++ stand flux cancel stale health check

clusters/stand/10-mesh/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-base/contour-template
+  - ../../../infrastructure/istio-pilot/contour-template
+  - ../../../infrastructure/istio-gateway/contour-template
+  - ../../../infrastructure/cert-manager/contour-template

clusters/stand/flux-system/kustomization.yaml

@@ -3,3 +3,11 @@ kind: Kustomization
 resources:
 - gotk-components.yaml
 - gotk-sync.yaml
+patches:
+- target:
+    kind: Deployment
+    name: kustomize-controller
+  patch: |-
+    - op: add
+      path: /spec/template/spec/containers/0/args/-
+      value: --feature-gates=CancelHealthCheckOnNewRevision=true

clusters/stand/layers.yaml

@@ -15,3 +15,22 @@ spec:
     substituteFrom:
       - kind: ConfigMap
         name: contour-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 10-mesh
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 15m0s
+  path: ./clusters/stand/10-mesh
+  prune: true
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars

infrastructure/cert-manager/contour-template/cert-manager.yaml

@@ -0,0 +1,25 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    controller:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cert-manager
+      acmesolver:
+        image:
+          registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+          repository: acmesolver
+    webhook:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cert-manager-webhook
+    cainjector:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cainjector

infrastructure/cert-manager/contour-template/kustomization.yaml

@@ -0,0 +1,28 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: cert-manager.yaml
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer-istio
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer-istio

infrastructure/istio-base/contour-template/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base

infrastructure/istio-gateway/contour-template/istio-gateway.yaml

@@ -0,0 +1,31 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway
+  namespace: istio-system
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  values:
+    _internal_defaults_do_not_set:
+      replicaCount: ${GATEWAY_REPLICAS}
+      service:
+        type: ClusterIP
+      nodeSelector:
+        sarex.io/gateway: "true"
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  istio: ingressgateway
+              topologyKey: kubernetes.io/hostname
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule

infrastructure/istio-gateway/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-gateway.yaml

infrastructure/istio-pilot/contour-template/istio-pilot.yaml

@@ -0,0 +1,12 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istiod
+  namespace: istio-system
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      imagePullSecrets:
+        - regcred

infrastructure/istio-pilot/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-pilot.yaml