하네스(Harness) 엔지니어링 완전 가이드 — CI/CD부터 비용 관리까지

1
2
3
4
5
6

# Helm으로 Harness SMEE 설치
helm repo add harness https://harness.github.io/helm-charts
helm install harness harness/harness \
  --namespace harness \
  --create-namespace \
  -f values.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

pipeline:
  name: Build and Test
  identifier: build_and_test
  projectIdentifier: my_project
  orgIdentifier: default
  stages:
    - stage:
        name: Build
        identifier: Build
        type: CI
        spec:
          cloneCodebase: true
          infrastructure:
            type: KubernetesDirect
            spec:
              connectorRef: my_k8s_cluster
              namespace: harness-builds
          execution:
            steps:
              - step:
                  type: Run
                  name: Run Tests
                  identifier: Run_Tests
                  spec:
                    connectorRef: dockerhub
                    image: golang:1.21
                    command: |
                      go test ./... -v -coverprofile=coverage.out
                      go tool cover -html=coverage.out -o coverage.html
              - step:
                  type: BuildAndPushDockerRegistry
                  name: Build and Push Image
                  identifier: Build_Push
                  spec:
                    connectorRef: dockerhub
                    repo: myorg/myapp
                    tags:
                      - <+pipeline.sequenceId>
                      - latest

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

- step:
    type: RunTests
    name: Run Tests with TI
    identifier: Run_Tests_TI
    spec:
      language: Java
      buildTool: Maven
      args: test
      runOnlySelectedTests: true  # Test Intelligence 활성화
      testAnnotations: "@Test,@org.junit.Test"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

- step:
    type: RestoreCacheGCS
    name: Restore Cache
    identifier: Restore_Cache
    spec:
      connectorRef: gcs_connector
      bucket: my-build-cache
      key: maven-{{ checksum "pom.xml" }}

- step:
    type: SaveCacheGCS
    name: Save Cache
    identifier: Save_Cache
    spec:
      connectorRef: gcs_connector
      bucket: my-build-cache
      key: maven-{{ checksum "pom.xml" }}
      sourcePaths:
        - /root/.m2/repository

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

- step:
    type: K8sCanaryDeploy
    name: Canary Deploy
    identifier: canary_deploy
    spec:
      instanceSelection:
        type: Percentage
        spec:
          percentage: 10
      skipDryRun: false
- step:
    type: Verify
    name: Verify Canary
    identifier: verify_canary
    spec:
      type: Continuous
      spec:
        monitoredServiceRef: my_service
        healthSources:
          - prometheus
        duration: 15m
        sensitivity: MEDIUM
- step:
    type: K8sCanaryDelete
    name: Delete Canary
    identifier: delete_canary

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

- step:
    type: K8sBlueGreenDeploy
    name: Blue Green Deploy
    identifier: bg_deploy
    spec:
      skipDryRun: false
- step:
    type: K8sBGSwapServices
    name: Swap Services
    identifier: swap_services
    spec:
      skipDryRun: false

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

environment:
  name: Production
  identifier: production
  type: Production
  variables:
    - name: REPLICA_COUNT
      type: String
      value: "10"
    - name: MEMORY_LIMIT
      type: String
      value: "2Gi"

1
2
3
4
5
6

rollbackSteps:
  - step:
      type: K8sRollingRollback
      name: Rollback
      identifier: rollback
      spec: {}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

# GitOps Application 정의
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: harness-gitops
spec:
  project: default
  source:
    repoURL: https://github.com/myorg/k8s-configs
    targetRevision: main
    path: apps/my-app/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

triggers:
  - trigger:
      name: PR Trigger
      identifier: pr_trigger
      enabled: true
      source:
        type: Webhook
        spec:
          type: Github
          spec:
            event: PullRequest
            actions:
              - Open
              - Reopen
              - Edit
            autoAbortPreviousExecutions: true

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

import { initialize, variation } from '@harnessio/ff-javascript-client-sdk';

// SDK 초기화
const client = initialize('YOUR_SDK_KEY', {
  identifier: 'user123',
  attributes: {
    email: 'user@example.com',
    plan: 'premium',
    country: 'KR'
  }
});

// 플래그 평가
await client.waitForInitialization();
const showNewDashboard = variation('new_dashboard_ui', false);

if (showNewDashboard) {
  renderNewDashboard();
} else {
  renderLegacyDashboard();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

@Service
public class FeatureService {

    @Autowired
    private CfClient cfClient;

    public boolean isNewCheckoutEnabled(String userId) {
        Target target = Target.builder()
            .identifier(userId)
            .name(userId)
            .attribute("plan", getUserPlan(userId))
            .build();

        return cfClient.boolVariation("new_checkout_flow", target, false);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

# 피처 플래그 설정 예시
feature_flag:
  identifier: new_checkout_flow
  name: New Checkout Flow
  kind: boolean
  defaultEnabled: false

  targeting_rules:
    # 베타 사용자 그룹 100% 활성화
    - clauses:
        - attribute: group
          op: equal
          values: ["beta_users"]
      serve: true

    # 프리미엄 플랜 사용자 20% 활성화 (점진적 롤아웃)
    - clauses:
        - attribute: plan
          op: equal
          values: ["premium"]
      serve:
        distribution:
          - variation: true
            weight: 20000  # 20%
          - variation: false
            weight: 80000  # 80%

1
2
3
4
5
6
7

// Amplitude/Mixpanel과 연동
const variant = variation('checkout_button_color', 'blue');

analytics.track('Checkout Initiated', {
  ff_checkout_button: variant,
  userId: currentUser.id
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# CCM 퍼스펙티브 설정
perspective:
  name: Backend Services
  rules:
    - viewConditions:
        - viewField:
            fieldId: label.k8s-app
            fieldName: k8s-app
            identifier: LABEL
          operator: IN
          values:
            - api-server
            - auth-service
            - payment-service

1
2
3
4
5
6
7
8

autostopping_rule:
  name: Dev Cluster Auto-Stop
  cloud_provider: AWS
  resources:
    - type: ECS
      cluster: dev-cluster
  idle_time_minutes: 15
  warmup_time_seconds: 30

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

budget:
  name: Production Monthly Budget
  amount: 50000  # $50,000
  period: MONTHLY
  alerts:
    - threshold: 80  # 80% 도달 시 알림
      channels:
        - slack: "#cloud-costs"
        - email: "devops@company.com"
    - threshold: 100  # 예산 초과 시 알림
      channels:
        - pagerduty: "cloud-cost-oncall"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# Rego 정책 예시: 프로덕션 배포는 승인 필수
package pipeline

deny[msg] {
  input.pipeline.stages[_].stage.spec.execution.steps[_].step.type == "K8sRollingDeploy"
  input.pipeline.stages[_].stage.spec.environment.identifier == "production"
  not has_approval_step
  msg := "Production deployments require an approval step"
}

has_approval_step {
  input.pipeline.stages[_].stage.spec.execution.steps[_].step.type == "HarnessApproval"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

role:
  name: Developer
  identifier: developer
  permissions:
    - core_pipeline_view
    - core_pipeline_execute
    - core_environment_view
  # 프로덕션 환경 직접 배포 불가
  resourceGroups:
    - non_production_resources

1
2
3
4
5
6
7

# 파이프라인에서 시크릿 참조
- step:
    type: Run
    spec:
      envVariables:
        DB_PASSWORD: <+secrets.getValue("production_db_password")>
        API_KEY: <+secrets.getValue("external_api_key")>

1
2
3
4
5
6

# Delegate Selector 활용
- step:
    type: Run
    spec:
      delegateSelectors:
        - prod-delegate  # 특정 Delegate 그룹 지정

1
2
3
4
5
6
7
8

# K8s Delegate 리소스 설정
resources:
  limits:
    cpu: "1"
    memory: 4Gi
  requests:
    cpu: 500m
    memory: 2Gi

1
2

DELEGATE_IMAGE: harness/delegate:23.10.81202
AUTO_UPGRADE: "false"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

stages:
  - parallel:
      - stage:
          name: Unit Tests
          # ...
      - stage:
          name: Lint
          # ...
      - stage:
          name: Security Scan
          # ...
  - stage:
      name: Build Docker Image
      # 위 모든 스테이지 완료 후 실행

1
2
3
4
5

- step:
    name: Deploy to Prod
    when:
      condition: <+trigger.targetBranch> == "main"
      stageStatus: Success

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

template:
  name: Standard Build Template
  identifier: standard_build
  versionLabel: v1
  type: Stage
  spec:
    type: CI
    spec:
      cloneCodebase: true
      execution:
        steps:
          - step:
              type: Run
              name: Build
              spec:
                command: make build
          - step:
              type: Run
              name: Test
              spec:
                command: make test

1
2
3
4
5
6
7
8
9

# Delegate 로그 확인
kubectl logs -n harness-delegate deployment/harness-delegate -f

# Delegate 상태 확인
kubectl get pods -n harness-delegate

# 네트워크 연결 테스트
kubectl exec -n harness-delegate deploy/harness-delegate -- \
  curl -s https://app.harness.io/api/health