diff --git a/apps/documentations/uralkal/api.yaml b/apps/documentations/uralkal/api.yaml index f6d5d90..8a18e18 100644 --- a/apps/documentations/uralkal/api.yaml +++ b/apps/documentations/uralkal/api.yaml @@ -13,6 +13,9 @@ spec: requests: cpu: null memory: null + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api:contour_8631bb0e envs: - name: POSTGRES_POOL_SIZE value: @@ -23,9 +26,12 @@ spec: - name: ZITADEL_DOMAIN value: _default: login.sarex.local.uralkali.com + - name: ZITADEL_INSECURE_SKIP_VERIFY + value: + _default: "true" - name: USE_ZITADEL value: - _default: "0" + _default: "1" - name: FLOWS_URL value: _default: http://backend-svc.flows.svc.cluster.local:80 diff --git a/apps/documentations/uralkal/filestream.yaml b/apps/documentations/uralkal/filestream.yaml index fcd7b29..15e7fff 100644 --- a/apps/documentations/uralkal/filestream.yaml +++ b/apps/documentations/uralkal/filestream.yaml @@ -13,10 +13,16 @@ spec: requests: cpu: null memory: null + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:contour_8631bb0e envs: - name: POSTGRES_POOL_SIZE value: _default: "20" + - name: ZITADEL_INSECURE_SKIP_VERIFY + value: + _default: "true" - name: ZITADEL_ACCOUNT value: _default: /vault/secrets/documentations-zitadel-account-json @@ -25,7 +31,7 @@ spec: _default: login.sarex.local.uralkali.com - name: USE_ZITADEL value: - _default: "0" + _default: "1" - name: FLOWS_URL value: _default: http://backend-svc.flows.svc.cluster.local:80 diff --git a/apps/flows/uralkal/backend.yaml b/apps/flows/uralkal/backend.yaml index f959017..35f0313 100644 --- a/apps/flows/uralkal/backend.yaml +++ b/apps/flows/uralkal/backend.yaml @@ -139,28 +139,11 @@ spec: value: _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + secretEnvs: - name: KAFKA_SSL_CERT - value: - _default: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- + secretName: + _default: kafka-kafka-contour-tls + secretKey: "ca.crt" podAnnotations: _default: diff --git a/apps/flows/uralkal/celery.yaml b/apps/flows/uralkal/celery.yaml index 99300df..3cca934 100644 --- a/apps/flows/uralkal/celery.yaml +++ b/apps/flows/uralkal/celery.yaml @@ -1,11 +1,4 @@ --- -# Патч celery для контура УГМК — подключение к Kafka. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml. -# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka. -# podAnnotations — map, мержится по ключам, поэтому переопределён только -# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -140,28 +133,11 @@ spec: value: _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + secretEnvs: - name: KAFKA_SSL_CERT - value: - _default: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- + secretName: + _default: kafka-kafka-contour-tls + secretKey: "ca.crt" podAnnotations: _default: diff --git a/apps/iam/base/backend.yaml b/apps/iam/base/backend.yaml index a2d1786..6a8e104 100644 --- a/apps/iam/base/backend.yaml +++ b/apps/iam/base/backend.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_b52d632c + _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513 pullPolicy: _default: IfNotPresent diff --git a/apps/iam/uralkal/backend-s3.yaml b/apps/iam/uralkal/backend-s3.yaml index 7e6c02a..97955a1 100644 --- a/apps/iam/uralkal/backend-s3.yaml +++ b/apps/iam/uralkal/backend-s3.yaml @@ -57,6 +57,10 @@ spec: value: _default: "iam" + - name: ZITADEL_TLS_INSECURE_SKIP_VERIFY + value: + _default: "true" + - name: S3_REGION value: _default: "ru-central1" diff --git a/apps/issues/uralkal/backend-s3.yaml b/apps/issues/uralkal/backend-s3.yaml index a84b217..0bf8a3c 100644 --- a/apps/issues/uralkal/backend-s3.yaml +++ b/apps/issues/uralkal/backend-s3.yaml @@ -49,11 +49,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/issues/uralkal/celery-s3.yaml b/apps/issues/uralkal/celery-s3.yaml index 57dd8c2..5c0e3f8 100644 --- a/apps/issues/uralkal/celery-s3.yaml +++ b/apps/issues/uralkal/celery-s3.yaml @@ -49,11 +49,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/issues/uralkal/kafka-ca-configmap.yaml b/apps/issues/uralkal/kafka-ca-configmap.yaml deleted file mode 100644 index dc16987..0000000 --- a/apps/issues/uralkal/kafka-ca-configmap.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: kafka-ca-cert - namespace: issues -data: - kafka.crt: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- diff --git a/apps/issues/uralkal/kustomization.yaml b/apps/issues/uralkal/kustomization.yaml index 88e7b00..0e24432 100644 --- a/apps/issues/uralkal/kustomization.yaml +++ b/apps/issues/uralkal/kustomization.yaml @@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base - - kafka-ca-configmap.yaml patches: - path: backend-s3.yaml target: diff --git a/apps/message-hub/uralkal/kafka-ca-configmap.yaml b/apps/message-hub/uralkal/kafka-ca-configmap.yaml deleted file mode 100644 index 9d0f768..0000000 --- a/apps/message-hub/uralkal/kafka-ca-configmap.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: kafka-ca-cert - namespace: message-hub -data: - kafka.crt: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- diff --git a/apps/message-hub/uralkal/kustomization.yaml b/apps/message-hub/uralkal/kustomization.yaml index 9bbf73e..aee71ac 100644 --- a/apps/message-hub/uralkal/kustomization.yaml +++ b/apps/message-hub/uralkal/kustomization.yaml @@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base - - kafka-ca-configmap.yaml patches: - path: message-hub.yaml target: diff --git a/apps/message-hub/uralkal/message-hub.yaml b/apps/message-hub/uralkal/message-hub.yaml index 32432e0..8087a85 100644 --- a/apps/message-hub/uralkal/message-hub.yaml +++ b/apps/message-hub/uralkal/message-hub.yaml @@ -91,11 +91,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/pm/uralkal/backend.yaml b/apps/pm/uralkal/backend.yaml index acf6698..22c108f 100644 --- a/apps/pm/uralkal/backend.yaml +++ b/apps/pm/uralkal/backend.yaml @@ -182,11 +182,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/pm/uralkal/celery.yaml b/apps/pm/uralkal/celery.yaml index 664fb17..17df2cf 100644 --- a/apps/pm/uralkal/celery.yaml +++ b/apps/pm/uralkal/celery.yaml @@ -191,11 +191,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/pm/uralkal/kafka-ca-configmap.yaml b/apps/pm/uralkal/kafka-ca-configmap.yaml deleted file mode 100644 index 8b919b1..0000000 --- a/apps/pm/uralkal/kafka-ca-configmap.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: kafka-ca-cert - namespace: pm -data: - kafka.crt: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- diff --git a/apps/pm/uralkal/kustomization.yaml b/apps/pm/uralkal/kustomization.yaml index cc8d769..392a5ce 100644 --- a/apps/pm/uralkal/kustomization.yaml +++ b/apps/pm/uralkal/kustomization.yaml @@ -3,7 +3,6 @@ kind: Kustomization resources: - ../base - redis.yaml - - kafka-ca-configmap.yaml patches: - path: backend.yaml target: