++ sarex-contour: zitadel
infrastructure/zitadel/sarex-contour (chart idp-contour 4.12.13), по образцу overlay vad: без dependsOn на postgresql (БД внешняя, отдельная машина 111.88.255.180 — заказана через terraform live/database, не in-cluster HelmRelease), postRenderer снимает nodeSelector с Deployment + 2 Job'ов и подменяет vault-agent template на свой (кладёт Admin.Password/FirstInstance.Org.Human.Password из secrets/data/zitadel/postgresql). ExternalDomain — заглушка zitadel.sarex-contour.internal, istio-config для внешнего доступа ещё не заведён. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
ivan
parent
48f7934699
commit
9baaa3d7f1
@ -11,6 +11,7 @@ resources:
|
|||||||
- ../../infrastructure/vault/sarex-contour
|
- ../../infrastructure/vault/sarex-contour
|
||||||
- ../../infrastructure/kafka/sarex-contour
|
- ../../infrastructure/kafka/sarex-contour
|
||||||
- ../../infrastructure/rabbitmq/sarex-contour
|
- ../../infrastructure/rabbitmq/sarex-contour
|
||||||
|
- ../../infrastructure/zitadel/sarex-contour
|
||||||
|
|
||||||
# apps
|
# apps
|
||||||
- ../../apps/control-interface/sarex-contour
|
- ../../apps/control-interface/sarex-contour
|
||||||
|
|||||||
6
infrastructure/zitadel/sarex-contour/kustomization.yaml
Normal file
6
infrastructure/zitadel/sarex-contour/kustomization.yaml
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ../base
|
||||||
|
patches:
|
||||||
|
- path: zitadel.yaml
|
||||||
158
infrastructure/zitadel/sarex-contour/zitadel.yaml
Normal file
158
infrastructure/zitadel/sarex-contour/zitadel.yaml
Normal file
@ -0,0 +1,158 @@
|
|||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: zitadel
|
||||||
|
namespace: zitadel
|
||||||
|
spec:
|
||||||
|
interval: 5m
|
||||||
|
timeout: 10m
|
||||||
|
postRenderers:
|
||||||
|
# sarex-contour без выделенных нод — снимаем nodeSelector/tolerations
|
||||||
|
# с Deployment и обоих Job'ов (init/setup). Дефолтный vault-agent
|
||||||
|
# template не кладёт Admin.Password/FirstInstance.Org.Human.Password —
|
||||||
|
# подменяем на свой (по образцу overlay vad), читающий их из
|
||||||
|
# secrets/data/zitadel/postgresql (поля password/humanPassword).
|
||||||
|
- kustomize:
|
||||||
|
patches:
|
||||||
|
- target:
|
||||||
|
group: apps
|
||||||
|
version: v1
|
||||||
|
kind: Deployment
|
||||||
|
name: zitadel-idp-contour
|
||||||
|
patch: |-
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/nodeSelector
|
||||||
|
value: {}
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/tolerations
|
||||||
|
value: []
|
||||||
|
- op: replace
|
||||||
|
path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
|
||||||
|
value: |-
|
||||||
|
{{- with secret "secrets/data/zitadel/postgresql" -}}
|
||||||
|
Database:
|
||||||
|
postgres:
|
||||||
|
User:
|
||||||
|
Password: |-
|
||||||
|
{{ index .Data.data "password" }}
|
||||||
|
Admin:
|
||||||
|
Password: |-
|
||||||
|
{{ index .Data.data "password" }}
|
||||||
|
FirstInstance:
|
||||||
|
Org:
|
||||||
|
Human:
|
||||||
|
Password: |-
|
||||||
|
{{ index .Data.data "humanPassword" }}
|
||||||
|
{{- end -}}
|
||||||
|
- target:
|
||||||
|
group: batch
|
||||||
|
version: v1
|
||||||
|
kind: Job
|
||||||
|
name: zitadel-idp-contour-init
|
||||||
|
patch: |-
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/nodeSelector
|
||||||
|
value: {}
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/tolerations
|
||||||
|
value: []
|
||||||
|
- op: replace
|
||||||
|
path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
|
||||||
|
value: |-
|
||||||
|
{{- with secret "secrets/data/zitadel/postgresql" -}}
|
||||||
|
Database:
|
||||||
|
postgres:
|
||||||
|
User:
|
||||||
|
Password: |-
|
||||||
|
{{ index .Data.data "password" }}
|
||||||
|
Admin:
|
||||||
|
Password: |-
|
||||||
|
{{ index .Data.data "password" }}
|
||||||
|
FirstInstance:
|
||||||
|
Org:
|
||||||
|
Human:
|
||||||
|
Password: |-
|
||||||
|
{{ index .Data.data "humanPassword" }}
|
||||||
|
{{- end -}}
|
||||||
|
- target:
|
||||||
|
group: batch
|
||||||
|
version: v1
|
||||||
|
kind: Job
|
||||||
|
name: zitadel-idp-contour-setup
|
||||||
|
patch: |-
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/nodeSelector
|
||||||
|
value: {}
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/tolerations
|
||||||
|
value: []
|
||||||
|
- op: replace
|
||||||
|
path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
|
||||||
|
value: |-
|
||||||
|
{{- with secret "secrets/data/zitadel/postgresql" -}}
|
||||||
|
Database:
|
||||||
|
postgres:
|
||||||
|
User:
|
||||||
|
Password: |-
|
||||||
|
{{ index .Data.data "password" }}
|
||||||
|
Admin:
|
||||||
|
Password: |-
|
||||||
|
{{ index .Data.data "password" }}
|
||||||
|
FirstInstance:
|
||||||
|
Org:
|
||||||
|
Human:
|
||||||
|
Password: |-
|
||||||
|
{{ index .Data.data "humanPassword" }}
|
||||||
|
{{- end -}}
|
||||||
|
values:
|
||||||
|
zitadel:
|
||||||
|
configmapConfig:
|
||||||
|
# placeholder — istio-config/DNS для sarex-contour ещё не заведены,
|
||||||
|
# резолвиться прямо сейчас не обязан.
|
||||||
|
ExternalDomain: zitadel.sarex-contour.internal
|
||||||
|
ExternalSecure: true
|
||||||
|
debug:
|
||||||
|
enabled: false
|
||||||
|
postgresqlSecret:
|
||||||
|
create: false
|
||||||
|
vault:
|
||||||
|
enabled: true
|
||||||
|
role: zitadel
|
||||||
|
authPath: auth/kubernetes
|
||||||
|
secretPath: secrets/data/zitadel/postgresql
|
||||||
|
secretKey: password
|
||||||
|
kvVersion: 2
|
||||||
|
fileName: zitadel-vault-config.yaml
|
||||||
|
serviceAccount:
|
||||||
|
create: true
|
||||||
|
name: zitadel
|
||||||
|
replicaCount: 1
|
||||||
|
pdb:
|
||||||
|
enabled: false
|
||||||
|
env:
|
||||||
|
- name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
|
||||||
|
value: "false"
|
||||||
|
- name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
|
||||||
|
value: "bcrypt,pbkdf2"
|
||||||
|
- name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
|
||||||
|
value: "true"
|
||||||
|
- name: ZITADEL_DATABASE_POSTGRES_HOST
|
||||||
|
value: "111.88.255.180"
|
||||||
|
- name: ZITADEL_DATABASE_POSTGRES_PORT
|
||||||
|
value: "5432"
|
||||||
|
- name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
|
||||||
|
value: "zitadel"
|
||||||
|
- name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
|
||||||
|
value: "zitadel"
|
||||||
|
- name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
|
||||||
|
value: "zitadel"
|
||||||
|
- name: ZITADEL_DATABASE_POSTGRES_DATABASE
|
||||||
|
value: "zitadel"
|
||||||
|
- name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
|
||||||
|
value: "disable"
|
||||||
|
- name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
|
||||||
|
value: "disable"
|
||||||
|
- name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
|
||||||
|
value: "zitadel-admin"
|
||||||
|
- name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
|
||||||
|
value: "Sarex"
|
||||||
Loading…
Reference in New Issue
Block a user