Add Measurements app to yc-ecp: define HelmRelease, configure Istio certificates, and update cluster Kustomization

apps/measurements/yc-ecp/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: measurements.yaml
+    target:
+      kind: HelmRelease
+      name: measurements

apps/measurements/yc-ecp/measurements.yaml

@@ -0,0 +1,65 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: measurements
+  namespace: measurements
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    services:
+      backend:
+        # в yc-ecp S3-настройки приходят из Secret, а не через Vault Agent,
+        # поэтому serviceAccount, vault-аннотации и обёртка entrypoint не нужны
+        serviceAccount:
+          enabled:
+            _default: false
+          name:
+            _default: null
+
+        podAnnotations:
+          _default: null
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:production_a5bb3e84
+          pullPolicy:
+            _default: Always
+
+        deployment:
+          name:
+            _default: measurement
+
+          replicaCount:
+            _default: 2
+
+          command:
+            _default: null
+          args:
+            _default: null
+
+        service:
+          name:
+            _default: measurement-service
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://aero.invest.sarex.io"
+
+          - name: CLASSIC_MODE
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: S3_JSON_SETTINGS
+            secretName:
+              _default: "s3-json-settings"
+            secretKey: "S3_JSON_SETTINGS"

clusters/yc-ecp/kustomization.yaml

@@ -9,3 +9,6 @@ resources:
   - ../../infrastructure/istio-config/yc-ecp
   - ../../infrastructure/dashboard/yc-ecp
   - ../../infrastructure/vault/yc-ecp
+
+# apps
+  - ../../apps/measurements/yc-ecp

infrastructure/istio-config/yc-ecp/istio-config.yaml

@@ -33,27 +33,25 @@ spec:
                     - http01:
                         ingress:
                           class: istio
-          # имя Certificate = ключ, имя секрета задаётся отдельно
+          # ключ = имя Certificate И имя секрета: версия чарта в OCI-репозитории
+          # поле secretName не читает, а берёт имя ключа
           certificates:
-            gitea-cert:
+            gitea-tls-secret:
               namespace: istio-system
-              secretName: gitea-tls-secret
               dnsNames:
                 - gitea.invest.cps.sarex.lonsdaleites.ru
               issuerRef:
                 name: letsencrypt-prod
                 kind: ClusterIssuer
-            vault-cert:
+            vault-tls:
               namespace: istio-system
-              secretName: vault-tls
               dnsNames:
                 - vault.invest.cps.sarex.lonsdaleites.ru
               issuerRef:
                 name: letsencrypt-prod
                 kind: ClusterIssuer
-            dashboard-cert:
+            dashboard-tls:
               namespace: istio-system
-              secretName: dashboard-tls
               dnsNames:
                 - dashboard.invest.cps.sarex.lonsdaleites.ru
               issuerRef: