apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: istio-config
  namespace: default
spec:
  # istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod/ingressgateway
  # в кластере нет — с зависимостями из base релиз никогда не станет Ready.
  # cert-manager нужен: этот релиз создаёт ClusterIssuer и Certificate
  dependsOn:
    - name: cert-manager
      namespace: cert-manager
  interval: 5m
  timeout: 10m
  values:
    global:
      env: yc-ecp
    environments:
      yc-ecp:
        namespaces: []
        certManager:
          # чарт рендерит ClusterIssuer как `spec: {{ toYaml $ci.spec }}`,
          # поэтому спека обязана лежать под ключом spec
          clusterIssuers:
            letsencrypt-prod:
              spec:
                acme:
                  email: "sarex@sarex.io"
                  server: "https://acme-v02.api.letsencrypt.org/directory"
                  privateKeySecretRef:
                    name: letsencrypt-prod
                  solvers:
                    - http01:
                        ingress:
                          class: istio
                          # solver-под создаётся контроллером в namespace
                          # сертификата, values чарта cert-manager на него
                          # не действуют — pull-секрет задаётся здесь
                          podTemplate:
                            spec:
                              imagePullSecrets:
                                - name: dockerhub
          # ключ = имя Certificate И имя секрета: версия чарта в OCI-репозитории
          # поле secretName не читает, а берёт имя ключа
          certificates:
            gitea-tls-secret:
              namespace: istio-system
              dnsNames:
                - gitea.invest.cps.sarex.lonsdaleites.ru
              issuerRef:
                name: letsencrypt-prod
                kind: ClusterIssuer
            vault-tls:
              namespace: istio-system
              dnsNames:
                - vault.invest.cps.sarex.lonsdaleites.ru
              issuerRef:
                name: letsencrypt-prod
                kind: ClusterIssuer
            dashboard-tls:
              namespace: istio-system
              dnsNames:
                - dashboard.invest.cps.sarex.lonsdaleites.ru
              issuerRef:
                name: letsencrypt-prod
                kind: ClusterIssuer
            aero-invest-tls-secret:
              namespace: istio-system
              dnsNames:
                - aero.invest.sarex.io
              issuerRef:
                name: letsencrypt-prod
                kind: ClusterIssuer
        istio:
          gateways:
            gitea:
              name: gitea-gateway
              namespace: gateway
              servers:
                - hosts:
                    - gitea.invest.cps.sarex.lonsdaleites.ru
                  httpPortName: http
                  httpsPortName: https
                  tls:
                    credentialName: gitea-tls-secret
            vault:
              name: vault-gateway
              namespace: gateway
              servers:
                - hosts:
                    - vault.invest.cps.sarex.lonsdaleites.ru
                  httpPortName: http
                  httpsPortName: https
                  tls:
                    credentialName: vault-tls
            main:
              name: main-gateway
              namespace: gateway
              servers:
                - hosts:
                    - aero.invest.sarex.io
                  httpPortName: http
                  httpsPortName: https
                  tls:
                    credentialName: aero-invest-tls-secret
            dashboard:
              name: dashboard-gateway
              namespace: gateway
              servers:
                - hosts:
                    - dashboard.invest.cps.sarex.lonsdaleites.ru
                  # без http-сервера порт 80 для этого хоста остаётся
                  # автогенерируемому ingress-шлюзу, через который
                  # cert-manager отдаёт HTTP-01 challenge
                  onlyHttps: true
                  httpsPortName: https
                  tls:
                    credentialName: dashboard-tls
          # имя VirtualService = ключ, поле name чарт игнорирует.
          # noCors: чарт иначе навешивает corsPolicy с дефолтными origins sarex.io
          virtualServices:
            gitea-virt-service:
              namespace: gateway
              noCors: true
              hosts:
                - gitea.invest.cps.sarex.lonsdaleites.ru
              gateways:
                - gateway/gitea-gateway
              routes:
                - path:
                    prefix: /
                  service: gitea.gitea.svc.cluster.local
                  port: 3000
            vault-virt-service:
              namespace: gateway
              noCors: true
              hosts:
                - vault.invest.cps.sarex.lonsdaleites.ru
              gateways:
                - gateway/vault-gateway
              routes:
                - path:
                    prefix: /
                  service: vault-vault-contour.vault.svc.cluster.local
                  port: 8200
            dashboard-virt-service:
              namespace: gateway
              noCors: true
              hosts:
                - dashboard.invest.cps.sarex.lonsdaleites.ru
              gateways:
                - gateway/dashboard-gateway
              routes:
                - path:
                    prefix: /
                  service: dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local
                  port: 80

            # --- aero.invest.sarex.io / main-gateway ---
            backend-service-virt-service:
              namespace: gateway
              hosts:
                - aero.invest.sarex.io
              gateways:
                - gateway/main-gateway
              cors:
                allowHeaders:
                  - Authorization
                  - Content-Type
                allowMethods:
                  - GET
                  - POST
                  - PUT
                  - PATCH
                  - HEAD
                  - DELETE
              routes:
                - path:
                    prefix: /admin/
                  service: backend-service.django.svc.cluster.local
                  port: 8000
                - path:
                    prefix: /api
                  service: backend-service.django.svc.cluster.local
                  port: 8000

            s3-proxy-virt-service:
              namespace: gateway
              hosts:
                - aero.invest.sarex.io
              gateways:
                - gateway/main-gateway
              cors:
                allowHeaders:
                  - Authorization
                  - Content-Type
                allowMethods:
                  - GET
                  - POST
                  - PUT
                  - PATCH
                  - HEAD
                  - DELETE
              routes:
                - path:
                    prefix: /s3/
                  rewrite: /
                  service: s3-bim-service.django.svc.cluster.local
                  port: 80
                - path:
                    prefix: /media/
                  rewrite: /
                  service: s3-service.django.svc.cluster.local
                  port: 80

            frontend-vs:
              namespace: gateway
              noCors: true
              hosts:
                - aero.invest.sarex.io
              gateways:
                - gateway/main-gateway
              routes:
                # без path — маршрут без match, catch-all, как в кластере;
                # он должен оставаться последним по порядку сопоставления
                - service: frontend-service.django.svc.cluster.local
                  port: 80

            bim-api-gazpromcps-api-virt-service:
              namespace: gateway
              hosts:
                - aero.invest.sarex.io
              gateways:
                - gateway/main-gateway
              cors:
                allowHeaders:
                  - Authorization
                  - Content-Type
                allowMethods:
                  - GET
                  - POST
                  - PUT
                  - PATCH
                  - HEAD
                  - DELETE
              routes:
                - path:
                    prefix: /bim-gazpromcps/api/
                  rewrite: /api/
                  service: bim-api-gazpromcps-service.bim.svc.cluster.local
                  port: 80
                - path:
                    prefix: /bim-gazpromcps/files/
                  rewrite: /files/
                  service: bim-api-gazpromcps-service.bim.svc.cluster.local
                  port: 80

            bim-backend-v2-api-virt-service:
              namespace: gateway
              hosts:
                - aero.invest.sarex.io
              gateways:
                - gateway/main-gateway
              cors:
                allowHeaders:
                  - Authorization
                  - Content-Type
                allowMethods:
                  - GET
                  - POST
                  - PUT
                  - PATCH
                  - HEAD
                  - DELETE
              routes:
                - path:
                    prefix: /bim2-gazpromcps/api/
                  rewrite: /api/
                  service: bim-backend-v2-service.bim.svc.cluster.local
                  port: 80

            eav-virt-service:
              namespace: gateway
              hosts:
                - aero.invest.sarex.io
              gateways:
                - gateway/main-gateway
              cors:
                allowHeaders:
                  - Authorization
                  - Content-Type
                allowMethods:
                  - POST
                  - GET
                  - PATCH
                  - DELETE
                  - HEAD
                  - PUT
                  - OPTIONS
              routes:
                - path:
                    prefix: /eav/api/
                  rewrite: /api/
                  service: eav-service.eav.svc.cluster.local
                  port: 8000
                  noCors: true
                - path:
                    prefix: /eav/admin/
                  rewrite: /eav/admin/
                  service: eav-service.eav.svc.cluster.local
                  port: 8000

            api-virt-service:
              namespace: gateway
              hosts:
                - aero.invest.sarex.io
              gateways:
                - gateway/main-gateway
              cors:
                allowHeaders:
                  - Authorization
                  - Content-Type
                allowMethods:
                  - GET
                  - POST
                  - PUT
                  - PATCH
                  - HEAD
                  - DELETE
              routes:
                - path:
                    prefix: /workflows/api/
                  rewrite: /api/
                  service: workflows-backend-service.processing.svc.cluster.local
                  port: 80

            projects-frontend-static-virt-service:
              namespace: gateway
              hosts:
                - aero.invest.sarex.io
              gateways:
                - gateway/main-gateway
              cors:
                allowHeaders:
                  - Authorization
                  - Content-Type
                allowMethods:
                  - GET
                  - POST
                  - PUT
                  - PATCH
                  - HEAD
                  - DELETE
              routes:
                - path:
                    prefix: /projects/static/
                  rewrite: /
                  service: projects-frontend-static-service.projects.svc.cluster.local
                  port: 80
