++

apps/control-interface/brusnika-stage/kustomization.yaml

@@ -1,6 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: mapper
+namespace: django
 resources:
-  - helmrelease.yaml
+  - helmrelease.yaml

apps/django/brusnika-stage/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: django
+resources:
+  - sarex-frontend.yaml

apps/django/brusnika-stage/sarex-frontend.yaml

@@ -0,0 +1,105 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.15.7
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+            stage: 1
+            preprod: 3
+            production: 3
+
+          port:
+            _default: 80
+
+          resources:
+            limits:
+              cpu:
+                _default: "2.0"
+              memory:
+                _default: 512Mi
+
+            requests:
+              cpu:
+                _default: "1.0"
+              memory:
+                _default: 128Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

clusters/brusnika-stage/kustomization.yaml

@@ -6,4 +6,5 @@ resources:
   - ./infrastructure
   - ./test-service.yaml
   - ../../apps/mapper/brusnika-stage
-  - ../../apps/control-interface/brusnika-stage
+  - ../../apps/control-interface/brusnika-stage
+  - ../../apps/django/brusnika-stage

clusters/yc-cps-prod/helm-repositories.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: yc-oci-charts
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 10m0s
+  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
+  secretRef:
+    name: yc-cr-auth

clusters/yc-cps-prod/infrastructure/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/vault
+  - ./vault-istio.yaml
+patches:
+  - path: ./patches/vault.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: vault
+      namespace: vault

clusters/yc-cps-prod/infrastructure/patches/vault.yaml

@@ -0,0 +1,12 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault
+  namespace: vault
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    server:
+      dataStorage:
+        storageClass: yc-network-hdd

clusters/yc-cps-prod/infrastructure/vault-istio.yaml

@@ -0,0 +1,61 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vault-cert
+  namespace: istio-system
+spec:
+  dnsNames:
+    - vault.infra.cps.sarex.io
+  duration: 2160h
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-issuer-istio
+  privateKey:
+    rotationPolicy: Always
+  renewBefore: 360h
+  secretName: vault-tls
+---
+apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: vault-gateway
+  namespace: gateway
+spec:
+  selector:
+    istio: ingressgateway
+  servers:
+    - hosts:
+        - vault.infra.cps.sarex.io
+      port:
+        name: https-443
+        number: 443
+        protocol: HTTPS
+      tls:
+        credentialName: vault-tls
+        mode: SIMPLE
+    - hosts:
+        - vault.infra.cps.sarex.io
+      port:
+        name: http-80
+        number: 80
+        protocol: HTTP
+---
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: vault-virt-service
+  namespace: vault
+spec:
+  gateways:
+    - gateway/vault-gateway
+  hosts:
+    - vault.infra.cps.sarex.io
+  http:
+    - match:
+        - uri:
+            prefix: /
+      route:
+        - destination:
+            host: vault-vault-contour.vault.svc.cluster.local
+            port:
+              number: 8200

clusters/yc-cps-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./flux-system
+  - ./helm-repositories.yaml
+  - ./infrastructure