Руководство по установке#

parameters {
        // metadata
        string(name: 'RELEASE_VERSION',description: 'version')
        //docker
        choice(name: 'DOCKER_REGISTRY_URL',description:'Host Regestry by upload and base docker image',
                choices: [
                    'docker-xxx.registry-ci.xxxxx.mycompany.ru',
                    'docker-release.registry-ci.xxxxx.mycompany.ru',
                    'registry.domain.xxxx.ru',
                    ' xxx.sw.sbc.space'
                ]
        )
        choice(name: 'BASE_IMAGE',
               choices: [
                   'registry-ci.xxxxx.mycompany.ru/base/redhat.io/openjdk/openjdk-11-rhel8:1.0-8',
                   'registry.domain.xxxx.ru/base/redhat/openjdk/openjdk-11-rhel8:1.0-8',
                   'xxx.sw.sbc.space/xxx_dev/ci90000087_asgtmq_dev/alt-sp8/openjdk-11:v0.1'
                        ], 
               description: 'Choose base image')
        string(name: 'DOCKER_CREDENTIAL_ID', description: 'nexus credentials id by upload party and owner distrib', defaultValue: 'CAB-SA-DVO00330_pass')
        choice(name: 'DOCKER_REGISTRY_PATH',
               choices:[
                   "ci00859819/ci02633323",
                   "docker-release/pprb/ci00859819/ci00859822_pprb-currency-rates",
                   "pprb/ci00859819/ci00859822_pprb-currency-rates",
                   "pprb-dev/ci00859819/ci00859822_pprb-currency-rates_dev",
                   "pprb/ci00859819/ci00859822_pprb-currency-rates",
                   "xxx_dev/ci90000071_crtx_dev",
                   "xxx/ci90000071_crtx"
               ],
               description: 'regestry path docker' )
        //nexus       
        choice(name: 'NEXUS_URL', 
               choices:[
                   "HTTPs://mycompany-nexus.xxxxx.mycompany.ru/nexus/content/repositories/Nexus_PROD",
                   "HTTPs://xxx.sw.sbc.space/nexus-cd/repository/xxx_PROD",
                                      "HTTPs://xxx.delta.xxxx.ru",
                   "HTTPs://sbrf-nexus.domain.mycompany.ru"
               ], 
               description: "" )
        choice(name: 'NEXUS_REPO_ID',
               choices:[
                   "Nexus_PROD",
                   "Nexus_PROD_OUT",
                   "xxx_PROD",
                   "SERVICE_PACKAGE_snapshot"

               ]
        )
        string(name: 'NEXUS_ARTIFACT_ID', description: 'ArtifactId ex: CI00859822_PPRB_ExchangeRates', defaultValue: 'CI02633323_PPRB_KV_CLOUD')
        string(name: 'NEXUS_CREDENTIAL_ID',description: 'You Nexus Credentialid', defaultValue: 'CAB-SA-DVO00330_pass')
        string(name: 'MAVEN_JENKINS_SETTINGS_XML', defaultValue: "95638388-5179-457e-b055-51a67aeda86d", description: "settings xml by upload distrib" )
        choice(name: 'NEXUS_GROUP_ID',
               choices:[
                   "Nexus_PROD",
                   "xxx_PROD.CI90000071_crtx.4g",
                   "---"

               ]
        )
        // distrib
        string(name: 'FULL_DISTR_URL', description: 'Nexus url by full distrib')

        booleanParam( defaultValue: true,description: 'NO_UPLOAD_NEXUS',name: 'NO_UPLOAD_NEXUS')
        booleanParam( defaultValue: true, description:'Использовать для проверок в отсутствии дистрибутива party и owner', name: 'USE_EXTRACT')
        booleanParam( defaultValue: true, description:'Использовать для проверок в отсутствии дистрибутива party и owner', name: 'NO_UPLOAD_EXTRACT_DISTR')

    }

kubectl create serviceaccount jenkins

serviceaccount "jenkins" created

kubectl get serviceaccounts jenkins -o yaml

kubectl get secret <имя сервисного аккаунта>-token-*  -o yaml

apiVersion: v1
data:
  ca.crt: (APISERVER'S CA BASE64 ENCODED)
------------
  token: (BEARER TOKEN BASE64 ENCODED)
kind: Secret
metadata:
  # ...
type: kubernetes.io/service-account-token

   [ req ]
   default_bits       = 2048
   distinguished_name = req_distinguished_name
   req_extensions     = req_ext
   prompt = no
    
   [ req_distinguished_name ]
   countryName                 = RU
   stateOrProvinceName         = MOW
   localityName                = MOW
   organizationName            = SBRF
   commonName                  = currency−rates.dev−apps.ocp−geo.domain.mycompany.ru
    
   [ req_ext ]
   subjectAltName = @alt_names
    
   [alt_names]
   DNS.1   = currency−rates−token.<your_domen>
   DNS.2   = currency−rates−token.<your_domen>
   DNS.3   = currency−rates−token.<your_domen>
   DNS.4   = currency−rates.<your_domen>
   DNS.5   = currency−rates.<your_domen>
   DNS.6   = currency−rates.<your_domen>
   DNS.7   = currency−rates−HTTPs.<your_domen>

openssl req −out request.csr −newkey rsa:2048 −nodes −keyout tls.key −config request.cnf

   openssl x509 −inform DER −in request.cer −out tls.crt

   openssl x509 −inform DER −in "Test Root CA 2.cer" −out root.pem

   openssl x509 −inform DER −in "Test Issuing CA 2.cer" −out issuing.pem

   cat root.pem issuing.pem > ca.pem

ssl.ose.istio.keyStore.ingress.password=
ssl.ose.istio.keyStore.egress.password=

# --------------------------------------------------
# Файл описывающий состав дистрибутива
# Secrets которые возьмутся из _passwords.conf (Common репозиторий)
secrets: [
  # База данных CR MAIN 
  "DB_CURRATE_MAIN_LOGIN",
  "DB_CURRATE_MAIN_PASSWORD",
  # База данных СR SI 
  "DB_CURRATE_STANDIN_LOGIN",
  "DB_CURRATE_STANDIN_PASSWORD",
  #
  "DB_EKPIT_MAIN_LOGIN",
  "DB_EKPIT_MAIN_PASSWORD",
  "DB_EKPIT_STANDIN_LOGIN",
  "DB_EKPIT_STANDIN_PASSWORD",
  #
  "MESSENGER_KAFKA_SSL_KEY_STORE_PASSWORD",
  "MESSENGER_KAFKA_SSL_TRUST_STORE_PASSWORD",
  # пароль от закрытого ключа
  "MESSENGER_KAFKA_SSL_PRIVATE_KEY_PASSWORD",
  #
  "OTT_CERTSTORE_PWD",
  "OTT_TRUST_STORE_PWD",
  # пароль от закрытого ключа
  "OTT_CERTSTORE_PRIVATE_KEY_PWD",
  #
  "AJ_KEYSTORE_PASSWORD",
  "AJ_TRUSTORE_PASSWORD",
  # пароль от закрытого ключа
  "AJ_KEY_PRIVATE_KEY_PASSWORD"
]

$files = (Get-ChildItem *_d).FullName
$vault_cred_openshift_ops='<your pass encrypt>'
ForEach ($file in $files){
    echo $file

    openssl enc -aes-256-cbc -k $vault_cred_openshift_ops -in $file -out $file.TrimEnd('_d') 
}

kind: Secret
apiVersion: v1
metadata:
  name: secret-aj
type: Opaque
data:
  keystore.jks: <base64 enc jks store >
  truststore.jks: <base64 enc jks store >

kind: Secret
apiVersion: v1
metadata:
  name: secret-egress-ca-certs
type: Opaque
data:
  ca.pem: <base 64 cert pem >

kind: Secret
apiVersion: v1
metadata:
  name: secret-egress-certs
  labels:
    app: crtx
type: Opaque
data:
  tls.crt: <base64 enc jks store >
  tls.key: <base64 enc jks store >

kind: Secret
apiVersion: v1
metadata:
  name: secret-ingress-ca-certs
type: Opaque
data:
  ca.pem:<base 64 cert pem>

kind: Secret
apiVersion: v1
metadata:
  name: secret-ingress-certs
  labels:
    app: crtx
type: Opaque
data:
  tls.crt: <base64 enc jks store > 
  tls.key: <base64 enc jks store >

kind: Secret
apiVersion: v1
metadata:
  name: secret-mq
  labels:
    app: crtx
type: Opaque
data:
  keystore.jks: <base64 enc jks store > 
  truststore.jks: <base64 enc jks store >

kind: Secret
apiVersion: v1
metadata:
  name: secret-ott-certs
type: Opaque
data:
  keystore.jks: <base64 enc jks store >
  truststore.jks: <base64 enc jks store >

keytool −importcert −file ./root_ca.cer −keystore ./ott_truststore.p12 −alias "root_ca"

SECMAN_ENABLED: true;

istio_ose_istio_egress_secman_timeout: 2s
istio_ose_istio_egress_destination_rule_secman_TFP_CONN_POLL_TCP_MAX_CONN: 400
istio_ose_istio_egress_destination_rule_secman_OUT_DETECTION_CONSECUTIVE_GATEWAY_ERRORS: 5
istio_ose_istio_egress_destination_rule_secman_OUT_DETECTION_INTERVAL: 1m
istio_ose_istio_egress_destination_rule_secman_OUT_DETECTION_BASE_EJECTION_TIME: 5m
istio_ose_istio_egress_destination_rule_secman_OUT_DETECTION_MAX_EJECTION_PERCENT: 100

crtx_secman_ose_deployment_spec_template_metadata_labels_secman_injector: enabled
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_agent_inject: true
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_agent_init_first: false
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_agent_pre_populate: false
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_agent_inject_default_template: json

crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_secret_cr_app_yaml: /app/secrets
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_agent_inject_secret_secret_cr_app_yaml: /app/secrets

crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_aj_keystore_jks: /app/certs/aj
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_aj_truststore_jks: /app/certs/aj

crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_mk_keystore_jks: /app/certs/messenger-kafka
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_mk_truststore_jks: /app/certs/messenger-kafka

crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_arr_keystore_jks: /app/certs/ark-rates-receiver-kafka
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_arr_truststore_jks: /app/certs/ark-rates-receiver-kafka

crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_ingress_chain_crt: /etc/istio/gateway-ca-certs
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_ingress_tls_crt: /etc/istio/gateway-certs
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_ingress_tls_key: /etc/istio/gateway-certs

crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_ott_keystore_p12: /mnt/secrets
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_ott_truststore_p12: /mnt/secrets

crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_egress_chain_crt: /etc/istio/gateway-ca-certs
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_egress_tls_crt: /etc/istio/gateway-certs
crtx_secman_ose_deployment_spec_metadata_annotations_vault_hashicorp_com_secret_volume_path_egress_tls_key: /etc/istio/gateway-certs

{    
"AJ_KEYSTORE_PASSWORD": "",
"AJ_TRUSTORE_PASSWORD": "",
"ARK_RATES_RECEIVER_KAFKA_SSL_KEY_STORE_PASSWORD": "",
"ARK_RATES_RECEIVER_KAFKA_SSL_PRIVATE_KEY_PASSWORD": "",
"ARK_RATES_RECEIVER_KAFKA_SSL_TRUST_STORE_PASSWORD": "",
"DB_CURRATE_MAIN_LOGIN": "currency_rates",
"DB_CURRATE_MAIN_PASSWORD": "",
"DB_CURRATE_STANDIN_LOGIN": "currency_rates",
"DB_CURRATE_STANDIN_PASSWORD": "",
"MESSENGER_KAFKA_SSL_KEY_STORE_PASSWORD": "",
"MESSENGER_KAFKA_SSL_PRIVATE_KEY_PASSWORD": "",
"MESSENGER_KAFKA_SSL_TRUST_STORE_PASSWORD": "",
"OTT_CERTSTORE_PRIVATE_KEY_PWD": "",
"OTT_CERTSTORE_PWD": "",
"OTT_TRUST_STORE_PWD": ""
}

"DB_EKPIT_MAIN_LOGIN": "",
"DB_EKPIT_MAIN_PASSWORD": "",
"DB_EKPIT_STANDIN_LOGIN": "",
"DB_EKPIT_STANDIN_PASSWORD": ""

{
"keystore.jks": "",
"truststore.jks": ""
}

{
"keystore.jks": "",
"truststore.jks": ""
}

{
"keystore.jks": "",
"truststore.jks": ""
}

{
"chain.crt": "",
"tls.crt": "",
"tls.key": ""
}

{
"chain.crt": "",
"tls.crt": "",
"tls.key": ""
}

{
"keystore.jks": "",
"truststore.jks": ""
}

DEPLOY_LIMITS: true;

  name: rate-limit-config
  namespace: tribe-pf-dev-crtx-vdc06-01
  labels:
    proj: synapse-rls
    agent: srls
    version: D-02.003.00-36
spec:
  endpoints: # 6 endpoints — на каждый gateway (HTTPs, HTTPs-geo, HTTPs-geo-smart, ott, ott-geo, ott-geo-smart)
    — endpoint: crtx-HTTPs-kb-tribe-pf-dev-crtx-vdc06-01.apps.stands-vdc01.solution.xxx:8443
      name: crtx-HTTPs
      shortname: crtxh
      overall_limit: -1
      by_header:
        header: module_id
        unit: second
        value: -1
        uri_prefixes:
          — unit: second
            uri_prefix: /<app_directory>.integration.api.cb.CentralBankRates
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.individual.ExchangeRatesForIndividuals
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.legal.ExchangeRatesForLegalEntities
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.financial.FinancialQuotes
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.interbank.InterbankRates
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.supplementary.ExchangeRatesSupplementary
            value: -1
      name: crtx-ott-geo
      shortname: crtxog
      overall_limit: -1
      by_header:
        header: module_id
        unit: second
        value: -1
        uri_prefixes:
          — unit: second
            uri_prefix: /<app_directory>.integration.api.cb.CentralBankRates
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.individual.ExchangeRatesForIndividuals
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.legal.ExchangeRatesForLegalEntities
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.financial.FinancialQuotes
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.interbank.InterbankRates
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.supplementary.ExchangeRatesSupplementary
            value: -1
    — endpoint: crtx-kb-tribe-pf-dev-crtx-vdc06-01.geo-smart.apps.stands-vdc01.solution.xxx:5443
      name: crtx-ott-geo-smart
      shortname: crtxogs
      overall_limit: -1
      by_header:
        header: module_id
        unit: second
        value: -1
        uri_prefixes:
          — unit: second
            uri_prefix: /<app_directory>.integration.api.cb.CentralBankRates
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.individual.ExchangeRatesForIndividuals
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.legal.ExchangeRatesForLegalEntities
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.financial.FinancialQuotes
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.interbank.InterbankRates
            value: -1
          — unit: second
            uri_prefix: /<app_directory>.cloud.api.supplementary.ExchangeRatesSupplementary
            value: -1
  rlnamespace: tribe-pf-dev-crtx-vdc06-01
  rlserver: rate-limiter-headless-service.tribe-pf-dev-crtx-vdc06-01.svc.cluster.local
  rlserverport: 8081
  visibility: namespace
  workloadSelector:
    labels:
      app: crtx-ingress
      istio: tribe-pf-dev-crtx-vdc06-01-ingress

   endpoints: [
   {
   "endpoint": "crtx-HTTPs-kb-tribe-pf-dev-crtx-vdc06-01.apps.stands-vdc01.solution.xxx:8443",
   "name": "crtx-HTTPs",
   "shortname": "crtxh",
   "overall_limit": -1,
   "by_header": {
   "header": "subsystemCode",
   "unit": "second",
   "value": -1,
   "uri_prefixes": [
   {
   "uri_prefix": "/<app_directory>.integration.api.cb.CentralBankRates",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/<app_directory>.cloud.api.individual.ExchangeRatesForIndividuals",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/<app_directory>.cloud.api.legal.ExchangeRatesForLegalEntities",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/<app_directory>.cloud.api.financial.FinancialQuotes",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/<app_directory>.cloud.api.interbank.InterbankRates",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/<app_directory>.cloud.api.supplementary.ExchangeRatesSupplementary",
   "unit": "second",
   "value": -1
   }
   ]
   }
   },
   {
   "endpoint": "crtx-kb-tribe-pf-dev-crtx-vdc06-01.geo-smart.apps.stands-vdc01.solution.xxx:5443",
   "name": "crtx-ott-geo-smart",
   "shortname": "crtxogs",
   "overall_limit": -1,
   "by_header": {
   "header": "subsystemCode",
   "unit": "second",
   "value": -1,
   "uri_prefixes": [
   {
   "uri_prefix": "/<app_directory>.integration.api.cb.CentralBankRates",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/<app_directory>.cloud.api.individual.ExchangeRatesForIndividuals",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/<app_directory>.cloud.api.legal.ExchangeRatesForLegalEntities",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/<app_directory>.cloud.api.financial.FinancialQuotes",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/<app_directory>.cloud.api.interbank.InterbankRates",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/<app_directory>.cloud.api.supplementary.ExchangeRatesSupplementary",
   "unit": "second",
   "value": -1
   }
   ]
   }
   }
   ]

    apiVersion: v1
    kind: Service
    metadata:
        # Пример названия сервиса
        name: unimon-sandbox-micrometer
        annotations:
            description: "Exposes Micrometer-Prometheus App by CLuster Ip"
            # Аннотация для включения сбора метрик
            prometheus.io.scrape: "true"
            # Аннотация для указания HTTP endpoint с метриками приложения
            # Путь указывается полностью, например если при тестирование
            # вы переходите на endpoint HTTP://localhost:8081/actuator/prometheus
            prometheus.io.path: "/actuator/prometheus"
            # Аннотация для указания порта подключения к HTTP endpoint с метриками
            # Внимание!!! порт может меняться на стороне потребителя, "8081" указан как пример   
            prometheus.io.port: "8081"
        labels:
            app: unimon-sandbox-micrometer
    spec:
        ports:
        — name: HTTP
          port: 8080
          targetPort: 8080
        — name: HTTP-actuator
          port: 8081
          targetPort: 8081
    selector:
        app: unimon-sandbox-micrometer

   keytool −genkey −keyalg EC −sigalg SHA256withECDSA −keystore ${module_id}.p12 −storetype PKCS12 −keysize 256 −dname "CN=${module_id}" −alias ${module_id}

   keytool −certreq −keyalg EC −sigalg SHA256withECDSA −keystore ${module_id}.p12 −storetype PKCS12 −alias ${module_id} > ${module_id}_cert_req.pem

   ./ejbcawsracli.sh certreq %{module_id} "CN=%{module_id}" NULL PlatformCA_EC PPRBModule %{module_id}_cert_req.pem PKCS10 PEM NONE

   keytool −import −keystore ${module_id}.p12 −storetype PKCS12 −file PlatformCA_EC.pem −alias PlatformCA_EC
   keytool −import −keystore ${module_id}.p12 −storetype PKCS12 −file ${module_id}.pem −alias ${module_id}

CR_NAMESPACE: ci00642380−idevgen2−dynamic−pricing−ift

jdbc_db_currate_main_url= jdbc:postgresql://10.2x.xx.xx:5432/crtxdev?currentSchema=currency_rates

jdbc_db_currate_main_host = 10.2x.xx.xx
jdbc_db_currate_main_ip = 10.2x.xx.xx
jdbc_db_currate_main_port = 5432\

… 
#currate db egrees 
# const mapping port 
istio_ose_istio_egress_svc_spec_ports_db_currate_main_mapping_port=5555
istio_ose_istio_egress_svc_spec_ports_db_currate_main_failover_mapping_port=5556
istio_ose_istio_egress_svc_spec_ports_db_currate_si_mapping_port=5556
istio_ose_istio_egress_svc_spec_ports_db_currate_si_failover_mapping_port=5557
#host
istio_ose_istio_egress_db_currate_main_host=${jdbc_db_currate_main_host}
istio_ose_istio_egress_db_currate_main_failover_host=${jdbc_db_currate_main_failover_host}
istio_ose_istio_egress_db_currate_si_host=${jdbc_db_currate_si_host}
istio_ose_istio_egress_db_currate_si_failover_host=${jdbc_db_currate_si_failover_host}
# ip
istio_ose_istio_egress_db_currate_main_ip=${jdbc_db_currate_main_ip}
istio_ose_istio_egress_db_currate_main_failover_ip=${jdbc_db_currate_main_failover_ip}
istio_ose_istio_egress_db_currate_si_ip=${jdbc_db_currate_si_ip}
istio_ose_istio_egress_db_currate_si_failover_ip=${jdbc_db_currate_si_failover_ip}
# port 
istio_ose_istio_egress_db_currate_main_port=${jdbc_db_currate_main_port}
istio_ose_istio_egress_db_currate_main_failover_port=${jdbc_db_currate_main_failover_port}
istio_ose_istio_egress_db_currate_si_port=${jdbc_db_currate_si_port}
istio_ose_istio_egress_db_currate_si_failover_port=${jdbc_db_currate_si_failover_port}
…

apiVersion: networking.istio.io/v1alpha3
    kind: ServiceEntry
    metadata:
      name: se-db-currency-main
    spec:
      addresses:
        — {{istio_ose_istio_egress_db_currate_main_ip }}/32
      endpoints:
        — address: {{ istio_ose_istio_egress_db_currate_main_ip }}
      exportTo:
        — .
      hosts:
        — {{ istio_ose_istio_egress_db_currate_main_host }}
      location: MESH_EXTERNAL
      ports:
        — name: tcp-{{ istio_ose_istio_egress_db_currate_main_port }}
          number: {{ istio_ose_istio_egress_db_currate_main_port }} 
          protocol: TCP
      resolution: STATIC

    apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: gw-cr-egress-db-currency-main
    spec:
      selector:
        istio: crtx-egress
      servers:
        — hosts:
            — {{ istio_ose_istio_egress_db_currate_main_host }}
          port:
            name: tcp-{{ istio_ose_istio_egress_db_currate_main_port }}
            number: {{ istio_ose_istio_egress_db_currate_main_port }}
            protocol: TCP

	
      apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: vs-cr-egress-db-currency-main
    spec:
      exportTo:
        — .
      gateways:
        — gw-cr-egress-db-currency-main
        — mesh
      hosts:
        — {{ istio_ose_istio_egress_svc_spec_ports_db_currate_main_host }}
      tcp:
        — match:
            — gateways:
                — mesh
              port: {{ istio_ose_istio_egress_svc_spec_ports_db_currate_main_port }}
          route:
            — destination:
                host: svc-cr-egress
                port:
                  number: {{ istio_ose_istio_egress_svc_spec_ports_db_currate_main_mapping_port }}
              weight: 100
        — match:
            — gateways:
                — gw-cr-egress-db-currency-main
              port: {{ istio_ose_istio_egress_svc_spec_ports_db_currate_main_mapping_port }}
          route:
            — destination:
                host: {{ istio_ose_istio_egress_db_currate_main_host }}
                port:
                  number: {{ istio_ose_istio_egress_db_currate_main_port }}
              weight: 100

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRuleF
metadata:
 labels:
   external: database
name: dr-dp-egress-${DB_CURRENCY_MAIN_HOST}
spec:
  exportTo:
    — .
  host: {{ istio_ose_istio_egress_db_currate_main_host }}
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      — port:
       number: {{ istio_ose_istio_egress_db_currate_main_mapping_port }}
      connectionPool:
        tcp:
          connectTimeout: {{ istio_ose_istio_egress_db_connectionPool_tcp_connectTimeout }}

          maxConnections:{{ istio_ose_istio_egress_db_connectionPool_tcp_maxConnections }}
          tcpKeepalive:
            time: {{ istio_ose_istio_egress_db_connectionPool_tcpKeepalive_time }}
            interval: {{ istio_ose_istio_egress_db_connectionPool_tcpKeepalive_interval }}

kind: Secret
apiVersion: v1
metadata:
  name: secret-crtx.unver
type: Opaque
data:
  DB_CURRATE_MAIN_LOGIN: <base64 enc >
  DB_CURRATE_MAIN_PASSWORD:  <base64 enc >
  # База данных СR SI 
  DB_CURRATE_STANDIN_LOGIN:  <base64 enc >
  DB_CURRATE_STANDIN_PASSWORD:  <base64 enc >
  #
  DB_EKPIT_MAIN_LOGIN:  <base64 enc >
  DB_EKPIT_MAIN_PASSWORD:  <base64 enc >
  DB_EKPIT_STANDIN_LOGIN:  <base64 enc >
  DB_EKPIT_STANDIN_PASSWORD:  <base64 enc >
  #
  MESSENGER_KAFKA_SSL_KEY_STORE_PASSWORD:  <base64 enc >
  MESSENGER_KAFKA_SSL_TRUST_STORE_PASSWORD:  <base64 enc >
  # пароль от закртытого ключа
  MESSENGER_KAFKA_SSL_PRIVATE_KEY_PASSWORD:  <base64 enc >
  #
  OTT_CERTSTORE_PWD:  <base64 enc >
  OTT_TRUST_STORE_PWD:  <base64 enc >
  # пароль от закртытого ключа
  OTT_CERTSTORE_PRIVATE_KEY_PWD:  <base64 enc >
  #
  AJ_KEYSTORE_PASSWORD:  <base64 enc >
  AJ_TRUSTORE_PASSWORD:  <base64 enc >
  # пароль от закртытого ключа
  AJ_KEY_PRIVATE_KEY_PASSWORD: <base64 enc >

kubectl apply -f <имя файла манифеста> -n <пространство имен для установки>

--
- hosts: 127.0.0.1_
  connection: local
  tasks: 
  — name: "template" 
    ansible.builtin.template:
      src : package/conf/k8s/base/crtx-cb-cloud-app/dc.yaml
      dest: ./<Директория для хранения итоговых манифестов>

ansible-playbook ./pipline.yaml --extra-vars "@package/conf/config/parameters/crtx-cb-cloud-app.all.conf" --extra-vars @/package/conf/config/parameters/crtx-istio-sidecar.all.conf  --extra-vars @/package/conf/custom_property.conf

apiVersion: apps/v1
kind: Deployment
metadata:
  name: crtx-cb-cloud-app
labels:  
  app: crtx-cb-cloud-app
spec:
  progressDeadlineSeconds: 300
  replicas: 1
  revisionHistoryLimit: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: "25%"
      maxUnavailable: "25%"
  selector:
    matchLabels:
      app: crtx-cb-cloud-app
  template:
    metadata:
      labels:
        app: crtx-cb-cloud-app
      annotations:
        sidecar.istio.io/inject: "True"
        sidecar.istio.io/rewriteAppHTTPProbers: "True"
    spec:
      restartPolicy: Always
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          — weight: 100
            podAffinityTerm:             
              labelSelector:
                matchExpressions:
                — key: app
                  operator: In
                  values:
                  — crtx-cb-cloud-app
              topologyKey: kubernetes.io/hostname
      containers:
      # app cb
        — resources:
            limits: 
              cpu: "1"
              memory: "2Gi"
            requests: 
              cpu: "1"
              memory: "2Gi"
          securityContext:
            readOnlyRootFilesystem: true 
          readinessProbe:
            HTTPGet: 
              path: /actuator/health/readiness
              port: 8081
              scheme: HTTP
            initialDelaySeconds: 160
            timeoutSeconds: 2
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          livenessProbe:
            HTTPGet: 
              path: /actuator/health/liveness
              port: 8081
              scheme: HTTP
            timeoutSeconds: 2
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 6
          startupProbe:
            failureThreshold: 50
            HTTPGet: 
              path: /actuator/health/liveness
              port: 8081
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          terminationMessagePath: /dev/termination-log
          name: crtx-cb-cloud-app
          env:
            — name: PROJECT_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            — name: NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            — name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            — name: POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
          ports:
            — containerPort: 8080
              protocol: TCP
            — containerPort: 8081
              protocol: TCP
          imagePullPolicy: Always
          volumeMounts:
            — { name: temp, mountPath: /tmp }
            — { name: applogs, mountPath: /tmp/logs }
            — { name: logback-config, readOnly: true, mountPath: /app/etc/logger }
            — { name: aj-secrets, readOnly: true, mountPath: /app/certs/aj }
            — { name: configmap-cr-app, readOnly: true, mountPath: /app/etc }
          envFrom:
            — configMapRef:
                name: crtx-cm-cb-cloud-app
            — secretRef:
                name: secret-crtx.${distrib.release.version}
          image:  "test/test@###IMAGE###"
        # logger  
      securityContext: 
        runAsNonRoot: true
      imagePullSecrets:
        — name: "default"
      volumes:
        — { name: temp, emptyDir: {} }
        — { name: applogs, emptyDir: {} }
        — name: logback-config
          configMap:
            name: crtx-cm-cb-cloud-app-logback
            defaultMode: 256
        — name: aj-secrets
          secret:
            secretName: secret-aj.${distrib.release.version}
            defaultMode: 256
            optional: true
        — name: configmap-cr-app
          configMap:
            name: crtx-cm-cb-cloud-app
            defaultMode: 256
      dnsPolicy: ClusterFirst

Kubectl apply -f <ваш обработанный. Манифест > -n <пространство имен в k8s>

   — apiVersion: networking.istio.io/v1alpha3
       kind: EnvoyFilter
       metadata:
         name: crtx-ef-mon
       spec:
         configPatches:
           — applyTo: HTTP_FILTER
             match:
               context: GATEWAY
               listener:
                 filterChain:
                   filter:
                     name: envoy.HTTP_connection_manager
                 portNumber: 5443
             patch:
               operation: INSERT_BEFORE
               value:
                 name: envoy.ext_authz
                 config:
                   failure_mode_allow: false
                   grpc_service:
                     google_grpc:
                       stat_prefix: ext_authz
                       target_uri: unix:/mnt/ott-uds-socket/ott.socket
                     timeout: 1s
                   with_request_body:
                     allow_partial_message: false
                     max_request_bytes: 1048576
         workloadSelector:
           labels:
             app: ${EGRESS_MON_GATEWAY_NAME}-${CR_NAMESPACE}

    apiVersion: v1
    kind: Service
    metadata:
      name: crtx-svc-egress-mon
      labels:
        app.kubernetes.io/component: istio-discovery
        app.kubernetes.io/name: istio-discovery
        app.kubernetes.io/part-of: istio
        istio.io/rev: basic
        release: istio
    spec:
      ports:
        — {name: HTTP-8080, port: 8080, protocol: TCP, targetPort: 8080}
        — {name: HTTPs-5443, port: 5443, protocol: TCP, targetPort: 5443}
      selector:
        istio: crtx-egress-mon

  apiVersion: v1
kind: Service
metadata:
  name: crtx-egress
  labels:
    app.kubernetes.io/component: istio-discovery
    app.kubernetes.io/managed-by: maistra-istio-operator
    app.kubernetes.io/name: istio-discovery
    app.kubernetes.io/part-of: istio
    istio.io/rev: basic
spec:
  ports:
    # ott+mTLS
    — name: HTTPs-5443, 
      port: 5443
      protocol: TCP
      targetPort: 5443
    # db curate mapping port
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_db_currate_main_mapping_port }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_db_currate_main_mapping_port }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_db_currate_main_mapping_port }} 
    # db curate failover mapping port
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_db_currate_main_failover_mapping_port }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_db_currate_main_failover_mapping_port }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_db_currate_main_failover_mapping_port }}
    # db curate si mapping port
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_db_currate_si_mapping_port }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_db_currate_si_mapping_port }}
      protocol: TCP
      targetPort: tcp-{{ istio_ose_istio_egress_svc_spec_ports_db_currate_si_mapping_port }}
    # db curate si failover port
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_db_currate_si_failover_mapping_port }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_db_currate_si_failover_mapping_port }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_db_currate_si_failover_mapping_port }}
    # db ekpit main mapping port
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_main_mapping_port }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_main_mapping_port }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_main_mapping_port }}
    # db ekpit main failover port 
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_main_failover_mapping_port }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_main_failover_mapping_port }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_main_failover_mapping_port }}
    # db ekpit si mapping port
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_si_mapping_port }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_si_mapping_port }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_si_mapping_port }}
    # db ekpit si failover port 
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_si_failover_mapping_port }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_si_failover_mapping_port }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_db_ekpit_si_failover_mapping_port }}
    # aj mapping port 1
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_1 }} 
      port: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_1 }} 
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_1 }}
    # aj mapping port 2
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_2 }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_2 }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_2 }}
      # aj mapping port 3
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_3 }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_3 }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_3 }}
      # aj mapping port 4
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_4 }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_4 }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_4 }}
      # aj mapping port 5
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_5 }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_5 }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_5 }}
    # aj mapping port 6
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_6 }}
      port: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_6 }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_aj_kafka_mapping_port_6 }}
    # messenger kafak port 1
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_1 }} 
      port: {{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_1 }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_1 }}
    # messenger kafak port 2
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_2 }} 
      port: {{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_2 }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_2 }}
    # messenger kafak port 3
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_3 }} 
      port: {{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_3 }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_3 }}
    # messenger kafak port 4
    — name: tcp-{{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_4 }} 
      port: {{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_4 }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_svc_spec_ports_messenger_kafka_mapping_port_4 }}
    # nsi facade 
    — name: tcp-{{ istio_ose_istio_egress_nsi_mapping_port }}
      port: {{ istio_ose_istio_egress_nsi_mapping_port }}
      protocol: TCP
      targetPort: {{ istio_ose_istio_egress_nsi_mapping_port }}

  selector:
    istio: crtx-egress
type: ClusterIP

- apiVersion: networking.istio.io/v1alpha3
    kind: ServiceEntry
    metadata:
      labels:
        external: integration-nsi-facade
      name: crtx-se-nsi-facade-service
    spec:
      exportTo:
        — .
      hosts:
        — ${ istio_ose_istio_egress_nsi_host }
      location: MESH_EXTERNAL
      ports:
        — name: HTTP-80
          number: 80
          protocol: HTTP
        — name: HTTPs-443
          number: 443
          protocol: TLS
      resolution: DNS

  — apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      labels:
        external: integration-nsi-facade
      name: crtx-gw-nsi-facade
    spec:
      selector:
        istio: crtx-egress
      servers:
        — hosts:
        — - {{ istio_ose_istio_egress_nsi_host }}
          port:
            name: HTTP-5443
            number: 5443 # PORT EGRESS ДЛЯ mTLS+OTT
            protocol: HTTP

  — apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      labels:
        external: integration-nsi-facade
      name: crtx-vs-nsi-facade
    spec:
      exportTo:
        — .
      gateways:
        — crtx-gw-nsi-facade
        — mesh
      hosts:
        — {{ istio_ose_istio_egress_nsi_host }}
      HTTP:
        — match:
            — gateways:
                — mesh
              port: 80
          rewrite:
            authority: {{ istio_ose_istio_egress_nsi_host  }}
          route:
            — destination:
                host: crtx-svc-egress
                port:
                  number: 5443
              weight: 100
          retries:
            attempts: 2
            retryOn: gateway-error,connect-failure,refused-stream
        — match:
            — gateways:
                — gw-cr-egress-nsi-facade
              port: 5443
          route:
            — destination:
                host: ${NSI_FACADE_HOST}
                port:
                  number: 443
              weight: 100
          retries:
            attempts: 2
            retryOn: gateway-error,connect-failure,refused-stream

  — apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      labels:
        external: integration-nsi-facade
      name: crtx-dr--nsi-facade
    spec:
      exportTo:
        — .
      host: {{ istio_ose_istio_egress_nsi_host }}
      trafficPolicy:
        loadBalancer:
          simple: ROUND_ROBIN
        portLevelSettings:
          — port:
              number: 443
            tls:
              caCertificates: /etc/istio/gateway-ca-certs/ca.pem
              clientCertificate: /etc/istio/gateway-certs/tls.crt
              mode: MUTUAL
              privateKey: /etc/istio/gateway-certs/tls.key
              sni: {{ istio_ose_istio_egress_nsi_host }}

- apiVersion: networking.istio.io/v1alpha3
    kind: ServiceEntry
    metadata:
      labels:
        external: logger
      name: crtx-se-logger-service
    spec:
      exportTo:
        — .
      hosts:
        — ${LOGGER_HOST}
      location: MESH_EXTERNAL
      ports:
        — name: HTTP-80
          number: 80
          protocol: HTTP
        — name: HTTPs-443
          number: 443
          protocol: TLS
      resolution: DNS

- apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      labels:
        external: logger
      name: crtx-gw-logger
    spec:
      selector:
        istio: crtx-egress-mon
      servers:
        — hosts:
            — ${LOGGER_HOST}
          port:
            name: HTTP-5443 # Порт на egress mTLS+OTT
            number: 5443
            protocol: HTTP

  — apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      labels:
        external: logger
      name: crtx-vs-logger
    spec:
      exportTo:
        — .
      gateways:
        — crtx-gw-logger
        — mesh
      hosts:
        — {{ istio_ose_istio_egress_logger_host }}
      HTTP:
        — match:
            — gateways:
                — mesh
              port: 80
          rewrite:
            authority: {{ istio_ose_istio_egress_logger_host }}
          route:
            — destination:
                host: crtx-svc-egress-mon
                port:
                  number: 5443
              weight: 100
          retries:
            attempts: 2
            retryOn: gateway-error,connect-failure,refused-stream
        — match:
            — gateways:
                — gw-cr-egress-logger
              port: 5443
          route:
            — destination:
                host: ${LOGGER_HOST}
                port:
                  number: 443
              weight: 100
          retries:
            attempts: 2
           
            retryOn: gateway-error,connect-failure,refused-stream

  — apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      labels:
        external: logger
      name: dr-cr-egress-logger
    spec:
      exportTo:
        — .
      host: ${LOGGER_HOST}
      trafficPolicy:
        loadBalancer:
          simple: ROUND_ROBIN
        portLevelSettings:
          — port:
              number: 443
            tls:
              caCertificates: /etc/istio/gateway-ca-certs/ca.pem
              clientCertificate: /etc/istio/gateway-certs/tls.crt
              mode: MUTUAL
              privateKey: /etc/istio/gateway-certs/tls.key
              sni: ${LOGGER_HOST}

- apiVersion: networking.istio.io/v1alpha3
    kind: ServiceEntry
    metadata:
      labels:
        external: integration-audit
      name: se-cr-audit-service
    spec:
      exportTo:
        — .
      hosts:
        — ${AUDIT_HOST}
      location: MESH_EXTERNAL
      ports:
        — name: HTTP-80
          number: 80
          protocol: HTTP
        — name: HTTPs-443
          number: 443
          protocol: TLS
      resolution: DNS

- apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      labels:
        external: integration-audit
      name: gw-cr-egress-audit
    spec:
      selector:
        istio: ${EGRESS_MON_GATEWAY_ISTIO_LABEL}
      servers:
        — hosts:
            — ${AUDIT_HOST}
          port:
            name: HTTP-5443
            number: 5443
            protocol: HTTP

- apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      labels:
        external: integration-audit
      name: vs-cr-egress-audit
    spec:
      exportTo:
        — .
      gateways:
        — gw-cr-egress-audit
        — mesh
      hosts:
        — ${AUDIT_HOST}
      HTTP:
        — match:
            — gateways:
                — mesh
              port: 80
          rewrite:
            authority: ${AUDIT_HOST}
          route:
            — destination:
                host: svc-cr-egress-for-mon
                port:
                  number: 5443
              weight: 100
          retries:
            attempts: 2
            perTryTimeout: 1s
            retryOn: gateway-error,connect-failure,refused-stream
        — match:
            — gateways:
                — gw-cr-egress-audit
              port: 5443
          route:
            — destination:
                host: ${AUDIT_HOST}
                port:
                  number: 443
              weight: 100
          retries:
            attempts: 2
            perTryTimeout: 1s
            retryOn: gateway-error,connect-failure,refused-stream

- apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      labels:
        external: integration-audit
      name: dr-cr-egress-audit
    spec:
      exportTo:
        — .
      host: ${AUDIT_HOST}
      trafficPolicy:
        loadBalancer:
          simple: ROUND_ROBIN
        portLevelSettings:
          — port:
              number: 443
            tls:
              caCertificates: /etc/istio/gateway-ca-certs/ca.pem
              clientCertificate: /etc/istio/gateway-certs/tls.crt
              mode: MUTUAL
              privateKey: /etc/istio/gateway-certs/tls.key
              sni: ${AUDIT_HOST}