Руководство по установке#

parameters {
        // metadata
        string(name: 'RELEASE_VERSION',description: 'version')
        //docker
        choice(name: 'DOCKER_REGISTRY_URL',description:'Host Regestry by upload and base docker image',
                choices: [
                    'docker-dev.registry-ci.xxxxx.mycompany.ru',
                    'docker-release.registry-ci.xxxxx.mycompany.ru',
                    'registry.xxxxx.yyy.ru',
                    'xxx.sw.sbc.space'
                ]
        )
        choice(name: 'BASE_IMAGE',
               choices: [
                   'registry-ci.xxxxx.mycompany.ru/base/redhat.io/openjdk/openjdk-11-rhel8:1.0-8',
                   'registry.xxxxx.yyy.ru/base/redhat/openjdk/openjdk-11-rhel8:1.0-8',
                   'xxx.sw.sbc.space/sbt_dev/ci90000087_asgtmq_dev/alt-sp8/openjdk-11:v0.1'
                        ],
               description: 'Choose base image')
        string(name: 'DOCKER_CREDENTIAL_ID', description: 'nexus credentials id by upload party and owner distrib', defaultValue: 'CAB-SA-DVO00330_pass')
        choice(name: 'DOCKER_REGISTRY_PATH',
               choices:[
                   "ci00859819/ci02633323",
                   "docker-release/pprb/ci00859819/ci00859822_pprb-pricing",
                   "pprb/ci00859819/ci00859822_pprb-pricing",
                   "pprb-dev/ci00859819/ci00859822_pprb-pricing_dev",
                   "pprb/ci00859819/ci00859822_pprb-pricing",
                   "sbt_dev/ci90000071_dypx_dev",
                   "sbt/ci90000071_dypx"
               ],
               description: 'regestry path docker' )
        //nexus
        choice(name: 'NEXUS_URL',
               choices:[
                   "https://mycompany-nexus.xxxxx.mycompany.ru/nexus/content/repositories/Nexus_PROD",
                   "https://xxx.sw.sbc.space/nexus-cd/repository/sbt_PROD",
                   "https://sbtnexus.xxxxx.yyy.ru",
                   "https://mycompany-nexus.maindomain.mycompany.ru"
               ],
               description: "" )
        choice(name: 'NEXUS_REPO_ID',
               choices:[
                   "Nexus_PROD",
                   "Nexus_PROD_OUT",
                   "sbt_PROD",
                   "SERVICE_PACKAGE_snapshot"

               ]
        )
        string(name: 'NEXUS_ARTIFACT_ID', description: 'ArtifactId ex: CI00859822_PPRB_ExchangeRates', defaultValue: 'CI02633323_PPRB_DP_CLOUD')
        string(name: 'NEXUS_CREDENTIAL_ID',description: 'You Nexus Credentialid', defaultValue: 'CAB-SA-DVO00330_pass')
        string(name: 'MAVEN_JENKINS_SETTINGS_XML', defaultValue: "95638388-5179-457e-b055-51a67aeda86d", description: "settings xml by upload distrib" )
        choice(name: 'NEXUS_GROUP_ID',
               choices:[
                   "Nexus_PROD",
                   "sbt_PROD.CI90000071_dypx.4g",
                   "---"

               ]
        )
        // distrib
        string(name: 'FULL_DISTR_URL', description: 'Nexus url by full distrib')

        booleanParam( defaultValue: true,description: 'NO_UPLOAD_NEXUS',name: 'NO_UPLOAD_NEXUS')
        booleanParam( defaultValue: true, description:'Использовать для проверок в отсутвии дистрибутива party и owner', name: 'USE_EXTRACT')
        booleanParam( defaultValue: true, description:'Использовать для проверок в отсутвии дистрибутива party и owner', name: 'NO_UPLOAD_EXTRACT_DISTR')

    }

kind: Secret
apiVersion: v1
metadata:
  name: secret-dypx.unver
type: Opaque
data:
  DB_PRICING_MAIN_LOGIN: <base64 enc >
  DB_PRICING_MAIN_PASSWORD:  <base64 enc >
  # База данных СR SI
  DB_PRICING_STANDIN_LOGIN:  <base64 enc >
  DB_PRICING_STANDIN_PASSWORD:  <base64 enc >
  #
  DB_EKPIT_MAIN_LOGIN:  <base64 enc >
  DB_EKPIT_MAIN_PASSWORD:  <base64 enc >
  DB_EKPIT_STANDIN_LOGIN:  <base64 enc >
  DB_EKPIT_STANDIN_PASSWORD:  <base64 enc >
  #
  MESSENGER_KAFKA_SSL_KEY_STORE_PASSWORD:  <base64 enc >
  MESSENGER_KAFKA_SSL_TRUST_STORE_PASSWORD:  <base64 enc >
  # пароль от закрытого ключа
  MESSENGER_KAFKA_SSL_PRIVATE_KEY_PASSWORD:  <base64 enc >
  #
  OTT_CERTSTORE_PWD:  <base64 enc >
  OTT_TRUST_STORE_PWD:  <base64 enc >
  # пароль от закрытого ключа
  OTT_CERTSTORE_PRIVATE_KEY_PWD:  <base64 enc >
  #
  AJ_KEYSTORE_PASSWORD:  <base64 enc >
  AJ_TRUSTORE_PASSWORD:  <base64 enc >
  # пароль от закртытого ключа
  AJ_KEY_PRIVATE_KEY_PASSWORD: <base64 enc >

kubectl apply -f <имя файла манифеста> -n <пространство имен для установки>

--
- hosts: 127.0.0.1_
  connection: local
  tasks:
  — name: "template"
    ansible.builtin.template:
      src : package/conf/k8s/base/dypx-pricing-cloud-app/dc.yaml
      dest: ./<Директория для хранения итоговых манифестов>

ansible-playbook ./pipline.yaml --extra-vars "@package/conf/config/parameters/dypx-pricing-cloud-app.all.conf" --extra-vars @/package/conf/config/parameters/dypx-istio-sidecar.all.conf  --extra-vars @/package/conf/custom_property.conf

apiVersion: apps/v1
kind: Deployment
metadata:
  name: dypx-pricing-cloud-app
labels:
  app: dypx-pricing-cloud-app
spec:
  progressDeadlineSeconds: 300
  replicas: 1
  revisionHistoryLimit: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: "25%"
      maxUnavailable: "25%"
  selector:
    matchLabels:
      app: dypx-pricing-cloud-app
  template:
    metadata:
      labels:
        app: dypx-pricing-cloud-app
      annotations:
        sidecar.istio.io/inject: "True"
        sidecar.istio.io/rewriteAppHTTPProbers: "True"
    spec:
      restartPolicy: Always
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          — weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                — key: app
                  operator: In
                  values:
                  — dypx-pricing-cloud-app
              topologyKey: kubernetes.io/hostname
      containers:
      # app cb
        — resources:
            limits:
              cpu: "1"
              memory: "2Gi"
            requests:
              cpu: "1"
              memory: "2Gi"
          securityContext:
            readOnlyRootFilesystem: true
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8081
              scheme: HTTP
            initialDelaySeconds: 160
            timeoutSeconds: 2
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8081
              scheme: HTTP
            timeoutSeconds: 2
            periodSeconds: 10
            successThreshold: 1
            failureThreshold: 6
          startupProbe:
            failureThreshold: 50
            httpGet:
              path: /actuator/health/liveness
              port: 8081
              scheme: HTTP
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          terminationMessagePath: /dev/termination-log
          name: dypx-pricing-cloud-app
          env:
            — name: PROJECT_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            — name: NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            — name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            — name: POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
          ports:
            — containerPort: 8080
              protocol: TCP
            — containerPort: 8081
              protocol: TCP
          imagePullPolicy: Always
          volumeMounts:
            — { name: temp, mountPath: /tmp }
            — { name: applogs, mountPath: /tmp/logs }
            — { name: logback-config, readOnly: true, mountPath: /app/etc/logger }
            — { name: aj-secrets, readOnly: true, mountPath: /app/certs/aj }
            — { name: configmap-dp-app, readOnly: true, mountPath: /app/etc }
          envFrom:
            — configMapRef:
                name: dypx-cm-pricing-cloud-app
            — secretRef:
                name: secret-dypx.${distrib.release.version}
          image:  "test/test@###IMAGE###"
        # logger
      securityContext:
        runAsNonRoot: true
      imagePullSecrets:
        — name: "default"
      volumes:
        — { name: temp, emptyDir: {} }
        — { name: applogs, emptyDir: {} }
        — name: logback-config
          configMap:
            name: dypx-cm-pricing-cloud-app-logback
            defaultMode: 256
        — name: aj-secrets
          secret:
            secretName: secret-aj.${distrib.release.version}
            defaultMode: 256
            optional: true
        — name: configmap-dp-app
          configMap:
            name: dypx-cm-pricing-cloud-app
            defaultMode: 256
      dnsPolicy: ClusterFirst

Kubectl apply -f <ваш обработаный. Манифест > -n <пространсвто имен в k8s>

kubectl create serviceaccount jenkins

serviceaccount "jenkins" created

kubectl get serviceaccounts jenkins -o yaml

kubectl get secret <имя сервисного аккаунта>-token-*  -o yaml

apiVersion: v1
data:
  ca.crt: (APISERVER'S CA BASE64 ENCODED)
------------
  token: (BEARER TOKEN BASE64 ENCODED)
kind: Secret
metadata:
  # ...
type: kubernetes.io/service-account-token

   [ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name
req_extensions     = req_ext
prompt = no

[ req_distinguished_name ]
countryName                 = RU
stateOrProvinceName         = MOW
localityName                = MOW
organizationName            = MYCOMPANY
commonName                  = pricing−rates.dev−apps.ocp−geo.maindomain.mycompany.ru

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
DNS.1   = dynamic-pricing−https.<your_domen>
DNS.2   = dynamic-pricing−https <your_domen>
DNS.3   = dynamic-pricing−https.<your_domen>
DNS.4   = dynamic-pricing−ott.<your_domen>
DNS.5   = dynamic-pricing−ott<your_domen>
DNS.6   = dynamic-pricing−ott.<your_domen>

openssl req −out request.csr −newkey rsa:2048 −nodes −keyout tls.key −config request.cnf

# --------------------------------------------------
# Файл описывающий состав дистрибутива
# Secrets которые возьмутся из _passwords.conf (Common репозиторий)
secrets: [
  # База данных CR MAIN
  "PRICE_DB_LOGIN_MAIN",
  “PRICE_DB_PASSWORD_MAIN",
  # База данных СR SI
  "PRICE_DB_LOGIN_CI",
  “PRICE_DB_PASSWORD_CI",
  #
  "DB_EKPIT_MAIN_LOGIN",
  "DB_EKPIT_MAIN_PASSWORD",
  "DB_EKPIT_STANDIN_LOGIN",
  "DB_EKPIT_STANDIN_PASSWORD",
  #
  "OTT_CERTSTORE_PWD",
  "OTT_TRUST_STORE_PWD",
  # пароль от закрытого ключа
  "OTT_CERTSTORE_PRIVATE_KEY_PWD",
  #
  "AJ_KEYSTORE_PASSWORD",
  "AJ_TRUSTORE_PASSWORD",
  # пароль от закрытого ключа
  "AJ_KEY_PRIVATE_KEY_PASSWORD"
]

extra-secrets: [
  "secret-aj",
  "secret-ott-certs",
  "secret-ingress-certs",
  "secret-ingress-ca-certs",
  "secret-egress-certs",
  "secret-egress-ca-certs"
]

$files = (Get-ChildItem *_d).FullName
$vault_cred_openshift_ops='<your pass encrypt>'
ForEach ($file in $files){
    echo $file

    openssl enc -aes-256-cbc -k $vault_cred_openshift_ops -in $file -out $file.TrimEnd('_d')
}

kind: Secret
apiVersion: v1
metadata:
  name: secret-aj
type: Opaque
data:
  keystore.jks: <base64 enc jks store >
  truststore.jks: <base64 enc jks store >

kind: Secret
apiVersion: v1
metadata:
  name: secret-egress-ca-certs
type: Opaque
data:
  ca.pem: <base 64 cert pem >

kind: Secret
apiVersion: v1
metadata:
  name: secret-egress-certs
  labels:
    app: dypx
type: Opaque
data:
  tls.crt: <base64 enc jks store >
  tls.key: <base64 enc jks store >

kind: Secret
apiVersion: v1
metadata:
  name: secret-ingress-ca-certs
type: Opaque
data:
  ca.pem:<base 64 cert pem>

kind: Secret
apiVersion: v1
metadata:
  name: secret-ingress-certs
  labels:
    app: dypx
type: Opaque
data:
  tls.crt: <base64 enc jks store >
  tls.key: <base64 enc jks store >

kind: Secret
apiVersion: v1
metadata:
  name: secret-ott-certs
type: Opaque
data:
  keystore.jks: <base64 enc jks store >
  truststore.jks: <base64 enc jks store >

keytool −importcert −file ./root_ca.cer −keystore ./ott_truststore.p12 −alias "root_ca"

SECMAN_ENABLED: true;

istio_ose_istio_egress_secman_timeout: 2s
istio_ose_istio_egress_destination_rule_secman_TFP_CONN_POLL_TCP_MAX_CONN: 400
istio_ose_istio_egress_destination_rule_secman_OUT_DETECTION_CONSECUTIVE_GATEWAY_ERRORS: 5
istio_ose_istio_egress_destination_rule_secman_OUT_DETECTION_INTERVAL: 1m
istio_ose_istio_egress_destination_rule_secman_OUT_DETECTION_BASE_EJECTION_TIME: 5m
istio_ose_istio_egress_destination_rule_secman_OUT_DETECTION_MAX_EJECTION_PERCENT: 100

dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_log_level=info
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_role=${secman_role}
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_namespace=${secman_namespace}

dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_secret_volume_path_secret_app_yaml=/app/secrets
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_agent_inject_secret_secret_app_yaml=${secman_secret_dp_path}

dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_agent_inject_template_aj_keystore_jks=${secman_secret_aj_path}
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_secret_volume_path_aj_keystore_jks=/app/certs/aj

dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_agent_inject_template_aj_truststore_jks=${secman_secret_aj_path}
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_secret_volume_path_aj_truststore_jks=/app/certs/aj

dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_secret_volume_path_egress_chain_crt=/etc/istio/gateway-ca-certs
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_secret_volume_path_egress_tls_crt=/etc/istio/gateway-certs
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_secret_volume_path_egress_tls_key=/etc/istio/gateway-certs
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_agent_inject_secret_egress_chain_crt=${secman_secret_egress_path}
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_agent_inject_secret_egress_tls_crt=${secman_secret_egress_path}
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_agent_inject_secret_egress_tls_key=${secman_secret_egress_path}

dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_secret_volume_path_ingress_chain_crt=/etc/istio/gateway-ca-certs
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_secret_volume_path_ingress_tls_crt=/etc/istio/gateway-certs
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_secret_volume_path_ingress_tls_key=/etc/istio/gateway-certs
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_agent_inject_secret_ingress_chain_crt=${secman_secret_ingress_path}
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_agent_inject_secret_ingress_tls_crt=${secman_secret_ingress_path}
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_agent_inject_secret_ingress_tls_key=${secman_secret_ingress_path}

dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_secret_volume_path_ott_keystore_p12=/mnt/secrets
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_secret_volume_path_ott_truststore_p12=/mnt/secrets
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_agent_inject_secret_ott_keystore_p12=${secman_secret_ott_path}
dypx_secman_deployment_spec_template_metadata_annotations_vault_hashicorp_com_agent_inject_secret_ott_truststore_p12=${secman_secret_ott_path}

{
"AJ_KEYSTORE_PASSWORD": "qqqq",
 "AJ_KEY_PRIVATE_PASSWORD": "qqqq",
 "AJ_TRUSTSTORE_PASSWORD": "qqqq",
 "DB_EKPIT_MAIN_LOGIN": "pgreader",
 "DB_EKPIT_MAIN_PASSWORD": "qqqq",
 "DB_EKPIT_STANDIN_LOGIN": "pgreader",
 "DB_EKPIT_STANDIN_PASSWORD": "qqqq",
 "DB_INDICATOR_MAIN_LOGIN": "pricing_service",
 "DB_INDICATOR_MAIN_PASSWORD": "qqqq",
 "DB_INDICATOR_STANDIN_LOGIN": "pricing_service",
 "DB_INDICATOR_STANDIN_PASSWORD": "qqqq",
 "DB_PRICING_MAIN_LOGIN": "pricing_service",
 "DB_PRICING_MAIN_PASSWORD": "qqqq",
 "DB_PRICING_STANDIN_LOGIN": "pricing_service",
 "DB_PRICING_STANDIN_PASSWORD": "qqqq",
 "OTT_CERTSTORE_PRIVATE_KEY_PWD": "qqqq",
 "OTT_CERTSTORE_PWD": "qqqq",
 "OTT_TRUST_STORE_PWD": "qqqq"
}

"DB_EKPIT_MAIN_LOGIN": "",
"DB_EKPIT_MAIN_PASSWORD": "",
"DB_EKPIT_STANDIN_LOGIN": "",
"DB_EKPIT_STANDIN_PASSWORD": ""

{
"keystore.jks": "",
"truststore.jks": ""
}

{
"chain.crt": "",
"tls.crt": "",
"tls.key": ""
}

{
"chain.crt": "",
"tls.crt": "",
"tls.key": ""
}

{
"keystore.jks": "",
"truststore.jks": ""
}

DEPLOY_LIMITS: true;

  name: rate-limit-config
  namespace: standname-dypx-vdc06-01
  labels:
    proj: synapse-rls
    agent: srls
    version: D-02.003.00-36
spec:
  endpoints: # 6 endpoints — на каждый gateway (https, https-geo, https-geo-smart, ott, ott-geo, ott-geo-smart)
    — endpoint: dypx-https-kb-standname-dypx-vdc06-01.apps.stands-vdc01.solution.sbt:8443
      name: dypx-https
      shortname: dypxh
      overall_limit: -1
      by_header:
        header: module_id
        unit: second
        value: -1
        uri_prefixes:
          — unit: second
            uri_prefix: /ru.sbt.currency.integration.api.cb.CentralBankRates
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.individual.ExchangeRatesForIndividuals
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.legal.ExchangeRatesForLegalEntities
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.financial.FinancialQuotes
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.interbank.InterbankRates
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.supplementary.ExchangeRatesSupplementary
            value: -1
      name: dypx-ott-geo
      shortname: dypxog
      overall_limit: -1
      by_header:
        header: module_id
        unit: second
        value: -1
        uri_prefixes:
          — unit: second
            uri_prefix: /ru.sbt.currency.integration.api.cb.CentralBankRates
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.individual.ExchangeRatesForIndividuals
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.legal.ExchangeRatesForLegalEntities
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.financial.FinancialQuotes
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.interbank.InterbankRates
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.supplementary.ExchangeRatesSupplementary
            value: -1
    — endpoint: dypx-kb-standname-dypx-vdc06-01.geo-smart.apps.stands-vdc01.solution.sbt:5443
      name: dypx-ott-geo-smart
      shortname: dypxogs
      overall_limit: -1
      by_header:
        header: module_id
        unit: second
        value: -1
        uri_prefixes:
          — unit: second
            uri_prefix: /ru.sbt.currency.integration.api.cb.CentralBankRates
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.individual.ExchangeRatesForIndividuals
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.legal.ExchangeRatesForLegalEntities
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.financial.FinancialQuotes
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.interbank.InterbankRates
            value: -1
          — unit: second
            uri_prefix: /ru.sbt.currency.cloud.api.supplementary.ExchangeRatesSupplementary
            value: -1
  rlnamespace: standname-dypx-vdc06-01
  rlserver: rate-limiter-headless-service.standname-dypx-vdc06-01.svc.cluster.local
  rlserverport: 8081
  visibility: namespace
  workloadSelector:
    labels:
      app: dypx-ingress
      istio: standname-dypx-vdc06-01-ingress

   endpoints: [
   {
   "endpoint": "dypx-https-kb-standname-dypx-vdc06-01.apps.stands-vdc01.solution.sbt:8443",
   "name": "dypx-https",
   "shortname": "dypxh",
   "overall_limit": -1,
   "by_header": {
   "header": "subsystemCode",
   "unit": "second",
   "value": -1,
   "uri_prefixes": [
   {
   "uri_prefix": "/ru.sbt.currency.integration.api.cb.CentralBankRates",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/ru.sbt.currency.cloud.api.individual.ExchangeRatesForIndividuals",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/ru.sbt.currency.cloud.api.legal.ExchangeRatesForLegalEntities",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/ru.sbt.currency.cloud.api.financial.FinancialQuotes",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/ru.sbt.currency.cloud.api.interbank.InterbankRates",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/ru.sbt.currency.cloud.api.supplementary.ExchangeRatesSupplementary",
   "unit": "second",
   "value": -1
   }
   ]
   }
   },
   {
   "endpoint": "dypx-kb-standname-dypx-vdc06-01.geo-smart.apps.stands-vdc01.solution.sbt:5443",
   "name": "dypx-ott-geo-smart",
   "shortname": "dypxogs",
   "overall_limit": -1,
   "by_header": {
   "header": "subsystemCode",
   "unit": "second",
   "value": -1,
   "uri_prefixes": [
   {
   "uri_prefix": "/ru.sbt.currency.integration.api.cb.CentralBankRates",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/ru.sbt.currency.cloud.api.individual.ExchangeRatesForIndividuals",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/ru.sbt.currency.cloud.api.legal.ExchangeRatesForLegalEntities",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/ru.sbt.currency.cloud.api.financial.FinancialQuotes",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/ru.sbt.currency.cloud.api.interbank.InterbankRates",
   "unit": "second",
   "value": -1
   },
   {
   "uri_prefix": "/ru.sbt.currency.cloud.api.supplementary.ExchangeRatesSupplementary",
   "unit": "second",
   "value": -1
   }
   ]
   }
   }
   ]

    apiVersion: v1
    kind: Service
    metadata:
        # Пример названия сервиса
        name: unimon-sandbox-micrometer
        annotations:
            description: "Exposes Micrometer-Prometheus App by CLuster Ip"
            # Аннотация для включения сбора метрик
            prometheus.io.scrape: "true"
            # Аннотация для указания HTTP endpoint с метриками приложения
            # Путь указывается полностью, например если при тестирование
            # вы переходите на endpoint http://localhost:8081/actuator/prometheus
            prometheus.io.path: "/actuator/prometheus"
            # Аннотация для указания порта подключения к HTTP endpoint с метриками
            # Внимание!!! порт может меняться на стороне потребителя, "8081" указан как пример
            prometheus.io.port: "8081"
        labels:
            app: unimon-sandbox-micrometer
    spec:
        ports:
        — name: http
          port: 8080
          targetPort: 8080
        — name: http-actuator
          port: 8081
          targetPort: 8081
    selector:
        app: unimon-sandbox-micrometer

CR_NAMESPACE: ci00642380−idevgen2−dynamic−pricing−ift

jdbc_db_pricing_main_url= jdbc:postgresql://xxxx/dypx?currentSchema=dypx

jdbc_db_pricing_main_host = xxxxx
jdbc_db_pricing_main_ip = xxxxx
jdbc_db_pricing_main_port = xxxxx

#pricing db egrees
# const mapping port
istio_ose_istio_egress_svc_spec_ports_db_pricing_main_mapping_port: xxxx
istio_ose_istio_egress_svc_spec_ports_db_pricing_main_failover_mapping_port: xxxx
istio_ose_istio_egress_svc_spec_ports_db_pricing_si_mapping_port: xxxx
istio_ose_istio_egress_svc_spec_ports_db_pricing_si_failover_mapping_port: xxxx
#host
istio_ose_istio_egress_db_pricing_main_host: ${jdbc_db_pricing_main_host}
istio_ose_istio_egress_db_pricing_main_failover_host: ${jdbc_db_pricing_main_failover_host}
istio_ose_istio_egress_db_pricing_si_host: ${jdbc_db_pricing_si_host}
istio_ose_istio_egress_db_pricing_si_failover_host: ${jdbc_db_pricing_si_failover_host}
# ip
istio_ose_istio_egress_db_pricing_main_ip: ${jdbc_db_pricing_main_ip}
istio_ose_istio_egress_db_pricing_main_failover_ip: ${jdbc_db_pricing_main_failover_ip}
istio_ose_istio_egress_db_pricing_si_ip: ${jdbc_db_pricing_si_ip}
istio_ose_istio_egress_db_pricing_si_failover_ip: ${jdbc_db_pricing_si_failover_ip}
# port
istio_ose_istio_egress_db_pricing_main_port: ${jdbc_db_pricing_main_port}
istio_ose_istio_egress_db_pricing_main_failover_port: ${jdbc_db_pricing_main_failover_port}
istio_ose_istio_egress_db_pricing_si_port: ${jdbc_db_pricing_si_port}
istio_ose_istio_egress_db_pricing_si_failover_port: ${jdbc_db_pricing_si_failover_port}

apiVersion: networking.istio.io/v1alpha3
    kind: ServiceEntry
    metadata:
      name: se-db-pricing-main
    spec:
      addresses:
        — {{istio_ose_istio_egress_db_pricing_main_ip }}/32
      endpoints:
        — address: {{ istio_ose_istio_egress_db_pricing_main_ip }}
      exportTo:
        — .
      hosts:
        — {{ istio_ose_istio_egress_db_pricing_main_host }}
      location: MESH_EXTERNAL
      ports:
        — name: tcp-{{ istio_ose_istio_egress_db_pricing_main_port }}
          number: {{ istio_ose_istio_egress_db_pricing_main_port }}
          protocol: TCP
      resolution: STATIC

    apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      name: gw-dp-egress-db-pricing-main
    spec:
      selector:
        istio: dypx-egress
      servers:
        — hosts:
            — {{ istio_ose_istio_egress_db_pricing_main_host }}
          port:
            name: tcp-{{ istio_ose_istio_egress_db_pricing_main_port }}
            number: {{ istio_ose_istio_egress_db_pricing_main_port }}
            protocol: TCP


      apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: vs-dp-egress-db-pricing-main
    spec:
      exportTo:
        — .
      gateways:
        — gw-dp-egress-db-pricing-main
        — mesh
      hosts:
        — {{ istio_ose_istio_egress_svc_spec_ports_db_pricing_main_host }}
      tcp:
        — match:
            — gateways:
                — mesh
              port: {{ istio_ose_istio_egress_svc_spec_ports_db_pricing_main_port }}
          route:
            — destination:
                host: svc-dp-egress
                port:
                  number: {{ istio_ose_istio_egress_svc_spec_ports_db_pricing_main_mapping_port }}
              weight: 100
        — match:
            — gateways:
                — gw-dp-egress-db-pricing-main
              port: {{ istio_ose_istio_egress_svc_spec_ports_db_pricing_main_mapping_port }}
          route:
            — destination:
                host: {{ istio_ose_istio_egress_db_pricing_main_host }}
                port:
                  number: {{ istio_ose_istio_egress_db_pricing_main_port }}
              weight: 100

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
 labels:
   external: database
name: dr-dp-egress-${DB_PRICING_MAIN_HOST}
spec:
  exportTo:
    — .
  host: {{ istio_ose_istio_egress_db_pricing_main_host }}
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      — port:
       number: {{ istio_ose_istio_egress_db_pricing_main_mapping_port }}
      connectionPool:
        tcp:
          connectTimeout: {{ istio_ose_istio_egress_db_connectionPool_tcp_connectTimeout }}

          maxConnections:{{ istio_ose_istio_egress_db_connectionPool_tcp_maxConnections }}
          tcpKeepalive:
            time: {{ istio_ose_istio_egress_db_connectionPool_tcpKeepalive_time }}
            interval: {{ istio_ose_istio_egress_db_connectionPool_tcpKeepalive_interval }}

- apiVersion: networking.istio.io/v1alpha3
    kind: EnvoyFilter
    metadata:
      name: envoyfilter-dp-egress
    spec:
      configPatches:
        — applyTo: HTTP_FILTER
          match:
            context: GATEWAY
            listener:
              filterChain:
                filter:
                  name: envoy.http_connection_manager
              portNumber: xxxx
          patch:
            operation: INSERT_BEFORE
            value:
              name: envoy.ext_authz
              config:
                failure_mode_allow: false
                grpc_service:
                  google_grpc:
                    stat_prefix: ext_authz
                    target_uri: unix:/mnt/ott-uds-socket/ott.socket
                  timeout: 1s
                with_request_body:
                  allow_partial_message: false
                  max_request_bytes: 1048576
      workloadSelector:
        labels:
          app: ${EGRESSGATEWAY_NAME}-${DP_NAMESPACE}
          istio: ${EGRESSGATEWAY_ISTIO_LABEL}

  — apiVersion: v1
    kind: Service
    metadata:
      name: svc-dp-egress-for-mon
      labels:
        app.kubernetes.io/component: istio-discovery
        app.kubernetes.io/instance: ${ISTIO_CONTROL_PLANE}
        app.kubernetes.io/managed-by: maistra-istio-operator
        app.kubernetes.io/name: istio-discovery
        app.kubernetes.io/part-of: istio
        app.kubernetes.io/version: ${ISTIO_VERSION}
        istio.io/rev: basic
        maistra-version: 2.0.2
        maistra.io/owner: ${ISTIO_CONTROL_PLANE}
        release: istio
    spec:
      ports:
        — {name: http-8080, port: 8080, protocol: TCP, targetPort: 8080}
        — {name: https-5443, port: 5443, protocol: TCP, targetPort: 5443}
      selector:
        app: ${EGRESS_MON_GATEWAY_NAME}-${DP_NAMESPACE}
        istio: ${EGRESS_MON_GATEWAY_ISTIO_LABEL}
    type: ClusterIP

  — apiVersion: v1
    kind: Service
    metadata:
      name: svc-dp-egress
      labels:
        app.kubernetes.io/component: istio-discovery
        app.kubernetes.io/instance: ${ISTIO_CONTROL_PLANE}
        app.kubernetes.io/managed-by: maistra-istio-operator
        app.kubernetes.io/name: istio-discovery
        app.kubernetes.io/part-of: istio
        app.kubernetes.io/version: ${ISTIO_VERSION}
        istio.io/rev: basic
        maistra-version: 2.0.2
        maistra.io/owner: ${ISTIO_CONTROL_PLANE}
        release: istio
    spec:
      ports:
        — {name: http-8080, port: 8080, protocol: TCP, targetPort: 8080}
        — {name: https-5443, port: 5443, protocol: TCP, targetPort: 5443}
        — {name: tcp-1518, port: 1518, protocol: TCP, targetPort: 1518}
        — {name: tcp-1521, port: 1521, protocol: TCP, targetPort: 1521}
        — {name: tcp-1522, port: 1522, protocol: TCP, targetPort: 1522}
        — {name: tcp-1523, port: 1523, protocol: TCP, targetPort: 1523}
        — {name: tcp-1524, port: 1524, protocol: TCP, targetPort: 1524}
        — {name: tcp-1525, port: 1525, protocol: TCP, targetPort: 1525}
        — {name: tcp-1526, port: 1526, protocol: TCP, targetPort: 1526}
        — {name: tcp-1527, port: 1527, protocol: TCP, targetPort: 1527}
        — {name: tcp-9092, port: 9092, protocol: TCP, targetPort: 9092}
        — {name: tcp-9093, port: 9093, protocol: TCP, targetPort: 9093}
        — {name: tcp-9094, port: 9094, protocol: TCP, targetPort: 9094}
        — {name: tcp-9095, port: 9095, protocol: TCP, targetPort: 9095}
        — {name: tcp-9096, port: 9096, protocol: TCP, targetPort: 9096}
        — {name: tcp-9097, port: 9097, protocol: TCP, targetPort: 9097}
        — {name: tcp-9098, port: 9098, protocol: TCP, targetPort: 9098}
        — {name: tcp-6543, port: 6543, protocol: TCP, targetPort: 6543}
        — {name: tcp-6544, port: 6544, protocol: TCP, targetPort: 6544}
        — {name: tcp-6545, port: 6545, protocol: TCP, targetPort: 6545}
      selector:
        app: ${EGRESSGATEWAY_NAME}-${DP_NAMESPACE}
        istio: ${EGRESSGATEWAY_ISTIO_LABEL}
    type: ClusterIP

- apiVersion: networking.istio.io/v1alpha3
   kind: ServiceEntry
   metadata:
     labels:
       external: integration-cr
     name: se-dp-cr-service
   spec:
     exportTo:
       — .
     hosts:
       — ${CR_HOST}
     location: MESH_EXTERNAL
     ports:
       — name: http-80
         number: 80
         protocol: HTTP
       — name: https-443
         number: 443
         protocol: TLS
     resolution: DNS
 — apiVersion: networking.istio.io/v1alpha3
   kind: Gateway
   metadata:
     labels:
       external: integration-cr
     name: gw-dp-egress-cr
   spec:
     selector:
       app: ${EGRESSGATEWAY_NAME}-${DP_NAMESPACE}
       istio: ${EGRESSGATEWAY_ISTIO_LABEL}
     servers:
       — hosts:
           — ${CR_HOST}
         port:
           name: http-5443
           number: 5443
           protocol: HTTP

 — apiVersion: networking.istio.io/v1alpha3
   kind: VirtualService
   metadata:
     labels:
       external: integration-cr
     name: vs-dp-egress-cr
   spec:
     exportTo:
       — .
     gateways:
       — gw-dp-egress-cr
       — mesh
     hosts:
       — ${CR_HOST}
     http:
       — match:
           — gateways:
               — mesh
             port: 80
         rewrite:
           authority: ${CR_HOST}
         route:
           — destination:
               host: svc-dp-egress
               port:
                 number: 5443
             weight: 100
         retries:
           attempts: 2
           perTryTimeout: 1s
           retryOn: gateway-error,connect-failure,refused-stream
       — match:
           — gateways:
               — gw-dp-egress-cr
             port: 5443
         route:
           — destination:
               host: ${CR_HOST}
               port:
                 number: 443
             weight: 100
         retries:
           attempts: 2
           perTryTimeout: 1s
           retryOn: gateway-error,connect-failure,refused-stream

# CR_HOST DestinationRule
 — apiVersion: networking.istio.io/v1alpha3
   kind: DestinationRule
   metadata:
     labels:
       external: integration-cr
     name: dr-dp-egress-cr
   spec:
     exportTo:
       — .
     host: ${CR_HOST}
     trafficPolicy:
       loadBalancer:
         simple: ROUND_ROBIN
       portLevelSettings:
         — port:
             number: 443
           tls:
             caCertificates: /etc/istio/gateway-ca-certs/ca.pem
             clientCertificate: /etc/istio/gateway-certs/tls.crt
             mode: MUTUAL
             privateKey: /etc/istio/gateway-certs/tls.key
             sni: ${CR_HOST}

- apiVersion: networking.istio.io/v1alpha3
    kind: ServiceEntry
    metadata:
      labels:
        external: integration-individual-tariffs
      name: se-dp-individual-tariffs
    spec:
      exportTo:
        — .
      hosts:
        — ${INDIVIDUAL_TARIFFS_HOST}
      location: MESH_EXTERNAL
      ports:
        — name: http-80
          number: 80
          protocol: HTTP
        — name: https-443
          number: 443
          protocol: TLS
      resolution: DNS

  — apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      labels:
        external: integration-individual-tariffs
      name: gw-dp-egress-individual-tariffs
    spec:
      selector:
        app: ${EGRESSGATEWAY_NAME}-${DP_NAMESPACE}
        istio: ${EGRESSGATEWAY_ISTIO_LABEL}
      servers:
        — hosts:
            — ${INDIVIDUAL_TARIFFS_HOST}
          port:
            name: http-8080
            number: 8080
            protocol: HTTP

  — apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      labels:
        external: integration-individual-tariffs
      name: vs-dp-egress-individual-tariffs
    spec:
      exportTo:
        — .
      gateways:
        — gw-dp-egress-individual-tariffs
        — mesh
      hosts:
        — ${INDIVIDUAL_TARIFFS_HOST}
      http:
        — match:
            — gateways:
                — mesh
              port: 80
          route:
            — destination:
                host: svc-dp-egress
                port:
                  number: 8080
          retries:
            attempts: 2
            perTryTimeout: 1s
            retryOn: gateway-error,connect-failure,refused-stream
        — match:
            — gateways:
                — gw-dp-egress-individual-tariffs
              port: 8080
          route:
            — destination:
                host: ${INDIVIDUAL_TARIFFS_HOST}
                port:
                  number: 443
          retries:
            attempts: 2
            perTryTimeout: 1s
            retryOn: gateway-error,connect-failure,refused-stream

# INDIVIDUAL_TARIFFS_HOST DestinationRule
  — apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      labels:
        external: integration-individual-tariffs
      name: dr-dp-egress-individual-tariffs
    spec:
      exportTo:
        — .
      host: ${INDIVIDUAL_TARIFFS_HOST}
      trafficPolicy:
        loadBalancer:
          simple: ROUND_ROBIN
        portLevelSettings:
          — port:
              number: 443
            tls:
              caCertificates: /etc/istio/gateway-ca-certs/ca.pem
              clientCertificate: /etc/istio/gateway-certs/tls.crt
              mode: MUTUAL
              privateKey: /etc/istio/gateway-certs/tls.key
              sni: ${INDIVIDUAL_TARIFFS_HOST}

- apiVersion: networking.istio.io/v1alpha3
    kind: ServiceEntry
    metadata:
      labels:
        external: integration-digital-price
      name: se-dp-digital-price
    spec:
      exportTo:
        — .
      hosts:
        — ${DIGITAL_PRICE_HOST}
      location: MESH_EXTERNAL
      ports:
        — name: http-80
          number: 80
          protocol: HTTP
        — name: https-443
          number: 443
          protocol: TLS
      resolution: DNS
  — apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      labels:
        external: integration-digital-price
      name: gw-dp-egress-digital-price
    spec:
      selector:
        app: ${EGRESSGATEWAY_NAME}-${DP_NAMESPACE}
        istio: ${EGRESSGATEWAY_ISTIO_LABEL}
      servers:
        — hosts:
            — ${DIGITAL_PRICE_HOST}
          port:
            name: http-8080
            number: 8080
            protocol: HTTP

  — apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      labels:
        external: integration-digital-price
      name: vs-dp-egress-digital-price
    spec:
      exportTo:
        — .
      gateways:
        — gw-dp-egress-digital-price
        — mesh
      hosts:
        — ${DIGITAL_PRICE_HOST}
      http:
        — match:
            — gateways:
                — mesh
              port: 80
          route:
            — destination:
                host: svc-dp-egress
                port:
                  number: 8080
          retries:
            attempts: 2
            perTryTimeout: 1s
            retryOn: gateway-error,connect-failure,refused-stream
        — match:
            — gateways:
                — gw-dp-egress-digital-price
              port: 8080
          route:
            — destination:
                host: ${DIGITAL_PRICE_HOST}
                port:
                  number: 443
          retries:
            attempts: 2
            perTryTimeout: 1s
            retryOn: gateway-error,connect-failure,refused-stream

# DIGITAL_PRICE_HOST DestinationRule
  — apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      labels:
        external: integration-digital-price
      name: dr-dp-egress-digital-price
    spec:
      exportTo:
        — .
      host: ${DIGITAL_PRICE_HOST}
      trafficPolicy:
        loadBalancer:
          simple: ROUND_ROBIN
        portLevelSettings:
          — port:
              number: 443
            tls:
              caCertificates: /etc/istio/gateway-ca-certs/ca.pem
              clientCertificate: /etc/istio/gateway-certs/tls.crt
              mode: MUTUAL
              privateKey: /etc/istio/gateway-certs/tls.key
              sni: ${DIGITAL_PRICE_HOST}

  — apiVersion: networking.istio.io/v1alpha3
    kind: ServiceEntry
    metadata:
      labels:
        external: logger
      name: se-dp-logger-service
    spec:
      exportTo:
        — .
      hosts:
        — ${DP_LOGGER_CLUSTER}
      location: MESH_EXTERNAL
      ports:
        — name: http-80
          number: 80
          protocol: HTTP
        — name: https-443
          number: 443
          protocol: TLS
      resolution: DNS

  — apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      labels:
        external: logger
      name: gw-dp-egress-logger
    spec:
      selector:
        istio: ${EGRESS_MON_GATEWAY_ISTIO_LABEL}
      servers:
        — hosts:
            — ${DP_LOGGER_CLUSTER}
          port:
            name: http-5443 # Порт на egress MTLS+OTT
            number: 5443
            protocol: HTTP

  — apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      labels:
        external: logger
      name: vs-dp-egress-logger
    spec:
      exportTo:
        — .
      gateways:
        — gw-dp-egress-logger
        — mesh
      hosts:
        — ${LOGGER_HOST}
      http:
        — match:
            — gateways:
                — mesh
              port: 80
          rewrite:
            authority: ${DP_LOGGER_CLUSTER}
          route:
            — destination:
                host: svc-dp-egress-for-mon
                port:
                  number: 5443
              weight: 100
          retries:
            attempts: 2
            perTryTimeout: 1s
            retryOn: gateway-error,connect-failure,refused-stream
        — match:
            — gateways:
                — gw-cr-egress-logger
              port: 5443
          route:
            — destination:
                host: ${LOGGER_HOST}
                port:
                  number: 443
              weight: 100
          retries:
            attempts: 2
            perTryTimeout: 1s
            retryOn: gateway-error,connect-failure,refused-stream

  — apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      labels:
        external: logger
      name: dr-cr-egress-logger
    spec:
      exportTo:
        — .
      host:  ${DP_LOGGER_CLUSTER}
      trafficPolicy:
        loadBalancer:
          simple: ROUND_ROBIN
        portLevelSettings:
          — port:
              number: 443
            tls:
              caCertificates: /etc/istio/gateway-ca-certs/ca.pem
              clientCertificate: /etc/istio/gateway-certs/tls.crt
              mode: MUTUAL
              privateKey: /etc/istio/gateway-certs/tls.key
              sni: ${LOGGER_HOST}

AUDIT
Взаимодействие MTLS + OTT
СТЕНД
ИФТ	${AUDIT_HOST}	ift.audit2-http-proxy-ott.ift-pprb-apps.ocp-geo.xxxxx.yyy.ru
НТ	${AUDIT_HOST}	demo.audit2-client-proxy.apps.dev-gen.maindomain.mycompany.ru
ПСИ	${AUDIT_HOST}	-
ПРОМ	${AUDIT_HOST}	-

  — apiVersion: networking.istio.io/v1alpha3
    kind: Gateway
    metadata:
      labels:
        external: integration-audit
      name: gw-dp-egress-audit
    spec:
      selector:
        istio: ${EGRESS_MON_GATEWAY_ISTIO_LABEL}
      servers:
        — hosts:
            — ${AUDIT_HOST}
          port:
            name: http-5443
            number: 5443
            protocol: HTTP

  — apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      labels:
        external: integration-audit
      name: vs-dp-egress-audit
    spec:
      exportTo:
        — .
      gateways:
        — gw-dp-egress-audit
        — mesh
      hosts:
        — ${AUDIT_HOST}
      http:
        — match:
            — gateways:
                — mesh
              port: 80
          rewrite:
            authority: ${AUDIT_HOST}
          route:
            — destination:
                host: svc-dp-egress-for-mon
                port:
                  number: 5443
              weight: 100
          retries:
            attempts: 2
            perTryTimeout: 1s
            retryOn: gateway-error,connect-failure,refused-stream
        — match:
            — gateways:
                — gw-dp-egress-audit
              port: 5443
          route:
            — destination:
                host: ${AUDIT_HOST}
                port:
                  number: 443
              weight: 100
          retries:
            attempts: 2
            perTryTimeout: 1s
            retryOn: gateway-error,connect-failure,refused-stream

  — apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      labels:
        external: integration-audit
      name: dr-dp-egress-audit
    spec:
      exportTo:
        — .
      host: ${AUDIT_HOST}
      trafficPolicy:
        loadBalancer:
          simple: ROUND_ROBIN
        portLevelSettings:
          — port:
              number: 443
            tls:
              caCertificates: /etc/istio/gateway-ca-certs/ca.pem
              clientCertificate: /etc/istio/gateway-certs/tls.crt
              mode: MUTUAL
              privateKey: /etc/istio/gateway-certs/tls.key
              sni: ${AUDIT_HOST}

# CRTX_HOST DestinationRule
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  labels:
    external: integration-crtx
  name: dypx-dr-egress-crtx
spec:
  exportTo:
    — .
  host: {{ istio_ose_istio_egress_crtx_host }}
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      — port:
          number: 443
        tls:
          caCertificates: /etc/istio/gateway-ca-certs/ca.pem
          clientCertificate: /etc/istio/gateway-certs/tls.crt
          mode: MUTUAL
          privateKey: /etc/istio/gateway-certs/tls.key
          sni: {{ istio_ose_istio_egress_crtx_host }}
        connectionPool:
          tcp:
            connectTimeout: {{ istio_ose_istio_egress_destination_rule_crtx_TFP_CONN_POLL_TCP_CONN_TIMEOUT }}
            maxConnections: {{ istio_ose_istio_egress_destination_rule_crtx_TFP_CONN_POLL_TCP_MAX_CONN }}
          outlierDetection:
            consecutiveGatewayErrors: {{ istio_ose_istio_egress_destination_rule_crtx_OUT_DETECTION_CONSECUTIVE_GATEWAY_ERRORS }}
            interval: {{ istio_ose_istio_egress_destination_rule_crtx_OUT_DETECTION_INTERVAL }}
            baseEjectionTime: {{ istio_ose_istio_egress_destination_rule_crtx_OUT_DETECTION_BASE_EJECTION_TIME }}
            maxEjectionPercent: {{ istio_ose_istio_egress_destination_rule_crtx_OUT_DETECTION_MAX_EJECTION_PERCENT }}

# DIGITAL_PRICE_HOST DestinationRule
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  labels:
    external: integration-digital-price
  name: dypx-dr-egress-digital-price
spec:
  exportTo:
    — .
  host: {{ istio_ose_istio_egress_digital_price_host }}
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      — port:
          number: 443
        tls:
          caCertificates: /etc/istio/gateway-ca-certs/ca.pem
          clientCertificate: /etc/istio/gateway-certs/tls.crt
          mode: MUTUAL
          privateKey: /etc/istio/gateway-certs/tls.key
          sni: {{ istio_ose_istio_egress_digital_price_host }}
        connectionPool:
          tcp:
            connectTimeout: {{ istio_ose_istio_egress_destination_rule_digital_price_TFP_CONN_POLL_TCP_CONN_TIMEOUT }}
            maxConnections: {{ istio_ose_istio_egress_destination_rule_digital_price_TFP_CONN_POLL_TCP_MAX_CONN }}
          outlierDetection:
            consecutiveGatewayErrors: {{ istio_ose_istio_egress_destination_rule_digital_price_OUT_DETECTION_CONSECUTIVE_GATEWAY_ERRORS }}
            interval: {{ istio_ose_istio_egress_destination_rule_digital_price_OUT_DETECTION_INTERVAL }}
            baseEjectionTime: {{ istio_ose_istio_egress_destination_rule_digital_price_OUT_DETECTION_BASE_EJECTION_TIME }}
            maxEjectionPercent: {{ istio_ose_istio_egress_destination_rule_digital_price_OUT_DETECTION_MAX_EJECTION_PERCENT }}