Initial commit

infrastructure/percona-everest/manifests/istio-virtualservice.yaml

@@ -0,0 +1,18 @@
+# infrastructure/percona-everest/istio-virtualservice.yaml
+# Percona Everest UI - Istio VirtualService
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: everest
+  namespace: everest-system
+spec:
+  hosts:
+    - everest.kube.huskypup.net
+  gateways:
+    - istio-system/edge
+  http:
+    - route:
+        - destination:
+            host: everest.everest-system.svc.cluster.local
+            port:
+              number: 8080

infrastructure/percona-everest/values.yaml

@@ -0,0 +1,95 @@
+# infrastructure/percona-everest/values.yaml
+# Percona Everest - Cloud-native database management platform
+#
+# Provides MySQL (PXC), MongoDB (PSMDB), and PostgreSQL operators
+# with a unified web UI dashboard for managing database clusters.
+#
+# UI: https://everest.kube.huskypup.net
+# DB Namespace: everest (managed databases go here)
+# Operator Namespace: everest-system
+# OLM Namespace: everest-olm
+
+# Disable telemetry
+telemetry: false
+
+# Server configuration
+server:
+  resources:
+    limits:
+      memory: 500Mi
+    requests:
+      cpu: 10m
+      memory: 20Mi
+  service:
+    name: everest
+    type: ClusterIP
+    port: 8080
+  # RBAC - enabled for security
+  rbac:
+    enabled: true
+    policy: |
+      g, admin, role:admin
+  # OIDC configuration for Authentik SSO
+  # Everest validates OIDC at startup via the issuerUrl's .well-known endpoint.
+  # The ConfigMap key is "oidc.config" (YAML block with clientId, issuerUrl, scopes).
+  # The helm.sh/resource-policy: keep annotation preserves it across upgrades.
+  # On fresh install, OIDC may not be available yet (Authentik blueprint not processed).
+  # In that case, leave oidc empty here and patch the ConfigMap after Authentik is ready:
+  #   kubectl -n everest-system patch configmap everest-settings --type=merge \
+  #     -p '{"data":{"oidc.config":"clientId: percona-everest-oidc-client-id-static-2025\nissuerUrl: https://auth.kube.huskypup.net/application/o/percona-everest/\nscopes:\n  - openid\n  - profile\n  - email\n"}}'
+  #   kubectl -n everest-system rollout restart deployment/everest-server
+  oidc: {}
+  # TLS terminated at ingress layer - no need for server-side TLS
+  tls:
+    enabled: false
+
+# Operator configuration
+operator:
+  resources:
+    limits:
+      memory: 128Mi
+    requests:
+      cpu: 5m
+      memory: 64Mi
+
+# Data importers - all three DB operators enabled
+dataImporters:
+  perconaPGOperator:
+    enabled: true
+  perconaPXCOperator:
+    enabled: true
+  perconaPSMDBOperator:
+    enabled: true
+
+# OLM is required for Everest operator management
+olm:
+  install: true
+  namespace: "everest-olm"
+  namespaceOverride: "everest-olm"
+
+# Database namespace - where managed DB clusters are deployed
+dbNamespace:
+  enabled: true
+  namespaceOverride: "everest"
+
+# =====================================================
+# DISABLE ALL BUNDLED MONITORING
+# We already have Prometheus + Grafana (Phase 5)
+# =====================================================
+kube-state-metrics:
+  enabled: false
+
+monitoring:
+  enabled: false
+
+createMonitoringResources: false
+
+pmm:
+  enabled: false
+
+pmm3:
+  enabled: false
+
+# Ingress handled externally via percona-everest/ingress.yaml
+ingress:
+  enabled: false