apps/attachments/d8-ugmk-prod/kustomization.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: attachments
-resources:
-  - ../base
-  - namespace.yaml
-patches: []
-#  - path: patch.yaml
-#    target:
-#      kind: HelmRelease
-#      name: attachments

apps/attachments/d8-ugmk-prod/namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: attachments
-  labels:
-    istio-injection: disabled
-    security.deckhouse.io/pod-policy: privileged

apps/control-interface/base/deployment.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: srx-admin
+  namespace: control-interface
+  labels:
+    app: srx-admin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: srx-admin
+  template:
+    metadata:
+      labels:
+        app: srx-admin
+    spec:
+      containers:
+        - name: srx-admin
+          image: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_3b9cb250
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+      imagePullSecrets:
+        - name: regcred
+

apps/control-interface/base/helmrelease.yaml

@@ -1,92 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: srx-admin
-  namespace: django
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      frontend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_feb59026
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: srx-admin
-
-          replicaCount:
-            _default: 1
-            stage: 1
-            preprod: 3
-            production: 3
-
-          port:
-            _default: 80
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: srx-admin-svc
-
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8080
-
-          targetPort:
-            _default: 80
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: regcred
-
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/control-interface/base/kustomization.yaml

@@ -1,6 +1,8 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: django
+namespace: control-interface
 resources:
-  - helmrelease.yaml
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml

apps/control-interface/base/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: control-interface
+  labels:
+    istio-injection: enabled

apps/control-interface/base/service.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontend-svc
+  namespace: control-interface
+spec:
+  type: ClusterIP
+  selector:
+    app: srx-admin
+  ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP

apps/control-interface/d8-ugmk-prod/kustomization.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: django
-resources:
-  - ../base
-  - namespace.yaml
-patches: []
-#  - path: patch.yaml
-#    target:
-#      kind: HelmRelease
-#      name: srx-admin

apps/control-interface/d8-ugmk-prod/namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: django
-  labels:
-    istio-injection: disabled
-    security.deckhouse.io/pod-policy: privileged

apps/control-interface/d8-ugmk-prod/patch.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: srx-admin
-  namespace: django
-spec:
-  values:
-    services:
-      frontend:
-        deployment:
-          replicaCount:
-            _default: 1

apps/control-interface/yc-k8s-test/kustomization.yaml

@@ -1,11 +1,10 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: django
 resources:
   - ../base
 patches:
   - path: replicas.yaml
     target:
-      kind: HelmRelease
+      kind: Deployment
       name: srx-admin

apps/control-interface/yc-k8s-test/replicas.yaml

@@ -1,13 +1,8 @@
 ---
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: apps/v1
-kind: HelmRelease
+kind: Deployment
 metadata:
   name: srx-admin
-  namespace: django
+  namespace: control-interface
 spec:
-  values:
+  replicas: 1
-    services:
-      frontend:
-        deployment:
-          replicaCount:
-            _default: 1

clusters/d8-ugmk-prod/bootstrap-jobs/README.md

@@ -1,8 +0,0 @@
-bootstrap-jobs для сервисных сущностей kafka и rabbitmq.
-
-Эти кронджобы читают сервисные описания из vault и синхронизируют:
-- пользователей, виртуальные хосты и права в rabbitmq;
-- пользователей и топики в kafka.
-
-Для нового кластера адрес vault переведен на `vault-vault-contour-active.vault.svc.cluster.local:8200`,
-чтобы джобы ходили только в активный узел vault.

clusters/d8-ugmk-prod/bootstrap-jobs/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - service-bootstrap-jobs.yaml

clusters/d8-ugmk-prod/bootstrap-jobs/service-bootstrap-jobs.yaml

@@ -1,245 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: rabbitmq-apps-bootstrap
-  namespace: rabbitmq
-spec:
-  schedule: "*/10 * * * *"
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 2
-  concurrencyPolicy: Forbid
-  jobTemplate:
-    spec:
-      backoffLimit: 0
-      activeDeadlineSeconds: 600
-      template:
-        metadata:
-          annotations:
-            sidecar.istio.io/inject: "false"
-        spec:
-          restartPolicy: OnFailure
-          serviceAccountName: rabbitmq
-          automountServiceAccountToken: false
-          volumes:
-            - name: sa-token
-              projected:
-                sources:
-                  - serviceAccountToken:
-                      path: token
-                      expirationSeconds: 3600
-          containers:
-            - name: bootstrap
-              image: alpine:3.20
-              volumeMounts:
-                - name: sa-token
-                  mountPath: /var/run/secrets/tokens
-                  readOnly: true
-              command: ["/bin/sh", "-ec"]
-              args:
-                - |
-                  apk add --no-cache curl jq >/dev/null
-                  VAULT_ADDR="http://vault-vault-contour-active.vault.svc.cluster.local:8200"
-                  JWT="$(cat /var/run/secrets/tokens/token)"
-                  VAULT_TOKEN="$(curl -sS --request POST \
-                    --data "{\"role\":\"rabbitmq\",\"jwt\":\"${JWT}\"}" \
-                    "${VAULT_ADDR}/v1/auth/kubernetes/login" | jq -r '.auth.client_token')"
-                  [ -n "${VAULT_TOKEN}" ] && [ "${VAULT_TOKEN}" != "null" ]
-
-                  admin_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/rabbitmq/auth")"
-                  admin_user="$(echo "${admin_json}" | jq -r '.data.data.username')"
-                  admin_pass="$(echo "${admin_json}" | jq -r '.data.data.password')"
-                  list_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/metadata/rabbitmq/apps?list=true")"
-                  for app in $(echo "${list_json}" | jq -r '.data.keys[]?' | sed 's#/$##'); do
-                    app_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/rabbitmq/apps/${app}")"
-                    username="$(echo "${app_json}" | jq -r '.data.data.username')"
-                    password="$(echo "${app_json}" | jq -r '.data.data.password')"
-                    [ -z "${username}" ] && username="${app}"
-                    [ -z "${password}" ] && continue
-
-                    curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
-                      -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/users/${username}" \
-                      -d "{\"password\":\"${password}\",\"tags\":\"\"}" >/dev/null
-
-                    vhosts_count="$(echo "${app_json}" | jq -r '(.data.data.vhosts // []) | length')"
-                    if [ "${vhosts_count}" -gt 0 ]; then
-                      echo "${app_json}" | jq -c '.data.data.vhosts[]' | while read -r vhost_item; do
-                        vhost="$(echo "${vhost_item}" | jq -r '.name // "/"')"
-                        configure="$(echo "${vhost_item}" | jq -r '.permissions.configure // ".*"')"
-                        write="$(echo "${vhost_item}" | jq -r '.permissions.write // ".*"')"
-                        read="$(echo "${vhost_item}" | jq -r '.permissions.read // ".*"')"
-                        vhost_uri="$(jq -rn --arg v "${vhost}" '$v|@uri')"
-
-                        curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
-                          -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/vhosts/${vhost_uri}" \
-                          -d '{}' >/dev/null
-                        curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
-                          -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/permissions/${vhost_uri}/${username}" \
-                          -d "{\"configure\":\"${configure}\",\"write\":\"${write}\",\"read\":\"${read}\"}" >/dev/null
-                      done
-                    else
-                      vhost="$(echo "${app_json}" | jq -r '.data.data.vhost // "/"')"
-                      configure="$(echo "${app_json}" | jq -r '.data.data.permissions.configure // ".*"')"
-                      write="$(echo "${app_json}" | jq -r '.data.data.permissions.write // ".*"')"
-                      read="$(echo "${app_json}" | jq -r '.data.data.permissions.read // ".*"')"
-                      vhost_uri="$(jq -rn --arg v "${vhost}" '$v|@uri')"
-
-                      curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
-                        -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/vhosts/${vhost_uri}" \
-                        -d '{}' >/dev/null
-                      curl -sS -u "${admin_user}:${admin_pass}" -H "content-type:application/json" \
-                        -X PUT "http://rabbitmq.rabbitmq.svc.cluster.local:15672/api/permissions/${vhost_uri}/${username}" \
-                        -d "{\"configure\":\"${configure}\",\"write\":\"${write}\",\"read\":\"${read}\"}" >/dev/null
-                    fi
-                  done
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: kafka-bootstrap-exec
-  namespace: kafka
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["pods/exec"]
-    verbs: ["create", "get"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: kafka-bootstrap-exec
-  namespace: kafka
-subjects:
-  - kind: ServiceAccount
-    name: kafka-kafka-contour
-    namespace: kafka
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kafka-bootstrap-exec
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: kafka-apps-bootstrap
-  namespace: kafka
-spec:
-  schedule: "*/10 * * * *"
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 2
-  concurrencyPolicy: Forbid
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          annotations:
-            sidecar.istio.io/inject: "false"
-        spec:
-          restartPolicy: OnFailure
-          serviceAccountName: kafka-kafka-contour
-          automountServiceAccountToken: true
-          volumes:
-            - name: sa-token
-              projected:
-                sources:
-                  - serviceAccountToken:
-                      path: token
-                      expirationSeconds: 3600
-          containers:
-            - name: bootstrap
-              image: alpine:3.20
-              volumeMounts:
-                - name: sa-token
-                  mountPath: /var/run/secrets/tokens
-                  readOnly: true
-              command: ["/bin/sh", "-ec"]
-              args:
-                - |
-                  set -e
-                  apk add --no-cache bash curl jq kubectl >/dev/null
-
-                  VAULT_ADDR="http://vault-vault-contour-active.vault.svc.cluster.local:8200"
-                  JWT="$(cat /var/run/secrets/tokens/token)"
-                  VAULT_TOKEN="$(curl -sS --request POST \
-                    --data "{\"role\":\"kafka\",\"jwt\":\"${JWT}\"}" \
-                    "${VAULT_ADDR}/v1/auth/kubernetes/login" | jq -r '.auth.client_token')"
-                  [ -n "${VAULT_TOKEN}" ] && [ "${VAULT_TOKEN}" != "null" ]
-
-                  bootstrap_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/kafka/bootstrap")"
-                  inter_broker_password="$(echo "${bootstrap_json}" | jq -r '.data.data.interBrokerPassword')"
-                  [ -n "${inter_broker_password}" ] && [ "${inter_broker_password}" != "null" ]
-                  list_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/metadata/kafka/apps?list=true")"
-                  target_pod="kafka-kafka-contour-controller-0"
-                  if ! kubectl -n kafka get pod "${target_pod}" >/dev/null 2>&1; then
-                    echo "Kafka controller pod not found"
-                    exit 1
-                  fi
-                  target_bootstrap="${target_pod}.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094"
-
-                  admin_props="$(mktemp)"
-                  printf "%s\n" \
-                    "security.protocol=SASL_PLAINTEXT" \
-                    "sasl.mechanism=PLAIN" \
-                    "sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username='inter_broker_user' password='${inter_broker_password}';" \
-                    "default.api.timeout.ms=60000" \
-                    "request.timeout.ms=60000" \
-                    > "${admin_props}"
-                  kubectl -n kafka exec -i "${target_pod}" -c kafka -- /bin/bash -lc 'cat > /tmp/admin.properties' < "${admin_props}"
-                  rm -f "${admin_props}"
-                  kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc 'test -s /tmp/admin.properties'
-
-                  for app in $(echo "${list_json}" | jq -r '.data.keys[]?' | sed 's#/$##'); do
-                    app_json="$(curl -sS -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/kafka/apps/${app}")"
-                    username="$(echo "${app_json}" | jq -r '.data.data.username')"
-                    password="$(echo "${app_json}" | jq -r '.data.data.password')"
-                    [ -z "${username}" ] && username="${app}"
-                    [ -z "${password}" ] && continue
-
-                    echo "Reconciling Kafka user ${username}"
-                    user_reconciled=false
-                    attempt=1
-                    while [ "${attempt}" -le 3 ]; do
-                      if kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
-                        timeout 60 /opt/bitnami/kafka/bin/kafka-configs.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
-                          --alter --add-config 'SCRAM-SHA-512=[password=${password}]' \
-                          --entity-type users --entity-name '${username}'
-                      " >/dev/null; then
-                        user_reconciled=true
-                        break
-                      fi
-                      echo "Kafka user ${username} reconcile attempt ${attempt}/3 failed"
-                      attempt=$((attempt + 1))
-                      sleep 5
-                    done
-                    if [ "${user_reconciled}" != "true" ]; then
-                      echo "Kafka user ${username} reconcile failed, continue"
-                      continue
-                    fi
-
-                    echo "${app_json}" | jq -c '.data.data.topics[]?' | while read -r topic_item; do
-                      topic_name="$(echo "${topic_item}" | jq -r '.name // empty')"
-                      partitions="$(echo "${topic_item}" | jq -r '.partitions // 3')"
-                      replication_factor="$(echo "${topic_item}" | jq -r '.replication_factor // 1')"
-                      topic_configs="$(echo "${topic_item}" | jq -r '(.configs // {}) | to_entries | map("\(.key)=\(.value|tostring)") | join(",")')"
-                      [ -z "${topic_name}" ] && continue
-
-                      echo "Reconciling Kafka topic ${topic_name}"
-                      if ! kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
-                        timeout 40 /opt/bitnami/kafka/bin/kafka-topics.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
-                          --create --if-not-exists --topic '${topic_name}' --partitions '${partitions}' --replication-factor '${replication_factor}'
-                      " >/dev/null; then
-                        echo "Kafka topic ${topic_name} create/reconcile failed, continue"
-                        continue
-                      fi
-
-                      if [ -n "${topic_configs}" ]; then
-                        if ! kubectl -n kafka exec "${target_pod}" -c kafka -- /bin/bash -lc "\
-                          timeout 40 /opt/bitnami/kafka/bin/kafka-configs.sh --bootstrap-server ${target_bootstrap} --command-config /tmp/admin.properties \
-                            --alter --entity-type topics --entity-name '${topic_name}' --add-config '${topic_configs}'
-                        " >/dev/null; then
-                          echo "Kafka topic ${topic_name} config reconcile failed, continue"
-                        fi
-                      fi
-                    done
-                  done

clusters/d8-ugmk-prod/flux-system/gotk-sync.yaml

@@ -1,27 +0,0 @@
-# This manifest was generated by flux. DO NOT EDIT.
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  ref:
-    branch: master
-  secretRef:
-    name: flux-system
-  url: http://10.222.255.165:3000/infra/iac.git
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  path: ./clusters/d8-ugmk-prod
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system

clusters/d8-ugmk-prod/flux-system/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- gotk-components.yaml
-- gotk-sync.yaml

clusters/d8-ugmk-prod/helm-repositories.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: yc-oci-charts
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 10m0s
-  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
-  secretRef:
-    name: yc-cr-auth

clusters/d8-ugmk-prod/istio-ingress/certificate.yaml

@@ -1,17 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: sarex-wildcard
-  namespace: d8-ingress-istio
-spec:
-  commonName: "*.sarex-k8s.uralmine.com"
-  dnsNames:
-    - "*.sarex-k8s.uralmine.com"
-    - "*.uralmine.com"
-  issuerRef:
-    group: cert-manager.io
-    kind: ClusterIssuer
-    name: sarex-selfsigned
-  privateKey:
-    rotationPolicy: Always
-  secretName: istio-ingress-tls

clusters/d8-ugmk-prod/istio-ingress/clusterissuer.yaml

@@ -1,6 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: sarex-selfsigned
-spec:
-  selfSigned: {}

clusters/d8-ugmk-prod/istio-ingress/ingress-controller.yaml

@@ -1,22 +0,0 @@
-apiVersion: deckhouse.io/v1alpha1
-kind: IngressIstioController
-metadata:
-  name: sarex
-spec:
-  ingressGatewayClass: istio
-  inlet: NodePort
-  nodePort:
-    httpPort: 30080
-    httpsPort: 30443
-  nodeSelector:
-    kubernetes.io/hostname: um-sarex-k8s-frontend-01
-  tolerations:
-    - effect: NoExecute
-      key: dedicated.deckhouse.io
-      operator: Equal
-      value: frontend
-  resourcesRequests:
-    mode: Static
-    static:
-      cpu: 100m
-      memory: 128Mi

clusters/d8-ugmk-prod/istio-ingress/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - clusterissuer.yaml
-  - certificate.yaml
-  - ingress-controller.yaml

clusters/d8-ugmk-prod/kustomization.yaml

@@ -1,21 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./flux-system
-  - ./helm-repositories.yaml
-
-
-# infrastructure
-  - ../../infrastructure/kafka/d8-ugmk-prod
-  - ../../infrastructure/rabbitmq/d8-ugmk-prod
-  - ../../infrastructure/camunda/d8-ugmk-prod
-  - ../../infrastructure/vault/d8-ugmk-prod
-  - ../../infrastructure/postgresql/d8-ugmk-prod
-  - ../../infrastructure/zitadel/d8-ugmk-prod
-  - ../../infrastructure/istio-config/d8-ugmk-prod
-  - ./istio-ingress
-  - ./bootstrap-jobs
-
-# apps
-  - ../../apps/attachments/d8-ugmk-prod
-  - ../../apps/control-interface/d8-ugmk-prod

infrastructure/camunda/d8-ugmk-prod/camunda-namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: camunda
-  labels:
-    istio-injection: disabled
-    security.deckhouse.io/pod-policy: privileged

infrastructure/camunda/d8-ugmk-prod/camunda.yaml

@@ -1,327 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: camunda
-  namespace: camunda
-spec:
-  dependsOn: []
-  interval: 5m
-  timeout: 15m
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              namespace: camunda
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: apps
-              version: v1
-              kind: StatefulSet
-              namespace: camunda
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: batch
-              version: v1
-              kind: Job
-              namespace: camunda
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              namespace: camunda
-              name: camunda-connectors
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              namespace: camunda
-              name: camunda-identity
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              namespace: camunda
-              name: camunda-operate
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              namespace: camunda
-              name: camunda-optimize
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              namespace: camunda
-              name: camunda-tasklist
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              namespace: camunda
-              name: camunda-zeebe-gateway
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: apps
-              version: v1
-              kind: StatefulSet
-              namespace: camunda
-              name: camunda-zeebe
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-  values:
-    global:
-      vault:
-        enabled: true
-        role: camunda
-        authPath: auth/kubernetes
-        secrets:
-          postgresql:
-            path: secrets/data/camunda/postgresql
-            keys:
-              password: identity-password
-              postgresPassword: postgres-password
-      image:
-        pullSecrets:
-          - name: regcred
-      identity:
-        auth:
-          publicIssuerUrl: "https://camunda-keycloak.sarex-k8s.uralmine.com/auth/realms/camunda-platform"
-          identity:
-            redirectUrl: "https://camunda-identity.sarex-k8s.uralmine.com"
-          operate:
-            redirectUrl: "https://camunda-operate.sarex-k8s.uralmine.com"
-          tasklist:
-            redirectUrl: "https://camunda-tasklist.sarex-k8s.uralmine.com"
-          optimize:
-            redirectUrl: "https://camunda-optimize.sarex-k8s.uralmine.com"
-          webModeler:
-            redirectUrl: "https://camunda-web-modeler.contour.infra.sarex.tech"
-          console:
-            redirectUrl: "https://camunda-console.contour.infra.sarex.tech"
-    identityPostgresql:
-      enabled: false
-      auth:
-        usePasswordFiles: true
-      primary:
-        automountServiceAccountToken: true
-        persistence:
-          size: 10Gi
-          storageClass: nfs01
-    identityKeycloak:
-      externalDatabase:
-        host: 10.222.255.162
-        port: 5432
-        user: bn_keycloak
-        database: bitnami_keycloak
-        password: ""
-        existingSecret: ""
-        existingSecretPasswordKey: password
-      postgresql:
-        enabled: false
-        auth:
-          usePasswordFiles: true
-        primary:
-          automountServiceAccountToken: true
-          persistence:
-            size: 10Gi
-            storageClass: nfs01
-      vaultEnv:
-        enabled: true
-        role: camunda
-        authPath: auth/kubernetes
-        envFiles:
-          KEYCLOAK_ADMIN_PASSWORD:
-            path: secrets/data/camunda/keycloak-admin
-            key: admin-password
-          KEYCLOAK_PASSWORD:
-            path: secrets/data/camunda/keycloak-admin
-            key: admin-password
-          KEYCLOAK_DATABASE_PASSWORD:
-            path: secrets/data/camunda/postgresql
-            key: keycloak-password
-      global:
-        storageClass: nfs01
-      tolerations: []
-    postgresql:
-      auth:
-        usePasswordFiles: true
-      primary:
-        automountServiceAccountToken: true
-        persistence:
-          size: 10Gi
-          storageClass: nfs01
-    elasticsearch:
-      master:
-        replicaCount: 1
-        podAntiAffinityPreset: soft
-        persistence:
-          size: 10Gi
-          storageClass: nfs01
-        tolerations: []
-      metrics:
-        enabled: false
-        serviceMonitor:
-          enabled: false
-        prometheusRule:
-          enabled: false
-        tolerations: []
-    camundaCanary:
-      enabled: false
-    prometheusServiceMonitor:
-      enabled: false
-    console:
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    zeebe:
-      clusterSize: "1"
-      partitionCount: "1"
-      replicationFactor: "1"
-      pvcStorageClassName: nfs01
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    zeebeGateway:
-      replicas: 1
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    identity:
-      externalDatabase:
-        enabled: true
-        host: 10.222.255.162
-        port: 5432
-        username: identity
-        database: identity
-        password: ""
-        existingSecret: ""
-        existingSecretPasswordKey: password
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    operate:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []
-    tasklist:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []
-    optimize:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []
-    executionIdentity:
-      image:
-        pullSecrets:
-          - name: regcred
-      tolerations: []
-    webModeler:
-      image:
-        pullSecrets:
-          - name: regcred
-      restapi:
-        tolerations: []
-      webapp:
-        tolerations: []
-      websockets:
-        tolerations: []
-    connectors:
-      image:
-        pullSecrets:
-          - name: regcred
-      serviceAccount:
-        automountServiceAccountToken: true
-      tolerations: []

infrastructure/camunda/d8-ugmk-prod/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: camunda.yaml
-  - path: camunda-namespace.yaml

infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml

@@ -1,140 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: istio-config
-  namespace: default
-spec:
-  dependsOn: []
-  interval: 5m
-  timeout: 10m
-  values:
-    global:
-      env: d8-ugmk-prod
-    environments:
-      d8-ugmk-prod:
-        istio:
-          gateways:
-            camunda:
-              name: camunda-gateway
-              namespace: default
-              selector:
-                istio.deckhouse.io/ingress-gateway-class: istio
-              servers:
-                - hosts:
-                    - camunda-keycloak.sarex-k8s.uralmine.com
-                  tls:
-                    credentialName: istio-ingress-tls
-                - hosts:
-                    - camunda-identity.sarex-k8s.uralmine.com
-                  tls:
-                    credentialName: istio-ingress-tls
-                - hosts:
-                    - camunda-operate.sarex-k8s.uralmine.com
-                  tls:
-                    credentialName: istio-ingress-tls
-                - hosts:
-                    - camunda-tasklist.sarex-k8s.uralmine.com
-                  tls:
-                    credentialName: istio-ingress-tls
-                - hosts:
-                    - camunda-optimize.sarex-k8s.uralmine.com
-                  tls:
-                    credentialName: istio-ingress-tls
-            rabbitmq:
-              name: rabbitmq-gateway
-              namespace: default
-              selector:
-                istio.deckhouse.io/ingress-gateway-class: istio
-              servers:
-                - hosts:
-                    - rabbitmq.sarex-k8s.uralmine.com
-                  tls:
-                    credentialName: istio-ingress-tls
-            zitadel:
-              name: zitadel-gateway
-              namespace: default
-              selector:
-                istio.deckhouse.io/ingress-gateway-class: istio
-              servers:
-                - hosts:
-                    - sarex-login.uralmine.com
-                  tls:
-                    credentialName: istio-ingress-tls
-          virtualServices:
-            camunda-keycloak:
-              namespace: default
-              hosts:
-                - camunda-keycloak.sarex-k8s.uralmine.com
-              gateways:
-                - default/camunda-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: camunda-keycloak.camunda.svc.cluster.local
-                  port: 80
-            camunda-identity:
-              namespace: default
-              hosts:
-                - camunda-identity.sarex-k8s.uralmine.com
-              gateways:
-                - default/camunda-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: camunda-identity.camunda.svc.cluster.local
-                  port: 80
-            camunda-operate:
-              namespace: default
-              hosts:
-                - camunda-operate.sarex-k8s.uralmine.com
-              gateways:
-                - default/camunda-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: camunda-operate.camunda.svc.cluster.local
-                  port: 80
-            camunda-tasklist:
-              namespace: default
-              hosts:
-                - camunda-tasklist.sarex-k8s.uralmine.com
-              gateways:
-                - default/camunda-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: camunda-tasklist.camunda.svc.cluster.local
-                  port: 80
-            camunda-optimize:
-              namespace: default
-              hosts:
-                - camunda-optimize.sarex-k8s.uralmine.com
-              gateways:
-                - default/camunda-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: camunda-optimize.camunda.svc.cluster.local
-                  port: 80
-            rabbitmq:
-              namespace: default
-              hosts:
-                - rabbitmq.sarex-k8s.uralmine.com
-              gateways:
-                - default/rabbitmq-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: rabbitmq.rabbitmq.svc.cluster.local
-                  port: 15672
-            zitadel:
-              namespace: default
-              hosts:
-                - sarex-login.uralmine.com
-              gateways:
-                - default/zitadel-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: zitadel-idp-contour.zitadel.svc.cluster.local
-                  port: 8080

infrastructure/istio-config/d8-ugmk-prod/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: istio-config.yaml

infrastructure/kafka/d8-ugmk-prod/kafka-namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kafka
-  labels:
-    istio-injection: disabled
-    security.deckhouse.io/pod-policy: privileged

infrastructure/kafka/d8-ugmk-prod/kafka.yaml

@@ -1,73 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: kafka
-  namespace: kafka
-spec:
-  interval: 5m
-  timeout: 10m
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: StatefulSet
-              namespace: kafka
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-  values:
-    global:
-      imagePullSecrets:
-        - regcred
-      defaultStorageClass: nfs01
-    image:
-      pullSecrets:
-        - regcred
-    controller:
-      replicaCount: 1
-      automountServiceAccountToken: true
-      persistence:
-        size: 8Gi
-        storageClass: nfs01
-      overrideConfiguration:
-        offsets.topic.replication.factor: 1
-        transaction.state.log.replication.factor: 1
-        transaction.state.log.min.isr: 1
-        default.replication.factor: 1
-        min.insync.replicas: 1
-    broker:
-      replicaCount: 0
-      automountServiceAccountToken: true
-    listeners:
-      client:
-        protocol: SASL_SSL
-        sslClientAuth: "none"
-    provisioning:
-      enabled: false
-    sasl:
-      managedExistingSecret:
-        enabled: false
-      existingSecret: ""
-      enabledMechanisms: PLAIN,SCRAM-SHA-512
-      interBrokerMechanism: PLAIN
-      controllerMechanism: PLAIN
-      client:
-        users: []
-        passwords: ""
-    tls:
-      type: PEM
-    vault:
-      enabled: true
-      role: kafka
-      authPath: auth/kubernetes
-      secretPath: secrets/data/kafka/bootstrap
-      clusterIdKey: clusterId
-      interBrokerPasswordKey: interBrokerPassword
-      controllerPasswordKey: controllerPassword

infrastructure/kafka/d8-ugmk-prod/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: kafka.yaml
-  - path: kafka-namespace.yaml

infrastructure/postgresql/d8-ugmk-prod/kustomization.yaml

@@ -1,28 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: postgresql.yaml
-  - patch: |-
-      - op: replace
-        path: /metadata/namespace
-        value: zitadel
-      - op: replace
-        path: /spec/values/primary/nodeSelector
-        value:
-          dedicated: null
-          kubernetes.io/hostname: um-sarex-k8s-master-01
-      - op: replace
-        path: /spec/values/primary/tolerations
-        value:
-          - key: node-role.kubernetes.io/control-plane
-            operator: Exists
-            effect: NoSchedule
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: postgresql
-      namespace: postgresql
-  - path: postgresql-namespace-delete.yaml

infrastructure/postgresql/d8-ugmk-prod/postgresql-namespace-delete.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: postgresql
-$patch: delete

infrastructure/postgresql/d8-ugmk-prod/postgresql.yaml

@@ -1,108 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: postgresql
-  namespace: postgresql
-spec:
-  interval: 5m
-  timeout: 2h
-
-  install:
-    timeout: 2h
-    remediation:
-      retries: 3
-
-  upgrade:
-    timeout: 2h
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      security:
-        allowInsecureImages: true
-      defaultStorageClass: nfs01
-      postgresql:
-        auth:
-          username: ""
-          database: ""
-          secretKeys:
-            userPasswordKey: "postgres-password"
-    auth:
-      username: ""
-      database: ""
-      secretKeys:
-        userPasswordKey: "postgres-password"
-    image:
-      registry: cr.yandex/crp3ccidau046kdj8g9q
-      repository: contour/postgresql
-      tag: 17.0.7
-      pullPolicy: Always
-    metrics:
-      enabled: false
-      prometheusRule:
-        enabled: false
-    primary:
-      automountServiceAccountToken: true
-      containerSecurityContext:
-        readOnlyRootFilesystem: false
-      persistence:
-        storageClass: nfs01
-        size: 20Gi
-      customLivenessProbe:
-        exec:
-          command:
-            - /bin/sh
-            - -c
-            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
-        initialDelaySeconds: 30
-        periodSeconds: 10
-        timeoutSeconds: 5
-        successThreshold: 1
-        failureThreshold: 6
-      customReadinessProbe:
-        exec:
-          command:
-            - /bin/sh
-            - -c
-            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
-        initialDelaySeconds: 5
-        periodSeconds: 10
-        timeoutSeconds: 5
-        successThreshold: 1
-        failureThreshold: 6
-      customStartupProbe:
-        exec:
-          command:
-            - /bin/sh
-            - -c
-            - exec pg_isready -U "postgres" -d postgres -h 127.0.0.1 -p 5432
-        initialDelaySeconds: 30
-        periodSeconds: 10
-        timeoutSeconds: 5
-        successThreshold: 1
-        failureThreshold: 6
-      nodeSelector:
-        dedicated: null
-        node.deckhouse.io/group: generic
-      tolerations:
-        - key: dedicated.deckhouse.io
-          operator: Equal
-          value: generic
-    contour:
-      enabled: true
-      adminUser: "postgres"
-      vault:
-        enabled: true
-        role: postgresql
-        authPath: auth/kubernetes
-        secretPath: secrets/data/postgresql/admin
-        secretKey: postgres-password
-        usersSecretPath: secrets/data/postgresql/users
-      sharedPreloadLibraries: "timescaledb,pg_stat_statements"
-      databases:
-        - name: zitadel
-          user: zitadel
-          passwordKey: zitadel
-          extensions: []
-          restoreFromDump: false

infrastructure/rabbitmq/d8-ugmk-prod/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: rabbitmq.yaml
-  - path: rabbitmq-namespace.yaml

infrastructure/rabbitmq/d8-ugmk-prod/rabbitmq-namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: rabbitmq
-  labels:
-    istio-injection: disabled
-    security.deckhouse.io/pod-policy: privileged

infrastructure/rabbitmq/d8-ugmk-prod/rabbitmq.yaml

@@ -1,97 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: rabbitmq
-  namespace: rabbitmq
-spec:
-  interval: 5m
-  timeout: 10m
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: StatefulSet
-              namespace: rabbitmq
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value: []
-          - target:
-              group: cert-manager.io
-              version: v1
-              kind: Certificate
-              namespace: gateway
-              name: rmq-tls
-            patch: |-
-              $patch: delete
-              apiVersion: cert-manager.io/v1
-              kind: Certificate
-              metadata:
-                name: rmq-tls
-                namespace: gateway
-          - target:
-              group: networking.istio.io
-              version: v1beta1
-              kind: Gateway
-              namespace: gateway
-              name: rmq-gateway
-            patch: |-
-              $patch: delete
-              apiVersion: networking.istio.io/v1beta1
-              kind: Gateway
-              metadata:
-                name: rmq-gateway
-                namespace: gateway
-          - target:
-              group: networking.istio.io
-              version: v1
-              kind: VirtualService
-              namespace: rabbitmq
-              name: rmq-virt-service
-            patch: |-
-              $patch: delete
-              apiVersion: networking.istio.io/v1
-              kind: VirtualService
-              metadata:
-                name: rmq-virt-service
-                namespace: rabbitmq
-  values:
-    global:
-      security:
-        allowInsecureImages: true
-    virtualService: null
-    gateway: null
-    certificate: null
-    metrics:
-      serviceMonitor:
-        enabled: false
-        default:
-          enabled: false
-        perObject:
-          enabled: false
-        detailed:
-          enabled: false
-    extraServiceMonitors: []
-    replicaCount: 1
-    resources:
-      requests:
-        memory: 1Gi
-    persistence:
-      storageClass: nfs01
-      size: 10Gi
-    auth:
-      securePassword: true
-      existingPasswordSecret: ""
-      vault:
-        enabled: true
-        role: rabbitmq
-        authPath: auth/kubernetes
-        secretPath: secrets/data/rabbitmq/auth
-        usernameKey: username
-        passwordKey: password

infrastructure/vault/d8-ugmk-prod/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: vault.yaml
-  - path: vault-namespace.yaml

infrastructure/vault/d8-ugmk-prod/vault-namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: vault
-  labels:
-    istio-injection: disabled
-    security.deckhouse.io/pod-policy: privileged

infrastructure/vault/d8-ugmk-prod/vault.yaml

@@ -1,40 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: vault
-  namespace: vault
-spec:
-  interval: 5m
-  timeout: 10m
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: StatefulSet
-              namespace: vault
-              name: vault-vault-contour
-            patch: |-
-              - op: replace
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: replace
-                path: /spec/template/spec/tolerations
-                value: []
-  values:
-    imagePullSecrets:
-      - name: regcred
-    backup:
-      enabled: false
-    injector:
-      nodeSelector:
-        node.deckhouse.io/group: generic
-      tolerations: []
-    server:
-      nodeSelector:
-        node.deckhouse.io/group: generic
-      tolerations: []
-      dataStorage:
-        storageClass: nfs01

infrastructure/zitadel/d8-ugmk-prod/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: zitadel.yaml
-  - path: zitadel-namespace.yaml

infrastructure/zitadel/d8-ugmk-prod/zitadel-namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: zitadel
-  labels:
-    istio-injection: disabled

infrastructure/zitadel/d8-ugmk-prod/zitadel.yaml

@@ -1,166 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: zitadel
-  namespace: zitadel
-spec:
-  interval: 5m
-  timeout: 10m
-  dependsOn:
-    - name: postgresql
-      namespace: zitadel
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              group: apps
-              version: v1
-              kind: Deployment
-              name: zitadel-idp-contour
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated.deckhouse.io
-                    operator: Equal
-                    value: generic
-              - op: replace
-                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
-                value: |-
-                  {{- with secret "secrets/data/zitadel/postgresql" -}}
-                  Database:
-                    postgres:
-                      User:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                      Admin:
-                        Password: |-
-                          {{ index .Data.data "adminPassword" }}
-                  FirstInstance:
-                    Org:
-                      Human:
-                        Password: |-
-                          {{ index .Data.data "humanPassword" }}
-                  {{- end -}}
-          - target:
-              group: batch
-              version: v1
-              kind: Job
-              name: zitadel-idp-contour-init
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated.deckhouse.io
-                    operator: Equal
-                    value: generic
-              - op: replace
-                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
-                value: |-
-                  {{- with secret "secrets/data/zitadel/postgresql" -}}
-                  Database:
-                    postgres:
-                      User:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                      Admin:
-                        Password: |-
-                          {{ index .Data.data "adminPassword" }}
-                  FirstInstance:
-                    Org:
-                      Human:
-                        Password: |-
-                          {{ index .Data.data "humanPassword" }}
-                  {{- end -}}
-          - target:
-              group: batch
-              version: v1
-              kind: Job
-              name: zitadel-idp-contour-setup
-            patch: |-
-              - op: add
-                path: /spec/template/spec/nodeSelector
-                value:
-                  node.deckhouse.io/group: generic
-              - op: add
-                path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated.deckhouse.io
-                    operator: Equal
-                    value: generic
-              - op: replace
-                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
-                value: |-
-                  {{- with secret "secrets/data/zitadel/postgresql" -}}
-                  Database:
-                    postgres:
-                      User:
-                        Password: |-
-                          {{ index .Data.data "password" }}
-                      Admin:
-                        Password: |-
-                          {{ index .Data.data "adminPassword" }}
-                  FirstInstance:
-                    Org:
-                      Human:
-                        Password: |-
-                          {{ index .Data.data "humanPassword" }}
-                  {{- end -}}
-  values:
-    zitadel:
-      configmapConfig:
-        ExternalDomain: sarex-login.uralmine.com
-        ExternalSecure: true
-      debug:
-        enabled: false
-    postgresqlSecret:
-      create: false
-      vault:
-        enabled: true
-        role: zitadel
-        authPath: auth/kubernetes
-        secretPath: secrets/data/zitadel/postgresql
-        secretKey: password
-        kvVersion: 2
-        fileName: zitadel-vault-config.yaml
-    serviceAccount:
-      create: true
-      name: zitadel
-    replicaCount: 1
-    pdb:
-      enabled: false
-    env:
-      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
-        value: "false"
-      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
-        value: "bcrypt,pbkdf2"
-      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
-        value: "true"
-      - name: ZITADEL_DATABASE_POSTGRES_HOST
-        value: "postgresql.zitadel.svc.cluster.local"
-      - name: ZITADEL_DATABASE_POSTGRES_PORT
-        value: "5432"
-      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
-        value: "zitadel"
-      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
-        value: "disable"
-      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
-        value: "disable"
-      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
-        value: "zitadel-admin"
-      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
-        value: "Sarex"