Add Kubernetes Dashboard configuration to yc-ecp: define HelmRelease, update Istio Gateway and VirtualService, and include in cluster Kustomization

clusters/yc-ecp/kustomization.yaml

@@ -7,4 +7,5 @@ resources:
 # infrastructure
   - ../../infrastructure/cert-manager/yc-ecp
   - ../../infrastructure/istio-config/yc-ecp
+  - ../../infrastructure/dashboard/yc-ecp
   - ../../infrastructure/vault/yc-ecp

infrastructure/dashboard/yc-ecp/dashboard.yaml

@@ -0,0 +1,29 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: dashboard
+  namespace: kubernetes-dashboard
+spec:
+  # istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod
+  # в кластере нет — с зависимостями из base релиз никогда не станет Ready
+  dependsOn: []
+  interval: 5m
+  timeout: 10m
+  values:
+    destinationRule:
+      enabled: true
+      host: "dashboard-kong-proxy"
+      tlsMode: "DISABLE"
+    # Gateway, Certificate и VirtualService описаны в istio-config
+    virtualService:
+      enabled: false
+    gateway:
+      enabled: false
+    app:
+      image:
+        pullSecrets:
+          - dockerhub
+    kong:
+      image:
+        pullSecrets:
+          - dockerhub

infrastructure/dashboard/yc-ecp/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: dashboard.yaml

infrastructure/istio-config/yc-ecp/istio-config.yaml

@@ -51,6 +51,14 @@ spec:
               issuerRef:
                 name: letsencrypt-prod
                 kind: ClusterIssuer
+            dashboard-cert:
+              namespace: istio-system
+              secretName: dashboard-tls
+              dnsNames:
+                - dashboard.invest.cps.sarex.lonsdaleites.ru
+              issuerRef:
+                name: letsencrypt-prod
+                kind: ClusterIssuer
         istio:
           gateways:
             gitea:
@@ -73,6 +81,16 @@ spec:
                   httpsPortName: https
                   tls:
                     credentialName: vault-tls
+            dashboard:
+              name: dashboard-gateway
+              namespace: gateway
+              servers:
+                - hosts:
+                    - dashboard.invest.cps.sarex.lonsdaleites.ru
+                  httpPortName: http
+                  httpsPortName: https
+                  tls:
+                    credentialName: dashboard-tls
           # имя VirtualService = ключ, поле name чарт игнорирует.
           # noCors: чарт иначе навешивает corsPolicy с дефолтными origins sarex.io
           virtualServices:
@@ -100,3 +118,15 @@ spec:
                     prefix: /
                   service: vault-vault-contour.vault.svc.cluster.local
                   port: 8200
+            dashboard-virt-service:
+              namespace: kubernetes-dashboard
+              noCors: true
+              hosts:
+                - dashboard.invest.cps.sarex.lonsdaleites.ru
+              gateways:
+                - gateway/dashboard-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local
+                  port: 80