141 lines
4.2 KiB
YAML
141 lines
4.2 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: istio-config
|
|
namespace: default
|
|
spec:
|
|
interval: 5m
|
|
timeout: 10m
|
|
dependsOn:
|
|
- name: istio-base
|
|
namespace: istio-system
|
|
- name: istiod
|
|
namespace: istio-system
|
|
- name: cert-manager
|
|
namespace: cert-manager
|
|
values:
|
|
global:
|
|
env: vk-infra
|
|
environments:
|
|
vk-infra:
|
|
certManager:
|
|
clusterIssuers:
|
|
letsencrypt-issuer-istio:
|
|
spec:
|
|
acme:
|
|
email: pavel@sarex.io
|
|
privateKeySecretRef:
|
|
name: letsencrypt-istio-account-key
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
solvers:
|
|
- http01:
|
|
ingress:
|
|
class: istio
|
|
podTemplate:
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: istio-registry-secret
|
|
certificates:
|
|
vault-tls:
|
|
dnsNames:
|
|
- vault.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
spec:
|
|
duration: 2160h0m0s
|
|
renewBefore: 360h0m0s
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
kb-tls:
|
|
dnsNames:
|
|
- kb.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
spec:
|
|
duration: 2160h0m0s
|
|
renewBefore: 360h0m0s
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
idp-tls:
|
|
dnsNames:
|
|
- iam.sarex.io
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
spec:
|
|
duration: 2160h0m0s
|
|
renewBefore: 360h0m0s
|
|
privateKey:
|
|
rotationPolicy: Always
|
|
istio:
|
|
gateways:
|
|
vault:
|
|
name: vault-gateway
|
|
namespace: istio-system
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- hosts:
|
|
- vault.infra.sarex.tech
|
|
tls:
|
|
credentialName: vault-tls
|
|
mode: SIMPLE
|
|
kb:
|
|
name: kb-gateway
|
|
namespace: istio-system
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- hosts:
|
|
- kb.infra.sarex.tech
|
|
tls:
|
|
credentialName: kb-tls
|
|
mode: SIMPLE
|
|
idp:
|
|
name: idp-gateway
|
|
namespace: istio-system
|
|
selector:
|
|
istio: ingressgateway
|
|
servers:
|
|
- hosts:
|
|
- iam.sarex.io
|
|
tls:
|
|
credentialName: idp-tls
|
|
mode: SIMPLE
|
|
virtualServices:
|
|
vault-virt-service:
|
|
namespace: istio-system
|
|
hosts:
|
|
- vault.infra.sarex.tech
|
|
gateways:
|
|
- istio-system/vault-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: vault-vault-contour-active.vault.svc.cluster.local
|
|
port: 8200
|
|
kb-virt-service:
|
|
namespace: istio-system
|
|
hosts:
|
|
- kb.infra.sarex.tech
|
|
gateways:
|
|
- istio-system/kb-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: kb-service.kb.svc.cluster.local
|
|
port: 80
|
|
idp-virt-service:
|
|
namespace: istio-system
|
|
hosts:
|
|
- iam.sarex.io
|
|
gateways:
|
|
- istio-system/idp-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: idp.zitadel.svc.cluster.local
|
|
port: 8080
|