sarex/iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

++ sarex-contour: zitadel

Browse Source 
infrastructure/zitadel/sarex-contour (chart idp-contour 4.12.13), по
образцу overlay vad: без dependsOn на postgresql (БД внешняя, отдельная
машина 111.88.255.180 — заказана через terraform live/database, не
in-cluster HelmRelease), postRenderer снимает nodeSelector с Deployment
+ 2 Job'ов и подменяет vault-agent template на свой (кладёт
Admin.Password/FirstInstance.Org.Human.Password из
secrets/data/zitadel/postgresql).

ExternalDomain — заглушка zitadel.sarex-contour.internal, istio-config
для внешнего доступа ещё не заведён.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
ivan 2026-09-11 18:15:12 +05:00
parent 48f7934699
commit 9baaa3d7f1
3 changed files with 165 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
clusters/sarex-contour/kustomization.yaml
View File

@ -11,6 +11,7 @@ resources:
- ../../infrastructure/vault/sarex-contour
- ../../infrastructure/kafka/sarex-contour
- ../../infrastructure/rabbitmq/sarex-contour
- ../../infrastructure/zitadel/sarex-contour
# apps
- ../../apps/control-interface/sarex-contour

6
infrastructure/zitadel/sarex-contour/kustomization.yaml Normal file
View File

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
patches:
- path: zitadel.yaml

158
infrastructure/zitadel/sarex-contour/zitadel.yaml Normal file
View File

@ -0,0 +1,158 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: zitadel
namespace: zitadel
spec:
interval: 5m
timeout: 10m
postRenderers:
# sarex-contour без выделенных нод — снимаем nodeSelector/tolerations
# с Deployment и обоих Job'ов (init/setup). Дефолтный vault-agent
# template не кладёт Admin.Password/FirstInstance.Org.Human.Password —
# подменяем на свой (по образцу overlay vad), читающий их из
# secrets/data/zitadel/postgresql (поля password/humanPassword).
- kustomize:
patches:
- target:
group: apps
version: v1
kind: Deployment
name: zitadel-idp-contour
patch: |-
- op: add
path: /spec/template/spec/nodeSelector
value: {}
- op: add
path: /spec/template/spec/tolerations
value: []
- op: replace
path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
value: |-
{{- with secret "secrets/data/zitadel/postgresql" -}}
Database:
postgres:
User:
Password: |-
{{ index .Data.data "password" }}
Admin:
Password: |-
{{ index .Data.data "password" }}
FirstInstance:
Org:
Human:
Password: |-
{{ index .Data.data "humanPassword" }}
{{- end -}}
- target:
group: batch
version: v1
kind: Job
name: zitadel-idp-contour-init
patch: |-
- op: add
path: /spec/template/spec/nodeSelector
value: {}
- op: add
path: /spec/template/spec/tolerations
value: []
- op: replace
path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
value: |-
{{- with secret "secrets/data/zitadel/postgresql" -}}
Database:
postgres:
User:
Password: |-
{{ index .Data.data "password" }}
Admin:
Password: |-
{{ index .Data.data "password" }}
FirstInstance:
Org:
Human:
Password: |-
{{ index .Data.data "humanPassword" }}
{{- end -}}
- target:
group: batch
version: v1
kind: Job
name: zitadel-idp-contour-setup
patch: |-
- op: add
path: /spec/template/spec/nodeSelector
value: {}
- op: add
path: /spec/template/spec/tolerations
value: []
- op: replace
path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
value: |-
{{- with secret "secrets/data/zitadel/postgresql" -}}
Database:
postgres:
User:
Password: |-
{{ index .Data.data "password" }}
Admin:
Password: |-
{{ index .Data.data "password" }}
FirstInstance:
Org:
Human:
Password: |-
{{ index .Data.data "humanPassword" }}
{{- end -}}
values:
zitadel:
configmapConfig:
# placeholder — istio-config/DNS для sarex-contour ещё не заведены,
# резолвиться прямо сейчас не обязан.
ExternalDomain: zitadel.sarex-contour.internal
ExternalSecure: true
debug:
enabled: false
postgresqlSecret:
create: false
vault:
enabled: true
role: zitadel
authPath: auth/kubernetes
secretPath: secrets/data/zitadel/postgresql
secretKey: password
kvVersion: 2
fileName: zitadel-vault-config.yaml
serviceAccount:
create: true
name: zitadel
replicaCount: 1
pdb:
enabled: false
env:
- name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
value: "false"
- name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
value: "bcrypt,pbkdf2"
- name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
value: "true"
- name: ZITADEL_DATABASE_POSTGRES_HOST
value: "111.88.255.180"
- name: ZITADEL_DATABASE_POSTGRES_PORT
value: "5432"
- name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
value: "zitadel"
- name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
value: "zitadel"
- name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
value: "zitadel"
- name: ZITADEL_DATABASE_POSTGRES_DATABASE
value: "zitadel"
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
value: "disable"
- name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
value: "disable"
- name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
value: "zitadel-admin"
- name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
value: "Sarex"