apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: istio-config
  namespace: default
spec:
  interval: 5m
  timeout: 10m
  dependsOn: []
  values:
    global:
      env: wb
    environments:
      wb:
        namespaces: []
        certManager:
          clusterIssuers: {}
          certificates: {}
        istio:
          envoyFilters: {}
          authorizationPolicies: {}
          requestAuthentications: {}
          gateways:
            gitea:
              name: gitea-gw
              namespace: gateway
              selector:
                istio: ingressgateway
              servers:
                - hosts:
                    - gitea-srx.wb.ru
                  tls:
                    credentialName: istio-gateway-wildcard-cert
            grafana:
              name: grafana-gw
              namespace: gateway
              selector:
                istio: ingressgateway
              servers:
                - hosts:
                    - grafana-srx.wb.ru
                  tls:
                    credentialName: istio-gateway-wildcard-cert
            openobserve:
              name: openobserve-gw
              namespace: gateway
              selector:
                istio: ingressgateway
              servers:
                - hosts:
                    - openobserve-srx.wb.ru
                  tls:
                    credentialName: istio-gateway-wildcard-cert
            superset:
              name: superset-gw
              namespace: gateway
              selector:
                istio: ingressgateway
              servers:
                - hosts:
                    - bi-srx.wb.ru
                  tls:
                    credentialName: istio-gateway-wildcard-cert
            vmalert:
              name: vmalert-gw
              namespace: gateway
              selector:
                istio: ingressgateway
              servers:
                - hosts:
                    - vmalert-srx.wb.ru
                  tls:
                    credentialName: istio-gateway-wildcard-cert
            vault:
              name: vault-gw
              namespace: gateway
              selector:
                istio: ingressgateway
              servers:
                - hosts:
                    - vault-srx.wb.ru
                  tls:
                    credentialName: istio-gateway-wildcard-cert
          virtualServices:
            gitea-vs:
              namespace: gitea
              hosts:
                - gitea-srx.wb.ru
              gateways:
                - gateway/gitea-gw
              routes:
                - path:
                    prefix: /
                  service: gitea.gitea.svc.cluster.local
                  port: 3000
            grafana-vs:
              namespace: prometheus-stack
              hosts:
                - grafana-srx.wb.ru
              gateways:
                - gateway/grafana-gw
              routes:
                - path:
                    prefix: /
                  service: prometheus-stack-grafana.prometheus-stack.svc.cluster.local
                  port: 80
            openobserve-vs:
              namespace: openobserve
              hosts:
                - openobserve-srx.wb.ru
              gateways:
                - gateway/openobserve-gw
              routes:
                - path:
                    prefix: /
                  service: openobserve-web.openobserve.svc.cluster.local
                  port: 5080
            superset-vs:
              namespace: superset
              hosts:
                - bi-srx.wb.ru
              gateways:
                - gateway/superset-gw
              routes:
                - path:
                    prefix: /
                  service: superset.superset.svc.cluster.local
                  port: 8088
            vmalert-vs:
              namespace: goalert
              hosts:
                - vmalert-srx.wb.ru
              gateways:
                - gateway/vmalert-gw
              routes:
                - path:
                    prefix: /
                  service: goalert.goalert.svc.cluster.local
                  port: 8081
            # Без этого VS /bimv2/api/* попадает в catch-all "/" фронта
            # (django/vs-sarex-frontend) и отдаёт 200 с HTML вместо JSON.
            bim-backend-v2:
              namespace: bim
              hosts:
                - srx.wb.ru
                - lk.srx.wb.ru
              gateways:
                - istio-system/main-gateway
              cors:
                allowOrigins:
                  - exact: https://srx.wb.ru
                  - exact: https://lk.srx.wb.ru
              routes:
                - path:
                    prefix: /bimv2/api/
                  rewrite: /api/
                  service: backend-service.bim.svc.cluster.local
                  port: 8000
            vault-vs:
              namespace: vault
              hosts:
                - vault-srx.wb.ru
              gateways:
                - gateway/vault-gw
              routes:
                - path:
                    prefix: /
                  service: vault-vault-contour-active.vault.svc.cluster.local
                  port: 8200