++ vk prod rabbitmq kafka

clusters/vk-prod/infrastructure/kustomization.yaml

@@ -5,3 +5,5 @@ resources:
   - ../../../infrastructure/istio-pilot/vk-prod
   - ../../../infrastructure/istio-gateway/vk-prod
   - ../../../infrastructure/gitlab-runner/vk-prod
+  - ../../../infrastructure/rabbitmq/vk-prod
+  - ../../../infrastructure/kafka/vk-prod

infrastructure/kafka/vk-prod/kafka-namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kafka
+  labels:
+    istio-injection: disabled

infrastructure/kafka/vk-prod/kafka.yaml

@@ -0,0 +1,72 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kafka
+  namespace: kafka
+spec:
+  interval: 5m
+  timeout: 15m
+  values:
+    global:
+      imagePullSecrets:
+        - regcred
+      defaultStorageClass: csi-ceph-ssd-retain
+    image:
+      pullSecrets:
+        - regcred
+    controller:
+      replicaCount: 3
+      automountServiceAccountToken: true
+      podAntiAffinityPreset: hard
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: kafka-contour
+              app.kubernetes.io/instance: kafka
+              app.kubernetes.io/component: controller-eligible
+      resources:
+        requests:
+          cpu: "1"
+          memory: 4Gi
+        limits:
+          memory: 6Gi
+      persistence:
+        size: 200Gi
+        storageClass: csi-ceph-ssd-retain
+      overrideConfiguration:
+        authorizer.class.name: org.apache.kafka.metadata.authorizer.StandardAuthorizer
+        allow.everyone.if.no.acl.found: false
+        super.users: User:controller_user;User:inter_broker_user
+        offsets.topic.replication.factor: 3
+        transaction.state.log.replication.factor: 3
+        transaction.state.log.min.isr: 2
+        default.replication.factor: 3
+        min.insync.replicas: 2
+        unclean.leader.election.enable: false
+        auto.create.topics.enable: false
+    broker:
+      replicaCount: 0
+      automountServiceAccountToken: true
+    listeners:
+      client:
+        protocol: SASL_PLAINTEXT
+        sslClientAuth: ""
+    provisioning:
+      enabled: false
+    sasl:
+      managedExistingSecret:
+        enabled: false
+      existingSecret: kafka-sasl
+      enabledMechanisms: PLAIN,SCRAM-SHA-512
+      interBrokerMechanism: PLAIN
+      controllerMechanism: PLAIN
+      client:
+        users: []
+        passwords: ""
+    tls:
+      type: PEM
+    vault:
+      enabled: false

infrastructure/kafka/vk-prod/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: kafka.yaml
+  - path: kafka-namespace.yaml

infrastructure/rabbitmq/vk-prod/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: rabbitmq.yaml
+  - path: rabbitmq-namespace.yaml

infrastructure/rabbitmq/vk-prod/rabbitmq-namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: rabbitmq
+  labels:
+    istio-injection: disabled

infrastructure/rabbitmq/vk-prod/rabbitmq.yaml

@@ -0,0 +1,94 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rabbitmq
+  namespace: rabbitmq
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: cert-manager.io
+              version: v1
+              kind: Certificate
+              namespace: gateway
+              name: rmq-tls
+            patch: |-
+              $patch: delete
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: rmq-tls
+                namespace: gateway
+          - target:
+              group: networking.istio.io
+              version: v1beta1
+              kind: Gateway
+              namespace: gateway
+              name: rmq-gateway
+            patch: |-
+              $patch: delete
+              apiVersion: networking.istio.io/v1beta1
+              kind: Gateway
+              metadata:
+                name: rmq-gateway
+                namespace: gateway
+          - target:
+              group: networking.istio.io
+              version: v1
+              kind: VirtualService
+              namespace: rabbitmq
+              name: rmq-virt-service
+            patch: |-
+              $patch: delete
+              apiVersion: networking.istio.io/v1
+              kind: VirtualService
+              metadata:
+                name: rmq-virt-service
+                namespace: rabbitmq
+  values:
+    global:
+      security:
+        allowInsecureImages: true
+    virtualService: null
+    gateway: null
+    certificate: null
+    metrics:
+      serviceMonitor:
+        enabled: false
+        default:
+          enabled: false
+        perObject:
+          enabled: false
+        detailed:
+          enabled: false
+    extraServiceMonitors: []
+    replicaCount: 3
+    podAntiAffinityPreset: hard
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: rabbitmq-contour
+            app.kubernetes.io/instance: rabbitmq
+    resources:
+      requests:
+        cpu: 500m
+        memory: 2Gi
+      limits:
+        memory: 3Gi
+    persistence:
+      storageClass: csi-ceph-ssd-retain
+      size: 30Gi
+    auth:
+      securePassword: true
+      existingPasswordSecret: rabbitmq-admin
+      existingSecretPasswordKey: rabbitmq-password
+      existingErlangSecret: rabbitmq-erlang
+    extraConfiguration: |-
+      default_queue_type = quorum
+      cluster_partition_handling = pause_minority