++ camunda legacy wait

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -5,6 +5,7 @@ include:
 stages:
   - build
   - slices
+  - slices-publish
 
 variables:
   RELEASE_NAME: iac-offline
@@ -35,7 +36,7 @@ build_offline_mirror:
     - docker push ${CR}/${RELEASE_NAME}:latest
   timeout: 30m
 
-publish_contour_slices:
+generate_slice_jobs:
   stage: slices
   image: ${CR}/infra/slice-builder:1.0.0
   tags:
@@ -45,7 +46,20 @@ publish_contour_slices:
   variables:
     GIT_DEPTH: "1"
   script:
-    - printf '%s' "$SLICES_PUSHER_KEY" | base64 -d > /tmp/slices-key.json
+    - python3 ci/publish-slice.py generate --release "$CI_COMMIT_TAG" --commit "$CI_COMMIT_SHA" --out slices-pipeline.yml
-    - python3 ci/publish-slices.py --repo . --release "$CI_COMMIT_TAG" --commit "$CI_COMMIT_SHA" --key-file /tmp/slices-key.json
+    - cat slices-pipeline.yml
-  after_script:
+  artifacts:
-    - rm -f /tmp/slices-key.json
+    paths:
+      - slices-pipeline.yml
+
+publish_contour_slices:
+  stage: slices-publish
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v?(?:\d+\.){2}\d+$/
+  needs:
+    - generate_slice_jobs
+  trigger:
+    include:
+      - artifact: slices-pipeline.yml
+        job: generate_slice_jobs
+    strategy: depend

apps/control-interface/uralkal/psql-tools-debug.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: debug
-          image: cr.yandex/crp3ccidau046kdj8g9q/mc-files:dev9
+          image: cr.yandex/crp3ccidau046kdj8g9q/mc-files:dev5
           imagePullPolicy: IfNotPresent
           command: ["/bin/sh", "-c", "while true; do sleep 3600; done"]
       imagePullSecrets:

apps/django/d8-ugmk-prod/backend.yaml

@@ -8,6 +8,9 @@ spec:
   values:
     services:
       backend:
+        deployment:
+          replicaCount:
+            _default: 2
         envs:
           - name: ALLOWED_HOSTS
             value:

apps/documentations/base/api.yaml

@@ -65,7 +65,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_fef3add2
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_89c8039a
           pullPolicy:
             _default: IfNotPresent
         service:
@@ -89,6 +89,9 @@ spec:
           - name: POSTGRES_POOL_SIZE
             value:
               _default: "20"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
           - name: USE_LEGACY_BIM_FLOW
             value:
               _default: "true"
@@ -236,6 +239,9 @@ spec:
           - name: VALKEY_PORT
             value:
               _default: "6379"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
         podAnnotations:
           _default:
             traffic.sidecar.istio.io/excludeOutboundPorts: "8200"

apps/documentations/base/filestream.yaml

@@ -97,6 +97,9 @@ spec:
           - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
             value:
               _default: "true"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
           - name: USE_ZITADEL
             value:
               _default: "1"
@@ -223,6 +226,9 @@ spec:
           - name: VALKEY_PORT
             value:
               _default: "6379"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
         podAnnotations:
           _default:
             traffic.sidecar.istio.io/excludeOutboundPorts: "8200"

apps/documentations/d8-ugmk-prod/api.yaml

@@ -156,3 +156,6 @@ spec:
           - name: VALKEY_PORT
             value:
               _default: "6379"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"

apps/documentations/d8-ugmk-prod/filestream.yaml

@@ -144,3 +144,6 @@ spec:
           - name: VALKEY_PORT
             value:
               _default: "6379"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"

apps/documentations/wb/api.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_0be18f51
           pullPolicy:
             _default: IfNotPresent
 
@@ -135,6 +135,10 @@ spec:
             value:
               _default: "20"
           
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
+
           - name: ZITADEL_ACCOUNT
             value:
               _default: "/etc/sarex/zitadel/zitadel-account.json"

apps/documentations/wb/filestream.yaml

@@ -138,6 +138,10 @@ spec:
             value:
               _default: "0.0.0.0:8080"
           
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
+
           - name: API_ADDRESS_FILE
             value:
               _default: "0.0.0.0:8080"

apps/eav/wb/django-configmap.yaml

@@ -18,7 +18,7 @@ data:
 
     # DEBUG SETTINGS START
     # ---------------------------------------------------------------------------------------------------------------------
-    DEBUG = True
+    DEBUG = False
     ALLOWED_HOSTS = ['*']
     # ---------------------------------------------------------------------------------------------------------------------
     # DEBUG SETTINGS END

apps/flows/d8-ugmk-prod/backend.yaml

@@ -9,6 +9,8 @@ spec:
     services:
       backend:
         deployment:
+          replicaCount:
+            _default: 2
           args:
             _default:
               - |

apps/issues/wb/production-configmap.yaml

@@ -12,7 +12,6 @@ data:
 
     # DEBUG SETTINGS START
     # -----------------------------------------------------------------------------
-    DEBUG = True
     # -----------------------------------------------------------------------------
 
     TEST_MODE = False
@@ -40,7 +39,7 @@ data:
 
     # DEBUG SETTINGS START
     # -----------------------------------------------------------------------------
-    DEBUG = True
+    DEBUG = False
     # -----------------------------------------------------------------------------
 
     REVIEW_HOST='http://backend-service.flows.svc.cluster.local:8000'

apps/processing/base/engine-low.yaml

@@ -142,6 +142,10 @@ spec:
             value:
               _default: "0"
 
+          - name: IGNORE_RESOURCES
+            value:
+              _default: "True"
+
           - name: DJANGO_HOST
             value:
               _default: "http://backend.django.svc.cluster.local:8000"

apps/processing/uralkal/engine-low.yaml

@@ -8,6 +8,9 @@ spec:
   values:
     services:
       backend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_7d2cd329
         deployment:
           resources:
             requests:

apps/workspaces/base/frontend.yaml

@@ -29,7 +29,7 @@ spec:
         enabled: true
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_a72e3265
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_2da2a00e
           pullPolicy:
             _default: IfNotPresent
         deployment:

apps/workspaces/ugok/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_07373a45
+            _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_1b5d64e4
           pullPolicy:
             _default: IfNotPresent
 

ci/build-slice.py

@@ -68,7 +68,7 @@ def collect(repo: Path, start: str) -> tuple[set[PurePosixPath], list[str]]:
         try:
             return PurePosixPath(p.resolve().relative_to(repo).as_posix())
         except ValueError:
-            raise SliceError(f"ссылка за пределы репозитория: {p}")
+            raise SliceError(f"reference outside the repository: {p}")
 
     def add_file(p: Path):
         r = rel(p)
@@ -86,21 +86,21 @@ def collect(repo: Path, start: str) -> tuple[set[PurePosixPath], list[str]]:
         seen_dirs.add(d)
         kfile = kustomization_file(d)
         if kfile is None:
-            raise SliceError(f"нет kustomization.yaml в {rel(d)}")
+            raise SliceError(f"no kustomization.yaml in {rel(d)}")
         if entry:
             entries.append(str(rel(d)))
         add_file(kfile)
         doc = yaml.safe_load(kfile.read_text()) or {}
         for ref in local_refs(doc):
             if is_remote(ref):
-                raise SliceError(f"удалённая ссылка {ref} в {rel(kfile)}")
+                raise SliceError(f"remote reference {ref} in {rel(kfile)}")
             target = (d / ref)
             if target.is_dir():
                 visit_dir(target)
             elif target.is_file():
                 add_file(target)
             else:
-                raise SliceError(f"ссылка {ref} в {rel(kfile)} никуда не ведёт")
+                raise SliceError(f"reference {ref} in {rel(kfile)} does not exist")
 
     visit_dir(repo / start, entry=True)
     return files, sorted(set(entries))
@@ -124,7 +124,7 @@ def write_tar(repo: Path, files: set[PurePosixPath], out: Path):
 def kustomize_build(path: Path) -> bytes:
     p = subprocess.run(["kubectl", "kustomize", str(path)], capture_output=True)
     if p.returncode != 0:
-        raise SliceError(f"kustomize build {path}: {p.stderr.decode().strip()}")
+        raise SliceError(f"kustomize build {path} failed: {p.stderr.decode().strip()}")
     return p.stdout
 
 
@@ -135,7 +135,7 @@ def verify(repo: Path, out: Path, entries: list[str]):
             tar.extractall(tmp, filter="data")
         for e in entries:
             if kustomize_build(repo / e) != kustomize_build(Path(tmp) / e):
-                raise SliceError(f"build {e} в срезе отличается от полного репозитория")
+                raise SliceError(f"kustomize build of {e} differs between slice and full repository")
 
 
 def main() -> int:
@@ -153,9 +153,9 @@ def main() -> int:
         if not args.no_verify:
             verify(repo, out, entries)
     except SliceError as e:
-        print(f"срез {args.contour}: {e}", file=sys.stderr)
+        print(f"slice {args.contour}: {e}", file=sys.stderr)
         return 1
-    print(f"срез {args.contour}: {len(files)} файлов, слоёв {len(entries)}: {', '.join(entries)}")
+    print(f"slice {args.contour}: {len(files)} files, entry points: {', '.join(entries)}")
     return 0
 
 

ci/publish-slice.py

@@ -4,10 +4,10 @@ import base64
 import hashlib
 import importlib.util
 import json
-import os
 import re
 import sys
 import tempfile
+import time
 import urllib.error
 import urllib.parse
 import urllib.request
@@ -22,10 +22,10 @@ spec.loader.exec_module(bs)
 
 REGISTRY_HOST = "cr.yandex"
 SLICE_REGISTRY = "crpct2b2lsmao4nm0cjk"
-INSTALLER_GITEA_URL = "http://gitea.gitea.svc:3000/infra/iac.git"
 CONFIG_TYPE = "application/vnd.sarex.slice.config.v1+json"
 LAYER_TYPE = "application/vnd.oci.image.layer.v1.tar"
 MANIFEST_TYPE = "application/vnd.oci.image.manifest.v1+json"
+JOB_IMAGE = "${CR}/infra/slice-builder:1.0.0"
 
 
 class PublishError(Exception):
@@ -36,13 +36,28 @@ def digest(data: bytes) -> str:
     return "sha256:" + hashlib.sha256(data).hexdigest()
 
 
-def connected_contours(repo: Path) -> list[str]:
+def list_contours(repo: Path) -> list[str]:
-    found = []
+    return sorted(p.parent.name for p in repo.glob("clusters/*/kustomization.yaml"))
-    for sync in sorted(repo.glob("clusters/*/flux-system/gotk-sync.yaml")):
+
-        for doc in yaml.safe_load_all(sync.read_text()):
+
-            if isinstance(doc, dict) and doc.get("kind") == "GitRepository" and doc.get("spec", {}).get("url") == INSTALLER_GITEA_URL:
+def child_pipeline(contours: list[str], release: str, commit: str) -> str:
-                found.append(sync.parents[1].name)
+    jobs: dict = {"stages": ["slices"]}
-    return found
+    for c in contours:
+        jobs[f"slice {c}"] = {
+            "stage": "slices",
+            "image": JOB_IMAGE,
+            "tags": ["build"],
+            "allow_failure": True,
+            "variables": {"GIT_DEPTH": "1"},
+            "script": [
+                "printf '%s' \"$SLICES_PUSHER_KEY\" | base64 -d > /tmp/slices-key.json",
+                f"python3 ci/publish-slice.py publish --contour {c} --release {release} --commit {commit} --key-file /tmp/slices-key.json",
+            ],
+            "after_script": ["rm -f /tmp/slices-key.json"],
+        }
+    if not contours:
+        jobs["no contours"] = {"stage": "slices", "image": JOB_IMAGE, "tags": ["build"], "script": ["echo 'no clusters/*/kustomization.yaml found'"]}
+    return yaml.safe_dump(jobs, sort_keys=False, allow_unicode=False)
 
 
 def build_manifest(layer: bytes, annotations: dict[str, str]) -> tuple[bytes, bytes]:
@@ -82,7 +97,7 @@ class Registry:
         params["scope"] = scope
         status, _, body = self._send("GET", f"{realm}?{urllib.parse.urlencode(params)}", headers={"Authorization": self.basic})
         if status != 200:
-            raise PublishError(f"авторизация в реестре: HTTP {status}")
+            raise PublishError(f"registry auth failed: HTTP {status}")
         payload = json.loads(body)
         return payload.get("token") or payload.get("access_token")
 
@@ -108,70 +123,94 @@ class Registry:
             raise PublishError(f"{repo}:current: HTTP {status}")
         return json.loads(body)["layers"][0]["digest"]
 
-    def put_blob(self, repo: str, data: bytes):
+    def put_blob(self, repo: str, data: bytes) -> bool:
         d = digest(data)
         if self.request("HEAD", repo, f"blobs/{d}")[0] == 200:
-            return
+            return False
         status, h, _ = self.request("POST", repo, "blobs/uploads/")
         if status != 202:
-            raise PublishError(f"загрузка блоба в {repo}: HTTP {status}")
+            raise PublishError(f"blob upload to {repo}: HTTP {status}")
         location = h["location"]
         if location.startswith("/"):
             location = self.base + location
         sep = "&" if "?" in location else "?"
         status, _, _ = self.request("PUT", repo, f"{location}{sep}digest={d}", data, {"Content-Type": "application/octet-stream"})
         if status != 201:
-            raise PublishError(f"загрузка блоба в {repo}: HTTP {status}")
+            raise PublishError(f"blob upload to {repo}: HTTP {status}")
+        return True
 
-    def push(self, repo: str, tags: list[str], layer: bytes, annotations: dict[str, str]):
+    def push(self, repo: str, tags: list[str], layer: bytes, annotations: dict[str, str]) -> bool:
         config, manifest = build_manifest(layer, annotations)
         self.put_blob(repo, config)
-        self.put_blob(repo, layer)
+        uploaded = self.put_blob(repo, layer)
         for tag in tags:
             status, _, body = self.request("PUT", repo, f"manifests/{tag}", manifest, {"Content-Type": MANIFEST_TYPE})
             if status != 201:
                 raise PublishError(f"{repo}:{tag}: HTTP {status} {body[:200]!r}")
+        return uploaded
+
+
+def log(msg: str):
+    print(f"[{time.strftime('%H:%M:%S')}] {msg}", flush=True)
+
+
+def publish(repo: Path, contour: str, release: str, commit: str, key_file: Path) -> int:
+    target = f"{SLICE_REGISTRY}/{contour}-iac"
+    log(f"contour {contour}, source iac@{commit[:8]}, release {release}")
+    try:
+        with tempfile.TemporaryDirectory() as tmp:
+            out = Path(tmp) / "slice.tar"
+            files, entries = bs.collect(repo, f"clusters/{contour}")
+            log(f"collected {len(files)} files, entry points: {', '.join(entries)}")
+            bs.write_tar(repo, files, out)
+            bs.verify(repo, out, entries)
+            log(f"verified: kustomize build of {len(entries)} entry point(s) identical to full repository")
+            layer = out.read_bytes()
+        new = digest(layer)
+        log(f"slice size {len(layer)} bytes, digest {new}")
+        registry = Registry("json_key", key_file.read_text())
+        current = registry.current_layer(f"{target}")
+        changed = current != new
+        log(f"registry {REGISTRY_HOST}/{target}, current " + (current or "absent") + (", content changed" if changed else ", content unchanged"))
+        tags = [commit[:8], release] + (["current"] if changed else [])
+        uploaded = registry.push(target, tags, layer, {
+            "org.opencontainers.image.source": "iac",
+            "org.opencontainers.image.revision": commit,
+            "org.opencontainers.image.version": release,
+            "org.opencontainers.image.created": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "io.sarex.slice.contour": contour,
+            "io.sarex.slice.kind": "iac",
+        })
+        log(f"layer {'uploaded' if uploaded else 'already in registry'}, tags pushed: {', '.join(tags)}")
+    except (bs.SliceError, PublishError) as e:
+        log(f"FAILED: {e}")
+        return 1
+    log("done")
+    return 0
 
 
 def main() -> int:
     ap = argparse.ArgumentParser()
-    ap.add_argument("--repo", default=".")
+    sub = ap.add_subparsers(dest="cmd", required=True)
-    ap.add_argument("--release", required=True)
+    gen = sub.add_parser("generate")
-    ap.add_argument("--commit", required=True)
+    gen.add_argument("--repo", default=".")
-    ap.add_argument("--branch", default="")
+    gen.add_argument("--release", required=True)
-    ap.add_argument("--key-file", required=True)
+    gen.add_argument("--commit", required=True)
+    gen.add_argument("--out", required=True)
+    pub = sub.add_parser("publish")
+    pub.add_argument("--repo", default=".")
+    pub.add_argument("--contour", required=True)
+    pub.add_argument("--release", required=True)
+    pub.add_argument("--commit", required=True)
+    pub.add_argument("--key-file", required=True)
     args = ap.parse_args()
     repo = Path(args.repo).resolve()
-    registry = Registry("json_key", Path(args.key_file).read_text())
+    if args.cmd == "generate":
-    contours = connected_contours(repo)
+        contours = list_contours(repo)
-    print(f"подключённые контуры: {', '.join(contours) or 'нет'}")
+        Path(args.out).write_text(child_pipeline(contours, args.release, args.commit))
-    failed = []
+        log(f"{len(contours)} contours: {', '.join(contours)}")
-    for contour in contours:
+        return 0
-        target = f"{SLICE_REGISTRY}/{contour}-iac"
+    return publish(repo, args.contour, args.release, args.commit, Path(args.key_file))
-        try:
-            with tempfile.TemporaryDirectory() as tmp:
-                out = Path(tmp) / "slice.tar"
-                files, entries = bs.collect(repo, f"clusters/{contour}")
-                bs.write_tar(repo, files, out)
-                bs.verify(repo, out, entries)
-                layer = out.read_bytes()
-            changed = registry.current_layer(target) != digest(layer)
-            tags = [args.commit[:8], args.release] + (["current"] if changed else [])
-            registry.push(target, tags, layer, {
-                "org.opencontainers.image.source": "iac",
-                "org.opencontainers.image.revision": args.commit,
-                "org.opencontainers.image.version": args.release,
-                "org.opencontainers.image.created": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
-                "io.sarex.slice.branch": args.branch,
-                "io.sarex.slice.contour": contour,
-                "io.sarex.slice.kind": "iac",
-            })
-            state = "current переставлен" if changed else "содержимое как в current"
-            print(f"{target}: {len(files)} файлов, {digest(layer)[:19]}, теги {', '.join(tags)}, {state}")
-        except (bs.SliceError, PublishError) as e:
-            print(f"{target}: ОШИБКА {e}", file=sys.stderr)
-            failed.append(contour)
-    return 1 if failed else 0
 
 
 if __name__ == "__main__":

ci/tests/test_build_slice.py

@@ -3,6 +3,7 @@ import tarfile
 from pathlib import Path
 
 import pytest
+import yaml
 
 spec = importlib.util.spec_from_file_location("build_slice", Path(__file__).parents[1] / "build-slice.py")
 bs = importlib.util.module_from_spec(spec)
@@ -48,13 +49,13 @@ def test_slice_follows_flux_paths_and_skips_foreign(repo):
 
 def test_remote_reference_stops_build(repo):
     put(repo, "clusters/a/kustomization.yaml", "resources:\n  - https://github.com/x/y//z\n")
-    with pytest.raises(bs.SliceError, match="удалённая ссылка"):
+    with pytest.raises(bs.SliceError, match="remote reference"):
         bs.collect(repo, "clusters/a")
 
 
 def test_dangling_reference_stops_build(repo):
     put(repo, "clusters/a/kustomization.yaml", "resources:\n  - ./missing.yaml\n")
-    with pytest.raises(bs.SliceError, match="никуда не ведёт"):
+    with pytest.raises(bs.SliceError, match="does not exist"):
         bs.collect(repo, "clusters/a")
 
 
@@ -70,16 +71,23 @@ def test_tar_is_byte_identical_across_runs(repo, tmp_path_factory):
         assert all(m.mtime == 0 for m in t.getmembers())
 
 
-pspec = importlib.util.spec_from_file_location("publish_slices", Path(__file__).parents[1] / "publish-slices.py")
+
+pspec = importlib.util.spec_from_file_location("publish_slice", Path(__file__).parents[1] / "publish-slice.py")
 ps = importlib.util.module_from_spec(pspec)
 pspec.loader.exec_module(ps)
 
 
-def test_only_installer_contours_are_connected(tmp_path):
+def test_every_cluster_with_kustomization_is_a_contour(tmp_path):
-    put(tmp_path, "clusters/stand/flux-system/gotk-sync.yaml",
+    put(tmp_path, "clusters/stand/kustomization.yaml", "resources: []\n")
-        f"apiVersion: source.toolkit.fluxcd.io/v1\nkind: GitRepository\nspec:\n  url: {ps.INSTALLER_GITEA_URL}\n")
+    put(tmp_path, "clusters/vad/kustomization.yaml", "resources: []\n")
-    put(tmp_path, "clusters/vad/flux-system/gotk-sync.yaml",
+    put(tmp_path, "clusters/contour/apps.yaml", "kind: Kustomization\n")
-        "apiVersion: source.toolkit.fluxcd.io/v1\nkind: GitRepository\nspec:\n  url: http://192.168.8.141:31361/infra/iac.git\n")
+    assert ps.list_contours(tmp_path) == ["stand", "vad"]
-    put(tmp_path, "clusters/old/flux-system/gotk-sync.yaml",
+
-        "apiVersion: source.toolkit.fluxcd.io/v1\nkind: GitRepository\nspec:\n  url: https://gitlab.sarex.io/infra/iac.git\n")
+
-    assert ps.connected_contours(tmp_path) == ["stand"]
+def test_child_pipeline_has_one_job_per_contour():
+    doc = yaml.safe_load(ps.child_pipeline(["stand", "vad"], "3.9.68", "abcdef1234"))
+    jobs = {k: v for k, v in doc.items() if k != "stages"}
+    assert sorted(jobs) == ["slice stand", "slice vad"]
+    assert all(j["allow_failure"] for j in jobs.values())
+    assert "--contour vad --release 3.9.68 --commit abcdef1234" in jobs["slice vad"]["script"][1]
+    assert all(ord(ch) < 128 for ch in ps.child_pipeline(["stand"], "1.0.0", "a" * 40))

clusters/stand/00-vault/helm-repositories.yaml

@@ -7,6 +7,8 @@ metadata:
 spec:
   type: oci
   interval: 10m0s
-  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
+  url: ${CHART_REPO:=oci://cr.yandex/crp3ccidau046kdj8g9q/charts}
   secretRef:
-    name: yc-cr-auth
+    name: ${CHART_REPO_SECRET:=yc-cr-auth}
+  certSecretRef:
+    name: chart-repo-ca

clusters/stand/00-vault/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helm-repositories.yaml
+  - ../../../infrastructure/vault/contour-template

clusters/stand/10-mesh/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-base/contour-template
+  - ../../../infrastructure/istio-pilot/contour-template
+  - ../../../infrastructure/istio-gateway/contour-template
+  - ../../../infrastructure/cert-manager/contour-template

clusters/stand/20-data/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/postgresql/contour-template
+  - ../../../infrastructure/kafka/contour-template
+  - ../../../infrastructure/rabbitmq/contour-template

clusters/stand/30-platform/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/zitadel/contour-template
+  - ../../../infrastructure/camunda/contour-template

clusters/stand/40-routing/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-config/contour-template

clusters/stand/flux-system/kustomization.yaml

@@ -3,3 +3,11 @@ kind: Kustomization
 resources:
 - gotk-components.yaml
 - gotk-sync.yaml
+patches:
+- target:
+    kind: Deployment
+    name: kustomize-controller
+  patch: |-
+    - op: add
+      path: /spec/template/spec/containers/0/args/-
+      value: --feature-gates=CancelHealthCheckOnNewRevision=true

clusters/stand/kustomization.yaml

@@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./flux-system
-  - ./helm-repositories.yaml
+  - ./layers.yaml

clusters/stand/layers.yaml

@@ -0,0 +1,93 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 00-vault
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 10m0s
+  path: ./clusters/stand/00-vault
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 10-mesh
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 15m0s
+  path: ./clusters/stand/10-mesh
+  prune: true
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 20-data
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 20m0s
+  path: ./clusters/stand/20-data
+  prune: true
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 30-platform
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 35m0s
+  path: ./clusters/stand/30-platform
+  prune: true
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 40-routing
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 10m0s
+  path: ./clusters/stand/40-routing
+  prune: true
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars

infrastructure/camunda/contour-template/camunda.yaml

@@ -0,0 +1,354 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: camunda
+  namespace: camunda
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 30m
+  waitStrategy:
+    name: legacy
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-connectors
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-identity
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-operate
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-optimize
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-tasklist
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-zeebe-gateway
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              name: camunda-zeebe
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+  values:
+    global:
+      vault:
+        enabled: true
+        role: camunda-contour
+        authPath: auth/kubernetes
+        secrets:
+          postgresql:
+            path: secrets/data/camunda/identity-db
+            keys:
+              password: password
+              postgresPassword: password
+      image:
+        pullSecrets:
+          - name: regcred
+      identity:
+        auth:
+          publicIssuerUrl: "https://${HOST_CAMUNDA_KEYCLOAK}/auth/realms/camunda-platform"
+          identity:
+            redirectUrl: "https://${HOST_CAMUNDA_IDENTITY}"
+          operate:
+            redirectUrl: "https://${HOST_CAMUNDA}"
+          tasklist:
+            redirectUrl: "https://${HOST_CAMUNDA_TASKLIST}"
+          optimize:
+            redirectUrl: "https://${HOST_CAMUNDA_OPTIMIZE}"
+    identityPostgresql:
+      enabled: false
+      auth:
+        usePasswordFiles: true
+      primary:
+        automountServiceAccountToken: true
+        persistence:
+          size: 10Gi
+          storageClass: ${STORAGE_CLASS}
+    identityKeycloak:
+      externalDatabase:
+        host: pg-host.storage.svc.cluster.local
+        port: 5432
+        user: bn_keycloak
+        database: bitnami_keycloak
+        password: ""
+        existingSecret: ""
+        existingSecretPasswordKey: password
+      postgresql:
+        enabled: false
+        auth:
+          usePasswordFiles: true
+        primary:
+          automountServiceAccountToken: true
+          persistence:
+            size: 10Gi
+            storageClass: ${STORAGE_CLASS}
+      vaultEnv:
+        enabled: true
+        role: camunda-contour
+        authPath: auth/kubernetes
+        envFiles:
+          KEYCLOAK_ADMIN_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_DATABASE_PASSWORD:
+            path: secrets/data/camunda/keycloak-db
+            key: password
+      global:
+        storageClass: ${STORAGE_CLASS}
+      tolerations: []
+    elasticsearch:
+      sysctlImage:
+        registry: cr.yandex
+        repository: crp3ccidau046kdj8g9q/contour/camunda/os-shell
+        tag: 12-debian-12-r32
+        pullSecrets:
+          - regcred
+      master:
+        replicaCount: 1
+        podAntiAffinityPreset: soft
+        persistence:
+          size: 10Gi
+          storageClass: ${STORAGE_CLASS}
+        tolerations: []
+      metrics:
+        enabled: false
+        serviceMonitor:
+          enabled: false
+        prometheusRule:
+          enabled: false
+        tolerations: []
+    camundaCanary:
+      enabled: false
+    prometheusServiceMonitor:
+      enabled: false
+    console:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebe:
+      clusterSize: "1"
+      partitionCount: "1"
+      replicationFactor: "1"
+      pvcStorageClassName: ${STORAGE_CLASS}
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebeGateway:
+      replicas: 1
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    identity:
+      fullURL: "https://${HOST_CAMUNDA_IDENTITY}"
+      externalDatabase:
+        enabled: true
+        host: pg-host.storage.svc.cluster.local
+        port: 5432
+        username: identity
+        database: identity
+        password: ""
+        existingSecret: ""
+        existingSecretPasswordKey: password
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    operate:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    tasklist:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    optimize:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    executionIdentity:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    webModeler:
+      image:
+        pullSecrets:
+          - name: regcred
+      restapi:
+        tolerations: []
+      webapp:
+        tolerations: []
+      websockets:
+        tolerations: []
+    connectors:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []

infrastructure/camunda/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: camunda.yaml

infrastructure/cert-manager/contour-template/cert-manager.yaml

@@ -0,0 +1,25 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    controller:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cert-manager
+      acmesolver:
+        image:
+          registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+          repository: acmesolver
+    webhook:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cert-manager-webhook
+    cainjector:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cainjector

infrastructure/cert-manager/contour-template/kustomization.yaml

@@ -0,0 +1,28 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: cert-manager.yaml
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer-istio
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer-istio

infrastructure/istio-base/contour-template/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base

infrastructure/istio-config/contour-template/istio-config.yaml

@@ -0,0 +1,117 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      env: contour
+    environments:
+      contour:
+        istio:
+          gateways:
+            platform:
+              name: platform-gateway
+              namespace: default
+              selector:
+                istio: ingressgateway
+              servers:
+              - hosts:
+                - ${HOST_LOGIN}
+                - ${HOST_CAMUNDA}
+                - ${HOST_CAMUNDA_IDENTITY}
+                - ${HOST_CAMUNDA_KEYCLOAK}
+                - ${HOST_CAMUNDA_OPTIMIZE}
+                - ${HOST_CAMUNDA_TASKLIST}
+                - ${HOST_RABBITMQ}
+                tls:
+                  credentialName: istio-ingress-tls
+          virtualServices:
+            zitadel:
+              name: zitadel-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_LOGIN}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: zitadel-idp-contour.zitadel.svc.cluster.local
+                port: 8080
+            camunda-operate:
+              name: camunda-operate-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-operate.camunda.svc.cluster.local
+                port: 80
+            camunda-identity:
+              name: camunda-identity-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_IDENTITY}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-identity.camunda.svc.cluster.local
+                port: 80
+            camunda-keycloak:
+              name: camunda-keycloak-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_KEYCLOAK}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-keycloak.camunda.svc.cluster.local
+                port: 80
+            camunda-optimize:
+              name: camunda-optimize-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_OPTIMIZE}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-optimize.camunda.svc.cluster.local
+                port: 80
+            camunda-tasklist:
+              name: camunda-tasklist-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_TASKLIST}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-tasklist.camunda.svc.cluster.local
+                port: 80
+            rabbitmq:
+              name: rabbitmq-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_RABBITMQ}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: rabbitmq.rabbitmq.svc.cluster.local
+                port: 15672

infrastructure/istio-config/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-config.yaml

infrastructure/istio-config/vk-infra/istio-config.yaml

@@ -103,6 +103,17 @@ spec:
                 renewBefore: 360h0m0s
                 privateKey:
                   rotationPolicy: Always
+            goalert-tls:
+              dnsNames:
+                - goalert.infra.sarex.io
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              spec:
+                duration: 2160h0m0s
+                renewBefore: 360h0m0s
+                privateKey:
+                  rotationPolicy: Always
         istio:
           gateways:
             vault:
@@ -172,6 +183,17 @@ spec:
                   tls:
                     credentialName: wiki-tls
                     mode: SIMPLE
+            goalert:
+              name: goalert-gateway
+              namespace: istio-system
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - goalert.infra.sarex.io
+                  tls:
+                    credentialName: goalert-tls
+                    mode: SIMPLE
           virtualServices:
             vault-virt-service:
               namespace: istio-system
@@ -250,3 +272,14 @@ spec:
                     prefix: /
                   service: outline.outline.svc.cluster.local
                   port: 80
+            goalert-virt-service:
+              namespace: istio-system
+              hosts:
+                - goalert.infra.sarex.io
+              gateways:
+                - istio-system/goalert-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: goalert.goalert.svc.cluster.local
+                  port: 8081

infrastructure/istio-gateway/contour-template/istio-gateway.yaml

@@ -0,0 +1,31 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway
+  namespace: istio-system
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  values:
+    _internal_defaults_do_not_set:
+      replicaCount: ${GATEWAY_REPLICAS}
+      service:
+        type: ClusterIP
+      nodeSelector:
+        sarex.io/gateway: "true"
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  istio: ingressgateway
+              topologyKey: kubernetes.io/hostname
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule

infrastructure/istio-gateway/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-gateway.yaml

infrastructure/istio-pilot/contour-template/istio-pilot.yaml

@@ -0,0 +1,12 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istiod
+  namespace: istio-system
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      imagePullSecrets:
+        - regcred

infrastructure/istio-pilot/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-pilot.yaml

infrastructure/kafka/contour-template/kafka.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kafka
+  namespace: kafka
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: kafka
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    global:
+      imagePullSecrets:
+        - regcred
+      defaultStorageClass: ${STORAGE_CLASS}
+    image:
+      pullSecrets:
+        - regcred
+    controller:
+      replicaCount: 1
+      automountServiceAccountToken: true
+      persistence:
+        size: 8Gi
+        storageClass: ${STORAGE_CLASS}
+      overrideConfiguration:
+        offsets.topic.replication.factor: 1
+        transaction.state.log.replication.factor: 1
+        transaction.state.log.min.isr: 1
+        default.replication.factor: 1
+        min.insync.replicas: 1
+    broker:
+      replicaCount: 0
+      automountServiceAccountToken: true
+    listeners:
+      client:
+        protocol: SASL_PLAINTEXT
+        sslClientAuth: "none"
+    provisioning:
+      enabled: false
+    sasl:
+      managedExistingSecret:
+        enabled: false
+      existingSecret: ""
+      enabledMechanisms: PLAIN,SCRAM-SHA-512
+      interBrokerMechanism: PLAIN
+      controllerMechanism: PLAIN
+      client:
+        users: []
+        passwords: ""
+    tls:
+      type: PEM
+    vault:
+      enabled: true
+      role: kafka
+      authPath: auth/kubernetes
+      secretPath: secrets/data/kafka/bootstrap
+      clusterIdKey: clusterId
+      interBrokerPasswordKey: interBrokerPassword
+      controllerPasswordKey: controllerPassword

infrastructure/kafka/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: kafka.yaml

infrastructure/postgresql/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: postgresql.yaml

infrastructure/postgresql/contour-template/postgresql.yaml

@@ -0,0 +1,104 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: postgresql
+  namespace: postgresql
+spec:
+  interval: 5m
+  timeout: 2h
+
+  install:
+    timeout: 2h
+    remediation:
+      retries: 3
+
+  upgrade:
+    timeout: 2h
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      security:
+        allowInsecureImages: true
+      defaultStorageClass: ${STORAGE_CLASS}
+      postgresql:
+        auth:
+          username: ""
+          database: ""
+          secretKeys:
+            userPasswordKey: "postgres-password"
+    auth:
+      username: ""
+      database: ""
+      secretKeys:
+        userPasswordKey: "postgres-password"
+    image:
+      registry: cr.yandex/crp3ccidau046kdj8g9q
+      repository: contour/postgresql
+      tag: 17.0.7
+      pullPolicy: Always
+    metrics:
+      enabled: false
+      prometheusRule:
+        enabled: false
+    primary:
+      automountServiceAccountToken: true
+      containerSecurityContext:
+        readOnlyRootFilesystem: false
+      persistence:
+        storageClass: ${STORAGE_CLASS}
+        size: 20Gi
+      customLivenessProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 30
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      customReadinessProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 5
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      customStartupProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 30
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      nodeSelector:
+        dedicated: generic
+      tolerations: []
+    contour:
+      enabled: true
+      adminUser: "postgres"
+      vault:
+        enabled: true
+        role: postgresql-zitadel
+        authPath: auth/kubernetes
+        secretPath: secrets/data/postgresql-zitadel/admin
+        secretKey: postgres-password
+        usersSecretPath: secrets/data/zitadel/postgresql
+      sharedPreloadLibraries: "timescaledb,pg_stat_statements"
+      databases:
+        - name: zitadel
+          user: zitadel
+          passwordKey: password
+          extensions: []
+          restoreFromDump: false

infrastructure/rabbitmq/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: rabbitmq.yaml

infrastructure/rabbitmq/contour-template/rabbitmq.yaml

@@ -0,0 +1,104 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rabbitmq
+  namespace: rabbitmq
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: rabbitmq
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: cert-manager.io
+              version: v1
+              kind: Certificate
+              namespace: gateway
+              name: rmq-tls
+            patch: |-
+              $patch: delete
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: rmq-tls
+                namespace: gateway
+          - target:
+              group: networking.istio.io
+              version: v1beta1
+              kind: Gateway
+              namespace: gateway
+              name: rmq-gateway
+            patch: |-
+              $patch: delete
+              apiVersion: networking.istio.io/v1beta1
+              kind: Gateway
+              metadata:
+                name: rmq-gateway
+                namespace: gateway
+          - target:
+              group: networking.istio.io
+              version: v1
+              kind: VirtualService
+              namespace: rabbitmq
+              name: rmq-virt-service
+            patch: |-
+              $patch: delete
+              apiVersion: networking.istio.io/v1
+              kind: VirtualService
+              metadata:
+                name: rmq-virt-service
+                namespace: rabbitmq
+  values:
+    global:
+      security:
+        allowInsecureImages: true
+    virtualService: null
+    gateway: null
+    certificate: null
+    metrics:
+      serviceMonitor:
+        enabled: false
+        default:
+          enabled: false
+        perObject:
+          enabled: false
+        detailed:
+          enabled: false
+    extraServiceMonitors: []
+    replicaCount: 1
+    resources:
+      requests:
+        memory: 1Gi
+    persistence:
+      storageClass: ${STORAGE_CLASS}
+      size: 10Gi
+    auth:
+      securePassword: true
+      enableLoopbackUser: false
+      existingPasswordSecret: ""
+      vault:
+        enabled: true
+        role: rabbitmq
+        authPath: auth/kubernetes
+        secretPath: secrets/data/rabbitmq/auth
+        usernameKey: username
+        passwordKey: password
+    advancedConfiguration: |-
+      [
+        {rabbit, [
+          {loopback_users, []}
+        ]}
+      ].

infrastructure/vault/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: vault.yaml

infrastructure/vault/contour-template/vault.yaml

@@ -0,0 +1,110 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault
+  namespace: vault
+spec:
+  interval: 5m
+  timeout: 10m
+  install:
+    disableWait: true
+  upgrade:
+    disableWait: true
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: vault
+              name: vault-vault-contour
+            patch: |-
+              - op: replace
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: replace
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    global:
+      namespace: vault
+      imagePullSecrets:
+        - name: regcred
+    backup:
+      enabled: false
+    injector:
+      nodeSelector:
+        dedicated: generic
+      tolerations: []
+    server:
+      includeConfigAnnotation: true
+      nodeSelector:
+        dedicated: generic
+      tolerations: []
+      dataStorage:
+        size: 10Gi
+        storageClass: ${STORAGE_CLASS}
+      volumes:
+        - name: unseal-keys
+          secret:
+            secretName: vault-unseal-keys
+            optional: true
+            defaultMode: 0440
+      extraContainers:
+        - name: unsealer
+          image: cr.yandex/crp3ccidau046kdj8g9q/vault/vault:1.21.2
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: VAULT_ADDR
+              value: http://127.0.0.1:8200
+          command:
+            - /bin/sh
+            - -c
+            - |
+              while true; do
+                if vault status >/dev/null 2>&1; then
+                  :
+                else
+                  rc=$?
+                  if [ "$rc" -eq 2 ]; then
+                    if [ -s /vault/unseal-keys/key1 ] && [ -s /vault/unseal-keys/key2 ] && [ -s /vault/unseal-keys/key3 ]; then
+                      for k in key1 key2 key3; do
+                        vault operator unseal "$(cat /vault/unseal-keys/$k)" >/dev/null 2>&1 || echo "unseal call failed"
+                      done
+                      if vault status >/dev/null 2>&1; then echo "unsealed"; else echo "still sealed"; fi
+                    else
+                      echo "sealed, keys not mounted"
+                    fi
+                  fi
+                fi
+                sleep 10
+              done
+          volumeMounts:
+            - name: unseal-keys
+              mountPath: /vault/unseal-keys
+              readOnly: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              memory: 64Mi
+      ha:
+        replicas: 1
+        raft:
+          config: |
+            ui = true
+
+            listener "tcp" {
+              tls_disable = 1
+              address = "[::]:8200"
+              cluster_address = "[::]:8201"
+            }
+
+            storage "raft" {
+              path = "/vault/data"
+            }
+
+            service_registration "kubernetes" {}

infrastructure/zitadel/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: zitadel.yaml

infrastructure/zitadel/contour-template/zitadel.yaml

@@ -0,0 +1,168 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: zitadel
+  namespace: zitadel
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: postgresql
+      namespace: postgresql
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: zitadel-idp-contour
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-init
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-setup
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+  values:
+    zitadel:
+      configmapConfig:
+        ExternalDomain: ${HOST_LOGIN}
+        ExternalSecure: true
+        # IAM_OWNER service user for sarexctl phase zitadel-setup; the chart stores its key
+        # in secret zitadel/sarex-installer. Created only on the first instance setup.
+        FirstInstance:
+          Org:
+            Machine:
+              Machine:
+                Username: sarex-installer
+                Name: sarexctl
+              MachineKey:
+                ExpirationDate: "2099-01-01T00:00:00Z"
+                Type: 1
+      debug:
+        enabled: false
+    postgresqlSecret:
+      create: false
+      vault:
+        enabled: true
+        role: zitadel
+        authPath: auth/kubernetes
+        secretPath: secrets/data/zitadel/postgresql
+        secretKey: password
+        kvVersion: 2
+        fileName: zitadel-vault-config.yaml
+    serviceAccount:
+      create: true
+      name: zitadel-idp-contour
+    replicaCount: 1
+    pdb:
+      enabled: false
+    env:
+      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
+        value: "false"
+      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
+        value: "bcrypt,pbkdf2"
+      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
+        value: "true"
+      - name: ZITADEL_DATABASE_POSTGRES_HOST
+        value: "postgresql.postgresql.svc.cluster.local"
+      - name: ZITADEL_DATABASE_POSTGRES_PORT
+        value: "5432"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
+        value: "zitadel-admin"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
+        value: "Sarex"