Nullus를 로컬에서 처음부터 끝까지

brew install go node kind kubectl helm jq libpq
brew install --cask orbstack      # 또는 Docker Desktop

git clone https://github.com/cloud-nullus/nullus.git
cd nullus

# 설치되는 도구가 쓸 Keycloak 주소를 정해 둔다 — up 보다 앞서야 한다
export NULLUS_LOCAL_DOMAIN=nullus.local

./scripts/runbook_local.sh preflight
./scripts/runbook_local.sh up --kind
./scripts/setup-local-domain.sh --apply-hosts   # CoreDNS 와 호스트 /etc/hosts 둘 다에 keycloak.<도메인> 을 넣는다 (sudo)
./scripts/runbook_local.sh status
./scripts/runbook_local.sh smoke

cat > ~/.nullus-e2e.env <<'EOF'
export API=http://localhost:8090
export CTX=kind-nullus-platform
export NS=nullus-gitlab-argocd-sonarqube # 스택 이름이자 네임스페이스 (stack-up 기본값)
export DOMAIN=nullus.local
export NULLUS_LOCAL_DOMAIN=nullus.local # 런북·설치기가 읽는다. 빠지면 issuer 가 localhost 로 되돌아간다
export ORG=11111111-1111-1111-1111-111111111111
export APP=demo-api                     # 8단계에서 만들 앱
export APP_NS=demo                      # 앱이 배포될 네임스페이스
EOF
source ~/.nullus-e2e.env

curl -s $API/api/v1/admin/clusters | jq '.items[] | {name, types}'

./scripts/runbook_local.sh stack-up --template=gitlab-argocd-sonarqube-v1 --wait
STACK_ID=$(curl -s $API/api/v1/stacks | jq -r --arg n "$NS" '.items[] | select(.name==$n) | .id' | head -1)
echo "export STACK_ID=$STACK_ID" >> ~/.nullus-e2e.env      # 출력의 "stack created: stk_..." 와 같아야 한다

source ~/.nullus-e2e.env
kubectl --context $CTX -n $NS get pods -w

./scripts/port-forward-gateway.sh
./scripts/port-forward-gateway.sh --hosts          # /etc/hosts 에 넣을 줄을 보여 준다
./scripts/port-forward-gateway.sh --hosts | sudo tee -a /etc/hosts

./scripts/setup-local-domain.sh                    # 내부 CA 를 꺼내고 신뢰 등록 명령을 알려 준다
# macOS
sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain .runbook-logs/nullus-internal-ca.crt
# 리눅스 — 스크립트가 출력하는 명령과 같다
sudo cp .runbook-logs/nullus-internal-ca.crt /usr/local/share/ca-certificates/ \
  && sudo update-ca-certificates

# GitLab — 사용자 root
kubectl --context $CTX -n $NS get secret gitlab-initial-root-password \
  -o jsonpath='{.data.password}' | base64 -d; echo
# Argo CD — 사용자 admin. 키는 clearPassword 다(password 키는 없다)
kubectl --context $CTX -n $NS get secret argocd-secret \
  -o jsonpath='{.data.clearPassword}' | base64 -d; echo
# SonarQube — 관리자 admin. 일반 사용자는 로그인 화면의 Keycloak 버튼으로 들어간다
kubectl --context $CTX -n $NS get secret nullus-sonarqube-credentials \
  -o jsonpath='{.data.admin-password}' | base64 -d; echo

./scripts/runbook_local.sh gitlab-forward      # NULLUS_GITLAB_URL=nullus-gitlab-argocd-sonarqube=http://127.0.0.1:8181
./scripts/runbook_local.sh status | grep gitlab

docker compose -f docker-compose.dev.yaml exec minio \
  mc alias set local http://localhost:9000 nullus nullus_dev
docker compose -f docker-compose.dev.yaml exec minio mc mb local/nullus-backup
docker compose -f docker-compose.dev.yaml exec postgres \
  psql -U nullus -d nullus -c 'CREATE DATABASE keycloak;'

cat > ~/.nullus-api.env <<'EOF'
NULLUS_BACKUP_ENABLED=true
# 정확히 32바이트, ENCRYPTION_KEY·DB 비밀번호와 다른 값
NULLUS_BACKUP_SEAL_KEY='nullus-backup-seal-key-32bytes!!'
NULLUS_BACKUP_DESTINATION_ENDPOINT=localhost:9000
NULLUS_BACKUP_DESTINATION_BUCKET=nullus-backup
NULLUS_BACKUP_DESTINATION_ACCESS_KEY=nullus
NULLUS_BACKUP_DESTINATION_SECRET_KEY=nullus_dev
NULLUS_BACKUP_DESTINATION_USE_SSL=false
NULLUS_BACKUP_KEYCLOAK_DATABASE_HOST=localhost
NULLUS_BACKUP_KEYCLOAK_DATABASE_PORT=5433
NULLUS_BACKUP_KEYCLOAK_DATABASE_NAME=keycloak
NULLUS_BACKUP_KEYCLOAK_DATABASE_USER=nullus
NULLUS_BACKUP_KEYCLOAK_DATABASE_PASSWORD=nullus_dev
EOF

export PATH="$(brew --prefix libpq)/bin:$PATH"     # pg_dump
source ~/.nullus-e2e.env                           # NULLUS_LOCAL_DOMAIN 을 물려받는다 — 아래 경고
./scripts/runbook_local.sh refresh                 # up 을 --auth=none 으로 띄웠으면 여기도 붙인다
grep '백업 모듈 준비 완료' .runbook-logs/api.log
./scripts/runbook_local.sh status | grep gitlab          # NULLUS_GITLAB_URL 은 런북이 stdout 으로 찍는다

PIPELINE_ID=$(curl -s $API/api/v1/cicd/pipelines | jq -r --arg n "$APP" '.items[] | select(.name==$n) | .id')
echo "export PIPELINE_ID=$PIPELINE_ID" >> ~/.nullus-e2e.env

kubectl --context $CTX -n $NS get applications.argoproj.io $APP
kubectl --context $CTX -n $APP_NS get deploy,pods,svc
curl -s "$API/api/v1/cicd/deployments?pipeline_id=$PIPELINE_ID" \
  | jq '.items[] | {version, status, triggeredBy}'

# 앱 응답 (다른 터미널에서 포트포워딩)
kubectl --context $CTX -n $APP_NS port-forward svc/$APP 8080:8080
curl -s localhost:8080 | head

cat > ~/.nullus-fingerprint.sh <<'EOF'
fingerprint() {
  echo "image=$(kubectl --context $CTX -n $APP_NS get deploy $APP -o jsonpath='{.spec.template.spec.containers[0].image}')"
  echo "argo=$(kubectl --context $CTX -n $NS get applications.argoproj.io $APP -o jsonpath='{.status.sync.revision}')"
  curl -s "$API/api/v1/cicd/deployments?pipeline_id=$PIPELINE_ID" \
    | jq -r '.items[] | "run=\(.version) \(.status)"' | sort
}
EOF
source ~/.nullus-e2e.env; source ~/.nullus-fingerprint.sh
fingerprint | tee ~/nullus-before.txt

OLD_IP=$(kubectl --context $CTX -n $NS get svc -l gateway.envoyproxy.io/owning-gateway-name \
  -o jsonpath='{.items[0].spec.clusterIP}')
echo "export OLD_IP=$OLD_IP" >> ~/.nullus-e2e.env

curl -sX POST $API/api/v1/admin/backups \
  -H 'Content-Type: application/json' -H "X-Org-Id: $ORG" \
  -d "{\"mode\":\"full\",\"stack_id\":\"$STACK_ID\",\"namespace\":\"$NS\",\"confirm\":\"$NS\"}" \
  | tee ~/nullus-backup.json | jq '{status, error}'

BID=$(curl -s $API/api/v1/admin/backups -H "X-Org-Id: $ORG" | jq -r '.items[0].id')
echo "export BID=$BID" >> ~/.nullus-e2e.env

curl -sX POST $API/api/v1/admin/backups/$BID/verify -H "X-Org-Id: $ORG" | jq
docker compose -f docker-compose.dev.yaml exec minio mc ls --recursive local/nullus-backup

kubectl --context $CTX delete namespace $NS --wait=false
kubectl --context $CTX wait --for=delete namespace/$NS --timeout=20m

kubectl --context $CTX wait --for=delete namespace/$NS --timeout=300s

curl -sX POST $API/api/v1/admin/restores \
  -H 'Content-Type: application/json' -H "X-Org-Id: $ORG" \
  -d "{\"backup_run_id\":\"$BID\",\"namespace\":\"$NS\",\"mode\":\"stack_only\",\"confirm\":\"$BID\"}" \
  | tee ~/nullus-restore.json | jq '{status, schema_check, integrity_report}'

kubectl --context $CTX -n $NS get pods -w

jq '.integrity_report.gateway_aliases' ~/nullus-restore.json   # 12단계에서 저장한 응답
NEW_IP=$(kubectl --context $CTX -n $NS get svc -l gateway.envoyproxy.io/owning-gateway-name \
  -o jsonpath='{.items[0].spec.clusterIP}')
echo "$OLD_IP -> $NEW_IP"   # 같으면 아래 접힌 노드 배선은 건너뛴다

# 맥에서 도구를 여는 라우터와 GitLab 포트포워딩
./scripts/port-forward-gateway.sh
curl -s -o /dev/null -w '%{http_code}\n' localhost:8181/users/sign_in   # 200. 런북의 포워드 루프가 다시 붙는다

# API 캐시를 비운다 (환경 파일과 GitLab 주소는 런북이 넣는다)
source ~/.nullus-e2e.env                           # 6단계 경고 — NULLUS_LOCAL_DOMAIN 이 빠지면 issuer 가 되돌아간다
./scripts/runbook_local.sh refresh

kubectl --context $CTX -n $NS annotate applications.argoproj.io $APP \
  argocd.argoproj.io/refresh=hard --overwrite

source ~/.nullus-e2e.env; source ~/.nullus-fingerprint.sh
fingerprint | tee ~/nullus-after.txt
diff ~/nullus-before.txt ~/nullus-after.txt && echo "지문 일치"

kubectl --context $CTX -n $NS get applications.argoproj.io $APP
kubectl --context $CTX -n $APP_NS get deploy $APP \
  -o jsonpath='{.spec.template.spec.containers[0].image}'; echo
curl -s "$API/api/v1/cicd/deployments?pipeline_id=$PIPELINE_ID" \
  | jq '.items[] | {version, status, triggeredBy}'

# eGovFrame sample v5.0.0 (원본 그대로) 의 알려진 CRITICAL — 검토일 · 담당자 · 사유를 적는다
CVE-2026-47884  # org.springframework:spring-webmvc 6.2.11 → 7.0.9
CVE-2026-40477  # org.thymeleaf:thymeleaf 3.1.3.RELEASE → 3.1.4.RELEASE
CVE-2026-41293  # org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 10.1.55
…

source ~/.nullus-e2e.env
LOCAL_HTTPS_PORT=8443 ./scripts/port-forward-gateway.sh         # 새 앱 주소를 라우터에 반영(443 을 쓰면 변수 생략)
kubectl --context $CTX -n $NS get applications.argoproj.io      # demo-api · egov-boot · egov-web 모두 Synced / Healthy
kubectl --context $CTX -n $APP_NS get deploy,httproute          # egov-boot · egov-web 1/1, 호스트 egov-*.nullus.local
curl -sk -o /dev/null -w '%{http_code}\n' https://egov-boot.nullus.local/   # 200 — 라우터를 8443 으로 띄웠으면 :8443

source ~/.nullus-e2e.env
curl -sS -X POST $API/api/v1/admin/upgrade-bundles -H 'Content-Type: application/json' -d '{
  "tool": "argocd", "release_name": "argo-cd", "chart_name": "argo-cd", "repo_url": "https://argoproj.github.io/argo-helm",
  "source_chart_version": "7.7.16", "source_app_version": "v2.13.3",
  "target_chart_version": "7.7.22", "target_app_version": "v2.13.4",
  "risk_level": "low", "expected_disruption": "API 서버 · 컨트롤러가 차례로 재시작(약 1~2분)",
  "release_notes": "https://github.com/argoproj/argo-cd/releases/tag/v2.13.4",
  "requires_backup": true, "supported_architectures": ["amd64", "arm64"],
  "status": "verified", "rehearsal_confirmed": true
}' | jq '{id, status}'                                           # 같은 ID · 같은 경로가 이미 있으면 409
curl -s $API/api/v1/admin/upgrade-bundles | jq '.items[] | {id, status}'

source ~/.nullus-e2e.env
curl -s $API/api/v1/stacks/$STACK_ID/upgrade-runs \
  | jq '.items[] | {status, from: .source_chart_version, to: .target_chart_version, requested_by}'   # succeeded 7.7.16 → 7.7.22
helm --kube-context $CTX -n $NS list -f '^argo-cd$'              # CHART argo-cd-7.7.22, APP VERSION v2.13.4
kubectl --context $CTX -n $NS get deploy argo-cd-argocd-server \
  -o jsonpath='{.spec.template.spec.containers[0].image}'; echo  # …argocd:v2.13.4
kubectl --context $CTX -n $NS get applications.argoproj.io $APP  # 기존 앱이 Synced / Healthy 그대로

curl -s $API/api/v1/assistant/status | jq            # 켜짐 여부 · 공급자 · 모델
curl -s $API/api/v1/admin/assistant -H "X-Org-Id: $ORG" | jq '{provider, effective_model, has_key, key_hint, enabled}'

# 포트포워딩 반복문과 게이트웨이 라우터
./scripts/runbook_local.sh gitlab-forward --down   # down 이 함께 내리므로 보통은 생략
./scripts/port-forward-gateway.sh --down

# 잠시 멈추기 — 데이터는 남는다
./scripts/runbook_local.sh down

# 처음 상태로 — 파이프라인 → 스택 → 플랫폼 → kind → 볼륨 순으로 전부 지운다
./scripts/runbook_local.sh purge

GW_IP=$(kubectl --context $CTX -n $NS get svc -l gateway.envoyproxy.io/owning-gateway-name \
  -o jsonpath='{.items[0].spec.clusterIP}')
CA_NS=$(kubectl --context $CTX get secret -A \
  -o jsonpath="{range .items[?(@.metadata.name=='nullus-internal-ca')]}{.metadata.namespace}{'\n'}{end}" | head -1)
kubectl --context $CTX -n "$CA_NS" get secret nullus-internal-ca -o jsonpath='{.data.tls\.crt}' \
  | base64 -d > /tmp/nullus-internal-ca.crt

for node in $(kind get nodes --name nullus-platform); do
  for host in gitlab.$DOMAIN registry.$DOMAIN; do
    docker exec "$node" sh -c "grep -v ' $host\$' /etc/hosts > /tmp/h && cat /tmp/h > /etc/hosts && rm -f /tmp/h; echo '$GW_IP $host' >> /etc/hosts"
  done
  docker cp /tmp/nullus-internal-ca.crt "$node:/usr/local/share/ca-certificates/nullus-internal-ca.crt"
  docker exec "$node" update-ca-certificates
  docker exec "$node" systemctl restart containerd
done
kubectl --context $CTX wait --for=condition=Ready nodes --all --timeout=180s

curl -s -X PUT $API/api/v1/stacks/$STACK_ID/image-scan-policy -H 'Content-Type: application/json' \
  -d '{"block_severity":"CRITICAL","ignore_unfixed":true,"on_scanner_unreachable":"block","sast_on_gate_failure":"warn"}' \
  | jq '{policy, pushes}'                        # 되돌리려면 "block"

source ~/.nullus-e2e.env
SQ_PW=$(kubectl --context $CTX -n $NS get secret nullus-sonarqube-credentials \
  -o jsonpath='{.data.admin-password}' | base64 -d)
kubectl --context $CTX -n $NS port-forward svc/sonarqube 19000:9000 >/dev/null 2>&1 &
SQ_TOKEN=$(curl -s -u "admin:$SQ_PW" -X POST http://localhost:19000/api/user_tokens/generate \
  --data-urlencode "name=e2e-$(date +%s)" -d type=GLOBAL_ANALYSIS_TOKEN | jq -r .token)
echo "${SQ_TOKEN:0:4}"                        # sqa_ 로 시작하면 된다

# 내부 CA 는 5단계의 setup-local-domain.sh 가 꺼내 둔 것. 사용자 root 와 5단계 비밀번호를 묻는다
git -c http.sslCAInfo=$PWD/.runbook-logs/nullus-internal-ca.crt \
  clone https://gitlab.$DOMAIN/nullus/$APP.git ~/$APP

# 스캐너 이미지는 amd64 만 있다. Apple Silicon 에서는 에뮬레이션으로 돈다(30초 남짓)
docker run --rm --platform linux/amd64 -v ~/$APP:/usr/src \
  -e SONAR_HOST_URL=http://host.docker.internal:19000 -e SONAR_TOKEN=$SQ_TOKEN \
  sonarsource/sonar-scanner-cli:12.2 -Dsonar.projectKey=$APP -Dsonar.qualitygate.wait=true
echo "exit=$?"

curl -s -u "admin:$SQ_PW" "http://localhost:19000/api/qualitygates/project_status?projectKey=$APP" \
  | jq -r '.projectStatus.status'