terraform-contour-mirror/infrastructure.yaml

current_environment: yc-k8s-test

# Contour branch — one declarative source for ALL closed contours. The concrete
# contour is selected by INFRA_ENV (falls back to current_environment). Entities
# use the SAME schema/contract as the product master branch; only the backend is
# in-cluster (see live/terragrunt.hcl providers). ++ ++ ++ ++ ++
environments:
  ugmk:
    namespaces:
      - name: attachments
        manage: true
        image_pull_secret: true
        labels:
          project: contour
        annotations:
          managed-by: terraform
          istio-injection: disabled
          security.deckhouse.io/pod-policy: privileged

      - name: ugmk-test-app
        manage: true
        image_pull_secret: true
        labels:
          project: contour

    postgresql:
      default_host: 10.222.255.162
      default_port: 5432

    databases:
      - cluster_id: main
        database:
          name: attachments_db
          extensions: []
        user:
          name: attachments
          password_length: 32
          password_special: false
          conn_limit: 20

      - cluster_id: main
        database:
          name: notes_db
          extensions:
            - uuid-ossp
            - pg_stat_statements
        user:
          name: notes
          password_length: 32
          password_special: false
          conn_limit: 20
          permissions:
            - notes_db

      - cluster_id: main
        database:
          name: ugmk_test_db
          extensions:
            - uuid-ossp
            - pg_stat_statements
        user:
          name: ugmk_test_user
          password_length: 32
          password_special: false
          conn_limit: 20
          permissions:
            - attachments_db

    minio: {}
    buckets: []

    kafka:
      # Broker has no authorizer configured (authorizer.class.name unset) —
      # any ACL write is rejected with "Security features are disabled".
      # Topics/users still work; skip ACLs until the broker enables one.
      create_acls: false
      kafka_cluster_refs:
        main:
          bootstrap_servers: kafka-kafka-contour.kafka.svc.cluster.local:9092
          sasl_mechanism: SCRAM-SHA-512
          security_protocol: SASL_PLAINTEXT
          tls_enabled: false
          default_partitions: 3
          default_replication_factor: 1
          max_replication_factor: 1
      topics:
        - name: ugmk.test.event.v1
          owner: ugmk-test-app
          clusterRef: main
          partitions: 3
          replicationFactor: 1
      users:
        - name: ugmk-test-app
          clusterRef: main
          permissions:
            - topic: ugmk.test.event.v1
              roles:
                - PRODUCER

    rabbitmq:
      management_endpoint: http://rabbitmq.rabbitmq.svc.cluster.local:15672
      amqp_host: rabbitmq.rabbitmq.svc.cluster.local
      amqp_port: 5672
      vhosts:
        - name: ugmk-test-vhost
      users:
        - name: ugmk-test-rmq
          password_length: 32
          password_special: false
      permissions:
        - user: ugmk-test-rmq
          vhost: ugmk-test-vhost
          configure: ".*"
          write: ".*"
          read: ".*"
      queues:
        - name: ugmk.test.queue
          vhost: ugmk-test-vhost
          durable: true
          auto_delete: false
          arguments:
            x-queue-type: classic

  yc-k8s-test:
    namespaces: 
      - name: test-namespace
        manage: true
        image_pull_secret: true

      - name: test-namespace-2
        manage: true
        image_pull_secret: true

      - name: signoz
        manage: false
        image_pull_secret: true



    # MinIO endpoint (declarative). Exposed externally on this contour; scheme
    # decides TLS. Admin creds are injected from Vault (secrets/minio/admin).
    minio:
      endpoint: https://minio.contour.infra.sarex.tech

    # In-cluster MinIO. Bucket + dedicated access user (access_key/secret_key).
    buckets:
      - name: test-bucket
        acl: private

    # In-cluster PostgreSQL server (single instance in ns postgresql).
    postgresql:
      default_host: postgresql.postgresql.svc.cluster.local
      default_port: 5432

    databases:
      - cluster_id: incluster
        database:
          name: test_db
          extensions:
            - uuid-ossp
            - pg_stat_statements
        user:
          name: test_user
          password_length: 32
          password_special: false
          conn_limit: 20

    # In-cluster Kafka (Bitnami). clusterRef carries the bootstrap endpoint.
    kafka:
      kafka_cluster_refs:
        contour:
          bootstrap_servers: kafka-kafka-contour.kafka.svc.cluster.local:9092
          sasl_mechanism: SCRAM-SHA-512
          security_protocol: SASL_PLAINTEXT
          tls_enabled: false
          default_partitions: 3
          default_replication_factor: 1
          max_replication_factor: 1
      topics:
        - name: contour.test.event.v1
          owner: contour-test
          clusterRef: contour
          partitions: 3
          replicationFactor: 1
      users:
        - name: contour-test
          clusterRef: contour
          permissions:
            - topic: contour.test.event.v1
              roles:
                - PRODUCER

    # In-cluster RabbitMQ.
    rabbitmq:
      amqp_host: rabbitmq.rabbitmq.svc.cluster.local
      amqp_port: 5672
      vhosts:
        - name: test-vhost
      users:
        - name: test-rmq
          password_length: 32
          password_special: false
      permissions:
        - user: test-rmq
          vhost: test-vhost
          configure: ".*"
          write: ".*"
          read: ".*"
      exchanges:
        - name: test.exchange
          vhost: test-vhost
          type: topic
          durable: true