++ add d8 ugmk prod service infra

clusters/d8-ugmk-prod/bootstrap-jobs/README.md

@@ -0,0 +1,8 @@
+bootstrap-jobs для сервисных сущностей kafka и rabbitmq.
+
+Эти кронджобы читают сервисные описания из vault и синхронизируют:
+- пользователей, виртуальные хосты и права в rabbitmq;
+- пользователей и топики в kafka.
+
+Для нового кластера адрес vault переведен на `vault-vault-contour-active.vault.svc.cluster.local:8200`,
+чтобы джобы ходили только в активный узел vault.

clusters/d8-ugmk-prod/bootstrap-jobs/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - service-bootstrap-jobs.yaml

clusters/d8-ugmk-prod/bootstrap-jobs/service-bootstrap-jobs.yaml

@@ -0,0 +1,245 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: rabbitmq-apps-bootstrap
+  namespace: rabbitmq
+spec:
+  schedule: "*/10 * * * *"
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 2
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 600
+      template:
+        metadata:
+          annotations:
+            sidecar.istio.io/inject: "false"
+        spec:
+          restartPolicy: OnFailure
+          serviceAccountName: rabbitmq
+          automountServiceAccountToken: false
+          volumes:
+            - name: sa-token
+              projected:
+                sources:
+                  - serviceAccountToken:
+                      path: token
+                      expirationSeconds: 3600
+          containers:
+            - name: bootstrap
+              image: alpine:3.20
+              volumeMounts:
+                - name: sa-token
+                  mountPath: /var/run/secrets/tokens
+                  readOnly: true
+              command: ["/bin/sh", "-ec"]
+              args:
+                - |
+                  apk add --no-cache curl jq >/dev/null
+                  VAULT_ADDR="http://vault-vault-contour-active.vault.svc.cluster.local:8200"
+                  JWT="$(cat /var/run/secrets/tokens/token)"
+                  VAULT_TOKEN="$(curl -sS --request POST \
+                    --data "{\"role\":\"rabbitmq\",\"jwt\":\"${JWT}\"}" \
+                    "${VAULT_ADDR}/v1/auth/kubernetes/login" | jq -r '.auth.client_token')"
+                  [ -n "${VAULT_TOKEN}" ] && [ "${VAULT_TOKEN}" != "null" ]
+
+                  admin_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/rabbitmq/auth")"
+                  admin_user="$(echo "${admin_json}" | jq -r '.data.data.username')"
+                  admin_pass="$(echo "${admin_json}" | jq -r '.data.data.password')"
+                  list_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/metadata/rabbitmq/apps?list=true")"
+                  for app in $(echo "${list_json}" | jq -r '.data.keys[]?' | sed 's#/$##'); do
+                    app_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/rabbitmq/apps/${app}")"
+                    username="$(echo "${app_json}" | jq -r '.data.data.username')"
+                    password="$(echo "${app_json}" | jq -r '.data.data.password')"
+                    [ -z "${username}" ] && username="${app}"
+                    [ -z "${password}" ] && continue
+
+                    curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
+                      -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/users/${username}" \
+                      -d "{\"password\":\"${password}\",\"tags\":\"\"}" >/dev/null
+
+                    vhosts_count="$(echo "${app_json}" | jq -r '(.data.data.vhosts // []) | length')"
+                    if [ "${vhosts_count}" -gt 0 ]; then
+                      echo "${app_json}" | jq -c '.data.data.vhosts[]' | while read -r vhost_item; do
+                        vhost="$(echo "${vhost_item}" | jq -r '.name // "/"')"
+                        configure="$(echo "${vhost_item}" | jq -r '.permissions.configure // ".*"')"
+                        write="$(echo "${vhost_item}" | jq -r '.permissions.write // ".*"')"
+                        read="$(echo "${vhost_item}" | jq -r '.permissions.read // ".*"')"
+                        vhost_uri="$(jq -rn --arg v "${vhost}" '$v|@uri')"
+
+                        curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
+                          -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/vhosts/${vhost_uri}" \
+                          -d '{}' >/dev/null
+                        curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
+                          -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/permissions/${vhost_uri}/${username}" \
+                          -d "{\"configure\":\"${configure}\",\"write\":\"${write}\",\"read\":\"${read}\"}" >/dev/null
+                      done
+                    else
+                      vhost="$(echo "${app_json}" | jq -r '.data.data.vhost // "/"')"
+                      configure="$(echo "${app_json}" | jq -r '.data.data.permissions.configure // ".*"')"
+                      write="$(echo "${app_json}" | jq -r '.data.data.permissions.write // ".*"')"
+                      read="$(echo "${app_json}" | jq -r '.data.data.permissions.read // ".*"')"
+                      vhost_uri="$(jq -rn --arg v "${vhost}" '$v|@uri')"
+
+                      curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
+                        -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/vhosts/${vhost_uri}" \
+                        -d '{}' >/dev/null
+                      curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
+                        -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/permissions/${vhost_uri}/${username}" \
+                        -d "{\"configure\":\"${configure}\",\"write\":\"${write}\",\"read\":\"${read}\"}" >/dev/null
+                    fi
+                  done
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kafka-bootstrap-exec
+  namespace: kafka
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create", "get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kafka-bootstrap-exec
+  namespace: kafka
+subjects:
+  - kind: ServiceAccount
+    name: kafka-kafka-contour
+    namespace: kafka
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kafka-bootstrap-exec
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: kafka-apps-bootstrap
+  namespace: kafka
+spec:
+  schedule: "*/10 * * * *"
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 2
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          annotations:
+            sidecar.istio.io/inject: "false"
+        spec:
+          restartPolicy: OnFailure
+          serviceAccountName: kafka-kafka-contour
+          automountServiceAccountToken: true
+          volumes:
+            - name: sa-token
+              projected:
+                sources:
+                  - serviceAccountToken:
+                      path: token
+                      expirationSeconds: 3600
+          containers:
+            - name: bootstrap
+              image: alpine:3.20
+              volumeMounts:
+                - name: sa-token
+                  mountPath: /var/run/secrets/tokens
+                  readOnly: true
+              command: ["/bin/sh", "-ec"]
+              args:
+                - |
+                  set -e
+                  apk add --no-cache bash curl jq kubectl >/dev/null
+
+                  VAULT_ADDR="http://vault-vault-contour-active.vault.svc.cluster.local:8200"
+                  JWT="$(cat /var/run/secrets/tokens/token)"
+                  VAULT_TOKEN="$(curl -sS --request POST \
+                    --data "{\"role\":\"kafka\",\"jwt\":\"${JWT}\"}" \
+                    "${VAULT_ADDR}/v1/auth/kubernetes/login" | jq -r '.auth.client_token')"
+                  [ -n "${VAULT_TOKEN}" ] && [ "${VAULT_TOKEN}" != "null" ]
+
+                  bootstrap_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/kafka/bootstrap")"
+                  inter_broker_password="$(echo "${bootstrap_json}" | jq -r '.data.data.interBrokerPassword')"
+                  [ -n "${inter_broker_password}" ] && [ "${inter_broker_password}" != "null" ]
+                  list_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/metadata/kafka/apps?list=true")"
+                  target_pod="kafka-kafka-contour-controller-0"
+                  if ! kubectl -n kafka get pod "${target_pod}" >/dev/null 2>&1; then
+                    echo "Kafka controller pod not found"
+                    exit 1
+                  fi
+                  target_bootstrap="${target_pod}.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094"
+
+                  admin_props="$(mktemp)"
+                  printf "%s\n" \
+                    "security.protocol=SASL_PLAINTEXT" \
+                    "sasl.mechanism=PLAIN" \
+                    "sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username='inter_broker_user' password='${inter_broker_password}';" \
+                    "default.api.timeout.ms=60000" \
+                    "request.timeout.ms=60000" \
+                    > "${admin_props}"
+                  kubectl -n kafka exec -i "${target_pod}" -c kafka -- /bin/bash -lc 'cat > /tmp/admin.properties' < "${admin_props}"
+                  rm -f "${admin_props}"
+                  kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc 'test -s /tmp/admin.properties'
+
+                  for app in $(echo "${list_json}" | jq -r '.data.keys[]?' | sed 's#/$##'); do
+                    app_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/kafka/apps/${app}")"
+                    username="$(echo "${app_json}" | jq -r '.data.data.username')"
+                    password="$(echo "${app_json}" | jq -r '.data.data.password')"
+                    [ -z "${username}" ] && username="${app}"
+                    [ -z "${password}" ] && continue
+
+                    echo "Reconciling Kafka user ${username}"
+                    user_reconciled=false
+                    attempt=1
+                    while [ "${attempt}" -le 3 ]; do
+                      if kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
+                        timeout 60 /opt/bitnami/kafka/bin/kafka-configs.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
+                          --alter --add-config 'SCRAM-SHA-512=[password=${password}]' \
+                          --entity-type users --entity-name '${username}'
+                      " >/dev/null; then
+                        user_reconciled=true
+                        break
+                      fi
+                      echo "Kafka user ${username} reconcile attempt ${attempt}/3 failed"
+                      attempt=$((attempt + 1))
+                      sleep 5
+                    done
+                    if [ "${user_reconciled}" != "true" ]; then
+                      echo "Kafka user ${username} reconcile failed, continue"
+                      continue
+                    fi
+
+                    echo "${app_json}" | jq -c '.data.data.topics[]?' | while read -r topic_item; do
+                      topic_name="$(echo "${topic_item}" | jq -r '.name // empty')"
+                      partitions="$(echo "${topic_item}" | jq -r '.partitions // 3')"
+                      replication_factor="$(echo "${topic_item}" | jq -r '.replication_factor // 1')"
+                      topic_configs="$(echo "${topic_item}" | jq -r '(.configs // {}) | to_entries | map("\(.key)=\(.value|tostring)") | join(",")')"
+                      [ -z "${topic_name}" ] && continue
+
+                      echo "Reconciling Kafka topic ${topic_name}"
+                      if ! kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
+                        timeout 40 /opt/bitnami/kafka/bin/kafka-topics.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
+                          --create --if-not-exists --topic '${topic_name}' --partitions '${partitions}' --replication-factor '${replication_factor}'
+                      " >/dev/null; then
+                        echo "Kafka topic ${topic_name} create/reconcile failed, continue"
+                        continue
+                      fi
+
+                      if [ -n "${topic_configs}" ]; then
+                        if ! kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
+                          timeout 40 /opt/bitnami/kafka/bin/kafka-configs.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
+                            --alter --entity-type topics --entity-name '${topic_name}' --add-config '${topic_configs}'
+                        " >/dev/null; then
+                          echo "Kafka topic ${topic_name} config reconcile failed, continue"
+                        fi
+                      fi
+                    done
+                  done

clusters/d8-ugmk-prod/infrastructure/kustomization.yaml

@@ -1,8 +1,48 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - ../../../infrastructure/kafka
+  - ../../../infrastructure/rabbitmq
+  - ../../../infrastructure/camunda
   - ../../../infrastructure/vault
+  - ../../../infrastructure/zitadel
 patches:
+  - path: ./patches/kafka.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: kafka
+      namespace: kafka
+  - path: ./patches/kafka-namespace.yaml
+    target:
+      version: v1
+      kind: Namespace
+      name: kafka
+  - path: ./patches/rabbitmq.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: rabbitmq
+      namespace: rabbitmq
+  - path: ./patches/rabbitmq-namespace.yaml
+    target:
+      version: v1
+      kind: Namespace
+      name: rabbitmq
+  - path: ./patches/camunda.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: camunda
+      namespace: camunda
+  - path: ./patches/camunda-namespace.yaml
+    target:
+      version: v1
+      kind: Namespace
+      name: camunda
   - path: ./patches/vault.yaml
     target:
       group: helm.toolkit.fluxcd.io
@@ -15,3 +55,15 @@ patches:
       version: v1
       kind: Namespace
       name: vault
+  - path: ./patches/zitadel.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: zitadel
+      namespace: zitadel
+  - path: ./patches/zitadel-namespace.yaml
+    target:
+      version: v1
+      kind: Namespace
+      name: zitadel

clusters/d8-ugmk-prod/infrastructure/patches/camunda-namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: camunda
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml

@@ -0,0 +1,198 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: camunda
+  namespace: camunda
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 15m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              namespace: camunda
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: camunda
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              namespace: camunda
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    global:
+      vault:
+        enabled: true
+        role: camunda
+        authPath: auth/kubernetes
+      image:
+        pullSecrets:
+          - name: regcred
+      identity:
+        auth:
+          publicIssuerUrl: "https://camunda-keycloak.contour.infra.sarex.tech/auth/realms/camunda-platform"
+          identity:
+            redirectUrl: "https://camunda-identity.contour.infra.sarex.tech"
+          operate:
+            redirectUrl: "https://camunda-operate.contour.infra.sarex.tech"
+          tasklist:
+            redirectUrl: "https://camunda-tasklist.contour.infra.sarex.tech"
+          optimize:
+            redirectUrl: "https://camunda-optimize.contour.infra.sarex.tech"
+          webModeler:
+            redirectUrl: "https://camunda-web-modeler.contour.infra.sarex.tech"
+          console:
+            redirectUrl: "https://camunda-console.contour.infra.sarex.tech"
+    identityPostgresql:
+      auth:
+        usePasswordFiles: true
+      primary:
+        automountServiceAccountToken: true
+        persistence:
+          size: 10Gi
+          storageClass: local-path
+    identityKeycloak:
+      postgresql:
+        auth:
+          usePasswordFiles: true
+        primary:
+          automountServiceAccountToken: true
+          persistence:
+            size: 10Gi
+            storageClass: local-path
+      vaultEnv:
+        enabled: true
+        role: camunda
+        authPath: auth/kubernetes
+        envFiles:
+          KEYCLOAK_ADMIN_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_DATABASE_PASSWORD:
+            path: secrets/data/camunda/postgresql
+            key: password
+      global:
+        storageClass: local-path
+      tolerations: []
+    postgresql:
+      auth:
+        usePasswordFiles: true
+      primary:
+        automountServiceAccountToken: true
+        persistence:
+          size: 10Gi
+          storageClass: local-path
+    elasticsearch:
+      master:
+        persistence:
+          size: 10Gi
+          storageClass: local-path
+        tolerations: []
+      metrics:
+        enabled: false
+        serviceMonitor:
+          enabled: false
+        prometheusRule:
+          enabled: false
+        tolerations: []
+    camundaCanary:
+      enabled: false
+    prometheusServiceMonitor:
+      enabled: false
+    console:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebe:
+      pvcStorageClassName: local-path
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebeGateway:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    operate:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    tasklist:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    optimize:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    executionIdentity:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    identity:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    webModeler:
+      image:
+        pullSecrets:
+          - name: regcred
+      restapi:
+        tolerations: []
+      webapp:
+        tolerations: []
+      websockets:
+        tolerations: []
+    connectors:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []

clusters/d8-ugmk-prod/infrastructure/patches/kafka-namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kafka
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kafka
+  namespace: kafka
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: kafka
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    global:
+      imagePullSecrets:
+        - regcred
+      defaultStorageClass: local-path
+    image:
+      pullSecrets:
+        - regcred
+    controller:
+      replicaCount: 1
+      automountServiceAccountToken: true
+      persistence:
+        size: 8Gi
+        storageClass: local-path
+      overrideConfiguration:
+        offsets.topic.replication.factor: 1
+        transaction.state.log.replication.factor: 1
+        transaction.state.log.min.isr: 1
+        default.replication.factor: 1
+        min.insync.replicas: 1
+    broker:
+      replicaCount: 0
+      automountServiceAccountToken: true
+    listeners:
+      client:
+        protocol: SASL_SSL
+        sslClientAuth: "none"
+    provisioning:
+      enabled: false
+    sasl:
+      managedExistingSecret:
+        enabled: false
+      existingSecret: ""
+      enabledMechanisms: PLAIN,SCRAM-SHA-512
+      interBrokerMechanism: PLAIN
+      controllerMechanism: PLAIN
+      client:
+        users: []
+        passwords: ""
+    tls:
+      type: PEM
+    vault:
+      enabled: true
+      role: kafka
+      authPath: auth/kubernetes
+      secretPath: secrets/data/kafka/bootstrap
+      clusterIdKey: clusterId
+      interBrokerPasswordKey: interBrokerPassword
+      controllerPasswordKey: controllerPassword

clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq-namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: rabbitmq
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml

@@ -0,0 +1,58 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rabbitmq
+  namespace: rabbitmq
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              namespace: rabbitmq
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+  values:
+    global:
+      security:
+        allowInsecureImages: true
+    virtualService: null
+    gateway: null
+    certificate: null
+    metrics:
+      serviceMonitor:
+        enabled: false
+        default:
+          enabled: false
+        perObject:
+          enabled: false
+        detailed:
+          enabled: false
+    extraServiceMonitors: []
+    replicaCount: 1
+    resources:
+      requests:
+        memory: 1Gi
+    persistence:
+      storageClass: local-path
+      size: 10Gi
+    auth:
+      securePassword: true
+      existingPasswordSecret: ""
+      vault:
+        enabled: true
+        role: rabbitmq
+        authPath: auth/kubernetes
+        secretPath: secrets/data/rabbitmq/auth
+        usernameKey: username
+        passwordKey: password

clusters/d8-ugmk-prod/infrastructure/patches/vault-namespace.yaml

@@ -4,3 +4,4 @@ metadata:
   name: vault
   labels:
     istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml

@@ -6,48 +6,18 @@ metadata:
 spec:
   interval: 5m
   timeout: 10m
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: StatefulSet
-              name: vault-vault-contour
-              namespace: vault
-            patch: |-
-              apiVersion: apps/v1
-              kind: StatefulSet
-              metadata:
-                name: vault-vault-contour
-                namespace: vault
-              spec:
-                template:
-                  spec:
-                    nodeSelector:
-                      node.deckhouse.io/group: generic
-                    tolerations: []
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              name: vault-vault-contour-agent-injector
-              namespace: vault
-            patch: |-
-              apiVersion: apps/v1
-              kind: Deployment
-              metadata:
-                name: vault-vault-contour-agent-injector
-                namespace: vault
-              spec:
-                template:
-                  spec:
-                    nodeSelector:
-                      node.deckhouse.io/group: generic
-                    tolerations: []
   values:
     imagePullSecrets:
       - name: regcred
+    backup:
+      enabled: false
+    injector:
+      nodeSelector:
+        node.deckhouse.io/group: generic
+      tolerations: []
     server:
+      nodeSelector:
+        node.deckhouse.io/group: generic
+      tolerations: []
       dataStorage:
         storageClass: local-path

clusters/d8-ugmk-prod/infrastructure/patches/zitadel-namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: zitadel
+  labels:
+    istio-injection: disabled

clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml

@@ -0,0 +1,153 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: zitadel
+  namespace: zitadel
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: zitadel-idp-contour
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "adminPassword" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-init
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "adminPassword" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-setup
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  node.deckhouse.io/group: generic
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "adminPassword" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+  values:
+    zitadel:
+      configmapConfig:
+        ExternalDomain: sarex-login.uralmine.com
+        ExternalSecure: true
+      debug:
+        enabled: false
+    postgresqlSecret:
+      vault:
+        enabled: true
+        role: zitadel
+        authPath: auth/kubernetes
+        secretPath: secrets/data/zitadel/postgresql
+        secretKey: password
+        kvVersion: 2
+        fileName: zitadel-vault-config.yaml
+    serviceAccount:
+      create: true
+      name: zitadel
+    replicaCount: 1
+    pdb:
+      enabled: false
+    env:
+      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
+        value: "false"
+      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
+        value: "bcrypt,pbkdf2"
+      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
+        value: "true"
+      - name: ZITADEL_DATABASE_POSTGRES_HOST
+        value: "10.222.255.162"
+      - name: ZITADEL_DATABASE_POSTGRES_PORT
+        value: "5432"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
+        value: "zitadel-admin"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
+        value: "Sarex"

clusters/d8-ugmk-prod/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - ./flux-system
   - ./helm-repositories.yaml
   - ./infrastructure
+  - ./bootstrap-jobs