From 1ae2a13198d208cb333d74c47f0444a0c005cf8c Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Tue, 11 Aug 2026 12:41:56 +0300
Subject: [PATCH] expose vault UI for wb via istio at vault-srx.wb.ru, routes
 to vault-vault-contour-active on 8200

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../infrastructure/patches/istio-config.yaml  | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/clusters/wb/infrastructure/patches/istio-config.yaml b/clusters/wb/infrastructure/patches/istio-config.yaml
index 1f91b3b..4fa371e 100644
--- a/clusters/wb/infrastructure/patches/istio-config.yaml
+++ b/clusters/wb/infrastructure/patches/istio-config.yaml
@@ -71,6 +71,16 @@ spec:
                     - vmalert-srx.wb.ru
                   tls:
                     credentialName: istio-gateway-wildcard-cert
+            vault:
+              name: vault-gw
+              namespace: gateway
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - vault-srx.wb.ru
+                  tls:
+                    credentialName: istio-gateway-wildcard-cert
           virtualServices:
             gitea-vs:
               namespace: gitea
@@ -127,3 +137,14 @@ spec:
                     prefix: /
                   service: goalert.goalert.svc.cluster.local
                   port: 8081
+            vault-vs:
+              namespace: vault
+              hosts:
+                - vault-srx.wb.ru
+              gateways:
+                - gateway/vault-gw
+              routes:
+                - path:
+                    prefix: /
+                  service: vault-vault-contour-active.vault.svc.cluster.local
+                  port: 8200