apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: istio-config
  namespace: default
spec:
  # istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod/ingressgateway
  # в кластере нет — с зависимостями из base релиз никогда не станет Ready
  dependsOn: []
  interval: 5m
  timeout: 10m
  values:
    global:
      env: yc-ecp
    environments:
      yc-ecp:
        namespaces: []
        certManager:
          clusterIssuers: {}
          certificates:
            gitea-tls-secret:
              namespace: istio-system
              dnsNames:
                - gitea.invest.cps.sarex.lonsdaleites.ru
              issuerRef:
                name: letsencrypt-prod
                kind: ClusterIssuer
            vault-tls:
              namespace: istio-system
              dnsNames:
                - vault.invest.cps.sarex.lonsdaleites.ru
              issuerRef:
                name: letsencrypt-prod
                kind: ClusterIssuer
        istio:
          gateways:
            gitea:
              name: gitea-gateway
              namespace: gateway
              servers:
                - hosts:
                    - gitea.invest.cps.sarex.lonsdaleites.ru
                  tls:
                    credentialName: gitea-tls-secret
            vault:
              name: vault-gateway
              namespace: gateway
              servers:
                - hosts:
                    - vault.invest.cps.sarex.lonsdaleites.ru
                  tls:
                    credentialName: vault-tls
          virtualServices:
            gitea:
              name: gitea-virt-service
              namespace: gitea
              hosts:
                - gitea.invest.cps.sarex.lonsdaleites.ru
              gateways:
                - gateway/gitea-gateway
              routes:
                - path:
                    prefix: /
                  service: gitea.gitea.svc.cluster.local
                  port: 3000
            vault:
              name: vault-virt-service
              namespace: vault
              hosts:
                - vault.invest.cps.sarex.lonsdaleites.ru
              gateways:
                - gateway/vault-gateway
              routes:
                - path:
                    prefix: /
                  service: vault-vault-contour.vault.svc.cluster.local
                  port: 8200