++ uralkal vault istio-base istio-pilot istio-gateway

.gitlab-ci.yml

@@ -27,7 +27,9 @@ build_offline_mirror:
         --build-arg BUILT_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
         ${BUILD_ARGS}
         -t ${IMAGE_NAME}
+        -t ${CR}/${RELEASE_NAME}:latest
 
     - docker run --rm -e DRY_RUN=true ${IMAGE_NAME}
     - docker push ${IMAGE_NAME}
+    - docker push ${CR}/${RELEASE_NAME}:latest
   timeout: 30m

clusters/uralkal/flux-system/gotk-sync.yaml

@@ -0,0 +1,25 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: master
+  url: http://10.133.0.246:32526/infra/iac.git
+  secretRef:
+    name: flux-system
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./clusters/uralkal
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

clusters/uralkal/flux-system/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gotk-components.yaml
+- gotk-sync.yaml

clusters/uralkal/helm-repositories.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: yc-oci-charts
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 10m0s
+  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
+  secretRef:
+    name: yc-cr-auth

clusters/uralkal/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./flux-system
+  - ./helm-repositories.yaml
+
+  - ../../infrastructure/vault/uralkal
+  - ../../infrastructure/istio-base/uralkal
+  - ../../infrastructure/istio-pilot/uralkal
+  - ../../infrastructure/istio-gateway/uralkal

infrastructure/istio-base/uralkal/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base

infrastructure/istio-gateway/uralkal/istio-gateway.yaml

@@ -0,0 +1,37 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway
+  namespace: istio-system
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  values:
+    _internal_defaults_do_not_set:
+      service:
+        type: NodePort
+        ports:
+          - name: status-port
+            port: 15021
+            protocol: TCP
+            targetPort: 15021
+          - name: http2
+            port: 80
+            protocol: TCP
+            targetPort: 80
+            nodePort: 30080
+          - name: https
+            port: 443
+            protocol: TCP
+            targetPort: 443
+            nodePort: 30443
+      nodeSelector:
+        node-role.kubernetes.io/control-plane: ""
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          effect: NoSchedule

infrastructure/istio-gateway/uralkal/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-gateway.yaml

infrastructure/istio-pilot/uralkal/istio-pilot.yaml

@@ -0,0 +1,15 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istiod
+  namespace: istio-system
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+  values:
+    global:
+      imagePullSecrets:
+        - regcred

infrastructure/istio-pilot/uralkal/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-pilot.yaml

infrastructure/vault/uralkal/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: vault.yaml

infrastructure/vault/uralkal/vault.yaml

@@ -0,0 +1,40 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault
+  namespace: vault
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: vault
+              name: vault-vault-contour
+            patch: |-
+              - op: replace
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: replace
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    imagePullSecrets:
+      - name: regcred
+    backup:
+      enabled: false
+    injector:
+      nodeSelector:
+        dedicated: generic
+      tolerations: []
+    server:
+      nodeSelector:
+        dedicated: generic
+      tolerations: []
+      dataStorage:
+        storageClass: local-path