Certificate Manager CQRS Event Sourcing

cert-manager SSL TLS Certificate Kubernetes Let's Encrypt ACME CQRS Command Query Separation Event Sourcing Events Audit Trail Replay

เนื้อหาเกี่ยวข้อง — ดูเพิ่มเติมเรื่อง Passkeys WebAuthn Cloud Native Design — คู่มือฉบับสมบูรณ์ 2026

Pattern	หลักการ	ใช้เมื่อ
CQRS	แยก Read/Write Model	Read/Write Load ต่างกันมาก
Event Sourcing	เก็บ Events แทน State	ต้องการ Audit Trail ครบ
cert-manager	Auto SSL Certificate	Kubernetes HTTPS
ACME	Automated Certificate	Let's Encrypt Cert

cert-manager Setup

# === cert-manager Installation & Config ===



# Install cert-manager

# helm repo add jetstack https://charts.jetstack.io

# helm repo update

# helm install cert-manager jetstack/cert-manager \

#   --namespace cert-manager --create-namespace \

#   --set installCRDs=true



# ClusterIssuer — Let's Encrypt Production

# apiVersion: cert-manager.io/v1

# kind: ClusterIssuer

# metadata:

#   name: letsencrypt-prod

# spec:

#   acme:

#     server: https://acme-v02.api.letsencrypt.org/directory

#     email: admin@example.com

#     privateKeySecretRef:

#       name: letsencrypt-prod-key

#     solvers:

#     - http01:

#         ingress:

#           class: nginx

#     - dns01:

#         cloudflare:

#           email: admin@example.com

#           apiTokenSecretRef:

#             name: cloudflare-api-token

#             key: api-token

#       selector:

#         dnsZones:

#         - "example.com"



# Certificate Resource

# apiVersion: cert-manager.io/v1

# kind: Certificate

# metadata:

#   name: myapp-tls

#   namespace: production

# spec:

#   secretName: myapp-tls-secret

#   issuerRef:

#     name: letsencrypt-prod

#     kind: ClusterIssuer

#   commonName: myapp.example.com

#   dnsNames:

#   - myapp.example.com

#   - www.myapp.example.com

#   - api.myapp.example.com

#   renewBefore: 720h  # 30 days before expiry



# Ingress with TLS

# apiVersion: networking.k8s.io/v1

# kind: Ingress

# metadata:

#   name: myapp-ingress

#   annotations:

#     cert-manager.io/cluster-issuer: letsencrypt-prod

# spec:

#   tls:

#   - hosts:

#     - myapp.example.com

#     secretName: myapp-tls-secret

#   rules:

#   - host: myapp.example.com

#     http:

#       paths:

#       - path: /

#         pathType: Prefix

#         backend:

#           service:

#             name: myapp

#             port:

#               number: 80



# kubectl get certificates -A

# kubectl describe certificate myapp-tls

# kubectl get certificaterequests -A



from dataclasses import dataclass

from typing import List



@dataclass

class CertConfig:

    domain: str

    issuer: str

    challenge: str

    renew_before_days: int

    status: str



certs = [

    CertConfig("myapp.example.com", "letsencrypt-prod", "HTTP-01", 30, "Ready"),

    CertConfig("*.example.com", "letsencrypt-prod", "DNS-01", 30, "Ready"),

    CertConfig("api.example.com", "vault-issuer", "Internal", 15, "Ready"),

    CertConfig("internal.corp", "self-signed", "None", 365, "Ready"),

]



print("Certificate Status:")

for c in certs:

    print(f"  {c.domain} | {c.issuer} | {c.challenge} | "

          f"Renew: {c.renew_before_days}d | {c.status}")

Event Store

# event_store.py — Persistent Event Store

# PostgreSQL Event Store Schema

# CREATE TABLE events (

#   id BIGSERIAL PRIMARY KEY,

#   stream_id VARCHAR(255) NOT NULL,

#   event_type VARCHAR(100) NOT NULL,

#   data JSONB NOT NULL,

#   metadata JSONB DEFAULT '{}',

#   version INT NOT NULL,

#   created_at TIMESTAMP DEFAULT NOW(),

#   INDEX idx_stream (stream_id, version),

#   UNIQUE (stream_id, version)

# );

#

# CREATE TABLE snapshots (

#   stream_id VARCHAR(255) PRIMARY KEY,

#   data JSONB NOT NULL,

#   version INT NOT NULL,

#   created_at TIMESTAMP DEFAULT NOW()

# );



# Event Store with Snapshots

event_store_features = {

    "Append Only": "Events เพิ่มเท่านั้น ไม่แก้ไข ไม่ลบ",

    "Stream": "จัดกลุ่ม Events ตาม Aggregate (เช่น Domain)",

    "Versioning": "ทุก Event มี Version ป้องกัน Concurrency",

    "Snapshot": "บันทึก State ทุก N Events ลดเวลา Replay",

    "Projection": "สร้าง Read Model จาก Events",

    "Replay": "สร้าง State ใหม่จาก Events ได้ตลอดเวลา",

}



print("Event Store Features:")

for feature, desc in event_store_features.items():

    print(f"  [{feature}]: {desc}")



# Tools

tools = {

    "EventStoreDB": "Open Source Event Store Database",

    "Apache Kafka": "Event Streaming Platform",

    "Marten": ".NET Event Sourcing Library",

    "Axon Framework": "Java CQRS/ES Framework",

    "PostgreSQL + JSONB": "DIY Event Store",

}



print(f"\n\nEvent Sourcing Tools:")

for tool, desc in tools.items():

    print(f"  {tool}: {desc}")



# When to Use

use_cases = {

    "ใช้ CQRS": ["Read/Write Load ต่างกันมาก", "ต้องการ Read Model หลายแบบ", "Complex Domain Logic"],

    "ใช้ Event Sourcing": ["ต้องการ Audit Trail ครบ", "ต้อง Replay/Debug ได้", "Temporal Query (ดูข้อมูล ณ เวลาใดก็ได้)"],

    "ไม่ควรใช้": ["CRUD ง่ายๆ", "ทีมเล็ก ไม่คุ้น Pattern", "ไม่ต้องการ Audit Trail"],

}



print(f"\n\nWhen to Use:")

for category, items in use_cases.items():

    print(f"\n  [{category}]")

    for item in items:

        print(f"    - {item}")