From a3fa7ba4c0b191482e9622f83910306128c71966 Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Wed, 28 Oct 2026 10:37:30 +0300 Subject: [PATCH] ++ stand data layer --- clusters/stand/20-data/kustomization.yaml | 6 + clusters/stand/layers.yaml | 19 ++++ .../kafka/contour-template/kafka.yaml | 73 ++++++++++++ .../kafka/contour-template/kustomization.yaml | 6 + .../contour-template/kustomization.yaml | 6 + .../contour-template/postgresql.yaml | 104 ++++++++++++++++++ .../contour-template/kustomization.yaml | 6 + .../rabbitmq/contour-template/rabbitmq.yaml | 104 ++++++++++++++++++ 8 files changed, 324 insertions(+) create mode 100644 clusters/stand/20-data/kustomization.yaml create mode 100644 infrastructure/kafka/contour-template/kafka.yaml create mode 100644 infrastructure/kafka/contour-template/kustomization.yaml create mode 100644 infrastructure/postgresql/contour-template/kustomization.yaml create mode 100644 infrastructure/postgresql/contour-template/postgresql.yaml create mode 100644 infrastructure/rabbitmq/contour-template/kustomization.yaml create mode 100644 infrastructure/rabbitmq/contour-template/rabbitmq.yaml diff --git a/clusters/stand/20-data/kustomization.yaml b/clusters/stand/20-data/kustomization.yaml new file mode 100644 index 0000000..77498c9 --- /dev/null +++ b/clusters/stand/20-data/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../../../infrastructure/postgresql/contour-template + - ../../../infrastructure/kafka/contour-template + - ../../../infrastructure/rabbitmq/contour-template diff --git a/clusters/stand/layers.yaml b/clusters/stand/layers.yaml index e5f1592..5b6200e 100644 --- a/clusters/stand/layers.yaml +++ b/clusters/stand/layers.yaml @@ -34,3 +34,22 @@ spec: substituteFrom: - kind: ConfigMap name: contour-vars +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: 20-data + namespace: flux-system +spec: + interval: 10m0s + timeout: 20m0s + path: ./clusters/stand/20-data + prune: true + wait: true + sourceRef: + kind: GitRepository + name: flux-system + postBuild: + substituteFrom: + - kind: ConfigMap + name: contour-vars diff --git a/infrastructure/kafka/contour-template/kafka.yaml b/infrastructure/kafka/contour-template/kafka.yaml new file mode 100644 index 0000000..96e7ae0 --- /dev/null +++ b/infrastructure/kafka/contour-template/kafka.yaml @@ -0,0 +1,73 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kafka + namespace: kafka +spec: + interval: 5m + timeout: 10m + postRenderers: + - kustomize: + patches: + - target: + group: apps + version: v1 + kind: StatefulSet + namespace: kafka + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + values: + global: + imagePullSecrets: + - regcred + defaultStorageClass: ${STORAGE_CLASS} + image: + pullSecrets: + - regcred + controller: + replicaCount: 1 + automountServiceAccountToken: true + persistence: + size: 8Gi + storageClass: ${STORAGE_CLASS} + overrideConfiguration: + offsets.topic.replication.factor: 1 + transaction.state.log.replication.factor: 1 + transaction.state.log.min.isr: 1 + default.replication.factor: 1 + min.insync.replicas: 1 + broker: + replicaCount: 0 + automountServiceAccountToken: true + listeners: + client: + protocol: SASL_SSL + sslClientAuth: "none" + provisioning: + enabled: false + sasl: + managedExistingSecret: + enabled: false + existingSecret: "" + enabledMechanisms: PLAIN,SCRAM-SHA-512 + interBrokerMechanism: PLAIN + controllerMechanism: PLAIN + client: + users: [] + passwords: "" + tls: + type: PEM + vault: + enabled: true + role: kafka + authPath: auth/kubernetes + secretPath: secrets/data/kafka/bootstrap + clusterIdKey: clusterId + interBrokerPasswordKey: interBrokerPassword + controllerPasswordKey: controllerPassword diff --git a/infrastructure/kafka/contour-template/kustomization.yaml b/infrastructure/kafka/contour-template/kustomization.yaml new file mode 100644 index 0000000..f60b1c1 --- /dev/null +++ b/infrastructure/kafka/contour-template/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: kafka.yaml diff --git a/infrastructure/postgresql/contour-template/kustomization.yaml b/infrastructure/postgresql/contour-template/kustomization.yaml new file mode 100644 index 0000000..f7fbc19 --- /dev/null +++ b/infrastructure/postgresql/contour-template/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: postgresql.yaml diff --git a/infrastructure/postgresql/contour-template/postgresql.yaml b/infrastructure/postgresql/contour-template/postgresql.yaml new file mode 100644 index 0000000..e8b07b7 --- /dev/null +++ b/infrastructure/postgresql/contour-template/postgresql.yaml @@ -0,0 +1,104 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: postgresql + namespace: postgresql +spec: + interval: 5m + timeout: 2h + + install: + timeout: 2h + remediation: + retries: 3 + + upgrade: + timeout: 2h + remediation: + retries: 3 + + values: + global: + security: + allowInsecureImages: true + defaultStorageClass: ${STORAGE_CLASS} + postgresql: + auth: + username: "" + database: "" + secretKeys: + userPasswordKey: "postgres-password" + auth: + username: "" + database: "" + secretKeys: + userPasswordKey: "postgres-password" + image: + registry: cr.yandex/crp3ccidau046kdj8g9q + repository: contour/postgresql + tag: 17.0.7 + pullPolicy: Always + metrics: + enabled: false + prometheusRule: + enabled: false + primary: + automountServiceAccountToken: true + containerSecurityContext: + readOnlyRootFilesystem: false + persistence: + storageClass: ${STORAGE_CLASS} + size: 20Gi + customLivenessProbe: + exec: + command: + - /bin/sh + - -c + - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432 + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 6 + customReadinessProbe: + exec: + command: + - /bin/sh + - -c + - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 6 + customStartupProbe: + exec: + command: + - /bin/sh + - -c + - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432 + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 6 + nodeSelector: + dedicated: generic + tolerations: [] + contour: + enabled: true + adminUser: "postgres" + vault: + enabled: true + role: postgresql-zitadel + authPath: auth/kubernetes + secretPath: secrets/data/postgresql-zitadel/admin + secretKey: postgres-password + usersSecretPath: secrets/data/zitadel/postgresql + sharedPreloadLibraries: "timescaledb,pg_stat_statements" + databases: + - name: zitadel + user: zitadel + passwordKey: password + extensions: [] + restoreFromDump: false diff --git a/infrastructure/rabbitmq/contour-template/kustomization.yaml b/infrastructure/rabbitmq/contour-template/kustomization.yaml new file mode 100644 index 0000000..e9a2db5 --- /dev/null +++ b/infrastructure/rabbitmq/contour-template/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: rabbitmq.yaml diff --git a/infrastructure/rabbitmq/contour-template/rabbitmq.yaml b/infrastructure/rabbitmq/contour-template/rabbitmq.yaml new file mode 100644 index 0000000..42d02ff --- /dev/null +++ b/infrastructure/rabbitmq/contour-template/rabbitmq.yaml @@ -0,0 +1,104 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: rabbitmq + namespace: rabbitmq +spec: + interval: 5m + timeout: 10m + postRenderers: + - kustomize: + patches: + - target: + group: apps + version: v1 + kind: StatefulSet + namespace: rabbitmq + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: cert-manager.io + version: v1 + kind: Certificate + namespace: gateway + name: rmq-tls + patch: |- + $patch: delete + apiVersion: cert-manager.io/v1 + kind: Certificate + metadata: + name: rmq-tls + namespace: gateway + - target: + group: networking.istio.io + version: v1beta1 + kind: Gateway + namespace: gateway + name: rmq-gateway + patch: |- + $patch: delete + apiVersion: networking.istio.io/v1beta1 + kind: Gateway + metadata: + name: rmq-gateway + namespace: gateway + - target: + group: networking.istio.io + version: v1 + kind: VirtualService + namespace: rabbitmq + name: rmq-virt-service + patch: |- + $patch: delete + apiVersion: networking.istio.io/v1 + kind: VirtualService + metadata: + name: rmq-virt-service + namespace: rabbitmq + values: + global: + security: + allowInsecureImages: true + virtualService: null + gateway: null + certificate: null + metrics: + serviceMonitor: + enabled: false + default: + enabled: false + perObject: + enabled: false + detailed: + enabled: false + extraServiceMonitors: [] + replicaCount: 1 + resources: + requests: + memory: 1Gi + persistence: + storageClass: ${STORAGE_CLASS} + size: 10Gi + auth: + securePassword: true + enableLoopbackUser: false + existingPasswordSecret: "" + vault: + enabled: true + role: rabbitmq + authPath: auth/kubernetes + secretPath: secrets/data/rabbitmq/auth + usernameKey: username + passwordKey: password + advancedConfiguration: |- + [ + {rabbit, [ + {loopback_users, []} + ]} + ].