Установка модуля "Рабочее место AWP"#

kind: ConfigMap
apiVersion: v1
metadata:
  name: tfsx-awp-arm-application-cm
data:
  application.properties: >-
    spring.cloud.vault.enabled=false

    spring.config.import=file:/vault/secrets/secrets.properties

    server.port=8080

    spring.jpa.hibernate.ddl-auto=none

    jwt.verify.enable=true

    spring.profiles.active=AUTHORIZATION_EXTERNAL_KEYCLOAK

    jwt.pubkey.update.period=0 * * * * *

    jwt.keycloak.info.url=http://oidc.cluster.example.ru.ru:4001/jwt

    server.ssl.enabled=false

    server.ssl.client-auth=none

    security.rbac={"ADMIN":{"POST":["/rest/v1/node","/rest/v1/certificate","/rest/v1/routes/enable","/rest/v1/routes/disable"],"GET":["/rest/v1/node","/rest/v1/certificate","/rest/v1/events","/rest/v1/routes","/rest/v1/whoami","/rest/v1/transactionLogs"]},"AUDITOR":{"GET":["/rest/v1/node","/rest/v1/certificate","/rest/v1/events","/rest/v1/routes","/rest/v1/whoami","/rest/v1/transactionLogs"]}}

    spring.datasource.url=jdbc:postgresql://psql.cluster.example.ru.ru:3001/MYSCHEME

    spring.datasource.driverClassName=org.postgresql.Driver

    spring.jpa.database-platform=org.hibernate.dialect.PostgreSQL95Dialect

    spring.jpa.properties.hibernate.default_schema=tfsdb

    spring.datasource.hikari.maximum-pool-size=2

    server.ssl.trust-store=/tfs_awp_backend/resource/certs/file.p12

    server.ssl.key-store=/tfs_awp_backend/resource/certs/file.p12

    jwt.trust.path=/tfs_awp_backend/resource/certs/jwt.trust.path.jks

    management.endpoint.health.probes.enabled=true

    management.health.livenessState.enabled=true

    management.health.readinessState.enabled=true

    management.endpoints.web.exposure.include=health,refresh,prometheus

    management.metrics.export.prometheus.enabled=true

    management.metrics.distribution.percentiles-histogram."[http.server.requests]"=true

    audit.properties.enabled.mock=false

    audit.properties.main.server=ip:9094

    audit.properties.fallback.server=ip:9094

    audit.properties.security.protocol=PLAINTEXT

    audit.properties.ssl.protocol=

    audit.properties.ssl.keystore.location=/tfs_awp_backend/resource/certs/file.jks

    audit.properties.ssl.truststore.location=/tfs_awp_backend/resource/certs/file.jks

    scim.patch.supported=true

    scim.bult.supported=false

    scim.bult.maxOperations=0

    scim.bult.maxPayloadSize=0

    scim.filter.supported=true

    scim.filter.maxResult=5000

    scim.changePassword.supported=false

    scim.sort.supported=false

    scim.etag.supported=false

    scim.authenticationSchemes.name=mTLS

    scim.authenticationSchemes.type=Mutual TLS

    scim.authenticationSchemes.description=Mutual authentication or two-way
    authenticationrefers to two parties authenticating each other at the same
    timein an authentication protocol
    
  # Ниже указаны параметры, указывать которые в СonfigMap не соответствует стандартам безопасности
  # Настоятельно рекомендуем расположить данные параметры в хранилище секретов
  # Приведены исключительно для наглядного примера конфигурации
    
    spring.datasource.password=123456

    server.ssl.trust-store-password=123456

    server.ssl.key-store-password=123456

    jwt.trust.password=123456

    audit.properties.ssl.key.password=123456

    audit.properties.ssl.keystore.password=123456

    audit.properties.ssl.truststore.password=123456

kind: ConfigMap
apiVersion: v1
metadata:
  name: tfsx-awp-configurator-cm
data:
  application.properties: >-
    spring.cloud.vault.enabled=false

    spring.config.import=file:/vault/secrets/secrets.properties

    server.port=8080

    spring.jpa.hibernate.ddl-auto=none

    jwt.verify.enable=true

    spring.profiles.active=AUTHORIZATION_EXTERNAL_KEYCLOAK

    jwt.pubkey.update.period=0 * * * * *

    jwt.keycloak.info.url=http://oidc.cluster.example.ru.ru:4001/jwt

    features.visible.featureToggle=true

    spring.datasource.driver-class-name=org.postgresql.Driver

    spring.datasource.url=jdbc:postgresql://psql.cluster.example.ru.ru:3001/MYSCHEME

    spring.datasource.hikari.maximum-pool-size=1

    spring.jpa.properties.hibernate.default_schema=TFSDB

    spring.constructordatasource.driver-class-name=org.postgresql.Driver

    spring.constructordatasource.hikari.maximum-pool-size=1

    spring.jpa.properties.hibernate.constructor_schema=tfs_constructor

    spring.jpa.database-platform=org.hibernate.dialect.PostgreSQL95Dialect

    spring.jpa.properties.hibernate.jdbc.lob.non_contextual_creation=true

    jwt.trust.path=/tfs_configurator_backend/resource/certs/file.jks

    audit.properties.enabled.mock=false

    audit.properties.main.server=ip:9094

    audit.properties.fallback.server=ip:9094

    audit.properties.security.protocol=PLAINTEXT

    audit.properties.ssl.protocol=

    audit.properties.ssl.keystore.location=/tfs_configurator_backend/resource/certs/file.jks

    audit.properties.ssl.truststore.location=/tfs_configurator_backend/resource/certs/file.jks

    management.endpoint.health.probes.enabled=true

    management.health.livenessState.enabled=true

    management.health.readinessState.enabled=true

    management.endpoints.web.exposure.include=health,refresh,prometheus

    management.metrics.export.prometheus.enabled=true

    management.metrics.distribution.percentiles-histogram."[http.server.requests]"=true

    server.ssl.enabled=false

    server.ssl.client-auth=none

    security.rbac={"ADMIN":{"POST":["/rest/v1/integrations/**/**","/rest/v1/contexts/**/**"],"PUT":["/rest/v1/integrations/**/**","/rest/v1/contexts/**/**"],"GET":["/rest/v1/integrations/**/**","/rest/v1/contexts/**/**","/rest/v1/whoami"]},"AUDITOR":{"GET":["/rest/v1/integrations/**/**","/rest/v1/contexts/**/**","/rest/v1/whoami"]}}

    server.ssl.trust-store=/tfs_configurator_backend/resource/certs/file.p12

    server.ssl.key-store=/tfs_configurator_backend/resource/certs/file.p12
                            
  # Ниже указаны параметры, указывать которые в СonfigMap не соответствует стандартам безопасности
  # Настоятельно рекомендуем расположить данные параметры в хранилище секретов
  # Приведены исключительно для наглядного примера конфигурации
                            
    spring.datasource.password=123456

    server.ssl.trust-store-password=123456

    server.ssl.key-store-password=123456

    jwt.trust.password=123456

    audit.properties.ssl.key.password=123456

    audit.properties.ssl.keystore.password=123456

    audit.properties.ssl.truststore.password=123456

kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: ingress-controller # имя вашего Ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: 'true'
    nginx.ingress.kubernetes.io/force-ssl-redirect: 'true'
    kubernetes.io/ingress.class: nginx
spec:
  rules:
    # на данном этапе должны быть объявлены 3 hosts(по одному на каждый компонент AWP)
    # объявленные hostname будут использоваться в вашем сервисе, который выступает как прокси
    - host: awp-frontend.cluster.example.ru.ru # для AWP frontend
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ingress-svc
                port:
                  number: 8443
    - host: awp-backend.cluster.example.ru.ru # для AWP backend
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ingress-svc
                port:
                  number: 8443
    - host: awp-backend-configurator.cluster.example.ru.ru # для AWP backend configurator
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: ingress-svc
                port:
                  number: 8443

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: ingress-gw
spec:
  selector:
    istio: ingress.cluster.example.ru.ru
  servers:
    - hosts:
        # применим ко всем hosts AWP
        - awp-frontend.cluster.example.ru.ru
        - awp-backend.cluster.example.ru.ru
        - awp-backend-configurator.cluster.example.ru.ru
      port:
        name: https-443
        number: 8443
        protocol: HTTPS
      # настройки mTLS
      tls:
        caCertificates: /istio/ingressgateway-certs/ca-chain.cert.pem
        mode: MUTUAL
        privateKey: /istio/ingressgateway-certs/tls.key
        serverCertificate: /istio/ingressgateway-certs/tls.crt

kind: Service
apiVersion: v1
metadata:
  name: tfsx-awp-frontend-svc
spec:
  ipFamilies:
    - IPv4
  ports:
    - name: http-8080
      protocol: TCP
      port: 8080
      targetPort: 8080
  internalTrafficPolicy: Cluster
  type: ClusterIP
  ipFamilyPolicy: SingleStack
  sessionAffinity: None
  selector:
    app: tfsx-awp-frontend # метка POD с приложением 

kind: Service
apiVersion: v1
metadata:
  name: tfsx-awp-arm-svc
spec:
  ipFamilies:
    - IPv4
  ports:
    - name: http-8080
      protocol: TCP
      port: 8080
      targetPort: 8080
  internalTrafficPolicy: Cluster
  type: ClusterIP
  ipFamilyPolicy: SingleStack
  sessionAffinity: None
  selector:
    app: tfsx-awp-arm # метка пода с приложением 

kind: Service
apiVersion: v1
metadata:
  name: tfsx-awp-configurator-svc
spec:
  ipFamilies:
    - IPv4
  ports:
    - name: http-8080
      protocol: TCP
      port: 8080
      targetPort: 8080
  internalTrafficPolicy: Cluster
  type: ClusterIP
  ipFamilyPolicy: SingleStack
  sessionAffinity: None
  selector:
    app: tfsx-awp-configurator # метка POD с приложением 

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ingress-tfsx-awp-frontend-vs
spec:
  exportTo:
    - .
  gateways:
    - ingress-gw
  hosts:
    - awp-frontend.cluster.example.ru.ru
  http:
    - match:
        - gateways:
            - ingress-gw
        - uri:
            prefix: /
      route:
        - destination:
            host: tfsx-awp-frontend-svc
            port:
              number: 8080
          weight: 100

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ingress-tfsx-awp-arm-vs
spec:
  exportTo:
    - .
  gateways:
    - ingress-gw
  hosts:
    - awp-backend.cluster.example.ru.ru
  http:
    - match:
        - gateways:
            - ingress-gw
        - uri:
            prefix: /
      route:
        - destination:
            host: tfsx-awp-arm-svc
            port:
              number: 8080
          weight: 100

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ingress-tfsx-awp-configurator-vs
spec:
  exportTo:
    - .
  gateways:
    - ingress-gw
  hosts:
    - awp-backend-configurator.cluster.example.ru.ru
  http:
    - match:
        - gateways:
            - ingress-gw
        - uri:
            prefix: /
      route:
        - destination:
            host: tfsx-awp-configurator-svc
            port:
              number: 8080
          weight: 100

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: egress-gw
spec:
  selector:
    istio: egress.cluster.example.ru.ru
  servers:
    - hosts:
        - psql.cluster.example.ru.ru # hostname, по которому доступна БД Postgres
      port:
        name: tcp-3000
        number: 3000 # порт на egress, заранее убедитесь, что нужный порт открыт
        protocol: TLS
      # межподовый mTLS
      tls:
        mode: ISTIO_MUTUAL

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: egress-postgres-se
spec:
  addresses:
    - {ip}/32 # ip-адрес вашей БД
  endpoints:
    - address: {ip} # ip-адрес вашей БД
  exportTo:
    - .
  hosts:
    - psql.cluster.example.ru.ru # hostname, по которому доступна БД Postgres
  location: MESH_EXTERNAL
  ports:
    - name: tcp-5432
      number: 5432 # порт БД Postgres
      protocol: TCP # протокол должен быть указан "Postgres"(регистр не важен) при использовании mTLS 
    # порт БД Postgres, указанный а application.properties
    - name: tcp-3001
      number: 3001
      protocol: TCP
  resolution: STATIC # при использовании "DNS", нужно убрать поля addresses и endpoints

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: egress-postgres-dsr
spec:
  exportTo:
    - .
  host: psql.cluster.example.ru.ru # hostname, по которому доступна БД Postgres
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      - port:
          number: 5432 # порт БД Postgres
        tls:
          # для организации mTLS используем сертификаты на egress
          caCertificates: /istio/pg-certs/pg-ca-chain.cert.pem
          clientCertificate: /istio/pg-certs/pg-tls.crt
          mode: MUTUAL
          privateKey: /istio/pg-certs/pg-tls.key
          sni: psql.cluster.example.ru.ru # SNI сервера БД

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: egress-postgres-vs
spec:
  gateways:
    - mesh
    - egress-gw
  hosts:
    - psql.cluster.example.ru.ru # hostname, который указан в properties приложения
  tcp:
    - match:
        - gateways:
            - mesh
          port: 3001 # порт БД Postgres, который указан в properties приложения
      route:
        - destination:
            host: egress-svc
            port:
              number: 3000 # внутренний порт egress
            subset: postgres
    - match:
        - gateways:
            - egress-gw
          port: 3000 # внутренний порт egress
      route:
        - destination:
            host: psql.cluster.example.ru.ru # hostname, по которому доступна БД Postgres
            port:
              number: 5432 # порт БД Postgres
          weight: 100

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: egress-gw
spec:
  selector:
    istio: egress.cluster.example.ru.ru
  servers:
    - hosts:
        - psql.cluster.example.ru.ru # hostname, по которому доступна БД Postgres
      port:
        name: tcp-3000
        number: 3000 # порт на egress, заранее убедитесь, что нужный порт открыт
        protocol: TLS
      # межподовый mTLS
      tls:
        mode: ISTIO_MUTUAL
    # новый блок для OIDC(https)
    - hosts:
        - oidc.cluster.example.ru.ru # hostname, по которому доступен OIDC Provider
      port:
        name: https-4000
        number: 4000 # порт на egress, заранее убедитесь, что нужный порт открыт
        protocol: TLS
      # межподовый mTLS
      tls:
        mode: ISTIO_MUTUAL

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: egress-oidc-se
spec:
  exportTo:
    - .
  hosts:
    - oidc.cluster.example.ru.ru # hostname, по которому доступен OIDC Provider
  location: MESH_EXTERNAL
  ports:
    - name: https-443
      number: 443 # порт OIDC Provider
      protocol: TCP
    # порт OIDC Provider, указанный а application.properties
    - name: http-4001
      number: 4001
      protocol: TCP
  resolution: DNS

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: egress-oidc-dsr
spec:
  exportTo:
    - .
  host: oidc.cluster.example.ru.ru # hostname, по которому доступен OIDC Provider
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      - port:
          number: 443 # порт OIDC Provider
        tls:
          # для организации mTLS используем сертификаты на egress
          caCertificates: /istio/oidc-certs/oidc-ca-chain.cert.pem
          clientCertificate: /istio/oidc-certs/oidc-tls.crt
          mode: MUTUAL
          privateKey: /istio/oidc-certs/oidc-tls.key
          sni: oidc.cluster.example.ru.ru # SNI сервера OIDC

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: egress-oidc-vs
spec:
  gateways:
    - mesh
    - egress-gw
  hosts:
    - oidc.cluster.example.ru.ru # hostname, который указан в properties приложения
  tcp:
    - match:
        - gateways:
            - mesh
          port: 4001 # порт OIDC Provider, который указан в properties приложения
      route:
        - destination:
            host: egress-svc
            port:
              number: 4000 # внутренний порт egress
            subset: postgres
    - match:
        - gateways:
            - egress-gw
          port: 4000 # внутренний порт egress
      route:
        - destination:
            host: oidc.cluster.example.ru.ru # hostname, по которому доступен OIDC Provider
            port:
              number: 443 # порт OIDC Provider
          weight: 100

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: egress-gw
spec:
  selector:
    istio: egress.cluster.example.ru.ru
  servers:
    - hosts:
        - psql.cluster.example.ru.ru # hostname, по которому доступна БД Postgres
      port:
        name: tcp-3000
        number: 3000 # порт на egress, заранее убедитесь, что нужный порт открыт
        protocol: TLS
      # межподовый mTLS
      tls:
        mode: ISTIO_MUTUAL
    - hosts:
        - oidc.cluster.example.ru.ru # hostname, по которому доступен OIDC Provider
      port:
        name: https-4000
        number: 4000 # порт на egress, заранее убедитесь, что нужный порт открыт
        protocol: HTTPS
      # межподовый mTLS
      tls:
        mode: ISTIO_MUTUAL
    # новый блок для AUDIT(kafka)
    - hosts:
        - audit.cluster.example.ru.ru # hostname, по которому доступен AUDIT
      port:
        name: tcp-5000
        number: 5000 # порт на egress, заранее убедитесь, что нужный порт открыт
        protocol: TLS
      # межподовый mTLS
      tls:
        mode: ISTIO_MUTUAL

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: egress-audit-se
spec:
  exportTo:
    - .
  hosts:
    - audit.cluster.example.ru.ru # hostname, по которому доступен AUDIT
  location: MESH_EXTERNAL
  ports:
    - name: tcp-9094
      number: 9094 # порт kafka-broker
      protocol: TCP
  resolution: DNS

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: egress-audit-dsr
spec:
  exportTo:
    - .
  host: audit.cluster.example.ru.ru # hostname, по которому доступен AUDIT
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      - port:
          number: 9094 # порт порт kafka-broker
        tls:
          # для организации mTLS используем сертификаты на egress
          caCertificates: /istio/kafka-certs/kafka-ca-chain.cert.pem
          clientCertificate: /istio/kafka-certs/kafka-tls.crt
          mode: MUTUAL
          privateKey: /istio/kafka-certs/kafka-tls.key
          sni: audit.cluster.example.ru.ru # SNI сервера Kafka

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: egress-audit-vs
spec:
  gateways:
    - mesh
    - egress-gw
  hosts:
    - audit.cluster.example.ru.ru # hostname, который указан в properties приложения
  tcp:
    - match:
        - gateways:
            - mesh
          port: 9094 # порт AUDIT, который указан в properties приложения
      route:
        - destination:
            host: egress-svc
            port:
              number: 5000 # внутренний порт egress
            subset: postgres
    - match:
        - gateways:
            - egress-gw
          port: 5000 # внутренний порт egress
      route:
        - destination:
            host: audit.cluster.example.ru.ru # hostname, по которому доступен AUDIT
            port:
              number: 9094 # порт AUDIT
          weight: 100

      tls:
        mode: ISTIO_MUTUAL

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: internal-mtls-egress-dr
spec:
  exportTo:
    - .
  host: egress-svc
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      - port:
          number: 3001
        tls:
          mode: ISTIO_MUTUAL
          sni: vm-test-fex-psql-320.vdc06.sy.your_domain
      - port:
          number: 4001
        tls:
          mode: ISTIO_MUTUAL
          sni: tfsx-keycloak-demo.dap.devpub-01.your_domain
      - port:
          number: 5001
        tls:
          mode: ISTIO_MUTUAL
          sni: vm-misk-fex-mock1-315.vdc06.sy.your_domain

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: tfsx-awp-frontend-istio-mtls
spec:
  exportTo:
    - .
  host: tfsx-awp-frontend-svc
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      - port:
          number: 8080
        tls:
          mode: ISTIO_MUTUAL

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: tfsx-awp-arm-istio-mtls
spec:
  exportTo:
    - .
  host: tfsx-awp-arm-svc
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      - port:
          number: 8080
        tls:
          mode: ISTIO_MUTUAL

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: tfsx-awp-configurator-mtls
spec:
  exportTo:
    - .
  host: tfsx-awp-configurator-svc
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
      - port:
          number: 8080
        tls:
          mode: ISTIO_MUTUAL

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: internal-mtls-pa
spec:
  mtls:
    mode: STRICT

          env:
            - name: WAIT_ISTIO_START
              # 1 = true, 0 = false
              value: '1'
            - name: WAIT_FILE_SECRET
              # файл с секретами указанный в шаблонах Vault Agent
              # vault.hashicorp.com/agent-inject-template-secrets.properties
              value: /vault/secrets/secrets.properties 

        vault.hashicorp.com/namespace: vault.exampleDomain.ru # namespace вашего Vault KV совместимого хранилища
        vault.hashicorp.com/role: example-role # role в вашем Vault KV совместимом хранилище
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/agent-pre-populate: 'false'
        vault.hashicorp.com/agent-inject-template-secrets.properties: |
                {{ with secret "KV/EXAMPLE/SECRETS/AWP_BC" }}
                  {{ range \$k, \$v := .Data }}
                    {{ \$k }}={{ \$v }}
                  {{ end }}
                {{ end }}
        vault.hashicorp.com/agent-inject-secret-secrets.properties: KV/EXAMPLE/SECRETS/AWP_BC # путь к секретам внутри хранилища
        vault.hashicorp.com/agent-inject-secret-server.ssl.trust-store.p12: 'true'
        vault.hashicorp.com/secret-volume-path-server.ssl.trust-store.p12: /tfs_configurator_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-server.ssl.key-store.p12: 'true'
        vault.hashicorp.com/secret-volume-path-server.ssl.key-store.p12: /tfs_configurator_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-jwt.trust.path.jks: 'true'
        vault.hashicorp.com/secret-volume-path-jwt.trust.path.jks: /tfs_configurator_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-audit.kafka.truststore.jks: 'true'
        vault.hashicorp.com/secret-volume-path-audit.kafka.truststore.jks: /tfs_configurator_backend/resource/certs
        vault.hashicorp.com/agent-inject-template-server.ssl.trust-store.p12: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_BC"}}{{base64Decode 
          .Data.server_ssl_trust_store_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-server.ssl.key-store.p12: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_BC"}}{{base64Decode
          .Data.server_ssl_key_store_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-jwt.trust.path.jks: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_BC"}}{{base64Decode
          .Data.jwt_trust_path_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-audit.kafka.truststore.jks: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_BC"}}{{base64Decode
          .Data.audit_kafka_truststore_base64}}{{ end }}

        vault.hashicorp.com/namespace: vault.exampleDomain.ru # namespace вашего Vault KV совместимого хранилища
        vault.hashicorp.com/role: example-role # role в вашем Vault KV совместимом хранилище
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/agent-pre-populate: 'false'
        vault.hashicorp.com/agent-inject-template-secrets.properties: |
          {{ with secret "KV/EXAMPLE/SECRETS/AWP_B" }}
            {{ range \$k, \$v := .Data }}
              {{ \$k }}={{ \$v }}
            {{ end }}
          {{ end }}
        vault.hashicorp.com/agent-inject-secret-secrets.properties: KV/EXAMPLE/SECRETS/AWP_B # путь к секретам внутри хранилища
        vault.hashicorp.com/agent-inject-secret-server.ssl.trust-store.p12: 'true'
        vault.hashicorp.com/secret-volume-path-server.ssl.trust-store.p12: /tfs_awp_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-server.ssl.key-store.p12: 'true'
        vault.hashicorp.com/secret-volume-path-server.ssl.key-store.p12: /tfs_awp_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-jwt.trust.path.jks: 'true'
        vault.hashicorp.com/secret-volume-path-jwt.trust.path.jks: /tfs_awp_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-audit.kafka.truststore.jks: 'true'
        vault.hashicorp.com/secret-volume-path-audit.kafka.truststore.jks: /tfs_awp_backend/resource/certs
        vault.hashicorp.com/agent-inject-template-server.ssl.trust-store.p12: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_B"}}{{base64Decode 
          .Data.server_ssl_trust_store_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-server.ssl.key-store.p12: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_B"}}{{base64Decode
          .Data.server_ssl_key_store_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-jwt.trust.path.jks: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_B"}}{{base64Decode
          .Data.jwt_trust_path_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-audit.kafka.truststore.jks: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_B"}}{{base64Decode
          .Data.audit_kafka_truststore_base64}}{{ end }}

kind: Deployment
apiVersion: apps/v1
metadata:
  name: tfsx-awp-frontend # указываем имя deployment
  labels:
    app: tfsx-awp-frontend
spec:
  replicas: 2
  selector:
    matchLabels:
      app: tfsx-awp-frontend
  template:
    metadata:
      labels:
        app: tfsx-awp-frontend
      annotations:
        # AWP FrontEnd не использует какие-либо секреты, указываем только аннотации для Data plane
        sidecar.istio.io/inject: 'true'
        sidecar.istio.io/proxyCPU: 256m
        sidecar.istio.io/proxyCPULimit: 256m
        sidecar.istio.io/proxyImage: >-
          registry2.k8s.ose-prod.your_domain/istio-syn/proxyv2@sha256:XXXXXXXXXXXXXXXXXXXX
        sidecar.istio.io/proxyMemory: 256Mi
        sidecar.istio.io/proxyMemoryLimit: 256Mi
        sidecar.istio.io/rewriteAppHTTPProbers: 'true'
    spec:
      volumes: # AWP FrontEnd несет с собой в Docker-образе NGINX
        - name: nginx-log
          emptyDir: {}
        - name: nginx-run
          emptyDir: {}
      containers:
        - resources:
            limits:
              cpu: 300m
              memory: 450Mi
            requests:
              cpu: 300m
              memory: 450Mi
          readinessProbe:
            httpGet:
              path: /
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 1
            timeoutSeconds: 5
            periodSeconds: 2
            successThreshold: 1
            failureThreshold: 3
          terminationMessagePath: /dev/termination-log
          name: tfsx-awp-frontend
          livenessProbe:
            httpGet:
              path: /
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 1
            timeoutSeconds: 5
            periodSeconds: 2
            successThreshold: 1
            failureThreshold: 3
          securityContext: # настройки, рекомендуемые стандартами кибербезопасности
            capabilities:
              drop:
                - ALL
            privileged: false
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          ports:
            - containerPort: 8080
              protocol: TCP
          imagePullPolicy: Always
          volumeMounts:
            - name: nginx-log
              mountPath: /var/opt/rh/rh-nginx116/log/nginx
            - name: nginx-run
              mountPath: /var/opt/rh/rh-nginx116/run/nginx
          terminationMessagePolicy: File
          image: >-
            HOST/awp-frontend/tfs-awp-frontend@sha256:XXXXXXXXXXXXXXXXXXXX
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      dnsPolicy: ClusterFirst
      securityContext: # настройки, рекомендуемые стандартами кибербезопасности
        runAsUser: 1002210000
        runAsGroup: 1002210000
        runAsNonRoot: true
        fsGroup: 1002210000
      imagePullSecrets:
        - name: image-puller-account
      schedulerName: default-scheduler
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 25%
      maxSurge: 25%
  revisionHistoryLimit: 10
  progressDeadlineSeconds: 600

kind: Deployment
apiVersion: apps/v1
metadata:
  name: tfsx-awp-arm # указываем имя deployment
  labels:
    app: tfsx-awp-arm
spec:
  replicas: 2
  selector:
    matchLabels:
      app: tfsx-awp-arm
  template:
    metadata:
      labels:
        app: tfsx-awp-arm
        secman-injector: enabled # включим Vault Agent inject
      annotations:
        sidecar.istio.io/proxyMemoryLimit: 256Mi
        sidecar.istio.io/proxyImage: >-
          registry2.k8s.ose-prod.your_domain/istio-syn/proxyv2@sha256:XXXXXXXXXXXXXXXXXXXX
        sidecar.istio.io/proxyCPULimit: 256m
        sidecar.istio.io/inject: 'true'
        sidecar.istio.io/proxyCPU: 256m
        vault.hashicorp.com/namespace: vault.exampleDomain.ru # namespace вашего Vault KV совместимого хранилища
        vault.hashicorp.com/role: example-role # role в вашем Vault KV совместимом хранилище
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/agent-pre-populate: 'false'
        vault.hashicorp.com/agent-inject-template-secrets.properties: |
          {{ with secret "KV/EXAMPLE/SECRETS/AWP_B" }}
            {{ range \$k, \$v := .Data }}
              {{ \$k }}={{ \$v }}
            {{ end }}
          {{ end }}
        vault.hashicorp.com/agent-inject-secret-secrets.properties: KV/EXAMPLE/SECRETS/AWP_B # путь к секретам внутри хранилища
        vault.hashicorp.com/agent-inject-secret-server.ssl.trust-store.p12: 'true'
        vault.hashicorp.com/secret-volume-path-server.ssl.trust-store.p12: /tfs_awp_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-server.ssl.key-store.p12: 'true'
        vault.hashicorp.com/secret-volume-path-server.ssl.key-store.p12: /tfs_awp_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-jwt.trust.path.jks: 'true'
        vault.hashicorp.com/secret-volume-path-jwt.trust.path.jks: /tfs_awp_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-audit.kafka.truststore.jks: 'true'
        vault.hashicorp.com/secret-volume-path-audit.kafka.truststore.jks: /tfs_awp_backend/resource/certs
        vault.hashicorp.com/agent-inject-template-server.ssl.trust-store.p12: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_B"}}{{base64Decode 
          .Data.server_ssl_trust_store_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-server.ssl.key-store.p12: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_B"}}{{base64Decode
          .Data.server_ssl_key_store_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-jwt.trust.path.jks: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_B"}}{{base64Decode
          .Data.jwt_trust_path_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-audit.kafka.truststore.jks: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_B"}}{{base64Decode
          .Data.audit_kafka_truststore_base64}}{{ end }}
    spec:
      volumes:
        - name: tfsx-awp-arm-config
          projected:
            sources: # убедитесь, что указанные ConfigMap's созданы в вашем namespace
              - configMap:
                  name: tfsx-awp-arm-application-cm
              - configMap:
                  name: tfsx-awp-arm-log-cm
            defaultMode: 256
        - name: logs
          emptyDir: {}
        - name: certs
          emptyDir: {}
        - name: tmp
          emptyDir: {}
      containers:
        - resources:
            limits:
              cpu: 450m
              memory: 650Mi
            requests:
              cpu: 450m
              memory: 650Mi
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 60
            timeoutSeconds: 5
            periodSeconds: 30
            successThreshold: 1
            failureThreshold: 3
          terminationMessagePath: /dev/termination-log
          name: tfsx-awp-arm
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 60
            timeoutSeconds: 5
            periodSeconds: 30
            successThreshold: 1
            failureThreshold: 3
          env:
            - name: WAIT_ISTIO_START
              value: '1'
            - name: WAIT_FILE_SECRET
              value: /vault/secrets/secrets.properties # Vault Agent загрузит секреты в данный файл
            - name: CONFIG_FOLDER_PATH
              value: /tfs_awp_backend/resource/
          securityContext: # настройки, рекомендуемые стандартами кибербезопасности
            capabilities:
              drop:
                - ALL
            privileged: false
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          ports:
            - containerPort: 8080
              protocol: TCP
          imagePullPolicy: Always
          volumeMounts:
            - name: logs
              mountPath: /var/log
            - name: tmp
              mountPath: /tmp
            - name: tfsx-awp-arm-config
              mountPath: /tfs_awp_backend/resource
          terminationMessagePolicy: File
          image: >-
            HOST/awp-backend/tfs-arm-backend@sha256:XXXXXXXXXXXXXXXXXXXX
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      dnsPolicy: ClusterFirst
      securityContext: # настройки, рекомендуемые стандартами кибербезопасности
        runAsUser: 1002210000
        runAsGroup: 1002210000
        runAsNonRoot: true
        fsGroup: 1002210000
      imagePullSecrets:
        - name: image-puller-account
      schedulerName: default-scheduler
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 25%
      maxSurge: 25%
  revisionHistoryLimit: 10
  progressDeadlineSeconds: 600

kind: Deployment
apiVersion: apps/v1
metadata:
  annotations:
  name: tfsx-awp-configurator # указываем имя deployment
  labels:
    app: tfsx-awp-configurator
spec:
  replicas: 2
  selector:
    matchLabels:
      app: tfsx-awp-configurator
  template:
    metadata:
      labels:
        app: tfsx-awp-configurator
        secman-injector: enabled # включим Vault Agent inject
      annotations:
        sidecar.istio.io/proxyMemoryLimit: 256Mi
        sidecar.istio.io/proxyImage: >-
          registry2.k8s.ose-prod.your_domain/istio-syn/proxyv2@sha256:XXXXXXXXXXXXXXXXXXXX
        sidecar.istio.io/proxyCPULimit: 256m
        sidecar.istio.io/inject: 'true'
        sidecar.istio.io/proxyCPU: 256m
        sidecar.istio.io/proxyMemory: 256Mi
        sidecar.istio.io/rewriteAppHTTPProbers: 'true'
        vault.hashicorp.com/namespace: vault.exampleDomain.ru # namespace вашего Vault KV совместимого хранилища
        vault.hashicorp.com/role: example-role # role в вашем Vault KV совместимом хранилище
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/agent-pre-populate: 'false'
        vault.hashicorp.com/agent-inject-template-secrets.properties: |
          {{ with secret "KV/EXAMPLE/SECRETS/AWP_BC" }}
            {{ range \$k, \$v := .Data }}
              {{ \$k }}={{ \$v }}
            {{ end }}
          {{ end }}
        vault.hashicorp.com/agent-inject-secret-secrets.properties: KV/EXAMPLE/SECRETS/AWP_BC # путь к секретам внутри хранилища
        vault.hashicorp.com/agent-inject-secret-server.ssl.trust-store.p12: 'true'
        vault.hashicorp.com/secret-volume-path-server.ssl.trust-store.p12: /tfs_configurator_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-server.ssl.key-store.p12: 'true'
        vault.hashicorp.com/secret-volume-path-server.ssl.key-store.p12: /tfs_configurator_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-jwt.trust.path.jks: 'true'
        vault.hashicorp.com/secret-volume-path-jwt.trust.path.jks: /tfs_configurator_backend/resource/certs
        vault.hashicorp.com/agent-inject-secret-audit.kafka.truststore.jks: 'true'
        vault.hashicorp.com/secret-volume-path-audit.kafka.truststore.jks: /tfs_configurator_backend/resource/certs
        vault.hashicorp.com/agent-inject-template-server.ssl.trust-store.p12: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_BC"}}{{base64Decode 
          .Data.server_ssl_trust_store_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-server.ssl.key-store.p12: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_BC"}}{{base64Decode
          .Data.server_ssl_key_store_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-jwt.trust.path.jks: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_BC"}}{{base64Decode
          .Data.jwt_trust_path_base64}}{{ end }}
        vault.hashicorp.com/agent-inject-template-audit.kafka.truststore.jks: >-
          {{with secret "KV/EXAMPLE/SECRETS/AWP_BC"}}{{base64Decode
          .Data.audit_kafka_truststore_base64}}{{ end }}
    spec:
      volumes: # убедитесь, что указанные ConfigMap's созданы в вашем namespace
        - name: tfsx-configurator-config
          projected:
            sources:
              - configMap:
                  name: tfsx-awp-configurator-cm
            defaultMode: 256
        - name: logs
          emptyDir: {}
        - name: tmp
          emptyDir: {}
      containers:
        - resources:
            limits:
              cpu: 450m
              memory: 650Mi
            requests:
              cpu: 450m
              memory: 650Mi
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 60
            timeoutSeconds: 5
            periodSeconds: 30
            successThreshold: 1
            failureThreshold: 3
          terminationMessagePath: /dev/termination-log
          name: tfsx-awp-configurator
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 60
            timeoutSeconds: 5
            periodSeconds: 30
            successThreshold: 1
            failureThreshold: 3
          env:
            - name: WAIT_ISTIO_START
              value: '1'
            - name: WAIT_FILE_SECRET
              value: /vault/secrets/secrets.properties # Vault Agent загрузит секреты в данный файл
            - name: CONFIG_FOLDER_PATH
              value: /tfs_configurator_backend/resource/ # отдельно Vault Agent загрузит нужные сертификаты в каталог /certs
          securityContext: # настройки, рекомендуемые стандартами кибербезопасности
            capabilities:
              drop:
                - ALL
            privileged: false
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          ports:
            - containerPort: 8080
              protocol: TCP
          imagePullPolicy: Always
          volumeMounts:
            - name: logs
              mountPath: /var/log
            - name: tmp
              mountPath: /tmp
            - name: tfsx-configurator-config
              mountPath: /tfs_configurator_backend/resource/
          terminationMessagePolicy: File
          image: >-
            HOST/awp-backend-configurator/tfs-configurator-backend@sha256:XXXXXXXXXXXXXXXXXXXX
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      dnsPolicy: ClusterFirst
      securityContext: # настройки, рекомендуемые стандартами кибербезопасности
        runAsUser: 1002210000
        runAsGroup: 1002210000
        runAsNonRoot: true
        fsGroup: 1002210000
      imagePullSecrets:
        - name: image-puller-account
      schedulerName: default-scheduler
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 25%
      maxSurge: 25%
  revisionHistoryLimit: 10
  progressDeadlineSeconds: 600

  # Конфигурирование раздела junctions, отвечающего за перенаправление входящего трафика
  # serverAddresses указывает на hosts's, которые были указаны в Ingress-controller при развертывании компонентов AWP
  RDS_START_CONF: |
    {
      "junctions": [
        {
          "junctionPoint": "/rest",
          "indexUrl": "/rest/v1/routes",
          "junctionName": "Administrator AWP (backend)",
          "https": false,
          "sslCommonName": "*",
          "transparent": true,
          "applyJctRequestFilter": "common/rds-set-header-host-to-backend.location.conf, common/rds-set-header-host-to-backend.location.conf",
          "serverAddresses": [
            "awp-backend.cluster.example.ru.ru"
          ]
        },
        {
          "junctionPoint": "/configurator",
          "indexUrl": "/rest/v1/contexts",
          "junctionName": "Сonfigurator (backend)",
          "https": false,
          "sslCommonName": "*",
          "transparent": false,
          "applyJctRequestFilter": "common/rds-set-header-host-to-backend.location.conf, common/rds-set-header-host-to-backend.location.conf",
          "serverAddresses": [
            "awp-backend-configurator.cluster.example.ru.ru"
          ]
        },
        {
          "junctionPoint": "/ui",
          "indexUrl": "/",
          "junctionName": "Administrator AWP (frontend)",
          "https": false,
          "sslCommonName": "*",
          "transparent": false,
          "applyJctRequestFilter": "common/rds-set-header-host-to-backend.location.conf, common/rds-set-header-host-to-backend.location.conf",
          "serverAddresses": [
            "awp-frontend.cluster.example.ru.ru"
          ]
        }
        ]
      }

  # конфигурирование взаимодействия с OIDC Provider и настройки стенда
  PROXY_DNSNAME: host.cluster.example.ru.ru
  PROXY_SESSION_SECRET: >-
    is-very-very-very-big-secret-80--343456567hkhkhkjhkhjkgfdrtrytrufnbcvbnvnbbjhuituyrtdfghddgh878__73434424@#323@#4%6&%456+
  SYSLOG_SERVER: '{ip}'
  OIDC_SCOPE: openid
  PROXY_OIDC_CLIENT_SECRET: 32ae75ad-629b-4638-aca4-d3851a70beaf
  STEND_NAME: test-stend
  OIDC_SSL_VERIFY: 'false'
  DEBUG: '1'
  STEND_ABBR: IAM Test
  OIDC_DISCOVERY_URL: >-
    https://oidc.test.uri.ru/auth
  OIDC_USE_CLIENT_CERT: 'false'
  PROXY_OIDC_CLIENT_ID: test-client
  OIDC_LOGOUT_URI: >-
    https://oidc.test.uri.ru/auth
  STEND_TYPE: Test

kind: Deployment
apiVersion: apps/v1
metadata:
  name: iamproxy-test
  labels:
    app: iamproxy-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: iamproxy-test
  template:
    metadata:
      labels:
        app: iamproxy-test
      # аннотации для инжектинга сайдкара istio-envoy
      annotations:
        sidecar.istio.io/inject: 'true'
        sidecar.istio.io/proxyCPU: 156m
        sidecar.istio.io/proxyCPULimit: 156m
        sidecar.istio.io/proxyImage: >-
          registry2.k8s.ose-prod.your_domain/istio-syn/proxyv2@sha256:XXXXXXXXXXXXXXXXXXXX
        sidecar.istio.io/proxyMemory: 156Mi
        sidecar.istio.io/proxyMemoryLimit: 156Mi
        sidecar.istio.io/rewriteAppHTTPProbers: 'true'
    spec:
      volumes:
        - name: tmp
          emptyDir: {}
      containers:
        - resources:
            limits:
              cpu: 400m
              memory: 500Mi
            requests:
              cpu: 400m
              memory: 500Mi
          terminationMessagePath: /dev/termination-log
          name: iamproxy-test
          env:
            - name: DEBUG
              value: '0'
            - name: OPENSHIFT_POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
          securityContext: # настройки безопасности
            capabilities:
              drop:
                - ALL
            privileged: false
            runAsUser: 10001
            runAsGroup: 12000
            runAsNonRoot: true
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            seccompProfile:
              type: RuntimeDefault
          ports:
            - name: http-status
              containerPort: 10080
              protocol: TCP
            - containerPort: 8080
              protocol: TCP
            - containerPort: 8443
              protocol: TCP
          imagePullPolicy: Always
          volumeMounts:
            - name: tmp
              mountPath: /tmp/platformauth-proxy
          terminationMessagePolicy: File
          envFrom:
            - configMapRef:
                name: iamproxy-test-cm # ConfigMap, должен быть создан заранее
          image: 'host/ci90000019_iamproxy/auth/iamproxy:{version}'
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      dnsPolicy: ClusterFirst
      securityContext:
        fsGroup: 13000
      imagePullSecrets:
        - name: '{account}'
      schedulerName: default-scheduler
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 25%
      maxSurge: 25%
  revisionHistoryLimit: 10
  progressDeadlineSeconds: 600