clusters/d8-ugmk-prod/bootstrap-jobs/README.md

@@ -1,8 +0,0 @@
-bootstrap-jobs для сервисных сущностей kafka и rabbitmq.
-
-Эти кронджобы читают сервисные описания из vault и синхронизируют:
-- пользователей, виртуальные хосты и права в rabbitmq;
-- пользователей и топики в kafka.
-
-Для нового кластера адрес vault переведен на `vault-vault-contour-active.vault.svc.cluster.local:8200`,
-чтобы джобы ходили только в активный узел vault.

clusters/d8-ugmk-prod/bootstrap-jobs/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - service-bootstrap-jobs.yaml

clusters/d8-ugmk-prod/bootstrap-jobs/service-bootstrap-jobs.yaml

@@ -1,245 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: rabbitmq-apps-bootstrap
-  namespace: rabbitmq
-spec:
-  schedule: "*/10 * * * *"
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 2
-  concurrencyPolicy: Forbid
-  jobTemplate:
-    spec:
-      backoffLimit: 0
-      activeDeadlineSeconds: 600
-      template:
-        metadata:
-          annotations:
-            sidecar.istio.io/inject: "false"
-        spec:
-          restartPolicy: OnFailure
-          serviceAccountName: rabbitmq
-          automountServiceAccountToken: false
-          volumes:
-            - name: sa-token
-              projected:
-                sources:
-                  - serviceAccountToken:
-                      path: token
-                      expirationSeconds: 3600
-          containers:
-            - name: bootstrap
-              image: alpine:3.20
-              volumeMounts:
-                - name: sa-token
-                  mountPath: /var/run/secrets/tokens
-                  readOnly: true
-              command: ["/bin/sh", "-ec"]
-              args:
-                - |
-                  apk add --no-cache curl jq >/dev/null
-                  VAULT_ADDR="http://vault-vault-contour-active.vault.svc.cluster.local:8200"
-                  JWT="$(cat /var/run/secrets/tokens/token)"
-                  VAULT_TOKEN="$(curl -sS --request POST \
-                    --data "{\"role\":\"rabbitmq\",\"jwt\":\"${JWT}\"}" \
-                    "${VAULT_ADDR}/v1/auth/kubernetes/login" | jq -r '.auth.client_token')"
-                  [ -n "${VAULT_TOKEN}" ] && [ "${VAULT_TOKEN}" != "null" ]
-
-                  admin_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/rabbitmq/auth")"
-                  admin_user="$(echo "${admin_json}" | jq -r '.data.data.username')"
-                  admin_pass="$(echo "${admin_json}" | jq -r '.data.data.password')"
-                  list_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/metadata/rabbitmq/apps?list=true")"
-                  for app in $(echo "${list_json}" | jq -r '.data.keys[]?' | sed 's#/$##'); do
-                    app_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/rabbitmq/apps/${app}")"
-                    username="$(echo "${app_json}" | jq -r '.data.data.username')"
-                    password="$(echo "${app_json}" | jq -r '.data.data.password')"
-                    [ -z "${username}" ] && username="${app}"
-                    [ -z "${password}" ] && continue
-
-                    curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
-                      -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/users/${username}" \
-                      -d "{\"password\":\"${password}\",\"tags\":\"\"}" >/dev/null
-
-                    vhosts_count="$(echo "${app_json}" | jq -r '(.data.data.vhosts // []) | length')"
-                    if [ "${vhosts_count}" -gt 0 ]; then
-                      echo "${app_json}" | jq -c '.data.data.vhosts[]' | while read -r vhost_item; do
-                        vhost="$(echo "${vhost_item}" | jq -r '.name // "/"')"
-                        configure="$(echo "${vhost_item}" | jq -r '.permissions.configure // ".*"')"
-                        write="$(echo "${vhost_item}" | jq -r '.permissions.write // ".*"')"
-                        read="$(echo "${vhost_item}" | jq -r '.permissions.read // ".*"')"
-                        vhost_uri="$(jq -rn --arg v "${vhost}" '$v|@uri')"
-
-                        curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
-                          -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/vhosts/${vhost_uri}" \
-                          -d '{}' >/dev/null
-                        curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
-                          -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/permissions/${vhost_uri}/${username}" \
-                          -d "{\"configure\":\"${configure}\",\"write\":\"${write}\",\"read\":\"${read}\"}" >/dev/null
-                      done
-                    else
-                      vhost="$(echo "${app_json}" | jq -r '.data.data.vhost // "/"')"
-                      configure="$(echo "${app_json}" | jq -r '.data.data.permissions.configure // ".*"')"
-                      write="$(echo "${app_json}" | jq -r '.data.data.permissions.write // ".*"')"
-                      read="$(echo "${app_json}" | jq -r '.data.data.permissions.read // ".*"')"
-                      vhost_uri="$(jq -rn --arg v "${vhost}" '$v|@uri')"
-
-                      curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
-                        -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/vhosts/${vhost_uri}" \
-                        -d '{}' >/dev/null
-                      curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
-                        -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/permissions/${vhost_uri}/${username}" \
-                        -d "{\"configure\":\"${configure}\",\"write\":\"${write}\",\"read\":\"${read}\"}" >/dev/null
-                    fi
-                  done
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: kafka-bootstrap-exec
-  namespace: kafka
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["pods/exec"]
-    verbs: ["create", "get"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kafka-bootstrap-exec
-  namespace: kafka
-subjects:
-  - kind: ServiceAccount
-    name: kafka-kafka-contour
-    namespace: kafka
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kafka-bootstrap-exec
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: kafka-apps-bootstrap
-  namespace: kafka
-spec:
-  schedule: "*/10 * * * *"
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 2
-  concurrencyPolicy: Forbid
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          annotations:
-            sidecar.istio.io/inject: "false"
-        spec:
-          restartPolicy: OnFailure
-          serviceAccountName: kafka-kafka-contour
-          automountServiceAccountToken: true
-          volumes:
-            - name: sa-token
-              projected:
-                sources:
-                  - serviceAccountToken:
-                      path: token
-                      expirationSeconds: 3600
-          containers:
-            - name: bootstrap
-              image: alpine:3.20
-              volumeMounts:
-                - name: sa-token
-                  mountPath: /var/run/secrets/tokens
-                  readOnly: true
-              command: ["/bin/sh", "-ec"]
-              args:
-                - |
-                  set -e
-                  apk add --no-cache bash curl jq kubectl >/dev/null
-
-                  VAULT_ADDR="http://vault-vault-contour-active.vault.svc.cluster.local:8200"
-                  JWT="$(cat /var/run/secrets/tokens/token)"
-                  VAULT_TOKEN="$(curl -sS --request POST \
-                    --data "{\"role\":\"kafka\",\"jwt\":\"${JWT}\"}" \
-                    "${VAULT_ADDR}/v1/auth/kubernetes/login" | jq -r '.auth.client_token')"
-                  [ -n "${VAULT_TOKEN}" ] && [ "${VAULT_TOKEN}" != "null" ]
-
-                  bootstrap_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/kafka/bootstrap")"
-                  inter_broker_password="$(echo "${bootstrap_json}" | jq -r '.data.data.interBrokerPassword')"
-                  [ -n "${inter_broker_password}" ] && [ "${inter_broker_password}" != "null" ]
-                  list_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/metadata/kafka/apps?list=true")"
-                  target_pod="kafka-kafka-contour-controller-0"
-                  if ! kubectl -n kafka get pod "${target_pod}" >/dev/null 2>&1; then
-                    echo "Kafka controller pod not found"
-                    exit 1
-                  fi
-                  target_bootstrap="${target_pod}.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094"
-
-                  admin_props="$(mktemp)"
-                  printf "%s\n" \
-                    "security.protocol=SASL_PLAINTEXT" \
-                    "sasl.mechanism=PLAIN" \
-                    "sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username='inter_broker_user' password='${inter_broker_password}';" \
-                    "default.api.timeout.ms=60000" \
-                    "request.timeout.ms=60000" \
-                    > "${admin_props}"
-                  kubectl -n kafka exec -i "${target_pod}" -c kafka -- /bin/bash -lc 'cat > /tmp/admin.properties' < "${admin_props}"
-                  rm -f "${admin_props}"
-                  kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc 'test -s /tmp/admin.properties'
-
-                  for app in $(echo "${list_json}" | jq -r '.data.keys[]?' | sed 's#/$##'); do
-                    app_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/kafka/apps/${app}")"
-                    username="$(echo "${app_json}" | jq -r '.data.data.username')"
-                    password="$(echo "${app_json}" | jq -r '.data.data.password')"
-                    [ -z "${username}" ] && username="${app}"
-                    [ -z "${password}" ] && continue
-
-                    echo "Reconciling Kafka user ${username}"
-                    user_reconciled=false
-                    attempt=1
-                    while [ "${attempt}" -le 3 ]; do
-                      if kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
-                        timeout 60 /opt/bitnami/kafka/bin/kafka-configs.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
-                          --alter --add-config 'SCRAM-SHA-512=[password=${password}]' \
-                          --entity-type users --entity-name '${username}'
-                      " >/dev/null; then
-                        user_reconciled=true
-                        break
-                      fi
-                      echo "Kafka user ${username} reconcile attempt ${attempt}/3 failed"
-                      attempt=$((attempt + 1))
-                      sleep 5
-                    done
-                    if [ "${user_reconciled}" != "true" ]; then
-                      echo "Kafka user ${username} reconcile failed, continue"
-                      continue
-                    fi
-
-                    echo "${app_json}" | jq -c '.data.data.topics[]?' | while read -r topic_item; do
-                      topic_name="$(echo "${topic_item}" | jq -r '.name // empty')"
-                      partitions="$(echo "${topic_item}" | jq -r '.partitions // 3')"
-                      replication_factor="$(echo "${topic_item}" | jq -r '.replication_factor // 1')"
-                      topic_configs="$(echo "${topic_item}" | jq -r '(.configs // {}) | to_entries | map("\(.key)=\(.value|tostring)") | join(",")')"
-                      [ -z "${topic_name}" ] && continue
-
-                      echo "Reconciling Kafka topic ${topic_name}"
-                      if ! kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
-                        timeout 40 /opt/bitnami/kafka/bin/kafka-topics.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
-                          --create --if-not-exists --topic '${topic_name}' --partitions '${partitions}' --replication-factor '${replication_factor}'
-                      " >/dev/null; then
-                        echo "Kafka topic ${topic_name} create/reconcile failed, continue"
-                        continue
-                      fi
-
-                      if [ -n "${topic_configs}" ]; then
-                        if ! kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
-                          timeout 40 /opt/bitnami/kafka/bin/kafka-configs.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
-                            --alter --entity-type topics --entity-name '${topic_name}' --add-config '${topic_configs}'
-                        " >/dev/null; then
-                          echo "Kafka topic ${topic_name} config reconcile failed, continue"
-                        fi
-                      fi
-                    done
-                  done

clusters/d8-ugmk-prod/infrastructure/kustomization.yaml

@@ -1,48 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ../../../infrastructure/kafka
-  - ../../../infrastructure/rabbitmq
-  - ../../../infrastructure/camunda
   - ../../../infrastructure/vault
-  - ../../../infrastructure/zitadel
 patches:
-  - path: ./patches/kafka.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: kafka
-      namespace: kafka
-  - path: ./patches/kafka-namespace.yaml
-    target:
-      version: v1
-      kind: Namespace
-      name: kafka
-  - path: ./patches/rabbitmq.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: rabbitmq
-      namespace: rabbitmq
-  - path: ./patches/rabbitmq-namespace.yaml
-    target:
-      version: v1
-      kind: Namespace
-      name: rabbitmq
-  - path: ./patches/camunda.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: camunda
-      namespace: camunda
-  - path: ./patches/camunda-namespace.yaml
-    target:
-      version: v1
-      kind: Namespace
-      name: camunda
   - path: ./patches/vault.yaml
     target:
       group: helm.toolkit.fluxcd.io
@@ -55,15 +15,3 @@ patches:
       version: v1
       kind: Namespace
       name: vault
-  - path: ./patches/zitadel.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: zitadel
-      namespace: zitadel
-  - path: ./patches/zitadel-namespace.yaml
-    target:
-      version: v1
-      kind: Namespace
-      name: zitadel

clusters/d8-ugmk-prod/infrastructure/patches/camunda-namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: camunda
-  labels:
-    istio-injection: disabled
-    security.deckhouse.io/pod-policy: privileged

clusters/d8-ugmk-prod/infrastructure/patches/camunda.yaml

@@ -1,198 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: camunda
-  namespace: camunda
-spec:
-  dependsOn: []
-  interval: 5m
-  timeout: 15m
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              namespace: camunda
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: apps
-              version: v1
-              kind: StatefulSet
-              namespace: camunda
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: batch
-              version: v1
-              kind: Job
-              namespace: camunda
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-  values:
-    global:
-      vault:
-        enabled: true
-        role: camunda
-        authPath: auth/kubernetes
-      image:
-        pullSecrets:
-          - name: regcred
-      identity:
-        auth:
-          publicIssuerUrl: "https://camunda-keycloak.contour.infra.sarex.tech/auth/realms/camunda-platform"
-          identity:
-            redirectUrl: "https://camunda-identity.contour.infra.sarex.tech"
-          operate:
-            redirectUrl: "https://camunda-operate.contour.infra.sarex.tech"
-          tasklist:
-            redirectUrl: "https://camunda-tasklist.contour.infra.sarex.tech"
-          optimize:
-            redirectUrl: "https://camunda-optimize.contour.infra.sarex.tech"
-          webModeler:
-            redirectUrl: "https://camunda-web-modeler.contour.infra.sarex.tech"
-          console:
-            redirectUrl: "https://camunda-console.contour.infra.sarex.tech"
-    identityPostgresql:
-      auth:
-        usePasswordFiles: true
-      primary:
-        automountServiceAccountToken: true
-        persistence:
-          size: 10Gi
-          storageClass: local-path
-    identityKeycloak:
-      postgresql:
-        auth:
-          usePasswordFiles: true
-        primary:
-          automountServiceAccountToken: true
-          persistence:
-            size: 10Gi
-            storageClass: local-path
-      vaultEnv:
-        enabled: true
-        role: camunda
-        authPath: auth/kubernetes
-        envFiles:
-          KEYCLOAK_ADMIN_PASSWORD:
-            path: secrets/data/camunda/keycloak-admin
-            key: admin-password
-          KEYCLOAK_PASSWORD:
-            path: secrets/data/camunda/keycloak-admin
-            key: admin-password
-          KEYCLOAK_DATABASE_PASSWORD:
-            path: secrets/data/camunda/postgresql
-            key: password
-      global:
-        storageClass: local-path
-      tolerations: []
-    postgresql:
-      auth:
-        usePasswordFiles: true
-      primary:
-        automountServiceAccountToken: true
-        persistence:
-          size: 10Gi
-          storageClass: local-path
-    elasticsearch:
-      master:
-        persistence:
-          size: 10Gi
-          storageClass: local-path
-        tolerations: []
-      metrics:
-        enabled: false
-        serviceMonitor:
-          enabled: false
-        prometheusRule:
-          enabled: false
-        tolerations: []
-    camundaCanary:
-      enabled: false
-    prometheusServiceMonitor:
-      enabled: false
-    console:
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    zeebe:
-      pvcStorageClassName: local-path
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    zeebeGateway:
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    operate:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []
-    tasklist:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []
-    optimize:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []
-    executionIdentity:
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    identity:
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    webModeler:
-      image:
-        pullSecrets:
-          - name: regcred
-      restapi:
-        tolerations: []
-      webapp:
-        tolerations: []
-      websockets:
-        tolerations: []
-    connectors:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []

clusters/d8-ugmk-prod/infrastructure/patches/kafka-namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kafka
-  labels:
-    istio-injection: disabled
-    security.deckhouse.io/pod-policy: privileged

clusters/d8-ugmk-prod/infrastructure/patches/kafka.yaml

@@ -1,73 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: kafka
-  namespace: kafka
-spec:
-  interval: 5m
-  timeout: 10m
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: StatefulSet
-              namespace: kafka
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-  values:
-    global:
-      imagePullSecrets:
-        - regcred
-      defaultStorageClass: local-path
-    image:
-      pullSecrets:
-        - regcred
-    controller:
-      replicaCount: 1
-      automountServiceAccountToken: true
-      persistence:
-        size: 8Gi
-        storageClass: local-path
-      overrideConfiguration:
-        offsets.topic.replication.factor: 1
-        transaction.state.log.replication.factor: 1
-        transaction.state.log.min.isr: 1
-        default.replication.factor: 1
-        min.insync.replicas: 1
-    broker:
-      replicaCount: 0
-      automountServiceAccountToken: true
-    listeners:
-      client:
-        protocol: SASL_SSL
-        sslClientAuth: "none"
-    provisioning:
-      enabled: false
-    sasl:
-      managedExistingSecret:
-        enabled: false
-      existingSecret: ""
-      enabledMechanisms: PLAIN,SCRAM-SHA-512
-      interBrokerMechanism: PLAIN
-      controllerMechanism: PLAIN
-      client:
-        users: []
-        passwords: ""
-    tls:
-      type: PEM
-    vault:
-      enabled: true
-      role: kafka
-      authPath: auth/kubernetes
-      secretPath: secrets/data/kafka/bootstrap
-      clusterIdKey: clusterId
-      interBrokerPasswordKey: interBrokerPassword
-      controllerPasswordKey: controllerPassword

clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq-namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: rabbitmq
-  labels:
-    istio-injection: disabled
-    security.deckhouse.io/pod-policy: privileged

clusters/d8-ugmk-prod/infrastructure/patches/rabbitmq.yaml

@@ -1,58 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: rabbitmq
-  namespace: rabbitmq
-spec:
-  interval: 5m
-  timeout: 10m
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: StatefulSet
-              namespace: rabbitmq
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-  values:
-    global:
-      security:
-        allowInsecureImages: true
-    virtualService: null
-    gateway: null
-    certificate: null
-    metrics:
-      serviceMonitor:
-        enabled: false
-        default:
-          enabled: false
-        perObject:
-          enabled: false
-        detailed:
-          enabled: false
-    extraServiceMonitors: []
-    replicaCount: 1
-    resources:
-      requests:
-        memory: 1Gi
-    persistence:
-      storageClass: local-path
-      size: 10Gi
-    auth:
-      securePassword: true
-      existingPasswordSecret: ""
-      vault:
-        enabled: true
-        role: rabbitmq
-        authPath: auth/kubernetes
-        secretPath: secrets/data/rabbitmq/auth
-        usernameKey: username
-        passwordKey: password

clusters/d8-ugmk-prod/infrastructure/patches/vault-namespace.yaml

@@ -4,4 +4,3 @@ metadata:
   name: vault
   labels:
     istio-injection: disabled
-    security.deckhouse.io/pod-policy: privileged

clusters/d8-ugmk-prod/infrastructure/patches/vault.yaml

@@ -9,15 +9,13 @@ spec:
   values:
     imagePullSecrets:
       - name: regcred
-    backup:
-      enabled: false
     injector:
       nodeSelector:
         node.deckhouse.io/group: generic
       tolerations: []
     server:
+      dataStorage:
+        storageClass: local-path
       nodeSelector:
         node.deckhouse.io/group: generic
       tolerations: []
-      dataStorage:
-        storageClass: local-path

clusters/d8-ugmk-prod/infrastructure/patches/zitadel-namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: zitadel
-  labels:
-    istio-injection: disabled

clusters/d8-ugmk-prod/infrastructure/patches/zitadel.yaml

@@ -1,153 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: zitadel
-  namespace: zitadel
-spec:
-  interval: 5m
-  timeout: 10m
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              name: zitadel-idp-contour
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-              - op: replace
-                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
-                value: |-
-                  {{- with secret "secrets/data/zitadel/postgresql" -}}
-                  Database:
-                    postgres:
-                      User:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                      Admin:
-                        Password: |-
-                          {{ index .Data.data "adminPassword" }}
-                  FirstInstance:
-                    Org:
-                      Human:
-                        Password: |-
-                          {{ index .Data.data "humanPassword" }}
-                  {{- end -}}
-          - target:
-              group: batch
-              version: v1
-              kind: Job
-              name: zitadel-idp-contour-init
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-              - op: replace
-                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
-                value: |-
-                  {{- with secret "secrets/data/zitadel/postgresql" -}}
-                  Database:
-                    postgres:
-                      User:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                      Admin:
-                        Password: |-
-                          {{ index .Data.data "adminPassword" }}
-                  FirstInstance:
-                    Org:
-                      Human:
-                        Password: |-
-                          {{ index .Data.data "humanPassword" }}
-                  {{- end -}}
-          - target:
-              group: batch
-              version: v1
-              kind: Job
-              name: zitadel-idp-contour-setup
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-              - op: replace
-                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
-                value: |-
-                  {{- with secret "secrets/data/zitadel/postgresql" -}}
-                  Database:
-                    postgres:
-                      User:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                      Admin:
-                        Password: |-
-                          {{ index .Data.data "adminPassword" }}
-                  FirstInstance:
-                    Org:
-                      Human:
-                        Password: |-
-                          {{ index .Data.data "humanPassword" }}
-                  {{- end -}}
-  values:
-    zitadel:
-      configmapConfig:
-        ExternalDomain: sarex-login.uralmine.com
-        ExternalSecure: true
-      debug:
-        enabled: false
-    postgresqlSecret:
-      vault:
-        enabled: true
-        role: zitadel
-        authPath: auth/kubernetes
-        secretPath: secrets/data/zitadel/postgresql
-        secretKey: password
-        kvVersion: 2
-        fileName: zitadel-vault-config.yaml
-    serviceAccount:
-      create: true
-      name: zitadel
-    replicaCount: 1
-    pdb:
-      enabled: false
-    env:
-      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
-        value: "false"
-      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
-        value: "bcrypt,pbkdf2"
-      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
-        value: "true"
-      - name: ZITADEL_DATABASE_POSTGRES_HOST
-        value: "10.222.255.162"
-      - name: ZITADEL_DATABASE_POSTGRES_PORT
-        value: "5432"
-      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
-        value: "disable"
-      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
-        value: "disable"
-      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
-        value: "zitadel-admin"
-      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
-        value: "Sarex"

clusters/d8-ugmk-prod/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
   - ./flux-system
   - ./helm-repositories.yaml
   - ./infrastructure
-  - ./bootstrap-jobs