Merge branch 'master' of gitlab.sarex.io:infra/iac into docs

apps/attachments/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: attachments
+resources:
+  - ../base
+  - namespace.yaml
+patches: []
+#  - path: patch.yaml
+#    target:
+#      kind: HelmRelease
+#      name: attachments

apps/attachments/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: attachments
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/control-interface/base/deployment.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: srx-admin
-  namespace: control-interface
-  labels:
-    app: srx-admin
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: srx-admin
-  template:
-    metadata:
-      labels:
-        app: srx-admin
-    spec:
-      containers:
-        - name: srx-admin
-          image: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_3b9cb250
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-      imagePullSecrets:
-        - name: regcred
-

apps/control-interface/base/helmrelease.yaml

@@ -0,0 +1,92 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: srx-admin
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_feb59026
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: srx-admin
+
+          replicaCount:
+            _default: 1
+            stage: 1
+            preprod: 3
+            production: 3
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: srx-admin-svc
+
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/control-interface/base/kustomization.yaml

@@ -1,8 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: control-interface
+namespace: django
 resources:
-  - namespace.yaml
-  - deployment.yaml
-  - service.yaml
+  - helmrelease.yaml

apps/control-interface/base/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: control-interface
-  labels:
-    istio-injection: enabled

apps/control-interface/base/service.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-svc
-  namespace: control-interface
-spec:
-  type: ClusterIP
-  selector:
-    app: srx-admin
-  ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP

apps/control-interface/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: django
+resources:
+  - ../base
+  - namespace.yaml
+patches: []
+#  - path: patch.yaml
+#    target:
+#      kind: HelmRelease
+#      name: srx-admin

apps/control-interface/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: django
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/control-interface/d8-ugmk-prod/patch.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: srx-admin
+  namespace: django
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          replicaCount:
+            _default: 1

apps/control-interface/yc-k8s-test/kustomization.yaml

@@ -1,10 +1,11 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: django
 resources:
   - ../base
 patches:
   - path: replicas.yaml
     target:
-      kind: Deployment
+      kind: HelmRelease
       name: srx-admin

apps/control-interface/yc-k8s-test/replicas.yaml

@@ -1,8 +1,13 @@
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: srx-admin
-  namespace: control-interface
+  namespace: django
 spec:
-  replicas: 1
+  values:
+    services:
+      frontend:
+        deployment:
+          replicaCount:
+            _default: 1

clusters/d8-ugmk-prod/bootstrap-jobs/README.md

@@ -0,0 +1,8 @@
+bootstrap-jobs для сервисных сущностей kafka и rabbitmq.
+
+Эти кронджобы читают сервисные описания из vault и синхронизируют:
+- пользователей, виртуальные хосты и права в rabbitmq;
+- пользователей и топики в kafka.
+
+Для нового кластера адрес vault переведен на `vault-vault-contour-active.vault.svc.cluster.local:8200`,
+чтобы джобы ходили только в активный узел vault.

clusters/d8-ugmk-prod/bootstrap-jobs/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - service-bootstrap-jobs.yaml

clusters/d8-ugmk-prod/bootstrap-jobs/service-bootstrap-jobs.yaml

@@ -0,0 +1,245 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: rabbitmq-apps-bootstrap
+  namespace: rabbitmq
+spec:
+  schedule: "*/10 * * * *"
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 2
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 600
+      template:
+        metadata:
+          annotations:
+            sidecar.istio.io/inject: "false"
+        spec:
+          restartPolicy: OnFailure
+          serviceAccountName: rabbitmq
+          automountServiceAccountToken: false
+          volumes:
+            - name: sa-token
+              projected:
+                sources:
+                  - serviceAccountToken:
+                      path: token
+                      expirationSeconds: 3600
+          containers:
+            - name: bootstrap
+              image: alpine:3.20
+              volumeMounts:
+                - name: sa-token
+                  mountPath: /var/run/secrets/tokens
+                  readOnly: true
+              command: ["/bin/sh", "-ec"]
+              args:
+                - |
+                  apk add --no-cache curl jq >/dev/null
+                  VAULT_ADDR="http://vault-vault-contour-active.vault.svc.cluster.local:8200"
+                  JWT="$(cat /var/run/secrets/tokens/token)"
+                  VAULT_TOKEN="$(curl -sS --request POST \
+                    --data "{\"role\":\"rabbitmq\",\"jwt\":\"${JWT}\"}" \
+                    "${VAULT_ADDR}/v1/auth/kubernetes/login" | jq -r '.auth.client_token')"
+                  [ -n "${VAULT_TOKEN}" ] && [ "${VAULT_TOKEN}" != "null" ]
+
+                  admin_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/rabbitmq/auth")"
+                  admin_user="$(echo "${admin_json}" | jq -r '.data.data.username')"
+                  admin_pass="$(echo "${admin_json}" | jq -r '.data.data.password')"
+                  list_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/metadata/rabbitmq/apps?list=true")"
+                  for app in $(echo "${list_json}" | jq -r '.data.keys[]?' | sed 's#/$##'); do
+                    app_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/rabbitmq/apps/${app}")"
+                    username="$(echo "${app_json}" | jq -r '.data.data.username')"
+                    password="$(echo "${app_json}" | jq -r '.data.data.password')"
+                    [ -z "${username}" ] && username="${app}"
+                    [ -z "${password}" ] && continue
+
+                    curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
+                      -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/users/${username}" \
+                      -d "{\"password\":\"${password}\",\"tags\":\"\"}" >/dev/null
+
+                    vhosts_count="$(echo "${app_json}" | jq -r '(.data.data.vhosts // []) | length')"
+                    if [ "${vhosts_count}" -gt 0 ]; then
+                      echo "${app_json}" | jq -c '.data.data.vhosts[]' | while read -r vhost_item; do
+                        vhost="$(echo "${vhost_item}" | jq -r '.name // "/"')"
+                        configure="$(echo "${vhost_item}" | jq -r '.permissions.configure // ".*"')"
+                        write="$(echo "${vhost_item}" | jq -r '.permissions.write // ".*"')"
+                        read="$(echo "${vhost_item}" | jq -r '.permissions.read // ".*"')"
+                        vhost_uri="$(jq -rn --arg v "${vhost}" '$v|@uri')"
+
+                        curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
+                          -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/vhosts/${vhost_uri}" \
+                          -d '{}' >/dev/null
+                        curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
+                          -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/permissions/${vhost_uri}/${username}" \
+                          -d "{\"configure\":\"${configure}\",\"write\":\"${write}\",\"read\":\"${read}\"}" >/dev/null
+                      done
+                    else
+                      vhost="$(echo "${app_json}" | jq -r '.data.data.vhost // "/"')"
+                      configure="$(echo "${app_json}" | jq -r '.data.data.permissions.configure // ".*"')"
+                      write="$(echo "${app_json}" | jq -r '.data.data.permissions.write // ".*"')"
+                      read="$(echo "${app_json}" | jq -r '.data.data.permissions.read // ".*"')"
+                      vhost_uri="$(jq -rn --arg v "${vhost}" '$v|@uri')"
+
+                      curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
+                        -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/vhosts/${vhost_uri}" \
+                        -d '{}' >/dev/null
+                      curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
+                        -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/permissions/${vhost_uri}/${username}" \
+                        -d "{\"configure\":\"${configure}\",\"write\":\"${write}\",\"read\":\"${read}\"}" >/dev/null
+                    fi
+                  done
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kafka-bootstrap-exec
+  namespace: kafka
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create", "get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kafka-bootstrap-exec
+  namespace: kafka
+subjects:
+  - kind: ServiceAccount
+    name: kafka-kafka-contour
+    namespace: kafka
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kafka-bootstrap-exec
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: kafka-apps-bootstrap
+  namespace: kafka
+spec:
+  schedule: "*/10 * * * *"
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 2
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          annotations:
+            sidecar.istio.io/inject: "false"
+        spec:
+          restartPolicy: OnFailure
+          serviceAccountName: kafka-kafka-contour
+          automountServiceAccountToken: true
+          volumes:
+            - name: sa-token
+              projected:
+                sources:
+                  - serviceAccountToken:
+                      path: token
+                      expirationSeconds: 3600
+          containers:
+            - name: bootstrap
+              image: alpine:3.20
+              volumeMounts:
+                - name: sa-token
+                  mountPath: /var/run/secrets/tokens
+                  readOnly: true
+              command: ["/bin/sh", "-ec"]
+              args:
+                - |
+                  set -e
+                  apk add --no-cache bash curl jq kubectl >/dev/null
+
+                  VAULT_ADDR="http://vault-vault-contour-active.vault.svc.cluster.local:8200"
+                  JWT="$(cat /var/run/secrets/tokens/token)"
+                  VAULT_TOKEN="$(curl -sS --request POST \
+                    --data "{\"role\":\"kafka\",\"jwt\":\"${JWT}\"}" \
+                    "${VAULT_ADDR}/v1/auth/kubernetes/login" | jq -r '.auth.client_token')"
+                  [ -n "${VAULT_TOKEN}" ] && [ "${VAULT_TOKEN}" != "null" ]
+
+                  bootstrap_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/kafka/bootstrap")"
+                  inter_broker_password="$(echo "${bootstrap_json}" | jq -r '.data.data.interBrokerPassword')"
+                  [ -n "${inter_broker_password}" ] && [ "${inter_broker_password}" != "null" ]
+                  list_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/metadata/kafka/apps?list=true")"
+                  target_pod="kafka-kafka-contour-controller-0"
+                  if ! kubectl -n kafka get pod "${target_pod}" >/dev/null 2>&1; then
+                    echo "Kafka controller pod not found"
+                    exit 1
+                  fi
+                  target_bootstrap="${target_pod}.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094"
+
+                  admin_props="$(mktemp)"
+                  printf "%s\n" \
+                    "security.protocol=SASL_PLAINTEXT" \
+                    "sasl.mechanism=PLAIN" \
+                    "sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username='inter_broker_user' password='${inter_broker_password}';" \
+                    "default.api.timeout.ms=60000" \
+                    "request.timeout.ms=60000" \
+                    > "${admin_props}"
+                  kubectl -n kafka exec -i "${target_pod}" -c kafka -- /bin/bash -lc 'cat > /tmp/admin.properties' < "${admin_props}"
+                  rm -f "${admin_props}"
+                  kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc 'test -s /tmp/admin.properties'
+
+                  for app in $(echo "${list_json}" | jq -r '.data.keys[]?' | sed 's#/$##'); do
+                    app_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/kafka/apps/${app}")"
+                    username="$(echo "${app_json}" | jq -r '.data.data.username')"
+                    password="$(echo "${app_json}" | jq -r '.data.data.password')"
+                    [ -z "${username}" ] && username="${app}"
+                    [ -z "${password}" ] && continue
+
+                    echo "Reconciling Kafka user ${username}"
+                    user_reconciled=false
+                    attempt=1
+                    while [ "${attempt}" -le 3 ]; do
+                      if kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
+                        timeout 60 /opt/bitnami/kafka/bin/kafka-configs.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
+                          --alter --add-config 'SCRAM-SHA-512=[password=${password}]' \
+                          --entity-type users --entity-name '${username}'
+                      " >/dev/null; then
+                        user_reconciled=true
+                        break
+                      fi
+                      echo "Kafka user ${username} reconcile attempt ${attempt}/3 failed"
+                      attempt=$((attempt + 1))
+                      sleep 5
+                    done
+                    if [ "${user_reconciled}" != "true" ]; then
+                      echo "Kafka user ${username} reconcile failed, continue"
+                      continue
+                    fi
+
+                    echo "${app_json}" | jq -c '.data.data.topics[]?' | while read -r topic_item; do
+                      topic_name="$(echo "${topic_item}" | jq -r '.name // empty')"
+                      partitions="$(echo "${topic_item}" | jq -r '.partitions // 3')"
+                      replication_factor="$(echo "${topic_item}" | jq -r '.replication_factor // 1')"
+                      topic_configs="$(echo "${topic_item}" | jq -r '(.configs // {}) | to_entries | map("\(.key)=\(.value|tostring)") | join(",")')"
+                      [ -z "${topic_name}" ] && continue
+
+                      echo "Reconciling Kafka topic ${topic_name}"
+                      if ! kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
+                        timeout 40 /opt/bitnami/kafka/bin/kafka-topics.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
+                          --create --if-not-exists --topic '${topic_name}' --partitions '${partitions}' --replication-factor '${replication_factor}'
+                      " >/dev/null; then
+                        echo "Kafka topic ${topic_name} create/reconcile failed, continue"
+                        continue
+                      fi
+
+                      if [ -n "${topic_configs}" ]; then
+                        if ! kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
+                          timeout 40 /opt/bitnami/kafka/bin/kafka-configs.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
+                            --alter --entity-type topics --entity-name '${topic_name}' --add-config '${topic_configs}'
+                        " >/dev/null; then
+                          echo "Kafka topic ${topic_name} config reconcile failed, continue"
+                        fi
+                      fi
+                    done
+                  done

clusters/d8-ugmk-prod/flux-system/gotk-sync.yaml

@@ -0,0 +1,27 @@
+# This manifest was generated by flux. DO NOT EDIT.
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: master
+  secretRef:
+    name: flux-system
+  url: http://10.222.255.165:3000/infra/iac.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./clusters/d8-ugmk-prod
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

clusters/d8-ugmk-prod/flux-system/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gotk-components.yaml
+- gotk-sync.yaml

clusters/d8-ugmk-prod/helm-repositories.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: yc-oci-charts
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 10m0s
+  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
+  secretRef:
+    name: yc-cr-auth

clusters/d8-ugmk-prod/istio-ingress/certificate.yaml

@@ -0,0 +1,17 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: sarex-wildcard
+  namespace: d8-ingress-istio
+spec:
+  commonName: "*.sarex-k8s.uralmine.com"
+  dnsNames:
+    - "*.sarex-k8s.uralmine.com"
+    - "*.uralmine.com"
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: sarex-selfsigned
+  privateKey:
+    rotationPolicy: Always
+  secretName: istio-ingress-tls

clusters/d8-ugmk-prod/istio-ingress/clusterissuer.yaml

@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: sarex-selfsigned
+spec:
+  selfSigned: {}

clusters/d8-ugmk-prod/istio-ingress/ingress-controller.yaml

@@ -0,0 +1,22 @@
+apiVersion: deckhouse.io/v1alpha1
+kind: IngressIstioController
+metadata:
+  name: sarex
+spec:
+  ingressGatewayClass: istio
+  inlet: NodePort
+  nodePort:
+    httpPort: 30080
+    httpsPort: 30443
+  nodeSelector:
+    kubernetes.io/hostname: um-sarex-k8s-frontend-01
+  tolerations:
+    - effect: NoExecute
+      key: dedicated.deckhouse.io
+      operator: Equal
+      value: frontend
+  resourcesRequests:
+    mode: Static
+    static:
+      cpu: 100m
+      memory: 128Mi

clusters/d8-ugmk-prod/istio-ingress/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - clusterissuer.yaml
+  - certificate.yaml
+  - ingress-controller.yaml

clusters/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./flux-system
+  - ./helm-repositories.yaml
+
+
+# infrastructure
+  - ../../infrastructure/kafka/d8-ugmk-prod
+  - ../../infrastructure/rabbitmq/d8-ugmk-prod
+  - ../../infrastructure/camunda/d8-ugmk-prod
+  - ../../infrastructure/vault/d8-ugmk-prod
+  - ../../infrastructure/postgresql/d8-ugmk-prod
+  - ../../infrastructure/zitadel/d8-ugmk-prod
+  - ../../infrastructure/istio-config/d8-ugmk-prod
+  - ./istio-ingress
+  - ./bootstrap-jobs
+
+# apps
+  - ../../apps/attachments/d8-ugmk-prod
+  - ../../apps/control-interface/d8-ugmk-prod

infrastructure/camunda/d8-ugmk-prod/camunda-namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: camunda
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

infrastructure/camunda/d8-ugmk-prod/camunda.yaml

@@ -0,0 +1,327 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: camunda
+  namespace: camunda
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 15m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: camunda
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              namespace: camunda
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-connectors
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-identity
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-operate
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-optimize
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-tasklist
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+              name: camunda-zeebe-gateway
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: camunda
+              name: camunda-zeebe
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    global:
+      vault:
+        enabled: true
+        role: camunda
+        authPath: auth/kubernetes
+        secrets:
+          postgresql:
+            path: secrets/data/camunda/postgresql
+            keys:
+              password: identity-password
+              postgresPassword: postgres-password
+      image:
+        pullSecrets:
+          - name: regcred
+      identity:
+        auth:
+          publicIssuerUrl: "https://camunda-keycloak.sarex-k8s.uralmine.com/auth/realms/camunda-platform"
+          identity:
+            redirectUrl: "https://camunda-identity.sarex-k8s.uralmine.com"
+          operate:
+            redirectUrl: "https://camunda-operate.sarex-k8s.uralmine.com"
+          tasklist:
+            redirectUrl: "https://camunda-tasklist.sarex-k8s.uralmine.com"
+          optimize:
+            redirectUrl: "https://camunda-optimize.sarex-k8s.uralmine.com"
+          webModeler:
+            redirectUrl: "https://camunda-web-modeler.contour.infra.sarex.tech"
+          console:
+            redirectUrl: "https://camunda-console.contour.infra.sarex.tech"
+    identityPostgresql:
+      enabled: false
+      auth:
+        usePasswordFiles: true
+      primary:
+        automountServiceAccountToken: true
+        persistence:
+          size: 10Gi
+          storageClass: nfs01
+    identityKeycloak:
+      externalDatabase:
+        host: 10.222.255.162
+        port: 5432
+        user: bn_keycloak
+        database: bitnami_keycloak
+        password: ""
+        existingSecret: ""
+        existingSecretPasswordKey: password
+      postgresql:
+        enabled: false
+        auth:
+          usePasswordFiles: true
+        primary:
+          automountServiceAccountToken: true
+          persistence:
+            size: 10Gi
+            storageClass: nfs01
+      vaultEnv:
+        enabled: true
+        role: camunda
+        authPath: auth/kubernetes
+        envFiles:
+          KEYCLOAK_ADMIN_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_DATABASE_PASSWORD:
+            path: secrets/data/camunda/postgresql
+            key: keycloak-password
+      global:
+        storageClass: nfs01
+      tolerations: []
+    postgresql:
+      auth:
+        usePasswordFiles: true
+      primary:
+        automountServiceAccountToken: true
+        persistence:
+          size: 10Gi
+          storageClass: nfs01
+    elasticsearch:
+      master:
+        replicaCount: 1
+        podAntiAffinityPreset: soft
+        persistence:
+          size: 10Gi
+          storageClass: nfs01
+        tolerations: []
+      metrics:
+        enabled: false
+        serviceMonitor:
+          enabled: false
+        prometheusRule:
+          enabled: false
+        tolerations: []
+    camundaCanary:
+      enabled: false
+    prometheusServiceMonitor:
+      enabled: false
+    console:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebe:
+      clusterSize: "1"
+      partitionCount: "1"
+      replicationFactor: "1"
+      pvcStorageClassName: nfs01
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebeGateway:
+      replicas: 1
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    identity:
+      externalDatabase:
+        enabled: true
+        host: 10.222.255.162
+        port: 5432
+        username: identity
+        database: identity
+        password: ""
+        existingSecret: ""
+        existingSecretPasswordKey: password
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    operate:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    tasklist:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    optimize:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    executionIdentity:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    webModeler:
+      image:
+        pullSecrets:
+          - name: regcred
+      restapi:
+        tolerations: []
+      webapp:
+        tolerations: []
+      websockets:
+        tolerations: []
+    connectors:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []

infrastructure/camunda/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: camunda.yaml
+  - path: camunda-namespace.yaml

infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml

@@ -0,0 +1,140 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      env: d8-ugmk-prod
+    environments:
+      d8-ugmk-prod:
+        istio:
+          gateways:
+            camunda:
+              name: camunda-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - camunda-keycloak.sarex-k8s.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - camunda-identity.sarex-k8s.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - camunda-operate.sarex-k8s.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - camunda-tasklist.sarex-k8s.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+                - hosts:
+                    - camunda-optimize.sarex-k8s.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+            rabbitmq:
+              name: rabbitmq-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - rabbitmq.sarex-k8s.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+            zitadel:
+              name: zitadel-gateway
+              namespace: default
+              selector:
+                istio.deckhouse.io/ingress-gateway-class: istio
+              servers:
+                - hosts:
+                    - sarex-login.uralmine.com
+                  tls:
+                    credentialName: istio-ingress-tls
+          virtualServices:
+            camunda-keycloak:
+              namespace: default
+              hosts:
+                - camunda-keycloak.sarex-k8s.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-keycloak.camunda.svc.cluster.local
+                  port: 80
+            camunda-identity:
+              namespace: default
+              hosts:
+                - camunda-identity.sarex-k8s.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-identity.camunda.svc.cluster.local
+                  port: 80
+            camunda-operate:
+              namespace: default
+              hosts:
+                - camunda-operate.sarex-k8s.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-operate.camunda.svc.cluster.local
+                  port: 80
+            camunda-tasklist:
+              namespace: default
+              hosts:
+                - camunda-tasklist.sarex-k8s.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-tasklist.camunda.svc.cluster.local
+                  port: 80
+            camunda-optimize:
+              namespace: default
+              hosts:
+                - camunda-optimize.sarex-k8s.uralmine.com
+              gateways:
+                - default/camunda-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: camunda-optimize.camunda.svc.cluster.local
+                  port: 80
+            rabbitmq:
+              namespace: default
+              hosts:
+                - rabbitmq.sarex-k8s.uralmine.com
+              gateways:
+                - default/rabbitmq-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: rabbitmq.rabbitmq.svc.cluster.local
+                  port: 15672
+            zitadel:
+              namespace: default
+              hosts:
+                - sarex-login.uralmine.com
+              gateways:
+                - default/zitadel-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: zitadel-idp-contour.zitadel.svc.cluster.local
+                  port: 8080

infrastructure/istio-config/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-config.yaml

infrastructure/kafka/d8-ugmk-prod/kafka-namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kafka
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

infrastructure/kafka/d8-ugmk-prod/kafka.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kafka
+  namespace: kafka
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: kafka
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    global:
+      imagePullSecrets:
+        - regcred
+      defaultStorageClass: nfs01
+    image:
+      pullSecrets:
+        - regcred
+    controller:
+      replicaCount: 1
+      automountServiceAccountToken: true
+      persistence:
+        size: 8Gi
+        storageClass: nfs01
+      overrideConfiguration:
+        offsets.topic.replication.factor: 1
+        transaction.state.log.replication.factor: 1
+        transaction.state.log.min.isr: 1
+        default.replication.factor: 1
+        min.insync.replicas: 1
+    broker:
+      replicaCount: 0
+      automountServiceAccountToken: true
+    listeners:
+      client:
+        protocol: SASL_SSL
+        sslClientAuth: "none"
+    provisioning:
+      enabled: false
+    sasl:
+      managedExistingSecret:
+        enabled: false
+      existingSecret: ""
+      enabledMechanisms: PLAIN,SCRAM-SHA-512
+      interBrokerMechanism: PLAIN
+      controllerMechanism: PLAIN
+      client:
+        users: []
+        passwords: ""
+    tls:
+      type: PEM
+    vault:
+      enabled: true
+      role: kafka
+      authPath: auth/kubernetes
+      secretPath: secrets/data/kafka/bootstrap
+      clusterIdKey: clusterId
+      interBrokerPasswordKey: interBrokerPassword
+      controllerPasswordKey: controllerPassword

infrastructure/kafka/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: kafka.yaml
+  - path: kafka-namespace.yaml

infrastructure/postgresql/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,28 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: postgresql.yaml
+  - patch: |-
+      - op: replace
+        path: /metadata/namespace
+        value: zitadel
+      - op: replace
+        path: /spec/values/primary/nodeSelector
+        value:
+          dedicated: null
+          kubernetes.io/hostname: um-sarex-k8s-master-01
+      - op: replace
+        path: /spec/values/primary/tolerations
+        value:
+          - key: node-role.kubernetes.io/control-plane
+            operator: Exists
+            effect: NoSchedule
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: postgresql
+      namespace: postgresql
+  - path: postgresql-namespace-delete.yaml

infrastructure/postgresql/d8-ugmk-prod/postgresql-namespace-delete.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgresql
+$patch: delete

infrastructure/postgresql/d8-ugmk-prod/postgresql.yaml

@@ -0,0 +1,108 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: postgresql
+  namespace: postgresql
+spec:
+  interval: 5m
+  timeout: 2h
+
+  install:
+    timeout: 2h
+    remediation:
+      retries: 3
+
+  upgrade:
+    timeout: 2h
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      security:
+        allowInsecureImages: true
+      defaultStorageClass: nfs01
+      postgresql:
+        auth:
+          username: ""
+          database: ""
+          secretKeys:
+            userPasswordKey: "postgres-password"
+    auth:
+      username: ""
+      database: ""
+      secretKeys:
+        userPasswordKey: "postgres-password"
+    image:
+      registry: cr.yandex/crp3ccidau046kdj8g9q
+      repository: contour/postgresql
+      tag: 17.0.7
+      pullPolicy: Always
+    metrics:
+      enabled: false
+      prometheusRule:
+        enabled: false
+    primary:
+      automountServiceAccountToken: true
+      containerSecurityContext:
+        readOnlyRootFilesystem: false
+      persistence:
+        storageClass: nfs01
+        size: 20Gi
+      customLivenessProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 30
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      customReadinessProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 5
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      customStartupProbe:
+        exec:
+          command:
+            - /bin/sh
+            - -c
+            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
+        initialDelaySeconds: 30
+        periodSeconds: 10
+        timeoutSeconds: 5
+        successThreshold: 1
+        failureThreshold: 6
+      nodeSelector:
+        dedicated: null
+        node.deckhouse.io/group: generic
+      tolerations:
+        - key: dedicated.deckhouse.io
+          operator: Equal
+          value: generic
+    contour:
+      enabled: true
+      adminUser: "postgres"
+      vault:
+        enabled: true
+        role: postgresql
+        authPath: auth/kubernetes
+        secretPath: secrets/data/postgresql/admin
+        secretKey: postgres-password
+        usersSecretPath: secrets/data/postgresql/users
+      sharedPreloadLibraries: "timescaledb,pg_stat_statements"
+      databases:
+        - name: zitadel
+          user: zitadel
+          passwordKey: zitadel
+          extensions: []
+          restoreFromDump: false

infrastructure/rabbitmq/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: rabbitmq.yaml
+  - path: rabbitmq-namespace.yaml

infrastructure/rabbitmq/d8-ugmk-prod/rabbitmq-namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: rabbitmq
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

infrastructure/rabbitmq/d8-ugmk-prod/rabbitmq.yaml

@@ -0,0 +1,97 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rabbitmq
+  namespace: rabbitmq
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: rabbitmq
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: cert-manager.io
+              version: v1
+              kind: Certificate
+              namespace: gateway
+              name: rmq-tls
+            patch: |-
+              $patch: delete
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: rmq-tls
+                namespace: gateway
+          - target:
+              group: networking.istio.io
+              version: v1beta1
+              kind: Gateway
+              namespace: gateway
+              name: rmq-gateway
+            patch: |-
+              $patch: delete
+              apiVersion: networking.istio.io/v1beta1
+              kind: Gateway
+              metadata:
+                name: rmq-gateway
+                namespace: gateway
+          - target:
+              group: networking.istio.io
+              version: v1
+              kind: VirtualService
+              namespace: rabbitmq
+              name: rmq-virt-service
+            patch: |-
+              $patch: delete
+              apiVersion: networking.istio.io/v1
+              kind: VirtualService
+              metadata:
+                name: rmq-virt-service
+                namespace: rabbitmq
+  values:
+    global:
+      security:
+        allowInsecureImages: true
+    virtualService: null
+    gateway: null
+    certificate: null
+    metrics:
+      serviceMonitor:
+        enabled: false
+        default:
+          enabled: false
+        perObject:
+          enabled: false
+        detailed:
+          enabled: false
+    extraServiceMonitors: []
+    replicaCount: 1
+    resources:
+      requests:
+        memory: 1Gi
+    persistence:
+      storageClass: nfs01
+      size: 10Gi
+    auth:
+      securePassword: true
+      existingPasswordSecret: ""
+      vault:
+        enabled: true
+        role: rabbitmq
+        authPath: auth/kubernetes
+        secretPath: secrets/data/rabbitmq/auth
+        usernameKey: username
+        passwordKey: password

infrastructure/vault/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: vault.yaml
+  - path: vault-namespace.yaml

infrastructure/vault/d8-ugmk-prod/vault-namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vault
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

infrastructure/vault/d8-ugmk-prod/vault.yaml

@@ -0,0 +1,40 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault
+  namespace: vault
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: vault
+              name: vault-vault-contour
+            patch: |-
+              - op: replace
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: replace
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    imagePullSecrets:
+      - name: regcred
+    backup:
+      enabled: false
+    injector:
+      nodeSelector:
+        node.deckhouse.io/group: generic
+      tolerations: []
+    server:
+      nodeSelector:
+        node.deckhouse.io/group: generic
+      tolerations: []
+      dataStorage:
+        storageClass: nfs01

infrastructure/zitadel/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: zitadel.yaml
+  - path: zitadel-namespace.yaml

infrastructure/zitadel/d8-ugmk-prod/zitadel-namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: zitadel
+  labels:
+    istio-injection: disabled

infrastructure/zitadel/d8-ugmk-prod/zitadel.yaml

@@ -0,0 +1,166 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: zitadel
+  namespace: zitadel
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: postgresql
+      namespace: zitadel
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: zitadel-idp-contour
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated.deckhouse.io
+                    operator: Equal
+                    value: generic
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "adminPassword" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-init
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated.deckhouse.io
+                    operator: Equal
+                    value: generic
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "adminPassword" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-setup
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated.deckhouse.io
+                    operator: Equal
+                    value: generic
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "adminPassword" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+  values:
+    zitadel:
+      configmapConfig:
+        ExternalDomain: sarex-login.uralmine.com
+        ExternalSecure: true
+      debug:
+        enabled: false
+    postgresqlSecret:
+      create: false
+      vault:
+        enabled: true
+        role: zitadel
+        authPath: auth/kubernetes
+        secretPath: secrets/data/zitadel/postgresql
+        secretKey: password
+        kvVersion: 2
+        fileName: zitadel-vault-config.yaml
+    serviceAccount:
+      create: true
+      name: zitadel
+    replicaCount: 1
+    pdb:
+      enabled: false
+    env:
+      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
+        value: "false"
+      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
+        value: "bcrypt,pbkdf2"
+      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
+        value: "true"
+      - name: ZITADEL_DATABASE_POSTGRES_HOST
+        value: "postgresql.zitadel.svc.cluster.local"
+      - name: ZITADEL_DATABASE_POSTGRES_PORT
+        value: "5432"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
+        value: "zitadel-admin"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
+        value: "Sarex"