diff --git a/clusters/vad/kustomization.yaml b/clusters/vad/kustomization.yaml index ad0124e..754ac83 100644 --- a/clusters/vad/kustomization.yaml +++ b/clusters/vad/kustomization.yaml @@ -9,3 +9,6 @@ resources: - ../../infrastructure/istio-gateway/vad - ../../infrastructure/vault/vad - ../../infrastructure/rabbitmq/vad + - ../../infrastructure/kafka/vad + - ../../infrastructure/camunda/vad + - ../../infrastructure/zitadel/vad diff --git a/infrastructure/camunda/vad/camunda.yaml b/infrastructure/camunda/vad/camunda.yaml new file mode 100644 index 0000000..2e27b3e --- /dev/null +++ b/infrastructure/camunda/vad/camunda.yaml @@ -0,0 +1,328 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: camunda + namespace: camunda +spec: + dependsOn: [] + interval: 5m + timeout: 15m + postRenderers: + - kustomize: + patches: + - target: + group: apps + version: v1 + kind: Deployment + namespace: camunda + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: apps + version: v1 + kind: StatefulSet + namespace: camunda + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: batch + version: v1 + kind: Job + namespace: camunda + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: apps + version: v1 + kind: Deployment + namespace: camunda + name: camunda-connectors + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: apps + version: v1 + kind: Deployment + namespace: camunda + name: camunda-identity + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: apps + version: v1 + kind: Deployment + namespace: camunda + name: camunda-operate + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: apps + version: v1 + kind: Deployment + namespace: camunda + name: camunda-optimize + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: apps + version: v1 + kind: Deployment + namespace: camunda + name: camunda-tasklist + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: apps + version: v1 + kind: Deployment + namespace: camunda + name: camunda-zeebe-gateway + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: apps + version: v1 + kind: StatefulSet + namespace: camunda + name: camunda-zeebe + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + values: + global: + vault: + enabled: true + role: camunda + authPath: auth/kubernetes + secrets: + postgresql: + path: secrets/data/camunda/postgresql + keys: + password: identity-password + postgresPassword: postgres-password + image: + pullSecrets: + - name: regcred + identity: + auth: + publicIssuerUrl: "https://camunda-keycloak.sarex.vadroad.ru/auth/realms/camunda-platform" + identity: + redirectUrl: "https://camunda-identity.sarex.vadroad.ru" + operate: + redirectUrl: "https://camunda.sarex.vadroad.ru" + tasklist: + redirectUrl: "https://camunda-tasklist.sarex.vadroad.ru" + optimize: + redirectUrl: "https://camunda-optimize.sarex.vadroad.ru" + webModeler: + redirectUrl: "https://camunda-web-modeler.contour.infra.sarex.tech" + console: + redirectUrl: "https://camunda-console.contour.infra.sarex.tech" + identityPostgresql: + enabled: false + auth: + usePasswordFiles: true + primary: + automountServiceAccountToken: true + persistence: + size: 10Gi + storageClass: local-path + identityKeycloak: + externalDatabase: + host: 192.168.8.131 + port: 5432 + user: bn_keycloak + database: bitnami_keycloak + password: "" + existingSecret: "" + existingSecretPasswordKey: password + postgresql: + enabled: false + auth: + usePasswordFiles: true + primary: + automountServiceAccountToken: true + persistence: + size: 10Gi + storageClass: local-path + vaultEnv: + enabled: true + role: camunda + authPath: auth/kubernetes + envFiles: + KEYCLOAK_ADMIN_PASSWORD: + path: secrets/data/camunda/keycloak-admin + key: admin-password + KEYCLOAK_PASSWORD: + path: secrets/data/camunda/keycloak-admin + key: admin-password + KEYCLOAK_DATABASE_PASSWORD: + path: secrets/data/camunda/postgresql + key: keycloak-password + global: + storageClass: local-path + tolerations: [] + postgresql: + auth: + usePasswordFiles: true + primary: + automountServiceAccountToken: true + persistence: + size: 10Gi + storageClass: local-path + elasticsearch: + master: + replicaCount: 1 + podAntiAffinityPreset: soft + persistence: + size: 10Gi + storageClass: local-path + tolerations: [] + metrics: + enabled: false + serviceMonitor: + enabled: false + prometheusRule: + enabled: false + tolerations: [] + camundaCanary: + enabled: false + prometheusServiceMonitor: + enabled: false + console: + image: + pullSecrets: + - name: regcred + tolerations: [] + zeebe: + clusterSize: "1" + partitionCount: "1" + replicationFactor: "1" + pvcStorageClassName: local-path + image: + pullSecrets: + - name: regcred + tolerations: [] + zeebeGateway: + replicas: 1 + image: + pullSecrets: + - name: regcred + tolerations: [] + identity: + fullURL: "https://camunda-identity.sarex.vadroad.ru" + externalDatabase: + enabled: true + host: 192.168.8.131 + port: 5432 + username: identity + database: identity + password: "" + existingSecret: "" + existingSecretPasswordKey: password + image: + pullSecrets: + - name: regcred + tolerations: [] + operate: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] + tasklist: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] + optimize: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] + executionIdentity: + image: + pullSecrets: + - name: regcred + tolerations: [] + webModeler: + image: + pullSecrets: + - name: regcred + restapi: + tolerations: [] + webapp: + tolerations: [] + websockets: + tolerations: [] + connectors: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] diff --git a/infrastructure/camunda/vad/kustomization.yaml b/infrastructure/camunda/vad/kustomization.yaml new file mode 100644 index 0000000..0c26313 --- /dev/null +++ b/infrastructure/camunda/vad/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: camunda.yaml diff --git a/infrastructure/kafka/vad/kafka.yaml b/infrastructure/kafka/vad/kafka.yaml new file mode 100644 index 0000000..54e3e12 --- /dev/null +++ b/infrastructure/kafka/vad/kafka.yaml @@ -0,0 +1,73 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kafka + namespace: kafka +spec: + interval: 5m + timeout: 10m + postRenderers: + - kustomize: + patches: + - target: + group: apps + version: v1 + kind: StatefulSet + namespace: kafka + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + values: + global: + imagePullSecrets: + - regcred + defaultStorageClass: local-path + image: + pullSecrets: + - regcred + controller: + replicaCount: 1 + automountServiceAccountToken: true + persistence: + size: 8Gi + storageClass: local-path + overrideConfiguration: + offsets.topic.replication.factor: 1 + transaction.state.log.replication.factor: 1 + transaction.state.log.min.isr: 1 + default.replication.factor: 1 + min.insync.replicas: 1 + broker: + replicaCount: 0 + automountServiceAccountToken: true + listeners: + client: + protocol: SASL_SSL + sslClientAuth: "none" + provisioning: + enabled: false + sasl: + managedExistingSecret: + enabled: false + existingSecret: "" + enabledMechanisms: PLAIN,SCRAM-SHA-512 + interBrokerMechanism: PLAIN + controllerMechanism: PLAIN + client: + users: [] + passwords: "" + tls: + type: PEM + vault: + enabled: true + role: kafka + authPath: auth/kubernetes + secretPath: secrets/data/kafka/bootstrap + clusterIdKey: clusterId + interBrokerPasswordKey: interBrokerPassword + controllerPasswordKey: controllerPassword diff --git a/infrastructure/kafka/vad/kustomization.yaml b/infrastructure/kafka/vad/kustomization.yaml new file mode 100644 index 0000000..f60b1c1 --- /dev/null +++ b/infrastructure/kafka/vad/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: kafka.yaml diff --git a/infrastructure/zitadel/vad/kustomization.yaml b/infrastructure/zitadel/vad/kustomization.yaml new file mode 100644 index 0000000..17fee7c --- /dev/null +++ b/infrastructure/zitadel/vad/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: zitadel.yaml diff --git a/infrastructure/zitadel/vad/zitadel.yaml b/infrastructure/zitadel/vad/zitadel.yaml new file mode 100644 index 0000000..2974ae6 --- /dev/null +++ b/infrastructure/zitadel/vad/zitadel.yaml @@ -0,0 +1,154 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: zitadel + namespace: zitadel +spec: + interval: 5m + timeout: 10m + postRenderers: + - kustomize: + patches: + - target: + group: apps + version: v1 + kind: Deployment + name: zitadel-idp-contour + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - op: replace + path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml + value: |- + {{- with secret "secrets/data/zitadel/postgresql" -}} + Database: + postgres: + User: + Password: |- + {{ index .Data.data "password" }} + Admin: + Password: |- + {{ index .Data.data "adminPassword" }} + FirstInstance: + Org: + Human: + Password: |- + {{ index .Data.data "humanPassword" }} + {{- end -}} + - target: + group: batch + version: v1 + kind: Job + name: zitadel-idp-contour-init + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - op: replace + path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml + value: |- + {{- with secret "secrets/data/zitadel/postgresql" -}} + Database: + postgres: + User: + Password: |- + {{ index .Data.data "password" }} + Admin: + Password: |- + {{ index .Data.data "adminPassword" }} + FirstInstance: + Org: + Human: + Password: |- + {{ index .Data.data "humanPassword" }} + {{- end -}} + - target: + group: batch + version: v1 + kind: Job + name: zitadel-idp-contour-setup + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + dedicated: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - op: replace + path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml + value: |- + {{- with secret "secrets/data/zitadel/postgresql" -}} + Database: + postgres: + User: + Password: |- + {{ index .Data.data "password" }} + Admin: + Password: |- + {{ index .Data.data "adminPassword" }} + FirstInstance: + Org: + Human: + Password: |- + {{ index .Data.data "humanPassword" }} + {{- end -}} + values: + zitadel: + configmapConfig: + ExternalDomain: login.sarex.vadroad.ru + ExternalSecure: true + debug: + enabled: false + postgresqlSecret: + create: false + vault: + enabled: true + role: zitadel + authPath: auth/kubernetes + secretPath: secrets/data/zitadel/postgresql + secretKey: password + kvVersion: 2 + fileName: zitadel-vault-config.yaml + serviceAccount: + create: true + name: zitadel + replicaCount: 1 + pdb: + enabled: false + env: + - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED + value: "false" + - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS + value: "bcrypt,pbkdf2" + - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED + value: "true" + - name: ZITADEL_DATABASE_POSTGRES_HOST + value: "192.168.8.131" + - name: ZITADEL_DATABASE_POSTGRES_PORT + value: "5432" + - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME + value: "zitadel" + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE + value: "zitadel" + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME + value: "postgres" + - name: ZITADEL_DATABASE_POSTGRES_DATABASE + value: "zitadel" + - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE + value: "disable" + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE + value: "disable" + - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME + value: "zitadel-admin" + - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME + value: "Sarex"