++ vk infra istio

clusters/vk-infra/flux-system/kustomization.yaml

@@ -0,0 +1,45 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gotk-components.yaml
+- gotk-sync.yaml
+patches:
+- target:
+    kind: Deployment
+    name: (source-controller|kustomize-controller|helm-controller|notification-controller)
+  patch: |
+    - op: add
+      path: /spec/template/spec/nodeSelector/sarex.io~1pool
+      value: svc
+- target:
+    kind: Deployment
+    name: kustomize-controller
+  patch: |
+    - op: replace
+      path: /spec/replicas
+      value: 3
+    - op: add
+      path: /spec/template/spec/topologySpreadConstraints
+      value:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app: kustomize-controller
+- target:
+    kind: Deployment
+    name: helm-controller
+  patch: |
+    - op: replace
+      path: /spec/replicas
+      value: 3
+    - op: add
+      path: /spec/template/spec/topologySpreadConstraints
+      value:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app: helm-controller

clusters/vk-infra/helm-repositories.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: istio-upstream
+  namespace: flux-system
+spec:
+  type: default
+  interval: 10m0s
+  url: https://istio-release.storage.googleapis.com/charts

clusters/vk-infra/infrastructure/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-base/vk-infra
+  - ../../../infrastructure/istio-pilot/vk-infra
+  - ../../../infrastructure/istio-gateway/vk-infra

clusters/vk-infra/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./flux-system
+  - ./helm-repositories.yaml
+  - ./infrastructure

infrastructure/istio-base/vk-infra/istio-base.yaml

@@ -0,0 +1,14 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-base
+  namespace: istio-system
+spec:
+  chart:
+    spec:
+      chart: base
+      version: "1.27.1"
+      sourceRef:
+        kind: HelmRepository
+        name: istio-upstream
+        namespace: flux-system

infrastructure/istio-base/vk-infra/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./istio-base.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istio-base
+      namespace: istio-system

infrastructure/istio-gateway/vk-infra/ingressgateway-me1.yaml

@@ -0,0 +1,42 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway-me1
+  namespace: istio-system
+spec:
+  interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  chart:
+    spec:
+      chart: gateway
+      version: "1.27.1"
+      sourceRef:
+        kind: HelmRepository
+        name: istio-upstream
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    name: istio-ingressgateway-me1
+    labels:
+      app: istio-ingressgateway
+      istio: ingressgateway
+    replicaCount: 1
+    autoscaling:
+      enabled: false
+    nodeSelector:
+      sarex.io/pool: svc
+      topology.kubernetes.io/zone: ME1
+    imagePullSecrets:
+      - name: istio-registry-secret
+    service:
+      type: ClusterIP

infrastructure/istio-gateway/vk-infra/ingressgateway-ms1.yaml

@@ -0,0 +1,42 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway-ms1
+  namespace: istio-system
+spec:
+  interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  chart:
+    spec:
+      chart: gateway
+      version: "1.27.1"
+      sourceRef:
+        kind: HelmRepository
+        name: istio-upstream
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    name: istio-ingressgateway-ms1
+    labels:
+      app: istio-ingressgateway
+      istio: ingressgateway
+    replicaCount: 1
+    autoscaling:
+      enabled: false
+    nodeSelector:
+      sarex.io/pool: svc
+      topology.kubernetes.io/zone: MS1
+    imagePullSecrets:
+      - name: istio-registry-secret
+    service:
+      type: ClusterIP

infrastructure/istio-gateway/vk-infra/ingressgateway-pa2.yaml

@@ -0,0 +1,42 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingressgateway-pa2
+  namespace: istio-system
+spec:
+  interval: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  chart:
+    spec:
+      chart: gateway
+      version: "1.27.1"
+      sourceRef:
+        kind: HelmRepository
+        name: istio-upstream
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    name: istio-ingressgateway-pa2
+    labels:
+      app: istio-ingressgateway
+      istio: ingressgateway
+    replicaCount: 1
+    autoscaling:
+      enabled: false
+    nodeSelector:
+      sarex.io/pool: svc
+      topology.kubernetes.io/zone: PA2
+    imagePullSecrets:
+      - name: istio-registry-secret
+    service:
+      type: ClusterIP

infrastructure/istio-gateway/vk-infra/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./ingressgateway-pa2.yaml
+  - ./ingressgateway-me1.yaml
+  - ./ingressgateway-ms1.yaml
+  - ./lb-service.yaml

infrastructure/istio-gateway/vk-infra/lb-service.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: istio-ingressgateway
+  namespace: istio-system
+  labels:
+    app: istio-ingressgateway
+    istio: ingressgateway
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: istio-ingressgateway
+    istio: ingressgateway
+  ports:
+    - name: status-port
+      port: 15021
+      protocol: TCP
+      targetPort: 15021
+    - name: http2
+      port: 80
+      protocol: TCP
+      targetPort: 80
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 443

infrastructure/istio-pilot/vk-infra/istio-pilot.yaml

@@ -0,0 +1,34 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istiod
+  namespace: istio-system
+spec:
+  chart:
+    spec:
+      chart: istiod
+      version: "1.27.1"
+      sourceRef:
+        kind: HelmRepository
+        name: istio-upstream
+        namespace: flux-system
+  values:
+    replicaCount: 3
+    autoscaleEnabled: false
+    nodeSelector:
+      sarex.io/pool: svc
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: topology.kubernetes.io/zone
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app: istiod
+            istio: pilot
+    global:
+      hub: cr.yandex/crp3ccidau046kdj8g9q/istio
+      tag: 1.27.1-amd64
+      imagePullSecrets:
+        - istio-registry-secret
+    pilot:
+      traceSampling: 100

infrastructure/istio-pilot/vk-infra/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./istio-pilot.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istiod
+      namespace: istio-system