++ vk prod istio

clusters/vk-prod/helm-repositories.yaml

@@ -0,0 +1,11 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: yc-oci-charts
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 10m0s
+  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
+  secretRef:
+    name: yc-cr-auth

clusters/vk-prod/infrastructure/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-base/vk-prod
+  - ../../../infrastructure/istio-pilot/vk-prod
+  - ../../../infrastructure/istio-gateway/vk-prod

clusters/vk-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./flux-system
+  - ./helm-repositories.yaml
+  - ./infrastructure

infrastructure/istio-base/vk-prod/istio-base.yaml

@@ -0,0 +1,14 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-base
+  namespace: istio-system
+spec:
+  chart:
+    spec:
+      chart: base-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system

infrastructure/istio-base/vk-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./istio-base.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istio-base
+      namespace: istio-system

infrastructure/istio-gateway/vk-prod/ingressgateway-me1.yaml

@@ -0,0 +1,42 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway-me1
+  namespace: istio-system
+spec:
+  interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  chart:
+    spec:
+      chart: gateway-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    name: istio-ingressgateway-me1
+    labels:
+      app: istio-ingressgateway
+      istio: ingressgateway
+    replicaCount: 1
+    autoscaling:
+      enabled: false
+    nodeSelector:
+      topology.kubernetes.io/zone: ME1
+    imagePullSecrets:
+      - name: istio-registry-secret
+    service:
+      type: ClusterIP
+      externalTrafficPolicy: ""

infrastructure/istio-gateway/vk-prod/ingressgateway-ms1.yaml

@@ -0,0 +1,42 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway-ms1
+  namespace: istio-system
+spec:
+  interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  chart:
+    spec:
+      chart: gateway-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    name: istio-ingressgateway-ms1
+    labels:
+      app: istio-ingressgateway
+      istio: ingressgateway
+    replicaCount: 1
+    autoscaling:
+      enabled: false
+    nodeSelector:
+      topology.kubernetes.io/zone: MS1
+    imagePullSecrets:
+      - name: istio-registry-secret
+    service:
+      type: ClusterIP
+      externalTrafficPolicy: ""

infrastructure/istio-gateway/vk-prod/ingressgateway-pa2.yaml

@@ -0,0 +1,42 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway-pa2
+  namespace: istio-system
+spec:
+  interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  chart:
+    spec:
+      chart: gateway-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    name: istio-ingressgateway-pa2
+    labels:
+      app: istio-ingressgateway
+      istio: ingressgateway
+    replicaCount: 1
+    autoscaling:
+      enabled: false
+    nodeSelector:
+      topology.kubernetes.io/zone: PA2
+    imagePullSecrets:
+      - name: istio-registry-secret
+    service:
+      type: ClusterIP
+      externalTrafficPolicy: ""

infrastructure/istio-gateway/vk-prod/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./ingressgateway-pa2.yaml
+  - ./ingressgateway-me1.yaml
+  - ./ingressgateway-ms1.yaml
+  - ./lb-service.yaml

infrastructure/istio-gateway/vk-prod/lb-service.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: istio-ingressgateway
+  namespace: istio-system
+  annotations:
+    loadbalancer.openstack.org/keep-floatingip: "true"
+  labels:
+    app: istio-ingressgateway
+    istio: ingressgateway
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: istio-ingressgateway
+    istio: ingressgateway
+  ports:
+    - name: status-port
+      port: 15021
+      protocol: TCP
+      targetPort: 15021
+    - name: http2
+      port: 80
+      protocol: TCP
+      targetPort: 80
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 443

infrastructure/istio-pilot/vk-prod/istio-pilot.yaml

@@ -0,0 +1,32 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istiod
+  namespace: istio-system
+spec:
+  chart:
+    spec:
+      chart: istiod-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+  values:
+    replicaCount: 3
+    autoscaleEnabled: false
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app: istiod
+            istio: pilot
+    global:
+      hub: cr.yandex/crp3ccidau046kdj8g9q/istio
+      tag: 1.30.5-amd64
+      imagePullSecrets:
+        - istio-registry-secret
+    pilot:
+      traceSampling: 100

infrastructure/istio-pilot/vk-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./istio-pilot.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istiod
+      namespace: istio-system