Spring 프로필과 설정 분리 전략

# application.yml — 공통 설정
spring:
  application:
    name: order-service
server:
  shutdown: graceful

---
# dev 프로필
spring:
  config:
    activate:
      on-profile: dev
  datasource:
    url: jdbc:mysql://localhost:3306/orders
    username: dev_user
    password: dev_pass
  jpa:
    show-sql: true
    hibernate:
      ddl-auto: create-drop
logging:
  level:
    org.hibernate.SQL: DEBUG
    org.hibernate.type.descriptor.sql: TRACE

---
# prod 프로필
spring:
  config:
    activate:
      on-profile: prod
  datasource:
    url: jdbc:mysql://prod-db.internal:3306/orders
    username: ${DB_USERNAME}          # 환경변수로 주입
    password: ${DB_PASSWORD}          # 환경변수로 주입
  jpa:
    show-sql: false
    hibernate:
      ddl-auto: validate              # 운영에서 DDL 자동 변경 금지
    properties:
      hibernate:
        generate_statistics: false
logging:
  level:
    root: WARN
    com.example: INFO

src/main/resources/
├── application.yml              # 공통
├── application-dev.yml          # dev 전용
├── application-stage.yml        # staging 전용
├── application-prod.yml         # prod 전용
└── application-test.yml         # 테스트 전용

# 이 4개는 전부 같은 프로퍼티
app.datasource-url          # kebab-case (추천)
app.datasourceUrl            # camelCase
app.datasource_url           # underscore
APP_DATASOURCE_URL           # 환경변수 (UPPER_SNAKE_CASE)

# 1. 환경변수 (가장 추천 — 코드 변경 없이 환경마다 다름)
export SPRING_PROFILES_ACTIVE=prod

# 2. JVM 인자
java -jar app.jar -Dspring.profiles.active=prod

# 3. 커맨드라인 인자
java -jar app.jar --spring.profiles.active=prod

# 4. application.yml 기본값 (위험 — 실수로 prod가 켜질 수 있음)
spring:
  profiles:
    active: dev   # 로컬 전용 기본값으로만 사용

spring:
  profiles:
    group:
      prod:
        - prod-db
        - prod-cache
        - prod-monitoring
      dev:
        - dev-db
        - dev-tools

SPRING_PROFILES_ACTIVE=prod,debug

@Component
public class ProfileGuard implements ApplicationListener<ApplicationReadyEvent> {

    @Value("${spring.profiles.active:}")
    private String activeProfiles;

    @Override
    public void onApplicationEvent(ApplicationReadyEvent event) {
        if (activeProfiles.contains("prod") && activeProfiles.contains("dev")) {
            throw new IllegalStateException(
                "prod와 dev 프로필이 동시에 활성화됨 — 설정 충돌 위험");
        }
    }
}

@Validated
@ConfigurationProperties(prefix = "app.order")
public record OrderProperties(
    @NotBlank String serviceUrl,
    @Min(1) @Max(100) int maxRetry,
    @DurationUnit(ChronoUnit.SECONDS) Duration timeout,
    NotificationProperties notification
) {
    public record NotificationProperties(
        boolean enabled,
        @Email String recipient,
        @DurationUnit(ChronoUnit.MINUTES) Duration cooldown
    ) {}
}

app:
  order:
    service-url: https://order-api.internal
    max-retry: 3
    timeout: 5s
    notification:
      enabled: true
      recipient: ops@example.com
      cooldown: 10m

@Configuration
@EnableConfigurationProperties(OrderProperties.class)
public class OrderConfig {

    @Bean
    public OrderClient orderClient(OrderProperties props) {
        return new OrderClient(
            props.serviceUrl(),
            props.maxRetry(),
            props.timeout()
        );
    }
}

// timeout이 누락되거나 maxRetry가 0이면
// 애플리케이션 시작 단계에서 BindValidationException 발생
// → 운영에서 "알 수 없는 런타임 오류"가 아닌 "시작 실패"로 빠르게 감지

***************************
APPLICATION FAILED TO START
***************************
Binding to target OrderProperties failed:

  Property: app.order.max-retry
  Value:    "0"
  Reason:   최솟값 1 이상이어야 합니다

@Configuration
public class CacheConfig {

    @Bean
    @Profile("dev")
    public CacheManager devCache() {
        // 로컬에서는 간단한 ConcurrentMap 캐시
        return new ConcurrentMapCacheManager("orders", "products");
    }

    @Bean
    @Profile("prod")
    public CacheManager prodCache(RedisConnectionFactory factory) {
        // 운영에서는 Redis 캐시
        RedisCacheConfiguration config = RedisCacheConfiguration.defaultCacheConfig()
            .entryTtl(Duration.ofMinutes(10))
            .serializeValuesWith(
                SerializationPair.fromSerializer(new GenericJackson2JsonRedisSerializer()));

        return RedisCacheManager.builder(factory)
            .cacheDefaults(config)
            .build();
    }
}

@Bean
@ConditionalOnProperty(
    name = "app.notification.enabled",
    havingValue = "true",
    matchIfMissing = false    // 설정 없으면 비활성
)
public NotificationService notificationService(OrderProperties props) {
    return new SlackNotificationService(props.notification());
}

# dev — 알림 꺼둠
app:
  notification:
    enabled: false

# prod — 알림 켬
app:
  notification:
    enabled: true
    recipient: ops@example.com

# k8s Secret
apiVersion: v1
kind: Secret
metadata:
  name: order-db-secret
type: Opaque
data:
  DB_USERNAME: b3JkZXJfdXNlcg==    # base64("order_user")
  DB_PASSWORD: cHIwZFBAc3M=        # base64("pr0dP@ss")
---
# Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-service
spec:
  template:
    spec:
      containers:
        - name: order-service
          image: order-service:latest
          envFrom:
            - secretRef:
                name: order-db-secret
          env:
            - name: SPRING_PROFILES_ACTIVE
              value: "prod"

# bootstrap.yml
spring:
  cloud:
    vault:
      uri: https://vault.internal:8200
      authentication: KUBERNETES    # K8s Service Account 인증
      kubernetes:
        role: order-service
        service-account-token-file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kv:
        enabled: true
        backend: secret
        default-context: order-service

// Vault에 저장된 secret/order-service 경로의 값이 자동 주입
@Value("${db.password}")
private String dbPassword;

# application-prod.yml
spring:
  config:
    import: "aws-secretsmanager:order-service/prod"

// AWS Secrets Manager의 order-service/prod 시크릿 키가
// 프로퍼티로 자동 매핑됨
@ConfigurationProperties(prefix = "db")
public record DbProperties(String username, String password, String url) {}

# 현재 적용된 모든 프로퍼티 소스와 값 확인
curl localhost:8080/actuator/env | jq '.propertySources[] | .name'

"systemEnvironment"
"applicationConfig: [classpath:/application-prod.yml]"
"applicationConfig: [classpath:/application.yml]"
"Vault: secret/order-service"

java -jar app.jar --debug

============================
CONDITIONS EVALUATION REPORT
============================

Positive matches:
-----------------
   RedisCacheConfiguration matched:
      - @ConditionalOnClass found required class 'org.springframework.data.redis.cache.RedisCacheManager'
      - @Profile("prod") matched

Negative matches:
-----------------
   ConcurrentMapCacheConfiguration:
      - @Profile("dev") did not match — active profiles: "prod"

# @ConfigurationProperties 바인딩 결과 확인
curl localhost:8080/actuator/configprops | jq '.contexts.application.beans'

{
  "orderProperties": {
    "prefix": "app.order",
    "properties": {
      "serviceUrl": "https://order-api.internal",
      "maxRetry": 3,
      "timeout": "PT5S",
      "notification": {
        "enabled": true,
        "recipient": "ops@example.com"
      }
    }
  }
}

@SpringBootTest
@ActiveProfiles("test")
class OrderServiceTest {

    @Autowired
    private OrderProperties props;

    @Test
    void shouldLoadTestConfiguration() {
        assertThat(props.maxRetry()).isEqualTo(1);   // test에서는 빠르게 실패
        assertThat(props.timeout()).isEqualTo(Duration.ofSeconds(1));
    }
}

@SpringBootTest
@ActiveProfiles("test")
@TestPropertySource(properties = {
    "app.order.max-retry=0",
    "app.order.notification.enabled=false"
})
class OrderServiceRetryDisabledTest {
    // max-retry=0인 상황을 테스트
}

@SpringBootTest
@Testcontainers
class OrderRepositoryTest {

    @Container
    static MySQLContainer<?> mysql = new MySQLContainer<>("mysql:8.0")
        .withDatabaseName("orders_test");

    @DynamicPropertySource
    static void configureProperties(DynamicPropertyRegistry registry) {
        registry.add("spring.datasource.url", mysql::getJdbcUrl);
        registry.add("spring.datasource.username", mysql::getUsername);
        registry.add("spring.datasource.password", mysql::getPassword);
    }

    // 실제 MySQL 컨테이너에 연결되어 테스트 실행
}

# application.yml — 공통
logging:
  pattern:
    console: "%d{ISO8601} [%thread] %-5level %logger{36} - %msg%n"

---
# dev
spring:
  config:
    activate:
      on-profile: dev
logging:
  level:
    root: INFO
    com.example: DEBUG
    org.hibernate.SQL: DEBUG
    org.hibernate.type.descriptor.sql.BasicBinder: TRACE

---
# prod
spring:
  config:
    activate:
      on-profile: prod
logging:
  level:
    root: WARN
    com.example: INFO
  pattern:
    console: '{"time":"%d{ISO8601}","level":"%level","logger":"%logger","msg":"%msg","thread":"%thread"}%n'

# ❌ 이런 일이 실제로 발생합니다
spring:
  jpa:
    hibernate:
      ddl-auto: update    # 운영에서 테이블 구조가 자동 변경됨!

# ❌ 점(.)이 포함된 환경변수는 대부분 셸에서 유효하지 않음
export spring.datasource.url=jdbc:mysql://...

# ✅ 언더스코어 + 대문자로 변환
export SPRING_DATASOURCE_URL=jdbc:mysql://...

// ❌ 절대 하지 마세요
log.info("DB 연결: url={}, password={}", url, password);

// ✅ 비밀 값은 마스킹
log.info("DB 연결: url={}, password=****", url);

management:
  endpoint:
    env:
      show-values: WHEN_AUTHORIZED
  endpoints:
    web:
      exposure:
        include: health, info, configprops
        exclude: env    # 운영에서는 env 노출 금지

# SPRING_PROFILES_ACTIVE를 안 넣고 배포하면
# application.yml의 기본값만 적용 → 로컬 DB로 연결될 수 있음