feat: Blue/Green 배포를 위한 Green 슬롯 management 포트(9081) ingress rule 추가#45
Conversation
Hexeong
requested review from
Gyuhyeok99,
JAEHEE25,
lsy1307,
sukangpunch,
whqtker and
wibaek
as code owners
📝 WalkthroughWalkthrough
Changesconfig/secrets 서브모듈 갱신
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/secrets`:
- Line 1: The submodule pointer change in config/secrets is not being caught by
the existing Terraform workflow filters because the filters in both
.github/workflows/terraform-plan.yml and .github/workflows/terraform-apply.yml
only specify concrete files within config/secrets (like prod.tfvars and
app_stack.tfvars) but not the directory path itself. When submodule pointers
change, they are reported as changes to the config/secrets path directly, not to
individual files within it. Add config/secrets as a direct path entry to the
prod/stage filters in both terraform-plan.yml and terraform-apply.yml workflow
files so that submodule pointer changes are properly detected and trigger the
appropriate plan and apply workflows.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ee2413af-89dd-46d1-92b7-46caa7bcd0eb
📒 Files selected for processing (1)
config/secrets
| @@ -1 +1 @@ | |||
| Subproject commit 40fe5a23122f5b5fe84c1ecbcec237318ba6358d | |||
| Subproject commit f76d2ff79e7535eae814f8974e87029a014b4736 | |||
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
base_ref="${GITHUB_BASE_REF:-}"
if [ -n "$base_ref" ] && git rev-parse --verify "origin/${base_ref}" >/dev/null 2>&1; then
base="origin/${base_ref}"
else
base="origin/HEAD"
fi
merge_base="$(git merge-base "$base" HEAD)"
printf '\n[PR 변경 경로]\n'
git diff --name-only "$merge_base" HEAD | sed 's/^/- /'
printf '\n[서브모듈 포인터 diff]\n'
git diff --submodule=short "$merge_base" HEAD -- config/secrets
printf '\n[Terraform workflow의 config/secrets 필터]\n'
rg -n -C2 "config/secrets" .github/workflows/terraform-plan.yml .github/workflows/terraform-apply.ymlRepository: solid-connection/solid-connection-infra
Length of output: 65
🏁 Script executed:
#!/bin/bash
# Repository 구조 확인
echo "[Repository 파일 목록 - 최상위 및 주요 디렉토리]"
ls -la | head -20
echo -e "\n[.github/workflows 디렉토리 확인]"
ls -la .github/workflows/ 2>/dev/null || echo "Directory not found"
echo -e "\n[config 디렉토리 확인]"
ls -la config/ 2>/dev/null || echo "Directory not found"Repository: solid-connection/solid-connection-infra
Length of output: 1725
🏁 Script executed:
#!/bin/bash
# Terraform workflow 파일 존재 여부 및 내용 확인
echo "[terraform-plan.yml 파일 확인]"
if [ -f .github/workflows/terraform-plan.yml ]; then
wc -l .github/workflows/terraform-plan.yml
echo -e "\n[terraform-plan.yml에서 path-filter 관련 부분]"
grep -n "paths\|config/secrets" .github/workflows/terraform-plan.yml | head -30
else
echo "File not found"
fi
echo -e "\n[terraform-apply.yml 파일 확인]"
if [ -f .github/workflows/terraform-apply.yml ]; then
wc -l .github/workflows/terraform-apply.yml
echo -e "\n[terraform-apply.yml에서 path-filter 관련 부분]"
grep -n "paths\|config/secrets" .github/workflows/terraform-apply.yml | head -30
else
echo "File not found"
fiRepository: solid-connection/solid-connection-infra
Length of output: 2095
🏁 Script executed:
#!/bin/bash
# Git 상태 확인
echo "[현재 브랜치 및 상태]"
git status
echo -e "\n[Git 로그 (최근 커밋)]"
git log --oneline -5
echo -e "\n[config/secrets 상태]"
ls -la config/secrets 2>/dev/null || echo "Directory not found"
cat config/secrets 2>/dev/null | head -10 || echo "File not found or not readable"Repository: solid-connection/solid-connection-infra
Length of output: 354
🏁 Script executed:
#!/bin/bash
# 실제 git diff 상태 확인
echo "[config/secrets의 git diff]"
git diff HEAD~1 HEAD -- config/secrets 2>/dev/null || git show HEAD -- config/secrets 2>/dev/null || echo "Can't show diff"
echo -e "\n[전체 changed files]"
git diff --name-only HEAD~1 HEAD 2>/dev/null || echo "Can't list changed files"
echo -e "\n[.gitmodules 확인]"
cat .gitmodulesRepository: solid-connection/solid-connection-infra
Length of output: 667
🏁 Script executed:
#!/bin/bash
# terraform-plan.yml의 실제 path filter 구조 확인 (특히 prod와 stage 섹션)
echo "[terraform-plan.yml의 30-60 라인 (path filter 정의)]"
sed -n '30,60p' .github/workflows/terraform-plan.yml
echo -e "\n[terraform-apply.yml의 29-60 라인 (path filter 정의)]"
sed -n '29,60p' .github/workflows/terraform-apply.ymlRepository: solid-connection/solid-connection-infra
Length of output: 2369
🏁 Script executed:
#!/bin/bash
# GitHub path filter 로직 확인: submodule 포인터 변경 시 어떤 경로로 보고되는지
echo "[git ls-files로 config/secrets 상태 확인]"
git ls-files --stage config/secrets
echo -e "\n[git status로 submodule 상태 확인]"
git status --porcelain config/secrets
echo -e "\n[Current commit hash vs HEAD~1]"
git rev-parse HEAD
git rev-parse HEAD~1Repository: solid-connection/solid-connection-infra
Length of output: 504
🌐 Web query:
dorny paths-filter submodule pointer changes detection
💡 Result:
dorny/paths-filter detects changes by comparing the git ref(s) you provide (via inputs base/ref) and then matching the resulting list of changed file paths against your glob filters; it does not include a first-class “submodule pointer vs submodule contents” mode. 1) What it will detect for submodules - Git records a submodule pointer as a change to the submodule directory path (the “gitlink”) in the superproject. - Since dorny/paths-filter matches “paths of all changed files” against your glob rules [1], it can detect that the submodule path itself changed (added/modified/deleted) when the gitlink changed—e.g., your filter could be something like submoduleDir/ or just submoduleDir. 2) What it will NOT automatically detect - It does not have a documented option for “filter inside submodule contents” (i.e., treat changes inside the submodule repo as changed files under that submodule path in the superproject) [2]. An open issue requests “option to filter paths in submodule” because the current behavior only returns the submodule name/pointer rather than the internal files [2]. 3) Practical workflow/workarounds - If you only care whether the submodule gitlink changed (pointer changed): - Add a filter that matches the submodule directory itself, because the superproject will show that path as changed [1]. - Example concept (you’d adapt paths): - submoduleA: ['path/to/submoduleA'] - If you care about files changed inside the submodule(s): - You must run additional logic outside paths-filter (e.g., checkout submodules and then run a git diff inside each submodule, or compute changed files via git for the submodule commits) because paths-filter doesn’t provide a native submodule-content detection knob [2]. 4) Where the comparison inputs come in - Change detection is done by using git ref(s) and diffing the current branch against base (or merge-base) depending on the event and inputs [1]. The set of paths you can match (including any submodule gitlink path) is derived from that diff step [1]. If you tell me which GitHub event you use (pull_request vs push vs workflow_dispatch) and what you mean by “pointer changes detection” (gitlink changed only, or internal submodule file changes), I can propose an exact filter config and/or a robust shell snippet.
Citations:
- 1: https://github.com/dorny/paths-filter
- 2: Please add option to filter paths in submodule dorny/paths-filter#143
서브모듈 포인터 변경도 Terraform plan/apply 필터에 포함시켜 주세요.
현재 PR에서 config/secrets submodule 포인터가 변경되지만, .github/workflows/terraform-plan.yml과 .github/workflows/terraform-apply.yml의 prod/stage 필터는 config/secrets/prod.tfvars, config/secrets/app_stack.tfvars 등 구체적 파일들만 명시하고 있습니다. Submodule 포인터 변경은 config/secrets 경로로 보고되므로, 필터에 이 경로를 직접 추가하지 않으면 prod/stage plan/apply가 스킵될 수 있습니다. 결과적으로 9081 ingress rule 변경이 검증·적용되지 않을 위험이 있습니다.
🔧 필터 보강 방법
prod:
- 'environment/prod/**'
- 'modules/app_stack/**'
- 'modules/common/**'
+ - 'config/secrets'
- 'config/secrets/prod.tfvars'
- 'config/secrets/app_stack.tfvars'
stage:
- 'environment/stage/**'
- 'modules/app_stack/**'
- 'modules/common/**'
+ - 'config/secrets'
- 'config/secrets/stage.tfvars'
- 'config/secrets/app_stack.tfvars'위 변경을 .github/workflows/terraform-plan.yml과 .github/workflows/terraform-apply.yml 양쪽에 동일하게 적용하면, submodule 포인터 변경이 prod/stage 필터와 매칭됩니다.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@config/secrets` at line 1, The submodule pointer change in config/secrets is
not being caught by the existing Terraform workflow filters because the filters
in both .github/workflows/terraform-plan.yml and
.github/workflows/terraform-apply.yml only specify concrete files within
config/secrets (like prod.tfvars and app_stack.tfvars) but not the directory
path itself. When submodule pointers change, they are reported as changes to the
config/secrets path directly, not to individual files within it. Add
config/secrets as a direct path entry to the prod/stage filters in both
terraform-plan.yml and terraform-apply.yml workflow files so that submodule
pointer changes are properly detected and trigger the appropriate plan and apply
workflows.
There was a problem hiding this comment.
@coderabbitai 필터에서 서브모듈의 어떤부분이 변경되었는지 알고 저 해쉬값을 가지고 판단 가능한가요?
There was a problem hiding this comment.
@Hexeong, 안타깝게도 dorny/paths-filter는 서브모듈 내부를 직접 들여다보지 못합니다.
기술적인 이유를 설명하면:
| 레이어 | Git이 기록하는 것 | 필터가 보는 것 |
|---|---|---|
| 슈퍼프로젝트 | config/secrets 경로에 commit hash 포인터 변경 (gitlink) |
config/secrets 하나의 경로 변경으로만 인식 |
| 서브모듈 내부 | app_stack.tfvars 등 실제 파일 변경 |
보이지 않음 |
즉, 워크플로우 필터 입장에서는 40fe5a2 → f76d2ff 라는 해시 변경만 알 수 있을 뿐, 그 해시 안에서 어떤 파일(prod.tfvars, app_stack.tfvars 등)이 바뀌었는지는 알 수 없습니다.
만약 서브모듈 내부 변경 파일을 기준으로 필터링하려면, 다음과 같은 커스텀 스크립트가 필요합니다:
- name: Check submodule internal changes
run: |
git submodule update --init config/secrets
git -C config/secrets diff 40fe5a2 f76d2ff --name-only그러나 이는 복잡도가 높아집니다. 따라서 원래 제안처럼 config/secrets 경로 자체를 필터에 추가하여, 서브모듈 포인터가 바뀌면 항상 plan/apply가 트리거되도록 하는 것이 더 간단하고 안전한 접근입니다. 서브모듈 변경이 어떤 파일이든 간에 Terraform 검증이 실행되어야 하는 상황이기 때문입니다.
There was a problem hiding this comment.
그럼 해당 내용은 다른 PR에서 작업하겠습니다.
2 participants
관련 이슈
작업 내용
Blue/Green 무중단 배포 도입으로 Green 슬롯의 actuator management 포트가 9081로 변경됨에 따라, 모니터링 서버(Prometheus)가 9081에 접근할 수 있도록 보안 그룹 ingress rule을 추가합니다.
변경 파일:
config/secrets/app_stack.tfvars(서브모듈)api_ingress_rules에 9081 포트 추가특이 사항
config/secrets서브모듈 커밋 포인터만 변경됨, 인프라 리소스 변경 없음file_sd_config전환은 모니터링 서버에서 수동 완료된 상태리뷰 요구사항 (선택)
Summary by CodeRabbit
릴리스 노트