apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: istio-config
  namespace: default
spec:
  interval: 5m
  timeout: 10m
  dependsOn:
    - name: istio-base
      namespace: istio-system
    - name: istiod
      namespace: istio-system
    - name: cert-manager
      namespace: cert-manager
  values:
    global:
      env: vk-infra
    environments:
      vk-infra:
        certManager:
          clusterIssuers:
            letsencrypt-issuer-istio:
              spec:
                acme:
                  email: pavel@sarex.io
                  privateKeySecretRef:
                    name: letsencrypt-istio-account-key
                  server: https://acme-v02.api.letsencrypt.org/directory
                  solvers:
                    - http01:
                        ingress:
                          class: istio
                          podTemplate:
                            spec:
                              imagePullSecrets:
                                - name: istio-registry-secret
          certificates:
            vault-tls:
              dnsNames:
                - vault.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
              spec:
                duration: 2160h0m0s
                renewBefore: 360h0m0s
                privateKey:
                  rotationPolicy: Always
            kb-tls:
              dnsNames:
                - kb.infra.sarex.tech
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
              spec:
                duration: 2160h0m0s
                renewBefore: 360h0m0s
                privateKey:
                  rotationPolicy: Always
            idp-tls:
              dnsNames:
                - iam.sarex.io
              issuerRef:
                name: letsencrypt-issuer-istio
                kind: ClusterIssuer
              spec:
                duration: 2160h0m0s
                renewBefore: 360h0m0s
                privateKey:
                  rotationPolicy: Always
        istio:
          gateways:
            vault:
              name: vault-gateway
              namespace: istio-system
              selector:
                istio: ingressgateway
              servers:
                - hosts:
                    - vault.infra.sarex.tech
                  tls:
                    credentialName: vault-tls
                    mode: SIMPLE
            kb:
              name: kb-gateway
              namespace: istio-system
              selector:
                istio: ingressgateway
              servers:
                - hosts:
                    - kb.infra.sarex.tech
                  tls:
                    credentialName: kb-tls
                    mode: SIMPLE
            idp:
              name: idp-gateway
              namespace: istio-system
              selector:
                istio: ingressgateway
              servers:
                - hosts:
                    - iam.sarex.io
                  tls:
                    credentialName: idp-tls
                    mode: SIMPLE
          virtualServices:
            vault-virt-service:
              namespace: istio-system
              hosts:
                - vault.infra.sarex.tech
              gateways:
                - istio-system/vault-gateway
              routes:
                - path:
                    prefix: /
                  service: vault-vault-contour-active.vault.svc.cluster.local
                  port: 8200
            kb-virt-service:
              namespace: istio-system
              hosts:
                - kb.infra.sarex.tech
              gateways:
                - istio-system/kb-gateway
              routes:
                - path:
                    prefix: /
                  service: kb-service.kb.svc.cluster.local
                  port: 80
            idp-virt-service:
              namespace: istio-system
              hosts:
                - iam.sarex.io
              gateways:
                - istio-system/idp-gateway
              routes:
                - path:
                    prefix: /
                  service: idp.zitadel.svc.cluster.local
                  port: 8080