From 47943a4420d95b9e2b9f5299a1c84e93e3149757 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 6 Oct 2026 13:21:59 +0500 Subject: [PATCH 1/7] ++ --- apps/control-interface/uralkal/ams-sync.yaml | 183 ++++++++++++++++++ .../uralkal/kustomization.yaml | 1 + 2 files changed, 184 insertions(+) create mode 100644 apps/control-interface/uralkal/ams-sync.yaml diff --git a/apps/control-interface/uralkal/ams-sync.yaml b/apps/control-interface/uralkal/ams-sync.yaml new file mode 100644 index 0000000..4595bf4 --- /dev/null +++ b/apps/control-interface/uralkal/ams-sync.yaml @@ -0,0 +1,183 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ams-sync + namespace: control-interface + labels: + app: ams-sync + service: backend +spec: + replicas: 1 + selector: + matchLabels: + app: ams-sync + template: + metadata: + labels: + app: ams-sync + service: backend + spec: + containers: + - name: backend + image: cr.yandex/crp3ccidau046kdj8g9q/ams-sync:ugok + command: ["sleep", "999999999999"] + imagePullPolicy: IfNotPresent + ports: + - name: http + containerPort: 8000 + protocol: TCP + env: + - name: AMS_SYNC_TOPIC + value: ams-sync + - name: ENVIRONMENT + value: PRODUCTION + - name: HOST_ORGANIZATION_ID + value: '392748423989716183' + - name: ALERT_ENABLED + value: 'False' + - name: USER_SERVER_HOST + value: https://sarex.local.uralkali.com + - name: AUTH_HOST + value: https://sarex.local.uralkali.com + - name: VERIFY_USERS + value: 'True' + - name: KAFKA_SECURITY_PROTOCOL + value: SSL + - name: KAFKA_SASL_MECHANISM + value: SCRAM-SHA-512 + - name: RESOURCES_INTERNAL_HOST + value: http://iams.iam.svc.cluster.local:8080 + - name: TELEGRAM_TOKEN + valueFrom: + secretKeyRef: + name: telegram-secret + key: telegram-token + - name: TELEGRAM_GROUP_ID + valueFrom: + secretKeyRef: + name: telegram-secret + key: telegram-group-id + - name: ZITADEL_HOST + valueFrom: + secretKeyRef: + name: zitadel-token-secret + key: zitadel-host + - name: ZITADEL_SERVICE_ACCESS_TOKEN + valueFrom: + secretKeyRef: + name: zitadel-token-secret + key: zitadel-access-token + - name: KAFKA_BOOTSTRAP_SERVERS + valueFrom: + secretKeyRef: + name: ams-kafka-secret + key: kafka-bootstrap-servers + - name: KAFKA_SASL_PLAIN_USERNAME + valueFrom: + secretKeyRef: + name: ams-kafka-secret + key: kafka-username + - name: KAFKA_SASL_PLAIN_PASSWORD + valueFrom: + secretKeyRef: + name: ams-kafka-secret + key: kafka-password + - name: KAFKA_SSL_CAFILE + valueFrom: + secretKeyRef: + name: ams-kafka-secret + key: kafka-ca-file + - name: AUTH_ADMIN_USERNAME + valueFrom: + secretKeyRef: + name: auth-secret + key: admin-username + - name: AUTH_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + name: auth-secret + key: admin-password + - name: USER_DB_NAME + valueFrom: + secretKeyRef: + name: user-db-secret + key: user-db-name + - name: USER_DB_USER + valueFrom: + secretKeyRef: + name: user-db-secret + key: user-db-user + - name: USER_DB_PASSWORD + valueFrom: + secretKeyRef: + name: user-db-secret + key: user-db-password + - name: USER_DB_HOST + valueFrom: + secretKeyRef: + name: user-db-secret + key: user-db-host + - name: USER_DB_PORT + valueFrom: + secretKeyRef: + name: user-db-secret + key: user-db-port + imagePullSecrets: + - name: regcred +--- +apiVersion: v1 +kind: Secret +metadata: + name: ams-kafka-secret + namespace: control-interface +type: Opaque +data: + kafka-bootstrap-servers: WyJicnVzbmlrYS1zdGFnZS1rYWZrYS1ib290c3RyYXAua2Fma2Euc3ZjLmNsdXN0ZXIubG9jYWw6OTA5MyJd + kafka-ca-file: L2V0Yy9jYS1jZXJ0aWZpY2F0ZXMvWWFuZGV4L1lhbmRleEludGVybmFsUm9vdENBLmNydA== + kafka-password: bkszNnNhc3ZTZm9JdEpuWFE0cXhhdjJPVVdJUFg1WkM= + kafka-username: c2FyZXg= +--- +apiVersion: v1 +kind: Secret +metadata: + name: auth-secret + namespace: control-interface +type: Opaque +data: + admin-password: emVhbG90MDk2 + admin-username: aGFnZW4wMTM= + host: aHR0cHM6Ly9zYXJleC5sb2NhbC51cmFsa2FsaS5jb20= +--- +apiVersion: v1 +kind: Secret +metadata: + name: telegram-secret + namespace: control-interface +type: Opaque +data: + telegram-group-id: LTEwMDIzNTAyNzE= + telegram-token: NzAyOTgxMDQ2ODpBQUZBUUI1X0Y5TV92R2RndGlXOVBDRzVTUndIcFg2SnNUZw== +--- +apiVersion: v1 +kind: Secret +metadata: + name: user-db-secret + namespace: control-interface +type: Opaque +data: + user-db-host: MTAuMTMzLjAuMjQ5 + user-db-name: c2FyZXhfZGI= + user-db-password: QXNOUkE3WUhoUVlIWnNCRXFRUVBxRUUwdEU0ZmtwTTU= + user-db-port: NTQzMg== + user-db-user: ZGphbmdv +--- +apiVersion: v1 +kind: Secret +metadata: + name: zitadel-token-secret + namespace: control-interface +type: Opaque +data: + zitadel-access-token: OXk5V0VZR05YYm11UXFxQlRjNDFNSTV1Yjc5R3R6VkR0dFZRM2ZiSE5PMnVpQU9YNTAwRzYyN3BDeUk5TEd2Y1Q0TFlHd2w= + zitadel-host: aHR0cHM6Ly9sb2dpbi5zYXJleC5sb2NhbC51cmFsa2FsaS5jb20= diff --git a/apps/control-interface/uralkal/kustomization.yaml b/apps/control-interface/uralkal/kustomization.yaml index 11cf137..ecf4b15 100644 --- a/apps/control-interface/uralkal/kustomization.yaml +++ b/apps/control-interface/uralkal/kustomization.yaml @@ -3,3 +3,4 @@ kind: Kustomization resources: - ../base - namespace.yaml + - ams-sync.yaml From 41177283297e15fcaac99b929a9bebddfa78dda7 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 6 Oct 2026 16:07:47 +0500 Subject: [PATCH 2/7] ++ --- apps/control-interface/uralkal/ams-sync.yaml | 183 ------------------ .../uralkal/kustomization.yaml | 1 - apps/documentations/uralkal/api.yaml | 2 +- apps/documentations/uralkal/filestream.yaml | 2 +- 4 files changed, 2 insertions(+), 186 deletions(-) delete mode 100644 apps/control-interface/uralkal/ams-sync.yaml diff --git a/apps/control-interface/uralkal/ams-sync.yaml b/apps/control-interface/uralkal/ams-sync.yaml deleted file mode 100644 index 4595bf4..0000000 --- a/apps/control-interface/uralkal/ams-sync.yaml +++ /dev/null @@ -1,183 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: ams-sync - namespace: control-interface - labels: - app: ams-sync - service: backend -spec: - replicas: 1 - selector: - matchLabels: - app: ams-sync - template: - metadata: - labels: - app: ams-sync - service: backend - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/ams-sync:ugok - command: ["sleep", "999999999999"] - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: AMS_SYNC_TOPIC - value: ams-sync - - name: ENVIRONMENT - value: PRODUCTION - - name: HOST_ORGANIZATION_ID - value: '392748423989716183' - - name: ALERT_ENABLED - value: 'False' - - name: USER_SERVER_HOST - value: https://sarex.local.uralkali.com - - name: AUTH_HOST - value: https://sarex.local.uralkali.com - - name: VERIFY_USERS - value: 'True' - - name: KAFKA_SECURITY_PROTOCOL - value: SSL - - name: KAFKA_SASL_MECHANISM - value: SCRAM-SHA-512 - - name: RESOURCES_INTERNAL_HOST - value: http://iams.iam.svc.cluster.local:8080 - - name: TELEGRAM_TOKEN - valueFrom: - secretKeyRef: - name: telegram-secret - key: telegram-token - - name: TELEGRAM_GROUP_ID - valueFrom: - secretKeyRef: - name: telegram-secret - key: telegram-group-id - - name: ZITADEL_HOST - valueFrom: - secretKeyRef: - name: zitadel-token-secret - key: zitadel-host - - name: ZITADEL_SERVICE_ACCESS_TOKEN - valueFrom: - secretKeyRef: - name: zitadel-token-secret - key: zitadel-access-token - - name: KAFKA_BOOTSTRAP_SERVERS - valueFrom: - secretKeyRef: - name: ams-kafka-secret - key: kafka-bootstrap-servers - - name: KAFKA_SASL_PLAIN_USERNAME - valueFrom: - secretKeyRef: - name: ams-kafka-secret - key: kafka-username - - name: KAFKA_SASL_PLAIN_PASSWORD - valueFrom: - secretKeyRef: - name: ams-kafka-secret - key: kafka-password - - name: KAFKA_SSL_CAFILE - valueFrom: - secretKeyRef: - name: ams-kafka-secret - key: kafka-ca-file - - name: AUTH_ADMIN_USERNAME - valueFrom: - secretKeyRef: - name: auth-secret - key: admin-username - - name: AUTH_ADMIN_PASSWORD - valueFrom: - secretKeyRef: - name: auth-secret - key: admin-password - - name: USER_DB_NAME - valueFrom: - secretKeyRef: - name: user-db-secret - key: user-db-name - - name: USER_DB_USER - valueFrom: - secretKeyRef: - name: user-db-secret - key: user-db-user - - name: USER_DB_PASSWORD - valueFrom: - secretKeyRef: - name: user-db-secret - key: user-db-password - - name: USER_DB_HOST - valueFrom: - secretKeyRef: - name: user-db-secret - key: user-db-host - - name: USER_DB_PORT - valueFrom: - secretKeyRef: - name: user-db-secret - key: user-db-port - imagePullSecrets: - - name: regcred ---- -apiVersion: v1 -kind: Secret -metadata: - name: ams-kafka-secret - namespace: control-interface -type: Opaque -data: - kafka-bootstrap-servers: WyJicnVzbmlrYS1zdGFnZS1rYWZrYS1ib290c3RyYXAua2Fma2Euc3ZjLmNsdXN0ZXIubG9jYWw6OTA5MyJd - kafka-ca-file: L2V0Yy9jYS1jZXJ0aWZpY2F0ZXMvWWFuZGV4L1lhbmRleEludGVybmFsUm9vdENBLmNydA== - kafka-password: bkszNnNhc3ZTZm9JdEpuWFE0cXhhdjJPVVdJUFg1WkM= - kafka-username: c2FyZXg= ---- -apiVersion: v1 -kind: Secret -metadata: - name: auth-secret - namespace: control-interface -type: Opaque -data: - admin-password: emVhbG90MDk2 - admin-username: aGFnZW4wMTM= - host: aHR0cHM6Ly9zYXJleC5sb2NhbC51cmFsa2FsaS5jb20= ---- -apiVersion: v1 -kind: Secret -metadata: - name: telegram-secret - namespace: control-interface -type: Opaque -data: - telegram-group-id: LTEwMDIzNTAyNzE= - telegram-token: NzAyOTgxMDQ2ODpBQUZBUUI1X0Y5TV92R2RndGlXOVBDRzVTUndIcFg2SnNUZw== ---- -apiVersion: v1 -kind: Secret -metadata: - name: user-db-secret - namespace: control-interface -type: Opaque -data: - user-db-host: MTAuMTMzLjAuMjQ5 - user-db-name: c2FyZXhfZGI= - user-db-password: QXNOUkE3WUhoUVlIWnNCRXFRUVBxRUUwdEU0ZmtwTTU= - user-db-port: NTQzMg== - user-db-user: ZGphbmdv ---- -apiVersion: v1 -kind: Secret -metadata: - name: zitadel-token-secret - namespace: control-interface -type: Opaque -data: - zitadel-access-token: OXk5V0VZR05YYm11UXFxQlRjNDFNSTV1Yjc5R3R6VkR0dFZRM2ZiSE5PMnVpQU9YNTAwRzYyN3BDeUk5TEd2Y1Q0TFlHd2w= - zitadel-host: aHR0cHM6Ly9sb2dpbi5zYXJleC5sb2NhbC51cmFsa2FsaS5jb20= diff --git a/apps/control-interface/uralkal/kustomization.yaml b/apps/control-interface/uralkal/kustomization.yaml index ecf4b15..11cf137 100644 --- a/apps/control-interface/uralkal/kustomization.yaml +++ b/apps/control-interface/uralkal/kustomization.yaml @@ -3,4 +3,3 @@ kind: Kustomization resources: - ../base - namespace.yaml - - ams-sync.yaml diff --git a/apps/documentations/uralkal/api.yaml b/apps/documentations/uralkal/api.yaml index f6d5d90..3a4b29e 100644 --- a/apps/documentations/uralkal/api.yaml +++ b/apps/documentations/uralkal/api.yaml @@ -25,7 +25,7 @@ spec: _default: login.sarex.local.uralkali.com - name: USE_ZITADEL value: - _default: "0" + _default: "1" - name: FLOWS_URL value: _default: http://backend-svc.flows.svc.cluster.local:80 diff --git a/apps/documentations/uralkal/filestream.yaml b/apps/documentations/uralkal/filestream.yaml index fcd7b29..298bac6 100644 --- a/apps/documentations/uralkal/filestream.yaml +++ b/apps/documentations/uralkal/filestream.yaml @@ -25,7 +25,7 @@ spec: _default: login.sarex.local.uralkali.com - name: USE_ZITADEL value: - _default: "0" + _default: "1" - name: FLOWS_URL value: _default: http://backend-svc.flows.svc.cluster.local:80 From 563ccefe83d7f2882f9dc6966e40b877de56875b Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 6 Oct 2026 16:50:50 +0500 Subject: [PATCH 3/7] documentations/uralkal: use prod_179e518c_uralkali images for api and filestream --- apps/documentations/uralkal/api.yaml | 3 +++ apps/documentations/uralkal/filestream.yaml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/apps/documentations/uralkal/api.yaml b/apps/documentations/uralkal/api.yaml index 3a4b29e..6f91d56 100644 --- a/apps/documentations/uralkal/api.yaml +++ b/apps/documentations/uralkal/api.yaml @@ -13,6 +13,9 @@ spec: requests: cpu: null memory: null + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c_uralkali envs: - name: POSTGRES_POOL_SIZE value: diff --git a/apps/documentations/uralkal/filestream.yaml b/apps/documentations/uralkal/filestream.yaml index 298bac6..00019cb 100644 --- a/apps/documentations/uralkal/filestream.yaml +++ b/apps/documentations/uralkal/filestream.yaml @@ -13,6 +13,9 @@ spec: requests: cpu: null memory: null + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_179e518c_uralkali envs: - name: POSTGRES_POOL_SIZE value: From df45eca99fd9bdb3511334b78a5501eab2aa67a7 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 6 Oct 2026 17:53:40 +0500 Subject: [PATCH 4/7] ++ --- apps/documentations/uralkal/api.yaml | 5 ++++- apps/documentations/uralkal/filestream.yaml | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/apps/documentations/uralkal/api.yaml b/apps/documentations/uralkal/api.yaml index 6f91d56..8a18e18 100644 --- a/apps/documentations/uralkal/api.yaml +++ b/apps/documentations/uralkal/api.yaml @@ -15,7 +15,7 @@ spec: memory: null image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c_uralkali + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api:contour_8631bb0e envs: - name: POSTGRES_POOL_SIZE value: @@ -26,6 +26,9 @@ spec: - name: ZITADEL_DOMAIN value: _default: login.sarex.local.uralkali.com + - name: ZITADEL_INSECURE_SKIP_VERIFY + value: + _default: "true" - name: USE_ZITADEL value: _default: "1" diff --git a/apps/documentations/uralkal/filestream.yaml b/apps/documentations/uralkal/filestream.yaml index 00019cb..15e7fff 100644 --- a/apps/documentations/uralkal/filestream.yaml +++ b/apps/documentations/uralkal/filestream.yaml @@ -15,11 +15,14 @@ spec: memory: null image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_179e518c_uralkali + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:contour_8631bb0e envs: - name: POSTGRES_POOL_SIZE value: _default: "20" + - name: ZITADEL_INSECURE_SKIP_VERIFY + value: + _default: "true" - name: ZITADEL_ACCOUNT value: _default: /vault/secrets/documentations-zitadel-account-json From 8c8a646e03657e469f54a96b65f97d85470b37a5 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 6 Oct 2026 18:19:18 +0500 Subject: [PATCH 5/7] ++ --- apps/iam/base/backend.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/iam/base/backend.yaml b/apps/iam/base/backend.yaml index a2d1786..6a8e104 100644 --- a/apps/iam/base/backend.yaml +++ b/apps/iam/base/backend.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_b52d632c + _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513 pullPolicy: _default: IfNotPresent From b1bfb8049a764cc0dee75ac856e5efa99d85392e Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 6 Oct 2026 18:24:47 +0500 Subject: [PATCH 6/7] ++ --- apps/iam/uralkal/backend-s3.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/iam/uralkal/backend-s3.yaml b/apps/iam/uralkal/backend-s3.yaml index 7e6c02a..97955a1 100644 --- a/apps/iam/uralkal/backend-s3.yaml +++ b/apps/iam/uralkal/backend-s3.yaml @@ -57,6 +57,10 @@ spec: value: _default: "iam" + - name: ZITADEL_TLS_INSECURE_SKIP_VERIFY + value: + _default: "true" + - name: S3_REGION value: _default: "ru-central1" From 90e684d0a9bbc4f4b7cafb453c79177477f8a77f Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 6 Oct 2026 21:59:43 +0500 Subject: [PATCH 7/7] uralkal: take Kafka CA from the kafka-kafka-contour-tls secret flows, issues, pm and message-hub read ca.crt from a copy of the Kafka TLS secret in their own namespace instead of an inline PEM (flows) or a per-namespace kafka-ca-cert ConfigMap (issues, pm, message-hub). Mount paths and env names are unchanged. The secret must exist in each namespace before the pods restart. --- apps/flows/uralkal/backend.yaml | 25 +++------------ apps/flows/uralkal/celery.yaml | 32 +++---------------- apps/issues/uralkal/backend-s3.yaml | 8 ++--- apps/issues/uralkal/celery-s3.yaml | 8 ++--- apps/issues/uralkal/kafka-ca-configmap.yaml | 27 ---------------- apps/issues/uralkal/kustomization.yaml | 1 - .../uralkal/kafka-ca-configmap.yaml | 27 ---------------- apps/message-hub/uralkal/kustomization.yaml | 1 - apps/message-hub/uralkal/message-hub.yaml | 8 ++--- apps/pm/uralkal/backend.yaml | 8 ++--- apps/pm/uralkal/celery.yaml | 8 ++--- apps/pm/uralkal/kafka-ca-configmap.yaml | 27 ---------------- apps/pm/uralkal/kustomization.yaml | 1 - 13 files changed, 28 insertions(+), 153 deletions(-) delete mode 100644 apps/issues/uralkal/kafka-ca-configmap.yaml delete mode 100644 apps/message-hub/uralkal/kafka-ca-configmap.yaml delete mode 100644 apps/pm/uralkal/kafka-ca-configmap.yaml diff --git a/apps/flows/uralkal/backend.yaml b/apps/flows/uralkal/backend.yaml index f959017..35f0313 100644 --- a/apps/flows/uralkal/backend.yaml +++ b/apps/flows/uralkal/backend.yaml @@ -139,28 +139,11 @@ spec: value: _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + secretEnvs: - name: KAFKA_SSL_CERT - value: - _default: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- + secretName: + _default: kafka-kafka-contour-tls + secretKey: "ca.crt" podAnnotations: _default: diff --git a/apps/flows/uralkal/celery.yaml b/apps/flows/uralkal/celery.yaml index 99300df..3cca934 100644 --- a/apps/flows/uralkal/celery.yaml +++ b/apps/flows/uralkal/celery.yaml @@ -1,11 +1,4 @@ --- -# Патч celery для контура УГМК — подключение к Kafka. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml. -# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka. -# podAnnotations — map, мержится по ключам, поэтому переопределён только -# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -140,28 +133,11 @@ spec: value: _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + secretEnvs: - name: KAFKA_SSL_CERT - value: - _default: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- + secretName: + _default: kafka-kafka-contour-tls + secretKey: "ca.crt" podAnnotations: _default: diff --git a/apps/issues/uralkal/backend-s3.yaml b/apps/issues/uralkal/backend-s3.yaml index a84b217..0bf8a3c 100644 --- a/apps/issues/uralkal/backend-s3.yaml +++ b/apps/issues/uralkal/backend-s3.yaml @@ -49,11 +49,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/issues/uralkal/celery-s3.yaml b/apps/issues/uralkal/celery-s3.yaml index 57dd8c2..5c0e3f8 100644 --- a/apps/issues/uralkal/celery-s3.yaml +++ b/apps/issues/uralkal/celery-s3.yaml @@ -49,11 +49,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/issues/uralkal/kafka-ca-configmap.yaml b/apps/issues/uralkal/kafka-ca-configmap.yaml deleted file mode 100644 index dc16987..0000000 --- a/apps/issues/uralkal/kafka-ca-configmap.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: kafka-ca-cert - namespace: issues -data: - kafka.crt: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- diff --git a/apps/issues/uralkal/kustomization.yaml b/apps/issues/uralkal/kustomization.yaml index 88e7b00..0e24432 100644 --- a/apps/issues/uralkal/kustomization.yaml +++ b/apps/issues/uralkal/kustomization.yaml @@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base - - kafka-ca-configmap.yaml patches: - path: backend-s3.yaml target: diff --git a/apps/message-hub/uralkal/kafka-ca-configmap.yaml b/apps/message-hub/uralkal/kafka-ca-configmap.yaml deleted file mode 100644 index 9d0f768..0000000 --- a/apps/message-hub/uralkal/kafka-ca-configmap.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: kafka-ca-cert - namespace: message-hub -data: - kafka.crt: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- diff --git a/apps/message-hub/uralkal/kustomization.yaml b/apps/message-hub/uralkal/kustomization.yaml index 9bbf73e..aee71ac 100644 --- a/apps/message-hub/uralkal/kustomization.yaml +++ b/apps/message-hub/uralkal/kustomization.yaml @@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base - - kafka-ca-configmap.yaml patches: - path: message-hub.yaml target: diff --git a/apps/message-hub/uralkal/message-hub.yaml b/apps/message-hub/uralkal/message-hub.yaml index 32432e0..8087a85 100644 --- a/apps/message-hub/uralkal/message-hub.yaml +++ b/apps/message-hub/uralkal/message-hub.yaml @@ -91,11 +91,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/pm/uralkal/backend.yaml b/apps/pm/uralkal/backend.yaml index acf6698..22c108f 100644 --- a/apps/pm/uralkal/backend.yaml +++ b/apps/pm/uralkal/backend.yaml @@ -182,11 +182,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/pm/uralkal/celery.yaml b/apps/pm/uralkal/celery.yaml index 664fb17..17df2cf 100644 --- a/apps/pm/uralkal/celery.yaml +++ b/apps/pm/uralkal/celery.yaml @@ -191,11 +191,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/pm/uralkal/kafka-ca-configmap.yaml b/apps/pm/uralkal/kafka-ca-configmap.yaml deleted file mode 100644 index 8b919b1..0000000 --- a/apps/pm/uralkal/kafka-ca-configmap.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: kafka-ca-cert - namespace: pm -data: - kafka.crt: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- diff --git a/apps/pm/uralkal/kustomization.yaml b/apps/pm/uralkal/kustomization.yaml index cc8d769..392a5ce 100644 --- a/apps/pm/uralkal/kustomization.yaml +++ b/apps/pm/uralkal/kustomization.yaml @@ -3,7 +3,6 @@ kind: Kustomization resources: - ../base - redis.yaml - - kafka-ca-configmap.yaml patches: - path: backend.yaml target: