Add TLS and routes for MinIO Console in brusnika-prod Istio configuration

clusters/brusnika-prod/infrastructure/clusterissuer-letsencrypt.yaml

@@ -20,6 +20,7 @@ spec:
             - identity.camunda.cde.brusnika.ru
             - jupyter.brusnika.onprem.sarex.io
             - keycloak.camunda.cde.brusnika.ru
+            - minio-console.brusnika.onprem.sarex.io
             - minio.brusnika.onprem.sarex.io
             - openobserve.brusnika.onprem.sarex.io
             - operate.camunda.cde.brusnika.ru

infrastructure/istio-config/brusnika-prod/istio-config.yaml

@@ -103,6 +103,13 @@ spec:
               issuerRef:
                 name: letsencrypt
                 kind: ClusterIssuer
+            minio-console-tls:
+              namespace: ingress-nginx
+              dnsNames:
+                - minio-console.brusnika.onprem.sarex.io
+              issuerRef:
+                name: letsencrypt
+                kind: ClusterIssuer
             projects-secret-name:
               namespace: ingress-nginx
               dnsNames:
@@ -278,6 +285,16 @@ spec:
                     - minio.brusnika.onprem.sarex.io
                   tls:
                     credentialName: brusnika-secret-name
+            minio-console:
+              name: minio-console-gw
+              namespace: ingress-nginx
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - minio-console.brusnika.onprem.sarex.io
+                  tls:
+                    credentialName: minio-console-tls
             sso-check:
               name: sso-check-gw
               namespace: ingress-nginx
@@ -629,15 +646,31 @@ spec:
                   redirect:
                     scheme: https
                     redirectCode: 308
-                - path:
-                    prefix: /console/
-                  rewrite: /
-                  service: minio-console.minio.svc.cluster.local
-                  port: 9001
                 - path:
                     prefix: /
                   service: minio.minio.svc.cluster.local
                   port: 9000
+            minio-console-vs:
+              namespace: minio
+              hosts:
+                - minio-console.brusnika.onprem.sarex.io
+              gateways:
+                - ingress-nginx/minio-console-gw
+              cors:
+                allowOrigins:
+                  - exact: https://minio-console.brusnika.onprem.sarex.io
+              routes:
+                - match:
+                    - port: 80
+                      uri:
+                        prefix: /
+                  redirect:
+                    scheme: https
+                    redirectCode: 308
+                - path:
+                    prefix: /
+                  service: minio-console.minio.svc.cluster.local
+                  port: 9001
             sso-check-vs:
               namespace: sso-check
               hosts:

infrastructure/minio/brusnika-prod/minio.yaml

@@ -11,7 +11,7 @@ spec:
     mode: standalone
     environment:
       MINIO_SERVER_URL: "https://minio.brusnika.onprem.sarex.io"
-      MINIO_BROWSER_REDIRECT_URL: "https://minio.brusnika.onprem.sarex.io/console/"
+      MINIO_BROWSER_REDIRECT_URL: "https://minio-console.brusnika.onprem.sarex.io"
       MINIO_API_CORS_ALLOW_ORIGIN: "https://minio.brusnika.onprem.sarex.io"
     imagePullSecrets:
       - name: regcred