From c43ffe5bcce26d50676eb5eefc3e9d96ca45372e Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Wed, 14 Oct 2026 13:35:13 +0300 Subject: [PATCH] ++ vk infra cert zitadel --- .../infrastructure/kustomization.yaml | 3 + .../cert-manager/vk-infra/cert-manager.yaml | 36 +++++++ .../clusterissuer-letsencrypt-istio.yaml | 18 ++++ .../cert-manager/vk-infra/kustomization.yaml | 24 +++++ .../istio-config/vk-infra/istio-config.yaml | 58 ++++++++++ .../istio-config/vk-infra/kustomization.yaml | 12 +++ .../zitadel/vk-infra/kustomization.yaml | 5 + .../zitadel/vk-infra/namespace.yaml | 6 ++ infrastructure/zitadel/vk-infra/zitadel.yaml | 102 ++++++++++++++++++ 9 files changed, 264 insertions(+) create mode 100644 infrastructure/cert-manager/vk-infra/cert-manager.yaml create mode 100644 infrastructure/cert-manager/vk-infra/clusterissuer-letsencrypt-istio.yaml create mode 100644 infrastructure/cert-manager/vk-infra/kustomization.yaml create mode 100644 infrastructure/istio-config/vk-infra/istio-config.yaml create mode 100644 infrastructure/istio-config/vk-infra/kustomization.yaml create mode 100644 infrastructure/zitadel/vk-infra/kustomization.yaml create mode 100644 infrastructure/zitadel/vk-infra/namespace.yaml create mode 100644 infrastructure/zitadel/vk-infra/zitadel.yaml diff --git a/clusters/vk-infra/infrastructure/kustomization.yaml b/clusters/vk-infra/infrastructure/kustomization.yaml index a875bc3..d095b2d 100644 --- a/clusters/vk-infra/infrastructure/kustomization.yaml +++ b/clusters/vk-infra/infrastructure/kustomization.yaml @@ -4,3 +4,6 @@ resources: - ../../../infrastructure/istio-base/vk-infra - ../../../infrastructure/istio-pilot/vk-infra - ../../../infrastructure/istio-gateway/vk-infra + - ../../../infrastructure/cert-manager/vk-infra + - ../../../infrastructure/istio-config/vk-infra + - ../../../infrastructure/zitadel/vk-infra diff --git a/infrastructure/cert-manager/vk-infra/cert-manager.yaml b/infrastructure/cert-manager/vk-infra/cert-manager.yaml new file mode 100644 index 0000000..9e6f59b --- /dev/null +++ b/infrastructure/cert-manager/vk-infra/cert-manager.yaml @@ -0,0 +1,36 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cert-manager + namespace: cert-manager +spec: + interval: 5m + timeout: 10m + values: + global: + imagePullSecrets: + - istio-registry-secret + controller: + image: + registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager + repository: cert-manager + pullSecrets: + - istio-registry-secret + acmesolver: + image: + registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager + repository: acmesolver + pullSecrets: + - istio-registry-secret + webhook: + image: + registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager + repository: cert-manager-webhook + pullSecrets: + - istio-registry-secret + cainjector: + image: + registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager + repository: cainjector + pullSecrets: + - istio-registry-secret diff --git a/infrastructure/cert-manager/vk-infra/clusterissuer-letsencrypt-istio.yaml b/infrastructure/cert-manager/vk-infra/clusterissuer-letsencrypt-istio.yaml new file mode 100644 index 0000000..22eab42 --- /dev/null +++ b/infrastructure/cert-manager/vk-infra/clusterissuer-letsencrypt-istio.yaml @@ -0,0 +1,18 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-issuer-istio +spec: + acme: + email: "pavel@sarex.io" + privateKeySecretRef: + name: letsencrypt-secret-key + server: "https://acme-v02.api.letsencrypt.org/directory" + solvers: + - http01: + ingress: + class: istio + podTemplate: + spec: + imagePullSecrets: + - name: istio-registry-secret diff --git a/infrastructure/cert-manager/vk-infra/kustomization.yaml b/infrastructure/cert-manager/vk-infra/kustomization.yaml new file mode 100644 index 0000000..3344871 --- /dev/null +++ b/infrastructure/cert-manager/vk-infra/kustomization.yaml @@ -0,0 +1,24 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: ./cert-manager.yaml + target: + group: helm.toolkit.fluxcd.io + version: v2 + kind: HelmRelease + name: cert-manager + namespace: cert-manager + - path: ./clusterissuer-letsencrypt-istio.yaml + - target: + group: cert-manager.io + version: v1 + kind: ClusterIssuer + name: letsencrypt-issuer + patch: |- + $patch: delete + apiVersion: cert-manager.io/v1 + kind: ClusterIssuer + metadata: + name: letsencrypt-issuer diff --git a/infrastructure/istio-config/vk-infra/istio-config.yaml b/infrastructure/istio-config/vk-infra/istio-config.yaml new file mode 100644 index 0000000..9f2daae --- /dev/null +++ b/infrastructure/istio-config/vk-infra/istio-config.yaml @@ -0,0 +1,58 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: istio-config + namespace: default +spec: + interval: 5m + timeout: 10m + dependsOn: + - name: istio-base + namespace: istio-system + - name: istiod + namespace: istio-system + - name: cert-manager + namespace: cert-manager + values: + global: + env: vk-infra + environments: + vk-infra: + certManager: + certificates: + idp-tls: + dnsNames: + - iam.sarex.io + issuerRef: + name: letsencrypt-issuer-istio + kind: ClusterIssuer + spec: + duration: 2160h0m0s + renewBefore: 360h0m0s + privateKey: + rotationPolicy: Always + istio: + gateways: + idp: + name: idp-gateway + namespace: istio-system + selector: + istio: ingressgateway + servers: + - hosts: + - iam.sarex.io + tls: + credentialName: idp-tls + mode: SIMPLE + virtualServices: + idp-virt-service: + namespace: istio-system + hosts: + - iam.sarex.io + gateways: + - istio-system/idp-gateway + routes: + - path: + prefix: / + service: idp.zitadel.svc.cluster.local + port: 8080 diff --git a/infrastructure/istio-config/vk-infra/kustomization.yaml b/infrastructure/istio-config/vk-infra/kustomization.yaml new file mode 100644 index 0000000..d4679f4 --- /dev/null +++ b/infrastructure/istio-config/vk-infra/kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: ./istio-config.yaml + target: + group: helm.toolkit.fluxcd.io + version: v2 + kind: HelmRelease + name: istio-config + namespace: default diff --git a/infrastructure/zitadel/vk-infra/kustomization.yaml b/infrastructure/zitadel/vk-infra/kustomization.yaml new file mode 100644 index 0000000..465b275 --- /dev/null +++ b/infrastructure/zitadel/vk-infra/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - zitadel.yaml diff --git a/infrastructure/zitadel/vk-infra/namespace.yaml b/infrastructure/zitadel/vk-infra/namespace.yaml new file mode 100644 index 0000000..ffe7f4c --- /dev/null +++ b/infrastructure/zitadel/vk-infra/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: zitadel + labels: + istio-injection: enabled diff --git a/infrastructure/zitadel/vk-infra/zitadel.yaml b/infrastructure/zitadel/vk-infra/zitadel.yaml new file mode 100644 index 0000000..88b89d5 --- /dev/null +++ b/infrastructure/zitadel/vk-infra/zitadel.yaml @@ -0,0 +1,102 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: idp + namespace: zitadel +spec: + interval: 10m + timeout: 15m + dependsOn: + - name: istio-base + namespace: istio-system + - name: istiod + namespace: istio-system + chart: + spec: + chart: idp-infra + version: "4.19.4-1" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + replicaCount: 3 + imagePullSecrets: + - name: istio-registry-secret + nodeSelector: + sarex.io/pool: svc + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - topologyKey: topology.kubernetes.io/zone + labelSelector: + matchLabels: + app.kubernetes.io/name: idp + app.kubernetes.io/instance: idp + env: + - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED + value: 'false' + - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS + value: bcrypt,pbkdf2 + - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED + value: 'true' + - name: ZITADEL_DATABASE_POSTGRES_HOST + valueFrom: + secretKeyRef: + name: zitadel-db + key: host + - name: ZITADEL_DATABASE_POSTGRES_PORT + valueFrom: + secretKeyRef: + name: zitadel-db + key: port + - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME + valueFrom: + secretKeyRef: + name: zitadel-db + key: user + - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD + valueFrom: + secretKeyRef: + name: zitadel-db + key: password + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE + valueFrom: + secretKeyRef: + name: zitadel-db + key: database + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME + valueFrom: + secretKeyRef: + name: zitadel-db + key: user + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: zitadel-db + key: password + - name: ZITADEL_DATABASE_POSTGRES_DATABASE + valueFrom: + secretKeyRef: + name: zitadel-db + key: database + - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE + value: require + - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE + value: require + - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME + value: zitadel-admin + - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_PASSWORD + valueFrom: + secretKeyRef: + name: zitadel-first-admin + key: password + - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME + value: Sarex