++ vk infra cert zitadel

clusters/vk-infra/infrastructure/kustomization.yaml

@@ -4,3 +4,6 @@ resources:
   - ../../../infrastructure/istio-base/vk-infra
   - ../../../infrastructure/istio-pilot/vk-infra
   - ../../../infrastructure/istio-gateway/vk-infra
+  - ../../../infrastructure/cert-manager/vk-infra
+  - ../../../infrastructure/istio-config/vk-infra
+  - ../../../infrastructure/zitadel/vk-infra

infrastructure/cert-manager/vk-infra/cert-manager.yaml

@@ -0,0 +1,36 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      imagePullSecrets:
+        - istio-registry-secret
+    controller:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cert-manager
+        pullSecrets:
+          - istio-registry-secret
+      acmesolver:
+        image:
+          registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+          repository: acmesolver
+          pullSecrets:
+            - istio-registry-secret
+    webhook:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cert-manager-webhook
+        pullSecrets:
+          - istio-registry-secret
+    cainjector:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cainjector
+        pullSecrets:
+          - istio-registry-secret

infrastructure/cert-manager/vk-infra/clusterissuer-letsencrypt-istio.yaml

@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-issuer-istio
+spec:
+  acme:
+    email: "pavel@sarex.io"
+    privateKeySecretRef:
+      name: letsencrypt-secret-key
+    server: "https://acme-v02.api.letsencrypt.org/directory"
+    solvers:
+      - http01:
+          ingress:
+            class: istio
+            podTemplate:
+              spec:
+                imagePullSecrets:
+                  - name: istio-registry-secret

infrastructure/cert-manager/vk-infra/kustomization.yaml

@@ -0,0 +1,24 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./cert-manager.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: cert-manager
+      namespace: cert-manager
+  - path: ./clusterissuer-letsencrypt-istio.yaml
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer

infrastructure/istio-config/vk-infra/istio-config.yaml

@@ -0,0 +1,58 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+    - name: cert-manager
+      namespace: cert-manager
+  values:
+    global:
+      env: vk-infra
+    environments:
+      vk-infra:
+        certManager:
+          certificates:
+            idp-tls:
+              dnsNames:
+                - iam.sarex.io
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              spec:
+                duration: 2160h0m0s
+                renewBefore: 360h0m0s
+                privateKey:
+                  rotationPolicy: Always
+        istio:
+          gateways:
+            idp:
+              name: idp-gateway
+              namespace: istio-system
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - iam.sarex.io
+                  tls:
+                    credentialName: idp-tls
+                    mode: SIMPLE
+          virtualServices:
+            idp-virt-service:
+              namespace: istio-system
+              hosts:
+                - iam.sarex.io
+              gateways:
+                - istio-system/idp-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: idp.zitadel.svc.cluster.local
+                  port: 8080

infrastructure/istio-config/vk-infra/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./istio-config.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istio-config
+      namespace: default

infrastructure/zitadel/vk-infra/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - zitadel.yaml

infrastructure/zitadel/vk-infra/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: zitadel
+  labels:
+    istio-injection: enabled

infrastructure/zitadel/vk-infra/zitadel.yaml

@@ -0,0 +1,102 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: idp
+  namespace: zitadel
+spec:
+  interval: 10m
+  timeout: 15m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+  chart:
+    spec:
+      chart: idp-infra
+      version: "4.19.4-1"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    replicaCount: 3
+    imagePullSecrets:
+      - name: istio-registry-secret
+    nodeSelector:
+      sarex.io/pool: svc
+    affinity:
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          - topologyKey: topology.kubernetes.io/zone
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: idp
+                app.kubernetes.io/instance: idp
+    env:
+      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
+        value: 'false'
+      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
+        value: bcrypt,pbkdf2
+      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
+        value: 'true'
+      - name: ZITADEL_DATABASE_POSTGRES_HOST
+        valueFrom:
+          secretKeyRef:
+            name: zitadel-db
+            key: host
+      - name: ZITADEL_DATABASE_POSTGRES_PORT
+        valueFrom:
+          secretKeyRef:
+            name: zitadel-db
+            key: port
+      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: zitadel-db
+            key: user
+      - name: ZITADEL_DATABASE_POSTGRES_USER_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: zitadel-db
+            key: password
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
+        valueFrom:
+          secretKeyRef:
+            name: zitadel-db
+            key: database
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: zitadel-db
+            key: user
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: zitadel-db
+            key: password
+      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
+        valueFrom:
+          secretKeyRef:
+            name: zitadel-db
+            key: database
+      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
+        value: require
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
+        value: require
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
+        value: zitadel-admin
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: zitadel-first-admin
+            key: password
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
+        value: Sarex