++ vk infra vault kb runner

clusters/vk-infra/infrastructure/kustomization.yaml

@@ -7,3 +7,7 @@ resources:
   - ../../../infrastructure/cert-manager/vk-infra
   - ../../../infrastructure/istio-config/vk-infra
   - ../../../infrastructure/zitadel/vk-infra
+  - ../../../infrastructure/vault-unseal/vk-infra
+  - ../../../infrastructure/vault/vk-infra
+  - ../../../infrastructure/kb/vk-infra
+  - ../../../infrastructure/gitlab-runner/vk-infra

infrastructure/gitlab-runner/vk-infra/gitlab-runner.yaml

@@ -0,0 +1,79 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitlab-runner
+  namespace: gitlab-managed-apps
+spec:
+  interval: 10m
+  timeout: 10m
+  chart:
+    spec:
+      chart: gitlab-runner-infra
+      version: "17.5.3"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    gitlabUrl: https://gitlab.sarex.io
+    concurrent: 20
+    checkInterval: 10
+    unregisterRunners: true
+    terminationGracePeriodSeconds: 3600
+    image:
+      registry: cr.yandex/crp3ccidau046kdj8g9q
+      image: mirror/gitlab-runner
+    imagePullSecrets:
+      - name: istio-registry-secret
+    nodeSelector:
+      sarex.io/pool: svc
+    rbac:
+      create: true
+      clusterWideAccess: false
+    serviceAccount:
+      create: true
+    podSecurityContext:
+      fsGroup: 65533
+      runAsUser: 100
+    metrics:
+      enabled: false
+    runners:
+      secret: gitlab-runner-secret
+      executor: kubernetes
+      cache: {}
+      config: |
+        [[runners]]
+          [runners.kubernetes]
+            namespace = "{{.Release.Namespace}}"
+            image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/docker:24.0.5"
+            helper_image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/gitlab-runner-helper:x86_64-v17.5.3"
+            image_pull_secrets = ["istio-registry-secret"]
+            poll_interval = 10
+            poll_timeout = 600
+            privileged = true
+            tls_verify = false
+            cpu_request = "0.1"
+            cpu_limit = "3"
+            memory_request = "128Mi"
+            memory_limit = "3Gi"
+            helper_cpu_request = "0.05"
+            helper_cpu_limit = "3"
+            helper_memory_request = "32Mi"
+            helper_memory_limit = "10Gi"
+            service_cpu_request = "0.5"
+            service_cpu_limit = "3"
+            service_memory_request = "3Gi"
+
+            [runners.feature_flags]
+              FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY = false
+            [runners.kubernetes.node_selector]
+              "sarex.io/pool" = "runners"
+            [runners.kubernetes.node_tolerations]
+              "sarex.io/pool=runners" = "NoSchedule"

infrastructure/gitlab-runner/vk-infra/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - gitlab-runner.yaml

infrastructure/gitlab-runner/vk-infra/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitlab-managed-apps

infrastructure/istio-config/vk-infra/istio-config.yaml

@@ -36,6 +36,28 @@ spec:
                               imagePullSecrets:
                                 - name: istio-registry-secret
           certificates:
+            vault-tls:
+              dnsNames:
+                - vault.infra.sarex.tech
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              spec:
+                duration: 2160h0m0s
+                renewBefore: 360h0m0s
+                privateKey:
+                  rotationPolicy: Always
+            kb-tls:
+              dnsNames:
+                - kb.infra.sarex.tech
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              spec:
+                duration: 2160h0m0s
+                renewBefore: 360h0m0s
+                privateKey:
+                  rotationPolicy: Always
             idp-tls:
               dnsNames:
                 - iam.sarex.io
@@ -49,6 +71,28 @@ spec:
                   rotationPolicy: Always
         istio:
           gateways:
+            vault:
+              name: vault-gateway
+              namespace: istio-system
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - vault.infra.sarex.tech
+                  tls:
+                    credentialName: vault-tls
+                    mode: SIMPLE
+            kb:
+              name: kb-gateway
+              namespace: istio-system
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - kb.infra.sarex.tech
+                  tls:
+                    credentialName: kb-tls
+                    mode: SIMPLE
             idp:
               name: idp-gateway
               namespace: istio-system
@@ -61,6 +105,28 @@ spec:
                     credentialName: idp-tls
                     mode: SIMPLE
           virtualServices:
+            vault-virt-service:
+              namespace: istio-system
+              hosts:
+                - vault.infra.sarex.tech
+              gateways:
+                - istio-system/vault-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: vault-vault-contour-active.vault.svc.cluster.local
+                  port: 8200
+            kb-virt-service:
+              namespace: istio-system
+              hosts:
+                - kb.infra.sarex.tech
+              gateways:
+                - istio-system/kb-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: kb-service.kb.svc.cluster.local
+                  port: 80
             idp-virt-service:
               namespace: istio-system
               hosts:

infrastructure/kb/vk-infra/kb.yaml

@@ -0,0 +1,36 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kb
+  namespace: kb
+spec:
+  interval: 10m
+  timeout: 10m
+  chart:
+    spec:
+      chart: kb
+      version: "0.0.1-infra"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  dependsOn:
+    - name: istiod
+      namespace: istio-system
+  values:
+    universal-chart:
+      global:
+        env: infra
+      image:
+        name:
+          infra: cr.yandex/crp3ccidau046kdj8g9q/kb:infra_a27f6dd0
+      imagePullSecrets:
+        name:
+          _default: istio-registry-secret

infrastructure/kb/vk-infra/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - kb.yaml

infrastructure/kb/vk-infra/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kb
+  labels:
+    istio-injection: enabled

infrastructure/vault-unseal/vk-infra/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - vault-unseal.yaml

infrastructure/vault-unseal/vk-infra/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vault-unseal
+  labels:
+    istio-injection: enabled

infrastructure/vault-unseal/vk-infra/vault-unseal.yaml

@@ -0,0 +1,97 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault-unseal
+  namespace: vault-unseal
+spec:
+  interval: 5m
+  timeout: 15m
+  chart:
+    spec:
+      chart: vault-contour
+      version: "0.2.3"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    disableWait: true
+    remediation:
+      retries: 3
+  upgrade:
+    disableWait: true
+    remediation:
+      retries: 3
+  values:
+    global:
+      namespace: vault-unseal
+      imagePullSecrets:
+        - name: istio-registry-secret
+    autounseal:
+      enabled: false
+    backup:
+      enabled: false
+    injector:
+      enabled: false
+    server:
+      includeConfigAnnotation: true
+      nodeSelector:
+        dedicated: null
+        sarex.io/pool: svc
+      tolerations: []
+      affinity: |
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: {{ template "vault.name" . }}
+                  app.kubernetes.io/instance: "{{ .Release.Name }}"
+                  component: server
+              topologyKey: topology.kubernetes.io/zone
+      dataStorage:
+        size: 10Gi
+        storageClass: csi-ceph-ssd-retain
+      ha:
+        replicas: 3
+        raft:
+          config: |
+            ui = true
+
+            listener "tcp" {
+              tls_disable = 1
+              address = "[::]:8200"
+              cluster_address = "[::]:8201"
+            }
+
+            storage "raft" {
+              path = "/vault/data"
+
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
+              }
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
+              }
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
+              }
+            }
+
+            {{- if .Values.autounseal.enabled }}
+            seal "transit" {
+              address         = "{{ .Values.autounseal.transit.address }}"
+              token           = "env://VAULT_TOKEN"
+              key_name        = "{{ .Values.autounseal.transit.keyName }}"
+              mount_path      = "{{ .Values.autounseal.transit.mountPath }}"
+              disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
+              tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
+            }
+            {{- end }}
+
+            service_registration "kubernetes" {}
+
+            telemetry {
+              prometheus_retention_time = "30s"
+              disable_hostname = true
+            }

infrastructure/vault/vk-infra/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - vault.yaml

infrastructure/vault/vk-infra/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vault
+  labels:
+    istio-injection: enabled

infrastructure/vault/vk-infra/vault.yaml

@@ -0,0 +1,106 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault
+  namespace: vault
+spec:
+  interval: 5m
+  timeout: 15m
+  chart:
+    spec:
+      chart: vault-contour
+      version: "0.2.3"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  dependsOn:
+    - name: vault-unseal
+      namespace: vault-unseal
+  install:
+    disableWait: true
+    remediation:
+      retries: 3
+  upgrade:
+    disableWait: true
+    remediation:
+      retries: 3
+  values:
+    global:
+      namespace: vault
+      imagePullSecrets:
+        - name: istio-registry-secret
+    autounseal:
+      enabled: true
+      transit:
+        address: "http://vault-unseal-vault-contour.vault-unseal.svc:8200"
+        keyName: "vault-infra-vk"
+        mountPath: "transit/"
+        tlsSkipVerify: false
+      secret:
+        create: false
+        name: "vault-transit-autounseal"
+    backup:
+      enabled: false
+    server:
+      includeConfigAnnotation: true
+      nodeSelector:
+        dedicated: null
+        sarex.io/pool: svc
+      tolerations: []
+      affinity: |
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: {{ template "vault.name" . }}
+                  app.kubernetes.io/instance: "{{ .Release.Name }}"
+                  component: server
+              topologyKey: topology.kubernetes.io/zone
+      dataStorage:
+        size: 20Gi
+        storageClass: csi-ceph-ssd-retain
+      ha:
+        replicas: 3
+        raft:
+          config: |
+            ui = true
+
+            listener "tcp" {
+              tls_disable = 1
+              address = "[::]:8200"
+              cluster_address = "[::]:8201"
+            }
+
+            storage "raft" {
+              path = "/vault/data"
+
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
+              }
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
+              }
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
+              }
+            }
+
+            {{- if .Values.autounseal.enabled }}
+            seal "transit" {
+              address         = "{{ .Values.autounseal.transit.address }}"
+              token           = "env://VAULT_TOKEN"
+              key_name        = "{{ .Values.autounseal.transit.keyName }}"
+              mount_path      = "{{ .Values.autounseal.transit.mountPath }}"
+              disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
+              tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
+            }
+            {{- end }}
+
+            service_registration "kubernetes" {}
+
+            telemetry {
+              prometheus_retention_time = "30s"
+              disable_hostname = true
+            }