apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: istio-config
  namespace: default
spec:
  # istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod/ingressgateway
  # в кластере нет — с зависимостями из base релиз никогда не станет Ready.
  # cert-manager нужен: этот релиз создаёт ClusterIssuer и Certificate
  dependsOn:
    - name: cert-manager
      namespace: cert-manager
  interval: 5m
  timeout: 10m
  values:
    global:
      env: yc-ecp
    environments:
      yc-ecp:
        namespaces: []
        certManager:
          # чарт рендерит ClusterIssuer как `spec: {{ toYaml $ci.spec }}`,
          # поэтому спека обязана лежать под ключом spec
          clusterIssuers:
            letsencrypt-prod:
              spec:
                acme:
                  email: "sarex@sarex.io"
                  server: "https://acme-v02.api.letsencrypt.org/directory"
                  privateKeySecretRef:
                    name: letsencrypt-prod
                  solvers:
                    - http01:
                        ingress:
                          class: istio
          # ключ = имя Certificate И имя секрета: версия чарта в OCI-репозитории
          # поле secretName не читает, а берёт имя ключа
          certificates:
            gitea-tls-secret:
              namespace: istio-system
              dnsNames:
                - gitea.invest.cps.sarex.lonsdaleites.ru
              issuerRef:
                name: letsencrypt-prod
                kind: ClusterIssuer
            vault-tls:
              namespace: istio-system
              dnsNames:
                - vault.invest.cps.sarex.lonsdaleites.ru
              issuerRef:
                name: letsencrypt-prod
                kind: ClusterIssuer
            dashboard-tls:
              namespace: istio-system
              dnsNames:
                - dashboard.invest.cps.sarex.lonsdaleites.ru
              issuerRef:
                name: letsencrypt-prod
                kind: ClusterIssuer
        istio:
          gateways:
            gitea:
              name: gitea-gateway
              namespace: gateway
              servers:
                - hosts:
                    - gitea.invest.cps.sarex.lonsdaleites.ru
                  httpPortName: http
                  httpsPortName: https
                  tls:
                    credentialName: gitea-tls-secret
            vault:
              name: vault-gateway
              namespace: gateway
              servers:
                - hosts:
                    - vault.invest.cps.sarex.lonsdaleites.ru
                  httpPortName: http
                  httpsPortName: https
                  tls:
                    credentialName: vault-tls
            dashboard:
              name: dashboard-gateway
              namespace: gateway
              servers:
                - hosts:
                    - dashboard.invest.cps.sarex.lonsdaleites.ru
                  httpPortName: http
                  httpsPortName: https
                  tls:
                    credentialName: dashboard-tls
          # имя VirtualService = ключ, поле name чарт игнорирует.
          # noCors: чарт иначе навешивает corsPolicy с дефолтными origins sarex.io
          virtualServices:
            gitea-virt-service:
              namespace: gitea
              noCors: true
              hosts:
                - gitea.invest.cps.sarex.lonsdaleites.ru
              gateways:
                - gateway/gitea-gateway
              routes:
                - path:
                    prefix: /
                  service: gitea.gitea.svc.cluster.local
                  port: 3000
            vault-virt-service:
              namespace: vault
              noCors: true
              hosts:
                - vault.invest.cps.sarex.lonsdaleites.ru
              gateways:
                - gateway/vault-gateway
              routes:
                - path:
                    prefix: /
                  service: vault-vault-contour.vault.svc.cluster.local
                  port: 8200
            dashboard-virt-service:
              namespace: kubernetes-dashboard
              noCors: true
              hosts:
                - dashboard.invest.cps.sarex.lonsdaleites.ru
              gateways:
                - gateway/dashboard-gateway
              routes:
                - path:
                    prefix: /
                  service: dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local
                  port: 80