360 lines
12 KiB
YAML
360 lines
12 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
||
kind: HelmRelease
|
||
metadata:
|
||
name: istio-config
|
||
namespace: default
|
||
spec:
|
||
# istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod/ingressgateway
|
||
# в кластере нет — с зависимостями из base релиз никогда не станет Ready.
|
||
# cert-manager нужен: этот релиз создаёт ClusterIssuer и Certificate
|
||
dependsOn:
|
||
- name: cert-manager
|
||
namespace: cert-manager
|
||
interval: 5m
|
||
timeout: 10m
|
||
values:
|
||
global:
|
||
env: yc-ecp
|
||
environments:
|
||
yc-ecp:
|
||
namespaces: []
|
||
certManager:
|
||
# чарт рендерит ClusterIssuer как `spec: {{ toYaml $ci.spec }}`,
|
||
# поэтому спека обязана лежать под ключом spec
|
||
clusterIssuers:
|
||
letsencrypt-prod:
|
||
spec:
|
||
acme:
|
||
email: "sarex@sarex.io"
|
||
server: "https://acme-v02.api.letsencrypt.org/directory"
|
||
privateKeySecretRef:
|
||
name: letsencrypt-prod
|
||
solvers:
|
||
- http01:
|
||
ingress:
|
||
class: istio
|
||
# solver-под создаётся контроллером в namespace
|
||
# сертификата, values чарта cert-manager на него
|
||
# не действуют — pull-секрет задаётся здесь
|
||
podTemplate:
|
||
spec:
|
||
imagePullSecrets:
|
||
- name: dockerhub
|
||
# ключ = имя Certificate И имя секрета: версия чарта в OCI-репозитории
|
||
# поле secretName не читает, а берёт имя ключа
|
||
certificates:
|
||
gitea-tls-secret:
|
||
namespace: istio-system
|
||
dnsNames:
|
||
- gitea.invest.cps.sarex.lonsdaleites.ru
|
||
issuerRef:
|
||
name: letsencrypt-prod
|
||
kind: ClusterIssuer
|
||
vault-tls:
|
||
namespace: istio-system
|
||
dnsNames:
|
||
- vault.invest.cps.sarex.lonsdaleites.ru
|
||
issuerRef:
|
||
name: letsencrypt-prod
|
||
kind: ClusterIssuer
|
||
dashboard-tls:
|
||
namespace: istio-system
|
||
dnsNames:
|
||
- dashboard.invest.cps.sarex.lonsdaleites.ru
|
||
issuerRef:
|
||
name: letsencrypt-prod
|
||
kind: ClusterIssuer
|
||
aero-invest-tls-secret:
|
||
namespace: istio-system
|
||
dnsNames:
|
||
- aero.invest.sarex.io
|
||
issuerRef:
|
||
name: letsencrypt-prod
|
||
kind: ClusterIssuer
|
||
istio:
|
||
gateways:
|
||
gitea:
|
||
name: gitea-gateway
|
||
namespace: gateway
|
||
servers:
|
||
- hosts:
|
||
- gitea.invest.cps.sarex.lonsdaleites.ru
|
||
httpPortName: http
|
||
httpsPortName: https
|
||
tls:
|
||
credentialName: gitea-tls-secret
|
||
vault:
|
||
name: vault-gateway
|
||
namespace: gateway
|
||
servers:
|
||
- hosts:
|
||
- vault.invest.cps.sarex.lonsdaleites.ru
|
||
httpPortName: http
|
||
httpsPortName: https
|
||
tls:
|
||
credentialName: vault-tls
|
||
main:
|
||
name: main-gateway
|
||
namespace: gateway
|
||
servers:
|
||
- hosts:
|
||
- aero.invest.sarex.io
|
||
httpPortName: http
|
||
httpsPortName: https
|
||
tls:
|
||
credentialName: aero-invest-tls-secret
|
||
dashboard:
|
||
name: dashboard-gateway
|
||
namespace: gateway
|
||
servers:
|
||
- hosts:
|
||
- dashboard.invest.cps.sarex.lonsdaleites.ru
|
||
# без http-сервера порт 80 для этого хоста остаётся
|
||
# автогенерируемому ingress-шлюзу, через который
|
||
# cert-manager отдаёт HTTP-01 challenge
|
||
onlyHttps: true
|
||
httpsPortName: https
|
||
tls:
|
||
credentialName: dashboard-tls
|
||
# имя VirtualService = ключ, поле name чарт игнорирует.
|
||
# noCors: чарт иначе навешивает corsPolicy с дефолтными origins sarex.io
|
||
virtualServices:
|
||
gitea-virt-service:
|
||
namespace: gateway
|
||
noCors: true
|
||
hosts:
|
||
- gitea.invest.cps.sarex.lonsdaleites.ru
|
||
gateways:
|
||
- gateway/gitea-gateway
|
||
routes:
|
||
- path:
|
||
prefix: /
|
||
service: gitea.gitea.svc.cluster.local
|
||
port: 3000
|
||
vault-virt-service:
|
||
namespace: gateway
|
||
noCors: true
|
||
hosts:
|
||
- vault.invest.cps.sarex.lonsdaleites.ru
|
||
gateways:
|
||
- gateway/vault-gateway
|
||
routes:
|
||
- path:
|
||
prefix: /
|
||
service: vault-vault-contour.vault.svc.cluster.local
|
||
port: 8200
|
||
dashboard-virt-service:
|
||
namespace: gateway
|
||
noCors: true
|
||
hosts:
|
||
- dashboard.invest.cps.sarex.lonsdaleites.ru
|
||
gateways:
|
||
- gateway/dashboard-gateway
|
||
routes:
|
||
- path:
|
||
prefix: /
|
||
service: dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local
|
||
port: 80
|
||
|
||
# # --- aero.invest.sarex.io / main-gateway ---
|
||
# backend-service-virt-service:
|
||
# namespace: gateway
|
||
# hosts:
|
||
# - aero.invest.sarex.io
|
||
# gateways:
|
||
# - gateway/main-gateway
|
||
# cors:
|
||
# allowHeaders:
|
||
# - Authorization
|
||
# - Content-Type
|
||
# allowMethods:
|
||
# - GET
|
||
# - POST
|
||
# - PUT
|
||
# - PATCH
|
||
# - HEAD
|
||
# - DELETE
|
||
# routes:
|
||
# - path:
|
||
# prefix: /admin/
|
||
# service: backend-service.django.svc.cluster.local
|
||
# port: 8000
|
||
# - path:
|
||
# prefix: /api
|
||
# service: backend-service.django.svc.cluster.local
|
||
# port: 8000
|
||
#
|
||
# s3-proxy-virt-service:
|
||
# namespace: gateway
|
||
# hosts:
|
||
# - aero.invest.sarex.io
|
||
# gateways:
|
||
# - gateway/main-gateway
|
||
# cors:
|
||
# allowHeaders:
|
||
# - Authorization
|
||
# - Content-Type
|
||
# allowMethods:
|
||
# - GET
|
||
# - POST
|
||
# - PUT
|
||
# - PATCH
|
||
# - HEAD
|
||
# - DELETE
|
||
# routes:
|
||
# - path:
|
||
# prefix: /s3/
|
||
# rewrite: /
|
||
# service: s3-bim-service.django.svc.cluster.local
|
||
# port: 80
|
||
# - path:
|
||
# prefix: /media/
|
||
# rewrite: /
|
||
# service: s3-service.django.svc.cluster.local
|
||
# port: 80
|
||
#
|
||
# frontend-vs:
|
||
# namespace: gateway
|
||
# noCors: true
|
||
# hosts:
|
||
# - aero.invest.sarex.io
|
||
# gateways:
|
||
# - gateway/main-gateway
|
||
# routes:
|
||
# # без path — маршрут без match, catch-all, как в кластере;
|
||
# # он должен оставаться последним по порядку сопоставления
|
||
# - service: frontend-service.django.svc.cluster.local
|
||
# port: 80
|
||
#
|
||
# bim-api-gazpromcps-api-virt-service:
|
||
# namespace: gateway
|
||
# hosts:
|
||
# - aero.invest.sarex.io
|
||
# gateways:
|
||
# - gateway/main-gateway
|
||
# cors:
|
||
# allowHeaders:
|
||
# - Authorization
|
||
# - Content-Type
|
||
# allowMethods:
|
||
# - GET
|
||
# - POST
|
||
# - PUT
|
||
# - PATCH
|
||
# - HEAD
|
||
# - DELETE
|
||
# routes:
|
||
# - path:
|
||
# prefix: /bim-gazpromcps/api/
|
||
# rewrite: /api/
|
||
# service: bim-api-gazpromcps-service.bim.svc.cluster.local
|
||
# port: 80
|
||
# - path:
|
||
# prefix: /bim-gazpromcps/files/
|
||
# rewrite: /files/
|
||
# service: bim-api-gazpromcps-service.bim.svc.cluster.local
|
||
# port: 80
|
||
#
|
||
# bim-backend-v2-api-virt-service:
|
||
# namespace: gateway
|
||
# hosts:
|
||
# - aero.invest.sarex.io
|
||
# gateways:
|
||
# - gateway/main-gateway
|
||
# cors:
|
||
# allowHeaders:
|
||
# - Authorization
|
||
# - Content-Type
|
||
# allowMethods:
|
||
# - GET
|
||
# - POST
|
||
# - PUT
|
||
# - PATCH
|
||
# - HEAD
|
||
# - DELETE
|
||
# routes:
|
||
# - path:
|
||
# prefix: /bim2-gazpromcps/api/
|
||
# rewrite: /api/
|
||
# service: bim-backend-v2-service.bim.svc.cluster.local
|
||
# port: 80
|
||
#
|
||
# eav-virt-service:
|
||
# namespace: gateway
|
||
# hosts:
|
||
# - aero.invest.sarex.io
|
||
# gateways:
|
||
# - gateway/main-gateway
|
||
# cors:
|
||
# allowHeaders:
|
||
# - Authorization
|
||
# - Content-Type
|
||
# allowMethods:
|
||
# - POST
|
||
# - GET
|
||
# - PATCH
|
||
# - DELETE
|
||
# - HEAD
|
||
# - PUT
|
||
# - OPTIONS
|
||
# routes:
|
||
# - path:
|
||
# prefix: /eav/api/
|
||
# rewrite: /api/
|
||
# service: eav-service.eav.svc.cluster.local
|
||
# port: 8000
|
||
# noCors: true
|
||
# - path:
|
||
# prefix: /eav/admin/
|
||
# rewrite: /eav/admin/
|
||
# service: eav-service.eav.svc.cluster.local
|
||
# port: 8000
|
||
#
|
||
# api-virt-service:
|
||
# namespace: gateway
|
||
# hosts:
|
||
# - aero.invest.sarex.io
|
||
# gateways:
|
||
# - gateway/main-gateway
|
||
# cors:
|
||
# allowHeaders:
|
||
# - Authorization
|
||
# - Content-Type
|
||
# allowMethods:
|
||
# - GET
|
||
# - POST
|
||
# - PUT
|
||
# - PATCH
|
||
# - HEAD
|
||
# - DELETE
|
||
# routes:
|
||
# - path:
|
||
# prefix: /workflows/api/
|
||
# rewrite: /api/
|
||
# service: workflows-backend-service.processing.svc.cluster.local
|
||
# port: 80
|
||
#
|
||
# projects-frontend-static-virt-service:
|
||
# namespace: gateway
|
||
# hosts:
|
||
# - aero.invest.sarex.io
|
||
# gateways:
|
||
# - gateway/main-gateway
|
||
# cors:
|
||
# allowHeaders:
|
||
# - Authorization
|
||
# - Content-Type
|
||
# allowMethods:
|
||
# - GET
|
||
# - POST
|
||
# - PUT
|
||
# - PATCH
|
||
# - HEAD
|
||
# - DELETE
|
||
# routes:
|
||
# - path:
|
||
# prefix: /projects/static/
|
||
# rewrite: /
|
||
# service: projects-frontend-static-service.projects.svc.cluster.local
|
||
# port: 80
|