From 445336e72186683c13a1d6dfe22f4798ef205b30 Mon Sep 17 00:00:00 2001
From: emelinda <emelin_d_a@mail.ru>
Date: Mon, 5 Oct 2026 21:21:30 +0300
Subject: [PATCH] Add TLS and routes for MinIO Console in `brusnika-prod` Istio
 configuration

---
 .../clusterissuer-letsencrypt.yaml            |  1 +
 .../brusnika-prod/istio-config.yaml           | 43 ++++++++++++++++---
 infrastructure/minio/brusnika-prod/minio.yaml |  2 +-
 3 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/clusters/brusnika-prod/infrastructure/clusterissuer-letsencrypt.yaml b/clusters/brusnika-prod/infrastructure/clusterissuer-letsencrypt.yaml
index 81fadfe..60a50b6 100644
--- a/clusters/brusnika-prod/infrastructure/clusterissuer-letsencrypt.yaml
+++ b/clusters/brusnika-prod/infrastructure/clusterissuer-letsencrypt.yaml
@@ -20,6 +20,7 @@ spec:
             - identity.camunda.cde.brusnika.ru
             - jupyter.brusnika.onprem.sarex.io
             - keycloak.camunda.cde.brusnika.ru
+            - minio-console.brusnika.onprem.sarex.io
             - minio.brusnika.onprem.sarex.io
             - openobserve.brusnika.onprem.sarex.io
             - operate.camunda.cde.brusnika.ru
diff --git a/infrastructure/istio-config/brusnika-prod/istio-config.yaml b/infrastructure/istio-config/brusnika-prod/istio-config.yaml
index fa70e02..7ff758f 100644
--- a/infrastructure/istio-config/brusnika-prod/istio-config.yaml
+++ b/infrastructure/istio-config/brusnika-prod/istio-config.yaml
@@ -103,6 +103,13 @@ spec:
               issuerRef:
                 name: letsencrypt
                 kind: ClusterIssuer
+            minio-console-tls:
+              namespace: ingress-nginx
+              dnsNames:
+                - minio-console.brusnika.onprem.sarex.io
+              issuerRef:
+                name: letsencrypt
+                kind: ClusterIssuer
             projects-secret-name:
               namespace: ingress-nginx
               dnsNames:
@@ -278,6 +285,16 @@ spec:
                     - minio.brusnika.onprem.sarex.io
                   tls:
                     credentialName: brusnika-secret-name
+            minio-console:
+              name: minio-console-gw
+              namespace: ingress-nginx
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - minio-console.brusnika.onprem.sarex.io
+                  tls:
+                    credentialName: minio-console-tls
             sso-check:
               name: sso-check-gw
               namespace: ingress-nginx
@@ -629,15 +646,31 @@ spec:
                   redirect:
                     scheme: https
                     redirectCode: 308
-                - path:
-                    prefix: /console/
-                  rewrite: /
-                  service: minio-console.minio.svc.cluster.local
-                  port: 9001
                 - path:
                     prefix: /
                   service: minio.minio.svc.cluster.local
                   port: 9000
+            minio-console-vs:
+              namespace: minio
+              hosts:
+                - minio-console.brusnika.onprem.sarex.io
+              gateways:
+                - ingress-nginx/minio-console-gw
+              cors:
+                allowOrigins:
+                  - exact: https://minio-console.brusnika.onprem.sarex.io
+              routes:
+                - match:
+                    - port: 80
+                      uri:
+                        prefix: /
+                  redirect:
+                    scheme: https
+                    redirectCode: 308
+                - path:
+                    prefix: /
+                  service: minio-console.minio.svc.cluster.local
+                  port: 9001
             sso-check-vs:
               namespace: sso-check
               hosts:
diff --git a/infrastructure/minio/brusnika-prod/minio.yaml b/infrastructure/minio/brusnika-prod/minio.yaml
index cb9c69f..5963ab9 100644
--- a/infrastructure/minio/brusnika-prod/minio.yaml
+++ b/infrastructure/minio/brusnika-prod/minio.yaml
@@ -11,7 +11,7 @@ spec:
     mode: standalone
     environment:
       MINIO_SERVER_URL: "https://minio.brusnika.onprem.sarex.io"
-      MINIO_BROWSER_REDIRECT_URL: "https://minio.brusnika.onprem.sarex.io/console/"
+      MINIO_BROWSER_REDIRECT_URL: "https://minio-console.brusnika.onprem.sarex.io"
       MINIO_API_CORS_ALLOW_ORIGIN: "https://minio.brusnika.onprem.sarex.io"
     imagePullSecrets:
       - name: regcred