feat(infra): OCI NLB 전용 Ingress 및 Terraform 관리 편입

apps/prod/infrastructure/ingress-nginx-nlb.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ingress-nginx-nlb
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://kubernetes.github.io/ingress-nginx
+      chart: ingress-nginx
+      targetRevision: 4.10.1
+      helm:
+        releaseName: ingress-nginx-nlb
+        valueFiles:
+          - $values/infrastructure/base/ingress-nginx/nlb-values.yaml
+    - repoURL: https://github.com/Pseudo-Lab/DevFactory-Ops.git
+      targetRevision: main
+      ref: values
+      path: infrastructure/base/ingress-nginx/nlb
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ingress-nginx
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

infrastructure/base/ingress-nginx/nlb-values.yaml

@@ -0,0 +1,19 @@
+# Parallel transport endpoint for NLB migration; existing Ingress rules and
+# TLS Secrets are shared, but only the original controller updates status.
+controller:
+  electionID: ingress-nginx-nlb-leader
+  ingressClassResource:
+    enabled: false
+  publishService:
+    enabled: false
+  extraArgs:
+    update-status: "false"
+  admissionWebhooks:
+    enabled: false
+  service:
+    enabled: false
+  config:
+    use-proxy-protocol: "true"
+    proxy-real-ip-cidr: "10.0.0.184/32"
+    use-forwarded-headers: "false"
+    compute-full-forwarded-for: "false"

infrastructure/base/ingress-nginx/nlb/service.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ingress-nginx-nlb-validation
+  namespace: ingress-nginx
+  labels:
+    purpose: devday-nlb-validation
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: ingress-nginx-nlb
+    app.kubernetes.io/name: ingress-nginx
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      nodePort: 31080
+    - name: https
+      port: 443
+      targetPort: https
+      nodePort: 31443
+    - name: health
+      port: 10254
+      targetPort: 10254
+      nodePort: 31081

terraform/oci/nlb/backend.tf

@@ -0,0 +1,10 @@
+# Existing NLB/NSG state was migrated to this key on 2026-10-11.
+# Use this backend; do not apply with an empty or old local state.
+terraform {
+  backend "oci" {
+    bucket    = "terraform-state-prod"
+    key       = "nlb/terraform.tfstate"
+    region    = "ap-chuncheon-1"
+    namespace = "axnda59strvy"
+  }
+}

terraform/oci/nlb/main.tf

@@ -0,0 +1,110 @@
+terraform {
+  required_providers {
+    oci = {
+      source  = "oracle/oci"
+      version = "9.9.0"
+    }
+  }
+}
+
+provider "oci" {
+  region              = "ap-chuncheon-1"
+  config_file_profile = "DEFAULT"
+}
+
+resource "oci_network_load_balancer_network_load_balancer" "validation" {
+  compartment_id                 = "ocid1.compartment.oc1..aaaaaaaa5homz3zv47kbptbom4zuhieqwrb3xqujpze52bjo7ufabwuvrx4a"
+  display_name                   = "devfactory-nlb-validation-20261009"
+  subnet_id                      = "ocid1.subnet.oc1.ap-chuncheon-1.aaaaaaaazrjpegygezejzytqi2z6kd5reacfsrtn3klsvluleqr53kqhzrqa"
+  is_private                     = false
+  is_preserve_source_destination = false
+  freeform_tags = {
+    purpose = "devday-isolated-nlb-validation"
+  }
+}
+
+resource "oci_network_load_balancer_backend_set" "validation" {
+  for_each = {
+    http  = 31080
+    https = 31443
+  }
+  name                     = each.key
+  network_load_balancer_id = oci_network_load_balancer_network_load_balancer.validation.id
+  policy                   = "FIVE_TUPLE"
+  is_preserve_source       = false
+  is_fail_open             = false
+
+  health_checker {
+    protocol           = "HTTP"
+    port               = 31081
+    url_path           = "/healthz"
+    return_code        = 200
+    interval_in_millis = 10000
+    timeout_in_millis  = 3000
+    retries            = 3
+  }
+}
+
+resource "oci_network_load_balancer_backend" "validation" {
+  for_each                 = oci_network_load_balancer_backend_set.validation
+  network_load_balancer_id = oci_network_load_balancer_network_load_balancer.validation.id
+  backend_set_name         = each.value.name
+  ip_address               = "10.0.0.158"
+  port                     = each.key == "http" ? 31080 : 31443
+  weight                   = 1
+}
+
+resource "oci_network_load_balancer_listener" "validation" {
+  for_each = {
+    http  = 80
+    https = 443
+  }
+  name                     = each.key
+  network_load_balancer_id = oci_network_load_balancer_network_load_balancer.validation.id
+  default_backend_set_name = oci_network_load_balancer_backend_set.validation[each.key].name
+  port                     = each.value
+  protocol                 = "TCP"
+  tcp_idle_timeout         = 360
+  is_ppv2enabled           = true
+}
+
+output "nlb_id" {
+  value = oci_network_load_balancer_network_load_balancer.validation.id
+}
+
+output "nlb_addresses" {
+  value = oci_network_load_balancer_network_load_balancer.validation.ip_addresses
+}
+
+# Existing VM attachment is recorded separately; preserve it during state migration.
+# Only the NLB private IP may reach the data and health NodePorts.
+resource "oci_core_network_security_group" "validation" {
+  compartment_id = "ocid1.compartment.oc1..aaaaaaaa5homz3zv47kbptbom4zuhieqwrb3xqujpze52bjo7ufabwuvrx4a"
+  vcn_id         = "ocid1.vcn.oc1.ap-chuncheon-1.amaaaaaa7rlw6kaam6u523nqzl4l4urgflqnccy4hemezdeshfyn5zfggbla"
+  display_name   = "devday-nlb-validation-nodeports-20261009"
+}
+
+resource "oci_core_network_security_group_security_rule" "validation" {
+  for_each = {
+    health_http  = { source = "10.0.0.184/32", port = 31080 }
+    health_https = { source = "10.0.0.184/32", port = 31443 }
+    health_check = { source = "10.0.0.184/32", port = 31081 }
+  }
+  network_security_group_id = oci_core_network_security_group.validation.id
+  direction                 = "INGRESS"
+  protocol                  = "6"
+  source_type               = "CIDR_BLOCK"
+  source                    = each.value.source
+  stateless                 = false
+  description               = "Isolated NLB validation: ${each.key}"
+  tcp_options {
+    destination_port_range {
+      min = each.value.port
+      max = each.value.port
+    }
+  }
+}
+
+output "validation_nsg_id" {
+  value = oci_core_network_security_group.validation.id
+}

terraform/oci/prod/compute.tf

@@ -18,6 +18,8 @@ resource "oci_core_instance" "prod_instance" {
     subnet_id      = oci_core_subnet.prod_subnet.id
     display_name   = "soo-server"
     hostname_label = "soo-server"
+    # Existing NLB backend NSG, managed by terraform/oci/nlb in a separate state.
+    nsg_ids = ["ocid1.networksecuritygroup.oc1.ap-chuncheon-1.aaaaaaaa3sgqirpzvsdhfb34goda4ajf6wgqheyxpe5jx6suh7laxedgvnla"]
   }
 
   metadata = {