apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: istio-config
  namespace: default
spec:
  interval: 5m
  timeout: 10m
  dependsOn:
  - name: istio-base
    namespace: istio-system
  - name: istiod
    namespace: istio-system
  - name: cert-manager
    namespace: cert-manager
  values:
    global:
      env: vk-prod
    environments:
      vk-prod:
        certManager:
          clusterIssuers:
            letsencrypt-issuer-istio:
              spec:
                acme:
                  email: pavel@sarex.io
                  privateKeySecretRef:
                    name: letsencrypt-istio-account-key
                  server: https://acme-v02.api.letsencrypt.org/directory
                  solvers:
                  - http01:
                      ingress:
                        class: istio
                        podTemplate:
                          spec:
                            imagePullSecrets:
                            - name: istio-registry-secret
          certificates:
            camunda-identity-tls:
              namespace: istio-system
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
              dnsNames:
              - camunda-identity.platform.sarex.space
              spec:
                duration: 2160h
                privateKey:
                  rotationPolicy: Always
                renewBefore: 360h
            camunda-keycloak-tls:
              namespace: istio-system
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
              dnsNames:
              - camunda-keycloak.platform.sarex.space
              spec:
                duration: 2160h
                privateKey:
                  rotationPolicy: Always
                renewBefore: 360h
            camunda-operate-tls:
              namespace: istio-system
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
              dnsNames:
              - camunda-operate.platform.sarex.space
              spec:
                duration: 2160h
                privateKey:
                  rotationPolicy: Always
                renewBefore: 360h
            camunda-optimize-tls:
              namespace: istio-system
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
              dnsNames:
              - camunda-optimize.platform.sarex.space
              spec:
                duration: 2160h
                privateKey:
                  rotationPolicy: Always
                renewBefore: 360h
            camunda-tasklist-tls:
              namespace: istio-system
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
              dnsNames:
              - camunda-tasklist.platform.sarex.space
              spec:
                duration: 2160h
                privateKey:
                  rotationPolicy: Always
                renewBefore: 360h
        istio:
          gateways:
            camunda:
              namespace: gateway
              servers:
              - hosts:
                - camunda-keycloak.platform.sarex.space
                tls:
                  credentialName: camunda-keycloak-tls
                httpsPortName: keycloak-https-443
                httpPortName: keycloak-http-80
              - hosts:
                - camunda-operate.platform.sarex.space
                tls:
                  credentialName: camunda-operate-tls
                httpsPortName: operate-https-443
                httpPortName: operate-http-80
              - hosts:
                - camunda-identity.platform.sarex.space
                tls:
                  credentialName: camunda-identity-tls
                httpsPortName: identity-https-443
                httpPortName: identity-http-80
              - hosts:
                - camunda-tasklist.platform.sarex.space
                tls:
                  credentialName: camunda-tasklist-tls
                httpsPortName: tasklist-https-443
                httpPortName: tasklist-http-80
              - hosts:
                - camunda-optimize.platform.sarex.space
                tls:
                  credentialName: camunda-optimize-tls
                httpsPortName: otpimize-https-443
                httpPortName: optimize-http-80
          virtualServices:
            identity-virt-service:
              namespace: gateway
              hosts:
              - camunda-identity.platform.sarex.space
              gateways:
              - gateway/camunda-gateway
              cors:
                allowHeaders:
                - Authorization
                - Content-Type
                - Identity
                allowMethods:
                - POST
                - GET
                - PATCH
                - DELETE
                - HEAD
                - PUT
                - OPTIONS
                allowOrigins:
                - regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
                omitMaxAge: true
              routes:
              - path:
                  prefix: /
                service: camunda-identity.camunda-prod.svc.cluster.local
            keycloak-virt-service:
              namespace: gateway
              hosts:
              - camunda-keycloak.platform.sarex.space
              gateways:
              - gateway/camunda-gateway
              cors:
                allowHeaders:
                - Authorization
                - Content-Type
                - Identity
                allowMethods:
                - POST
                - GET
                - PATCH
                - DELETE
                - HEAD
                - PUT
                - OPTIONS
                allowOrigins:
                - regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
                omitMaxAge: true
              routes:
              - path:
                  prefix: /auth/
                service: camunda-keycloak.camunda-prod.svc.cluster.local
            operate-virt-service:
              namespace: gateway
              hosts:
              - camunda-operate.platform.sarex.space
              gateways:
              - gateway/camunda-gateway
              cors:
                allowHeaders:
                - Authorization
                - Content-Type
                - Identity
                allowMethods:
                - POST
                - GET
                - PATCH
                - DELETE
                - HEAD
                - PUT
                - OPTIONS
                allowOrigins:
                - regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
                omitMaxAge: true
              routes:
              - path:
                  prefix: /
                service: camunda-operate.camunda-prod.svc.cluster.local
            optimize-virt-service:
              namespace: gateway
              hosts:
              - camunda-optimize.platform.sarex.space
              gateways:
              - gateway/camunda-gateway
              cors:
                allowHeaders:
                - Authorization
                - Content-Type
                - Identity
                allowMethods:
                - POST
                - GET
                - PATCH
                - DELETE
                - HEAD
                - PUT
                - OPTIONS
                allowOrigins:
                - regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
                omitMaxAge: true
              routes:
              - path:
                  prefix: /
                service: camunda-optimize.camunda-prod.svc.cluster.local
            tasklist-virt-service:
              namespace: gateway
              hosts:
              - camunda-tasklist.platform.sarex.space
              gateways:
              - gateway/camunda-gateway
              cors:
                allowHeaders:
                - Authorization
                - Content-Type
                - Identity
                allowMethods:
                - POST
                - GET
                - PATCH
                - DELETE
                - HEAD
                - PUT
                - OPTIONS
                allowOrigins:
                - regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
                omitMaxAge: true
              routes:
              - path:
                  prefix: /
                service: camunda-tasklist.camunda-prod.svc.cluster.local