++ fix gateway wildcard and drop foreign domains

clusters/vad/kustomization.yaml

@@ -9,3 +9,8 @@ resources:
   - ../../infrastructure/istio-gateway/vad
   - ../../infrastructure/vault/vad
   - ../../infrastructure/rabbitmq/vad
+  - ../../infrastructure/kafka/vad
+  - ../../infrastructure/camunda/vad
+  - ../../infrastructure/zitadel/vad
+  - ../../infrastructure/istio-config/vad
+  - ../../infrastructure/s3-proxy/vad

infrastructure/camunda/vad/camunda.yaml

@@ -0,0 +1,316 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: camunda
+  namespace: camunda
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 15m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: camunda
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              namespace: camunda
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-connectors
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-identity
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-operate
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-optimize
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-tasklist
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-zeebe-gateway
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: camunda
+              name: camunda-zeebe
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    global:
+      vault:
+        enabled: true
+        role: camunda
+        authPath: auth/kubernetes
+        secrets:
+          postgresql:
+            path: secrets/data/camunda/postgresql
+            keys:
+              password: identity-password
+              postgresPassword: postgres-password
+      image:
+        pullSecrets:
+          - name: regcred
+      identity:
+        auth:
+          publicIssuerUrl: "https://camunda-keycloak.sarex.vadroad.ru/auth/realms/camunda-platform"
+          identity:
+            redirectUrl: "https://camunda-identity.sarex.vadroad.ru"
+          operate:
+            redirectUrl: "https://camunda.sarex.vadroad.ru"
+          tasklist:
+            redirectUrl: "https://camunda-tasklist.sarex.vadroad.ru"
+          optimize:
+            redirectUrl: "https://camunda-optimize.sarex.vadroad.ru"
+    identityPostgresql:
+      enabled: false
+      auth:
+        usePasswordFiles: true
+      primary:
+        automountServiceAccountToken: true
+        persistence:
+          size: 10Gi
+          storageClass: local-path
+    identityKeycloak:
+      externalDatabase:
+        host: 192.168.8.131
+        port: 5432
+        user: bn_keycloak
+        database: bitnami_keycloak
+        password: ""
+        existingSecret: ""
+        existingSecretPasswordKey: password
+      postgresql:
+        enabled: false
+        auth:
+          usePasswordFiles: true
+        primary:
+          automountServiceAccountToken: true
+          persistence:
+            size: 10Gi
+            storageClass: local-path
+      vaultEnv:
+        enabled: true
+        role: camunda
+        authPath: auth/kubernetes
+        envFiles:
+          KEYCLOAK_ADMIN_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_DATABASE_PASSWORD:
+            path: secrets/data/camunda/postgresql
+            key: keycloak-password
+      global:
+        storageClass: local-path
+      tolerations: []
+    elasticsearch:
+      master:
+        replicaCount: 1
+        podAntiAffinityPreset: soft
+        persistence:
+          size: 10Gi
+          storageClass: local-path
+        tolerations: []
+      metrics:
+        enabled: false
+        serviceMonitor:
+          enabled: false
+        prometheusRule:
+          enabled: false
+        tolerations: []
+    camundaCanary:
+      enabled: false
+    prometheusServiceMonitor:
+      enabled: false
+    console:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebe:
+      clusterSize: "1"
+      partitionCount: "1"
+      replicationFactor: "1"
+      pvcStorageClassName: local-path
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebeGateway:
+      replicas: 1
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    identity:
+      fullURL: "https://camunda-identity.sarex.vadroad.ru"
+      externalDatabase:
+        enabled: true
+        host: 192.168.8.131
+        port: 5432
+        username: identity
+        database: identity
+        password: ""
+        existingSecret: ""
+        existingSecretPasswordKey: password
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    operate:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    tasklist:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    optimize:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    executionIdentity:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    webModeler:
+      image:
+        pullSecrets:
+          - name: regcred
+      restapi:
+        tolerations: []
+      webapp:
+        tolerations: []
+      websockets:
+        tolerations: []
+    connectors:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []

infrastructure/camunda/vad/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: camunda.yaml

infrastructure/istio-config/vad/istio-config.yaml

@@ -0,0 +1,126 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      env: vad
+    environments:
+      vad:
+        istio:
+          gateways:
+            platform:
+              name: platform-gateway
+              namespace: default
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - sarex.vadroad.ru
+                    - login.sarex.vadroad.ru
+                    - bi.sarex.vadroad.ru
+                    - document-link.sarex.vadroad.ru
+                    - s3.sarex.vadroad.ru
+                    - camunda.sarex.vadroad.ru
+                    - camunda-identity.sarex.vadroad.ru
+                    - camunda-keycloak.sarex.vadroad.ru
+                    - camunda-optimize.sarex.vadroad.ru
+                    - camunda-tasklist.sarex.vadroad.ru
+                    - rabbitmq.sarex.vadroad.ru
+                    - sarex-stamp-verification.vadroad.ru
+                  tls:
+                    credentialName: istio-ingress-tls
+          virtualServices:
+            zitadel:
+              namespace: default
+              hosts:
+                - login.sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: zitadel-idp-contour.zitadel.svc.cluster.local
+                  port: 8080
+            camunda-operate:
+              namespace: default
+              hosts:
+                - camunda.sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-operate.camunda.svc.cluster.local
+                  port: 80
+            camunda-identity:
+              namespace: default
+              hosts:
+                - camunda-identity.sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-identity.camunda.svc.cluster.local
+                  port: 80
+            camunda-keycloak:
+              namespace: default
+              hosts:
+                - camunda-keycloak.sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-keycloak.camunda.svc.cluster.local
+                  port: 80
+            camunda-optimize:
+              namespace: default
+              hosts:
+                - camunda-optimize.sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-optimize.camunda.svc.cluster.local
+                  port: 80
+            camunda-tasklist:
+              namespace: default
+              hosts:
+                - camunda-tasklist.sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-tasklist.camunda.svc.cluster.local
+                  port: 80
+            rabbitmq:
+              namespace: default
+              hosts:
+                - rabbitmq.sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: rabbitmq.rabbitmq.svc.cluster.local
+                  port: 15672
+            s3:
+              namespace: default
+              hosts:
+                - s3.sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: s3-proxy.s3-proxy.svc.cluster.local
+                  port: 80

infrastructure/istio-config/vad/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-config.yaml

infrastructure/kafka/vad/kafka.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kafka
+  namespace: kafka
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: kafka
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    global:
+      imagePullSecrets:
+        - regcred
+      defaultStorageClass: local-path
+    image:
+      pullSecrets:
+        - regcred
+    controller:
+      replicaCount: 1
+      automountServiceAccountToken: true
+      persistence:
+        size: 8Gi
+        storageClass: local-path
+      overrideConfiguration:
+        offsets.topic.replication.factor: 1
+        transaction.state.log.replication.factor: 1
+        transaction.state.log.min.isr: 1
+        default.replication.factor: 1
+        min.insync.replicas: 1
+    broker:
+      replicaCount: 0
+      automountServiceAccountToken: true
+    listeners:
+      client:
+        protocol: SASL_SSL
+        sslClientAuth: "none"
+    provisioning:
+      enabled: false
+    sasl:
+      managedExistingSecret:
+        enabled: false
+      existingSecret: ""
+      enabledMechanisms: PLAIN,SCRAM-SHA-512
+      interBrokerMechanism: PLAIN
+      controllerMechanism: PLAIN
+      client:
+        users: []
+        passwords: ""
+    tls:
+      type: PEM
+    vault:
+      enabled: true
+      role: kafka
+      authPath: auth/kubernetes
+      secretPath: secrets/data/kafka/bootstrap
+      clusterIdKey: clusterId
+      interBrokerPasswordKey: interBrokerPassword
+      controllerPasswordKey: controllerPassword

infrastructure/kafka/vad/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: kafka.yaml

infrastructure/s3-proxy/vad/configmap.yaml

@@ -0,0 +1,52 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: s3-proxy-nginx-conf
+  namespace: s3-proxy
+data:
+  nginx.conf: |
+    worker_processes auto;
+    error_log /dev/stderr info;
+
+    events {
+      worker_connections 1024;
+    }
+
+    http {
+      access_log off;
+
+      upstream minio_backend {
+        least_conn;
+        server 192.168.8.121:9000 max_fails=3 fail_timeout=10s;
+        server 192.168.8.122:9000 max_fails=3 fail_timeout=10s;
+        server 192.168.8.123:9000 max_fails=3 fail_timeout=10s;
+        server 192.168.8.124:9000 max_fails=3 fail_timeout=10s;
+      }
+
+      server {
+        listen 8080;
+        server_name _;
+
+        ignore_invalid_headers off;
+        client_max_body_size 0;
+        proxy_buffering off;
+        proxy_request_buffering off;
+
+        location /healthz {
+          return 200 "ok\n";
+        }
+
+        location / {
+          proxy_http_version 1.1;
+          proxy_set_header Host $http_host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_connect_timeout 5s;
+          proxy_read_timeout 300s;
+          proxy_send_timeout 300s;
+          chunked_transfer_encoding off;
+          proxy_pass http://minio_backend;
+        }
+      }
+    }

infrastructure/s3-proxy/vad/deployment.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: s3-proxy
+  namespace: s3-proxy
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: s3-proxy
+  template:
+    metadata:
+      labels:
+        app: s3-proxy
+    spec:
+      nodeSelector:
+        dedicated: generic
+      tolerations: []
+      containers:
+        - name: nginx
+          image: nginx:1.25-alpine
+          volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/nginx.conf
+              subPath: nginx.conf
+          ports:
+            - name: http
+              containerPort: 8080
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: nginx-conf
+          configMap:
+            name: s3-proxy-nginx-conf

infrastructure/s3-proxy/vad/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - configmap.yaml
+  - deployment.yaml
+  - service.yaml

infrastructure/s3-proxy/vad/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: s3-proxy
+  labels:
+    istio-injection: disabled

infrastructure/s3-proxy/vad/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: s3-proxy
+  namespace: s3-proxy
+spec:
+  type: ClusterIP
+  selector:
+    app: s3-proxy
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP

infrastructure/zitadel/vad/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: zitadel.yaml

infrastructure/zitadel/vad/zitadel.yaml

@@ -0,0 +1,154 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: zitadel
+  namespace: zitadel
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: zitadel-idp-contour
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-init
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-setup
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+  values:
+    zitadel:
+      configmapConfig:
+        ExternalDomain: login.sarex.vadroad.ru
+        ExternalSecure: true
+      debug:
+        enabled: false
+    postgresqlSecret:
+      create: false
+      vault:
+        enabled: true
+        role: zitadel
+        authPath: auth/kubernetes
+        secretPath: secrets/data/zitadel/postgresql
+        secretKey: password
+        kvVersion: 2
+        fileName: zitadel-vault-config.yaml
+    serviceAccount:
+      create: true
+      name: zitadel
+    replicaCount: 1
+    pdb:
+      enabled: false
+    env:
+      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
+        value: "false"
+      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
+        value: "bcrypt,pbkdf2"
+      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
+        value: "true"
+      - name: ZITADEL_DATABASE_POSTGRES_HOST
+        value: "192.168.8.131"
+      - name: ZITADEL_DATABASE_POSTGRES_PORT
+        value: "5432"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
+        value: "zitadel-admin"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
+        value: "Sarex"