++
This commit is contained in:
ivan
parent
b629d7a699
commit
1106008b19
171
apps/flows/d8-ugmk-prod/backend.yaml
Normal file
171
apps/flows/d8-ugmk-prod/backend.yaml
Normal file
@ -0,0 +1,171 @@
|
|||||||
|
---
|
||||||
|
# Патч backend для контура УГМК — подключение к Kafka.
|
||||||
|
#
|
||||||
|
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
|
||||||
|
# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
|
||||||
|
# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
|
||||||
|
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||||||
|
# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: backend
|
||||||
|
namespace: flows
|
||||||
|
spec:
|
||||||
|
values:
|
||||||
|
services:
|
||||||
|
backend:
|
||||||
|
deployment:
|
||||||
|
args:
|
||||||
|
_default:
|
||||||
|
- |
|
||||||
|
set -a
|
||||||
|
[ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
|
||||||
|
[ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
|
||||||
|
[ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
|
||||||
|
[ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
|
||||||
|
[ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
|
||||||
|
[ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
|
||||||
|
set +a
|
||||||
|
exec /opt/entrypoint.sh
|
||||||
|
|
||||||
|
envs:
|
||||||
|
- name: LOG_LEVEL
|
||||||
|
value:
|
||||||
|
_default: "DEBUG"
|
||||||
|
|
||||||
|
- name: BASE_HOST
|
||||||
|
value:
|
||||||
|
_default: "https://srx.wb.ru"
|
||||||
|
|
||||||
|
- name: CELERY_QUEUE
|
||||||
|
value:
|
||||||
|
_default: "flow"
|
||||||
|
|
||||||
|
- name: EAV_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||||
|
|
||||||
|
- name: DJANGO_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://backend-svc.django.svc.cluster.local:80/api"
|
||||||
|
|
||||||
|
- name: PLANNING_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp"
|
||||||
|
|
||||||
|
- name: PLANNING_USE
|
||||||
|
value:
|
||||||
|
_default: "True"
|
||||||
|
|
||||||
|
- name: DOCUMENTATION_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
|
||||||
|
|
||||||
|
- name: DOCUMENTATION_EXTERNAL_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
|
||||||
|
|
||||||
|
- name: ENABLE_ANALYTICS
|
||||||
|
value:
|
||||||
|
_default: "1"
|
||||||
|
|
||||||
|
- name: ENABLE_CELERY
|
||||||
|
value:
|
||||||
|
_default: "1"
|
||||||
|
|
||||||
|
- name: ENABLE_MAILGUN
|
||||||
|
value:
|
||||||
|
_default: "0"
|
||||||
|
|
||||||
|
- name: ENABLE_METRICS
|
||||||
|
value:
|
||||||
|
_default: "0"
|
||||||
|
|
||||||
|
- name: FROM_EMAIL
|
||||||
|
value:
|
||||||
|
_default: "sarex@rwb.ru"
|
||||||
|
|
||||||
|
- name: GATEWAY_URL
|
||||||
|
value:
|
||||||
|
_default: "http://pdm-svc.documentations.svc.cluster.local:80"
|
||||||
|
|
||||||
|
- name: RESOURCE_URL
|
||||||
|
value:
|
||||||
|
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||||||
|
|
||||||
|
- name: SERVICE_HOST
|
||||||
|
value:
|
||||||
|
_default: "https://srx.wb.ru/flows/api/v1"
|
||||||
|
|
||||||
|
- name: SMTP_HOST
|
||||||
|
value:
|
||||||
|
_default: "mail.rwb.ru"
|
||||||
|
|
||||||
|
- name: CHECKLIST_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
|
||||||
|
|
||||||
|
- name: SMTP_PORT
|
||||||
|
value:
|
||||||
|
_default: "465"
|
||||||
|
|
||||||
|
- name: SYNC_RESOURCE_ID
|
||||||
|
value:
|
||||||
|
_default: "1"
|
||||||
|
|
||||||
|
- name: TIMEOUT
|
||||||
|
value:
|
||||||
|
_default: "120"
|
||||||
|
|
||||||
|
- name: WORKFLOWS_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://backend-svc.processing.svc.cluster.local:80/api/v1"
|
||||||
|
|
||||||
|
- name: WORKFLOWS_TIMEOUT
|
||||||
|
value:
|
||||||
|
_default: "60"
|
||||||
|
|
||||||
|
- name: DOCUMENTATION_TIMEOUT
|
||||||
|
value:
|
||||||
|
_default: "60"
|
||||||
|
|
||||||
|
# Kafka — код (flow/kafka.py) ждёт KAFKA_HOST как единую строку "host:port"
|
||||||
|
# (не список!), KAFKA_SSL_CERT — сырое PEM-содержимое CA (не путь к файлу,
|
||||||
|
# cadata= в ssl.create_default_context). Хост/порт/CA — те же проверенные
|
||||||
|
# значения, что и у message-hub/pm (apps/message-hub/d8-ugmk-prod).
|
||||||
|
- name: KAFKA_HOST
|
||||||
|
value:
|
||||||
|
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||||||
|
|
||||||
|
- name: KAFKA_SSL_CERT
|
||||||
|
value:
|
||||||
|
_default: |
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
|
||||||
|
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
|
||||||
|
NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
|
||||||
|
MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
|
||||||
|
h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
|
||||||
|
D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
|
||||||
|
tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
|
||||||
|
Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
|
||||||
|
GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
|
||||||
|
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
|
||||||
|
Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
|
||||||
|
A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
|
||||||
|
QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
|
||||||
|
KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
|
||||||
|
kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
|
||||||
|
TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
|
||||||
|
fdA17/ibw6gFrH2b3vZKcx8D455V
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
|
||||||
|
podAnnotations:
|
||||||
|
_default:
|
||||||
|
vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
|
||||||
|
vault.hashicorp.com/agent-inject-template-flows-kafka: |-
|
||||||
|
{{- with secret "secrets/data/kafka/apps/flows" -}}
|
||||||
|
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||||||
|
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||||||
|
{{- end -}}
|
||||||
168
apps/flows/d8-ugmk-prod/celery.yaml
Normal file
168
apps/flows/d8-ugmk-prod/celery.yaml
Normal file
@ -0,0 +1,168 @@
|
|||||||
|
---
|
||||||
|
# Патч celery для контура УГМК — подключение к Kafka.
|
||||||
|
#
|
||||||
|
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
|
||||||
|
# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml.
|
||||||
|
# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
|
||||||
|
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||||||
|
# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: celery
|
||||||
|
namespace: flows
|
||||||
|
spec:
|
||||||
|
values:
|
||||||
|
services:
|
||||||
|
celery:
|
||||||
|
deployment:
|
||||||
|
args:
|
||||||
|
_default:
|
||||||
|
- |
|
||||||
|
set -a
|
||||||
|
[ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
|
||||||
|
[ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
|
||||||
|
[ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
|
||||||
|
[ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
|
||||||
|
[ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
|
||||||
|
[ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
|
||||||
|
set +a
|
||||||
|
exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow
|
||||||
|
|
||||||
|
envs:
|
||||||
|
- name: LOG_LEVEL
|
||||||
|
value:
|
||||||
|
_default: "DEBUG"
|
||||||
|
|
||||||
|
- name: BASE_HOST
|
||||||
|
value:
|
||||||
|
_default: "https://srx.wb.ru"
|
||||||
|
|
||||||
|
- name: CELERY_QUEUE
|
||||||
|
value:
|
||||||
|
_default: "flow"
|
||||||
|
|
||||||
|
- name: EAV_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||||
|
|
||||||
|
- name: DJANGO_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://backend-svc.django.svc.cluster.local:80/api"
|
||||||
|
|
||||||
|
- name: PLANNING_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://backend-service.pm.svc.cluster.local:80/api/pm/msp"
|
||||||
|
|
||||||
|
- name: PLANNING_USE
|
||||||
|
value:
|
||||||
|
_default: "True"
|
||||||
|
|
||||||
|
- name: DOCUMENTATION_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
|
||||||
|
|
||||||
|
- name: DOCUMENTATION_EXTERNAL_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
|
||||||
|
|
||||||
|
- name: ENABLE_ANALYTICS
|
||||||
|
value:
|
||||||
|
_default: "1"
|
||||||
|
|
||||||
|
- name: ENABLE_CELERY
|
||||||
|
value:
|
||||||
|
_default: "1"
|
||||||
|
|
||||||
|
- name: ENABLE_MAILGUN
|
||||||
|
value:
|
||||||
|
_default: "0"
|
||||||
|
|
||||||
|
- name: ENABLE_METRICS
|
||||||
|
value:
|
||||||
|
_default: "0"
|
||||||
|
|
||||||
|
- name: FROM_EMAIL
|
||||||
|
value:
|
||||||
|
_default: "sarex@rwb.ru"
|
||||||
|
|
||||||
|
- name: GATEWAY_URL
|
||||||
|
value:
|
||||||
|
_default: "http://pdm-api.documentations.svc.cluster.local:8080"
|
||||||
|
|
||||||
|
- name: RESOURCE_URL
|
||||||
|
value:
|
||||||
|
_default: "http://resources-service.resources.svc.cluster.local:8000"
|
||||||
|
|
||||||
|
- name: SERVICE_HOST
|
||||||
|
value:
|
||||||
|
_default: "https://srx.wb.ru/flows/api/v1"
|
||||||
|
|
||||||
|
- name: SMTP_HOST
|
||||||
|
value:
|
||||||
|
_default: "mail.rwb.ru"
|
||||||
|
|
||||||
|
- name: CHECKLIST_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
|
||||||
|
|
||||||
|
- name: SMTP_PORT
|
||||||
|
value:
|
||||||
|
_default: "465"
|
||||||
|
|
||||||
|
- name: SYNC_RESOURCE_ID
|
||||||
|
value:
|
||||||
|
_default: "1"
|
||||||
|
|
||||||
|
- name: TIMEOUT
|
||||||
|
value:
|
||||||
|
_default: "120"
|
||||||
|
|
||||||
|
- name: WORKFLOWS_HOST
|
||||||
|
value:
|
||||||
|
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
|
||||||
|
|
||||||
|
- name: WORKFLOWS_TIMEOUT
|
||||||
|
value:
|
||||||
|
_default: "60"
|
||||||
|
|
||||||
|
- name: DOCUMENTATION_TIMEOUT
|
||||||
|
value:
|
||||||
|
_default: "60"
|
||||||
|
|
||||||
|
# См. подробные комментарии в apps/flows/d8-ugmk-prod/backend.yaml.
|
||||||
|
- name: KAFKA_HOST
|
||||||
|
value:
|
||||||
|
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||||||
|
|
||||||
|
- name: KAFKA_SSL_CERT
|
||||||
|
value:
|
||||||
|
_default: |
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
|
||||||
|
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
|
||||||
|
NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
|
||||||
|
MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
|
||||||
|
h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
|
||||||
|
D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
|
||||||
|
tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
|
||||||
|
Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
|
||||||
|
GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
|
||||||
|
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
|
||||||
|
Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
|
||||||
|
A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
|
||||||
|
QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
|
||||||
|
KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
|
||||||
|
kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
|
||||||
|
TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
|
||||||
|
fdA17/ibw6gFrH2b3vZKcx8D455V
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
|
||||||
|
podAnnotations:
|
||||||
|
_default:
|
||||||
|
vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
|
||||||
|
vault.hashicorp.com/agent-inject-template-flows-kafka: |-
|
||||||
|
{{- with secret "secrets/data/kafka/apps/flows" -}}
|
||||||
|
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||||||
|
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||||||
|
{{- end -}}
|
||||||
@ -8,3 +8,11 @@ patches:
|
|||||||
target:
|
target:
|
||||||
kind: Namespace
|
kind: Namespace
|
||||||
name: flows
|
name: flows
|
||||||
|
- path: backend.yaml
|
||||||
|
target:
|
||||||
|
kind: HelmRelease
|
||||||
|
name: backend
|
||||||
|
- path: celery.yaml
|
||||||
|
target:
|
||||||
|
kind: HelmRelease
|
||||||
|
name: celery
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user