385abf1092
- infrastructure/outline/vk-infra: namespace, HelmRelease outline-valkey (valkey 0.1.0, standalone) и outline (outline 0.1.0, Outline 1.12.0) - clusters/vk-infra: подключение outline/vk-infra - istio-config/vk-infra: Certificate, Gateway и VirtualService для wiki.sarex.space Секреты outline и outline-valkey созданы в кластере вручную.
253 lines
7.9 KiB
YAML
253 lines
7.9 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: istio-config
|
|
namespace: default
|
|
spec:
|
|
interval: 5m
|
|
timeout: 10m
|
|
dependsOn:
|
|
- name: istio-base
|
|
namespace: istio-system
|
|
- name: istiod
|
|
namespace: istio-system
|
|
- name: cert-manager
|
|
namespace: cert-manager
|
|
values:
|
|
global:
|
|
env: vk-infra
|
|
environments:
|
|
vk-infra:
|
|
certManager:
|
|
clusterIssuers:
|
|
letsencrypt-issuer-istio:
|
|
spec:
|
|
acme:
|
|
email: pavel@sarex.io
|
|
privateKeySecretRef:
|
|
name: letsencrypt-istio-account-key
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
solvers:
|
|
- http01:
|
|
ingress:
|
|
class: istio
|
|
podTemplate:
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: istio-registry-secret
|
|
certificates:
|
|
vault-tls:
|
|
dnsNames:
|
|
- vault.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
spec:
|
|
duration: 2160h0m0s
|
|
renewBefore: 360h0m0s
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
kb-tls:
|
|
dnsNames:
|
|
- kb.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
spec:
|
|
duration: 2160h0m0s
|
|
renewBefore: 360h0m0s
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
srx-ui-kit-tls:
|
|
dnsNames:
|
|
- srx-ui-kit.infra.sarex.tech
|
|
- srx-ui-kit-stage.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
spec:
|
|
duration: 2160h0m0s
|
|
renewBefore: 360h0m0s
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
nexus-tls:
|
|
dnsNames:
|
|
- nexus.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
spec:
|
|
duration: 2160h0m0s
|
|
renewBefore: 360h0m0s
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
idp-tls:
|
|
dnsNames:
|
|
- iam.sarex.io
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
spec:
|
|
duration: 2160h0m0s
|
|
renewBefore: 360h0m0s
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
wiki-tls:
|
|
dnsNames:
|
|
- wiki.sarex.space
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
spec:
|
|
duration: 2160h0m0s
|
|
renewBefore: 360h0m0s
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
istio:
|
|
gateways:
|
|
vault:
|
|
name: vault-gateway
|
|
namespace: istio-system
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- hosts:
|
|
- vault.infra.sarex.tech
|
|
tls:
|
|
credentialName: vault-tls
|
|
mode: SIMPLE
|
|
kb:
|
|
name: kb-gateway
|
|
namespace: istio-system
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- hosts:
|
|
- kb.infra.sarex.tech
|
|
tls:
|
|
credentialName: kb-tls
|
|
mode: SIMPLE
|
|
srx-ui-kit:
|
|
name: srx-ui-kit-gateway
|
|
namespace: istio-system
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- hosts:
|
|
- srx-ui-kit.infra.sarex.tech
|
|
- srx-ui-kit-stage.infra.sarex.tech
|
|
tls:
|
|
credentialName: srx-ui-kit-tls
|
|
mode: SIMPLE
|
|
nexus:
|
|
name: nexus-gateway
|
|
namespace: istio-system
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- hosts:
|
|
- nexus.infra.sarex.tech
|
|
tls:
|
|
credentialName: nexus-tls
|
|
mode: SIMPLE
|
|
idp:
|
|
name: idp-gateway
|
|
namespace: istio-system
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- hosts:
|
|
- iam.sarex.io
|
|
tls:
|
|
credentialName: idp-tls
|
|
mode: SIMPLE
|
|
wiki:
|
|
name: wiki-gateway
|
|
namespace: istio-system
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- hosts:
|
|
- wiki.sarex.space
|
|
tls:
|
|
credentialName: wiki-tls
|
|
mode: SIMPLE
|
|
virtualServices:
|
|
vault-virt-service:
|
|
namespace: istio-system
|
|
hosts:
|
|
- vault.infra.sarex.tech
|
|
gateways:
|
|
- istio-system/vault-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: vault-vault-contour-active.vault.svc.cluster.local
|
|
port: 8200
|
|
kb-virt-service:
|
|
namespace: istio-system
|
|
hosts:
|
|
- kb.infra.sarex.tech
|
|
gateways:
|
|
- istio-system/kb-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: kb-service.kb.svc.cluster.local
|
|
port: 80
|
|
srx-ui-kit-virt-service:
|
|
namespace: istio-system
|
|
hosts:
|
|
- srx-ui-kit.infra.sarex.tech
|
|
gateways:
|
|
- istio-system/srx-ui-kit-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: universal-static-site-srx-ui-kit-pages.gitlab-pages-srx-ui-kit.svc.cluster.local
|
|
port: 80
|
|
srx-ui-kit-stage-virt-service:
|
|
namespace: istio-system
|
|
hosts:
|
|
- srx-ui-kit-stage.infra.sarex.tech
|
|
gateways:
|
|
- istio-system/srx-ui-kit-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: universal-static-site-srx-ui-kit-stage-pages.gitlab-pages-srx-ui-kit-stage.svc.cluster.local
|
|
port: 80
|
|
nexus-virt-service:
|
|
namespace: istio-system
|
|
hosts:
|
|
- nexus.infra.sarex.tech
|
|
gateways:
|
|
- istio-system/nexus-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: nexus.nexus.svc.cluster.local
|
|
port: 8081
|
|
idp-virt-service:
|
|
namespace: istio-system
|
|
hosts:
|
|
- iam.sarex.io
|
|
gateways:
|
|
- istio-system/idp-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: idp.zitadel.svc.cluster.local
|
|
port: 8080
|
|
wiki-virt-service:
|
|
namespace: istio-system
|
|
hosts:
|
|
- wiki.sarex.space
|
|
gateways:
|
|
- istio-system/wiki-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: outline.outline.svc.cluster.local
|
|
port: 80
|