265 lines
8.7 KiB
YAML
265 lines
8.7 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: istio-config
|
|
namespace: default
|
|
spec:
|
|
interval: 5m
|
|
timeout: 10m
|
|
dependsOn:
|
|
- name: istio-base
|
|
namespace: istio-system
|
|
- name: istiod
|
|
namespace: istio-system
|
|
- name: cert-manager
|
|
namespace: cert-manager
|
|
values:
|
|
global:
|
|
env: vk-prod
|
|
environments:
|
|
vk-prod:
|
|
certManager:
|
|
clusterIssuers:
|
|
letsencrypt-issuer-istio:
|
|
spec:
|
|
acme:
|
|
email: pavel@sarex.io
|
|
privateKeySecretRef:
|
|
name: letsencrypt-istio-account-key
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
solvers:
|
|
- http01:
|
|
ingress:
|
|
class: istio
|
|
podTemplate:
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: istio-registry-secret
|
|
certificates:
|
|
camunda-identity-tls:
|
|
namespace: istio-system
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- camunda-identity.platform.sarex.space
|
|
spec:
|
|
duration: 2160h
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
renewBefore: 360h
|
|
camunda-keycloak-tls:
|
|
namespace: istio-system
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- camunda-keycloak.platform.sarex.space
|
|
spec:
|
|
duration: 2160h
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
renewBefore: 360h
|
|
camunda-operate-tls:
|
|
namespace: istio-system
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- camunda-operate.platform.sarex.space
|
|
spec:
|
|
duration: 2160h
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
renewBefore: 360h
|
|
camunda-optimize-tls:
|
|
namespace: istio-system
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- camunda-optimize.platform.sarex.space
|
|
spec:
|
|
duration: 2160h
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
renewBefore: 360h
|
|
camunda-tasklist-tls:
|
|
namespace: istio-system
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- camunda-tasklist.platform.sarex.space
|
|
spec:
|
|
duration: 2160h
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
renewBefore: 360h
|
|
istio:
|
|
gateways:
|
|
camunda:
|
|
namespace: gateway
|
|
servers:
|
|
- hosts:
|
|
- camunda-keycloak.platform.sarex.space
|
|
tls:
|
|
credentialName: camunda-keycloak-tls
|
|
httpsPortName: keycloak-https-443
|
|
httpPortName: keycloak-http-80
|
|
- hosts:
|
|
- camunda-operate.platform.sarex.space
|
|
tls:
|
|
credentialName: camunda-operate-tls
|
|
httpsPortName: operate-https-443
|
|
httpPortName: operate-http-80
|
|
- hosts:
|
|
- camunda-identity.platform.sarex.space
|
|
tls:
|
|
credentialName: camunda-identity-tls
|
|
httpsPortName: identity-https-443
|
|
httpPortName: identity-http-80
|
|
- hosts:
|
|
- camunda-tasklist.platform.sarex.space
|
|
tls:
|
|
credentialName: camunda-tasklist-tls
|
|
httpsPortName: tasklist-https-443
|
|
httpPortName: tasklist-http-80
|
|
- hosts:
|
|
- camunda-optimize.platform.sarex.space
|
|
tls:
|
|
credentialName: camunda-optimize-tls
|
|
httpsPortName: otpimize-https-443
|
|
httpPortName: optimize-http-80
|
|
virtualServices:
|
|
identity-virt-service:
|
|
namespace: gateway
|
|
hosts:
|
|
- camunda-identity.platform.sarex.space
|
|
gateways:
|
|
- gateway/camunda-gateway
|
|
cors:
|
|
allowHeaders:
|
|
- Authorization
|
|
- Content-Type
|
|
- Identity
|
|
allowMethods:
|
|
- POST
|
|
- GET
|
|
- PATCH
|
|
- DELETE
|
|
- HEAD
|
|
- PUT
|
|
- OPTIONS
|
|
allowOrigins:
|
|
- regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
|
|
omitMaxAge: true
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: camunda-identity.camunda-prod.svc.cluster.local
|
|
keycloak-virt-service:
|
|
namespace: gateway
|
|
hosts:
|
|
- camunda-keycloak.platform.sarex.space
|
|
gateways:
|
|
- gateway/camunda-gateway
|
|
cors:
|
|
allowHeaders:
|
|
- Authorization
|
|
- Content-Type
|
|
- Identity
|
|
allowMethods:
|
|
- POST
|
|
- GET
|
|
- PATCH
|
|
- DELETE
|
|
- HEAD
|
|
- PUT
|
|
- OPTIONS
|
|
allowOrigins:
|
|
- regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
|
|
omitMaxAge: true
|
|
routes:
|
|
- path:
|
|
prefix: /auth/
|
|
service: camunda-keycloak.camunda-prod.svc.cluster.local
|
|
operate-virt-service:
|
|
namespace: gateway
|
|
hosts:
|
|
- camunda-operate.platform.sarex.space
|
|
gateways:
|
|
- gateway/camunda-gateway
|
|
cors:
|
|
allowHeaders:
|
|
- Authorization
|
|
- Content-Type
|
|
- Identity
|
|
allowMethods:
|
|
- POST
|
|
- GET
|
|
- PATCH
|
|
- DELETE
|
|
- HEAD
|
|
- PUT
|
|
- OPTIONS
|
|
allowOrigins:
|
|
- regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
|
|
omitMaxAge: true
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: camunda-operate.camunda-prod.svc.cluster.local
|
|
optimize-virt-service:
|
|
namespace: gateway
|
|
hosts:
|
|
- camunda-optimize.platform.sarex.space
|
|
gateways:
|
|
- gateway/camunda-gateway
|
|
cors:
|
|
allowHeaders:
|
|
- Authorization
|
|
- Content-Type
|
|
- Identity
|
|
allowMethods:
|
|
- POST
|
|
- GET
|
|
- PATCH
|
|
- DELETE
|
|
- HEAD
|
|
- PUT
|
|
- OPTIONS
|
|
allowOrigins:
|
|
- regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
|
|
omitMaxAge: true
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: camunda-optimize.camunda-prod.svc.cluster.local
|
|
tasklist-virt-service:
|
|
namespace: gateway
|
|
hosts:
|
|
- camunda-tasklist.platform.sarex.space
|
|
gateways:
|
|
- gateway/camunda-gateway
|
|
cors:
|
|
allowHeaders:
|
|
- Authorization
|
|
- Content-Type
|
|
- Identity
|
|
allowMethods:
|
|
- POST
|
|
- GET
|
|
- PATCH
|
|
- DELETE
|
|
- HEAD
|
|
- PUT
|
|
- OPTIONS
|
|
allowOrigins:
|
|
- regex: (https://.*\.sarex\.io)|(https://.*\.sarex\.space)|(https://localhost:.*)|(https://clouddevelopment.rt.ru)
|
|
omitMaxAge: true
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: camunda-tasklist.camunda-prod.svc.cluster.local
|