++ route s3 domain through ingressgateway to nginx service

infrastructure/istio-config/vad/istio-config.yaml

@@ -104,3 +104,14 @@ spec:
                     prefix: /
                   service: rabbitmq.rabbitmq.svc.cluster.local
                   port: 15672
+            s3:
+              namespace: default
+              hosts:
+                - s3.sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: s3-proxy.s3-proxy.svc.cluster.local
+                  port: 80

infrastructure/s3-proxy/vad/configmap.yaml

@@ -12,20 +12,41 @@ data:
       worker_connections 1024;
     }
 
-    stream {
+    http {
+      access_log off;
+
       upstream minio_backend {
-        server 192.168.8.121:9000;
+        least_conn;
-        server 192.168.8.122:9000;
+        server 192.168.8.121:9000 max_fails=3 fail_timeout=10s;
-        server 192.168.8.123:9000;
+        server 192.168.8.122:9000 max_fails=3 fail_timeout=10s;
-        server 192.168.8.124:9000;
+        server 192.168.8.123:9000 max_fails=3 fail_timeout=10s;
+        server 192.168.8.124:9000 max_fails=3 fail_timeout=10s;
       }
 
       server {
-        listen 443 ssl;
+        listen 8080;
-        ssl_certificate /vault/secrets/tls.crt;
+        server_name _;
-        ssl_certificate_key /vault/secrets/tls.key;
+
-        proxy_pass minio_backend;
+        ignore_invalid_headers off;
-        proxy_connect_timeout 5s;
+        client_max_body_size 0;
-        proxy_timeout 300s;
+        proxy_buffering off;
+        proxy_request_buffering off;
+
+        location /healthz {
+          return 200 "ok\n";
+        }
+
+        location / {
+          proxy_http_version 1.1;
+          proxy_set_header Host $http_host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_connect_timeout 5s;
+          proxy_read_timeout 300s;
+          proxy_send_timeout 300s;
+          chunked_transfer_encoding off;
+          proxy_pass http://minio_backend;
+        }
       }
     }

infrastructure/s3-proxy/vad/deployment.yaml

@@ -4,7 +4,7 @@ metadata:
   name: s3-proxy
   namespace: s3-proxy
 spec:
-  replicas: 1
+  replicas: 2
   selector:
     matchLabels:
       app: s3-proxy
@@ -12,26 +12,10 @@ spec:
     metadata:
       labels:
         app: s3-proxy
-      annotations:
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/role: "s3-proxy"
-        vault.hashicorp.com/auth-path: "auth/kubernetes"
-        vault.hashicorp.com/agent-inject-secret-tls.crt: "secrets/data/s3-proxy/tls"
-        vault.hashicorp.com/agent-inject-template-tls.crt: |
-          {{- with secret "secrets/data/s3-proxy/tls" -}}
-          {{ .Data.data.tls_crt }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-tls.key: "secrets/data/s3-proxy/tls"
-        vault.hashicorp.com/agent-inject-template-tls.key: |
-          {{- with secret "secrets/data/s3-proxy/tls" -}}
-          {{ .Data.data.tls_key }}
-          {{- end -}}
     spec:
-      serviceAccountName: s3-proxy
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
       nodeSelector:
-        kubernetes.io/hostname: sarex-srv-generic-1
+        dedicated: generic
+      tolerations: []
       containers:
         - name: nginx
           image: nginx:1.25-alpine
@@ -40,9 +24,20 @@ spec:
               mountPath: /etc/nginx/nginx.conf
               subPath: nginx.conf
           ports:
-            - name: s3-tls
+            - name: http
-              containerPort: 443
+              containerPort: 8080
-              hostPort: 443
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 20
           resources:
             requests:
               cpu: 50m

infrastructure/s3-proxy/vad/kustomization.yaml

@@ -2,6 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
   - configmap.yaml
   - deployment.yaml
+  - service.yaml

infrastructure/s3-proxy/vad/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: s3-proxy
+  namespace: s3-proxy
+spec:
+  type: ClusterIP
+  selector:
+    app: s3-proxy
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP

infrastructure/s3-proxy/vad/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: s3-proxy
-  namespace: s3-proxy