clusters/vk-infra/infrastructure/kustomization.yaml

@@ -7,6 +7,3 @@ resources:
   - ../../../infrastructure/cert-manager/vk-infra
   - ../../../infrastructure/istio-config/vk-infra
   - ../../../infrastructure/zitadel/vk-infra
-  - ../../../infrastructure/vault-unseal/vk-infra
-  - ../../../infrastructure/vault/vk-infra
-  - ../../../infrastructure/kb/vk-infra

infrastructure/gitlab-runner/vk-infra/gitlab-runner.yaml

@@ -1,79 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitlab-runner
-  namespace: gitlab-managed-apps
-spec:
-  interval: 10m
-  timeout: 10m
-  chart:
-    spec:
-      chart: gitlab-runner-infra
-      version: "17.5.3"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  values:
-    gitlabUrl: https://gitlab.sarex.io
-    concurrent: 20
-    checkInterval: 10
-    unregisterRunners: true
-    terminationGracePeriodSeconds: 3600
-    image:
-      registry: cr.yandex/crp3ccidau046kdj8g9q
-      image: mirror/gitlab-runner
-    imagePullSecrets:
-      - name: istio-registry-secret
-    nodeSelector:
-      sarex.io/pool: svc
-    rbac:
-      create: true
-      clusterWideAccess: false
-    serviceAccount:
-      create: true
-    podSecurityContext:
-      fsGroup: 65533
-      runAsUser: 100
-    metrics:
-      enabled: false
-    runners:
-      secret: gitlab-runner-secret
-      executor: kubernetes
-      cache: {}
-      config: |
-        [[runners]]
-          [runners.kubernetes]
-            namespace = "{{.Release.Namespace}}"
-            image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/docker:24.0.5"
-            helper_image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/gitlab-runner-helper:x86_64-v17.5.3"
-            image_pull_secrets = ["istio-registry-secret"]
-            poll_interval = 10
-            poll_timeout = 600
-            privileged = true
-            tls_verify = false
-            cpu_request = "0.1"
-            cpu_limit = "3"
-            memory_request = "128Mi"
-            memory_limit = "3Gi"
-            helper_cpu_request = "0.05"
-            helper_cpu_limit = "3"
-            helper_memory_request = "32Mi"
-            helper_memory_limit = "10Gi"
-            service_cpu_request = "0.5"
-            service_cpu_limit = "3"
-            service_memory_request = "3Gi"
-
-            [runners.feature_flags]
-              FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY = false
-            [runners.kubernetes.node_selector]
-              "sarex.io/pool" = "runners"
-            [runners.kubernetes.node_tolerations]
-              "sarex.io/pool=runners" = "NoSchedule"

infrastructure/gitlab-runner/vk-infra/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - gitlab-runner.yaml

infrastructure/gitlab-runner/vk-infra/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitlab-managed-apps

infrastructure/istio-config/vk-infra/istio-config.yaml

@@ -36,28 +36,6 @@ spec:
                               imagePullSecrets:
                                 - name: istio-registry-secret
           certificates:
-            vault-tls:
-              dnsNames:
-                - vault.infra.sarex.tech
-              issuerRef:
-                name: letsencrypt-issuer-istio
-                kind: ClusterIssuer
-              spec:
-                duration: 2160h0m0s
-                renewBefore: 360h0m0s
-                privateKey:
-                  rotationPolicy: Always
-            kb-tls:
-              dnsNames:
-                - kb.infra.sarex.tech
-              issuerRef:
-                name: letsencrypt-issuer-istio
-                kind: ClusterIssuer
-              spec:
-                duration: 2160h0m0s
-                renewBefore: 360h0m0s
-                privateKey:
-                  rotationPolicy: Always
             idp-tls:
               dnsNames:
                 - iam.sarex.io
@@ -71,28 +49,6 @@ spec:
                   rotationPolicy: Always
         istio:
           gateways:
-            vault:
-              name: vault-gateway
-              namespace: istio-system
-              selector:
-                istio: ingressgateway
-              servers:
-                - hosts:
-                    - vault.infra.sarex.tech
-                  tls:
-                    credentialName: vault-tls
-                    mode: SIMPLE
-            kb:
-              name: kb-gateway
-              namespace: istio-system
-              selector:
-                istio: ingressgateway
-              servers:
-                - hosts:
-                    - kb.infra.sarex.tech
-                  tls:
-                    credentialName: kb-tls
-                    mode: SIMPLE
             idp:
               name: idp-gateway
               namespace: istio-system
@@ -105,28 +61,6 @@ spec:
                     credentialName: idp-tls
                     mode: SIMPLE
           virtualServices:
-            vault-virt-service:
-              namespace: istio-system
-              hosts:
-                - vault.infra.sarex.tech
-              gateways:
-                - istio-system/vault-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: vault-vault-contour-active.vault.svc.cluster.local
-                  port: 8200
-            kb-virt-service:
-              namespace: istio-system
-              hosts:
-                - kb.infra.sarex.tech
-              gateways:
-                - istio-system/kb-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: kb-service.kb.svc.cluster.local
-                  port: 80
             idp-virt-service:
               namespace: istio-system
               hosts:

infrastructure/kb/vk-infra/kb.yaml

@@ -1,36 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: kb
-  namespace: kb
-spec:
-  interval: 10m
-  timeout: 10m
-  chart:
-    spec:
-      chart: kb
-      version: "0.0.1-infra"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  dependsOn:
-    - name: istiod
-      namespace: istio-system
-  values:
-    universal-chart:
-      global:
-        env: infra
-      image:
-        name:
-          infra: cr.yandex/crp3ccidau046kdj8g9q/kb:infra_a27f6dd0
-      imagePullSecrets:
-        name:
-          _default: istio-registry-secret

infrastructure/kb/vk-infra/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - kb.yaml

infrastructure/kb/vk-infra/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kb
-  labels:
-    istio-injection: enabled

infrastructure/vault-unseal/vk-infra/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - vault-unseal.yaml

infrastructure/vault-unseal/vk-infra/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: vault-unseal
-  labels:
-    istio-injection: enabled

infrastructure/vault-unseal/vk-infra/vault-unseal.yaml

@@ -1,97 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: vault-unseal
-  namespace: vault-unseal
-spec:
-  interval: 5m
-  timeout: 15m
-  chart:
-    spec:
-      chart: vault-contour
-      version: "0.2.3"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-  install:
-    disableWait: true
-    remediation:
-      retries: 3
-  upgrade:
-    disableWait: true
-    remediation:
-      retries: 3
-  values:
-    global:
-      namespace: vault-unseal
-      imagePullSecrets:
-        - name: istio-registry-secret
-    autounseal:
-      enabled: false
-    backup:
-      enabled: false
-    injector:
-      enabled: false
-    server:
-      includeConfigAnnotation: true
-      nodeSelector:
-        dedicated: null
-        sarex.io/pool: svc
-      tolerations: []
-      affinity: |
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchLabels:
-                  app.kubernetes.io/name: {{ template "vault.name" . }}
-                  app.kubernetes.io/instance: "{{ .Release.Name }}"
-                  component: server
-              topologyKey: topology.kubernetes.io/zone
-      dataStorage:
-        size: 10Gi
-        storageClass: csi-ceph-ssd-retain
-      ha:
-        replicas: 3
-        raft:
-          config: |
-            ui = true
-
-            listener "tcp" {
-              tls_disable = 1
-              address = "[::]:8200"
-              cluster_address = "[::]:8201"
-            }
-
-            storage "raft" {
-              path = "/vault/data"
-
-              retry_join {
-                leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
-              }
-              retry_join {
-                leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
-              }
-              retry_join {
-                leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
-              }
-            }
-
-            {{- if .Values.autounseal.enabled }}
-            seal "transit" {
-              address         = "{{ .Values.autounseal.transit.address }}"
-              token           = "env://VAULT_TOKEN"
-              key_name        = "{{ .Values.autounseal.transit.keyName }}"
-              mount_path      = "{{ .Values.autounseal.transit.mountPath }}"
-              disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
-              tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
-            }
-            {{- end }}
-
-            service_registration "kubernetes" {}
-
-            telemetry {
-              prometheus_retention_time = "30s"
-              disable_hostname = true
-            }

infrastructure/vault/vk-infra/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - vault.yaml

infrastructure/vault/vk-infra/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: vault
-  labels:
-    istio-injection: enabled

infrastructure/vault/vk-infra/vault.yaml

@@ -1,106 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: vault
-  namespace: vault
-spec:
-  interval: 5m
-  timeout: 15m
-  chart:
-    spec:
-      chart: vault-contour
-      version: "0.2.3"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-  dependsOn:
-    - name: vault-unseal
-      namespace: vault-unseal
-  install:
-    disableWait: true
-    remediation:
-      retries: 3
-  upgrade:
-    disableWait: true
-    remediation:
-      retries: 3
-  values:
-    global:
-      namespace: vault
-      imagePullSecrets:
-        - name: istio-registry-secret
-    autounseal:
-      enabled: true
-      transit:
-        address: "http://vault-unseal-vault-contour.vault-unseal.svc:8200"
-        keyName: "vault-infra-vk"
-        mountPath: "transit/"
-        tlsSkipVerify: false
-      secret:
-        create: false
-        name: "vault-transit-autounseal"
-    backup:
-      enabled: false
-    server:
-      includeConfigAnnotation: true
-      nodeSelector:
-        dedicated: null
-        sarex.io/pool: svc
-      tolerations: []
-      affinity: |
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchLabels:
-                  app.kubernetes.io/name: {{ template "vault.name" . }}
-                  app.kubernetes.io/instance: "{{ .Release.Name }}"
-                  component: server
-              topologyKey: topology.kubernetes.io/zone
-      dataStorage:
-        size: 20Gi
-        storageClass: csi-ceph-ssd-retain
-      ha:
-        replicas: 3
-        raft:
-          config: |
-            ui = true
-
-            listener "tcp" {
-              tls_disable = 1
-              address = "[::]:8200"
-              cluster_address = "[::]:8201"
-            }
-
-            storage "raft" {
-              path = "/vault/data"
-
-              retry_join {
-                leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
-              }
-              retry_join {
-                leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
-              }
-              retry_join {
-                leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
-              }
-            }
-
-            {{- if .Values.autounseal.enabled }}
-            seal "transit" {
-              address         = "{{ .Values.autounseal.transit.address }}"
-              token           = "env://VAULT_TOKEN"
-              key_name        = "{{ .Values.autounseal.transit.keyName }}"
-              mount_path      = "{{ .Values.autounseal.transit.mountPath }}"
-              disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
-              tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
-            }
-            {{- end }}
-
-            service_registration "kubernetes" {}
-
-            telemetry {
-              prometheus_retention_time = "30s"
-              disable_hostname = true
-            }