Merge remote-tracking branch 'origin/master'

2026-10-06 20:30:02 +03:00 · 2026-10-06 20:30:02 +03:00 · 252a716c03
commit 252a716c03
parent 4f66b55d10 90e684d0a9
17 changed files with 47 additions and 156 deletions
--- a/apps/documentations/uralkal/api.yaml
+++ b/apps/documentations/uralkal/api.yaml
@ -13,6 +13,9 @@ spec:
            requests:
              cpu: null
              memory: null
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api:contour_8631bb0e
        envs:
          - name: POSTGRES_POOL_SIZE
            value:
@ -23,9 +26,12 @@ spec:
          - name: ZITADEL_DOMAIN
            value:
              _default: login.sarex.local.uralkali.com
+          - name: ZITADEL_INSECURE_SKIP_VERIFY
+            value:
+              _default: "true"
          - name: USE_ZITADEL
            value:
-              _default: "0"
+              _default: "1"
          - name: FLOWS_URL
            value:
              _default: http://backend-svc.flows.svc.cluster.local:80
--- a/apps/documentations/uralkal/filestream.yaml
+++ b/apps/documentations/uralkal/filestream.yaml
@ -13,10 +13,16 @@ spec:
            requests:
              cpu: null
              memory: null
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:contour_8631bb0e
        envs:
          - name: POSTGRES_POOL_SIZE
            value:
              _default: "20"
+          - name: ZITADEL_INSECURE_SKIP_VERIFY
+            value:
+              _default: "true"
          - name: ZITADEL_ACCOUNT
            value:
              _default: /vault/secrets/documentations-zitadel-account-json
@ -25,7 +31,7 @@ spec:
              _default: login.sarex.local.uralkali.com
          - name: USE_ZITADEL
            value:
-              _default: "0"
+              _default: "1"
          - name: FLOWS_URL
            value:
              _default: http://backend-svc.flows.svc.cluster.local:80
--- a/apps/flows/uralkal/backend.yaml
+++ b/apps/flows/uralkal/backend.yaml
@ -139,28 +139,11 @@ spec:
            value:
              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"

+        secretEnvs:
          - name: KAFKA_SSL_CERT
-            value:
-              _default: |
-                -----BEGIN CERTIFICATE-----
-                MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-                MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-                MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-                tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-                h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-                k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-                GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-                zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-                Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-                A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-                vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-                OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-                fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-                ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-                0FC16VuidLG0HUCCawFjRiAg9rIA
-                -----END CERTIFICATE-----
+            secretName:
+              _default: kafka-kafka-contour-tls
+            secretKey: "ca.crt"

        podAnnotations:
          _default:
--- a/apps/flows/uralkal/celery.yaml
+++ b/apps/flows/uralkal/celery.yaml
@ -1,11 +1,4 @@
 ---
-# Патч celery для контура УГМК — подключение к Kafka.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml.
-# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
-# podAnnotations — map, мержится по ключам, поэтому переопределён только
-# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@ -140,28 +133,11 @@ spec:
            value:
              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"

+        secretEnvs:
          - name: KAFKA_SSL_CERT
-            value:
-              _default: |
-                -----BEGIN CERTIFICATE-----
-                MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-                MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-                MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-                tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-                h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-                k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-                GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-                zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-                Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-                A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-                vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-                OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-                fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-                ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-                0FC16VuidLG0HUCCawFjRiAg9rIA
-                -----END CERTIFICATE-----
+            secretName:
+              _default: kafka-kafka-contour-tls
+            secretKey: "ca.crt"

        podAnnotations:
          _default:
--- a/apps/iam/base/backend.yaml
+++ b/apps/iam/base/backend.yaml
@ -42,7 +42,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_b52d632c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
          pullPolicy:
            _default: IfNotPresent

--- a/apps/iam/uralkal/backend-s3.yaml
+++ b/apps/iam/uralkal/backend-s3.yaml
@ -57,6 +57,10 @@ spec:
            value:
              _default: "iam"

+          - name: ZITADEL_TLS_INSECURE_SKIP_VERIFY
+            value:
+              _default: "true"
+
          - name: S3_REGION
            value:
              _default: "ru-central1"
--- a/apps/issues/uralkal/backend-s3.yaml
+++ b/apps/issues/uralkal/backend-s3.yaml
@ -49,11 +49,11 @@ spec:
                _default: kafka.crt
              readOnly:
                _default: true
-              configMap:
-                name:
-                  _default: kafka-ca-cert
+              secret:
+                secretName:
+                  _default: kafka-kafka-contour-tls
                items:
-                  - key: kafka.crt
+                  - key: ca.crt
                    path:
                      _default: kafka.crt

--- a/apps/issues/uralkal/celery-s3.yaml
+++ b/apps/issues/uralkal/celery-s3.yaml
@ -49,11 +49,11 @@ spec:
                _default: kafka.crt
              readOnly:
                _default: true
-              configMap:
-                name:
-                  _default: kafka-ca-cert
+              secret:
+                secretName:
+                  _default: kafka-kafka-contour-tls
                items:
-                  - key: kafka.crt
+                  - key: ca.crt
                    path:
                      _default: kafka.crt

--- a/apps/issues/uralkal/kafka-ca-configmap.yaml
+++ b/apps/issues/uralkal/kafka-ca-configmap.yaml
@ -1,27 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-ca-cert
-  namespace: issues
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-    0FC16VuidLG0HUCCawFjRiAg9rIA
-    -----END CERTIFICATE-----
--- a/apps/issues/uralkal/kustomization.yaml
+++ b/apps/issues/uralkal/kustomization.yaml
@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
-  - kafka-ca-configmap.yaml
 patches:
  - path: backend-s3.yaml
    target:
--- a/apps/message-hub/uralkal/kafka-ca-configmap.yaml
+++ b/apps/message-hub/uralkal/kafka-ca-configmap.yaml
@ -1,27 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-ca-cert
-  namespace: message-hub
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-    0FC16VuidLG0HUCCawFjRiAg9rIA
-    -----END CERTIFICATE-----
--- a/apps/message-hub/uralkal/kustomization.yaml
+++ b/apps/message-hub/uralkal/kustomization.yaml
@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
-  - kafka-ca-configmap.yaml
 patches:
  - path: message-hub.yaml
    target:
--- a/apps/message-hub/uralkal/message-hub.yaml
+++ b/apps/message-hub/uralkal/message-hub.yaml
@ -91,11 +91,11 @@ spec:
                _default: kafka.crt
              readOnly:
                _default: true
-              configMap:
-                name:
-                  _default: kafka-ca-cert
+              secret:
+                secretName:
+                  _default: kafka-kafka-contour-tls
                items:
-                  - key: kafka.crt
+                  - key: ca.crt
                    path:
                      _default: kafka.crt

--- a/apps/pm/uralkal/backend.yaml
+++ b/apps/pm/uralkal/backend.yaml
@ -182,11 +182,11 @@ spec:
                _default: kafka.crt
              readOnly:
                _default: true
-              configMap:
-                name:
-                  _default: kafka-ca-cert
+              secret:
+                secretName:
+                  _default: kafka-kafka-contour-tls
                items:
-                  - key: kafka.crt
+                  - key: ca.crt
                    path:
                      _default: kafka.crt

--- a/apps/pm/uralkal/celery.yaml
+++ b/apps/pm/uralkal/celery.yaml
@ -191,11 +191,11 @@ spec:
                _default: kafka.crt
              readOnly:
                _default: true
-              configMap:
-                name:
-                  _default: kafka-ca-cert
+              secret:
+                secretName:
+                  _default: kafka-kafka-contour-tls
                items:
-                  - key: kafka.crt
+                  - key: ca.crt
                    path:
                      _default: kafka.crt

--- a/apps/pm/uralkal/kafka-ca-configmap.yaml
+++ b/apps/pm/uralkal/kafka-ca-configmap.yaml
@ -1,27 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-ca-cert
-  namespace: pm
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-    0FC16VuidLG0HUCCawFjRiAg9rIA
-    -----END CERTIFICATE-----
--- a/apps/pm/uralkal/kustomization.yaml
+++ b/apps/pm/uralkal/kustomization.yaml
@ -3,7 +3,6 @@ kind: Kustomization
 resources:
  - ../base
  - redis.yaml
-  - kafka-ca-configmap.yaml
 patches:
  - path: backend.yaml
    target: