kubernetes/apps/security/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: security
+
+components:
+  - ../../components/sops
+
+resources:
+  - ./namespace.yaml
+  - ./vault/ks.yaml

kubernetes/apps/security/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: security
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled

kubernetes/apps/security/vault/app/helmrelease.yaml

@@ -0,0 +1,75 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault
+spec:
+  chart:
+    spec:
+      chart: vault
+      version: 0.34.1
+      sourceRef:
+        kind: HelmRepository
+        name: hashicorp
+  interval: 1h
+  maxHistory: 3
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    crds: CreateReplace
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  values:
+    global:
+      enabled: true
+      tlsDisable: true
+    injector:
+      enabled: false
+    csi:
+      enabled: false
+    server:
+      # standalone + integrated storage (raft) на PVC. После рестарта пода Vault
+      # остаётся запечатанным (sealed) — распечатывается вручную ключами из
+      # Shamir-схемы (key-shares=5, key-threshold=3).
+      # authDelegator нужен для auth-метода kubernetes, через который
+      # external-secrets получает токен (TokenReview).
+      authDelegator:
+        enabled: true
+      standalone:
+        enabled: true
+        config: |
+          ui = true
+
+          listener "tcp" {
+            address         = "[::]:8200"
+            cluster_address = "[::]:8201"
+            tls_disable     = 1
+          }
+
+          storage "raft" {
+            path = "/vault/data"
+          }
+
+          service_registration "kubernetes" {}
+      dataStorage:
+        enabled: true
+        size: 5Gi
+        storageClass: openebs-hostpath
+        accessMode: ReadWriteOnce
+      service:
+        enabled: true
+        type: ClusterIP
+      resources:
+        requests:
+          cpu: 100m
+          memory: 256Mi
+        limits:
+          memory: 512Mi
+    ui:
+      enabled: true
+      serviceType: ClusterIP
+      externalPort: 8200
+      targetPort: 8200

kubernetes/apps/security/vault/app/helmrepository.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: hashicorp
+spec:
+  interval: 12h
+  url: https://helm.releases.hashicorp.com

kubernetes/apps/security/vault/app/httproute.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vault
+spec:
+  hostnames:
+    - vault.${SECRET_DOMAIN}
+  parentRefs:
+    # Внимание: http-листенер envoy-internal принимает маршруты только из
+    # namespace network (allowedRoutes.namespaces.from: Same), поэтому маршруты
+    # из других namespace цепляются к https-листенеру (from: All). Сертификат
+    # grachevko-ru-production-tls подписан ClusterIssuer internal-ca, то есть
+    # самоподписанным CA — его нужно импортировать в доверенные на клиенте.
+    - name: envoy-internal
+      namespace: network
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: vault-ui
+          port: 8200
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

kubernetes/apps/security/vault/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrepository.yaml
+  - ./helmrelease.yaml
+  - ./httproute.yaml

kubernetes/apps/security/vault/ks.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vault
+spec:
+  dependsOn:
+    - name: localpv-provisioner
+      namespace: storage
+  interval: 1h
+  path: ./kubernetes/apps/security/vault/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: security
+  wait: true
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: vault
+      namespace: security

kubernetes/apps/storage/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: storage
+
+components:
+  - ../../components/sops
+
+resources:
+  - ./namespace.yaml
+  - ./localpv-provisioner/ks.yaml

kubernetes/apps/storage/localpv-provisioner/app/helmrelease.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: localpv-provisioner
+spec:
+  chart:
+    spec:
+      chart: localpv-provisioner
+      version: 4.6.0
+      sourceRef:
+        kind: HelmRepository
+        name: openebs
+  interval: 1h
+  maxHistory: 3
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    crds: CreateReplace
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  values:
+    analytics:
+      enabled: false
+    # openebs-hostpath объявляется StorageClass по умолчанию: PVC без явного
+    # storageClassName биндятся в /var/openebs/local на ноде, где оказался под.
+    hostpathClass:
+      isDefaultClass: true
+    localpv:
+      basePath: /var/openebs/local

kubernetes/apps/storage/localpv-provisioner/app/helmrepository.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: openebs
+spec:
+  interval: 12h
+  url: https://openebs.github.io/dynamic-localpv-provisioner

kubernetes/apps/storage/localpv-provisioner/app/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrepository.yaml
+  - ./helmrelease.yaml

kubernetes/apps/storage/localpv-provisioner/ks.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: localpv-provisioner
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/storage/localpv-provisioner/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: storage
+  wait: true
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: localpv-provisioner
+      namespace: storage

kubernetes/apps/storage/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: storage
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled