From 0037411aaeb592066ecbdcc05dee5983fd501369 Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Wed, 28 Oct 2026 15:18:25 +0300 Subject: [PATCH] ++ stand camunda via vault --- clusters/stand/30-platform/kustomization.yaml | 1 + .../camunda/contour-template/camunda.yaml | 352 ++++++++++++++++++ .../contour-template/kustomization.yaml | 6 + 3 files changed, 359 insertions(+) create mode 100644 infrastructure/camunda/contour-template/camunda.yaml create mode 100644 infrastructure/camunda/contour-template/kustomization.yaml diff --git a/clusters/stand/30-platform/kustomization.yaml b/clusters/stand/30-platform/kustomization.yaml index c85a9e1..a375cd7 100644 --- a/clusters/stand/30-platform/kustomization.yaml +++ b/clusters/stand/30-platform/kustomization.yaml @@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../../infrastructure/zitadel/contour-template + - ../../../infrastructure/camunda/contour-template diff --git a/infrastructure/camunda/contour-template/camunda.yaml b/infrastructure/camunda/contour-template/camunda.yaml new file mode 100644 index 0000000..72df352 --- /dev/null +++ b/infrastructure/camunda/contour-template/camunda.yaml @@ -0,0 +1,352 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: camunda + namespace: camunda +spec: + dependsOn: [] + interval: 5m + timeout: 15m + postRenderers: + - kustomize: + patches: + - target: + group: apps + version: v1 + kind: Deployment + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: processing + - op: add + path: /spec/template/spec/tolerations + value: + - key: dedicated + operator: Equal + value: processing + effect: NoSchedule + - target: + group: apps + version: v1 + kind: StatefulSet + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: processing + - op: add + path: /spec/template/spec/tolerations + value: + - key: dedicated + operator: Equal + value: processing + effect: NoSchedule + - target: + group: batch + version: v1 + kind: Job + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: processing + - op: add + path: /spec/template/spec/tolerations + value: + - key: dedicated + operator: Equal + value: processing + effect: NoSchedule + - target: + group: apps + version: v1 + kind: Deployment + name: camunda-connectors + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: processing + - op: add + path: /spec/template/spec/tolerations + value: + - key: dedicated + operator: Equal + value: processing + effect: NoSchedule + - target: + group: apps + version: v1 + kind: Deployment + name: camunda-identity + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: processing + - op: add + path: /spec/template/spec/tolerations + value: + - key: dedicated + operator: Equal + value: processing + effect: NoSchedule + - target: + group: apps + version: v1 + kind: Deployment + name: camunda-operate + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: processing + - op: add + path: /spec/template/spec/tolerations + value: + - key: dedicated + operator: Equal + value: processing + effect: NoSchedule + - target: + group: apps + version: v1 + kind: Deployment + name: camunda-optimize + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: processing + - op: add + path: /spec/template/spec/tolerations + value: + - key: dedicated + operator: Equal + value: processing + effect: NoSchedule + - target: + group: apps + version: v1 + kind: Deployment + name: camunda-tasklist + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: processing + - op: add + path: /spec/template/spec/tolerations + value: + - key: dedicated + operator: Equal + value: processing + effect: NoSchedule + - target: + group: apps + version: v1 + kind: Deployment + name: camunda-zeebe-gateway + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: processing + - op: add + path: /spec/template/spec/tolerations + value: + - key: dedicated + operator: Equal + value: processing + effect: NoSchedule + - target: + group: apps + version: v1 + kind: StatefulSet + name: camunda-zeebe + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: processing + - op: add + path: /spec/template/spec/tolerations + value: + - key: dedicated + operator: Equal + value: processing + effect: NoSchedule + values: + global: + vault: + enabled: true + role: camunda-contour + authPath: auth/kubernetes + secrets: + postgresql: + path: secrets/data/camunda/identity-db + keys: + password: password + postgresPassword: password + image: + pullSecrets: + - name: regcred + identity: + auth: + publicIssuerUrl: "https://${HOST_CAMUNDA_KEYCLOAK}/auth/realms/camunda-platform" + identity: + redirectUrl: "https://${HOST_CAMUNDA_IDENTITY}" + operate: + redirectUrl: "https://${HOST_CAMUNDA}" + tasklist: + redirectUrl: "https://${HOST_CAMUNDA_TASKLIST}" + optimize: + redirectUrl: "https://${HOST_CAMUNDA_OPTIMIZE}" + identityPostgresql: + enabled: false + auth: + usePasswordFiles: true + primary: + automountServiceAccountToken: true + persistence: + size: 10Gi + storageClass: ${STORAGE_CLASS} + identityKeycloak: + externalDatabase: + host: pg-host.storage.svc.cluster.local + port: 5432 + user: bn_keycloak + database: bitnami_keycloak + password: "" + existingSecret: "" + existingSecretPasswordKey: password + postgresql: + enabled: false + auth: + usePasswordFiles: true + primary: + automountServiceAccountToken: true + persistence: + size: 10Gi + storageClass: ${STORAGE_CLASS} + vaultEnv: + enabled: true + role: camunda-contour + authPath: auth/kubernetes + envFiles: + KEYCLOAK_ADMIN_PASSWORD: + path: secrets/data/camunda/keycloak-admin + key: admin-password + KEYCLOAK_PASSWORD: + path: secrets/data/camunda/keycloak-admin + key: admin-password + KEYCLOAK_DATABASE_PASSWORD: + path: secrets/data/camunda/keycloak-db + key: password + global: + storageClass: ${STORAGE_CLASS} + tolerations: [] + elasticsearch: + sysctlImage: + registry: cr.yandex + repository: crp3ccidau046kdj8g9q/contour/camunda/os-shell + tag: 12-debian-12-r32 + pullSecrets: + - regcred + master: + replicaCount: 1 + podAntiAffinityPreset: soft + persistence: + size: 10Gi + storageClass: ${STORAGE_CLASS} + tolerations: [] + metrics: + enabled: false + serviceMonitor: + enabled: false + prometheusRule: + enabled: false + tolerations: [] + camundaCanary: + enabled: false + prometheusServiceMonitor: + enabled: false + console: + image: + pullSecrets: + - name: regcred + tolerations: [] + zeebe: + clusterSize: "1" + partitionCount: "1" + replicationFactor: "1" + pvcStorageClassName: ${STORAGE_CLASS} + image: + pullSecrets: + - name: regcred + tolerations: [] + zeebeGateway: + replicas: 1 + image: + pullSecrets: + - name: regcred + tolerations: [] + identity: + fullURL: "https://${HOST_CAMUNDA_IDENTITY}" + externalDatabase: + enabled: true + host: pg-host.storage.svc.cluster.local + port: 5432 + username: identity + database: identity + password: "" + existingSecret: "" + existingSecretPasswordKey: password + image: + pullSecrets: + - name: regcred + tolerations: [] + operate: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] + tasklist: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] + optimize: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] + executionIdentity: + image: + pullSecrets: + - name: regcred + tolerations: [] + webModeler: + image: + pullSecrets: + - name: regcred + restapi: + tolerations: [] + webapp: + tolerations: [] + websockets: + tolerations: [] + connectors: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] diff --git a/infrastructure/camunda/contour-template/kustomization.yaml b/infrastructure/camunda/contour-template/kustomization.yaml new file mode 100644 index 0000000..0c26313 --- /dev/null +++ b/infrastructure/camunda/contour-template/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: camunda.yaml