Merge branch 'feature/outline-vk-infra' into 'master'

Outline в vk-infra

See merge request infra/iac!11

clusters/vk-infra/infrastructure/kustomization.yaml

@@ -12,3 +12,4 @@ resources:
   - ../../../infrastructure/kb/vk-infra
   - ../../../infrastructure/gitlab-runner/vk-infra
   - ../../../infrastructure/nexus/vk-infra
+  - ../../../infrastructure/outline/vk-infra

infrastructure/istio-config/vk-infra/istio-config.yaml

@@ -92,6 +92,17 @@ spec:
                 renewBefore: 360h0m0s
                 privateKey:
                   rotationPolicy: Always
+            wiki-tls:
+              dnsNames:
+                - wiki.sarex.space
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              spec:
+                duration: 2160h0m0s
+                renewBefore: 360h0m0s
+                privateKey:
+                  rotationPolicy: Always
         istio:
           gateways:
             vault:
@@ -150,6 +161,17 @@ spec:
                   tls:
                     credentialName: idp-tls
                     mode: SIMPLE
+            wiki:
+              name: wiki-gateway
+              namespace: istio-system
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - wiki.sarex.space
+                  tls:
+                    credentialName: wiki-tls
+                    mode: SIMPLE
           virtualServices:
             vault-virt-service:
               namespace: istio-system
@@ -217,3 +239,14 @@ spec:
                     prefix: /
                   service: idp.zitadel.svc.cluster.local
                   port: 8080
+            wiki-virt-service:
+              namespace: istio-system
+              hosts:
+                - wiki.sarex.space
+              gateways:
+                - istio-system/wiki-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: outline.outline.svc.cluster.local
+                  port: 80

infrastructure/outline/vk-infra/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - valkey.yaml
+  - outline.yaml

infrastructure/outline/vk-infra/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: outline
+  labels:
+    istio-injection: enabled

infrastructure/outline/vk-infra/outline.yaml

@@ -0,0 +1,139 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: outline
+  namespace: outline
+spec:
+  interval: 10m
+  timeout: 10m
+  chart:
+    spec:
+      chart: outline
+      version: "0.1.0"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  dependsOn:
+    - name: istiod
+      namespace: istio-system
+    - name: outline-valkey
+      namespace: outline
+  values:
+    universal-chart:
+      global:
+        env: infra
+      image:
+        name:
+          infra: cr.yandex/crp3ccidau046kdj8g9q/outlinewiki/outline:1.12.0
+      envs:
+        - name: NODE_ENV
+          value:
+            _default: production
+        - name: URL
+          value:
+            _default: https://wiki.sarex.space
+        - name: PORT
+          value:
+            _default: "3000"
+        - name: WEB_CONCURRENCY
+          value:
+            _default: "1"
+        # TLS терминируется на istio ingressgateway
+        - name: FORCE_HTTPS
+          value:
+            _default: "false"
+        - name: ENABLE_UPDATES
+          value:
+            _default: "false"
+        - name: LOG_LEVEL
+          value:
+            _default: info
+        - name: PGSSLMODE
+          value:
+            _default: require
+        - name: FILE_STORAGE
+          value:
+            _default: s3
+        - name: AWS_REGION
+          value:
+            _default: ru-msk
+        - name: AWS_S3_UPLOAD_BUCKET_URL
+          value:
+            _default: https://hb.ru-msk.vkcloud-storage.ru
+        - name: AWS_S3_UPLOAD_BUCKET_NAME
+          value:
+            _default: sarex-wiki
+        - name: AWS_S3_FORCE_PATH_STYLE
+          value:
+            _default: "true"
+        - name: AWS_S3_ACL
+          value:
+            _default: private
+        # VK Object Storage документирует presigned PUT; presigned POST не описан
+        - name: AWS_S3_UPLOAD_METHOD
+          value:
+            _default: put
+        - name: OIDC_DISPLAY_NAME
+          value:
+            _default: Sarex IAM
+        - name: OIDC_AUTH_URI
+          value:
+            _default: https://iam.sarex.io/oauth/v2/authorize
+        - name: OIDC_TOKEN_URI
+          value:
+            _default: https://iam.sarex.io/oauth/v2/token
+        - name: OIDC_USERINFO_URI
+          value:
+            _default: https://iam.sarex.io/oidc/v1/userinfo
+        - name: OIDC_LOGOUT_URI
+          value:
+            _default: https://iam.sarex.io/oidc/v1/end_session
+        - name: OIDC_USERNAME_CLAIM
+          value:
+            _default: preferred_username
+        - name: OIDC_SCOPES
+          value:
+            _default: openid profile email offline_access
+        # SMTP подключается отдельным шагом: добавить SMTP_HOST, SMTP_PORT,
+        # SMTP_FROM_EMAIL сюда и SMTP_USERNAME, SMTP_PASSWORD в secretEnvs.
+      secretEnvs:
+        - name: SECRET_KEY
+          secretName:
+            _default: outline
+          secretKey: SECRET_KEY
+        - name: UTILS_SECRET
+          secretName:
+            _default: outline
+          secretKey: UTILS_SECRET
+        - name: DATABASE_URL
+          secretName:
+            _default: outline
+          secretKey: DATABASE_URL
+        - name: REDIS_URL
+          secretName:
+            _default: outline
+          secretKey: REDIS_URL
+        - name: AWS_ACCESS_KEY_ID
+          secretName:
+            _default: outline
+          secretKey: AWS_ACCESS_KEY_ID
+        - name: AWS_SECRET_ACCESS_KEY
+          secretName:
+            _default: outline
+          secretKey: AWS_SECRET_ACCESS_KEY
+        - name: OIDC_CLIENT_ID
+          secretName:
+            _default: outline
+          secretKey: OIDC_CLIENT_ID
+        - name: OIDC_CLIENT_SECRET
+          secretName:
+            _default: outline
+          secretKey: OIDC_CLIENT_SECRET

infrastructure/outline/vk-infra/valkey.yaml

@@ -0,0 +1,62 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: outline-valkey
+  namespace: outline
+spec:
+  interval: 10m
+  timeout: 10m
+  chart:
+    spec:
+      chart: valkey
+      version: "0.1.0"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    fullnameOverride: outline-valkey
+    image:
+      registry: cr.yandex
+      repository: crp3ccidau046kdj8g9q/valkey/valkey
+      tag: 8.0.2-debian-12-r6
+    global:
+      imagePullSecrets:
+        - istio-registry-secret
+      security:
+        allowInsecureImages: true
+    architecture: standalone
+    auth:
+      enabled: true
+      sentinel: false
+      existingSecret: outline-valkey
+      existingSecretPasswordKey: valkey-password
+    # Outline хранит в Valkey очереди фоновых задач и состояние websocket.
+    # Персистентность не нужна, вытеснение ключей недопустимо для очередей.
+    commonConfiguration: |-
+      appendonly no
+      save ""
+      maxmemory 256mb
+      maxmemory-policy noeviction
+    primary:
+      podAnnotations:
+        sidecar.istio.io/inject: "false"
+      nodeSelector:
+        sarex.io/pool: svc
+      resources:
+        requests:
+          cpu: 50m
+          memory: 128Mi
+        limits:
+          memory: 384Mi
+      persistence:
+        enabled: false
+    metrics:
+      enabled: false