Refactor yc-ecp Istio and cert-manager configurations: adjust ClusterIssuer specs, update certificate and VirtualService keys, and add port names.

infrastructure/istio-config/yc-ecp/istio-config.yaml

@@ -19,8 +19,11 @@ spec:
       yc-ecp:
         namespaces: []
         certManager:
+          # чарт рендерит ClusterIssuer как `spec: {{ toYaml $ci.spec }}`,
+          # поэтому спека обязана лежать под ключом spec
           clusterIssuers:
             letsencrypt-prod:
+              spec:
                 acme:
                   email: "sarex@sarex.io"
                   server: "https://acme-v02.api.letsencrypt.org/directory"
@@ -30,16 +33,19 @@ spec:
                     - http01:
                         ingress:
                           class: istio
+          # имя Certificate = ключ, имя секрета задаётся отдельно
           certificates:
-            gitea-tls-secret:
+            gitea-cert:
               namespace: istio-system
+              secretName: gitea-tls-secret
               dnsNames:
                 - gitea.invest.cps.sarex.lonsdaleites.ru
               issuerRef:
                 name: letsencrypt-prod
                 kind: ClusterIssuer
-            vault-tls:
+            vault-cert:
               namespace: istio-system
+              secretName: vault-tls
               dnsNames:
                 - vault.invest.cps.sarex.lonsdaleites.ru
               issuerRef:
@@ -53,6 +59,8 @@ spec:
               servers:
                 - hosts:
                     - gitea.invest.cps.sarex.lonsdaleites.ru
+                  httpPortName: http
+                  httpsPortName: https
                   tls:
                     credentialName: gitea-tls-secret
             vault:
@@ -61,12 +69,16 @@ spec:
               servers:
                 - hosts:
                     - vault.invest.cps.sarex.lonsdaleites.ru
+                  httpPortName: http
+                  httpsPortName: https
                   tls:
                     credentialName: vault-tls
+          # имя VirtualService = ключ, поле name чарт игнорирует.
+          # noCors: чарт иначе навешивает corsPolicy с дефолтными origins sarex.io
           virtualServices:
-            gitea:
-              name: gitea-virt-service
+            gitea-virt-service:
               namespace: gitea
+              noCors: true
               hosts:
                 - gitea.invest.cps.sarex.lonsdaleites.ru
               gateways:
@@ -76,9 +88,9 @@ spec:
                     prefix: /
                   service: gitea.gitea.svc.cluster.local
                   port: 3000
-            vault:
-              name: vault-virt-service
+            vault-virt-service:
               namespace: vault
+              noCors: true
               hosts:
                 - vault.invest.cps.sarex.lonsdaleites.ru
               gateways: