sarex/iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master'

Browse Source
This commit is contained in:
emelinda 2026-10-15 18:00:43 +03:00
commit 1067163ef7
107 changed files with 15732 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
.DS_Store vendored Normal file
View File

Binary file not shown.

BIN
apps/.DS_Store vendored Normal file
View File

Binary file not shown.

2
apps/attachments/brusnika-stage/backend.yaml
View File

@ -35,7 +35,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/attachments:production_6dbb4dce
_default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
pullPolicy:
_default: IfNotPresent

6
apps/bi/brusnika-stage/backend.yaml
View File

@ -37,7 +37,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_37902c73
_default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_e607dcc6
pullPolicy:
_default: IfNotPresent
@ -119,6 +119,10 @@ spec:
_default: regcred
envs:
- name: SUPERSET_HOST
value:
_default: "https://superset.test.sarex.brusnika.tech"
- name: SETTINGS_DEBUG
value:
_default: "0"

2
apps/bim/brusnika-stage/backend.yaml
View File

@ -35,7 +35,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
_default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a
pullPolicy:
_default: IfNotPresent

40
apps/cde/brusnika-stage/cde-flowscallback.yaml Normal file
View File

@ -0,0 +1,40 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cde-flowscallback
namespace: orchestrator
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-flowscallback
app.kubernetes.io/version: 0.0.1
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-flowscallback
template:
metadata:
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde-worker-flowscallback
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- env:
- name: IS_CONTOUR
value: 'True'
- name: S3_IS_CONTOUR
value: 'True'
envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:preprod_0986a572
imagePullPolicy: Always
name: cde-worker-flowscallback
imagePullSecrets:
- name: dockerhub

40
apps/cde/brusnika-stage/cde-splitpdf.yaml Normal file
View File

@ -0,0 +1,40 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cde-splitpdf
namespace: orchestrator
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-splitpdf
app.kubernetes.io/version: 0.0.1
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-splitpdf
template:
metadata:
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde-worker-splitpdf
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- env:
- name: S3_IS_CONTOUR
value: 'true'
- name: IS_CONTOUR
value: 'True'
envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_4.4.1
imagePullPolicy: Always
name: cde-worker-splitpdf
imagePullSecrets:
- name: dockerhub

35
apps/cde/brusnika-stage/cde-worker-alert.yaml Normal file
View File

@ -0,0 +1,35 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cde-worker-alert
namespace: orchestrator
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-alert
app.kubernetes.io/version: 0.0.1
spec:
replicas: 0
selector:
matchLabels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-alert
template:
metadata:
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde-worker-alert
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/orchestrator:latest
imagePullPolicy: Always
name: cde-worker-alert
imagePullSecrets:
- name: dockerhub

40
apps/cde/brusnika-stage/cde-worker-copy.yaml Normal file
View File

@ -0,0 +1,40 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cde-worker-copy
namespace: orchestrator
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-copy
app.kubernetes.io/version: 0.0.1
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-copy
template:
metadata:
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde-worker-copy
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- env:
- name: IS_CONTOUR
value: 'True'
- name: S3_IS_CONTOUR
value: 'True'
envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:preprod_0986a572
imagePullPolicy: Always
name: cde-worker-copy
imagePullSecrets:
- name: dockerhub

41
apps/cde/brusnika-stage/cde-worker-copyv2.yaml Normal file
View File

@ -0,0 +1,41 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cde-worker-copyv2
namespace: orchestrator
labels:
app.kubernetes.io/instance: name
app.kubernetes.io/name: cde-worker-copyv2
app.kubernetes.io/version: 0.0.1
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: name
app.kubernetes.io/name: cde-worker-copy
template:
metadata:
labels:
app.kubernetes.io/instance: name
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde-worker-copy
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- env:
- name: S3_IS_CONTOUR
value: 'true'
- name: IS_CONTOUR
value: 'True'
envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/copyv2-worker:prod_4.0.2
imagePullPolicy: Always
name: cde-worker-copy
securityContext: {}
imagePullSecrets:
- name: dockerhub

40
apps/cde/brusnika-stage/cde-worker-markings.yaml Normal file
View File

@ -0,0 +1,40 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cde-worker-markings
namespace: orchestrator
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-markings
app.kubernetes.io/version: 0.0.1
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-markings
template:
metadata:
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde-worker-markings
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- env:
- name: IS_CONTOUR
value: 'True'
- name: S3_IS_CONTOUR
value: 'True'
envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:preprod_eb50f30e
imagePullPolicy: Always
name: cde-worker-markings
imagePullSecrets:
- name: dockerhub

40
apps/cde/brusnika-stage/cde-worker-sign.yaml Normal file
View File

@ -0,0 +1,40 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cde-worker-sign
namespace: orchestrator
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-sign
app.kubernetes.io/version: 0.0.1
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-sign
template:
metadata:
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde-worker-sign
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- env:
- name: IS_CONTOUR
value: 'True'
- name: S3_IS_CONTOUR
value: 'True'
envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:preprod_0986a572
imagePullPolicy: Always
name: cde-worker-sign
imagePullSecrets:
- name: dockerhub

40
apps/cde/brusnika-stage/cde-worker-update-bundles.yaml Normal file
View File

@ -0,0 +1,40 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cde-worker-update-bundles
namespace: orchestrator
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-updatebundles
app.kubernetes.io/version: 0.0.1
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde-worker-updatebundles
template:
metadata:
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde-worker-updatebundles
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- env:
- name: IS_CONTOUR
value: 'True'
- name: S3_IS_CONTOUR
value: 'True'
envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:preprod_0986a572
imagePullPolicy: Always
name: cde-worker-update-bundles
imagePullSecrets:
- name: dockerhub

55
apps/cde/brusnika-stage/cde.yaml Normal file
View File

@ -0,0 +1,55 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: cde
namespace: orchestrator
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde
app.kubernetes.io/version: 0.0.1
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde
template:
metadata:
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/cde:production_e5316bd0
imagePullPolicy: Always
livenessProbe:
failureThreshold: 3
initialDelaySeconds: 15
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: 8080
timeoutSeconds: 1
name: cde
ports:
- containerPort: 8080
name: http
protocol: TCP
readinessProbe:
failureThreshold: 3
initialDelaySeconds: 15
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: 8080
timeoutSeconds: 1
imagePullSecrets:
- name: dockerhub

41
apps/cde/brusnika-stage/createversionsv2-worke.yaml Normal file
View File

@ -0,0 +1,41 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: createversionsv2-worke
namespace: orchestrator
labels:
app.kubernetes.io/instance: name
app.kubernetes.io/name: cde-worker-createversions
app.kubernetes.io/version: 0.0.1
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: name
app.kubernetes.io/name: cde-worker-createversions
template:
metadata:
labels:
app.kubernetes.io/instance: name
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde-worker-createversions
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- env:
- name: S3_IS_CONTOUR
value: 'true'
- name: IS_CONTOUR
value: 'true'
envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/createversionsv2-worker:preprod_90202b78
imagePullPolicy: Always
name: createversionsv2-worke
securityContext: {}
imagePullSecrets:
- name: dockerhub

17
apps/cde/brusnika-stage/kustomization.yaml
View File

@ -1,6 +1,19 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: contracts
namespace: orchestrator
resources:
- helmrelease.yaml
- serviceaccount.yaml
- service.yaml
- cde.yaml
- cde-flowscallback.yaml
- cde-splitpdf.yaml
- cde-worker-alert.yaml
- cde-worker-copy.yaml
- cde-worker-markings.yaml
- cde-worker-sign.yaml
- cde-worker-update-bundles.yaml
- cde-worker-copyv2.yaml
- createversionsv2-worke.yaml
- markingsv2-worker.yaml
- signv2-worker.yaml

41
apps/cde/brusnika-stage/markingsv2-worker.yaml Normal file
View File

@ -0,0 +1,41 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: markingsv2-worker
namespace: orchestrator
labels:
app.kubernetes.io/instance: name
app.kubernetes.io/name: cde-worker-markings
app.kubernetes.io/version: 0.0.1
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: name
app.kubernetes.io/name: cde-worker-markings
template:
metadata:
labels:
app.kubernetes.io/instance: name
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde-worker-markings
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- env:
- name: S3_IS_CONTOUR
value: 'true'
- name: IS_CONTOUR
value: 'True'
envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/markingsv2-worker:prod_4.0.2
imagePullPolicy: Always
name: cde-worker-markings
securityContext: {}
imagePullSecrets:
- name: dockerhub

19
apps/cde/brusnika-stage/service.yaml Normal file
View File

@ -0,0 +1,19 @@
---
apiVersion: v1
kind: Service
metadata:
name: cde
namespace: orchestrator
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde
spec:
type: ClusterIP
selector:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde
ports:
- name: http
port: 8080
protocol: TCP
targetPort: 8080

10
apps/cde/brusnika-stage/serviceaccount.yaml Normal file
View File

@ -0,0 +1,10 @@
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: cde
namespace: orchestrator
labels:
app.kubernetes.io/instance: cde
app.kubernetes.io/name: cde
app.kubernetes.io/version: 0.0.1

41
apps/cde/brusnika-stage/signv2-worker.yaml Normal file
View File

@ -0,0 +1,41 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: signv2-worker
namespace: orchestrator
labels:
app.kubernetes.io/instance: name
app.kubernetes.io/name: cde-worker-sign
app.kubernetes.io/version: 0.0.1
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: name
app.kubernetes.io/name: cde-worker-sign
template:
metadata:
labels:
app.kubernetes.io/instance: name
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: cde-worker-sign
app.kubernetes.io/version: 0.0.1
helm.sh/chart: cde-0.1.0
spec:
serviceAccountName: cde
containers:
- env:
- name: S3_IS_CONTOUR
value: 'true'
- name: IS_CONTOUR
value: 'True'
envFrom:
- secretRef:
name: cde-secret
image: cr.yandex/crp3ccidau046kdj8g9q/signv2-worker:prod_4.0.2
imagePullPolicy: Always
name: cde-worker-sign
securityContext: {}
imagePullSecrets:
- name: dockerhub

2
apps/control-interface/uralkal/psql-tools-debug.yaml
View File

@ -18,7 +18,7 @@ spec:
spec:
containers:
- name: debug
image: cr.yandex/crp3ccidau046kdj8g9q/psql-tools:uralkal-20261007
image: cr.yandex/crp3ccidau046kdj8g9q/zitadel-bpmn:cc_contour_5.22.3_ca40c204
imagePullPolicy: IfNotPresent
command: ["/bin/sh", "-c"]
args:

2
apps/django/base/django-configmap.yaml
View File

@ -87,7 +87,7 @@ data:
'Bearer',
)
HOST = "https://sarex.contour.infra.sarex.tech"
HOST = os.environ.get("DJANGO_HOST", "https://sarex.contour.infra.sarex.tech")
POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')

18
apps/django/brusnika-stage/nginx-configmap.yaml
View File

@ -101,7 +101,8 @@ data:
location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
add_header Content-Type application/wasm always;
types { }
default_type application/wasm;
add_header Cache-Control "public, max-age=31536000, immutable" always;
add_header Access-Control-Allow-Origin "*" always;
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@ -110,7 +111,8 @@ data:
location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
add_header Content-Type application/javascript always;
types { }
default_type application/javascript;
add_header Cache-Control "public, max-age=31536000, immutable" always;
add_header Access-Control-Allow-Origin "*" always;
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@ -119,7 +121,8 @@ data:
location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
add_header Content-Type application/javascript always;
types { }
default_type application/javascript;
add_header Cache-Control "public, max-age=31536000, immutable" always;
add_header Access-Control-Allow-Origin "*" always;
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@ -128,7 +131,8 @@ data:
location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
alias /opt/react_client/static/viewer-pdf/mupdf.js;
add_header Content-Type application/javascript always;
types { }
default_type application/javascript;
add_header Cache-Control "public, max-age=31536000, immutable" always;
add_header Access-Control-Allow-Origin "*" always;
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@ -136,7 +140,8 @@ data:
}
location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
add_header Content-Type application/wasm always;
types { }
default_type application/wasm;
alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
}
@ -144,7 +149,8 @@ data:
rewrite /workspaces-v2/(.+) /$1 break;
proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
add_header Content-Type application/wasm;
proxy_hide_header Content-Type;
add_header Content-Type application/wasm always;
proxy_set_header Accept application/wasm;
}

3
apps/django/d8-ugmk-prod/backend.yaml
View File

@ -18,6 +18,9 @@ spec:
- name: SERVER_ZITADEL_ENABLED
value:
_default: "True"
- name: DJANGO_HOST
value:
_default: "https://sarex.uralmine.com"
- name: DJANGO_SETTINGS_MODULE
value:
_default: config.settings.production

4
apps/django/uralkal/backend.yaml
View File

@ -14,6 +14,10 @@ spec:
cpu: null
memory: null
envs:
- name: DJANGO_HOST
value:
_default: "https://sarex.local.uralkali.com"
- name: ALLOWED_HOSTS
value:
_default: "*"

4
apps/django/vad/backend.yaml
View File

@ -9,6 +9,10 @@ spec:
services:
backend:
envs:
- name: DJANGO_HOST
value:
_default: "https://sarex.vadroad.ru"
- name: ALLOWED_HOSTS
value:
_default: "*"

6
apps/documentations/brusnika-stage/api.yaml
View File

@ -37,7 +37,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
pullPolicy:
_default: IfNotPresent
@ -100,6 +100,10 @@ spec:
labels:
monitoring: prometheus
envs:
- name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
value:
_default: "true"
- name: POSTGRES_ADDRESS
value:
_default: "192.168.2.45"

95
apps/documentations/brusnika-stage/hasher.yaml Normal file
View File

@ -0,0 +1,95 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: hasher
namespace: documentations
labels:
app: hasher
service: normal
spec:
replicas: 1
selector:
matchLabels:
app: hasher
template:
metadata:
labels:
app: hasher
service: normal
spec:
containers:
- env:
- name: HASHER_APP__LOG_LEVEL
value: INFO
- name: HASHER_APP__NUM_WORKERS
value: '4'
- name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
value: hash.compute.normal.tasks
- name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
value: hash.compute
- name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
value: direct
- name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
value: hash.compute.normal
- name: HASHER_S3__MAX_POOL_CONNECTIONS
value: '10'
- name: HASHER_S3__CONNECT_TIMEOUT
value: '10'
- name: HASHER_S3__READ_TIMEOUT
value: '30'
- name: HASHER_S3__REGION_NAME
value: ru-central1
- name: HASHER_S3__USE_SSL
value: 'true'
- name: HASHER_S3__VERIFY
value: 'true'
- name: HASHER_AMQP__USERNAME
valueFrom:
secretKeyRef:
key: user
name: hasher-rabbitmq-secret
- name: HASHER_AMQP__PASSWORD
valueFrom:
secretKeyRef:
key: password
name: hasher-rabbitmq-secret
- name: HASHER_AMQP__HOST
valueFrom:
secretKeyRef:
key: host
name: hasher-rabbitmq-secret
- name: HASHER_AMQP__PORT
valueFrom:
secretKeyRef:
key: port
name: hasher-rabbitmq-secret
- name: HASHER_AMQP__VHOST
valueFrom:
secretKeyRef:
key: vhost
name: hasher-rabbitmq-secret
- name: HASHER_S3__ENDPOINT
valueFrom:
secretKeyRef:
key: endpoint
name: hasher-s3-secret
- name: HASHER_S3__ACCESS_KEY
valueFrom:
secretKeyRef:
key: access_key
name: hasher-s3-secret
- name: HASHER_S3__SECRET_KEY
valueFrom:
secretKeyRef:
key: secret_key
name: hasher-s3-secret
image: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
imagePullPolicy: IfNotPresent
name: normal
ports:
- containerPort: 8080
name: http
protocol: TCP
imagePullSecrets:
- name: regcred

2
apps/documentations/brusnika-stage/kustomization.yaml
View File

@ -7,3 +7,5 @@ resources:
- pdm.yaml
- api.yaml
- filestream.yaml
- hasher.yaml
- pdf-markings-amqp.yaml

125
apps/documentations/brusnika-stage/pdf-markings-amqp.yaml Normal file
View File

@ -0,0 +1,125 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: pdf-markings-amqp
namespace: documentations
labels:
app: pdf-markings-amqp
service: api
spec:
replicas: 1
selector:
matchLabels:
app: pdf-markings-amqp
strategy:
rollingUpdate:
maxSurge: 3
maxUnavailable: 3
type: RollingUpdate
template:
metadata:
labels:
app: pdf-markings-amqp
service: api
spec:
containers:
- env:
- name: MARKS_APP__LOG_LEVEL
value: INFO
- name: MARKS_CRYPTO__HASHING_ALGO
value: md_gost12_256
- name: MARKS_DOCUMENTS_DB__HOST
value: 192.168.2.45
- name: MARKS_DOCUMENTS_DB__PORT
value: '5432'
- name: MARKS_DOCUMENTS_DB__DATABASE
value: documentations
- name: MARKS_DOCUMENTS_DB__SSLMODE
value: disable
- name: MARKS_QR__REDIRECT_URL
value: https://stamp-verification.test.sarex.brusnika.tech/
- name: MARKS_QR__BASE_DOCUMENT_URL
value: https://test.sarex.brusnika.tech
- name: MARKS_S3__USE_SSL
value: 'false'
- name: MARKS_S3__SSL_VERIFY
value: 'false'
- name: MARKS_S3__REGION
value: ru-central1
- name: MARKS_S3__DEFAULT_BUCKET
value: documentations-stage-1-sarex-new
- name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
value: pdf_markings_input
- name: MARKS_DOCUMENTS_DB__USERNAME
valueFrom:
secretKeyRef:
key: username
name: postgres-secret
- name: MARKS_DOCUMENTS_DB__PASSWORD
valueFrom:
secretKeyRef:
key: password
name: postgres-secret
- name: MARKS_S3__URL
valueFrom:
secretKeyRef:
key: endpoint_url
name: yc-s3
- name: MARKS_S3__ACCESS_KEY
valueFrom:
secretKeyRef:
key: key_id
name: yc-s3
- name: MARKS_S3__SECRET_KEY
valueFrom:
secretKeyRef:
key: access_key
name: yc-s3
- name: MARKS_RABBITMQ__HOST
valueFrom:
secretKeyRef:
key: host
name: rabbitmq
- name: MARKS_RABBITMQ__PORT
valueFrom:
secretKeyRef:
key: port
name: rabbitmq
- name: MARKS_RABBITMQ__USERNAME
valueFrom:
secretKeyRef:
key: username
name: rabbitmq
- name: MARKS_RABBITMQ__PASSWORD
valueFrom:
secretKeyRef:
key: password
name: rabbitmq
- name: MARKS_RABBITMQ__VHOST
valueFrom:
secretKeyRef:
key: vhost
name: rabbitmq
- name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
valueFrom:
secretKeyRef:
key: heartbeat
name: rabbitmq
image: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
imagePullPolicy: IfNotPresent
name: api
ports:
- containerPort: 8000
name: http
protocol: TCP
volumeMounts:
- mountPath: /etc/sarex/yc-s3-storage
name: yc-s3
readOnly: true
volumes:
- name: yc-s3
secret:
secretName: yc-s3
imagePullSecrets:
- name: regcred

6
apps/documentations/wb/api.yaml
View File

@ -36,7 +36,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
pullPolicy:
_default: IfNotPresent
@ -307,6 +307,10 @@ spec:
value:
_default: "6379"
- name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
value:
_default: "true"
secretEnvs:
- name: PUBLIC_KEY
secretName:

22
apps/flows/brusnika-stage/celery.yaml
View File

@ -35,7 +35,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
_default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
pullPolicy:
_default: IfNotPresent
@ -252,6 +252,26 @@ spec:
_default: "https://test.sarex.brusnika.tech"
secretEnvs:
- name: FLOWS_DB_DB
secretName:
_default: "postgres-secret"
secretKey: "database"
- name: FLOWS_DB_USERNAME
secretName:
_default: "postgres-secret"
secretKey: "username"
- name: FLOWS_DB_PASSWORD
secretName:
_default: "postgres-secret"
secretKey: "password"
- name: DJANGO_AUTH
secretName:
_default: "django-secret"
secretKey: "token"
- name: ADMIN_PANEL_SECRET_KEY
secretName:
_default: "admin-secret"

2
apps/flows/brusnika-stage/frontend.yaml
View File

@ -35,7 +35,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
_default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
pullPolicy:
_default: IfNotPresent

2
apps/iam/brusnika-stage/backend.yaml
View File

@ -35,7 +35,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
_default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
pullPolicy:
_default: IfNotPresent

10
apps/notes/brusnika-stage/backend.yaml
View File

@ -35,7 +35,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:0.3.7
_default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854
pullPolicy:
_default: IfNotPresent
@ -87,6 +87,14 @@ spec:
monitoring: prometheus
envs:
- name: SYNC_RESOURCE_ID
value:
_default: "0"
- name: ENABLE_ND
value:
_default: "0"
- name: DJANGO_HOST
value:
_default: "http://backend.django.svc.cluster.local:8000"

2
apps/notes/brusnika-stage/frontend.yaml
View File

@ -35,7 +35,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:prod_55791cf6_relative
_default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f
pullPolicy:
_default: IfNotPresent

2
apps/pm/brusnika-stage/frontend.yaml
View File

@ -37,7 +37,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_7f125269
_default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_abfaba7c
pullPolicy:
_default: IfNotPresent

313
apps/premises/base/backend.yaml Normal file
View File

@ -0,0 +1,313 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: backend
namespace: premises
spec:
interval: 10m
chart:
spec:
chart: universal-chart
version: "0.1.9"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
global:
env: _default
services:
backend:
enabled: true
serviceAccount:
enabled:
_default: true
name:
_default: premises-vault
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/premises-backend:production_216148a9
pullPolicy:
_default: IfNotPresent
deployment:
enabled: true
name:
_default: premises-backend
replicaCount:
_default: 1
port:
_default: 8000
command:
_default: ["/bin/sh", "-ec"]
args:
_default:
- |
set -a
[ -f /vault/secrets/premises-db ] && . /vault/secrets/premises-db
[ -f /vault/secrets/premises-kafka ] && . /vault/secrets/premises-kafka
[ -f /vault/secrets/premises-s3 ] && . /vault/secrets/premises-s3
[ -f /vault/secrets/premises-issues-db ] && . /vault/secrets/premises-issues-db
[ -f /vault/secrets/premises-inspections-db ] && . /vault/secrets/premises-inspections-db
[ -f /vault/secrets/premises-checklists-db ] && . /vault/secrets/premises-checklists-db
[ -f /vault/secrets/premises-eav-db ] && . /vault/secrets/premises-eav-db
[ -f /vault/secrets/premises-sarex-db ] && . /vault/secrets/premises-sarex-db
[ -f /usr/local/share/ca-certificates/kafka.crt ] && export KAFKA_SSL_CERT="$(cat /usr/local/share/ca-certificates/kafka.crt)"
set +a
exec ./entrypoint.sh
resources:
requests:
cpu:
_default: "1"
memory:
_default: 1Gi
probes:
liveness:
enabled:
_default: true
httpGet:
path:
_default: /internal/healthz/live/
initialDelaySeconds:
_default: 10
periodSeconds:
_default: 60
readiness:
enabled:
_default: true
httpGet:
path:
_default: /internal/healthz/ready/
initialDelaySeconds:
_default: 10
periodSeconds:
_default: 30
service:
enabled: true
name:
_default: backend-svc
type:
_default: ClusterIP
port:
_default: 80
targetPort:
_default: 8000
portName:
_default: http
imagePullSecrets:
enabled:
_default: true
name:
_default: regcred
envs:
- name: DEBUG
value:
_default: "false"
- name: HTTP_ROOT_PATH
value:
_default: "/premises"
- name: JWT_AUTH_ENABLE
value:
_default: "true"
- name: GUNICORN_WORKERS
value:
_default: "3"
- name: FASTSTREAM_WORKERS
value:
_default: "3"
- name: DATABASE_POOL_SIZE
value:
_default: "5"
- name: KAFKA_EAV_ASSET_TOPIC_NAME
value:
_default: "assets_broadcast"
- name: KAFKA_SSL_CERT
value:
_default: ""
- name: S3_BUCKET
value:
_default: "premises"
- name: EXPORT_TTL_MINUTES
value:
_default: "30"
- name: EXPORT_MAX_WORKERS
value:
_default: "4"
- name: EXPORT_S3_KEY_PREFIX
value:
_default: "premise-export"
- name: ATTACHMENT_MAX_SIZE_BYTES
value:
_default: "314572800"
- name: ATTACHMENT_S3_KEY_PREFIX
value:
_default: "attachment/"
- name: OTEL_ENABLE
value:
_default: "false"
- name: OTEL_URL
value:
_default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
- name: OTEL_SERVICE_NAME
value:
_default: "premises-backend"
- name: OTEL_INSECURE
value:
_default: "true"
- name: SRX_SDK_IAM_ENVIRONMENT
value:
_default: "production"
- name: WORKFLOWS_HOST
value:
_default: "http://backend-svc.processing.svc.cluster.local:80"
- name: WORKFLOWS_GENERATION_IMAGE
value:
_default: "cr.yandex/crp3ccidau046kdj8g9q/rendering-template:master"
- name: WORKFLOWS_DOCX_TO_PDF_IMAGE
value:
_default: "cr.yandex/crp3ccidau046kdj8g9q/docx-to-pdf:latest"
- name: WORKFLOWS_CALLBACK_IMAGE
value:
_default: "cr.yandex/crp3ccidau046kdj8g9q/webhook-caller:master"
- name: WORKFLOWS_CALLBACK_HOST
value:
_default: "http://backend-svc.premises.svc.cluster.local:80"
- name: WORKFLOWS_RESULT_PATH
value:
_default: "premises-prod"
podAnnotations:
_default:
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/auth-path: auth/kubernetes
vault.hashicorp.com/role: premises
vault.hashicorp.com/agent-inject-secret-premises-db: secrets/data/apps/premises/postgres
vault.hashicorp.com/agent-inject-template-premises-db: |-
{{- with secret "secrets/data/apps/premises/postgres" -}}
DATABASE_HOST={{ index .Data.data "host" }}
DATABASE_PORT={{ index .Data.data "port" }}
DATABASE_NAME={{ index .Data.data "database" }}
DATABASE_USERNAME={{ index .Data.data "username" }}
DATABASE_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-premises-kafka: secrets/data/kafka/apps/premises
vault.hashicorp.com/agent-inject-template-premises-kafka: |-
{{- with secret "secrets/data/kafka/apps/premises" -}}
KAFKA_HOST={{ if .Data.data.auth }}{{ index .Data.data.auth "bootstrap_servers" }}{{ else }}{{ index .Data.data "bootstrap_servers" }}{{ end }}
KAFKA_USERNAME={{ index .Data.data "username" }}
KAFKA_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-premises-s3: secrets/data/minio/apps/premises
vault.hashicorp.com/agent-inject-template-premises-s3: |-
{{- with secret "secrets/data/minio/apps/premises" -}}
S3_HOST={{ index .Data.data.client "endpoint" }}
S3_ACCESS_KEY={{ index .Data.data "access_key" }}
S3_SECRET_KEY={{ index .Data.data "secret_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-premises-issues-db: secrets/data/apps/issues/postgres
vault.hashicorp.com/agent-inject-template-premises-issues-db: |-
{{- with secret "secrets/data/apps/issues/postgres" -}}
ISSUES_DATABASE_HOST={{ index .Data.data "host" }}
ISSUES_DATABASE_PORT={{ index .Data.data "port" }}
ISSUES_DATABASE_NAME={{ index .Data.data "database" }}
ISSUES_DATABASE_USERNAME={{ index .Data.data "username" }}
ISSUES_DATABASE_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-premises-inspections-db: secrets/data/apps/inspections/postgres
vault.hashicorp.com/agent-inject-template-premises-inspections-db: |-
{{- with secret "secrets/data/apps/inspections/postgres" -}}
INSPECTIONS_DATABASE_HOST={{ index .Data.data "host" }}
INSPECTIONS_DATABASE_PORT={{ index .Data.data "port" }}
INSPECTIONS_DATABASE_NAME={{ index .Data.data "database" }}
INSPECTIONS_DATABASE_USERNAME={{ index .Data.data "username" }}
INSPECTIONS_DATABASE_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-premises-checklists-db: secrets/data/apps/checklists/postgres
vault.hashicorp.com/agent-inject-template-premises-checklists-db: |-
{{- with secret "secrets/data/apps/checklists/postgres" -}}
CHECKLISTS_DATABASE_HOST={{ index .Data.data "host" }}
CHECKLISTS_DATABASE_PORT={{ index .Data.data "port" }}
CHECKLISTS_DATABASE_NAME={{ index .Data.data "database" }}
CHECKLISTS_DATABASE_USERNAME={{ index .Data.data "username" }}
CHECKLISTS_DATABASE_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-premises-eav-db: secrets/data/apps/eav/postgres
vault.hashicorp.com/agent-inject-template-premises-eav-db: |-
{{- with secret "secrets/data/apps/eav/postgres" -}}
EAV_DATABASE_HOST={{ index .Data.data "host" }}
EAV_DATABASE_PORT={{ index .Data.data "port" }}
EAV_DATABASE_NAME={{ index .Data.data "database" }}
EAV_DATABASE_USERNAME={{ index .Data.data "username" }}
EAV_DATABASE_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-premises-sarex-db: secrets/data/apps/django/postgres
vault.hashicorp.com/agent-inject-template-premises-sarex-db: |-
{{- with secret "secrets/data/apps/django/postgres" -}}
SAREX_DATABASE_HOST={{ index .Data.data "host" }}
SAREX_DATABASE_PORT={{ index .Data.data "port" }}
SAREX_DATABASE_NAME={{ index .Data.data "database" }}
SAREX_DATABASE_USERNAME={{ index .Data.data "username" }}
SAREX_DATABASE_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
commitSha: ""
gitlabUri: ""
gitlabJobUrl: ""
owner: ""

7
apps/premises/base/kustomization.yaml Normal file
View File

@ -0,0 +1,7 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: premises
resources:
- namespace.yaml
- backend.yaml

7
apps/premises/base/namespace.yaml Normal file
View File

@ -0,0 +1,7 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: premises
labels:
istio-injection: enabled

31
apps/premises/vad/backend.yaml Normal file
View File

@ -0,0 +1,31 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: backend
namespace: premises
spec:
values:
services:
backend:
deployment:
resources:
requests:
cpu: null
memory: null
volumes:
_default:
- name: kafka-ca-cert
mountPath:
_default: /usr/local/share/ca-certificates/kafka.crt
subPath:
_default: kafka.crt
readOnly:
_default: true
configMap:
name:
_default: kafka-ca-cert
items:
- key: kafka.crt
path:
_default: kafka.crt

27
apps/premises/vad/kafka-ca-configmap.yaml Normal file
View File

@ -0,0 +1,27 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: kafka-ca-cert
namespace: premises
data:
kafka.crt: |
-----BEGIN CERTIFICATE-----
MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
0FC16VuidLG0HUCCawFjRiAg9rIA
-----END CERTIFICATE-----

10
apps/premises/vad/kustomization.yaml Normal file
View File

@ -0,0 +1,10 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- kafka-ca-configmap.yaml
patches:
- path: backend.yaml
target:
kind: HelmRelease
name: backend

10
apps/processing/brusnika-stage/engine-low.yaml
View File

@ -35,7 +35,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/kubernetes-engine:3546957f1e7e8278fc6363da0287573e9454275a
_default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:production_f5fe4688
pullPolicy:
_default: IfNotPresent
@ -87,6 +87,10 @@ spec:
monitoring: prometheus
envs:
- name: ENABLE_TOLERATION
value:
_default: "1"
- name: RABBITMQ_HOST
value:
_default: "rabbitmq-service.workflow.svc.cluster.local"
@ -94,6 +98,10 @@ spec:
- name: RABBITMQ_PORT
value:
_default: "5672/api"
- name: ENABLE_TOLERATION
value:
_default: "1"
- name: POSTGRES_ADDRESS
value:

2
apps/transmittal/brusnika-stage/backend.yaml
View File

@ -287,7 +287,7 @@ spec:
- name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
value:
_default: "minio-service.minio.svc.cluster.local:9000"
_default: "minio-svc.minio.svc.cluster.local:9000"
- name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
value:

2
apps/transmittal/brusnika-stage/worker.yaml
View File

@ -278,7 +278,7 @@ spec:
- name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
value:
_default: "minio-service.minio.svc.cluster.local:9000"
_default: "minio-svc.minio.svc.cluster.local:9000"
- name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
value:

2
apps/workspaces/base/frontend.yaml
View File

@ -29,7 +29,7 @@ spec:
enabled: true
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_07373a45
_default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_828f1bfc
pullPolicy:
_default: IfNotPresent
deployment:

BIN
clusters/.DS_Store vendored Normal file
View File

Binary file not shown.

1
clusters/brusnika-stage/kustomization.yaml
View File

@ -12,6 +12,7 @@ resources:
- ../../apps/resources/brusnika-stage
- ../../apps/workspaces/brusnika-stage
- ../../apps/documentations/brusnika-stage
- ../../apps/cde/brusnika-stage
- ../../apps/flows/brusnika-stage
- ../../apps/processing/brusnika-stage
- ../../apps/reviews/brusnika-stage

1
clusters/vad/kustomization.yaml
View File

@ -52,3 +52,4 @@ resources:
- ../../apps/pm/vad
- ../../apps/message-hub/vad
- ../../apps/cde/vad
- ../../apps/premises/vad

6432
clusters/vk-infra/flux-system/gotk-components.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

27
clusters/vk-infra/flux-system/gotk-sync.yaml Normal file
View File

@ -0,0 +1,27 @@
# This manifest was generated by flux. DO NOT EDIT.
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
name: flux-system
namespace: flux-system
spec:
interval: 1m0s
ref:
branch: master
secretRef:
name: flux-system
url: ssh://git@gitlab.sarex.io/infra/iac.git
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: flux-system
namespace: flux-system
spec:
interval: 10m0s
path: ./clusters/vk-infra
prune: true
sourceRef:
kind: GitRepository
name: flux-system

59
clusters/vk-infra/flux-system/kustomization.yaml Normal file
View File

@ -0,0 +1,59 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- gotk-components.yaml
- gotk-sync.yaml
patches:
- target:
kind: Deployment
name: (source-controller|kustomize-controller|helm-controller|notification-controller)
patch: |
- op: add
path: /spec/template/spec/nodeSelector/sarex.io~1pool
value: svc
- target:
kind: Deployment
name: kustomize-controller
patch: |
- op: replace
path: /spec/replicas
value: 3
- op: add
path: /spec/strategy
value:
type: RollingUpdate
rollingUpdate:
maxSurge: 0
maxUnavailable: 1
- op: add
path: /spec/template/spec/affinity
value:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- topologyKey: topology.kubernetes.io/zone
labelSelector:
matchLabels:
app: kustomize-controller
- target:
kind: Deployment
name: helm-controller
patch: |
- op: replace
path: /spec/replicas
value: 3
- op: add
path: /spec/strategy
value:
type: RollingUpdate
rollingUpdate:
maxSurge: 0
maxUnavailable: 1
- op: add
path: /spec/template/spec/affinity
value:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- topologyKey: topology.kubernetes.io/zone
labelSelector:
matchLabels:
app: helm-controller

11
clusters/vk-infra/helm-repositories.yaml Normal file
View File

@ -0,0 +1,11 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: yc-oci-charts
namespace: flux-system
spec:
type: oci
interval: 10m0s
url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
secretRef:
name: yc-cr-auth

13
clusters/vk-infra/infrastructure/kustomization.yaml Normal file
View File

@ -0,0 +1,13 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../infrastructure/istio-base/vk-infra
- ../../../infrastructure/istio-pilot/vk-infra
- ../../../infrastructure/istio-gateway/vk-infra
- ../../../infrastructure/cert-manager/vk-infra
- ../../../infrastructure/istio-config/vk-infra
- ../../../infrastructure/zitadel/vk-infra
- ../../../infrastructure/vault-unseal/vk-infra
- ../../../infrastructure/vault/vk-infra
- ../../../infrastructure/kb/vk-infra
- ../../../infrastructure/gitlab-runner/vk-infra

6
clusters/vk-infra/kustomization.yaml Normal file
View File

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./flux-system
- ./helm-repositories.yaml
- ./infrastructure

6432
clusters/vk-prod/flux-system/gotk-components.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

27
clusters/vk-prod/flux-system/gotk-sync.yaml Normal file
View File

@ -0,0 +1,27 @@
# This manifest was generated by flux. DO NOT EDIT.
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
name: flux-system
namespace: flux-system
spec:
interval: 1m0s
ref:
branch: master
secretRef:
name: flux-system
url: ssh://git@gitlab.sarex.io/infra/iac.git
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: flux-system
namespace: flux-system
spec:
interval: 10m0s
path: ./clusters/vk-prod
prune: true
sourceRef:
kind: GitRepository
name: flux-system

52
clusters/vk-prod/flux-system/kustomization.yaml Normal file
View File

@ -0,0 +1,52 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- gotk-components.yaml
- gotk-sync.yaml
patches:
- target:
kind: Deployment
name: kustomize-controller
patch: |
- op: replace
path: /spec/replicas
value: 3
- op: add
path: /spec/strategy
value:
type: RollingUpdate
rollingUpdate:
maxSurge: 0
maxUnavailable: 1
- op: add
path: /spec/template/spec/affinity
value:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- topologyKey: topology.kubernetes.io/zone
labelSelector:
matchLabels:
app: kustomize-controller
- target:
kind: Deployment
name: helm-controller
patch: |
- op: replace
path: /spec/replicas
value: 3
- op: add
path: /spec/strategy
value:
type: RollingUpdate
rollingUpdate:
maxSurge: 0
maxUnavailable: 1
- op: add
path: /spec/template/spec/affinity
value:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- topologyKey: topology.kubernetes.io/zone
labelSelector:
matchLabels:
app: helm-controller

11
clusters/vk-prod/helm-repositories.yaml Normal file
View File

@ -0,0 +1,11 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: yc-oci-charts
namespace: flux-system
spec:
type: oci
interval: 10m0s
url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
secretRef:
name: yc-cr-auth

7
clusters/vk-prod/infrastructure/kustomization.yaml Normal file
View File

@ -0,0 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../infrastructure/istio-base/vk-prod
- ../../../infrastructure/istio-pilot/vk-prod
- ../../../infrastructure/istio-gateway/vk-prod
- ../../../infrastructure/gitlab-runner/vk-prod

6
clusters/vk-prod/kustomization.yaml Normal file
View File

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./flux-system
- ./helm-repositories.yaml
- ./infrastructure

BIN
docs/.DS_Store vendored Normal file
View File

Binary file not shown.

BIN
infrastructure/.DS_Store vendored Normal file
View File

Binary file not shown.

36
infrastructure/cert-manager/vk-infra/cert-manager.yaml Normal file
View File

@ -0,0 +1,36 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cert-manager
namespace: cert-manager
spec:
interval: 5m
timeout: 10m
values:
global:
imagePullSecrets:
- istio-registry-secret
controller:
image:
registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
repository: cert-manager
pullSecrets:
- istio-registry-secret
acmesolver:
image:
registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
repository: acmesolver
pullSecrets:
- istio-registry-secret
webhook:
image:
registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
repository: cert-manager-webhook
pullSecrets:
- istio-registry-secret
cainjector:
image:
registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
repository: cainjector
pullSecrets:
- istio-registry-secret

34
infrastructure/cert-manager/vk-infra/kustomization.yaml Normal file
View File

@ -0,0 +1,34 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
patches:
- path: ./cert-manager.yaml
target:
group: helm.toolkit.fluxcd.io
version: v2
kind: HelmRelease
name: cert-manager
namespace: cert-manager
- target:
group: cert-manager.io
version: v1
kind: ClusterIssuer
name: letsencrypt-issuer
patch: |-
$patch: delete
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-issuer
- target:
group: cert-manager.io
version: v1
kind: ClusterIssuer
name: letsencrypt-issuer-istio
patch: |-
$patch: delete
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-issuer-istio

79
infrastructure/gitlab-runner/vk-infra/gitlab-runner.yaml Normal file
View File

@ -0,0 +1,79 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: gitlab-runner
namespace: gitlab-managed-apps
spec:
interval: 10m
timeout: 10m
chart:
spec:
chart: gitlab-runner-infra
version: "17.5.3"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
gitlabUrl: https://gitlab.sarex.io
concurrent: 20
checkInterval: 10
unregisterRunners: true
terminationGracePeriodSeconds: 3600
image:
registry: cr.yandex/crp3ccidau046kdj8g9q
image: mirror/gitlab-runner
imagePullSecrets:
- name: istio-registry-secret
nodeSelector:
sarex.io/pool: svc
rbac:
create: true
clusterWideAccess: false
serviceAccount:
create: true
podSecurityContext:
fsGroup: 65533
runAsUser: 100
metrics:
enabled: false
runners:
secret: gitlab-runner-secret
executor: kubernetes
cache: {}
config: |
[[runners]]
[runners.kubernetes]
namespace = "{{.Release.Namespace}}"
image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/docker:24.0.5"
helper_image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/gitlab-runner-helper:x86_64-v17.5.3"
image_pull_secrets = ["istio-registry-secret"]
poll_interval = 10
poll_timeout = 600
privileged = true
tls_verify = false
cpu_request = "0.1"
cpu_limit = "3"
memory_request = "128Mi"
memory_limit = "3Gi"
helper_cpu_request = "0.05"
helper_cpu_limit = "3"
helper_memory_request = "32Mi"
helper_memory_limit = "10Gi"
service_cpu_request = "0.5"
service_cpu_limit = "3"
service_memory_request = "3Gi"
[runners.feature_flags]
FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY = false
[runners.kubernetes.node_selector]
"sarex.io/pool" = "runners"
[runners.kubernetes.node_tolerations]
"sarex.io/pool=runners" = "NoSchedule"

5
infrastructure/gitlab-runner/vk-infra/kustomization.yaml Normal file
View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- gitlab-runner.yaml

4
infrastructure/gitlab-runner/vk-infra/namespace.yaml Normal file
View File

@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: gitlab-managed-apps

77
infrastructure/gitlab-runner/vk-prod/gitlab-runner.yaml Normal file
View File

@ -0,0 +1,77 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: gitlab-runner
namespace: gitlab-managed-apps
spec:
interval: 10m
timeout: 10m
chart:
spec:
chart: gitlab-runner-infra
version: "17.5.3"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
gitlabUrl: https://gitlab.sarex.io
concurrent: 20
checkInterval: 10
unregisterRunners: true
terminationGracePeriodSeconds: 3600
image:
registry: cr.yandex/crp3ccidau046kdj8g9q
image: mirror/gitlab-runner
imagePullSecrets:
- name: istio-registry-secret
rbac:
create: true
clusterWideAccess: false
serviceAccount:
create: true
podSecurityContext:
fsGroup: 65533
runAsUser: 100
metrics:
enabled: false
runners:
secret: gitlab-runner-secret
executor: kubernetes
cache: {}
config: |
[[runners]]
[runners.kubernetes]
namespace = "{{.Release.Namespace}}"
image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/docker:24.0.5"
helper_image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/gitlab-runner-helper:x86_64-v17.5.3"
image_pull_secrets = ["istio-registry-secret"]
poll_interval = 10
poll_timeout = 600
privileged = true
tls_verify = false
cpu_request = "0.1"
cpu_limit = "3"
memory_request = "128Mi"
memory_limit = "3Gi"
helper_cpu_request = "0.05"
helper_cpu_limit = "3"
helper_memory_request = "32Mi"
helper_memory_limit = "10Gi"
service_cpu_request = "0.5"
service_cpu_limit = "3"
service_memory_request = "3Gi"
[runners.feature_flags]
FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY = false
[runners.kubernetes.node_selector]
"sarex.io/pool" = "runners"
[runners.kubernetes.node_tolerations]
"sarex.io/pool=runners" = "NoSchedule"

5
infrastructure/gitlab-runner/vk-prod/kustomization.yaml Normal file
View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- gitlab-runner.yaml

4
infrastructure/gitlab-runner/vk-prod/namespace.yaml Normal file
View File

@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: gitlab-managed-apps

14
infrastructure/istio-base/vk-infra/istio-base.yaml Normal file
View File

@ -0,0 +1,14 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: istio-base
namespace: istio-system
spec:
chart:
spec:
chart: base-infra
version: "1.30.5"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system

12
infrastructure/istio-base/vk-infra/kustomization.yaml Normal file
View File

@ -0,0 +1,12 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
patches:
- path: ./istio-base.yaml
target:
group: helm.toolkit.fluxcd.io
version: v2
kind: HelmRelease
name: istio-base
namespace: istio-system

14
infrastructure/istio-base/vk-prod/istio-base.yaml Normal file
View File

@ -0,0 +1,14 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: istio-base
namespace: istio-system
spec:
chart:
spec:
chart: base-infra
version: "1.30.5"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system

12
infrastructure/istio-base/vk-prod/kustomization.yaml Normal file
View File

@ -0,0 +1,12 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
patches:
- path: ./istio-base.yaml
target:
group: helm.toolkit.fluxcd.io
version: v2
kind: HelmRelease
name: istio-base
namespace: istio-system

25
infrastructure/istio-config/brusnika-stage/istio-config.yaml
View File

@ -671,8 +671,19 @@ spec:
allowOrigins:
- regex: ".*"
routes:
- path:
prefix: /orchestrator/api/process/
rewrite: /api/process/
service: cde.orchestrator.svc.cluster.local
port: 8080
- path:
prefix: /orchestrator/api/sign
rewrite: /api/sign
service: cde.orchestrator.svc.cluster.local
port: 8080
- path:
prefix: /orchestrator/
rewrite: /api/
service: cde.orchestrator.svc.cluster.local
port: 8080
global-test-vs:
@ -1188,6 +1199,20 @@ spec:
service: workspaces-service.workspaces.svc.cluster.local
port: 8000
vs-iam-api:
namespace: ingress-nginx
hosts:
- test.sarex.brusnika.tech
gateways:
- ingress-nginx/main-gateway
routes:
- match:
- uri:
prefix: /iam/api/
rewrite: /external/api/
service: iam-backend.iam.svc.cluster.local
port: 8000
vs-resources-admin:
namespace: ingress-nginx
hosts:

23
infrastructure/istio-config/uralkal/istio-config.yaml
View File

@ -388,6 +388,29 @@ spec:
rewrite: /eav/admin/
service: backend-svc.eav.svc.cluster.local
port: 80
cde-api:
name: cde-api-virt-service
namespace: default
hosts:
- sarex.local.uralkali.com
gateways:
- default/platform-gateway
routes:
- path:
prefix: /orchestrator/api/process/
rewrite: /api/process/
service: cde-svc.cde.svc.cluster.local
port: 80
- path:
prefix: /orchestrator/api/sign
rewrite: /api/sign
service: cde-svc.cde.svc.cluster.local
port: 80
- path:
prefix: /orchestrator/
rewrite: /api/
service: cde-svc.cde.svc.cluster.local
port: 80
srx-admin-frontend:
name: srx-admin-frontend-virt-service
namespace: default

36
infrastructure/istio-config/vad/istio-config.yaml
View File

@ -335,6 +335,19 @@ spec:
rewrite: /api/
service: backend-svc.inspections.svc.cluster.local
port: 80
premises-api:
name: premises-api-virt-service
namespace: default
hosts:
- sarex.vadroad.ru
gateways:
- default/platform-gateway
routes:
- path:
prefix: /premises/api/
rewrite: /api/
service: backend-svc.premises.svc.cluster.local
port: 80
reviews-frontend:
name: reviews-frontend-virt-service
namespace: default
@ -386,6 +399,29 @@ spec:
rewrite: /eav/admin/
service: backend-svc.eav.svc.cluster.local
port: 80
cde-api:
name: cde-api-virt-service
namespace: default
hosts:
- sarex.vadroad.ru
gateways:
- default/platform-gateway
routes:
- path:
prefix: /orchestrator/api/process/
rewrite: /api/process/
service: cde-svc.cde.svc.cluster.local
port: 80
- path:
prefix: /orchestrator/api/sign
rewrite: /api/sign
service: cde-svc.cde.svc.cluster.local
port: 80
- path:
prefix: /orchestrator/
rewrite: /api/
service: cde-svc.cde.svc.cluster.local
port: 80
srx-admin-frontend:
name: srx-admin-frontend-virt-service
namespace: default

140
infrastructure/istio-config/vk-infra/istio-config.yaml Normal file
View File

@ -0,0 +1,140 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: istio-config
namespace: default
spec:
interval: 5m
timeout: 10m
dependsOn:
- name: istio-base
namespace: istio-system
- name: istiod
namespace: istio-system
- name: cert-manager
namespace: cert-manager
values:
global:
env: vk-infra
environments:
vk-infra:
certManager:
clusterIssuers:
letsencrypt-issuer-istio:
spec:
acme:
email: pavel@sarex.io
privateKeySecretRef:
name: letsencrypt-istio-account-key
server: https://acme-v02.api.letsencrypt.org/directory
solvers:
- http01:
ingress:
class: istio
podTemplate:
spec:
imagePullSecrets:
- name: istio-registry-secret
certificates:
vault-tls:
dnsNames:
- vault.infra.sarex.tech
issuerRef:
name: letsencrypt-issuer-istio
kind: ClusterIssuer
spec:
duration: 2160h0m0s
renewBefore: 360h0m0s
privateKey:
rotationPolicy: Always
kb-tls:
dnsNames:
- kb.infra.sarex.tech
issuerRef:
name: letsencrypt-issuer-istio
kind: ClusterIssuer
spec:
duration: 2160h0m0s
renewBefore: 360h0m0s
privateKey:
rotationPolicy: Always
idp-tls:
dnsNames:
- iam.sarex.io
issuerRef:
name: letsencrypt-issuer-istio
kind: ClusterIssuer
spec:
duration: 2160h0m0s
renewBefore: 360h0m0s
privateKey:
rotationPolicy: Always
istio:
gateways:
vault:
name: vault-gateway
namespace: istio-system
selector:
istio: ingressgateway
servers:
- hosts:
- vault.infra.sarex.tech
tls:
credentialName: vault-tls
mode: SIMPLE
kb:
name: kb-gateway
namespace: istio-system
selector:
istio: ingressgateway
servers:
- hosts:
- kb.infra.sarex.tech
tls:
credentialName: kb-tls
mode: SIMPLE
idp:
name: idp-gateway
namespace: istio-system
selector:
istio: ingressgateway
servers:
- hosts:
- iam.sarex.io
tls:
credentialName: idp-tls
mode: SIMPLE
virtualServices:
vault-virt-service:
namespace: istio-system
hosts:
- vault.infra.sarex.tech
gateways:
- istio-system/vault-gateway
routes:
- path:
prefix: /
service: vault-vault-contour-active.vault.svc.cluster.local
port: 8200
kb-virt-service:
namespace: istio-system
hosts:
- kb.infra.sarex.tech
gateways:
- istio-system/kb-gateway
routes:
- path:
prefix: /
service: kb-service.kb.svc.cluster.local
port: 80
idp-virt-service:
namespace: istio-system
hosts:
- iam.sarex.io
gateways:
- istio-system/idp-gateway
routes:
- path:
prefix: /
service: idp.zitadel.svc.cluster.local
port: 8080

12
infrastructure/istio-config/vk-infra/kustomization.yaml Normal file
View File

@ -0,0 +1,12 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
patches:
- path: ./istio-config.yaml
target:
group: helm.toolkit.fluxcd.io
version: v2
kind: HelmRelease
name: istio-config
namespace: default

43
infrastructure/istio-gateway/vk-infra/ingressgateway-me1.yaml Normal file
View File

@ -0,0 +1,43 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: ingressgateway-me1
namespace: istio-system
spec:
interval: 10m
dependsOn:
- name: istio-base
namespace: istio-system
- name: istiod
namespace: istio-system
chart:
spec:
chart: gateway-infra
version: "1.30.5"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
name: istio-ingressgateway-me1
labels:
app: istio-ingressgateway
istio: ingressgateway
replicaCount: 1
autoscaling:
enabled: false
nodeSelector:
sarex.io/pool: svc
topology.kubernetes.io/zone: ME1
imagePullSecrets:
- name: istio-registry-secret
service:
type: ClusterIP
externalTrafficPolicy: ""

43
infrastructure/istio-gateway/vk-infra/ingressgateway-ms1.yaml Normal file
View File

@ -0,0 +1,43 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: ingressgateway-ms1
namespace: istio-system
spec:
interval: 10m
dependsOn:
- name: istio-base
namespace: istio-system
- name: istiod
namespace: istio-system
chart:
spec:
chart: gateway-infra
version: "1.30.5"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
name: istio-ingressgateway-ms1
labels:
app: istio-ingressgateway
istio: ingressgateway
replicaCount: 1
autoscaling:
enabled: false
nodeSelector:
sarex.io/pool: svc
topology.kubernetes.io/zone: MS1
imagePullSecrets:
- name: istio-registry-secret
service:
type: ClusterIP
externalTrafficPolicy: ""

43
infrastructure/istio-gateway/vk-infra/ingressgateway-pa2.yaml Normal file
View File

@ -0,0 +1,43 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: ingressgateway-pa2
namespace: istio-system
spec:
interval: 10m
dependsOn:
- name: istio-base
namespace: istio-system
- name: istiod
namespace: istio-system
chart:
spec:
chart: gateway-infra
version: "1.30.5"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
name: istio-ingressgateway-pa2
labels:
app: istio-ingressgateway
istio: ingressgateway
replicaCount: 1
autoscaling:
enabled: false
nodeSelector:
sarex.io/pool: svc
topology.kubernetes.io/zone: PA2
imagePullSecrets:
- name: istio-registry-secret
service:
type: ClusterIP
externalTrafficPolicy: ""

7
infrastructure/istio-gateway/vk-infra/kustomization.yaml Normal file
View File

@ -0,0 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./ingressgateway-pa2.yaml
- ./ingressgateway-me1.yaml
- ./ingressgateway-ms1.yaml
- ./lb-service.yaml

30
infrastructure/istio-gateway/vk-infra/lb-service.yaml Normal file
View File

@ -0,0 +1,30 @@
apiVersion: v1
kind: Service
metadata:
name: istio-ingressgateway
namespace: istio-system
annotations:
loadbalancer.openstack.org/keep-floatingip: "true"
labels:
app: istio-ingressgateway
istio: ingressgateway
spec:
type: LoadBalancer
loadBalancerIP: 161.104.109.7
externalTrafficPolicy: Local
selector:
app: istio-ingressgateway
istio: ingressgateway
ports:
- name: status-port
port: 15021
protocol: TCP
targetPort: 15021
- name: http2
port: 80
protocol: TCP
targetPort: 80
- name: https
port: 443
protocol: TCP
targetPort: 443

42
infrastructure/istio-gateway/vk-prod/ingressgateway-me1.yaml Normal file
View File

@ -0,0 +1,42 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: ingressgateway-me1
namespace: istio-system
spec:
interval: 10m
dependsOn:
- name: istio-base
namespace: istio-system
- name: istiod
namespace: istio-system
chart:
spec:
chart: gateway-infra
version: "1.30.5"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
name: istio-ingressgateway-me1
labels:
app: istio-ingressgateway
istio: ingressgateway
replicaCount: 1
autoscaling:
enabled: false
nodeSelector:
topology.kubernetes.io/zone: ME1
imagePullSecrets:
- name: istio-registry-secret
service:
type: ClusterIP
externalTrafficPolicy: ""

42
infrastructure/istio-gateway/vk-prod/ingressgateway-ms1.yaml Normal file
View File

@ -0,0 +1,42 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: ingressgateway-ms1
namespace: istio-system
spec:
interval: 10m
dependsOn:
- name: istio-base
namespace: istio-system
- name: istiod
namespace: istio-system
chart:
spec:
chart: gateway-infra
version: "1.30.5"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
name: istio-ingressgateway-ms1
labels:
app: istio-ingressgateway
istio: ingressgateway
replicaCount: 1
autoscaling:
enabled: false
nodeSelector:
topology.kubernetes.io/zone: MS1
imagePullSecrets:
- name: istio-registry-secret
service:
type: ClusterIP
externalTrafficPolicy: ""

42
infrastructure/istio-gateway/vk-prod/ingressgateway-pa2.yaml Normal file
View File

@ -0,0 +1,42 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: ingressgateway-pa2
namespace: istio-system
spec:
interval: 10m
dependsOn:
- name: istio-base
namespace: istio-system
- name: istiod
namespace: istio-system
chart:
spec:
chart: gateway-infra
version: "1.30.5"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
name: istio-ingressgateway-pa2
labels:
app: istio-ingressgateway
istio: ingressgateway
replicaCount: 1
autoscaling:
enabled: false
nodeSelector:
topology.kubernetes.io/zone: PA2
imagePullSecrets:
- name: istio-registry-secret
service:
type: ClusterIP
externalTrafficPolicy: ""

7
infrastructure/istio-gateway/vk-prod/kustomization.yaml Normal file
View File

@ -0,0 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./ingressgateway-pa2.yaml
- ./ingressgateway-me1.yaml
- ./ingressgateway-ms1.yaml
- ./lb-service.yaml

30
infrastructure/istio-gateway/vk-prod/lb-service.yaml Normal file
View File

@ -0,0 +1,30 @@
apiVersion: v1
kind: Service
metadata:
name: istio-ingressgateway
namespace: istio-system
annotations:
loadbalancer.openstack.org/keep-floatingip: "true"
labels:
app: istio-ingressgateway
istio: ingressgateway
spec:
type: LoadBalancer
loadBalancerIP: 161.104.106.190
externalTrafficPolicy: Local
selector:
app: istio-ingressgateway
istio: ingressgateway
ports:
- name: status-port
port: 15021
protocol: TCP
targetPort: 15021
- name: http2
port: 80
protocol: TCP
targetPort: 80
- name: https
port: 443
protocol: TCP
targetPort: 443

34
infrastructure/istio-pilot/vk-infra/istio-pilot.yaml Normal file
View File

@ -0,0 +1,34 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: istiod
namespace: istio-system
spec:
chart:
spec:
chart: istiod-infra
version: "1.30.5"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
values:
replicaCount: 3
autoscaleEnabled: false
nodeSelector:
sarex.io/pool: svc
topologySpreadConstraints:
- maxSkew: 1
topologyKey: topology.kubernetes.io/zone
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app: istiod
istio: pilot
global:
hub: cr.yandex/crp3ccidau046kdj8g9q/istio
tag: 1.30.5-amd64
imagePullSecrets:
- istio-registry-secret
pilot:
traceSampling: 100

12
infrastructure/istio-pilot/vk-infra/kustomization.yaml Normal file
View File

@ -0,0 +1,12 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
patches:
- path: ./istio-pilot.yaml
target:
group: helm.toolkit.fluxcd.io
version: v2
kind: HelmRelease
name: istiod
namespace: istio-system

32
infrastructure/istio-pilot/vk-prod/istio-pilot.yaml Normal file
View File

@ -0,0 +1,32 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: istiod
namespace: istio-system
spec:
chart:
spec:
chart: istiod-infra
version: "1.30.5"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
values:
replicaCount: 3
autoscaleEnabled: false
topologySpreadConstraints:
- maxSkew: 1
topologyKey: topology.kubernetes.io/zone
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app: istiod
istio: pilot
global:
hub: cr.yandex/crp3ccidau046kdj8g9q/istio
tag: 1.30.5-amd64
imagePullSecrets:
- istio-registry-secret
pilot:
traceSampling: 100

12
infrastructure/istio-pilot/vk-prod/kustomization.yaml Normal file
View File

@ -0,0 +1,12 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
patches:
- path: ./istio-pilot.yaml
target:
group: helm.toolkit.fluxcd.io
version: v2
kind: HelmRelease
name: istiod
namespace: istio-system

36
infrastructure/kb/vk-infra/kb.yaml Normal file
View File

@ -0,0 +1,36 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: kb
namespace: kb
spec:
interval: 10m
timeout: 10m
chart:
spec:
chart: kb
version: "0.0.1-infra"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
dependsOn:
- name: istiod
namespace: istio-system
values:
universal-chart:
global:
env: infra
image:
name:
infra: cr.yandex/crp3ccidau046kdj8g9q/kb:infra_a27f6dd0
imagePullSecrets:
name:
_default: istio-registry-secret

5
infrastructure/kb/vk-infra/kustomization.yaml Normal file
View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- kb.yaml

6
infrastructure/kb/vk-infra/namespace.yaml Normal file
View File

@ -0,0 +1,6 @@
apiVersion: v1
kind: Namespace
metadata:
name: kb
labels:
istio-injection: enabled

5
infrastructure/vault-unseal/vk-infra/kustomization.yaml Normal file
View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- vault-unseal.yaml

6
infrastructure/vault-unseal/vk-infra/namespace.yaml Normal file
View File

@ -0,0 +1,6 @@
apiVersion: v1
kind: Namespace
metadata:
name: vault-unseal
labels:
istio-injection: enabled

Some files were not shown because too many files have changed in this diff Show More