getter @Setter
public class FeatureFlags {
    private boolean newPayment;
}

spring:
  cloud:
    kubernetes:
      discovery:
        # 특정 네임스페이스만
        namespaces:
          - production
        # 라벨 조건 추가
        service-labels:
          app.kubernetes.io/part-of: order-system
        # 특정 서비스 포함/제외
        filter:
          includes:
            - payment-service
            - inventory-service

[Discovery Server]  ← K8s API 접근 권한 (유일)
       ↑
   HTTP 엔드포인트
       ↑
[Pod A] [Pod B] [Pod C]  ← K8s API 권한 불필요

<!-- Discovery Server 의존성 -->
<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-kubernetes-discoverserver</artifactId>
</dependency>

# 클라이언트 Pod에서 Discovery Server를 사용
spring:
  cloud:
    kubernetes:
      discovery:
        discovery-server-url: http://discovery-server.default.svc:8761

# 네이티브 이미지 빌드
mvn -Pnative spring-boot:build-image

# Istio 환경에서 디스커버리만 비활성화
spring:
  cloud:
    kubernetes:
      discovery:
        enabled: false  # Istio가 처리
      config:
        enabled: true   # ConfigMap 연동은 유지