apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: istio-config namespace: default spec: # istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod/ingressgateway # в кластере нет — с зависимостями из base релиз никогда не станет Ready. # cert-manager нужен: этот релиз создаёт ClusterIssuer и Certificate dependsOn: - name: cert-manager namespace: cert-manager interval: 5m timeout: 10m values: global: env: yc-ecp environments: yc-ecp: namespaces: [] certManager: # чарт рендерит ClusterIssuer как `spec: {{ toYaml $ci.spec }}`, # поэтому спека обязана лежать под ключом spec clusterIssuers: letsencrypt-prod: spec: acme: email: "sarex@sarex.io" server: "https://acme-v02.api.letsencrypt.org/directory" privateKeySecretRef: name: letsencrypt-prod solvers: - http01: ingress: class: istio # solver-под создаётся контроллером в namespace # сертификата, values чарта cert-manager на него # не действуют — pull-секрет задаётся здесь podTemplate: spec: imagePullSecrets: - name: dockerhub # ключ = имя Certificate И имя секрета: версия чарта в OCI-репозитории # поле secretName не читает, а берёт имя ключа certificates: gitea-tls-secret: namespace: istio-system dnsNames: - gitea.invest.cps.sarex.lonsdaleites.ru issuerRef: name: letsencrypt-prod kind: ClusterIssuer vault-tls: namespace: istio-system dnsNames: - vault.invest.cps.sarex.lonsdaleites.ru issuerRef: name: letsencrypt-prod kind: ClusterIssuer dashboard-tls: namespace: istio-system dnsNames: - dashboard.invest.cps.sarex.lonsdaleites.ru issuerRef: name: letsencrypt-prod kind: ClusterIssuer aero-invest-tls-secret: namespace: istio-system dnsNames: - aero.invest.sarex.io issuerRef: name: letsencrypt-prod kind: ClusterIssuer istio: gateways: gitea: name: gitea-gateway namespace: gateway servers: - hosts: - gitea.invest.cps.sarex.lonsdaleites.ru httpPortName: http httpsPortName: https tls: credentialName: gitea-tls-secret vault: name: vault-gateway namespace: gateway servers: - hosts: - vault.invest.cps.sarex.lonsdaleites.ru httpPortName: http httpsPortName: https tls: credentialName: vault-tls main: name: main-gateway namespace: gateway servers: - hosts: - aero.invest.sarex.io httpPortName: http httpsPortName: https tls: credentialName: aero-invest-tls-secret dashboard: name: dashboard-gateway namespace: gateway servers: - hosts: - dashboard.invest.cps.sarex.lonsdaleites.ru # без http-сервера порт 80 для этого хоста остаётся # автогенерируемому ingress-шлюзу, через который # cert-manager отдаёт HTTP-01 challenge onlyHttps: true httpsPortName: https tls: credentialName: dashboard-tls # имя VirtualService = ключ, поле name чарт игнорирует. # noCors: чарт иначе навешивает corsPolicy с дефолтными origins sarex.io virtualServices: gitea-virt-service: namespace: gateway noCors: true hosts: - gitea.invest.cps.sarex.lonsdaleites.ru gateways: - gateway/gitea-gateway routes: - path: prefix: / service: gitea.gitea.svc.cluster.local port: 3000 vault-virt-service: namespace: gateway noCors: true hosts: - vault.invest.cps.sarex.lonsdaleites.ru gateways: - gateway/vault-gateway routes: - path: prefix: / service: vault-vault-contour.vault.svc.cluster.local port: 8200 dashboard-virt-service: namespace: gateway noCors: true hosts: - dashboard.invest.cps.sarex.lonsdaleites.ru gateways: - gateway/dashboard-gateway routes: - path: prefix: / service: dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local port: 80 # --- aero.invest.sarex.io / main-gateway --- backend-service-virt-service: namespace: gateway hosts: - aero.invest.sarex.io gateways: - gateway/main-gateway cors: allowHeaders: - Authorization - Content-Type allowMethods: - GET - POST - PUT - PATCH - HEAD - DELETE routes: - path: prefix: /admin/ service: backend-service.django.svc.cluster.local port: 8000 - path: prefix: /api service: backend-service.django.svc.cluster.local port: 8000 s3-proxy-virt-service: namespace: gateway hosts: - aero.invest.sarex.io gateways: - gateway/main-gateway cors: allowHeaders: - Authorization - Content-Type allowMethods: - GET - POST - PUT - PATCH - HEAD - DELETE routes: - path: prefix: /s3/ rewrite: / service: s3-bim-service.django.svc.cluster.local port: 80 - path: prefix: /media/ rewrite: / service: s3-service.django.svc.cluster.local port: 80 frontend-vs: namespace: gateway noCors: true hosts: - aero.invest.sarex.io gateways: - gateway/main-gateway routes: # без path — маршрут без match, catch-all, как в кластере; # он должен оставаться последним по порядку сопоставления - service: frontend-service.django.svc.cluster.local port: 80 # # bim-api-gazpromcps-api-virt-service: # namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: # - gateway/main-gateway # cors: # allowHeaders: # - Authorization # - Content-Type # allowMethods: # - GET # - POST # - PUT # - PATCH # - HEAD # - DELETE # routes: # - path: # prefix: /bim-gazpromcps/api/ # rewrite: /api/ # service: bim-api-gazpromcps-service.bim.svc.cluster.local # port: 80 # - path: # prefix: /bim-gazpromcps/files/ # rewrite: /files/ # service: bim-api-gazpromcps-service.bim.svc.cluster.local # port: 80 # # bim-backend-v2-api-virt-service: # namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: # - gateway/main-gateway # cors: # allowHeaders: # - Authorization # - Content-Type # allowMethods: # - GET # - POST # - PUT # - PATCH # - HEAD # - DELETE # routes: # - path: # prefix: /bim2-gazpromcps/api/ # rewrite: /api/ # service: bim-backend-v2-service.bim.svc.cluster.local # port: 80 # # eav-virt-service: # namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: # - gateway/main-gateway # cors: # allowHeaders: # - Authorization # - Content-Type # allowMethods: # - POST # - GET # - PATCH # - DELETE # - HEAD # - PUT # - OPTIONS # routes: # - path: # prefix: /eav/api/ # rewrite: /api/ # service: eav-service.eav.svc.cluster.local # port: 8000 # noCors: true # - path: # prefix: /eav/admin/ # rewrite: /eav/admin/ # service: eav-service.eav.svc.cluster.local # port: 8000 # # api-virt-service: # namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: # - gateway/main-gateway # cors: # allowHeaders: # - Authorization # - Content-Type # allowMethods: # - GET # - POST # - PUT # - PATCH # - HEAD # - DELETE # routes: # - path: # prefix: /workflows/api/ # rewrite: /api/ # service: workflows-backend-service.processing.svc.cluster.local # port: 80 # # projects-frontend-static-virt-service: # namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: # - gateway/main-gateway # cors: # allowHeaders: # - Authorization # - Content-Type # allowMethods: # - GET # - POST # - PUT # - PATCH # - HEAD # - DELETE # routes: # - path: # prefix: /projects/static/ # rewrite: / # service: projects-frontend-static-service.projects.svc.cluster.local # port: 80