Merge remote-tracking branch 'origin/master'

apps/inspections/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
           pullPolicy:
             _default: IfNotPresent
 

apps/transmittal/brusnika-stage/backend.yaml

@@ -287,11 +287,11 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
             value:
-              _default: "minio-svc.minio.svc.cluster.local:9000"
+              _default: "minio.brusnika.lonsdaleites.ru"
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
             value:
-              _default: "false"
+              _default: "true"
 
           - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
             value:

clusters/vk-infra/infrastructure/kustomization.yaml

@@ -11,3 +11,4 @@ resources:
   - ../../../infrastructure/vault/vk-infra
   - ../../../infrastructure/kb/vk-infra
   - ../../../infrastructure/gitlab-runner/vk-infra
+  - ../../../infrastructure/nexus/vk-infra

infrastructure/istio-config/vk-infra/istio-config.yaml

@@ -58,6 +58,17 @@ spec:
                 renewBefore: 360h0m0s
                 privateKey:
                   rotationPolicy: Always
+            nexus-tls:
+              dnsNames:
+                - nexus.infra.sarex.tech
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              spec:
+                duration: 2160h0m0s
+                renewBefore: 360h0m0s
+                privateKey:
+                  rotationPolicy: Always
             idp-tls:
               dnsNames:
                 - iam.sarex.io
@@ -93,6 +104,17 @@ spec:
                   tls:
                     credentialName: kb-tls
                     mode: SIMPLE
+            nexus:
+              name: nexus-gateway
+              namespace: istio-system
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - nexus.infra.sarex.tech
+                  tls:
+                    credentialName: nexus-tls
+                    mode: SIMPLE
             idp:
               name: idp-gateway
               namespace: istio-system
@@ -127,6 +149,17 @@ spec:
                     prefix: /
                   service: kb-service.kb.svc.cluster.local
                   port: 80
+            nexus-virt-service:
+              namespace: istio-system
+              hosts:
+                - nexus.infra.sarex.tech
+              gateways:
+                - istio-system/nexus-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: nexus.nexus.svc.cluster.local
+                  port: 8081
             idp-virt-service:
               namespace: istio-system
               hosts:

infrastructure/nexus/vk-infra/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - nexus.yaml

infrastructure/nexus/vk-infra/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nexus
+  labels:
+    istio-injection: enabled

infrastructure/nexus/vk-infra/nexus.yaml

@@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nexus
+  namespace: nexus
+spec:
+  interval: 10m
+  timeout: 15m
+  chart:
+    spec:
+      chart: nexus3
+      version: "5.7.0"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  dependsOn:
+    - name: istiod
+      namespace: istio-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    image:
+      repository: cr.yandex/crp3ccidau046kdj8g9q/mirror/nexus3
+    bashImage:
+      repository: cr.yandex/crp3ccidau046kdj8g9q/mirror/bash
+      tag: "20261015"
+    imagePullSecrets:
+      - name: istio-registry-secret
+    nodeSelector:
+      dedicated: null
+      sarex.io/pool: svc
+    tolerations: []
+    persistence:
+      storageClass: csi-ceph-ssd-retain
+      size: 50Gi
+    backupSyncer:
+      enabled: false
+    config:
+      enabled: false
+    gateway: null
+    virtualService: null