From 3a5b3b07e6e4252fda229fda7d87f924657ad872 Mon Sep 17 00:00:00 2001
From: emelinda <emelin_d_a@mail.ru>
Date: Wed, 5 Aug 2026 00:00:06 +0300
Subject: [PATCH] Add Measurements app to `yc-ecp`: define HelmRelease,
 configure Istio certificates, and update cluster Kustomization

---
 apps/measurements/yc-ecp/kustomization.yaml   | 10 +++
 apps/measurements/yc-ecp/measurements.yaml    | 65 +++++++++++++++++++
 clusters/yc-ecp/kustomization.yaml            |  3 +
 .../istio-config/yc-ecp/istio-config.yaml     | 12 ++--
 4 files changed, 83 insertions(+), 7 deletions(-)
 create mode 100644 apps/measurements/yc-ecp/kustomization.yaml
 create mode 100644 apps/measurements/yc-ecp/measurements.yaml

diff --git a/apps/measurements/yc-ecp/kustomization.yaml b/apps/measurements/yc-ecp/kustomization.yaml
new file mode 100644
index 0000000..ef1b4e0
--- /dev/null
+++ b/apps/measurements/yc-ecp/kustomization.yaml
@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: measurements.yaml
+    target:
+      kind: HelmRelease
+      name: measurements
diff --git a/apps/measurements/yc-ecp/measurements.yaml b/apps/measurements/yc-ecp/measurements.yaml
new file mode 100644
index 0000000..4dcbfa4
--- /dev/null
+++ b/apps/measurements/yc-ecp/measurements.yaml
@@ -0,0 +1,65 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: measurements
+  namespace: measurements
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    services:
+      backend:
+        # в yc-ecp S3-настройки приходят из Secret, а не через Vault Agent,
+        # поэтому serviceAccount, vault-аннотации и обёртка entrypoint не нужны
+        serviceAccount:
+          enabled:
+            _default: false
+          name:
+            _default: null
+
+        podAnnotations:
+          _default: null
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:production_a5bb3e84
+          pullPolicy:
+            _default: Always
+
+        deployment:
+          name:
+            _default: measurement
+
+          replicaCount:
+            _default: 2
+
+          command:
+            _default: null
+          args:
+            _default: null
+
+        service:
+          name:
+            _default: measurement-service
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://aero.invest.sarex.io"
+
+          - name: CLASSIC_MODE
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: S3_JSON_SETTINGS
+            secretName:
+              _default: "s3-json-settings"
+            secretKey: "S3_JSON_SETTINGS"
diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml
index 50dc89a..ed93bd6 100644
--- a/clusters/yc-ecp/kustomization.yaml
+++ b/clusters/yc-ecp/kustomization.yaml
@@ -9,3 +9,6 @@ resources:
   - ../../infrastructure/istio-config/yc-ecp
   - ../../infrastructure/dashboard/yc-ecp
   - ../../infrastructure/vault/yc-ecp
+
+# apps
+  - ../../apps/measurements/yc-ecp
diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml
index 607e680..36adb55 100644
--- a/infrastructure/istio-config/yc-ecp/istio-config.yaml
+++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml
@@ -33,27 +33,25 @@ spec:
                     - http01:
                         ingress:
                           class: istio
-          # имя Certificate = ключ, имя секрета задаётся отдельно
+          # ключ = имя Certificate И имя секрета: версия чарта в OCI-репозитории
+          # поле secretName не читает, а берёт имя ключа
           certificates:
-            gitea-cert:
+            gitea-tls-secret:
               namespace: istio-system
-              secretName: gitea-tls-secret
               dnsNames:
                 - gitea.invest.cps.sarex.lonsdaleites.ru
               issuerRef:
                 name: letsencrypt-prod
                 kind: ClusterIssuer
-            vault-cert:
+            vault-tls:
               namespace: istio-system
-              secretName: vault-tls
               dnsNames:
                 - vault.invest.cps.sarex.lonsdaleites.ru
               issuerRef:
                 name: letsencrypt-prod
                 kind: ClusterIssuer
-            dashboard-cert:
+            dashboard-tls:
               namespace: istio-system
-              secretName: dashboard-tls
               dnsNames:
                 - dashboard.invest.cps.sarex.lonsdaleites.ru
               issuerRef: