From 9baaa3d7f1f3e2ffb34f52e24e24bf3ed8ed38ed Mon Sep 17 00:00:00 2001 From: ivan Date: Fri, 11 Sep 2026 18:15:12 +0500 Subject: [PATCH] ++ sarex-contour: zitadel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit infrastructure/zitadel/sarex-contour (chart idp-contour 4.12.13), по образцу overlay vad: без dependsOn на postgresql (БД внешняя, отдельная машина 111.88.255.180 — заказана через terraform live/database, не in-cluster HelmRelease), postRenderer снимает nodeSelector с Deployment + 2 Job'ов и подменяет vault-agent template на свой (кладёт Admin.Password/FirstInstance.Org.Human.Password из secrets/data/zitadel/postgresql). ExternalDomain — заглушка zitadel.sarex-contour.internal, istio-config для внешнего доступа ещё не заведён. Co-Authored-By: Claude Sonnet 5 --- clusters/sarex-contour/kustomization.yaml | 1 + .../zitadel/sarex-contour/kustomization.yaml | 6 + .../zitadel/sarex-contour/zitadel.yaml | 158 ++++++++++++++++++ 3 files changed, 165 insertions(+) create mode 100644 infrastructure/zitadel/sarex-contour/kustomization.yaml create mode 100644 infrastructure/zitadel/sarex-contour/zitadel.yaml diff --git a/clusters/sarex-contour/kustomization.yaml b/clusters/sarex-contour/kustomization.yaml index d757beb..0874b98 100644 --- a/clusters/sarex-contour/kustomization.yaml +++ b/clusters/sarex-contour/kustomization.yaml @@ -11,6 +11,7 @@ resources: - ../../infrastructure/vault/sarex-contour - ../../infrastructure/kafka/sarex-contour - ../../infrastructure/rabbitmq/sarex-contour + - ../../infrastructure/zitadel/sarex-contour # apps - ../../apps/control-interface/sarex-contour diff --git a/infrastructure/zitadel/sarex-contour/kustomization.yaml b/infrastructure/zitadel/sarex-contour/kustomization.yaml new file mode 100644 index 0000000..17fee7c --- /dev/null +++ b/infrastructure/zitadel/sarex-contour/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: zitadel.yaml diff --git a/infrastructure/zitadel/sarex-contour/zitadel.yaml b/infrastructure/zitadel/sarex-contour/zitadel.yaml new file mode 100644 index 0000000..89e4504 --- /dev/null +++ b/infrastructure/zitadel/sarex-contour/zitadel.yaml @@ -0,0 +1,158 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: zitadel + namespace: zitadel +spec: + interval: 5m + timeout: 10m + postRenderers: + # sarex-contour без выделенных нод — снимаем nodeSelector/tolerations + # с Deployment и обоих Job'ов (init/setup). Дефолтный vault-agent + # template не кладёт Admin.Password/FirstInstance.Org.Human.Password — + # подменяем на свой (по образцу overlay vad), читающий их из + # secrets/data/zitadel/postgresql (поля password/humanPassword). + - kustomize: + patches: + - target: + group: apps + version: v1 + kind: Deployment + name: zitadel-idp-contour + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: {} + - op: add + path: /spec/template/spec/tolerations + value: [] + - op: replace + path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml + value: |- + {{- with secret "secrets/data/zitadel/postgresql" -}} + Database: + postgres: + User: + Password: |- + {{ index .Data.data "password" }} + Admin: + Password: |- + {{ index .Data.data "password" }} + FirstInstance: + Org: + Human: + Password: |- + {{ index .Data.data "humanPassword" }} + {{- end -}} + - target: + group: batch + version: v1 + kind: Job + name: zitadel-idp-contour-init + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: {} + - op: add + path: /spec/template/spec/tolerations + value: [] + - op: replace + path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml + value: |- + {{- with secret "secrets/data/zitadel/postgresql" -}} + Database: + postgres: + User: + Password: |- + {{ index .Data.data "password" }} + Admin: + Password: |- + {{ index .Data.data "password" }} + FirstInstance: + Org: + Human: + Password: |- + {{ index .Data.data "humanPassword" }} + {{- end -}} + - target: + group: batch + version: v1 + kind: Job + name: zitadel-idp-contour-setup + patch: |- + - op: add + path: /spec/template/spec/nodeSelector + value: {} + - op: add + path: /spec/template/spec/tolerations + value: [] + - op: replace + path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml + value: |- + {{- with secret "secrets/data/zitadel/postgresql" -}} + Database: + postgres: + User: + Password: |- + {{ index .Data.data "password" }} + Admin: + Password: |- + {{ index .Data.data "password" }} + FirstInstance: + Org: + Human: + Password: |- + {{ index .Data.data "humanPassword" }} + {{- end -}} + values: + zitadel: + configmapConfig: + # placeholder — istio-config/DNS для sarex-contour ещё не заведены, + # резолвиться прямо сейчас не обязан. + ExternalDomain: zitadel.sarex-contour.internal + ExternalSecure: true + debug: + enabled: false + postgresqlSecret: + create: false + vault: + enabled: true + role: zitadel + authPath: auth/kubernetes + secretPath: secrets/data/zitadel/postgresql + secretKey: password + kvVersion: 2 + fileName: zitadel-vault-config.yaml + serviceAccount: + create: true + name: zitadel + replicaCount: 1 + pdb: + enabled: false + env: + - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED + value: "false" + - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS + value: "bcrypt,pbkdf2" + - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED + value: "true" + - name: ZITADEL_DATABASE_POSTGRES_HOST + value: "111.88.255.180" + - name: ZITADEL_DATABASE_POSTGRES_PORT + value: "5432" + - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME + value: "zitadel" + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE + value: "zitadel" + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME + value: "zitadel" + - name: ZITADEL_DATABASE_POSTGRES_DATABASE + value: "zitadel" + - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE + value: "disable" + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE + value: "disable" + - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME + value: "zitadel-admin" + - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME + value: "Sarex"