++ stand data layer

clusters/stand/20-data/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/postgresql/contour-template
+  - ../../../infrastructure/kafka/contour-template
+  - ../../../infrastructure/rabbitmq/contour-template

clusters/stand/layers.yaml

@@ -34,3 +34,22 @@ spec:
     substituteFrom:
       - kind: ConfigMap
         name: contour-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 20-data
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 20m0s
+  path: ./clusters/stand/20-data
+  prune: true
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars

infrastructure/kafka/contour-template/kafka.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kafka
+  namespace: kafka
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: kafka
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    global:
+      imagePullSecrets:
+        - regcred
+      defaultStorageClass: ${STORAGE_CLASS}
+    image:
+      pullSecrets:
+        - regcred
+    controller:
+      replicaCount: 1
+      automountServiceAccountToken: true
+      persistence:
+        size: 8Gi
+        storageClass: ${STORAGE_CLASS}
+      overrideConfiguration:
+        offsets.topic.replication.factor: 1
+        transaction.state.log.replication.factor: 1
+        transaction.state.log.min.isr: 1
+        default.replication.factor: 1
+        min.insync.replicas: 1
+    broker:
+      replicaCount: 0
+      automountServiceAccountToken: true
+    listeners:
+      client:
+        protocol: SASL_SSL
+        sslClientAuth: "none"
+    provisioning:
+      enabled: false
+    sasl:
+      managedExistingSecret:
+        enabled: false
+      existingSecret: ""
+      enabledMechanisms: PLAIN,SCRAM-SHA-512
+      interBrokerMechanism: PLAIN
+      controllerMechanism: PLAIN
+      client:
+        users: []
+        passwords: ""
+    tls:
+      type: PEM
+    vault:
+      enabled: true
+      role: kafka
+      authPath: auth/kubernetes
+      secretPath: secrets/data/kafka/bootstrap
+      clusterIdKey: clusterId
+      interBrokerPasswordKey: interBrokerPassword
+      controllerPasswordKey: controllerPassword

infrastructure/kafka/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: kafka.yaml

infrastructure/postgresql/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: postgresql.yaml

infrastructure/postgresql/contour-template/postgresql.yaml

@@ -0,0 +1,104 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: postgresql
+  namespace: postgresql
+spec:
+  interval: 5m
+  timeout: 2h
+
+  install:
+    timeout: 2h
+    remediation:
+      retries: 3
+
+  upgrade:
+    timeout: 2h
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      security:
+        allowInsecureImages: true
+      defaultStorageClass: ${STORAGE_CLASS}
+      postgresql:
+        auth:
+          username: ""
+          database: ""
+          secretKeys:
+            userPasswordKey: "postgres-password"
+    auth:
+      username: ""
+      database: ""
+      secretKeys:
+        userPasswordKey: "postgres-password"
+    image:
+      registry: cr.yandex/crp3ccidau046kdj8g9q
+      repository: contour/postgresql
+      tag: 17.0.7
+      pullPolicy: Always
+    metrics:
+      enabled: false
+      prometheusRule:
+        enabled: false
+    primary:
+      automountServiceAccountToken: true
+      containerSecurityContext:
+        readOnlyRootFilesystem: false
+      persistence:
+        storageClass: ${STORAGE_CLASS}
+        size: 20Gi
+      customLivenessProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 30
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      customReadinessProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 5
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      customStartupProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 30
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      nodeSelector:
+        dedicated: generic
+      tolerations: []
+    contour:
+      enabled: true
+      adminUser: "postgres"
+      vault:
+        enabled: true
+        role: postgresql-zitadel
+        authPath: auth/kubernetes
+        secretPath: secrets/data/postgresql-zitadel/admin
+        secretKey: postgres-password
+        usersSecretPath: secrets/data/zitadel/postgresql
+      sharedPreloadLibraries: "timescaledb,pg_stat_statements"
+      databases:
+        - name: zitadel
+          user: zitadel
+          passwordKey: password
+          extensions: []
+          restoreFromDump: false

infrastructure/rabbitmq/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: rabbitmq.yaml

infrastructure/rabbitmq/contour-template/rabbitmq.yaml

@@ -0,0 +1,104 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rabbitmq
+  namespace: rabbitmq
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: rabbitmq
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: cert-manager.io
+              version: v1
+              kind: Certificate
+              namespace: gateway
+              name: rmq-tls
+            patch: |-
+              $patch: delete
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: rmq-tls
+                namespace: gateway
+          - target:
+              group: networking.istio.io
+              version: v1beta1
+              kind: Gateway
+              namespace: gateway
+              name: rmq-gateway
+            patch: |-
+              $patch: delete
+              apiVersion: networking.istio.io/v1beta1
+              kind: Gateway
+              metadata:
+                name: rmq-gateway
+                namespace: gateway
+          - target:
+              group: networking.istio.io
+              version: v1
+              kind: VirtualService
+              namespace: rabbitmq
+              name: rmq-virt-service
+            patch: |-
+              $patch: delete
+              apiVersion: networking.istio.io/v1
+              kind: VirtualService
+              metadata:
+                name: rmq-virt-service
+                namespace: rabbitmq
+  values:
+    global:
+      security:
+        allowInsecureImages: true
+    virtualService: null
+    gateway: null
+    certificate: null
+    metrics:
+      serviceMonitor:
+        enabled: false
+        default:
+          enabled: false
+        perObject:
+          enabled: false
+        detailed:
+          enabled: false
+    extraServiceMonitors: []
+    replicaCount: 1
+    resources:
+      requests:
+        memory: 1Gi
+    persistence:
+      storageClass: ${STORAGE_CLASS}
+      size: 10Gi
+    auth:
+      securePassword: true
+      enableLoopbackUser: false
+      existingPasswordSecret: ""
+      vault:
+        enabled: true
+        role: rabbitmq
+        authPath: auth/kubernetes
+        secretPath: secrets/data/rabbitmq/auth
+        usernameKey: username
+        passwordKey: password
+    advancedConfiguration: |-
+      [
+        {rabbit, [
+          {loopback_users, []}
+        ]}
+      ].