++ camunda legacy wait

++ camunda timeout 30m
++ merge feat/zitadel-setup: sarex-installer machine user
2026-10-31 17:45:29 +03:00 · 2026-10-31 15:21:43 +03:00 · 2026-10-30 13:53:12 +05:00 · 2026-10-29 18:23:28 +05:00 · 2026-10-29 17:36:35 +05:00 · 2026-10-29 15:05:47 +03:00
25 changed files with 773 additions and 8 deletions
--- a/apps/django/d8-ugmk-prod/backend.yaml
+++ b/apps/django/d8-ugmk-prod/backend.yaml
@ -8,6 +8,9 @@ spec:
  values:
    services:
      backend:
+        deployment:
+          replicaCount:
+            _default: 2
        envs:
          - name: ALLOWED_HOSTS
            value:
--- a/apps/documentations/base/api.yaml
+++ b/apps/documentations/base/api.yaml
@ -65,7 +65,7 @@ spec:
              enabled: false
        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_fef3add2
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_89c8039a
          pullPolicy:
            _default: IfNotPresent
        service:
@ -89,6 +89,9 @@ spec:
          - name: POSTGRES_POOL_SIZE
            value:
              _default: "20"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
          - name: USE_LEGACY_BIM_FLOW
            value:
              _default: "true"
--- a/apps/documentations/base/filestream.yaml
+++ b/apps/documentations/base/filestream.yaml
@ -97,6 +97,9 @@ spec:
          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
            value:
              _default: "true"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
          - name: USE_ZITADEL
            value:
              _default: "1"
--- a/apps/documentations/wb/api.yaml
+++ b/apps/documentations/wb/api.yaml
@ -134,6 +134,10 @@ spec:
          - name: POSTGRES_POOL_SIZE
            value:
              _default: "20"
+          
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"

          - name: ZITADEL_ACCOUNT
            value:
--- a/apps/documentations/wb/filestream.yaml
+++ b/apps/documentations/wb/filestream.yaml
@ -137,6 +137,10 @@ spec:
          - name: API_ADDRESS
            value:
              _default: "0.0.0.0:8080"
+          
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"

          - name: API_ADDRESS_FILE
            value:
--- a/apps/eav/wb/django-configmap.yaml
+++ b/apps/eav/wb/django-configmap.yaml
@ -18,7 +18,7 @@ data:

    # DEBUG SETTINGS START
    # ---------------------------------------------------------------------------------------------------------------------
-    DEBUG = True
+    DEBUG = False
    ALLOWED_HOSTS = ['*']
    # ---------------------------------------------------------------------------------------------------------------------
    # DEBUG SETTINGS END
--- a/apps/flows/d8-ugmk-prod/backend.yaml
+++ b/apps/flows/d8-ugmk-prod/backend.yaml
@ -9,6 +9,8 @@ spec:
    services:
      backend:
        deployment:
+          replicaCount:
+            _default: 2
          args:
            _default:
              - |
--- a/apps/processing/base/engine-low.yaml
+++ b/apps/processing/base/engine-low.yaml
@ -142,6 +142,10 @@ spec:
            value:
              _default: "0"

+          - name: IGNORE_RESOURCES
+            value:
+              _default: "True"
+
          - name: DJANGO_HOST
            value:
              _default: "http://backend.django.svc.cluster.local:8000"
--- a/apps/processing/uralkal/engine-low.yaml
+++ b/apps/processing/uralkal/engine-low.yaml
@ -8,6 +8,9 @@ spec:
  values:
    services:
      backend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_7d2cd329
        deployment:
          resources:
            requests:
--- a/apps/workspaces/base/frontend.yaml
+++ b/apps/workspaces/base/frontend.yaml
@ -29,7 +29,7 @@ spec:
        enabled: true
        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_1b5d64e4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_2da2a00e
          pullPolicy:
            _default: IfNotPresent
        deployment:
--- a/apps/workspaces/ugok/frontend.yaml
+++ b/apps/workspaces/ugok/frontend.yaml
@ -36,7 +36,7 @@ spec:

        image:
          name:
-            _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_07373a45
+            _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_1b5d64e4
          pullPolicy:
            _default: IfNotPresent

--- a/clusters/stand/00-vault/helm-repositories.yaml
+++ b/clusters/stand/00-vault/helm-repositories.yaml
@ -7,6 +7,8 @@ metadata:
 spec:
  type: oci
  interval: 10m0s
-  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
+  url: ${CHART_REPO:=oci://cr.yandex/crp3ccidau046kdj8g9q/charts}
  secretRef:
-    name: yc-cr-auth
+    name: ${CHART_REPO_SECRET:=yc-cr-auth}
+  certSecretRef:
+    name: chart-repo-ca
--- a/clusters/stand/00-vault/kustomization.yaml
+++ b/clusters/stand/00-vault/kustomization.yaml
@ -1,4 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - ./helm-repositories.yaml
  - ../../../infrastructure/vault/contour-template
--- a/clusters/stand/30-platform/kustomization.yaml
+++ b/clusters/stand/30-platform/kustomization.yaml
@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/zitadel/contour-template
+  - ../../../infrastructure/camunda/contour-template
--- a/clusters/stand/40-routing/kustomization.yaml
+++ b/clusters/stand/40-routing/kustomization.yaml
@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-config/contour-template
--- a/clusters/stand/kustomization.yaml
+++ b/clusters/stand/kustomization.yaml
@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./flux-system
-  - ./helm-repositories.yaml
  - ./layers.yaml
--- a/clusters/stand/layers.yaml
+++ b/clusters/stand/layers.yaml
@ -53,3 +53,41 @@ spec:
    substituteFrom:
      - kind: ConfigMap
        name: contour-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 30-platform
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 35m0s
+  path: ./clusters/stand/30-platform
+  prune: true
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 40-routing
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 10m0s
+  path: ./clusters/stand/40-routing
+  prune: true
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars
--- a/infrastructure/camunda/contour-template/camunda.yaml
+++ b/infrastructure/camunda/contour-template/camunda.yaml
@ -0,0 +1,354 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: camunda
+  namespace: camunda
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 30m
+  waitStrategy:
+    name: legacy
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-connectors
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-identity
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-operate
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-optimize
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-tasklist
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-zeebe-gateway
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              name: camunda-zeebe
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+  values:
+    global:
+      vault:
+        enabled: true
+        role: camunda-contour
+        authPath: auth/kubernetes
+        secrets:
+          postgresql:
+            path: secrets/data/camunda/identity-db
+            keys:
+              password: password
+              postgresPassword: password
+      image:
+        pullSecrets:
+          - name: regcred
+      identity:
+        auth:
+          publicIssuerUrl: "https://${HOST_CAMUNDA_KEYCLOAK}/auth/realms/camunda-platform"
+          identity:
+            redirectUrl: "https://${HOST_CAMUNDA_IDENTITY}"
+          operate:
+            redirectUrl: "https://${HOST_CAMUNDA}"
+          tasklist:
+            redirectUrl: "https://${HOST_CAMUNDA_TASKLIST}"
+          optimize:
+            redirectUrl: "https://${HOST_CAMUNDA_OPTIMIZE}"
+    identityPostgresql:
+      enabled: false
+      auth:
+        usePasswordFiles: true
+      primary:
+        automountServiceAccountToken: true
+        persistence:
+          size: 10Gi
+          storageClass: ${STORAGE_CLASS}
+    identityKeycloak:
+      externalDatabase:
+        host: pg-host.storage.svc.cluster.local
+        port: 5432
+        user: bn_keycloak
+        database: bitnami_keycloak
+        password: ""
+        existingSecret: ""
+        existingSecretPasswordKey: password
+      postgresql:
+        enabled: false
+        auth:
+          usePasswordFiles: true
+        primary:
+          automountServiceAccountToken: true
+          persistence:
+            size: 10Gi
+            storageClass: ${STORAGE_CLASS}
+      vaultEnv:
+        enabled: true
+        role: camunda-contour
+        authPath: auth/kubernetes
+        envFiles:
+          KEYCLOAK_ADMIN_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_DATABASE_PASSWORD:
+            path: secrets/data/camunda/keycloak-db
+            key: password
+      global:
+        storageClass: ${STORAGE_CLASS}
+      tolerations: []
+    elasticsearch:
+      sysctlImage:
+        registry: cr.yandex
+        repository: crp3ccidau046kdj8g9q/contour/camunda/os-shell
+        tag: 12-debian-12-r32
+        pullSecrets:
+          - regcred
+      master:
+        replicaCount: 1
+        podAntiAffinityPreset: soft
+        persistence:
+          size: 10Gi
+          storageClass: ${STORAGE_CLASS}
+        tolerations: []
+      metrics:
+        enabled: false
+        serviceMonitor:
+          enabled: false
+        prometheusRule:
+          enabled: false
+        tolerations: []
+    camundaCanary:
+      enabled: false
+    prometheusServiceMonitor:
+      enabled: false
+    console:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebe:
+      clusterSize: "1"
+      partitionCount: "1"
+      replicationFactor: "1"
+      pvcStorageClassName: ${STORAGE_CLASS}
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebeGateway:
+      replicas: 1
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    identity:
+      fullURL: "https://${HOST_CAMUNDA_IDENTITY}"
+      externalDatabase:
+        enabled: true
+        host: pg-host.storage.svc.cluster.local
+        port: 5432
+        username: identity
+        database: identity
+        password: ""
+        existingSecret: ""
+        existingSecretPasswordKey: password
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    operate:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    tasklist:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    optimize:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    executionIdentity:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    webModeler:
+      image:
+        pullSecrets:
+          - name: regcred
+      restapi:
+        tolerations: []
+      webapp:
+        tolerations: []
+      websockets:
+        tolerations: []
+    connectors:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
--- a/infrastructure/camunda/contour-template/kustomization.yaml
+++ b/infrastructure/camunda/contour-template/kustomization.yaml
@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: camunda.yaml
--- a/infrastructure/istio-config/contour-template/istio-config.yaml
+++ b/infrastructure/istio-config/contour-template/istio-config.yaml
@ -0,0 +1,117 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      env: contour
+    environments:
+      contour:
+        istio:
+          gateways:
+            platform:
+              name: platform-gateway
+              namespace: default
+              selector:
+                istio: ingressgateway
+              servers:
+              - hosts:
+                - ${HOST_LOGIN}
+                - ${HOST_CAMUNDA}
+                - ${HOST_CAMUNDA_IDENTITY}
+                - ${HOST_CAMUNDA_KEYCLOAK}
+                - ${HOST_CAMUNDA_OPTIMIZE}
+                - ${HOST_CAMUNDA_TASKLIST}
+                - ${HOST_RABBITMQ}
+                tls:
+                  credentialName: istio-ingress-tls
+          virtualServices:
+            zitadel:
+              name: zitadel-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_LOGIN}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: zitadel-idp-contour.zitadel.svc.cluster.local
+                port: 8080
+            camunda-operate:
+              name: camunda-operate-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-operate.camunda.svc.cluster.local
+                port: 80
+            camunda-identity:
+              name: camunda-identity-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_IDENTITY}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-identity.camunda.svc.cluster.local
+                port: 80
+            camunda-keycloak:
+              name: camunda-keycloak-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_KEYCLOAK}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-keycloak.camunda.svc.cluster.local
+                port: 80
+            camunda-optimize:
+              name: camunda-optimize-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_OPTIMIZE}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-optimize.camunda.svc.cluster.local
+                port: 80
+            camunda-tasklist:
+              name: camunda-tasklist-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_TASKLIST}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-tasklist.camunda.svc.cluster.local
+                port: 80
+            rabbitmq:
+              name: rabbitmq-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_RABBITMQ}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: rabbitmq.rabbitmq.svc.cluster.local
+                port: 15672
--- a/infrastructure/istio-config/contour-template/kustomization.yaml
+++ b/infrastructure/istio-config/contour-template/kustomization.yaml
@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-config.yaml
--- a/infrastructure/istio-config/vk-infra/istio-config.yaml
+++ b/infrastructure/istio-config/vk-infra/istio-config.yaml
@ -103,6 +103,17 @@ spec:
                renewBefore: 360h0m0s
                privateKey:
                  rotationPolicy: Always
+            goalert-tls:
+              dnsNames:
+                - goalert.infra.sarex.io
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              spec:
+                duration: 2160h0m0s
+                renewBefore: 360h0m0s
+                privateKey:
+                  rotationPolicy: Always
        istio:
          gateways:
            vault:
@ -172,6 +183,17 @@ spec:
                  tls:
                    credentialName: wiki-tls
                    mode: SIMPLE
+            goalert:
+              name: goalert-gateway
+              namespace: istio-system
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - goalert.infra.sarex.io
+                  tls:
+                    credentialName: goalert-tls
+                    mode: SIMPLE
          virtualServices:
            vault-virt-service:
              namespace: istio-system
@ -250,3 +272,14 @@ spec:
                    prefix: /
                  service: outline.outline.svc.cluster.local
                  port: 80
+            goalert-virt-service:
+              namespace: istio-system
+              hosts:
+                - goalert.infra.sarex.io
+              gateways:
+                - istio-system/goalert-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: goalert.goalert.svc.cluster.local
+                  port: 8081
--- a/infrastructure/kafka/contour-template/kafka.yaml
+++ b/infrastructure/kafka/contour-template/kafka.yaml
@ -47,7 +47,7 @@ spec:
      automountServiceAccountToken: true
    listeners:
      client:
-        protocol: SASL_SSL
+        protocol: SASL_PLAINTEXT
        sslClientAuth: "none"
    provisioning:
      enabled: false
--- a/infrastructure/zitadel/contour-template/kustomization.yaml
+++ b/infrastructure/zitadel/contour-template/kustomization.yaml
@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: zitadel.yaml
--- a/infrastructure/zitadel/contour-template/zitadel.yaml
+++ b/infrastructure/zitadel/contour-template/zitadel.yaml
@ -0,0 +1,168 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: zitadel
+  namespace: zitadel
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: postgresql
+      namespace: postgresql
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: zitadel-idp-contour
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-init
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-setup
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+  values:
+    zitadel:
+      configmapConfig:
+        ExternalDomain: ${HOST_LOGIN}
+        ExternalSecure: true
+        # IAM_OWNER service user for sarexctl phase zitadel-setup; the chart stores its key
+        # in secret zitadel/sarex-installer. Created only on the first instance setup.
+        FirstInstance:
+          Org:
+            Machine:
+              Machine:
+                Username: sarex-installer
+                Name: sarexctl
+              MachineKey:
+                ExpirationDate: "2099-01-01T00:00:00Z"
+                Type: 1
+      debug:
+        enabled: false
+    postgresqlSecret:
+      create: false
+      vault:
+        enabled: true
+        role: zitadel
+        authPath: auth/kubernetes
+        secretPath: secrets/data/zitadel/postgresql
+        secretKey: password
+        kvVersion: 2
+        fileName: zitadel-vault-config.yaml
+    serviceAccount:
+      create: true
+      name: zitadel-idp-contour
+    replicaCount: 1
+    pdb:
+      enabled: false
+    env:
+      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
+        value: "false"
+      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
+        value: "bcrypt,pbkdf2"
+      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
+        value: "true"
+      - name: ZITADEL_DATABASE_POSTGRES_HOST
+        value: "postgresql.postgresql.svc.cluster.local"
+      - name: ZITADEL_DATABASE_POSTGRES_PORT
+        value: "5432"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
+        value: "zitadel-admin"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
+        value: "Sarex"
Author	SHA1	Message	Date
Kochetkov S	e4e5e06aec	++ camunda legacy wait	2026-10-31 17:45:29 +03:00
Kochetkov S	9f2c6932d7	++ camunda timeout 30m	2026-10-31 15:21:43 +03:00
ivan	cd94931c76	++ merge feat/zitadel-setup: sarex-installer machine user Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-30 13:53:12 +05:00
ivan	104bde49c4	++	2026-10-29 18:23:28 +05:00
ivan	b61571a858	++	2026-10-29 17:36:35 +05:00
Kochetkov S	13b9ca8a9f	++ stand chart repo from vars	2026-10-29 15:05:47 +03:00
ivan	31bdc74c80	++	2026-10-29 16:11:54 +05:00
ivan	9f4801af68	++ contour zitadel: sarex-installer machine user for zitadel-setup Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 15:32:27 +05:00
ivan	63b33aaafb	++	2026-10-29 13:06:42 +05:00
ivan	fb52d422ca	++	2026-10-29 12:37:46 +05:00
ivan	deb0d5f0eb	++	2026-10-28 20:06:09 +05:00
Kochetkov S	1613172dd6	++ contour kafka client sasl plaintext	2026-10-28 15:47:31 +03:00
Kochetkov S	b7c36a5348	++ stand routing layer	2026-10-28 15:31:36 +03:00
Kochetkov S	0037411aae	++ stand camunda via vault	2026-10-28 15:18:25 +03:00
Kochetkov S	c23b51e2a5	infra: route GoAlert through VK Istio	2026-10-28 14:39:19 +03:00
Kochetkov S	448a994fd4	Merge branch 'master' of https://gitlab.sarex.io/infra/iac	2026-10-28 14:38:14 +03:00
Дмитрий Лавренчук	bfad13da2f	Merge branch 'pdm/update-image-api-fix-copy' into 'master' fix: image documentation updated See merge request infra/iac!14	2026-10-28 10:36:26 +00:00
diamondrigido	f936f5ffb0	fix: image documentation updated	2026-10-28 12:31:00 +02:00
ivan	25b3536124	++	2026-10-28 14:51:22 +05:00
ivan	cdc2c34bca	++	2026-10-28 14:39:15 +05:00
ivan	3b53a99371	++	2026-10-28 14:30:36 +05:00
ivan	aa3365cb0d	++	2026-10-28 14:27:20 +05:00
ivan	7cf8b13f91	++	2026-10-28 14:00:45 +05:00
Kochetkov S	1c3525fc1b	++ stand platform layer zitadel	2026-10-28 11:15:41 +03:00