init: registry server + operator from VM

k8s/README.md

@@ -0,0 +1,30 @@
+# k8s 🔧
+
+Кратко: Kubernetes‑манифесты для namespace `terra` — развёртывание `registry-server`, `terraform-operator`, Ingress, TLS и связанные ресурсы (S3, CRD, builder ConfigMap).
+
+## Важные файлы
+- `00-namespace.yaml` — namespace `terra`
+- `00-rbac.yaml` — RBAC для оператора
+- `02-crd.yaml` — CRD для операторов (ProviderRelease)
+- `03-build-script.yaml` — ConfigMap для сборщика Job'ов
+- `04-operator-deployment.yaml` — Deployment для оператора
+- `05-registry-server.yaml`, `06-registry-server-docs.yaml` — Deployment, Service и Ingress для `registry-server`
+
+## Как перенести на новый домен (коротко) ✅
+1. **Ingress**: в манифесте (обычно `05-*` или `registry-ingress`) заменить `host: terra.k8c.ru` на новый домен и убедиться в корректной аннотации `cert-manager.io/cluster-issuer` (или задать другой `secretName`).
+2. **Certificate**: cert-manager автоматически выпустит/обновит TLS; проверьте `kubectl -n terra get certificate registry-tls -o yaml` и дождитесь `status.conditions[*].type == Ready`.
+3. **Deployment env**: заменить `REGISTRY_HOSTNAME` в `04-operator-deployment.yaml` и в `registry-server` на новый домен.
+4. **DNS**: добавить A/CNAME запись для нового домена, указывающую на IP балансировщика (`kubectl -n terra get ingress registry-ingress -o jsonpath='{.status.loadBalancer.ingress[0].ip}'`).
+5. **Secrets & storage**: используйте `s3-credentials` (S3_ENDPOINT/S3_ACCESS_KEY/S3_SECRET_KEY) и убедитесь в доступности S3.
+6. **Apply & Verify**:
+   - `kubectl apply -f manifests/`
+   - `kubectl -n terra describe ingress registry-ingress`
+   - `kubectl -n terra get certificate registry-tls`
+   - `curl -vk https://<domain>/docs/<namespace>/<name>/<version>/`
+
+## Проверки (read-only)
+- `kubectl -n terra get ingress,svc,deploy,po,secret`
+- `kubectl -n terra get certificate registry-tls -o yaml`
+- `kubectl -n terra logs <registry-pod>`
+
+> Примечание: это инструкция для операции вручную/CI; я ничего не меняю в кластере автоматически.

k8s/base/deployment.yaml

@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+    spec:
+      containers:
+      - name: my-container
+        image: my-image:latest
+        ports:
+        - containerPort: 80

k8s/base/ingress.yaml

@@ -0,0 +1,16 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: my-ingress
+spec:
+  rules:
+  - host: example.local
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: my-service
+            port:
+              number: 80

k8s/base/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

k8s/base/service.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: my-service
+spec:
+  selector:
+    app: my-app
+  ports:
+  - protocol: TCP
+    port: 80
+    targetPort: 80

k8s/overlays/dev/clusterissuer-selfsigned-dev.yaml

@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-dev
+spec:
+  selfSigned: {}

k8s/overlays/dev/clusterissuer-staging-dev.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging-dev
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: devops@example.com
+    privateKeySecretRef:
+      name: letsencrypt-staging-dev
+    solvers:
+    - http01:
+        ingress:
+          class: nginx

k8s/overlays/dev/image-patch.yaml

@@ -0,0 +1,10 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-deployment
+spec:
+  template:
+    spec:
+      containers:
+      - name: my-container
+        image: nginx:stable

k8s/overlays/dev/ingress-patch.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: my-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: selfsigned-dev
+    kubernetes.io/ingress.class: nginx
+spec:
+  tls:
+  - hosts:
+    - terr.kube5s.ru
+    secretName: terr-kube5s-ru-tls
+  rules:
+  - host: terr.kube5s.ru
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: my-service
+            port:
+              number: 80

k8s/overlays/dev/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+namespace: terra-dev
+patchesStrategicMerge:
+  - ingress-patch.yaml
+  - image-patch.yaml

k8s/registry-deployment-new.yaml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: registry-server
+  namespace: terra
+  labels:
+    app: registry-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: registry-server
+  template:
+    metadata:
+      labels:
+        app: registry-server
+    spec:
+      containers:
+      - name: registry-server
+        image: naeel/terraform-registry-server:docs-dev
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 8080
+        env:
+        - name: REGISTRY_HOSTNAME
+          value: "terra.k8c.ru"
+        - name: S3_ENDPOINT
+          value: "s3.msk-1.ngcloud.ru"
+        - name: S3_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              name: s3-credentials
+              key: access-key
+        - name: S3_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: s3-credentials
+              key: secret-key
+        - name: S3_BUCKET
+          value: "terraform-registry"
+        - name: S3_USE_SSL
+          value: "true"

k8s/registry-ingress-new.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: registry-ingress
+  namespace: terra
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    nginx.ingress.kubernetes.io/proxy-body-size: "100m"
+    nginx.ingress.kubernetes.io/rewrite-target: "/$2"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - terra.k8c.ru
+    secretName: registry-tls
+  rules:
+  - host: terra.k8c.ru
+    http:
+      paths:
+      - path: "/()(.*)"
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: registry-server
+            port:
+              number: 80