chore: restructured project

terraform/main/configs/api_gateway/spec.yaml

@@ -0,0 +1,141 @@
+openapi: "3.0.0"
+info:
+  version: 1.0.0
+  title: API Gateway
+
+paths:
+  /health:
+    get:
+      summary: Health Check
+      description: Endpoint to confirm the API Gateway service is operational.
+      operationId: healthCheck
+      x-yc-apigateway-integration:
+        type: dummy
+        http_code: 200
+        http_headers:
+          "Content-Type": "application/json"
+        content:
+          "*": '{"status": "ok"}'
+      responses:
+        "200":
+          description: Service is healthy.
+
+  /config:
+    get:
+      summary: Config
+      description: Implementation of frontend dynamic configuration.
+      operationId: config
+      x-yc-apigateway-integration:
+        type: dummy
+        http_code: 200
+        http_headers:
+          "Content-Type": "application/json"
+        content:
+          "*": '{"backend_url": "https://some.backend.example.com"}'
+      responses:
+        "200":
+          description: Config returned.
+
+  /assets/{path+}:
+    get:
+      summary: Get Static File
+      description: Serves static files from the S3 bucket.
+      operationId: getAssetsFile
+      parameters:
+        - name: path
+          in: path
+          required: true
+          schema:
+            type: string
+      x-yc-apigateway-integration:
+        type: object_storage
+        bucket: "${bucket_name}"
+        object: "current/assets/{path}"
+        error_object: "old/assets/{path}"
+      responses:
+        "200":
+          description: Static file content.
+        "404":
+          description: Asset not found.
+
+  /img/{path+}:
+    get:
+      summary: Get Static File
+      description: Serves static files from the S3 bucket.
+      operationId: getImgFile
+      parameters:
+        - name: path
+          in: path
+          required: true
+          schema:
+            type: string
+      x-yc-apigateway-integration:
+        type: object_storage
+        bucket: "${bucket_name}"
+        object: "current/img/{path}"
+        error_object: "old/img/{path}"
+      responses:
+        "200":
+          description: Static file content.
+        "404":
+          description: Asset not found.
+
+  /favicon.svg:
+    get:
+      summary: Get Static File
+      description: Serves static files from the S3 bucket.
+      operationId: getFaviconFile
+      parameters:
+        - name: path
+          in: path
+          required: true
+          schema:
+            type: string
+      x-yc-apigateway-integration:
+        type: object_storage
+        bucket: "${bucket_name}"
+        object: "current/favicon.svg"
+        error_object: "old/favicon.svg"
+      responses:
+        "200":
+          description: Static file content.
+        "404":
+          description: Asset not found.
+
+  /:
+    get:
+      summary: Serve SPA Entrypoint (Root)
+      description: Serves the main 'index.html' file for requests to the root of the domain.
+      operationId: getSpaIndexRoot
+      x-yc-apigateway-integration:
+        type: object_storage
+        bucket: "${bucket_name}"
+        object: "current/index.html"
+        error_object: "old/index.html"
+      responses:
+        "200":
+          description: Main HTML page of the SPA.
+        "404":
+          description: "'index.html' not found in the bucket."
+
+  /{proxy+}:
+    get:
+      summary: Serve SPA Entrypoint (Client-Side Routes)
+      description: Catches all other application paths and serves 'index.html', enabling client-side routing.
+      operationId: getSpaIndexCatchAll
+      parameters:
+        - name: proxy
+          in: path
+          required: true
+          schema:
+            type: string
+      x-yc-apigateway-integration:
+        type: object_storage
+        bucket: "${bucket_name}"
+        object: "current/index.html"
+        error_object: "old/index.html"
+      responses:
+        "200":
+          description: Main HTML page of the SPA.
+        "404":
+          description: "'index.html' not found in the bucket."

terraform/main/configs/cloud_init/main_master.yaml

@@ -0,0 +1,61 @@
+#cloud-config
+
+ssh_pwauth: false
+package_update: true
+package_upgrade: true
+
+growpart:
+  mode: growpart
+  devices: ["/"]
+  ignore_growroot_disabled: true
+
+users:
+  - name: ubuntu
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    lock_passwd: true
+    shell: /bin/bash
+
+write_files:
+  - path: /var/lib/rancher/credentialprovider/config.yaml
+    permissions: "0600"
+    encoding: b64
+    content: ${k3s_credential_provider_config}
+  - path: /var/lib/rancher/credentialprovider/bin/yc-credential-provider
+    permissions: "0700"
+    encoding: b64
+    content: ${k3s_credential_provider}
+
+runcmd:
+  - |
+    export HOME=/root
+    curl https://storage.yandexcloud.net/yandexcloud-yc/install.sh | bash -s -- -i /tmp/yc -n
+    mv /tmp/yc/bin/yc /usr/bin/
+    yc config set instance-service-account true
+    yc config set cloud-id ${yc_cloud_id}
+  - |
+    DISK=/dev/disk/by-id/virtio-data
+    K3S_DIR=${k3s_dir}
+    mkdir -p $K3S_DIR
+    if ! blkid $DISK > /dev/null; then
+        mkfs.ext4 $DISK
+    fi
+    echo "$DISK $K3S_DIR ext4 defaults 0 0" >> /etc/fstab
+    mount -a
+    resize2fs $DISK
+  - |
+    curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=stable INSTALL_K3S_EXEC="server \
+        --cluster-init \
+        --token=${k3s_token} \
+        --node-name=`hostname -f` \
+        --node-taint CriticalAddonsOnly=true:NoExecute \
+        --write-kubeconfig ${k3s_dir}/kubeconfig/config \
+        --image-credential-provider-bin-dir /var/lib/rancher/credentialprovider/bin \
+        --image-credential-provider-config /var/lib/rancher/credentialprovider/config.yaml \
+        --data-dir=${k3s_dir} \
+        --default-local-storage-path=${k3s_dir}/storage" sh -
+  - |
+    curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+  - |
+    mkdir -p /home/ubuntu/.kube
+    cp ${k3s_dir}/kubeconfig/config /home/ubuntu/.kube/config
+    chown -R ubuntu:ubuntu /home/ubuntu/

terraform/main/configs/cloud_init/master.yaml

@@ -0,0 +1,58 @@
+#cloud-config
+
+ssh_pwauth: false
+package_update: true
+package_upgrade: true
+
+growpart:
+  mode: growpart
+  devices: ["/"]
+  ignore_growroot_disabled: true
+
+users:
+  - name: ubuntu
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    lock_passwd: true
+    shell: /bin/bash
+
+write_files:
+  - path: /var/lib/rancher/credentialprovider/config.yaml
+    permissions: "0600"
+    encoding: b64
+    content: ${k3s_credential_provider_config}
+  - path: /var/lib/rancher/credentialprovider/bin/yc-credential-provider
+    permissions: "0700"
+    encoding: b64
+    content: ${k3s_credential_provider}
+
+runcmd:
+  - |
+    export HOME=/root
+    curl https://storage.yandexcloud.net/yandexcloud-yc/install.sh | bash -s -- -i /tmp/yc -n
+    mv /tmp/yc/bin/yc /usr/bin/
+    yc config set instance-service-account true
+    yc config set cloud-id ${yc_cloud_id}
+  - |
+    DISK=/dev/disk/by-id/virtio-data
+    K3S_DIR=${k3s_dir}
+    mkdir -p $K3S_DIR
+    if ! blkid $DISK > /dev/null; then
+        mkfs.ext4 $DISK
+    fi
+    echo "$DISK $K3S_DIR ext4 defaults 0 0" >> /etc/fstab
+    mount -a
+    resize2fs $DISK
+  - |
+    curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=stable INSTALL_K3S_EXEC="server \
+        --server=https://${k3s_master_ip}:6443 \
+        --token=${k3s_token} \
+        --node-name=`hostname -f` \
+        --write-kubeconfig ${k3s_dir}/kubeconfig/config \
+        --image-credential-provider-bin-dir /var/lib/rancher/credentialprovider/bin \
+        --image-credential-provider-config /var/lib/rancher/credentialprovider/config.yaml \
+        --data-dir=${k3s_dir} \
+        --default-local-storage-path=${k3s_dir}/storage" sh -
+  - |
+    mkdir -p /home/ubuntu/.kube
+    cp ${k3s_dir}/kubeconfig/config /home/ubuntu/.kube/config
+    chown -R ubuntu:ubuntu /home/ubuntu/

terraform/main/configs/cloud_init/worker.yaml

@@ -0,0 +1,56 @@
+#cloud-config
+
+ssh_pwauth: false
+package_update: true
+package_upgrade: true
+
+growpart:
+  mode: growpart
+  devices: ["/"]
+  ignore_growroot_disabled: true
+
+users:
+  - name: ubuntu
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    lock_passwd: true
+    shell: /bin/bash
+
+write_files:
+  - path: /var/lib/rancher/credentialprovider/config.yaml
+    permissions: "0600"
+    encoding: b64
+    content: ${k3s_credential_provider_config}
+  - path: /var/lib/rancher/credentialprovider/bin/yc-credential-provider
+    permissions: "0700"
+    encoding: b64
+    content: ${k3s_credential_provider}
+
+runcmd:
+  - |
+    export HOME=/root
+    curl https://storage.yandexcloud.net/yandexcloud-yc/install.sh | bash -s -- -i /tmp/yc -n
+    mv /tmp/yc/bin/yc /usr/bin/
+    yc config set instance-service-account true
+    yc config set cloud-id ${yc_cloud_id}
+  - |
+    DISK=/dev/disk/by-id/virtio-data
+    K3S_DIR=${k3s_dir}
+    mkdir -p $K3S_DIR
+    if ! blkid $DISK > /dev/null; then
+        mkfs.ext4 $DISK
+    fi
+    echo "$DISK $K3S_DIR ext4 defaults 0 0" >> /etc/fstab
+    mount -a
+    resize2fs $DISK
+  - |
+    curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=stable INSTALL_K3S_EXEC="agent \
+        --server=https://${k3s_master_ip}:6443 \
+        --token=${k3s_token} \
+        --node-name=`hostname -f` \
+        --image-credential-provider-bin-dir /var/lib/rancher/credentialprovider/bin \
+        --image-credential-provider-config /var/lib/rancher/credentialprovider/config.yaml \
+        --data-dir=${k3s_dir}" sh -
+  - |
+    mkdir -p /home/ubuntu/.kube
+    cp ${k3s_dir}/kubeconfig/config /home/ubuntu/.kube/config
+    chown -R ubuntu:ubuntu /home/ubuntu/

terraform/main/configs/k3s/credentialprovider.yaml

@@ -0,0 +1,10 @@
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: CredentialProviderConfig
+providers:
+  - name: yc-credential-provider
+    apiVersion: credentialprovider.kubelet.k8s.io/v1
+    matchImages:
+      - "cr.yandex"
+      - "cr.cloud.yandex.net"
+      - "container-registry.cloud.yandex.net"
+    defaultCacheDuration: "1h"

terraform/main/configs/k3s/yc-credential-provider

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+command -v jq >/dev/null || { echo "jq required" >&2; exit 1; }
+command -v yc >/dev/null || { echo "yc required" >&2; exit 1; }
+
+req=$(cat)
+image=$(printf '%s' "$req" | jq -r '.image // empty')
+
+if [[ -z "$image" ]]; then
+  echo "no image in request" >&2
+  exit 1
+fi
+
+registry=${image%%/*}
+if [[ -z "$registry" ]]; then
+  registry="$image"
+fi
+
+creds_json=$(printf '%s' "$image" | yc container docker-credential get 2>/dev/null) || {
+  echo "yc docker-credential failed" >&2
+  exit 1
+}
+
+username=$(printf '%s' "$creds_json" | jq -r '.Username // empty')
+secret=$(printf '%s' "$creds_json" | jq -r '.Secret // empty')
+
+if [[ -z "$username" || -z "$secret" ]]; then
+  echo "failed to parse yc output" >&2
+  exit 1
+fi
+
+jq -n \
+  --arg api "credentialprovider.kubelet.k8s.io/v1" \
+  --arg kind "CredentialProviderResponse" \
+  --arg reg "$registry" \
+  --arg user "$username" \
+  --arg pass "$secret" \
+  --arg cache "6h" \
+  --arg keyType "Registry" \
+'{
+  apiVersion: $api,
+  kind: $kind,
+  auth: { ($reg): { username: $user, password: $pass } },
+  cacheDuration: $cache,
+  cacheKeyType: $keyType
+}'