From 7dba565792c5c6cb3e824b786fadc7e180480f4e Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Mon, 13 Jul 2026 20:32:32 +0300 Subject: [PATCH] ++ add d8 ugmk prod service infra --- .../d8-ugmk-prod/bootstrap-jobs/README.md | 8 + .../bootstrap-jobs/kustomization.yaml | 4 + .../service-bootstrap-jobs.yaml | 245 ++++++++++++++++++ .../infrastructure/kustomization.yaml | 52 ++++ .../patches/camunda-namespace.yaml | 7 + .../infrastructure/patches/camunda.yaml | 198 ++++++++++++++ .../patches/kafka-namespace.yaml | 7 + .../infrastructure/patches/kafka.yaml | 73 ++++++ .../patches/rabbitmq-namespace.yaml | 7 + .../infrastructure/patches/rabbitmq.yaml | 58 +++++ .../patches/vault-namespace.yaml | 1 + .../infrastructure/patches/vault.yaml | 48 +--- .../patches/zitadel-namespace.yaml | 6 + .../infrastructure/patches/zitadel.yaml | 153 +++++++++++ clusters/d8-ugmk-prod/kustomization.yaml | 1 + 15 files changed, 829 insertions(+), 39 deletions(-) create mode 100644 clusters/d8-ugmk-prod/bootstrap-jobs/README.md create mode 100644 clusters/d8-ugmk-prod/bootstrap-jobs/kustomization.yaml create mode 100644 clusters/d8-ugmk-prod/bootstrap-jobs/service-bootstrap-jobs.yaml create mode 100644 clusters/d8-ugmk-prod/infrastructure/patches/camunda-namespace.yaml create mode 100644 clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml create mode 100644 clusters/d8-ugmk-prod/infrastructure/patches/kafka-namespace.yaml create mode 100644 clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml create mode 100644 clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq-namespace.yaml create mode 100644 clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml create mode 100644 clusters/d8-ugmk-prod/infrastructure/patches/zitadel-namespace.yaml create mode 100644 clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml diff --git a/clusters/d8-ugmk-prod/bootstrap-jobs/README.md b/clusters/d8-ugmk-prod/bootstrap-jobs/README.md new file mode 100644 index 0000000..ccdc83b --- /dev/null +++ b/clusters/d8-ugmk-prod/bootstrap-jobs/README.md @@ -0,0 +1,8 @@ +bootstrap-jobs для сервисных сущностей kafka и rabbitmq. + +Эти кронджобы читают сервисные описания из vault и синхронизируют: +- пользователей, виртуальные хосты и права в rabbitmq; +- пользователей и топики в kafka. + +Для нового кластера адрес vault переведен на `vault-vault-contour-active.vault.svc.cluster.local:8200`, +чтобы джобы ходили только в активный узел vault. diff --git a/clusters/d8-ugmk-prod/bootstrap-jobs/kustomization.yaml b/clusters/d8-ugmk-prod/bootstrap-jobs/kustomization.yaml new file mode 100644 index 0000000..269a32f --- /dev/null +++ b/clusters/d8-ugmk-prod/bootstrap-jobs/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - service-bootstrap-jobs.yaml diff --git a/clusters/d8-ugmk-prod/bootstrap-jobs/service-bootstrap-jobs.yaml b/clusters/d8-ugmk-prod/bootstrap-jobs/service-bootstrap-jobs.yaml new file mode 100644 index 0000000..5e7ad33 --- /dev/null +++ b/clusters/d8-ugmk-prod/bootstrap-jobs/service-bootstrap-jobs.yaml @@ -0,0 +1,245 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: rabbitmq-apps-bootstrap + namespace: rabbitmq +spec: + schedule: "*/10 * * * *" + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 2 + concurrencyPolicy: Forbid + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 600 + template: + metadata: + annotations: + sidecar.istio.io/inject: "false" + spec: + restartPolicy: OnFailure + serviceAccountName: rabbitmq + automountServiceAccountToken: false + volumes: + - name: sa-token + projected: + sources: + - serviceAccountToken: + path: token + expirationSeconds: 3600 + containers: + - name: bootstrap + image: alpine:3.20 + volumeMounts: + - name: sa-token + mountPath: /var/run/secrets/tokens + readOnly: true + command: ["/bin/sh", "-ec"] + args: + - | + apk add --no-cache curl jq >/dev/null + VAULT_ADDR="http://vault-vault-contour-active.vault.svc.cluster.local:8200" + JWT="$(cat /var/run/secrets/tokens/token)" + VAULT_TOKEN="$(curl -sS --request POST \ + --data "{\"role\":\"rabbitmq\",\"jwt\":\"${JWT}\"}" \ + "${VAULT_ADDR}/v1/auth/kubernetes/login" | jq -r '.auth.client_token')" + [ -n "${VAULT_TOKEN}" ] && [ "${VAULT_TOKEN}" != "null" ] + + admin_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/rabbitmq/auth")" + admin_user="$(echo "${admin_json}" | jq -r '.data.data.username')" + admin_pass="$(echo "${admin_json}" | jq -r '.data.data.password')" + list_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/metadata/rabbitmq/apps?list=true")" + for app in $(echo "${list_json}" | jq -r '.data.keys[]?' | sed 's#/$##'); do + app_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/rabbitmq/apps/${app}")" + username="$(echo "${app_json}" | jq -r '.data.data.username')" + password="$(echo "${app_json}" | jq -r '.data.data.password')" + [ -z "${username}" ] && username="${app}" + [ -z "${password}" ] && continue + + curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \ + -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/users/${username}" \ + -d "{\"password\":\"${password}\",\"tags\":\"\"}" >/dev/null + + vhosts_count="$(echo "${app_json}" | jq -r '(.data.data.vhosts // []) | length')" + if [ "${vhosts_count}" -gt 0 ]; then + echo "${app_json}" | jq -c '.data.data.vhosts[]' | while read -r vhost_item; do + vhost="$(echo "${vhost_item}" | jq -r '.name // "/"')" + configure="$(echo "${vhost_item}" | jq -r '.permissions.configure // ".*"')" + write="$(echo "${vhost_item}" | jq -r '.permissions.write // ".*"')" + read="$(echo "${vhost_item}" | jq -r '.permissions.read // ".*"')" + vhost_uri="$(jq -rn --arg v "${vhost}" '$v|@uri')" + + curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \ + -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/vhosts/${vhost_uri}" \ + -d '{}' >/dev/null + curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \ + -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/permissions/${vhost_uri}/${username}" \ + -d "{\"configure\":\"${configure}\",\"write\":\"${write}\",\"read\":\"${read}\"}" >/dev/null + done + else + vhost="$(echo "${app_json}" | jq -r '.data.data.vhost // "/"')" + configure="$(echo "${app_json}" | jq -r '.data.data.permissions.configure // ".*"')" + write="$(echo "${app_json}" | jq -r '.data.data.permissions.write // ".*"')" + read="$(echo "${app_json}" | jq -r '.data.data.permissions.read // ".*"')" + vhost_uri="$(jq -rn --arg v "${vhost}" '$v|@uri')" + + curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \ + -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/vhosts/${vhost_uri}" \ + -d '{}' >/dev/null + curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \ + -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/permissions/${vhost_uri}/${username}" \ + -d "{\"configure\":\"${configure}\",\"write\":\"${write}\",\"read\":\"${read}\"}" >/dev/null + fi + done +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: kafka-bootstrap-exec + namespace: kafka +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list"] + - apiGroups: [""] + resources: ["pods/exec"] + verbs: ["create", "get"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: kafka-bootstrap-exec + namespace: kafka +subjects: + - kind: ServiceAccount + name: kafka-kafka-contour + namespace: kafka +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: kafka-bootstrap-exec +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: kafka-apps-bootstrap + namespace: kafka +spec: + schedule: "*/10 * * * *" + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 2 + concurrencyPolicy: Forbid + jobTemplate: + spec: + template: + metadata: + annotations: + sidecar.istio.io/inject: "false" + spec: + restartPolicy: OnFailure + serviceAccountName: kafka-kafka-contour + automountServiceAccountToken: true + volumes: + - name: sa-token + projected: + sources: + - serviceAccountToken: + path: token + expirationSeconds: 3600 + containers: + - name: bootstrap + image: alpine:3.20 + volumeMounts: + - name: sa-token + mountPath: /var/run/secrets/tokens + readOnly: true + command: ["/bin/sh", "-ec"] + args: + - | + set -e + apk add --no-cache bash curl jq kubectl >/dev/null + + VAULT_ADDR="http://vault-vault-contour-active.vault.svc.cluster.local:8200" + JWT="$(cat /var/run/secrets/tokens/token)" + VAULT_TOKEN="$(curl -sS --request POST \ + --data "{\"role\":\"kafka\",\"jwt\":\"${JWT}\"}" \ + "${VAULT_ADDR}/v1/auth/kubernetes/login" | jq -r '.auth.client_token')" + [ -n "${VAULT_TOKEN}" ] && [ "${VAULT_TOKEN}" != "null" ] + + bootstrap_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/kafka/bootstrap")" + inter_broker_password="$(echo "${bootstrap_json}" | jq -r '.data.data.interBrokerPassword')" + [ -n "${inter_broker_password}" ] && [ "${inter_broker_password}" != "null" ] + list_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/metadata/kafka/apps?list=true")" + target_pod="kafka-kafka-contour-controller-0" + if ! kubectl -n kafka get pod "${target_pod}" >/dev/null 2>&1; then + echo "Kafka controller pod not found" + exit 1 + fi + target_bootstrap="${target_pod}.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094" + + admin_props="$(mktemp)" + printf "%s\n" \ + "security.protocol=SASL_PLAINTEXT" \ + "sasl.mechanism=PLAIN" \ + "sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username='inter_broker_user' password='${inter_broker_password}';" \ + "default.api.timeout.ms=60000" \ + "request.timeout.ms=60000" \ + > "${admin_props}" + kubectl -n kafka exec -i "${target_pod}" -c kafka -- /bin/bash -lc 'cat > /tmp/admin.properties' < "${admin_props}" + rm -f "${admin_props}" + kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc 'test -s /tmp/admin.properties' + + for app in $(echo "${list_json}" | jq -r '.data.keys[]?' | sed 's#/$##'); do + app_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/kafka/apps/${app}")" + username="$(echo "${app_json}" | jq -r '.data.data.username')" + password="$(echo "${app_json}" | jq -r '.data.data.password')" + [ -z "${username}" ] && username="${app}" + [ -z "${password}" ] && continue + + echo "Reconciling Kafka user ${username}" + user_reconciled=false + attempt=1 + while [ "${attempt}" -le 3 ]; do + if kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\ + timeout 60 /opt/bitnami/kafka/bin/kafka-configs.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \ + --alter --add-config 'SCRAM-SHA-512=[password=${password}]' \ + --entity-type users --entity-name '${username}' + " >/dev/null; then + user_reconciled=true + break + fi + echo "Kafka user ${username} reconcile attempt ${attempt}/3 failed" + attempt=$((attempt + 1)) + sleep 5 + done + if [ "${user_reconciled}" != "true" ]; then + echo "Kafka user ${username} reconcile failed, continue" + continue + fi + + echo "${app_json}" | jq -c '.data.data.topics[]?' | while read -r topic_item; do + topic_name="$(echo "${topic_item}" | jq -r '.name // empty')" + partitions="$(echo "${topic_item}" | jq -r '.partitions // 3')" + replication_factor="$(echo "${topic_item}" | jq -r '.replication_factor // 1')" + topic_configs="$(echo "${topic_item}" | jq -r '(.configs // {}) | to_entries | map("\(.key)=\(.value|tostring)") | join(",")')" + [ -z "${topic_name}" ] && continue + + echo "Reconciling Kafka topic ${topic_name}" + if ! kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\ + timeout 40 /opt/bitnami/kafka/bin/kafka-topics.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \ + --create --if-not-exists --topic '${topic_name}' --partitions '${partitions}' --replication-factor '${replication_factor}' + " >/dev/null; then + echo "Kafka topic ${topic_name} create/reconcile failed, continue" + continue + fi + + if [ -n "${topic_configs}" ]; then + if ! kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\ + timeout 40 /opt/bitnami/kafka/bin/kafka-configs.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \ + --alter --entity-type topics --entity-name '${topic_name}' --add-config '${topic_configs}' + " >/dev/null; then + echo "Kafka topic ${topic_name} config reconcile failed, continue" + fi + fi + done + done diff --git a/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml b/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml index 08ccca9..ed28986 100644 --- a/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml +++ b/clusters/d8-ugmk-prod/infrastructure/kustomization.yaml @@ -1,8 +1,48 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: + - ../../../infrastructure/kafka + - ../../../infrastructure/rabbitmq + - ../../../infrastructure/camunda - ../../../infrastructure/vault + - ../../../infrastructure/zitadel patches: + - path: ./patches/kafka.yaml + target: + group: helm.toolkit.fluxcd.io + version: v2 + kind: HelmRelease + name: kafka + namespace: kafka + - path: ./patches/kafka-namespace.yaml + target: + version: v1 + kind: Namespace + name: kafka + - path: ./patches/rabbitmq.yaml + target: + group: helm.toolkit.fluxcd.io + version: v2 + kind: HelmRelease + name: rabbitmq + namespace: rabbitmq + - path: ./patches/rabbitmq-namespace.yaml + target: + version: v1 + kind: Namespace + name: rabbitmq + - path: ./patches/camunda.yaml + target: + group: helm.toolkit.fluxcd.io + version: v2 + kind: HelmRelease + name: camunda + namespace: camunda + - path: ./patches/camunda-namespace.yaml + target: + version: v1 + kind: Namespace + name: camunda - path: ./patches/vault.yaml target: group: helm.toolkit.fluxcd.io @@ -15,3 +55,15 @@ patches: version: v1 kind: Namespace name: vault + - path: ./patches/zitadel.yaml + target: + group: helm.toolkit.fluxcd.io + version: v2 + kind: HelmRelease + name: zitadel + namespace: zitadel + - path: ./patches/zitadel-namespace.yaml + target: + version: v1 + kind: Namespace + name: zitadel diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/camunda-namespace.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/camunda-namespace.yaml new file mode 100644 index 0000000..2c6192a --- /dev/null +++ b/clusters/d8-ugmk-prod/infrastructure/patches/camunda-namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: camunda + labels: + istio-injection: disabled + security.deckhouse.io/pod-policy: privileged diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml new file mode 100644 index 0000000..abe0424 --- /dev/null +++ b/clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml @@ -0,0 +1,198 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: camunda + namespace: camunda +spec: + dependsOn: [] + interval: 5m + timeout: 15m + postRenderers: + - kustomize: + patches: + - target: + group: apps + version: v1 + kind: Deployment + namespace: camunda + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + node.deckhouse.io/group: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: apps + version: v1 + kind: StatefulSet + namespace: camunda + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + node.deckhouse.io/group: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - target: + group: batch + version: v1 + kind: Job + namespace: camunda + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + node.deckhouse.io/group: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + values: + global: + vault: + enabled: true + role: camunda + authPath: auth/kubernetes + image: + pullSecrets: + - name: regcred + identity: + auth: + publicIssuerUrl: "https://camunda-keycloak.contour.infra.sarex.tech/auth/realms/camunda-platform" + identity: + redirectUrl: "https://camunda-identity.contour.infra.sarex.tech" + operate: + redirectUrl: "https://camunda-operate.contour.infra.sarex.tech" + tasklist: + redirectUrl: "https://camunda-tasklist.contour.infra.sarex.tech" + optimize: + redirectUrl: "https://camunda-optimize.contour.infra.sarex.tech" + webModeler: + redirectUrl: "https://camunda-web-modeler.contour.infra.sarex.tech" + console: + redirectUrl: "https://camunda-console.contour.infra.sarex.tech" + identityPostgresql: + auth: + usePasswordFiles: true + primary: + automountServiceAccountToken: true + persistence: + size: 10Gi + storageClass: local-path + identityKeycloak: + postgresql: + auth: + usePasswordFiles: true + primary: + automountServiceAccountToken: true + persistence: + size: 10Gi + storageClass: local-path + vaultEnv: + enabled: true + role: camunda + authPath: auth/kubernetes + envFiles: + KEYCLOAK_ADMIN_PASSWORD: + path: secrets/data/camunda/keycloak-admin + key: admin-password + KEYCLOAK_PASSWORD: + path: secrets/data/camunda/keycloak-admin + key: admin-password + KEYCLOAK_DATABASE_PASSWORD: + path: secrets/data/camunda/postgresql + key: password + global: + storageClass: local-path + tolerations: [] + postgresql: + auth: + usePasswordFiles: true + primary: + automountServiceAccountToken: true + persistence: + size: 10Gi + storageClass: local-path + elasticsearch: + master: + persistence: + size: 10Gi + storageClass: local-path + tolerations: [] + metrics: + enabled: false + serviceMonitor: + enabled: false + prometheusRule: + enabled: false + tolerations: [] + camundaCanary: + enabled: false + prometheusServiceMonitor: + enabled: false + console: + image: + pullSecrets: + - name: regcred + tolerations: [] + zeebe: + pvcStorageClassName: local-path + image: + pullSecrets: + - name: regcred + tolerations: [] + zeebeGateway: + image: + pullSecrets: + - name: regcred + tolerations: [] + operate: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] + tasklist: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] + optimize: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] + executionIdentity: + image: + pullSecrets: + - name: regcred + tolerations: [] + identity: + image: + pullSecrets: + - name: regcred + tolerations: [] + webModeler: + image: + pullSecrets: + - name: regcred + restapi: + tolerations: [] + webapp: + tolerations: [] + websockets: + tolerations: [] + connectors: + image: + pullSecrets: + - name: regcred + serviceAccount: + automountServiceAccountToken: true + tolerations: [] diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/kafka-namespace.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/kafka-namespace.yaml new file mode 100644 index 0000000..e171e07 --- /dev/null +++ b/clusters/d8-ugmk-prod/infrastructure/patches/kafka-namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: kafka + labels: + istio-injection: disabled + security.deckhouse.io/pod-policy: privileged diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml new file mode 100644 index 0000000..b1e93fe --- /dev/null +++ b/clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml @@ -0,0 +1,73 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kafka + namespace: kafka +spec: + interval: 5m + timeout: 10m + postRenderers: + - kustomize: + patches: + - target: + group: apps + version: v1 + kind: StatefulSet + namespace: kafka + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + node.deckhouse.io/group: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + values: + global: + imagePullSecrets: + - regcred + defaultStorageClass: local-path + image: + pullSecrets: + - regcred + controller: + replicaCount: 1 + automountServiceAccountToken: true + persistence: + size: 8Gi + storageClass: local-path + overrideConfiguration: + offsets.topic.replication.factor: 1 + transaction.state.log.replication.factor: 1 + transaction.state.log.min.isr: 1 + default.replication.factor: 1 + min.insync.replicas: 1 + broker: + replicaCount: 0 + automountServiceAccountToken: true + listeners: + client: + protocol: SASL_SSL + sslClientAuth: "none" + provisioning: + enabled: false + sasl: + managedExistingSecret: + enabled: false + existingSecret: "" + enabledMechanisms: PLAIN,SCRAM-SHA-512 + interBrokerMechanism: PLAIN + controllerMechanism: PLAIN + client: + users: [] + passwords: "" + tls: + type: PEM + vault: + enabled: true + role: kafka + authPath: auth/kubernetes + secretPath: secrets/data/kafka/bootstrap + clusterIdKey: clusterId + interBrokerPasswordKey: interBrokerPassword + controllerPasswordKey: controllerPassword diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq-namespace.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq-namespace.yaml new file mode 100644 index 0000000..0dff2d7 --- /dev/null +++ b/clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq-namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: rabbitmq + labels: + istio-injection: disabled + security.deckhouse.io/pod-policy: privileged diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml new file mode 100644 index 0000000..c1da47c --- /dev/null +++ b/clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml @@ -0,0 +1,58 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: rabbitmq + namespace: rabbitmq +spec: + interval: 5m + timeout: 10m + postRenderers: + - kustomize: + patches: + - target: + group: apps + version: v1 + kind: StatefulSet + namespace: rabbitmq + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + node.deckhouse.io/group: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + values: + global: + security: + allowInsecureImages: true + virtualService: null + gateway: null + certificate: null + metrics: + serviceMonitor: + enabled: false + default: + enabled: false + perObject: + enabled: false + detailed: + enabled: false + extraServiceMonitors: [] + replicaCount: 1 + resources: + requests: + memory: 1Gi + persistence: + storageClass: local-path + size: 10Gi + auth: + securePassword: true + existingPasswordSecret: "" + vault: + enabled: true + role: rabbitmq + authPath: auth/kubernetes + secretPath: secrets/data/rabbitmq/auth + usernameKey: username + passwordKey: password diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/vault-namespace.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/vault-namespace.yaml index b4e1203..810a280 100644 --- a/clusters/d8-ugmk-prod/infrastructure/patches/vault-namespace.yaml +++ b/clusters/d8-ugmk-prod/infrastructure/patches/vault-namespace.yaml @@ -4,3 +4,4 @@ metadata: name: vault labels: istio-injection: disabled + security.deckhouse.io/pod-policy: privileged diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml index a0293e6..6fe5725 100644 --- a/clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml +++ b/clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml @@ -6,48 +6,18 @@ metadata: spec: interval: 5m timeout: 10m - postRenderers: - - kustomize: - patches: - - target: - group: apps - version: v1 - kind: StatefulSet - name: vault-vault-contour - namespace: vault - patch: |- - apiVersion: apps/v1 - kind: StatefulSet - metadata: - name: vault-vault-contour - namespace: vault - spec: - template: - spec: - nodeSelector: - node.deckhouse.io/group: generic - tolerations: [] - - target: - group: apps - version: v1 - kind: Deployment - name: vault-vault-contour-agent-injector - namespace: vault - patch: |- - apiVersion: apps/v1 - kind: Deployment - metadata: - name: vault-vault-contour-agent-injector - namespace: vault - spec: - template: - spec: - nodeSelector: - node.deckhouse.io/group: generic - tolerations: [] values: imagePullSecrets: - name: regcred + backup: + enabled: false + injector: + nodeSelector: + node.deckhouse.io/group: generic + tolerations: [] server: + nodeSelector: + node.deckhouse.io/group: generic + tolerations: [] dataStorage: storageClass: local-path diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/zitadel-namespace.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/zitadel-namespace.yaml new file mode 100644 index 0000000..fc379d8 --- /dev/null +++ b/clusters/d8-ugmk-prod/infrastructure/patches/zitadel-namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: zitadel + labels: + istio-injection: disabled diff --git a/clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml b/clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml new file mode 100644 index 0000000..5938c29 --- /dev/null +++ b/clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml @@ -0,0 +1,153 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: zitadel + namespace: zitadel +spec: + interval: 5m + timeout: 10m + postRenderers: + - kustomize: + patches: + - target: + group: apps + version: v1 + kind: Deployment + name: zitadel-idp-contour + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + node.deckhouse.io/group: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - op: replace + path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml + value: |- + {{- with secret "secrets/data/zitadel/postgresql" -}} + Database: + postgres: + User: + Password: |- + {{ index .Data.data "password" }} + Admin: + Password: |- + {{ index .Data.data "adminPassword" }} + FirstInstance: + Org: + Human: + Password: |- + {{ index .Data.data "humanPassword" }} + {{- end -}} + - target: + group: batch + version: v1 + kind: Job + name: zitadel-idp-contour-init + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + node.deckhouse.io/group: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - op: replace + path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml + value: |- + {{- with secret "secrets/data/zitadel/postgresql" -}} + Database: + postgres: + User: + Password: |- + {{ index .Data.data "password" }} + Admin: + Password: |- + {{ index .Data.data "adminPassword" }} + FirstInstance: + Org: + Human: + Password: |- + {{ index .Data.data "humanPassword" }} + {{- end -}} + - target: + group: batch + version: v1 + kind: Job + name: zitadel-idp-contour-setup + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: + node.deckhouse.io/group: generic + - op: add + path: /spec/template/spec/tolerations + value: [] + - op: replace + path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml + value: |- + {{- with secret "secrets/data/zitadel/postgresql" -}} + Database: + postgres: + User: + Password: |- + {{ index .Data.data "password" }} + Admin: + Password: |- + {{ index .Data.data "adminPassword" }} + FirstInstance: + Org: + Human: + Password: |- + {{ index .Data.data "humanPassword" }} + {{- end -}} + values: + zitadel: + configmapConfig: + ExternalDomain: sarex-login.uralmine.com + ExternalSecure: true + debug: + enabled: false + postgresqlSecret: + vault: + enabled: true + role: zitadel + authPath: auth/kubernetes + secretPath: secrets/data/zitadel/postgresql + secretKey: password + kvVersion: 2 + fileName: zitadel-vault-config.yaml + serviceAccount: + create: true + name: zitadel + replicaCount: 1 + pdb: + enabled: false + env: + - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED + value: "false" + - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS + value: "bcrypt,pbkdf2" + - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED + value: "true" + - name: ZITADEL_DATABASE_POSTGRES_HOST + value: "10.222.255.162" + - name: ZITADEL_DATABASE_POSTGRES_PORT + value: "5432" + - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME + value: "zitadel" + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE + value: "zitadel" + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME + value: "zitadel" + - name: ZITADEL_DATABASE_POSTGRES_DATABASE + value: "zitadel" + - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE + value: "disable" + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE + value: "disable" + - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME + value: "zitadel-admin" + - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME + value: "Sarex" diff --git a/clusters/d8-ugmk-prod/kustomization.yaml b/clusters/d8-ugmk-prod/kustomization.yaml index a8384a3..dcb749b 100644 --- a/clusters/d8-ugmk-prod/kustomization.yaml +++ b/clusters/d8-ugmk-prod/kustomization.yaml @@ -4,3 +4,4 @@ resources: - ./flux-system - ./helm-repositories.yaml - ./infrastructure + - ./bootstrap-jobs