diff --git a/clusters/vk-infra/infrastructure/kustomization.yaml b/clusters/vk-infra/infrastructure/kustomization.yaml index d095b2d..f5c5395 100644 --- a/clusters/vk-infra/infrastructure/kustomization.yaml +++ b/clusters/vk-infra/infrastructure/kustomization.yaml @@ -7,3 +7,7 @@ resources: - ../../../infrastructure/cert-manager/vk-infra - ../../../infrastructure/istio-config/vk-infra - ../../../infrastructure/zitadel/vk-infra + - ../../../infrastructure/vault-unseal/vk-infra + - ../../../infrastructure/vault/vk-infra + - ../../../infrastructure/kb/vk-infra + - ../../../infrastructure/gitlab-runner/vk-infra diff --git a/infrastructure/gitlab-runner/vk-infra/gitlab-runner.yaml b/infrastructure/gitlab-runner/vk-infra/gitlab-runner.yaml new file mode 100644 index 0000000..b020997 --- /dev/null +++ b/infrastructure/gitlab-runner/vk-infra/gitlab-runner.yaml @@ -0,0 +1,79 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: gitlab-runner + namespace: gitlab-managed-apps +spec: + interval: 10m + timeout: 10m + chart: + spec: + chart: gitlab-runner-infra + version: "17.5.3" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + gitlabUrl: https://gitlab.sarex.io + concurrent: 20 + checkInterval: 10 + unregisterRunners: true + terminationGracePeriodSeconds: 3600 + image: + registry: cr.yandex/crp3ccidau046kdj8g9q + image: mirror/gitlab-runner + imagePullSecrets: + - name: istio-registry-secret + nodeSelector: + sarex.io/pool: svc + rbac: + create: true + clusterWideAccess: false + serviceAccount: + create: true + podSecurityContext: + fsGroup: 65533 + runAsUser: 100 + metrics: + enabled: false + runners: + secret: gitlab-runner-secret + executor: kubernetes + cache: {} + config: | + [[runners]] + [runners.kubernetes] + namespace = "{{.Release.Namespace}}" + image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/docker:24.0.5" + helper_image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/gitlab-runner-helper:x86_64-v17.5.3" + image_pull_secrets = ["istio-registry-secret"] + poll_interval = 10 + poll_timeout = 600 + privileged = true + tls_verify = false + cpu_request = "0.1" + cpu_limit = "3" + memory_request = "128Mi" + memory_limit = "3Gi" + helper_cpu_request = "0.05" + helper_cpu_limit = "3" + helper_memory_request = "32Mi" + helper_memory_limit = "10Gi" + service_cpu_request = "0.5" + service_cpu_limit = "3" + service_memory_request = "3Gi" + + [runners.feature_flags] + FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY = false + [runners.kubernetes.node_selector] + "sarex.io/pool" = "runners" + [runners.kubernetes.node_tolerations] + "sarex.io/pool=runners" = "NoSchedule" diff --git a/infrastructure/gitlab-runner/vk-infra/kustomization.yaml b/infrastructure/gitlab-runner/vk-infra/kustomization.yaml new file mode 100644 index 0000000..fa82e31 --- /dev/null +++ b/infrastructure/gitlab-runner/vk-infra/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - gitlab-runner.yaml diff --git a/infrastructure/gitlab-runner/vk-infra/namespace.yaml b/infrastructure/gitlab-runner/vk-infra/namespace.yaml new file mode 100644 index 0000000..89abf76 --- /dev/null +++ b/infrastructure/gitlab-runner/vk-infra/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: gitlab-managed-apps diff --git a/infrastructure/istio-config/vk-infra/istio-config.yaml b/infrastructure/istio-config/vk-infra/istio-config.yaml index 8dba9b1..f96809b 100644 --- a/infrastructure/istio-config/vk-infra/istio-config.yaml +++ b/infrastructure/istio-config/vk-infra/istio-config.yaml @@ -36,6 +36,28 @@ spec: imagePullSecrets: - name: istio-registry-secret certificates: + vault-tls: + dnsNames: + - vault.infra.sarex.tech + issuerRef: + name: letsencrypt-issuer-istio + kind: ClusterIssuer + spec: + duration: 2160h0m0s + renewBefore: 360h0m0s + privateKey: + rotationPolicy: Always + kb-tls: + dnsNames: + - kb.infra.sarex.tech + issuerRef: + name: letsencrypt-issuer-istio + kind: ClusterIssuer + spec: + duration: 2160h0m0s + renewBefore: 360h0m0s + privateKey: + rotationPolicy: Always idp-tls: dnsNames: - iam.sarex.io @@ -49,6 +71,28 @@ spec: rotationPolicy: Always istio: gateways: + vault: + name: vault-gateway + namespace: istio-system + selector: + istio: ingressgateway + servers: + - hosts: + - vault.infra.sarex.tech + tls: + credentialName: vault-tls + mode: SIMPLE + kb: + name: kb-gateway + namespace: istio-system + selector: + istio: ingressgateway + servers: + - hosts: + - kb.infra.sarex.tech + tls: + credentialName: kb-tls + mode: SIMPLE idp: name: idp-gateway namespace: istio-system @@ -61,6 +105,28 @@ spec: credentialName: idp-tls mode: SIMPLE virtualServices: + vault-virt-service: + namespace: istio-system + hosts: + - vault.infra.sarex.tech + gateways: + - istio-system/vault-gateway + routes: + - path: + prefix: / + service: vault-vault-contour-active.vault.svc.cluster.local + port: 8200 + kb-virt-service: + namespace: istio-system + hosts: + - kb.infra.sarex.tech + gateways: + - istio-system/kb-gateway + routes: + - path: + prefix: / + service: kb-service.kb.svc.cluster.local + port: 80 idp-virt-service: namespace: istio-system hosts: diff --git a/infrastructure/kb/vk-infra/kb.yaml b/infrastructure/kb/vk-infra/kb.yaml new file mode 100644 index 0000000..7400503 --- /dev/null +++ b/infrastructure/kb/vk-infra/kb.yaml @@ -0,0 +1,36 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kb + namespace: kb +spec: + interval: 10m + timeout: 10m + chart: + spec: + chart: kb + version: "0.0.1-infra" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + dependsOn: + - name: istiod + namespace: istio-system + values: + universal-chart: + global: + env: infra + image: + name: + infra: cr.yandex/crp3ccidau046kdj8g9q/kb:infra_a27f6dd0 + imagePullSecrets: + name: + _default: istio-registry-secret diff --git a/infrastructure/kb/vk-infra/kustomization.yaml b/infrastructure/kb/vk-infra/kustomization.yaml new file mode 100644 index 0000000..56f7ced --- /dev/null +++ b/infrastructure/kb/vk-infra/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - kb.yaml diff --git a/infrastructure/kb/vk-infra/namespace.yaml b/infrastructure/kb/vk-infra/namespace.yaml new file mode 100644 index 0000000..786c26c --- /dev/null +++ b/infrastructure/kb/vk-infra/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: kb + labels: + istio-injection: enabled diff --git a/infrastructure/vault-unseal/vk-infra/kustomization.yaml b/infrastructure/vault-unseal/vk-infra/kustomization.yaml new file mode 100644 index 0000000..b0935c5 --- /dev/null +++ b/infrastructure/vault-unseal/vk-infra/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - vault-unseal.yaml diff --git a/infrastructure/vault-unseal/vk-infra/namespace.yaml b/infrastructure/vault-unseal/vk-infra/namespace.yaml new file mode 100644 index 0000000..1ed2ce1 --- /dev/null +++ b/infrastructure/vault-unseal/vk-infra/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: vault-unseal + labels: + istio-injection: enabled diff --git a/infrastructure/vault-unseal/vk-infra/vault-unseal.yaml b/infrastructure/vault-unseal/vk-infra/vault-unseal.yaml new file mode 100644 index 0000000..f5527b8 --- /dev/null +++ b/infrastructure/vault-unseal/vk-infra/vault-unseal.yaml @@ -0,0 +1,97 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: vault-unseal + namespace: vault-unseal +spec: + interval: 5m + timeout: 15m + chart: + spec: + chart: vault-contour + version: "0.2.3" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + disableWait: true + remediation: + retries: 3 + upgrade: + disableWait: true + remediation: + retries: 3 + values: + global: + namespace: vault-unseal + imagePullSecrets: + - name: istio-registry-secret + autounseal: + enabled: false + backup: + enabled: false + injector: + enabled: false + server: + includeConfigAnnotation: true + nodeSelector: + dedicated: null + sarex.io/pool: svc + tolerations: [] + affinity: | + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app.kubernetes.io/name: {{ template "vault.name" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + component: server + topologyKey: topology.kubernetes.io/zone + dataStorage: + size: 10Gi + storageClass: csi-ceph-ssd-retain + ha: + replicas: 3 + raft: + config: | + ui = true + + listener "tcp" { + tls_disable = 1 + address = "[::]:8200" + cluster_address = "[::]:8201" + } + + storage "raft" { + path = "/vault/data" + + retry_join { + leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200" + } + retry_join { + leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200" + } + retry_join { + leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200" + } + } + + {{- if .Values.autounseal.enabled }} + seal "transit" { + address = "{{ .Values.autounseal.transit.address }}" + token = "env://VAULT_TOKEN" + key_name = "{{ .Values.autounseal.transit.keyName }}" + mount_path = "{{ .Values.autounseal.transit.mountPath }}" + disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}" + tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}" + } + {{- end }} + + service_registration "kubernetes" {} + + telemetry { + prometheus_retention_time = "30s" + disable_hostname = true + } diff --git a/infrastructure/vault/vk-infra/kustomization.yaml b/infrastructure/vault/vk-infra/kustomization.yaml new file mode 100644 index 0000000..4aa28e3 --- /dev/null +++ b/infrastructure/vault/vk-infra/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - vault.yaml diff --git a/infrastructure/vault/vk-infra/namespace.yaml b/infrastructure/vault/vk-infra/namespace.yaml new file mode 100644 index 0000000..77ee9e7 --- /dev/null +++ b/infrastructure/vault/vk-infra/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: vault + labels: + istio-injection: enabled diff --git a/infrastructure/vault/vk-infra/vault.yaml b/infrastructure/vault/vk-infra/vault.yaml new file mode 100644 index 0000000..126ea5f --- /dev/null +++ b/infrastructure/vault/vk-infra/vault.yaml @@ -0,0 +1,106 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: vault + namespace: vault +spec: + interval: 5m + timeout: 15m + chart: + spec: + chart: vault-contour + version: "0.2.3" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + dependsOn: + - name: vault-unseal + namespace: vault-unseal + install: + disableWait: true + remediation: + retries: 3 + upgrade: + disableWait: true + remediation: + retries: 3 + values: + global: + namespace: vault + imagePullSecrets: + - name: istio-registry-secret + autounseal: + enabled: true + transit: + address: "http://vault-unseal-vault-contour.vault-unseal.svc:8200" + keyName: "vault-infra-vk" + mountPath: "transit/" + tlsSkipVerify: false + secret: + create: false + name: "vault-transit-autounseal" + backup: + enabled: false + server: + includeConfigAnnotation: true + nodeSelector: + dedicated: null + sarex.io/pool: svc + tolerations: [] + affinity: | + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app.kubernetes.io/name: {{ template "vault.name" . }} + app.kubernetes.io/instance: "{{ .Release.Name }}" + component: server + topologyKey: topology.kubernetes.io/zone + dataStorage: + size: 20Gi + storageClass: csi-ceph-ssd-retain + ha: + replicas: 3 + raft: + config: | + ui = true + + listener "tcp" { + tls_disable = 1 + address = "[::]:8200" + cluster_address = "[::]:8201" + } + + storage "raft" { + path = "/vault/data" + + retry_join { + leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200" + } + retry_join { + leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200" + } + retry_join { + leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200" + } + } + + {{- if .Values.autounseal.enabled }} + seal "transit" { + address = "{{ .Values.autounseal.transit.address }}" + token = "env://VAULT_TOKEN" + key_name = "{{ .Values.autounseal.transit.keyName }}" + mount_path = "{{ .Values.autounseal.transit.mountPath }}" + disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}" + tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}" + } + {{- end }} + + service_registration "kubernetes" {} + + telemetry { + prometheus_retention_time = "30s" + disable_hostname = true + }