From bf5b04ace7ca1b2bce42ea555646897e93503ae0 Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 3 Aug 2026 14:27:22 +0500 Subject: [PATCH 01/85] ++ --- apps/bim/base/backend.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/bim/base/backend.yaml b/apps/bim/base/backend.yaml index dc5c8e0..e6be7a4 100644 --- a/apps/bim/base/backend.yaml +++ b/apps/bim/base/backend.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/bim-api:contour_f9f2a39 + _default: cr.yandex/crp3ccidau046kdj8g9q/bim-api:contour_f9f2a39-dirty pullPolicy: _default: IfNotPresent From 9c5dd7c86087283b8897db74eed950bdfcd2ca34 Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 3 Aug 2026 14:32:07 +0500 Subject: [PATCH 02/85] ++ --- apps/issues/base/kustomization.yaml | 2 ++ apps/issues/base/redis-deployment.yaml | 27 ++++++++++++++++++++++++++ apps/issues/base/redis-service.yaml | 13 +++++++++++++ 3 files changed, 42 insertions(+) create mode 100644 apps/issues/base/redis-deployment.yaml create mode 100644 apps/issues/base/redis-service.yaml diff --git a/apps/issues/base/kustomization.yaml b/apps/issues/base/kustomization.yaml index 36da654..3f644d7 100644 --- a/apps/issues/base/kustomization.yaml +++ b/apps/issues/base/kustomization.yaml @@ -8,3 +8,5 @@ resources: - celery.yaml - frontend.yaml - production-configmap.yaml + - redis-deployment.yaml + - redis-service.yaml diff --git a/apps/issues/base/redis-deployment.yaml b/apps/issues/base/redis-deployment.yaml new file mode 100644 index 0000000..cb26558 --- /dev/null +++ b/apps/issues/base/redis-deployment.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: redis + namespace: issues + labels: + app: redis +spec: + replicas: 1 + selector: + matchLabels: + app: redis + template: + metadata: + labels: + app: redis + spec: + containers: + - name: redis + image: cr.yandex/crp3ccidau046kdj8g9q/redis:latest + imagePullPolicy: Always + ports: + - containerPort: 6379 + protocol: TCP + imagePullSecrets: + - name: regcred diff --git a/apps/issues/base/redis-service.yaml b/apps/issues/base/redis-service.yaml new file mode 100644 index 0000000..591c935 --- /dev/null +++ b/apps/issues/base/redis-service.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: redis + namespace: issues +spec: + selector: + app: redis + ports: + - port: 6379 + targetPort: 6379 + protocol: TCP From 3b1878ca595316f3547c85cb265b6cca1e3a5f33 Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 3 Aug 2026 14:48:27 +0500 Subject: [PATCH 03/85] ++ --- apps/processing/base/engine-low.yaml | 2 +- apps/processing/base/engine.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/processing/base/engine-low.yaml b/apps/processing/base/engine-low.yaml index eaed6b5..842898d 100644 --- a/apps/processing/base/engine-low.yaml +++ b/apps/processing/base/engine-low.yaml @@ -165,7 +165,7 @@ spec: - name: INTERNAL_FILESTREAM_URL value: - _default: "http://documentations-filestream.documentations.svc.cluster.local:8080" + _default: "http://backend-filestream-svc.documentations.svc.cluster.local:80" - name: EXTERNAL_PDM_URL value: diff --git a/apps/processing/base/engine.yaml b/apps/processing/base/engine.yaml index 049437b..b2133bc 100644 --- a/apps/processing/base/engine.yaml +++ b/apps/processing/base/engine.yaml @@ -165,7 +165,7 @@ spec: - name: INTERNAL_FILESTREAM_URL value: - _default: "http://documentations-filestream.documentations.svc.cluster.local:8080" + _default: "http://backend-filestream-svc.documentations.svc.cluster.local:80" - name: EXTERNAL_PDM_URL value: From b84811a5b2b8e3349cd2475f2b9116e70bf23390 Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 3 Aug 2026 14:52:09 +0500 Subject: [PATCH 04/85] ++ --- apps/processing/base/engine-low.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/apps/processing/base/engine-low.yaml b/apps/processing/base/engine-low.yaml index 842898d..93123f5 100644 --- a/apps/processing/base/engine-low.yaml +++ b/apps/processing/base/engine-low.yaml @@ -166,7 +166,9 @@ spec: - name: INTERNAL_FILESTREAM_URL value: _default: "http://backend-filestream-svc.documentations.svc.cluster.local:80" - + - name: IGNORE_TAINTS_AND_NODE_SELECTOR + value: + _default: "true" - name: EXTERNAL_PDM_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" From 0dbe5dd0acec5419e0588be72c74e305907d8fa8 Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 3 Aug 2026 14:57:06 +0500 Subject: [PATCH 05/85] ++ --- apps/processing/base/engine-low.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/processing/base/engine-low.yaml b/apps/processing/base/engine-low.yaml index 93123f5..de487c9 100644 --- a/apps/processing/base/engine-low.yaml +++ b/apps/processing/base/engine-low.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_3ef5b462 + _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_a03d37da pullPolicy: _default: IfNotPresent From 55c9f573c309f5742aebd0f626bd6a73b3508934 Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 3 Aug 2026 15:30:37 +0500 Subject: [PATCH 06/85] ++ --- apps/iam/base/backend.yaml | 21 +++++++++++++++++-- apps/iam/base/kustomization.yaml | 1 + .../iam/base/zitadel-org-rules-configmap.yaml | 12 +++++++++++ apps/processing/base/engine-low.yaml | 3 ++- 4 files changed, 34 insertions(+), 3 deletions(-) create mode 100644 apps/iam/base/zitadel-org-rules-configmap.yaml diff --git a/apps/iam/base/backend.yaml b/apps/iam/base/backend.yaml index df0feef..024c62e 100644 --- a/apps/iam/base/backend.yaml +++ b/apps/iam/base/backend.yaml @@ -102,6 +102,23 @@ spec: name: _default: regcred + volumes: + _default: + - name: iam-zitadel-org-rules + mountPath: + _default: /config/zitadel/org-rules-prod.json + subPath: + _default: org-rules-prod.json + readOnly: + _default: true + configMap: + name: + _default: iam-zitadel-org-rules + items: + - key: org-rules-prod.json + path: + _default: org-rules-prod.json + labels: monitoring: prometheus @@ -132,11 +149,11 @@ spec: - name: ZITADEL_ENABLED value: - _default: "false" + _default: "true" - name: ZITADEL_HOST value: - _default: "https://login.sarex.io" + _default: "https://sarex-login.uralmine.com" - name: ZITADEL_ORG_RULES_FILE value: diff --git a/apps/iam/base/kustomization.yaml b/apps/iam/base/kustomization.yaml index d99dded..65128fb 100644 --- a/apps/iam/base/kustomization.yaml +++ b/apps/iam/base/kustomization.yaml @@ -5,3 +5,4 @@ namespace: iam resources: - namespace.yaml - backend.yaml + - zitadel-org-rules-configmap.yaml diff --git a/apps/iam/base/zitadel-org-rules-configmap.yaml b/apps/iam/base/zitadel-org-rules-configmap.yaml new file mode 100644 index 0000000..56bfc37 --- /dev/null +++ b/apps/iam/base/zitadel-org-rules-configmap.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: iam-zitadel-org-rules + namespace: iam +data: + org-rules-prod.json: | + { + "default_org_id": "383923292894987370", + "rules": [] + } diff --git a/apps/processing/base/engine-low.yaml b/apps/processing/base/engine-low.yaml index de487c9..76ad5bc 100644 --- a/apps/processing/base/engine-low.yaml +++ b/apps/processing/base/engine-low.yaml @@ -42,7 +42,8 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_a03d37da + _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_a03d37da-dirty + pullPolicy: _default: IfNotPresent From f55f25479a205e92bcbbd676ed3e4fb60622cbe6 Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 3 Aug 2026 15:46:41 +0500 Subject: [PATCH 07/85] ++ --- apps/processing/base/engine-low.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/processing/base/engine-low.yaml b/apps/processing/base/engine-low.yaml index 76ad5bc..6d68275 100644 --- a/apps/processing/base/engine-low.yaml +++ b/apps/processing/base/engine-low.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_a03d37da-dirty + _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_a03d37da-dirty2 pullPolicy: _default: IfNotPresent From 30f669ed141832358044ccfe001b3469b643ffab Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 3 Aug 2026 15:59:05 +0500 Subject: [PATCH 08/85] ++ --- apps/processing/base/engine-low.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/processing/base/engine-low.yaml b/apps/processing/base/engine-low.yaml index 6d68275..debd269 100644 --- a/apps/processing/base/engine-low.yaml +++ b/apps/processing/base/engine-low.yaml @@ -162,7 +162,7 @@ spec: - name: INTERNAL_PDM_URL value: - _default: "http://documentations-api.documentations.svc.cluster.local:8080" + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" - name: INTERNAL_FILESTREAM_URL value: @@ -172,15 +172,15 @@ spec: _default: "true" - name: EXTERNAL_PDM_URL value: - _default: "http://documentations-api.documentations.svc.cluster.local:8080" + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" - name: EXTERNAL_FILESTREAM_URL value: - _default: "http://documentations-filestream-service.documentations.svc.cluster.local:8080" + _default: "http://backend-filestream-svc.documentations.svc.cluster.local:80" - name: RESOURCES_API_INTERNAL_HOST value: - _default: "http://resources-service.resources.svc.cluster.local:8000" + _default: "http://iam-backend.iam.svc.cluster.local:8000" - name: ENABLE_SQL_QUERY value: From 48ec94afc9d8965e24def8eb7fe6a2ddeac7471a Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 3 Aug 2026 16:05:21 +0500 Subject: [PATCH 09/85] ++ --- apps/documentations/base/api.yaml | 2 +- apps/issues/base/production-configmap.yaml | 2 +- apps/transmittal/base/backend.yaml | 2 +- apps/transmittal/base/worker.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/documentations/base/api.yaml b/apps/documentations/base/api.yaml index 10657cd..07ec559 100644 --- a/apps/documentations/base/api.yaml +++ b/apps/documentations/base/api.yaml @@ -144,7 +144,7 @@ spec: _default: sarex.contour.infra.sarex.tech - name: DOCUMENTATION_URL value: - _default: http://documentations-api.documentations.svc.cluster.local:80/ + _default: http://backend-api-svc.documentations.svc.cluster.local:80/ - name: WORKFLOW_URL value: _default: http://backend-svc.processing.svc.cluster.local:80/ diff --git a/apps/issues/base/production-configmap.yaml b/apps/issues/base/production-configmap.yaml index aaca72c..012e486 100644 --- a/apps/issues/base/production-configmap.yaml +++ b/apps/issues/base/production-configmap.yaml @@ -46,7 +46,7 @@ data: WORKFLOWS_HOST = "http://workflows-api-service.workflow.svc.cluster.local:8000" WORKFLOWS_URL = "http://workflows-api-service.workflow.svc.cluster.local:8000" - DOCUMENTATIONS_URL = "http://documentations-api.documentations.svc.cluster.local:8080" + DOCUMENTATIONS_URL = "http://backend-api-svc.documentations.svc.cluster.local:80" RESOURCES_API_HOST = os.getenv("RESOURCES_API_HOST", default="http://resources-service.resources.svc.cluster:8000") KAFKA_HOST = "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093" KAFKA_USERNAME = "sarex" diff --git a/apps/transmittal/base/backend.yaml b/apps/transmittal/base/backend.yaml index fce07eb..bb6c535 100644 --- a/apps/transmittal/base/backend.yaml +++ b/apps/transmittal/base/backend.yaml @@ -253,7 +253,7 @@ spec: - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL value: - _default: "http://documentations-api.documentations.svc.cluster.local:8080" + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS value: diff --git a/apps/transmittal/base/worker.yaml b/apps/transmittal/base/worker.yaml index 82ce921..e70e209 100644 --- a/apps/transmittal/base/worker.yaml +++ b/apps/transmittal/base/worker.yaml @@ -238,7 +238,7 @@ spec: - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL value: - _default: "http://documentations-api.documentations.svc.cluster.local:8080" + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS value: From f8a16fe423603d9e1ae50ed26d4dcc1c9aaf44af Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 3 Aug 2026 16:32:47 +0500 Subject: [PATCH 10/85] ++ --- apps/iam/base/backend.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/apps/iam/base/backend.yaml b/apps/iam/base/backend.yaml index 024c62e..1c50e67 100644 --- a/apps/iam/base/backend.yaml +++ b/apps/iam/base/backend.yaml @@ -204,10 +204,10 @@ spec: {{- with secret "secrets/data/apps/iam/postgres" -}} DB_DSN=postgres://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@{{ index .Data.data "host" }}:{{ index .Data.data "port" }}/{{ index .Data.data "database" }} {{- end -}} - vault.hashicorp.com/agent-inject-secret-iam-zitadel: secrets/data/apps/iam/zitadel + vault.hashicorp.com/agent-inject-secret-iam-zitadel: secrets/data/vault/common/django_auth vault.hashicorp.com/agent-inject-template-iam-zitadel: |- - {{- with secret "secrets/data/apps/iam/zitadel" -}} - ZITADEL_ACCESS_TOKEN={{ index .Data.data "access_token" }} + {{- with secret "secrets/data/vault/common/django_auth" -}} + ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }} {{- end -}} vault.hashicorp.com/agent-inject-secret-iam-kafka: secrets/data/kafka/apps/iam vault.hashicorp.com/agent-inject-template-iam-kafka: |- From 8a0eee6538ffdab727aaad7d66980d94d9e00b69 Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 3 Aug 2026 20:41:38 +0500 Subject: [PATCH 11/85] ++ --- .../istio-ingress/certificate.yaml | 3 ++- .../camunda/d8-ugmk-prod/camunda.yaml | 10 ++++---- .../d8-ugmk-prod/istio-config.yaml | 24 +++++++++---------- 3 files changed, 19 insertions(+), 18 deletions(-) diff --git a/clusters/d8-ugmk-prod/istio-ingress/certificate.yaml b/clusters/d8-ugmk-prod/istio-ingress/certificate.yaml index d95d380..6fb5625 100644 --- a/clusters/d8-ugmk-prod/istio-ingress/certificate.yaml +++ b/clusters/d8-ugmk-prod/istio-ingress/certificate.yaml @@ -4,8 +4,9 @@ metadata: name: sarex-wildcard namespace: d8-ingress-istio spec: - commonName: "*.uralmine.com" + commonName: "*.sarex-k8s.uralmine.com" dnsNames: + - "*.sarex-k8s.uralmine.com" - "*.uralmine.com" issuerRef: group: cert-manager.io diff --git a/infrastructure/camunda/d8-ugmk-prod/camunda.yaml b/infrastructure/camunda/d8-ugmk-prod/camunda.yaml index 2601400..30d0764 100644 --- a/infrastructure/camunda/d8-ugmk-prod/camunda.yaml +++ b/infrastructure/camunda/d8-ugmk-prod/camunda.yaml @@ -164,15 +164,15 @@ spec: - name: regcred identity: auth: - publicIssuerUrl: "https://sarex-camunda-keycloak.uralmine.com/auth/realms/camunda-platform" + publicIssuerUrl: "https://camunda-keycloak.sarex-k8s.uralmine.com/auth/realms/camunda-platform" identity: - redirectUrl: "https://sarex-camunda-identity.uralmine.com" + redirectUrl: "https://camunda-identity.sarex-k8s.uralmine.com" operate: - redirectUrl: "https://sarex-camunda-operate.uralmine.com" + redirectUrl: "https://camunda-operate.sarex-k8s.uralmine.com" tasklist: - redirectUrl: "https://sarex-camunda-tasklist.uralmine.com" + redirectUrl: "https://camunda-tasklist.sarex-k8s.uralmine.com" optimize: - redirectUrl: "https://sarex-camunda-optimize.uralmine.com" + redirectUrl: "https://camunda-optimize.sarex-k8s.uralmine.com" webModeler: redirectUrl: "https://camunda-web-modeler.contour.infra.sarex.tech" console: diff --git a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml index f50c455..b181dd6 100644 --- a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml +++ b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml @@ -23,12 +23,12 @@ spec: - hosts: - sarex.uralmine.com - sarex-login.uralmine.com - - sarex-rabbitmq.uralmine.com - - sarex-camunda-keycloak.uralmine.com - - sarex-camunda-identity.uralmine.com - - sarex-camunda-operate.uralmine.com - - sarex-camunda-tasklist.uralmine.com - - sarex-camunda-optimize.uralmine.com + - rabbitmq.sarex-k8s.uralmine.com + - camunda-keycloak.sarex-k8s.uralmine.com + - camunda-identity.sarex-k8s.uralmine.com + - camunda-operate.sarex-k8s.uralmine.com + - camunda-tasklist.sarex-k8s.uralmine.com + - camunda-optimize.sarex-k8s.uralmine.com tls: credentialName: istio-ingress-tls virtualServices: @@ -383,7 +383,7 @@ spec: camunda-keycloak: namespace: default hosts: - - sarex-camunda-keycloak.uralmine.com + - camunda-keycloak.sarex-k8s.uralmine.com gateways: - default/platform-gateway routes: @@ -394,7 +394,7 @@ spec: camunda-identity: namespace: default hosts: - - sarex-camunda-identity.uralmine.com + - camunda-identity.sarex-k8s.uralmine.com gateways: - default/platform-gateway routes: @@ -405,7 +405,7 @@ spec: camunda-operate: namespace: default hosts: - - sarex-camunda-operate.uralmine.com + - camunda-operate.sarex-k8s.uralmine.com gateways: - default/platform-gateway routes: @@ -416,7 +416,7 @@ spec: camunda-tasklist: namespace: default hosts: - - sarex-camunda-tasklist.uralmine.com + - camunda-tasklist.sarex-k8s.uralmine.com gateways: - default/platform-gateway routes: @@ -427,7 +427,7 @@ spec: camunda-optimize: namespace: default hosts: - - sarex-camunda-optimize.uralmine.com + - camunda-optimize.sarex-k8s.uralmine.com gateways: - default/platform-gateway routes: @@ -438,7 +438,7 @@ spec: rabbitmq: namespace: default hosts: - - sarex-rabbitmq.uralmine.com + - rabbitmq.sarex-k8s.uralmine.com gateways: - default/platform-gateway routes: From fb765a9cf9d1448e0b2a228aeff217e35492c098 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 12:41:10 +0500 Subject: [PATCH 12/85] ++ --- .../d8-ugmk-prod/istio-config.yaml | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml index b181dd6..ef05722 100644 --- a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml +++ b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml @@ -29,6 +29,8 @@ spec: - camunda-operate.sarex-k8s.uralmine.com - camunda-tasklist.sarex-k8s.uralmine.com - camunda-optimize.sarex-k8s.uralmine.com + - sarex-stamp-verification.uralmine.com + - sarex-document-link.uralmine.com tls: credentialName: istio-ingress-tls virtualServices: @@ -457,3 +459,25 @@ spec: prefix: / service: zitadel-idp-contour.zitadel.svc.cluster.local port: 8080 + stamp-verification: + namespace: default + hosts: + - sarex-stamp-verification.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: / + service: frontend-service.stamp-verification.svc.cluster.local + port: 80 + document-link: + namespace: default + hosts: + - sarex-document-link.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: / + service: frontend-service.document-link.svc.cluster.local + port: 80 From 3d80c69ed1f5e7f7b9cef8544e57fc56f48b6b97 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 12:52:48 +0500 Subject: [PATCH 13/85] ++ --- apps/document-link/base/frontend.yaml | 4 ++-- apps/documentations/d8-ugmk-prod/api.yaml | 2 +- apps/documentations/d8-ugmk-prod/filestream.yaml | 2 +- apps/stamp-verification/base/frontend.yaml | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/apps/document-link/base/frontend.yaml b/apps/document-link/base/frontend.yaml index ad8222d..a03d2ee 100644 --- a/apps/document-link/base/frontend.yaml +++ b/apps/document-link/base/frontend.yaml @@ -50,7 +50,7 @@ spec: _default: 1 port: - _default: 80 + _default: 3000 resources: requests: @@ -78,7 +78,7 @@ spec: _default: 80 targetPort: - _default: 80 + _default: 3000 portName: _default: http diff --git a/apps/documentations/d8-ugmk-prod/api.yaml b/apps/documentations/d8-ugmk-prod/api.yaml index 5b2e0ff..902efce 100644 --- a/apps/documentations/d8-ugmk-prod/api.yaml +++ b/apps/documentations/d8-ugmk-prod/api.yaml @@ -95,7 +95,7 @@ spec: _default: http://marks-service:8000 - name: PUBLIC_LINK_HOST value: - _default: https://document-link-srx.wb.ru + _default: https://sarex-document-link.uralmine.com - name: NAMESPACE value: _default: documentations diff --git a/apps/documentations/d8-ugmk-prod/filestream.yaml b/apps/documentations/d8-ugmk-prod/filestream.yaml index a9ecae9..3136817 100644 --- a/apps/documentations/d8-ugmk-prod/filestream.yaml +++ b/apps/documentations/d8-ugmk-prod/filestream.yaml @@ -92,7 +92,7 @@ spec: _default: http://marks-service:8000 - name: PUBLIC_LINK_HOST value: - _default: https://document-link-srx.wb.ru + _default: https://sarex-document-link.uralmine.com - name: NAMESPACE value: _default: documentations diff --git a/apps/stamp-verification/base/frontend.yaml b/apps/stamp-verification/base/frontend.yaml index 48c11dd..2160634 100644 --- a/apps/stamp-verification/base/frontend.yaml +++ b/apps/stamp-verification/base/frontend.yaml @@ -50,7 +50,7 @@ spec: _default: 1 port: - _default: 80 + _default: 8080 resources: requests: @@ -78,7 +78,7 @@ spec: _default: 80 targetPort: - _default: 80 + _default: 8080 portName: _default: http From 311abec0403262dc7cde7533943139065d343d75 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 13:08:37 +0500 Subject: [PATCH 14/85] ++ --- apps/document-link/base/frontend.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/document-link/base/frontend.yaml b/apps/document-link/base/frontend.yaml index a03d2ee..54f3d89 100644 --- a/apps/document-link/base/frontend.yaml +++ b/apps/document-link/base/frontend.yaml @@ -36,7 +36,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:wb_cb2027ce + _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:contour_d8c3481b pullPolicy: _default: IfNotPresent From ebe1bbfd0891e3a03e532bbdd06700d796856e76 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 13:19:31 +0500 Subject: [PATCH 15/85] ++ --- .../d8-ugmk-prod/istio-config.yaml | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml index ef05722..557fb03 100644 --- a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml +++ b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml @@ -481,3 +481,33 @@ spec: prefix: / service: frontend-service.document-link.svc.cluster.local port: 80 + envoyFilters: + cors-uralmine: + namespace: istio-system + workloadSelector: + labels: + istio.deckhouse.io/ingress-gateway-class: istio + configPatches: + - applyTo: HTTP_FILTER + match: + context: GATEWAY + listener: + filterChain: + filter: + name: envoy.filters.network.http_connection_manager + subFilter: + name: envoy.filters.http.router + patch: + operation: INSERT_BEFORE + value: + name: envoy.filters.http.cors + typed_config: + '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors + cors: + allow_credentials: true + allow_headers: "Authorization,Content-Type" + allow_methods: "GET,POST,PUT,PATCH,DELETE,OPTIONS" + allow_origin_string_match: + - safe_regex: + regex: https://.*\.uralmine\.com + max_age: "86400" From 0c04c357dc6b9b2fd7537eee9fd04d9fe52656cb Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 13:29:50 +0500 Subject: [PATCH 16/85] ++ --- apps/document-link/base/frontend.yaml | 2 +- .../d8-ugmk-prod/istio-config.yaml | 43 ++++++------------- 2 files changed, 14 insertions(+), 31 deletions(-) diff --git a/apps/document-link/base/frontend.yaml b/apps/document-link/base/frontend.yaml index 54f3d89..20255c1 100644 --- a/apps/document-link/base/frontend.yaml +++ b/apps/document-link/base/frontend.yaml @@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: frontend - namespace: document-link + namespace: spec: interval: 10m diff --git a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml index 557fb03..d255397 100644 --- a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml +++ b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml @@ -217,6 +217,19 @@ spec: rewrite: / service: frontend-svc.issues.svc.cluster.local port: 80 + remarks-frontend: + name: remarks-frontend-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /remarks/static/ + rewrite: / + service: frontend-service.remarks.svc.cluster.local + port: 80 auth-frontend: name: auth-frontend-virt-service namespace: default @@ -481,33 +494,3 @@ spec: prefix: / service: frontend-service.document-link.svc.cluster.local port: 80 - envoyFilters: - cors-uralmine: - namespace: istio-system - workloadSelector: - labels: - istio.deckhouse.io/ingress-gateway-class: istio - configPatches: - - applyTo: HTTP_FILTER - match: - context: GATEWAY - listener: - filterChain: - filter: - name: envoy.filters.network.http_connection_manager - subFilter: - name: envoy.filters.http.router - patch: - operation: INSERT_BEFORE - value: - name: envoy.filters.http.cors - typed_config: - '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors - cors: - allow_credentials: true - allow_headers: "Authorization,Content-Type" - allow_methods: "GET,POST,PUT,PATCH,DELETE,OPTIONS" - allow_origin_string_match: - - safe_regex: - regex: https://.*\.uralmine\.com - max_age: "86400" From a076995f3afbf867e7cafee72ed17c9d5891edeb Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 13:37:51 +0500 Subject: [PATCH 17/85] ++ --- apps/django/base/nginx-configmap.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/apps/django/base/nginx-configmap.yaml b/apps/django/base/nginx-configmap.yaml index 4080296..2f02662 100644 --- a/apps/django/base/nginx-configmap.yaml +++ b/apps/django/base/nginx-configmap.yaml @@ -70,11 +70,11 @@ data: proxy_pass http://backend-svc.pm.svc.cluster.local:8000; } - # location ~^/api/v1/documents/ { - # #rewrite /api/(.+) /$1 break; - # proxy_set_header Host $host; - # proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80; - # } + location ~^/api/v1/documents/ { + #rewrite /api/(.+) /$1 break; + proxy_set_header Host $host; + proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80; + } location ~^/(api|admin)/ { proxy_http_version 1.1; From c5ca007f03f60c0e883d78c737139bd04ca926b8 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 13:42:34 +0500 Subject: [PATCH 18/85] ++ --- apps/django/base/nginx-configmap.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/apps/django/base/nginx-configmap.yaml b/apps/django/base/nginx-configmap.yaml index 2f02662..97a9b33 100644 --- a/apps/django/base/nginx-configmap.yaml +++ b/apps/django/base/nginx-configmap.yaml @@ -71,6 +71,7 @@ data: } location ~^/api/v1/documents/ { + proxy_http_version 1.1; #rewrite /api/(.+) /$1 break; proxy_set_header Host $host; proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80; From 0703f6a7ea4871321840c68eeeee813024a715f8 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 14:07:53 +0500 Subject: [PATCH 19/85] ++ --- apps/checklists/base/helmrelease.yaml | 2 +- .../istio-config/d8-ugmk-prod/istio-config.yaml | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/apps/checklists/base/helmrelease.yaml b/apps/checklists/base/helmrelease.yaml index f4fb2cd..9087b32 100644 --- a/apps/checklists/base/helmrelease.yaml +++ b/apps/checklists/base/helmrelease.yaml @@ -64,7 +64,7 @@ spec: service: enabled: true name: - _default: rfi-backend-api-svc + _default: backend-svc type: _default: ClusterIP port: diff --git a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml index d255397..07c0915 100644 --- a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml +++ b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml @@ -191,6 +191,19 @@ spec: rewrite: /api/ service: backend-svc.issues.svc.cluster.local port: 80 + checklists-api: + name: checklists-api-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /checklists/api/ + rewrite: /api/ + service: backend-svc.checklists.svc.cluster.local + port: 80 flows-api: name: flows-api-virt-service namespace: default From 9c892604fb0cdc3e1c8ccbbfa7b720d03f86703a Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 14:18:35 +0500 Subject: [PATCH 20/85] ++ --- apps/django/base/nginx-configmap.yaml | 46 +++++++++++++++++++++++++-- 1 file changed, 44 insertions(+), 2 deletions(-) diff --git a/apps/django/base/nginx-configmap.yaml b/apps/django/base/nginx-configmap.yaml index 97a9b33..5fb667c 100644 --- a/apps/django/base/nginx-configmap.yaml +++ b/apps/django/base/nginx-configmap.yaml @@ -62,6 +62,7 @@ data: if_modified_since off; expires off; } + location ~^/api/pm/ { #rewrite /api/(.+) /$1 break; proxy_http_version 1.1; @@ -84,13 +85,54 @@ data: proxy_pass http://backend-svc.django.svc.cluster.local:80; } - location ~^/workspaces-v2/(.+).js { + + location = /static/pdf-runtime/assets/mupdf-wasm.wasm { + alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm; + add_header Content-Type application/wasm always; + add_header Cache-Control "public, max-age=31536000, immutable" always; + add_header Access-Control-Allow-Origin "*" always; + add_header Access-Control-Allow-Methods "GET, OPTIONS" always; + add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; + } + + location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js { + alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js; + add_header Content-Type application/javascript always; + add_header Cache-Control "public, max-age=31536000, immutable" always; + add_header Access-Control-Allow-Origin "*" always; + add_header Access-Control-Allow-Methods "GET, OPTIONS" always; + add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; + } + + location = /workspaces-v2/worker/mupdf.worker-3.3.9.js { + alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js; + add_header Content-Type application/javascript always; + add_header Cache-Control "public, max-age=31536000, immutable" always; + add_header Access-Control-Allow-Origin "*" always; + add_header Access-Control-Allow-Methods "GET, OPTIONS" always; + add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; + } + + location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js { + alias /opt/react_client/static/viewer-pdf/mupdf.js; + add_header Content-Type application/javascript always; + add_header Cache-Control "public, max-age=31536000, immutable" always; + add_header Access-Control-Allow-Origin "*" always; + add_header Access-Control-Allow-Methods "GET, OPTIONS" always; + add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; + } + + location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm { + add_header Content-Type application/wasm always; + alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm; + } + + location ~^/workspaces-v2/(.+).js { proxy_http_version 1.1; proxy_set_header Connection ""; rewrite /workspaces-v2/(.+) /$1 break; proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; } - location ~^/workspaces-v2/(.+)\.wasm$ { proxy_http_version 1.1; From a9ec189e918ed41d24cdbe951c3d745ce3680f3e Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 14:30:09 +0500 Subject: [PATCH 21/85] ++ --- apps/documentations/d8-ugmk-prod/api.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/documentations/d8-ugmk-prod/api.yaml b/apps/documentations/d8-ugmk-prod/api.yaml index 902efce..e15cd14 100644 --- a/apps/documentations/d8-ugmk-prod/api.yaml +++ b/apps/documentations/d8-ugmk-prod/api.yaml @@ -68,7 +68,7 @@ spec: _default: sarex.uralmine.com - name: DOCUMENTATION_URL value: - _default: http://documentations-api.documentations.svc.cluster.local:80/ + _default: http://backend-api-svc.documentations.svc.cluster.local:80/ - name: WORKFLOW_URL value: _default: http://backend-svc.processing.svc.cluster.local:80/ From 27327f2c9c63e9366e60c215a73d1724c55831d0 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 14:36:19 +0500 Subject: [PATCH 22/85] ++ --- .../istio-config/d8-ugmk-prod/istio-config.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml index 07c0915..45ead2a 100644 --- a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml +++ b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml @@ -204,6 +204,19 @@ spec: rewrite: /api/ service: backend-svc.checklists.svc.cluster.local port: 80 + bim-api: + name: bim-api-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /bimv2/api/ + rewrite: /api/ + service: backend-svc.bim.svc.cluster.local + port: 80 flows-api: name: flows-api-virt-service namespace: default From a8a4f5e50de47ab5c11069d9b1cff888b0b45593 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 18:33:39 +0500 Subject: [PATCH 23/85] ++ --- apps/attachments/base/helmrelease.yaml | 2 +- apps/attachments/d8-ugmk-prod/patch.yaml | 22 +- apps/iam/d8-ugmk-prod/backend-s3.yaml | 78 ++++++ apps/iam/d8-ugmk-prod/kustomization.yaml | 7 +- apps/issues/d8-ugmk-prod/backend-s3.yaml | 20 ++ apps/issues/d8-ugmk-prod/celery-s3.yaml | 20 ++ apps/issues/d8-ugmk-prod/kustomization.yaml | 8 + apps/rfi/d8-ugmk-prod/backend-s3.yaml | 20 ++ apps/rfi/d8-ugmk-prod/celery-s3.yaml | 20 ++ apps/rfi/d8-ugmk-prod/kustomization.yaml | 8 + apps/transmittal/d8-ugmk-prod/backend-s3.yaml | 256 ++++++++++++++++++ .../d8-ugmk-prod/kustomization.yaml | 8 + apps/transmittal/d8-ugmk-prod/worker-s3.yaml | 256 ++++++++++++++++++ 13 files changed, 712 insertions(+), 13 deletions(-) create mode 100644 apps/iam/d8-ugmk-prod/backend-s3.yaml create mode 100644 apps/issues/d8-ugmk-prod/backend-s3.yaml create mode 100644 apps/issues/d8-ugmk-prod/celery-s3.yaml create mode 100644 apps/rfi/d8-ugmk-prod/backend-s3.yaml create mode 100644 apps/rfi/d8-ugmk-prod/celery-s3.yaml create mode 100644 apps/transmittal/d8-ugmk-prod/backend-s3.yaml create mode 100644 apps/transmittal/d8-ugmk-prod/worker-s3.yaml diff --git a/apps/attachments/base/helmrelease.yaml b/apps/attachments/base/helmrelease.yaml index aee5f94..5fc7d68 100644 --- a/apps/attachments/base/helmrelease.yaml +++ b/apps/attachments/base/helmrelease.yaml @@ -103,7 +103,7 @@ spec: YANDEX_S3_ENDPOINT_URL=minio.minio:9000 YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - YANDEX_S3_USE_SSL=false + YANDEX_S3_USE_SSL=true YANDEX_S3_REGION=ru-central YANDEX_S3_VERIFY=false BUCKET_NAME=attachments diff --git a/apps/attachments/d8-ugmk-prod/patch.yaml b/apps/attachments/d8-ugmk-prod/patch.yaml index ad66013..78b2d70 100644 --- a/apps/attachments/d8-ugmk-prod/patch.yaml +++ b/apps/attachments/d8-ugmk-prod/patch.yaml @@ -22,14 +22,14 @@ spec: DATABASE_PASSWORD={{ index .Data.data "password" }} DATABASE_SSL_MODE=disable {{- end -}} -# vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments -# vault.hashicorp.com/agent-inject-template-attachments-s3: |- -# {{- with secret "secrets/data/minio/apps/attachments" -}} -# YANDEX_S3_ENDPOINT_URL=minio.minio:9000 -# YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} -# YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} -# YANDEX_S3_USE_SSL=false -# YANDEX_S3_REGION=ru-central -# YANDEX_S3_VERIFY=false -# BUCKET_NAME=attachments -# {{- end -}} + vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments + vault.hashicorp.com/agent-inject-template-attachments-s3: |- + {{- with secret "secrets/data/minio/apps/attachments" -}} + YANDEX_S3_ENDPOINT_URL=s3.uralmine.com + YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YANDEX_S3_USE_SSL=true + YANDEX_S3_REGION=ru-central + YANDEX_S3_VERIFY=false + BUCKET_NAME=sarex-attachments-storage + {{- end -}} diff --git a/apps/iam/d8-ugmk-prod/backend-s3.yaml b/apps/iam/d8-ugmk-prod/backend-s3.yaml new file mode 100644 index 0000000..f959181 --- /dev/null +++ b/apps/iam/d8-ugmk-prod/backend-s3.yaml @@ -0,0 +1,78 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: iam-backend + namespace: iam +spec: + values: + services: + backend: + envs: + - name: ENVIRONMENT + value: + _default: "prod" + + - name: LOG_LEVEL + value: + _default: "debug" + + - name: AUTH_ENABLED + value: + _default: "true" + + - name: HTTP_PORT + value: + _default: "8080" + + - name: HTTP_READ_BUFFER_SIZE + value: + _default: "131072" + + - name: DB_MIGRATIONS_PATH + value: + _default: "migrations" + + - name: ZITADEL_ENABLED + value: + _default: "true" + + - name: ZITADEL_HOST + value: + _default: "https://sarex-login.uralmine.com" + + - name: ZITADEL_ORG_RULES_FILE + value: + _default: "config/zitadel/org-rules-prod.json" + + - name: S3_ENABLED + value: + _default: "true" + + - name: S3_ENDPOINT_URL + value: + _default: "https://s3.uralmine.com" + + - name: S3_BUCKET_NAME + value: + _default: "sarex-media-storage" + + - name: S3_REGION + value: + _default: "ru-central1" + + - name: S3_PRESIGN_EXPIRES + value: + _default: "1h" + + - name: KAFKA_ENABLED + value: + _default: "false" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/etc/ca-certificates/Yandex/ca-cert" + + - name: KAFKA_TOPIC_LEGACY_AMS_SYNC + value: + _default: "ams-sync" diff --git a/apps/iam/d8-ugmk-prod/kustomization.yaml b/apps/iam/d8-ugmk-prod/kustomization.yaml index d412d5c..e9b4313 100644 --- a/apps/iam/d8-ugmk-prod/kustomization.yaml +++ b/apps/iam/d8-ugmk-prod/kustomization.yaml @@ -3,4 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: iam resources: - - ../base \ No newline at end of file + - ../base +patches: + - path: backend-s3.yaml + target: + kind: HelmRelease + name: iam-backend \ No newline at end of file diff --git a/apps/issues/d8-ugmk-prod/backend-s3.yaml b/apps/issues/d8-ugmk-prod/backend-s3.yaml new file mode 100644 index 0000000..4c56193 --- /dev/null +++ b/apps/issues/d8-ugmk-prod/backend-s3.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: issues +spec: + values: + services: + backend: + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=sarex-issues + YC_S3_ENDPOINT_URL=https://s3.uralmine.com + {{- end -}} diff --git a/apps/issues/d8-ugmk-prod/celery-s3.yaml b/apps/issues/d8-ugmk-prod/celery-s3.yaml new file mode 100644 index 0000000..9ab021a --- /dev/null +++ b/apps/issues/d8-ugmk-prod/celery-s3.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: issues +spec: + values: + services: + celery: + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=sarex-issues + YC_S3_ENDPOINT_URL=https://s3.uralmine.com + {{- end -}} diff --git a/apps/issues/d8-ugmk-prod/kustomization.yaml b/apps/issues/d8-ugmk-prod/kustomization.yaml index b64e558..a4cf8c2 100644 --- a/apps/issues/d8-ugmk-prod/kustomization.yaml +++ b/apps/issues/d8-ugmk-prod/kustomization.yaml @@ -8,3 +8,11 @@ patches: target: kind: Namespace name: issues + - path: backend-s3.yaml + target: + kind: HelmRelease + name: backend + - path: celery-s3.yaml + target: + kind: HelmRelease + name: celery diff --git a/apps/rfi/d8-ugmk-prod/backend-s3.yaml b/apps/rfi/d8-ugmk-prod/backend-s3.yaml new file mode 100644 index 0000000..92a66d2 --- /dev/null +++ b/apps/rfi/d8-ugmk-prod/backend-s3.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: rfi +spec: + values: + services: + backend: + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi + vault.hashicorp.com/agent-inject-template-rfi-s3: |- + {{- with secret "secrets/data/minio/apps/rfi" -}} + YC_S3_ENDPOINT_URL=https://s3.uralmine.com + YC_S3_BUCKET_NAME=sarex-rfi + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} diff --git a/apps/rfi/d8-ugmk-prod/celery-s3.yaml b/apps/rfi/d8-ugmk-prod/celery-s3.yaml new file mode 100644 index 0000000..5f6b485 --- /dev/null +++ b/apps/rfi/d8-ugmk-prod/celery-s3.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: rfi +spec: + values: + services: + celery: + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi + vault.hashicorp.com/agent-inject-template-rfi-s3: |- + {{- with secret "secrets/data/minio/apps/rfi" -}} + YC_S3_ENDPOINT_URL=https://s3.uralmine.com + YC_S3_BUCKET_NAME=sarex-rfi + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} diff --git a/apps/rfi/d8-ugmk-prod/kustomization.yaml b/apps/rfi/d8-ugmk-prod/kustomization.yaml index 51bc006..b52cf82 100644 --- a/apps/rfi/d8-ugmk-prod/kustomization.yaml +++ b/apps/rfi/d8-ugmk-prod/kustomization.yaml @@ -9,3 +9,11 @@ patches: target: kind: HelmRelease name: frontend + - path: backend-s3.yaml + target: + kind: HelmRelease + name: backend + - path: celery-s3.yaml + target: + kind: HelmRelease + name: celery diff --git a/apps/transmittal/d8-ugmk-prod/backend-s3.yaml b/apps/transmittal/d8-ugmk-prod/backend-s3.yaml new file mode 100644 index 0000000..8d556c4 --- /dev/null +++ b/apps/transmittal/d8-ugmk-prod/backend-s3.yaml @@ -0,0 +1,256 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: transmittal +spec: + values: + services: + backend: + envs: + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://sarex.contour.infra.sarex.tech/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "s3.uralmine.com" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.documentations.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-transmittal-s3: secrets/data/minio/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-s3: |- + {{- with secret "secrets/data/minio/apps/transmittal" -}} + TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY={{ index .Data.data "access_key" }} + TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY={{ index .Data.data "secret_key" }} + TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET=sarex-tf-state + {{- end -}} diff --git a/apps/transmittal/d8-ugmk-prod/kustomization.yaml b/apps/transmittal/d8-ugmk-prod/kustomization.yaml index eed0fa0..c5c2c5b 100644 --- a/apps/transmittal/d8-ugmk-prod/kustomization.yaml +++ b/apps/transmittal/d8-ugmk-prod/kustomization.yaml @@ -8,3 +8,11 @@ patches: target: kind: Namespace name: transmittal + - path: backend-s3.yaml + target: + kind: HelmRelease + name: backend + - path: worker-s3.yaml + target: + kind: HelmRelease + name: worker diff --git a/apps/transmittal/d8-ugmk-prod/worker-s3.yaml b/apps/transmittal/d8-ugmk-prod/worker-s3.yaml new file mode 100644 index 0000000..7840397 --- /dev/null +++ b/apps/transmittal/d8-ugmk-prod/worker-s3.yaml @@ -0,0 +1,256 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: worker + namespace: transmittal +spec: + values: + services: + worker: + envs: + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://lk.srx.wb.ru:30443/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "s3.uralmine.com" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.documentations.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-transmittal-s3: secrets/data/minio/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-s3: |- + {{- with secret "secrets/data/minio/apps/transmittal" -}} + TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY={{ index .Data.data "access_key" }} + TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY={{ index .Data.data "secret_key" }} + TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET=sarex-tf-state + {{- end -}} From 1e1280d74e56f7cc627713ddab73b6533d08aab6 Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 18:54:52 +0500 Subject: [PATCH 24/85] ++ --- apps/pm/base/kustomization.yaml | 1 + apps/pm/base/resources-static.yaml | 90 +++++++++++++++++++ .../d8-ugmk-prod/istio-config.yaml | 13 +++ 3 files changed, 104 insertions(+) create mode 100644 apps/pm/base/resources-static.yaml diff --git a/apps/pm/base/kustomization.yaml b/apps/pm/base/kustomization.yaml index aa00f14..fbd18cd 100644 --- a/apps/pm/base/kustomization.yaml +++ b/apps/pm/base/kustomization.yaml @@ -8,3 +8,4 @@ resources: - celery.yaml - frontend.yaml - backend-configmap.yaml + - resources-static.yaml diff --git a/apps/pm/base/resources-static.yaml b/apps/pm/base/resources-static.yaml new file mode 100644 index 0000000..7d611be --- /dev/null +++ b/apps/pm/base/resources-static.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: resources-static + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + resources-static: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/resources-frontend:ugok_7f38a9ce + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: resources-static + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: resources-static-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml index 45ead2a..8098569 100644 --- a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml +++ b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml @@ -256,6 +256,19 @@ spec: rewrite: / service: frontend-service.remarks.svc.cluster.local port: 80 + resources-frontend: + name: resources-frontend-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /resources/static/ + rewrite: / + service: resources-static-svc.pm.svc.cluster.local + port: 80 auth-frontend: name: auth-frontend-virt-service namespace: default From 16477cc6fd262cf138562cb5d0864c7056c6ae5e Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 18:56:41 +0500 Subject: [PATCH 25/85] ++ --- apps/attachments/base/helmrelease.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/attachments/base/helmrelease.yaml b/apps/attachments/base/helmrelease.yaml index 5fc7d68..cfa6a62 100644 --- a/apps/attachments/base/helmrelease.yaml +++ b/apps/attachments/base/helmrelease.yaml @@ -52,7 +52,7 @@ spec: exec /opt/attachments/entrypoint.sh image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:feature_6238c882 + _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev pullPolicy: _default: IfNotPresent service: From 3bb9514f1ef603b70e9fd9a07f6401837edfd61f Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 4 Aug 2026 19:22:37 +0500 Subject: [PATCH 26/85] ++ --- apps/attachments/base/helmrelease.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/apps/attachments/base/helmrelease.yaml b/apps/attachments/base/helmrelease.yaml index cfa6a62..de00e85 100644 --- a/apps/attachments/base/helmrelease.yaml +++ b/apps/attachments/base/helmrelease.yaml @@ -49,6 +49,15 @@ spec: [ -f /vault/secrets/attachments-db ] && . /vault/secrets/attachments-db [ -f /vault/secrets/attachments-s3 ] && . /vault/secrets/attachments-s3 set +a + mkdir -p /etc/sarex/yc-s3-storage + cat > /etc/sarex/yc-s3-storage/yc-s3-service-account.json < Date: Tue, 4 Aug 2026 22:34:42 +0300 Subject: [PATCH 27/85] Migrate Istio and Vault configurations to separate `yc-ecp` infrastructure directories with updated HelmRelease and Kustomization files. --- .../yc-ecp/infrastructure/gitea-istio.yaml | 57 -------------- .../yc-ecp/infrastructure/kustomization.yaml | 14 ---- .../yc-ecp/infrastructure/vault-istio.yaml | 57 -------------- clusters/yc-ecp/kustomization.yaml | 5 +- .../istio-config/yc-ecp/istio-config.yaml | 77 +++++++++++++++++++ .../istio-config/yc-ecp/kustomization.yaml | 6 ++ .../vault/yc-ecp/kustomization.yaml | 6 ++ .../vault/yc-ecp}/vault.yaml | 0 8 files changed, 93 insertions(+), 129 deletions(-) delete mode 100644 clusters/yc-ecp/infrastructure/gitea-istio.yaml delete mode 100644 clusters/yc-ecp/infrastructure/kustomization.yaml delete mode 100644 clusters/yc-ecp/infrastructure/vault-istio.yaml create mode 100644 infrastructure/istio-config/yc-ecp/istio-config.yaml create mode 100644 infrastructure/istio-config/yc-ecp/kustomization.yaml create mode 100644 infrastructure/vault/yc-ecp/kustomization.yaml rename {clusters/yc-ecp/infrastructure/patches => infrastructure/vault/yc-ecp}/vault.yaml (100%) diff --git a/clusters/yc-ecp/infrastructure/gitea-istio.yaml b/clusters/yc-ecp/infrastructure/gitea-istio.yaml deleted file mode 100644 index 70397ab..0000000 --- a/clusters/yc-ecp/infrastructure/gitea-istio.yaml +++ /dev/null @@ -1,57 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: gitea-cert - namespace: istio-system -spec: - dnsNames: - - gitea.invest.cps.sarex.lonsdaleites.ru - issuerRef: - kind: ClusterIssuer - name: letsencrypt-prod - secretName: gitea-tls-secret ---- -apiVersion: networking.istio.io/v1beta1 -kind: Gateway -metadata: - name: gitea-gateway - namespace: gateway -spec: - selector: - istio: ingressgateway - servers: - - hosts: - - gitea.invest.cps.sarex.lonsdaleites.ru - port: - name: http - number: 80 - protocol: HTTP - - hosts: - - gitea.invest.cps.sarex.lonsdaleites.ru - port: - name: https - number: 443 - protocol: HTTPS - tls: - credentialName: gitea-tls-secret - mode: SIMPLE ---- -apiVersion: networking.istio.io/v1beta1 -kind: VirtualService -metadata: - name: gitea-virt-service - namespace: gitea -spec: - gateways: - - gateway/gitea-gateway - hosts: - - gitea.invest.cps.sarex.lonsdaleites.ru - http: - - match: - - uri: - prefix: / - route: - - destination: - host: gitea - port: - number: 3000 diff --git a/clusters/yc-ecp/infrastructure/kustomization.yaml b/clusters/yc-ecp/infrastructure/kustomization.yaml deleted file mode 100644 index 63b7b6b..0000000 --- a/clusters/yc-ecp/infrastructure/kustomization.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ../../../infrastructure/vault - - ./gitea-istio.yaml - - ./vault-istio.yaml -patches: - - path: ./patches/vault.yaml - target: - group: helm.toolkit.fluxcd.io - version: v2 - kind: HelmRelease - name: vault - namespace: vault diff --git a/clusters/yc-ecp/infrastructure/vault-istio.yaml b/clusters/yc-ecp/infrastructure/vault-istio.yaml deleted file mode 100644 index 37d6d6e..0000000 --- a/clusters/yc-ecp/infrastructure/vault-istio.yaml +++ /dev/null @@ -1,57 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: vault-cert - namespace: istio-system -spec: - dnsNames: - - vault.invest.cps.sarex.lonsdaleites.ru - issuerRef: - kind: ClusterIssuer - name: letsencrypt-prod - secretName: vault-tls ---- -apiVersion: networking.istio.io/v1beta1 -kind: Gateway -metadata: - name: vault-gateway - namespace: gateway -spec: - selector: - istio: ingressgateway - servers: - - hosts: - - vault.invest.cps.sarex.lonsdaleites.ru - port: - name: http - number: 80 - protocol: HTTP - - hosts: - - vault.invest.cps.sarex.lonsdaleites.ru - port: - name: https - number: 443 - protocol: HTTPS - tls: - credentialName: vault-tls - mode: SIMPLE ---- -apiVersion: networking.istio.io/v1beta1 -kind: VirtualService -metadata: - name: vault-virt-service - namespace: vault -spec: - gateways: - - gateway/vault-gateway - hosts: - - vault.invest.cps.sarex.lonsdaleites.ru - http: - - match: - - uri: - prefix: / - route: - - destination: - host: vault-vault-contour.vault.svc.cluster.local - port: - number: 8200 diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml index a8384a3..139913c 100644 --- a/clusters/yc-ecp/kustomization.yaml +++ b/clusters/yc-ecp/kustomization.yaml @@ -3,4 +3,7 @@ kind: Kustomization resources: - ./flux-system - ./helm-repositories.yaml - - ./infrastructure + +# infrastructure + - ../../infrastructure/istio-config/yc-ecp + - ../../infrastructure/vault/yc-ecp diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml new file mode 100644 index 0000000..1810ac9 --- /dev/null +++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml @@ -0,0 +1,77 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: istio-config + namespace: default +spec: + # istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod/ingressgateway + # в кластере нет — с зависимостями из base релиз никогда не станет Ready + dependsOn: [] + interval: 5m + timeout: 10m + values: + global: + env: yc-ecp + environments: + yc-ecp: + namespaces: [] + certManager: + clusterIssuers: {} + certificates: + gitea-tls-secret: + namespace: istio-system + dnsNames: + - gitea.invest.cps.sarex.lonsdaleites.ru + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer + vault-tls: + namespace: istio-system + dnsNames: + - vault.invest.cps.sarex.lonsdaleites.ru + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer + istio: + gateways: + gitea: + name: gitea-gateway + namespace: gateway + servers: + - hosts: + - gitea.invest.cps.sarex.lonsdaleites.ru + tls: + credentialName: gitea-tls-secret + vault: + name: vault-gateway + namespace: gateway + servers: + - hosts: + - vault.invest.cps.sarex.lonsdaleites.ru + tls: + credentialName: vault-tls + virtualServices: + gitea: + name: gitea-virt-service + namespace: gitea + hosts: + - gitea.invest.cps.sarex.lonsdaleites.ru + gateways: + - gateway/gitea-gateway + routes: + - path: + prefix: / + service: gitea.gitea.svc.cluster.local + port: 3000 + vault: + name: vault-virt-service + namespace: vault + hosts: + - vault.invest.cps.sarex.lonsdaleites.ru + gateways: + - gateway/vault-gateway + routes: + - path: + prefix: / + service: vault-vault-contour.vault.svc.cluster.local + port: 8200 diff --git a/infrastructure/istio-config/yc-ecp/kustomization.yaml b/infrastructure/istio-config/yc-ecp/kustomization.yaml new file mode 100644 index 0000000..894c51a --- /dev/null +++ b/infrastructure/istio-config/yc-ecp/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: istio-config.yaml diff --git a/infrastructure/vault/yc-ecp/kustomization.yaml b/infrastructure/vault/yc-ecp/kustomization.yaml new file mode 100644 index 0000000..dd86ecb --- /dev/null +++ b/infrastructure/vault/yc-ecp/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: vault.yaml diff --git a/clusters/yc-ecp/infrastructure/patches/vault.yaml b/infrastructure/vault/yc-ecp/vault.yaml similarity index 100% rename from clusters/yc-ecp/infrastructure/patches/vault.yaml rename to infrastructure/vault/yc-ecp/vault.yaml From c4e6c079f7f1b1d7e6474b786b0557999aafc53b Mon Sep 17 00:00:00 2001 From: emelinda Date: Tue, 4 Aug 2026 22:53:59 +0300 Subject: [PATCH 28/85] Migrate cert-manager configuration to `yc-ecp` infrastructure directory with updated HelmRelease, ClusterIssuer, and Kustomization files. --- clusters/yc-ecp/kustomization.yaml | 1 + .../cert-manager/yc-ecp/cert-manager.yaml | 12 ++++++++++++ .../yc-ecp/clusterissuer-letsencrypt-delete.yaml | 5 +++++ .../clusterissuer-letsencrypt-istio-delete.yaml | 5 +++++ .../yc-ecp/clusterissuer-letsencrypt-prod.yaml | 14 ++++++++++++++ .../cert-manager/yc-ecp/kustomization.yaml | 10 ++++++++++ 6 files changed, 47 insertions(+) create mode 100644 infrastructure/cert-manager/yc-ecp/cert-manager.yaml create mode 100644 infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml create mode 100644 infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml create mode 100644 infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml create mode 100644 infrastructure/cert-manager/yc-ecp/kustomization.yaml diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml index 139913c..3bb515f 100644 --- a/clusters/yc-ecp/kustomization.yaml +++ b/clusters/yc-ecp/kustomization.yaml @@ -5,5 +5,6 @@ resources: - ./helm-repositories.yaml # infrastructure + - ../../infrastructure/cert-manager/yc-ecp - ../../infrastructure/istio-config/yc-ecp - ../../infrastructure/vault/yc-ecp diff --git a/infrastructure/cert-manager/yc-ecp/cert-manager.yaml b/infrastructure/cert-manager/yc-ecp/cert-manager.yaml new file mode 100644 index 0000000..1cb5ad7 --- /dev/null +++ b/infrastructure/cert-manager/yc-ecp/cert-manager.yaml @@ -0,0 +1,12 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cert-manager + namespace: cert-manager +spec: + interval: 5m + timeout: 10m + values: + global: + imagePullSecrets: + - dockerhub diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml new file mode 100644 index 0000000..494e4ab --- /dev/null +++ b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml @@ -0,0 +1,5 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-issuer +$patch: delete diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml new file mode 100644 index 0000000..9901d81 --- /dev/null +++ b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml @@ -0,0 +1,5 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-issuer-istio +$patch: delete diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml new file mode 100644 index 0000000..3de8c09 --- /dev/null +++ b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml @@ -0,0 +1,14 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-prod +spec: + acme: + email: "sarex@sarex.io" + privateKeySecretRef: + name: letsencrypt-prod + server: "https://acme-v02.api.letsencrypt.org/directory" + solvers: + - http01: + ingress: + class: istio \ No newline at end of file diff --git a/infrastructure/cert-manager/yc-ecp/kustomization.yaml b/infrastructure/cert-manager/yc-ecp/kustomization.yaml new file mode 100644 index 0000000..63bab8e --- /dev/null +++ b/infrastructure/cert-manager/yc-ecp/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base + - clusterissuer-letsencrypt-prod.yaml +patches: + - path: cert-manager.yaml + # yc-ecp выпускает сертификаты только через letsencrypt-prod + - path: clusterissuer-letsencrypt-delete.yaml + - path: clusterissuer-letsencrypt-istio-delete.yaml From 4cd9a8b4d5901ea1afcfba2c2639fcd0b27529f3 Mon Sep 17 00:00:00 2001 From: emelinda Date: Tue, 4 Aug 2026 22:58:10 +0300 Subject: [PATCH 29/85] Add `imagePullSecrets` to Let's Encrypt ClusterIssuer for DockerHub authentication --- .../cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml index 3de8c09..5739c5b 100644 --- a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml +++ b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml @@ -11,4 +11,8 @@ spec: solvers: - http01: ingress: - class: istio \ No newline at end of file + class: istio + podTemplate: + spec: + imagePullSecrets: + - name: dockerhub From da36ac822f71e40e1692d7baefc41bf72d4385ff Mon Sep 17 00:00:00 2001 From: emelinda Date: Tue, 4 Aug 2026 23:06:33 +0300 Subject: [PATCH 30/85] Remove unused ClusterIssuer references from `yc-ecp` cert-manager kustomization --- infrastructure/cert-manager/yc-ecp/kustomization.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/infrastructure/cert-manager/yc-ecp/kustomization.yaml b/infrastructure/cert-manager/yc-ecp/kustomization.yaml index 63bab8e..6e03798 100644 --- a/infrastructure/cert-manager/yc-ecp/kustomization.yaml +++ b/infrastructure/cert-manager/yc-ecp/kustomization.yaml @@ -2,9 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base - - clusterissuer-letsencrypt-prod.yaml patches: - path: cert-manager.yaml - # yc-ecp выпускает сертификаты только через letsencrypt-prod - - path: clusterissuer-letsencrypt-delete.yaml - - path: clusterissuer-letsencrypt-istio-delete.yaml From 9e4a27f898db04b4d8ba8bacd363956e8612dc67 Mon Sep 17 00:00:00 2001 From: emelinda Date: Tue, 4 Aug 2026 23:07:06 +0300 Subject: [PATCH 31/85] Remove unused Let's Encrypt ClusterIssuer configurations from `yc-ecp` cert-manager directory. --- .../clusterissuer-letsencrypt-delete.yaml | 5 ----- ...clusterissuer-letsencrypt-istio-delete.yaml | 5 ----- .../yc-ecp/clusterissuer-letsencrypt-prod.yaml | 18 ------------------ 3 files changed, 28 deletions(-) delete mode 100644 infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml delete mode 100644 infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml delete mode 100644 infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml deleted file mode 100644 index 494e4ab..0000000 --- a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-issuer -$patch: delete diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml deleted file mode 100644 index 9901d81..0000000 --- a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-issuer-istio -$patch: delete diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml deleted file mode 100644 index 5739c5b..0000000 --- a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-prod.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-prod -spec: - acme: - email: "sarex@sarex.io" - privateKeySecretRef: - name: letsencrypt-prod - server: "https://acme-v02.api.letsencrypt.org/directory" - solvers: - - http01: - ingress: - class: istio - podTemplate: - spec: - imagePullSecrets: - - name: dockerhub From 6b107c872aa3728938e1a09a99483e452f24b170 Mon Sep 17 00:00:00 2001 From: emelinda Date: Tue, 4 Aug 2026 23:14:05 +0300 Subject: [PATCH 32/85] Remove deprecated Let's Encrypt ClusterIssuer configurations and update dependencies in `yc-ecp` cert-manager and Istio configuration. --- .../clusterissuer-letsencrypt-delete.yaml | 5 +++++ ...lusterissuer-letsencrypt-istio-delete.yaml | 5 +++++ .../cert-manager/yc-ecp/kustomization.yaml | 4 ++++ .../istio-config/yc-ecp/istio-config.yaml | 19 ++++++++++++++++--- 4 files changed, 30 insertions(+), 3 deletions(-) create mode 100644 infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml create mode 100644 infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml new file mode 100644 index 0000000..494e4ab --- /dev/null +++ b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-delete.yaml @@ -0,0 +1,5 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-issuer +$patch: delete diff --git a/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml new file mode 100644 index 0000000..9901d81 --- /dev/null +++ b/infrastructure/cert-manager/yc-ecp/clusterissuer-letsencrypt-istio-delete.yaml @@ -0,0 +1,5 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-issuer-istio +$patch: delete diff --git a/infrastructure/cert-manager/yc-ecp/kustomization.yaml b/infrastructure/cert-manager/yc-ecp/kustomization.yaml index 6e03798..032cf3b 100644 --- a/infrastructure/cert-manager/yc-ecp/kustomization.yaml +++ b/infrastructure/cert-manager/yc-ecp/kustomization.yaml @@ -4,3 +4,7 @@ resources: - ../base patches: - path: cert-manager.yaml + # ClusterIssuer/letsencrypt-prod создаёт istio-config; issuer'ы из base здесь + # не нужны и вдобавок делят один privateKeySecretRef, затирая ACME-ключ друг друга + - path: clusterissuer-letsencrypt-delete.yaml + - path: clusterissuer-letsencrypt-istio-delete.yaml diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml index 1810ac9..00a2081 100644 --- a/infrastructure/istio-config/yc-ecp/istio-config.yaml +++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml @@ -5,8 +5,11 @@ metadata: namespace: default spec: # istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod/ingressgateway - # в кластере нет — с зависимостями из base релиз никогда не станет Ready - dependsOn: [] + # в кластере нет — с зависимостями из base релиз никогда не станет Ready. + # cert-manager нужен: этот релиз создаёт ClusterIssuer и Certificate + dependsOn: + - name: cert-manager + namespace: cert-manager interval: 5m timeout: 10m values: @@ -16,7 +19,17 @@ spec: yc-ecp: namespaces: [] certManager: - clusterIssuers: {} + clusterIssuers: + letsencrypt-prod: + acme: + email: "sarex@sarex.io" + server: "https://acme-v02.api.letsencrypt.org/directory" + privateKeySecretRef: + name: letsencrypt-prod + solvers: + - http01: + ingress: + class: istio certificates: gitea-tls-secret: namespace: istio-system From e491466a3766b34362734f6b17a6e10870a89396 Mon Sep 17 00:00:00 2001 From: emelinda Date: Tue, 4 Aug 2026 23:27:13 +0300 Subject: [PATCH 33/85] Refactor `yc-ecp` Istio and cert-manager configurations: adjust ClusterIssuer specs, update certificate and VirtualService keys, and add port names. --- .../istio-config/yc-ecp/istio-config.yaml | 42 ++++++++++++------- 1 file changed, 27 insertions(+), 15 deletions(-) diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml index 00a2081..51dfb48 100644 --- a/infrastructure/istio-config/yc-ecp/istio-config.yaml +++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml @@ -19,27 +19,33 @@ spec: yc-ecp: namespaces: [] certManager: + # чарт рендерит ClusterIssuer как `spec: {{ toYaml $ci.spec }}`, + # поэтому спека обязана лежать под ключом spec clusterIssuers: letsencrypt-prod: - acme: - email: "sarex@sarex.io" - server: "https://acme-v02.api.letsencrypt.org/directory" - privateKeySecretRef: - name: letsencrypt-prod - solvers: - - http01: - ingress: - class: istio + spec: + acme: + email: "sarex@sarex.io" + server: "https://acme-v02.api.letsencrypt.org/directory" + privateKeySecretRef: + name: letsencrypt-prod + solvers: + - http01: + ingress: + class: istio + # имя Certificate = ключ, имя секрета задаётся отдельно certificates: - gitea-tls-secret: + gitea-cert: namespace: istio-system + secretName: gitea-tls-secret dnsNames: - gitea.invest.cps.sarex.lonsdaleites.ru issuerRef: name: letsencrypt-prod kind: ClusterIssuer - vault-tls: + vault-cert: namespace: istio-system + secretName: vault-tls dnsNames: - vault.invest.cps.sarex.lonsdaleites.ru issuerRef: @@ -53,6 +59,8 @@ spec: servers: - hosts: - gitea.invest.cps.sarex.lonsdaleites.ru + httpPortName: http + httpsPortName: https tls: credentialName: gitea-tls-secret vault: @@ -61,12 +69,16 @@ spec: servers: - hosts: - vault.invest.cps.sarex.lonsdaleites.ru + httpPortName: http + httpsPortName: https tls: credentialName: vault-tls + # имя VirtualService = ключ, поле name чарт игнорирует. + # noCors: чарт иначе навешивает corsPolicy с дефолтными origins sarex.io virtualServices: - gitea: - name: gitea-virt-service + gitea-virt-service: namespace: gitea + noCors: true hosts: - gitea.invest.cps.sarex.lonsdaleites.ru gateways: @@ -76,9 +88,9 @@ spec: prefix: / service: gitea.gitea.svc.cluster.local port: 3000 - vault: - name: vault-virt-service + vault-virt-service: namespace: vault + noCors: true hosts: - vault.invest.cps.sarex.lonsdaleites.ru gateways: From 172e889f00851c44a8f73c0d400ef3e7e7c07112 Mon Sep 17 00:00:00 2001 From: emelinda Date: Tue, 4 Aug 2026 23:34:53 +0300 Subject: [PATCH 34/85] Add Kubernetes Dashboard configuration to `yc-ecp`: define HelmRelease, update Istio Gateway and VirtualService, and include in cluster Kustomization --- clusters/yc-ecp/kustomization.yaml | 1 + .../dashboard/yc-ecp/dashboard.yaml | 29 ++++++++++++++++++ .../dashboard/yc-ecp/kustomization.yaml | 6 ++++ .../istio-config/yc-ecp/istio-config.yaml | 30 +++++++++++++++++++ 4 files changed, 66 insertions(+) create mode 100644 infrastructure/dashboard/yc-ecp/dashboard.yaml create mode 100644 infrastructure/dashboard/yc-ecp/kustomization.yaml diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml index 3bb515f..50dc89a 100644 --- a/clusters/yc-ecp/kustomization.yaml +++ b/clusters/yc-ecp/kustomization.yaml @@ -7,4 +7,5 @@ resources: # infrastructure - ../../infrastructure/cert-manager/yc-ecp - ../../infrastructure/istio-config/yc-ecp + - ../../infrastructure/dashboard/yc-ecp - ../../infrastructure/vault/yc-ecp diff --git a/infrastructure/dashboard/yc-ecp/dashboard.yaml b/infrastructure/dashboard/yc-ecp/dashboard.yaml new file mode 100644 index 0000000..bf821e7 --- /dev/null +++ b/infrastructure/dashboard/yc-ecp/dashboard.yaml @@ -0,0 +1,29 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: dashboard + namespace: kubernetes-dashboard +spec: + # istio в yc-ecp поставлен istio-operator, HelmRelease istio-base/istiod + # в кластере нет — с зависимостями из base релиз никогда не станет Ready + dependsOn: [] + interval: 5m + timeout: 10m + values: + destinationRule: + enabled: true + host: "dashboard-kong-proxy" + tlsMode: "DISABLE" + # Gateway, Certificate и VirtualService описаны в istio-config + virtualService: + enabled: false + gateway: + enabled: false + app: + image: + pullSecrets: + - dockerhub + kong: + image: + pullSecrets: + - dockerhub diff --git a/infrastructure/dashboard/yc-ecp/kustomization.yaml b/infrastructure/dashboard/yc-ecp/kustomization.yaml new file mode 100644 index 0000000..1e73b3b --- /dev/null +++ b/infrastructure/dashboard/yc-ecp/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: dashboard.yaml diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml index 51dfb48..607e680 100644 --- a/infrastructure/istio-config/yc-ecp/istio-config.yaml +++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml @@ -51,6 +51,14 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer + dashboard-cert: + namespace: istio-system + secretName: dashboard-tls + dnsNames: + - dashboard.invest.cps.sarex.lonsdaleites.ru + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer istio: gateways: gitea: @@ -73,6 +81,16 @@ spec: httpsPortName: https tls: credentialName: vault-tls + dashboard: + name: dashboard-gateway + namespace: gateway + servers: + - hosts: + - dashboard.invest.cps.sarex.lonsdaleites.ru + httpPortName: http + httpsPortName: https + tls: + credentialName: dashboard-tls # имя VirtualService = ключ, поле name чарт игнорирует. # noCors: чарт иначе навешивает corsPolicy с дефолтными origins sarex.io virtualServices: @@ -100,3 +118,15 @@ spec: prefix: / service: vault-vault-contour.vault.svc.cluster.local port: 8200 + dashboard-virt-service: + namespace: kubernetes-dashboard + noCors: true + hosts: + - dashboard.invest.cps.sarex.lonsdaleites.ru + gateways: + - gateway/dashboard-gateway + routes: + - path: + prefix: / + service: dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local + port: 80 From 3a5b3b07e6e4252fda229fda7d87f924657ad872 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 00:00:06 +0300 Subject: [PATCH 35/85] Add Measurements app to `yc-ecp`: define HelmRelease, configure Istio certificates, and update cluster Kustomization --- apps/measurements/yc-ecp/kustomization.yaml | 10 +++ apps/measurements/yc-ecp/measurements.yaml | 65 +++++++++++++++++++ clusters/yc-ecp/kustomization.yaml | 3 + .../istio-config/yc-ecp/istio-config.yaml | 12 ++-- 4 files changed, 83 insertions(+), 7 deletions(-) create mode 100644 apps/measurements/yc-ecp/kustomization.yaml create mode 100644 apps/measurements/yc-ecp/measurements.yaml diff --git a/apps/measurements/yc-ecp/kustomization.yaml b/apps/measurements/yc-ecp/kustomization.yaml new file mode 100644 index 0000000..ef1b4e0 --- /dev/null +++ b/apps/measurements/yc-ecp/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: measurements.yaml + target: + kind: HelmRelease + name: measurements diff --git a/apps/measurements/yc-ecp/measurements.yaml b/apps/measurements/yc-ecp/measurements.yaml new file mode 100644 index 0000000..4dcbfa4 --- /dev/null +++ b/apps/measurements/yc-ecp/measurements.yaml @@ -0,0 +1,65 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: measurements + namespace: measurements +spec: + interval: 5m + timeout: 10m + values: + services: + backend: + # в yc-ecp S3-настройки приходят из Secret, а не через Vault Agent, + # поэтому serviceAccount, vault-аннотации и обёртка entrypoint не нужны + serviceAccount: + enabled: + _default: false + name: + _default: null + + podAnnotations: + _default: null + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:production_a5bb3e84 + pullPolicy: + _default: Always + + deployment: + name: + _default: measurement + + replicaCount: + _default: 2 + + command: + _default: null + args: + _default: null + + service: + name: + _default: measurement-service + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: DJANGO_HOST + value: + _default: "https://aero.invest.sarex.io" + + - name: CLASSIC_MODE + value: + _default: "0" + + secretEnvs: + - name: S3_JSON_SETTINGS + secretName: + _default: "s3-json-settings" + secretKey: "S3_JSON_SETTINGS" diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml index 50dc89a..ed93bd6 100644 --- a/clusters/yc-ecp/kustomization.yaml +++ b/clusters/yc-ecp/kustomization.yaml @@ -9,3 +9,6 @@ resources: - ../../infrastructure/istio-config/yc-ecp - ../../infrastructure/dashboard/yc-ecp - ../../infrastructure/vault/yc-ecp + +# apps + - ../../apps/measurements/yc-ecp diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml index 607e680..36adb55 100644 --- a/infrastructure/istio-config/yc-ecp/istio-config.yaml +++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml @@ -33,27 +33,25 @@ spec: - http01: ingress: class: istio - # имя Certificate = ключ, имя секрета задаётся отдельно + # ключ = имя Certificate И имя секрета: версия чарта в OCI-репозитории + # поле secretName не читает, а берёт имя ключа certificates: - gitea-cert: + gitea-tls-secret: namespace: istio-system - secretName: gitea-tls-secret dnsNames: - gitea.invest.cps.sarex.lonsdaleites.ru issuerRef: name: letsencrypt-prod kind: ClusterIssuer - vault-cert: + vault-tls: namespace: istio-system - secretName: vault-tls dnsNames: - vault.invest.cps.sarex.lonsdaleites.ru issuerRef: name: letsencrypt-prod kind: ClusterIssuer - dashboard-cert: + dashboard-tls: namespace: istio-system - secretName: dashboard-tls dnsNames: - dashboard.invest.cps.sarex.lonsdaleites.ru issuerRef: From c7c244e95da9da88a09c591814e318ae6217d824 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 00:11:41 +0300 Subject: [PATCH 36/85] Update `yc-ecp` Istio configuration: add `imagePullSecrets` for cert-manager and enforce HTTPS for dashboard bindings --- infrastructure/istio-config/yc-ecp/istio-config.yaml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml index 36adb55..96893a5 100644 --- a/infrastructure/istio-config/yc-ecp/istio-config.yaml +++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml @@ -33,6 +33,13 @@ spec: - http01: ingress: class: istio + # solver-под создаётся контроллером в namespace + # сертификата, values чарта cert-manager на него + # не действуют — pull-секрет задаётся здесь + podTemplate: + spec: + imagePullSecrets: + - name: dockerhub # ключ = имя Certificate И имя секрета: версия чарта в OCI-репозитории # поле secretName не читает, а берёт имя ключа certificates: @@ -85,7 +92,10 @@ spec: servers: - hosts: - dashboard.invest.cps.sarex.lonsdaleites.ru - httpPortName: http + # без http-сервера порт 80 для этого хоста остаётся + # автогенерируемому ingress-шлюзу, через который + # cert-manager отдаёт HTTP-01 challenge + onlyHttps: true httpsPortName: https tls: credentialName: dashboard-tls From 27e36cfa7cff747056a2fffe61216baa79e4907d Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 00:17:21 +0300 Subject: [PATCH 37/85] Refactor Measurements app kustomization in `yc-ecp`: remove unused `patches` section and update resource references --- apps/measurements/yc-ecp/kustomization.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/apps/measurements/yc-ecp/kustomization.yaml b/apps/measurements/yc-ecp/kustomization.yaml index ef1b4e0..afefca3 100644 --- a/apps/measurements/yc-ecp/kustomization.yaml +++ b/apps/measurements/yc-ecp/kustomization.yaml @@ -2,9 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../base -patches: - - path: measurements.yaml - target: - kind: HelmRelease - name: measurements + - measurements.yaml +#patches: +# - path: measurements.yaml +# target: +# kind: HelmRelease +# name: measurements From 4abcd33cd5187679ffda9a18fad35f2b36546312 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 00:26:54 +0300 Subject: [PATCH 38/85] Comment out Measurements app in `yc-ecp` cluster Kustomization file. --- clusters/yc-ecp/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml index ed93bd6..3bea482 100644 --- a/clusters/yc-ecp/kustomization.yaml +++ b/clusters/yc-ecp/kustomization.yaml @@ -11,4 +11,4 @@ resources: - ../../infrastructure/vault/yc-ecp # apps - - ../../apps/measurements/yc-ecp +# - ../../apps/measurements/yc-ecp From 64412e1b94894a3afe312eb0503a9cb9ad1d6085 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 00:35:29 +0300 Subject: [PATCH 39/85] Add Measurements app to `yc-ecp`: define namespace, update HelmRelease with chart details, and include in cluster Kustomization --- apps/measurements/yc-ecp/kustomization.yaml | 7 ++---- apps/measurements/yc-ecp/measurements.yaml | 27 +++++++++++++++------ apps/measurements/yc-ecp/namespace.yaml | 7 ++++++ clusters/yc-ecp/kustomization.yaml | 2 +- 4 files changed, 29 insertions(+), 14 deletions(-) create mode 100644 apps/measurements/yc-ecp/namespace.yaml diff --git a/apps/measurements/yc-ecp/kustomization.yaml b/apps/measurements/yc-ecp/kustomization.yaml index afefca3..0bb1fc1 100644 --- a/apps/measurements/yc-ecp/kustomization.yaml +++ b/apps/measurements/yc-ecp/kustomization.yaml @@ -1,10 +1,7 @@ --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: measurements resources: - measurements.yaml -#patches: -# - path: measurements.yaml -# target: -# kind: HelmRelease -# name: measurements + - namespace.yaml diff --git a/apps/measurements/yc-ecp/measurements.yaml b/apps/measurements/yc-ecp/measurements.yaml index 4dcbfa4..3ac0fab 100644 --- a/apps/measurements/yc-ecp/measurements.yaml +++ b/apps/measurements/yc-ecp/measurements.yaml @@ -7,6 +7,25 @@ metadata: spec: interval: 5m timeout: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: services: backend: @@ -49,14 +68,6 @@ spec: name: _default: dockerhub - envs: - - name: DJANGO_HOST - value: - _default: "https://aero.invest.sarex.io" - - - name: CLASSIC_MODE - value: - _default: "0" secretEnvs: - name: S3_JSON_SETTINGS diff --git a/apps/measurements/yc-ecp/namespace.yaml b/apps/measurements/yc-ecp/namespace.yaml new file mode 100644 index 0000000..1ff2c3e --- /dev/null +++ b/apps/measurements/yc-ecp/namespace.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: measurements + labels: + istio-injection: enabled diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml index 3bea482..ed93bd6 100644 --- a/clusters/yc-ecp/kustomization.yaml +++ b/clusters/yc-ecp/kustomization.yaml @@ -11,4 +11,4 @@ resources: - ../../infrastructure/vault/yc-ecp # apps -# - ../../apps/measurements/yc-ecp + - ../../apps/measurements/yc-ecp From 638da92688b8533fbdd114e302005a98508927e8 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 00:46:00 +0300 Subject: [PATCH 40/85] Update Measurements app configuration in `yc-ecp`: enable backend service, set deployment and service details, and define resource requests and ports --- apps/measurements/yc-ecp/measurements.yaml | 45 +++++++++++++++++----- 1 file changed, 36 insertions(+), 9 deletions(-) diff --git a/apps/measurements/yc-ecp/measurements.yaml b/apps/measurements/yc-ecp/measurements.yaml index 3ac0fab..21aebaf 100644 --- a/apps/measurements/yc-ecp/measurements.yaml +++ b/apps/measurements/yc-ecp/measurements.yaml @@ -27,18 +27,18 @@ spec: retries: 3 values: + global: + env: _default + services: backend: + enabled: true + # в yc-ecp S3-настройки приходят из Secret, а не через Vault Agent, # поэтому serviceAccount, vault-аннотации и обёртка entrypoint не нужны serviceAccount: enabled: _default: false - name: - _default: null - - podAnnotations: - _default: null image: name: @@ -47,21 +47,48 @@ spec: _default: Always deployment: + enabled: true + name: _default: measurement replicaCount: _default: 2 - command: - _default: null - args: - _default: null + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false service: + enabled: true + name: _default: measurement-service + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + imagePullSecrets: enabled: _default: true From d46ba48d2221da870d0b3aba1c9bc5bad05cbed8 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 01:05:11 +0300 Subject: [PATCH 41/85] Update `yc-ecp` Istio configuration: add `main-gateway` and TLS settings for `aero.invest.sarex.io` --- .../istio-config/yc-ecp/istio-config.yaml | 219 ++++++++++++++++++ 1 file changed, 219 insertions(+) diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml index 96893a5..551b5c2 100644 --- a/infrastructure/istio-config/yc-ecp/istio-config.yaml +++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml @@ -64,6 +64,13 @@ spec: issuerRef: name: letsencrypt-prod kind: ClusterIssuer + aero-invest-tls-secret: + namespace: istio-system + dnsNames: + - aero.invest.sarex.io + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer istio: gateways: gitea: @@ -86,6 +93,16 @@ spec: httpsPortName: https tls: credentialName: vault-tls + main: + name: main-gateway + namespace: gateway + servers: + - hosts: + - aero.invest.sarex.io + httpPortName: http + httpsPortName: https + tls: + credentialName: aero-invest-tls-secret dashboard: name: dashboard-gateway namespace: gateway @@ -138,3 +155,205 @@ spec: prefix: / service: dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local port: 80 + +# # --- aero.invest.sarex.io / main-gateway --- +# backend-service-virt-service: +# namespace: django +# hosts: +# - aero.invest.sarex.io +# gateways: +# - gateway/main-gateway +# cors: +# allowHeaders: +# - Authorization +# - Content-Type +# allowMethods: +# - GET +# - POST +# - PUT +# - PATCH +# - HEAD +# - DELETE +# routes: +# - path: +# prefix: /admin/ +# service: backend-service +# port: 8000 +# - path: +# prefix: /api +# service: backend-service +# port: 8000 +# +# s3-proxy-virt-service: +# namespace: django +# hosts: +# - aero.invest.sarex.io +# gateways: +# - gateway/main-gateway +# cors: +# allowHeaders: +# - Authorization +# - Content-Type +# allowMethods: +# - GET +# - POST +# - PUT +# - PATCH +# - HEAD +# - DELETE +# routes: +# - path: +# prefix: /s3/ +# rewrite: / +# service: s3-bim-service +# port: 80 +# - path: +# prefix: /media/ +# rewrite: / +# service: s3-service +# port: 80 +# +# frontend-vs: +# namespace: django +# noCors: true +# hosts: +# - aero.invest.sarex.io +# gateways: +# - gateway/main-gateway +# routes: +# # без path — маршрут без match, catch-all, как в кластере; +# # он должен оставаться последним по порядку сопоставления +# - service: frontend-service.django.svc.cluster.local +# port: 80 +# +# bim-api-gazpromcps-api-virt-service: +# namespace: bim +# hosts: +# - aero.invest.sarex.io +# gateways: +# - gateway/main-gateway +# cors: +# allowHeaders: +# - Authorization +# - Content-Type +# allowMethods: +# - GET +# - POST +# - PUT +# - PATCH +# - HEAD +# - DELETE +# routes: +# - path: +# prefix: /bim-gazpromcps/api/ +# rewrite: /api/ +# service: bim-api-gazpromcps-service +# port: 80 +# - path: +# prefix: /bim-gazpromcps/files/ +# rewrite: /files/ +# service: bim-api-gazpromcps-service +# port: 80 +# +# bim-backend-v2-api-virt-service: +# namespace: bim +# hosts: +# - aero.invest.sarex.io +# gateways: +# - gateway/main-gateway +# cors: +# allowHeaders: +# - Authorization +# - Content-Type +# allowMethods: +# - GET +# - POST +# - PUT +# - PATCH +# - HEAD +# - DELETE +# routes: +# - path: +# prefix: /bim2-gazpromcps/api/ +# rewrite: /api/ +# service: bim-backend-v2-service +# port: 80 +# +# eav-virt-service: +# namespace: eav +# hosts: +# - aero.invest.sarex.io +# gateways: +# - gateway/main-gateway +# cors: +# allowHeaders: +# - Authorization +# - Content-Type +# allowMethods: +# - POST +# - GET +# - PATCH +# - DELETE +# - HEAD +# - PUT +# - OPTIONS +# routes: +# - path: +# prefix: /eav/api/ +# rewrite: /api/ +# service: eav-service +# port: 8000 +# noCors: true +# - path: +# prefix: /eav/admin/ +# rewrite: /eav/admin/ +# service: eav-service +# port: 8000 +# +# api-virt-service: +# namespace: processing +# hosts: +# - aero.invest.sarex.io +# gateways: +# - gateway/main-gateway +# cors: +# allowHeaders: +# - Authorization +# - Content-Type +# allowMethods: +# - GET +# - POST +# - PUT +# - PATCH +# - HEAD +# - DELETE +# routes: +# - path: +# prefix: /workflows/api/ +# rewrite: /api/ +# service: workflows-backend-service +# port: 80 +# +# projects-frontend-static-virt-service: +# namespace: projects +# hosts: +# - aero.invest.sarex.io +# gateways: +# - gateway/main-gateway +# cors: +# allowHeaders: +# - Authorization +# - Content-Type +# allowMethods: +# - GET +# - POST +# - PUT +# - PATCH +# - HEAD +# - DELETE +# routes: +# - path: +# prefix: /projects/static/ +# rewrite: / +# service: projects-frontend-static-service +# port: 80 From d5884d3a3b2601ad6f74c68594345c221779c885 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 01:39:43 +0300 Subject: [PATCH 42/85] Update Measurements app in `yc-ecp`: configure custom `gunicorn` command with access log settings --- apps/measurements/yc-ecp/measurements.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/apps/measurements/yc-ecp/measurements.yaml b/apps/measurements/yc-ecp/measurements.yaml index 21aebaf..1e4e42d 100644 --- a/apps/measurements/yc-ecp/measurements.yaml +++ b/apps/measurements/yc-ecp/measurements.yaml @@ -58,6 +58,14 @@ spec: port: _default: 8000 + # entrypoint.sh запускает gunicorn без --access-logfile, поэтому + # запросы не попадают в лог; подменяем команду целиком + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - gunicorn -w 4 -k uvicorn.workers.UvicornWorker -b 0.0.0.0:8000 --timeout 240 --access-logfile - --access-logformat '%(h)s "%(r)s" %(s)s %(b)s %(M)sms' measurements.main:app + resources: requests: cpu: From f88cf044349e8bba475b8345dbbe828b1cbc9f2a Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 01:48:07 +0300 Subject: [PATCH 43/85] Update Measurements app image in `yc-ecp` configuration: change default tag to `prod_6070cd4d` --- apps/measurements/yc-ecp/measurements.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/measurements/yc-ecp/measurements.yaml b/apps/measurements/yc-ecp/measurements.yaml index 1e4e42d..639fbc7 100644 --- a/apps/measurements/yc-ecp/measurements.yaml +++ b/apps/measurements/yc-ecp/measurements.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:production_a5bb3e84 + _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:prod_6070cd4d pullPolicy: _default: Always From 218d233eb7e2d3c9ab50715c1f1804fb4dc26623 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 01:58:35 +0300 Subject: [PATCH 44/85] Add Django frontend app to `yc-ecp`: define namespace, configure HelmRelease with chart and deployment details, update Istio configuration, and include in cluster Kustomization --- apps/django/yc-ecp/frontend.yaml | 133 ++++++++++++++++++ apps/django/yc-ecp/kustomization.yaml | 7 + apps/django/yc-ecp/namespace.yaml | 7 + clusters/yc-ecp/kustomization.yaml | 1 + .../istio-config/yc-ecp/istio-config.yaml | 44 +++--- 5 files changed, 170 insertions(+), 22 deletions(-) create mode 100644 apps/django/yc-ecp/frontend.yaml create mode 100644 apps/django/yc-ecp/kustomization.yaml create mode 100644 apps/django/yc-ecp/namespace.yaml diff --git a/apps/django/yc-ecp/frontend.yaml b/apps/django/yc-ecp/frontend.yaml new file mode 100644 index 0000000..1b3d2b4 --- /dev/null +++ b/apps/django/yc-ecp/frontend.yaml @@ -0,0 +1,133 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: django +spec: + interval: 5m + timeout: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:cps_82ba823b + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + podAffinityTerm: + labelSelector: + matchExpressions: + - key: app + operator: In + values: + - frontend + topologyKey: kubernetes.io/hostname + + # ConfigMap'ы nginx-configmap и robots-txt-config создаются вне этого + # релиза — чарт только монтирует их + volumes: + _default: + - name: nginx-configmap + mountPath: + _default: /etc/nginx/nginx.conf + subPath: + _default: nginx.conf + configMap: + name: + _default: nginx-configmap + items: + - key: nginx.conf + path: + _default: nginx.conf + + - name: robots-volume + mountPath: + _default: /opt/react_client/robots.txt + subPath: + _default: robots.txt + configMap: + name: + _default: robots-txt-config + items: + - key: robots.txt + path: + _default: robots.txt diff --git a/apps/django/yc-ecp/kustomization.yaml b/apps/django/yc-ecp/kustomization.yaml new file mode 100644 index 0000000..667b328 --- /dev/null +++ b/apps/django/yc-ecp/kustomization.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: django +resources: + - frontend.yaml +# - namespace.yaml diff --git a/apps/django/yc-ecp/namespace.yaml b/apps/django/yc-ecp/namespace.yaml new file mode 100644 index 0000000..33478ea --- /dev/null +++ b/apps/django/yc-ecp/namespace.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: django + labels: + istio-injection: enabled diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml index ed93bd6..65f668e 100644 --- a/clusters/yc-ecp/kustomization.yaml +++ b/clusters/yc-ecp/kustomization.yaml @@ -12,3 +12,4 @@ resources: # apps - ../../apps/measurements/yc-ecp + - ../../apps/django/yc-ecp diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml index 551b5c2..6220737 100644 --- a/infrastructure/istio-config/yc-ecp/istio-config.yaml +++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml @@ -120,7 +120,7 @@ spec: # noCors: чарт иначе навешивает corsPolicy с дефолтными origins sarex.io virtualServices: gitea-virt-service: - namespace: gitea + namespace: gateway noCors: true hosts: - gitea.invest.cps.sarex.lonsdaleites.ru @@ -132,7 +132,7 @@ spec: service: gitea.gitea.svc.cluster.local port: 3000 vault-virt-service: - namespace: vault + namespace: gateway noCors: true hosts: - vault.invest.cps.sarex.lonsdaleites.ru @@ -144,7 +144,7 @@ spec: service: vault-vault-contour.vault.svc.cluster.local port: 8200 dashboard-virt-service: - namespace: kubernetes-dashboard + namespace: gateway noCors: true hosts: - dashboard.invest.cps.sarex.lonsdaleites.ru @@ -158,7 +158,7 @@ spec: # # --- aero.invest.sarex.io / main-gateway --- # backend-service-virt-service: -# namespace: django +# namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: @@ -177,15 +177,15 @@ spec: # routes: # - path: # prefix: /admin/ -# service: backend-service +# service: backend-service.django.svc.cluster.local # port: 8000 # - path: # prefix: /api -# service: backend-service +# service: backend-service.django.svc.cluster.local # port: 8000 # # s3-proxy-virt-service: -# namespace: django +# namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: @@ -205,16 +205,16 @@ spec: # - path: # prefix: /s3/ # rewrite: / -# service: s3-bim-service +# service: s3-bim-service.django.svc.cluster.local # port: 80 # - path: # prefix: /media/ # rewrite: / -# service: s3-service +# service: s3-service.django.svc.cluster.local # port: 80 # # frontend-vs: -# namespace: django +# namespace: gateway # noCors: true # hosts: # - aero.invest.sarex.io @@ -227,7 +227,7 @@ spec: # port: 80 # # bim-api-gazpromcps-api-virt-service: -# namespace: bim +# namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: @@ -247,16 +247,16 @@ spec: # - path: # prefix: /bim-gazpromcps/api/ # rewrite: /api/ -# service: bim-api-gazpromcps-service +# service: bim-api-gazpromcps-service.bim.svc.cluster.local # port: 80 # - path: # prefix: /bim-gazpromcps/files/ # rewrite: /files/ -# service: bim-api-gazpromcps-service +# service: bim-api-gazpromcps-service.bim.svc.cluster.local # port: 80 # # bim-backend-v2-api-virt-service: -# namespace: bim +# namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: @@ -276,11 +276,11 @@ spec: # - path: # prefix: /bim2-gazpromcps/api/ # rewrite: /api/ -# service: bim-backend-v2-service +# service: bim-backend-v2-service.bim.svc.cluster.local # port: 80 # # eav-virt-service: -# namespace: eav +# namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: @@ -301,17 +301,17 @@ spec: # - path: # prefix: /eav/api/ # rewrite: /api/ -# service: eav-service +# service: eav-service.eav.svc.cluster.local # port: 8000 # noCors: true # - path: # prefix: /eav/admin/ # rewrite: /eav/admin/ -# service: eav-service +# service: eav-service.eav.svc.cluster.local # port: 8000 # # api-virt-service: -# namespace: processing +# namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: @@ -331,11 +331,11 @@ spec: # - path: # prefix: /workflows/api/ # rewrite: /api/ -# service: workflows-backend-service +# service: workflows-backend-service.processing.svc.cluster.local # port: 80 # # projects-frontend-static-virt-service: -# namespace: projects +# namespace: gateway # hosts: # - aero.invest.sarex.io # gateways: @@ -355,5 +355,5 @@ spec: # - path: # prefix: /projects/static/ # rewrite: / -# service: projects-frontend-static-service +# service: projects-frontend-static-service.projects.svc.cluster.local # port: 80 From db0b8988f1ddb73e4c5b0f94cc5d00726a383c7e Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 02:06:17 +0300 Subject: [PATCH 45/85] Refactor `yc-ecp` configuration: update HelmRelease affinity settings for `frontend` and re-enable commented Istio routes for `main-gateway`. --- apps/django/yc-ecp/frontend.yaml | 14 +- .../istio-config/yc-ecp/istio-config.yaml | 138 +++++++++--------- 2 files changed, 79 insertions(+), 73 deletions(-) diff --git a/apps/django/yc-ecp/frontend.yaml b/apps/django/yc-ecp/frontend.yaml index 1b3d2b4..aeddfe8 100644 --- a/apps/django/yc-ecp/frontend.yaml +++ b/apps/django/yc-ecp/frontend.yaml @@ -89,18 +89,24 @@ spec: name: _default: dockerhub + # чарт прогоняет weight, key, operator и topologyKey через pluckEnv, + # который читает только map вида {_default: …}; скаляры дают пустые значения affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 + - weight: + _default: 100 podAffinityTerm: labelSelector: matchExpressions: - - key: app - operator: In + - key: + _default: app + operator: + _default: In values: - frontend - topologyKey: kubernetes.io/hostname + topologyKey: + _default: kubernetes.io/hostname # ConfigMap'ы nginx-configmap и robots-txt-config создаются вне этого # релиза — чарт только монтирует их diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml index 6220737..e8b493a 100644 --- a/infrastructure/istio-config/yc-ecp/istio-config.yaml +++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml @@ -156,75 +156,75 @@ spec: service: dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local port: 80 -# # --- aero.invest.sarex.io / main-gateway --- -# backend-service-virt-service: -# namespace: gateway -# hosts: -# - aero.invest.sarex.io -# gateways: -# - gateway/main-gateway -# cors: -# allowHeaders: -# - Authorization -# - Content-Type -# allowMethods: -# - GET -# - POST -# - PUT -# - PATCH -# - HEAD -# - DELETE -# routes: -# - path: -# prefix: /admin/ -# service: backend-service.django.svc.cluster.local -# port: 8000 -# - path: -# prefix: /api -# service: backend-service.django.svc.cluster.local -# port: 8000 -# -# s3-proxy-virt-service: -# namespace: gateway -# hosts: -# - aero.invest.sarex.io -# gateways: -# - gateway/main-gateway -# cors: -# allowHeaders: -# - Authorization -# - Content-Type -# allowMethods: -# - GET -# - POST -# - PUT -# - PATCH -# - HEAD -# - DELETE -# routes: -# - path: -# prefix: /s3/ -# rewrite: / -# service: s3-bim-service.django.svc.cluster.local -# port: 80 -# - path: -# prefix: /media/ -# rewrite: / -# service: s3-service.django.svc.cluster.local -# port: 80 -# -# frontend-vs: -# namespace: gateway -# noCors: true -# hosts: -# - aero.invest.sarex.io -# gateways: -# - gateway/main-gateway -# routes: -# # без path — маршрут без match, catch-all, как в кластере; -# # он должен оставаться последним по порядку сопоставления -# - service: frontend-service.django.svc.cluster.local -# port: 80 + # --- aero.invest.sarex.io / main-gateway --- + backend-service-virt-service: + namespace: gateway + hosts: + - aero.invest.sarex.io + gateways: + - gateway/main-gateway + cors: + allowHeaders: + - Authorization + - Content-Type + allowMethods: + - GET + - POST + - PUT + - PATCH + - HEAD + - DELETE + routes: + - path: + prefix: /admin/ + service: backend-service.django.svc.cluster.local + port: 8000 + - path: + prefix: /api + service: backend-service.django.svc.cluster.local + port: 8000 + + s3-proxy-virt-service: + namespace: gateway + hosts: + - aero.invest.sarex.io + gateways: + - gateway/main-gateway + cors: + allowHeaders: + - Authorization + - Content-Type + allowMethods: + - GET + - POST + - PUT + - PATCH + - HEAD + - DELETE + routes: + - path: + prefix: /s3/ + rewrite: / + service: s3-bim-service.django.svc.cluster.local + port: 80 + - path: + prefix: /media/ + rewrite: / + service: s3-service.django.svc.cluster.local + port: 80 + + frontend-vs: + namespace: gateway + noCors: true + hosts: + - aero.invest.sarex.io + gateways: + - gateway/main-gateway + routes: + # без path — маршрут без match, catch-all, как в кластере; + # он должен оставаться последним по порядку сопоставления + - service: frontend-service.django.svc.cluster.local + port: 80 # # bim-api-gazpromcps-api-virt-service: # namespace: gateway From 8d9e1d3d9ec99599e08545b751b65d84648ea964 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 02:11:22 +0300 Subject: [PATCH 46/85] Comment out Django app in `yc-ecp` cluster Kustomization file. --- clusters/yc-ecp/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml index 65f668e..563960b 100644 --- a/clusters/yc-ecp/kustomization.yaml +++ b/clusters/yc-ecp/kustomization.yaml @@ -12,4 +12,4 @@ resources: # apps - ../../apps/measurements/yc-ecp - - ../../apps/django/yc-ecp +# - ../../apps/django/yc-ecp From 9da34bb9cc743cf746d65c6860ddb345996b007b Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 02:12:32 +0300 Subject: [PATCH 47/85] Re-enable Django app in `yc-ecp` cluster Kustomization file. --- clusters/yc-ecp/kustomization.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clusters/yc-ecp/kustomization.yaml b/clusters/yc-ecp/kustomization.yaml index 563960b..65f668e 100644 --- a/clusters/yc-ecp/kustomization.yaml +++ b/clusters/yc-ecp/kustomization.yaml @@ -12,4 +12,4 @@ resources: # apps - ../../apps/measurements/yc-ecp -# - ../../apps/django/yc-ecp + - ../../apps/django/yc-ecp From af6135f2b0d58b66239d0a22689b78c7df501de2 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 02:16:35 +0300 Subject: [PATCH 48/85] Re-enable and configure multiple virtual services in `yc-ecp` Istio configuration for `main-gateway`. --- .../istio-config/yc-ecp/istio-config.yaml | 264 +++++++++--------- 1 file changed, 132 insertions(+), 132 deletions(-) diff --git a/infrastructure/istio-config/yc-ecp/istio-config.yaml b/infrastructure/istio-config/yc-ecp/istio-config.yaml index e8b493a..1a03f22 100644 --- a/infrastructure/istio-config/yc-ecp/istio-config.yaml +++ b/infrastructure/istio-config/yc-ecp/istio-config.yaml @@ -225,135 +225,135 @@ spec: # он должен оставаться последним по порядку сопоставления - service: frontend-service.django.svc.cluster.local port: 80 -# -# bim-api-gazpromcps-api-virt-service: -# namespace: gateway -# hosts: -# - aero.invest.sarex.io -# gateways: -# - gateway/main-gateway -# cors: -# allowHeaders: -# - Authorization -# - Content-Type -# allowMethods: -# - GET -# - POST -# - PUT -# - PATCH -# - HEAD -# - DELETE -# routes: -# - path: -# prefix: /bim-gazpromcps/api/ -# rewrite: /api/ -# service: bim-api-gazpromcps-service.bim.svc.cluster.local -# port: 80 -# - path: -# prefix: /bim-gazpromcps/files/ -# rewrite: /files/ -# service: bim-api-gazpromcps-service.bim.svc.cluster.local -# port: 80 -# -# bim-backend-v2-api-virt-service: -# namespace: gateway -# hosts: -# - aero.invest.sarex.io -# gateways: -# - gateway/main-gateway -# cors: -# allowHeaders: -# - Authorization -# - Content-Type -# allowMethods: -# - GET -# - POST -# - PUT -# - PATCH -# - HEAD -# - DELETE -# routes: -# - path: -# prefix: /bim2-gazpromcps/api/ -# rewrite: /api/ -# service: bim-backend-v2-service.bim.svc.cluster.local -# port: 80 -# -# eav-virt-service: -# namespace: gateway -# hosts: -# - aero.invest.sarex.io -# gateways: -# - gateway/main-gateway -# cors: -# allowHeaders: -# - Authorization -# - Content-Type -# allowMethods: -# - POST -# - GET -# - PATCH -# - DELETE -# - HEAD -# - PUT -# - OPTIONS -# routes: -# - path: -# prefix: /eav/api/ -# rewrite: /api/ -# service: eav-service.eav.svc.cluster.local -# port: 8000 -# noCors: true -# - path: -# prefix: /eav/admin/ -# rewrite: /eav/admin/ -# service: eav-service.eav.svc.cluster.local -# port: 8000 -# -# api-virt-service: -# namespace: gateway -# hosts: -# - aero.invest.sarex.io -# gateways: -# - gateway/main-gateway -# cors: -# allowHeaders: -# - Authorization -# - Content-Type -# allowMethods: -# - GET -# - POST -# - PUT -# - PATCH -# - HEAD -# - DELETE -# routes: -# - path: -# prefix: /workflows/api/ -# rewrite: /api/ -# service: workflows-backend-service.processing.svc.cluster.local -# port: 80 -# -# projects-frontend-static-virt-service: -# namespace: gateway -# hosts: -# - aero.invest.sarex.io -# gateways: -# - gateway/main-gateway -# cors: -# allowHeaders: -# - Authorization -# - Content-Type -# allowMethods: -# - GET -# - POST -# - PUT -# - PATCH -# - HEAD -# - DELETE -# routes: -# - path: -# prefix: /projects/static/ -# rewrite: / -# service: projects-frontend-static-service.projects.svc.cluster.local -# port: 80 + + bim-api-gazpromcps-api-virt-service: + namespace: gateway + hosts: + - aero.invest.sarex.io + gateways: + - gateway/main-gateway + cors: + allowHeaders: + - Authorization + - Content-Type + allowMethods: + - GET + - POST + - PUT + - PATCH + - HEAD + - DELETE + routes: + - path: + prefix: /bim-gazpromcps/api/ + rewrite: /api/ + service: bim-api-gazpromcps-service.bim.svc.cluster.local + port: 80 + - path: + prefix: /bim-gazpromcps/files/ + rewrite: /files/ + service: bim-api-gazpromcps-service.bim.svc.cluster.local + port: 80 + + bim-backend-v2-api-virt-service: + namespace: gateway + hosts: + - aero.invest.sarex.io + gateways: + - gateway/main-gateway + cors: + allowHeaders: + - Authorization + - Content-Type + allowMethods: + - GET + - POST + - PUT + - PATCH + - HEAD + - DELETE + routes: + - path: + prefix: /bim2-gazpromcps/api/ + rewrite: /api/ + service: bim-backend-v2-service.bim.svc.cluster.local + port: 80 + + eav-virt-service: + namespace: gateway + hosts: + - aero.invest.sarex.io + gateways: + - gateway/main-gateway + cors: + allowHeaders: + - Authorization + - Content-Type + allowMethods: + - POST + - GET + - PATCH + - DELETE + - HEAD + - PUT + - OPTIONS + routes: + - path: + prefix: /eav/api/ + rewrite: /api/ + service: eav-service.eav.svc.cluster.local + port: 8000 + noCors: true + - path: + prefix: /eav/admin/ + rewrite: /eav/admin/ + service: eav-service.eav.svc.cluster.local + port: 8000 + + api-virt-service: + namespace: gateway + hosts: + - aero.invest.sarex.io + gateways: + - gateway/main-gateway + cors: + allowHeaders: + - Authorization + - Content-Type + allowMethods: + - GET + - POST + - PUT + - PATCH + - HEAD + - DELETE + routes: + - path: + prefix: /workflows/api/ + rewrite: /api/ + service: workflows-backend-service.processing.svc.cluster.local + port: 80 + + projects-frontend-static-virt-service: + namespace: gateway + hosts: + - aero.invest.sarex.io + gateways: + - gateway/main-gateway + cors: + allowHeaders: + - Authorization + - Content-Type + allowMethods: + - GET + - POST + - PUT + - PATCH + - HEAD + - DELETE + routes: + - path: + prefix: /projects/static/ + rewrite: / + service: projects-frontend-static-service.projects.svc.cluster.local + port: 80 From abc4d756db8216c51464a199320e3e4f36325948 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 02:19:42 +0300 Subject: [PATCH 49/85] Add S3 Proxy apps to `yc-ecp`: define `s3-proxy` and `s3-proxy-bim` HelmReleases with chart, deployment, and service configurations, and include in cluster Kustomization --- apps/django/yc-ecp/kustomization.yaml | 2 + apps/django/yc-ecp/s3-proxy-bim.yaml | 104 +++++++++++++++++++++++++ apps/django/yc-ecp/s3-proxy.yaml | 105 ++++++++++++++++++++++++++ 3 files changed, 211 insertions(+) create mode 100644 apps/django/yc-ecp/s3-proxy-bim.yaml create mode 100644 apps/django/yc-ecp/s3-proxy.yaml diff --git a/apps/django/yc-ecp/kustomization.yaml b/apps/django/yc-ecp/kustomization.yaml index 667b328..792964e 100644 --- a/apps/django/yc-ecp/kustomization.yaml +++ b/apps/django/yc-ecp/kustomization.yaml @@ -4,4 +4,6 @@ kind: Kustomization namespace: django resources: - frontend.yaml + - s3-proxy.yaml + - s3-proxy-bim.yaml # - namespace.yaml diff --git a/apps/django/yc-ecp/s3-proxy-bim.yaml b/apps/django/yc-ecp/s3-proxy-bim.yaml new file mode 100644 index 0000000..f733038 --- /dev/null +++ b/apps/django/yc-ecp/s3-proxy-bim.yaml @@ -0,0 +1,104 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: s3-proxy-bim + namespace: django +spec: + interval: 5m + timeout: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + s3-proxy-bim: + enabled: true + + # образ публичный, из Docker Hub — pull-секрет не нужен + image: + name: + _default: pottava/s3-proxy + pullPolicy: + _default: Always + + deployment: + enabled: true + + name: + _default: s3-proxy-bim + + replicaCount: + _default: 2 + + port: + _default: 80 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: s3-bim-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: false + + envs: + - name: AWS_API_ENDPOINT + value: + _default: "https://storage.yandexcloud.net" + + # ключи S3 лежат в Secret/s3-proxy-bim-secret, созданном вне этого релиза + secretEnvs: + - name: AWS_ACCESS_KEY_ID + secretName: + _default: "s3-proxy-bim-secret" + secretKey: "login" + + - name: AWS_SECRET_ACCESS_KEY + secretName: + _default: "s3-proxy-bim-secret" + secretKey: "password" + + - name: AWS_S3_BUCKET + secretName: + _default: "s3-proxy-bim-secret" + secretKey: "bucket" diff --git a/apps/django/yc-ecp/s3-proxy.yaml b/apps/django/yc-ecp/s3-proxy.yaml new file mode 100644 index 0000000..657394f --- /dev/null +++ b/apps/django/yc-ecp/s3-proxy.yaml @@ -0,0 +1,105 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: s3-proxy + namespace: django +spec: + interval: 5m + timeout: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + s3-proxy: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable + pullPolicy: + _default: Always + + deployment: + enabled: true + + name: + _default: s3-proxy + + replicaCount: + _default: 2 + + port: + _default: 80 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: s3-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: AWS_API_ENDPOINT + value: + _default: "https://storage.yandexcloud.net" + + # ключи S3 лежат в Secret/s3-proxy-secret, созданном вне этого релиза + secretEnvs: + - name: AWS_ACCESS_KEY_ID + secretName: + _default: "s3-proxy-secret" + secretKey: "login" + + - name: AWS_SECRET_ACCESS_KEY + secretName: + _default: "s3-proxy-secret" + secretKey: "password" + + - name: AWS_S3_BUCKET + secretName: + _default: "s3-proxy-secret" + secretKey: "bucket" From 30d58ba9af9b4fd50b2ded514416a976e0d209ff Mon Sep 17 00:00:00 2001 From: ivan Date: Wed, 5 Aug 2026 12:29:59 +0500 Subject: [PATCH 50/85] ++ --- apps/django/d8-ugmk-prod/backend.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/apps/django/d8-ugmk-prod/backend.yaml b/apps/django/d8-ugmk-prod/backend.yaml index dde6df0..f662678 100644 --- a/apps/django/d8-ugmk-prod/backend.yaml +++ b/apps/django/d8-ugmk-prod/backend.yaml @@ -138,3 +138,14 @@ spec: - name: KC_USE_REDIRECT_LOGOUT value: _default: "False" + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-template-django-s3: |- + {{- with secret "secrets/data/minio/apps/django" }} + AWS_S3_ENDPOINT_URL=https://s3.uralmine.com + S3_HOST=https://s3.uralmine.com + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + {{- end }} From 19fe0a66c2d6aa8d9491137744102a01e2dc01f5 Mon Sep 17 00:00:00 2001 From: ivan Date: Wed, 5 Aug 2026 12:40:27 +0500 Subject: [PATCH 51/85] ++ --- apps/django/base/backend.yaml | 3 +++ apps/django/d8-ugmk-prod/backend.yaml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/apps/django/base/backend.yaml b/apps/django/base/backend.yaml index 217177c..2548704 100644 --- a/apps/django/base/backend.yaml +++ b/apps/django/base/backend.yaml @@ -285,6 +285,9 @@ spec: S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} S3_LOGIN={{ index .Data.data "access_key" }} S3_PASSWORD={{ index .Data.data "secret_key" }} + AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} {{- end }} vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django vault.hashicorp.com/agent-inject-template-django-kafka: |- diff --git a/apps/django/d8-ugmk-prod/backend.yaml b/apps/django/d8-ugmk-prod/backend.yaml index f662678..9f4613b 100644 --- a/apps/django/d8-ugmk-prod/backend.yaml +++ b/apps/django/d8-ugmk-prod/backend.yaml @@ -148,4 +148,7 @@ spec: S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} S3_LOGIN={{ index .Data.data "access_key" }} S3_PASSWORD={{ index .Data.data "secret_key" }} + AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} {{- end }} From 12f3281deb1cca74a092a2835cbe5cacf3a99b09 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 11:29:52 +0300 Subject: [PATCH 52/85] Add IaC catalog: create `IAC-CATALOG.md` documenting component repositories, deployment models, and cluster configurations. --- IAC-CATALOG.md | 675 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 675 insertions(+) create mode 100644 IAC-CATALOG.md diff --git a/IAC-CATALOG.md b/IAC-CATALOG.md new file mode 100644 index 0000000..7b32002 --- /dev/null +++ b/IAC-CATALOG.md @@ -0,0 +1,675 @@ +# Каталог IaC-компонентов и репозиториев + +Карта ответственности: **какой репозиторий за что отвечает** в инфраструктуре `gitlab.sarex.io` +и **из чего состоит** этот репозиторий (`infra/iac`). + +- Источники: GitLab-группа `infra` (209 проектов, включая подгруппы) + содержимое `infra/iac`. +- Дата среза: **2026-08-05**. +- Все ссылки — на `https://gitlab.sarex.io`. + +Пометки достоверности: + +| Знак | Значение | +|---|---| +| ✅ | структура/назначение проверены — репозиторий открыт и прочитан | +| ◻️ | назначение выведено из имени, описания в GitLab и веток; **требует подтверждения** | + +--- + +## 1. Слои IaC и где они живут + +``` +┌─ Железо / VM ─────────────────────────────────────────────────────────────┐ +│ ansible-playbooks, ansible-patroni-cluster, ansible-minio-cluster, │ +│ tools/ansible-vm-preparing, astra-linux, hardware, intervpc-vpn-tunnel │ +├─ Кластер Kubernetes ──────────────────────────────────────────────────────┤ +│ kubespray, k8s-provision │ +├─ Облачные и k8s-ресурсы (namespace/БД/S3/секреты/топики) ─────────────────┤ +│ terraform, terraform-contour, terraform-contour-mirror, │ +│ sarex-terraform-provider │ +├─ GitOps: состояние кластеров ─────────────────────────────────────────────┤ +│ ★ iac (Flux v2, этот репозиторий) iac-gpn (ArgoCD) poc/iac (архив) │ +├─ Поставка отдельных компонентов через GitLab CI (ветка = контур) ─────────┤ +│ vault, redis, kafka, postgresql, istio-config, keycloak, … (~60 репо) │ +├─ Библиотеки чартов ───────────────────────────────────────────────────────┤ +│ universal-helm-chart, common-charts, chart-museum │ +├─ Эксплуатация, аудит, наблюдаемость ──────────────────────────────────────┤ +│ k8s-changelog, cluster-maintenance, k8s-hustler, harvester, backups/* │ +└───────────────────────────────────────────────────────────────────────────┘ +``` + +**Главный водораздел.** В инфраструктуре сосуществуют **две модели доставки**: + +1. **GitOps (Flux)** — `infra/iac`. Один репозиторий, множество кластеров, состояние декларируется + в `clusters/<кластер>/`, Flux сам подтягивает изменения. +2. **Push-деплой (GitLab CI)** — по репозиторию на компонент, чарт лежит в `.helm/`, + **ветка = контур/окружение** (`stage`, `preprod`, `contour`, `infra`, `brusnika-prod`, …). + Проверено на [vault](https://gitlab.sarex.io/infra/vault), + [redis](https://gitlab.sarex.io/infra/redis), + [istio-config](https://gitlab.sarex.io/infra/istio-config), + [kube-prometheus-stack](https://gitlab.sarex.io/infra/kube-prometheus-stack), + [gitlab-runner](https://gitlab.sarex.io/infra/gitlab-runner). ✅ + +Для ряда компонентов (Vault, Redis, Kafka, PostgreSQL, Istio, Keycloak, Zitadel, OpenObserve, +Superset, Trino, GoAlert, GlitchTip, argo-*, otel-*) **существуют оба источника**. +См. раздел [6. Перекрытия](#6-перекрытия-и-как-выбирать-источник-истины). + +--- + +## 2. Ядро IaC — репозитории верхнего уровня + +| Репозиторий | Зона ответственности | Ключевое содержимое | +|---|---|---| +| ★ [infra/iac](https://gitlab.sarex.io/infra/iac) ✅ | **Основной GitOps-монорепозиторий (Flux v2).** Декларативное состояние 9 кластеров: инфраструктурные компоненты + прикладные сервисы | `clusters/`, `infrastructure/` (36), `apps/` (37), `inventory.yaml`, `docs/apps/` | +| [infra/terraform](https://gitlab.sarex.io/infra/terraform) ✅ | **Ресурсы Yandex Cloud и Kubernetes**: namespaces, PostgreSQL БД/пользователи, S3-бакеты, Valkey/Redis-пользователи, Kafka-топики, RabbitMQ, k8s-секреты. Единый источник правды — `infrastructure.yaml`, секреты через SOPS | `live/prod` (Terragrunt), `modules/`: `k8s-namespace`, `k8s-secret`, `k8s-secrets`, `kafka-topics-yc`, `rabbitmq`, `yc-database`, `yc-s3`, `yc-valkey-user` | +| [infra/terraform-contour](https://gitlab.sarex.io/infra/terraform-contour) ✅ | Тот же подход **для изолированного контура**: namespaces и секреты из Vault | `live/{namespace,vault-secrets}`, `modules/{k8s-namespace,vault-platform-secrets}` | +| [infra/terraform-contour-mirror](https://gitlab.sarex.io/infra/terraform-contour-mirror) ✅ | **Зеркало `infra/terraform` для контура** (ветка `contour`, единственная). Тот же README и структура + `Dockerfile` для запуска в закрытом периметре | `live/`, `modules/`, `scripts/`, `Dockerfile` | +| [infra/sarex-terraform-provider](https://gitlab.sarex.io/infra/sarex-terraform-provider) ✅ | **Внутренние Terraform-провайдеры**, генерируемые из OpenAPI-спек продуктовых API (например `workspaces-api`). В публичный реестр не публикуются — ставятся через dev overrides | `providers/`, `internal/`, `examples/`, `Makefile` | +| [infra/iac-gpn](https://gitlab.sarex.io/infra/iac-gpn) ✅ | **GitOps-контур ГПН на ArgoCD** (не Flux): `root.yaml` + app-of-apps, конфигмапы бэкендов, образ `terraform-contour-stronghold` | `argocd/{root.yaml,apps}`, `infrastructure/*-configmaps`, `images/` | +| [infra/poc/iac](https://gitlab.sarex.io/infra/poc/iac) ✅ | **Предшественник/PoC** текущего Flux-репозитория. Последняя активность 2026-02-16 — считать архивом | `clusters/`, `apps/`, `infra/`, `GUIDE.md` | + +--- + +## 3. Провижининг: от железа до кластера + +| Репозиторий | Отвечает за | +|---|---| +| [infra/kubespray](https://gitlab.sarex.io/infra/kubespray) ✅ | Форк upstream Kubespray — **развёртывание самих кластеров Kubernetes** на VM | +| [infra/k8s-provision](https://gitlab.sarex.io/infra/k8s-provision) ✅ | **Первичная обвязка свежего кластера**: `namespaces`, `cert_manager`, `istio` (+`ISTIO.md`), `ingress`, `dashboard`, `prometheus`, `postgres`/`ya_postgres`, `rabbitmq`, `pvc`, `gitlab`, `teamcity`, `migration` | +| [infra/ansible-playbooks](https://gitlab.sarex.io/infra/ansible-playbooks) ✅ | Зонтичный Ansible-репозиторий: каталоги `minio/`, `patroni/` | +| [infra/ansible-patroni-cluster](https://gitlab.sarex.io/infra/ansible-patroni-cluster) ✅ | **PostgreSQL HA на VM через Patroni** (`site.yml`, `roles/`, `inventory/`, `test.yml`) | +| [infra/ansible-minio-cluster](https://gitlab.sarex.io/infra/ansible-minio-cluster) ✅ | **MinIO-кластер на VM** + сценарии проверок `fault-tolerance-test.yml`, `heal-test.yml` | +| [infra/tools/ansible-vm-preparing](https://gitlab.sarex.io/infra/tools/ansible-vm-preparing) ✅ | Подготовка VM перед Ansible/Kubespray (Python-обвязка, `uv`). README — шаблонный, назначение по коду | +| [infra/hardware](https://gitlab.sarex.io/infra/hardware) ◻️ | Учёт/конфигурация физического оборудования | +| [infra/astra-linux](https://gitlab.sarex.io/infra/astra-linux) ◻️ | Сборка/настройка образов Astra Linux для импортозамещённых контуров | +| [infra/intervpc-vpn-tunnel](https://gitlab.sarex.io/infra/intervpc-vpn-tunnel) ◻️ | VPN-туннель между VPC | +| [infra/cluster-maintenance](https://gitlab.sarex.io/infra/cluster-maintenance) ◻️ | Регламентные операции обслуживания кластеров | + +--- + +## 4. Компонентные репозитории (`.helm/` + GitLab CI, ветка = контур) + +Формат ниже: **компонент → репозиторий**. Столбец «в `iac`» показывает, есть ли одноимённый +компонент в этом монорепозитории (`infrastructure/<имя>`). + +### 4.1 Сеть, Ingress, Service Mesh + +| Компонент | Репозиторий | в `iac` | +|---|---|---| +| Istio (base/pilot/gateway) | [infra/istio](https://gitlab.sarex.io/infra/istio) `infra` | ✔ `istio-base`, `istio-pilot`, `istio-gateway` | +| Istio: Gateway/VirtualService/AuthPolicy/EnvoyFilter | [infra/istio-config](https://gitlab.sarex.io/infra/istio-config) ✅ ветки `stage`,`preprod`,`contour`,`infra`,`master` | ✔ `istio-config` | +| Istio для контура НН | [infra/istio-nn](https://gitlab.sarex.io/infra/istio-nn) ◻️ | — | +| cert-manager | [infra/cert-manager](https://gitlab.sarex.io/infra/cert-manager) ◻️ | ✔ `cert-manager` | +| nginx (ingress для Django) | [infra/ingress-nginx-django](https://gitlab.sarex.io/infra/ingress-nginx-django) ◻️ | — | +| nginx с Kerberos / hardened nginx | [infra/nginx-krb](https://gitlab.sarex.io/infra/nginx-krb), [infra/secure-nginx](https://gitlab.sarex.io/infra/secure-nginx) ◻️ | — | + +### 4.2 Identity, доступ, безопасность + +| Компонент | Репозиторий | в `iac` | +|---|---|---| +| Keycloak | [infra/keycloak](https://gitlab.sarex.io/infra/keycloak) ◻️ | ✔ `keycloak` | +| Zitadel | [infra/zitadel](https://gitlab.sarex.io/infra/zitadel) ◻️ | ✔ `zitadel` | +| Zitadel auth proxy | [infra/zitadel-auth-proxy](https://gitlab.sarex.io/infra/zitadel-auth-proxy) ◻️ | — | +| OpenLDAP | [infra/openldap](https://gitlab.sarex.io/infra/openldap) `contour` ◻️ | ✔ `openldap` | +| HashiCorp Vault | [infra/vault](https://gitlab.sarex.io/infra/vault) ✅ `contour` | ✔ `vault`, `vault-unseal` | +| SpiceDB (авторизация) | [infra/spicedb](https://gitlab.sarex.io/infra/spicedb) ◻️ | — | +| OAuth2-фасад / gatekeeper | [infra/oauth2-facade](https://gitlab.sarex.io/infra/oauth2-facade), [infra/gogatekeeper](https://gitlab.sarex.io/infra/gogatekeeper) ◻️ | — | +| Фильтрация JWKS | [infra/jwks-key-filter](https://gitlab.sarex.io/infra/jwks-key-filter) ◻️ | — | +| Django ↔ Keycloak (библиотека) | [infra/django-keycloak](https://gitlab.sarex.io/infra/django-keycloak) ✅ | — | +| Сканирование секретов / образов | [infra/gitleaks](https://gitlab.sarex.io/infra/gitleaks), [infra/clair](https://gitlab.sarex.io/infra/clair), [infra/sec/report](https://gitlab.sarex.io/infra/sec/report) ◻️ | — | + +### 4.3 Данные и хранилища + +| Компонент | Репозиторий | в `iac` | +|---|---|---| +| PostgreSQL | [infra/postgresql](https://gitlab.sarex.io/infra/postgresql) ветки `contour`,`contour-13`,`preprod`,`stronghold` ✅ | ✔ `postgresql` | +| PostgreSQL 16 (контур WB) | [infra/wb/postgresql16](https://gitlab.sarex.io/infra/wb/postgresql16) ◻️ | — | +| pg_partman / TimescaleDB / CockroachDB | [infra/postgres-pgpartman](https://gitlab.sarex.io/infra/postgres-pgpartman), [infra/timescaledb](https://gitlab.sarex.io/infra/timescaledb), [infra/cockroachdb](https://gitlab.sarex.io/infra/cockroachdb) ◻️ | — | +| Redis | [infra/redis](https://gitlab.sarex.io/infra/redis) ✅ `contour` | ✔ `redis` | +| MinIO (в k8s) | [infra/minio-standalone](https://gitlab.sarex.io/infra/minio-standalone) `contour` ◻️ | ✔ `minio` | +| ClickHouse (+оператор) | [infra/clickhouse](https://gitlab.sarex.io/infra/clickhouse), [infra/clickhouse-operator](https://gitlab.sarex.io/infra/clickhouse-operator) ◻️ | — | +| OpenSearch (+оператор) | [infra/opensearch](https://gitlab.sarex.io/infra/opensearch), [infra/opensearch-operator](https://gitlab.sarex.io/infra/opensearch-operator) ◻️ | — | +| S3-прокси | — (только в `iac`) | ✔ `s3-proxy` | + +### 4.4 Брокеры и обмен сообщениями + +| Компонент | Репозиторий | в `iac` | +|---|---|---| +| Kafka | [infra/kafka](https://gitlab.sarex.io/infra/kafka) ветки `stage`,`preprod`,`brusnika-*` ✅ | ✔ `kafka` | +| Kafka standalone (контур НН) | [infra/kafka-nn](https://gitlab.sarex.io/infra/kafka-nn) ◻️ | — | +| Strimzi/Kafka-оператор | [infra/kafka-operator](https://gitlab.sarex.io/infra/kafka-operator) ◻️ | — | +| Kafka exporter | [infra/kafka-exporter](https://gitlab.sarex.io/infra/kafka-exporter) ◻️ | ✔ `kafka-exporter` | +| Маршрутизация между Kafka-кластерами | [infra/kafka-router](https://gitlab.sarex.io/infra/kafka-router) ✅ | — | +| Kafka → Vector мост | [infra/kafka-vector-bridge](https://gitlab.sarex.io/infra/kafka-vector-bridge) ◻️ | — | +| RabbitMQ (+оператор, контур НН) | [infra/rabbitmq](https://gitlab.sarex.io/infra/rabbitmq), [infra/rabbitmq-cluster-operator](https://gitlab.sarex.io/infra/rabbitmq-cluster-operator), [infra/rabbitmq-nn](https://gitlab.sarex.io/infra/rabbitmq-nn) ◻️ | ✔ `rabbitmq` | + +### 4.5 Наблюдаемость + +| Компонент | Репозиторий | в `iac` | +|---|---|---| +| kube-prometheus-stack | [infra/kube-prometheus-stack](https://gitlab.sarex.io/infra/kube-prometheus-stack) ✅ `infra` | ✔ `prometheus-stack` | +| prometheus-stack (описан как «A complete monitoring stack for Kubernetes») | [infra/prometheus-stack](https://gitlab.sarex.io/infra/prometheus-stack) `stage` | ✔ `prometheus-stack` | +| Алерты и дашборды для Prometheus/Grafana | [infra/prometheus-stsack-resources](https://gitlab.sarex.io/infra/prometheus-stsack-resources) *(опечатка в имени — так в GitLab)* | — | +| VictoriaMetrics stack / cluster | [infra/vm-stack](https://gitlab.sarex.io/infra/vm-stack), [infra/vm-cluster](https://gitlab.sarex.io/infra/vm-cluster) ◻️ | ✔ `vmstack` | +| Экспортеры: node / postgres / blackbox | [infra/node-exporter](https://gitlab.sarex.io/infra/node-exporter), [infra/postgres-exporter](https://gitlab.sarex.io/infra/postgres-exporter), [infra/blackbox-exporter](https://gitlab.sarex.io/infra/blackbox-exporter) ◻️ | ✔ `postgres-exporter` | +| OpenObserve | [infra/openobserve](https://gitlab.sarex.io/infra/openobserve) ветка `contour/cps` ✅ | ✔ `openobserve` | +| Loki / SigNoz | [infra/loki](https://gitlab.sarex.io/infra/loki), [infra/signoz](https://gitlab.sarex.io/infra/signoz) ◻️ | — | +| Sentry / GlitchTip | [infra/sentry](https://gitlab.sarex.io/infra/sentry), [infra/glitchtip](https://gitlab.sarex.io/infra/glitchtip) `contour/cps` ◻️ | ✔ `glitchtip` | +| GoAlert (+ исходники, + Telegram-релей) | [infra/goalert](https://gitlab.sarex.io/infra/goalert), [infra/goalert-source](https://gitlab.sarex.io/infra/goalert-source), [infra/goalert-telegram-relay](https://gitlab.sarex.io/infra/goalert-telegram-relay) ◻️ | ✔ `goalert` | +| OpenTelemetry collector / operator | [infra/opentelemetry-collector](https://gitlab.sarex.io/infra/opentelemetry-collector), [infra/opentelemetry-operator](https://gitlab.sarex.io/infra/opentelemetry-operator) ◻️ | ✔ `opentelemetry-collector`, `opentelemetry-operator` | +| eBPF-экспортер OTel | [infra/otel-ebpf-exporter](https://gitlab.sarex.io/infra/otel-ebpf-exporter) ◻️ | — | +| Конвейер телеметрии: OTel → Kafka → ClickHouse | [infra/otel-kafka-processor](https://gitlab.sarex.io/infra/otel-kafka-processor), [infra/otel-kafka-clickhouse-worker](https://gitlab.sarex.io/infra/otel-kafka-clickhouse-worker) ◻️ | — | +| SDK-обвязки инструментирования | [infra/otel/django-otel-tools](https://gitlab.sarex.io/infra/otel/django-otel-tools), [infra/otel/fastapi-otel-tools](https://gitlab.sarex.io/infra/otel/fastapi-otel-tools), [infra/golang-fiber-otel-tools](https://gitlab.sarex.io/infra/golang-fiber-otel-tools), [infra/golang-net-http-otel-tools](https://gitlab.sarex.io/infra/golang-net-http-otel-tools), [infra/django-instrumented](https://gitlab.sarex.io/infra/django-instrumented), [infra/djano-autoinstrumentation](https://gitlab.sarex.io/infra/djano-autoinstrumentation) ◻️ | — | +| PMM, Trickster, отчёты по Prometheus | [infra/pmm](https://gitlab.sarex.io/infra/pmm), [infra/trickster](https://gitlab.sarex.io/infra/trickster), [infra/prometheus-report](https://gitlab.sarex.io/infra/prometheus-report) ◻️ | — | +| SIEM-шиппер (+UI) | [infra/siem-shiper](https://gitlab.sarex.io/infra/siem-shiper), [infra/siem-shiper-frontend](https://gitlab.sarex.io/infra/siem-shiper-frontend) ◻️ | — | + +### 4.6 Платформа, аналитика, BPM + +| Компонент | Репозиторий | в `iac` | +|---|---|---| +| Kubernetes Dashboard | [infra/dashboard](https://gitlab.sarex.io/infra/dashboard) ◻️ | ✔ `dashboard` | +| local-path-provisioner | [infra/local-path-provisioner-nn](https://gitlab.sarex.io/infra/local-path-provisioner-nn) ◻️ | ✔ `local-path-provisioner` | +| Camunda (+ модели процессов) | [infra/camunda](https://gitlab.sarex.io/infra/camunda) `camunda-prod`, [infra/camunda-processes](https://gitlab.sarex.io/infra/camunda-processes) ◻️ | ✔ `camunda` | +| Argo Workflows / Argo Events | [infra/argo-workflows](https://gitlab.sarex.io/infra/argo-workflows), [infra/argo-events](https://gitlab.sarex.io/infra/argo-events) ◻️ | ✔ `argo-workflows`, `argo-events` | +| Superset / Trino | [infra/superset](https://gitlab.sarex.io/infra/superset), [infra/trino](https://gitlab.sarex.io/infra/trino) ◻️ | ✔ `superset`, `trino` | +| Jupyter, BI-эксперименты, ETL, ГИС | [infra/jupyter-notebook](https://gitlab.sarex.io/infra/jupyter-notebook), [infra/bi-test](https://gitlab.sarex.io/infra/bi-test), [infra/etl](https://gitlab.sarex.io/infra/etl), [infra/sarex-gis](https://gitlab.sarex.io/infra/sarex-gis) ◻️ | — | +| Mailer | [infra/mailer](https://gitlab.sarex.io/infra/mailer) ◻️ | — | + +### 4.7 CI/CD и Git-инфраструктура + +| Компонент | Репозиторий | +|---|---| +| GitLab Runner | [infra/gitlab-runner](https://gitlab.sarex.io/infra/gitlab-runner) ✅ (`.helm` + CI) | +| Gitea (Git-зеркала для изолированных контуров) | [infra/gitea](https://gitlab.sarex.io/infra/gitea) ◻️ — см. §5, Flux в закрытых контурах читает `iac` именно из Gitea | +| ChartMuseum (реестр Helm-чартов) | [infra/chart-museum](https://gitlab.sarex.io/infra/chart-museum) ◻️ | +| Базовые Docker-образы | [infra/base-images](https://gitlab.sarex.io/infra/base-images) ◻️ | +| Миграция и утилиты GitLab | [infra/gitlab-migrator](https://gitlab.sarex.io/infra/gitlab-migrator), [infra/gitlab-tools](https://gitlab.sarex.io/infra/gitlab-tools) ◻️ | + +### 4.8 Библиотеки чартов + +| Репозиторий | Отвечает за | +|---|---| +| [infra/universal-helm-chart](https://gitlab.sarex.io/infra/universal-helm-chart) ✅ | Универсальный чарт (`.helm/`), на который ссылаются HelmRelease в `iac` (`openobserve`, `glitchtip` — `chart: universal-chart`) | +| [infra/common-charts](https://gitlab.sarex.io/infra/common-charts) ✅ | Общие чарты, сейчас — `universal-static-site` | +| [infra/helm-values-extractor](https://gitlab.sarex.io/infra/helm-values-extractor) ◻️ | Извлечение `values` из работающих релизов (ветка `draft-script`) | +| [infra/poc/itworksonmyhelm](https://gitlab.sarex.io/infra/poc/itworksonmyhelm), [infra/wb/helm-of-business](https://gitlab.sarex.io/infra/wb/helm-of-business) ◻️ | Эксперименты/контурные наборы чартов | + +--- + +## 5. Что внутри `infra/iac` + +### 5.1 Кластеры и откуда Flux их читает + +Точка входа Flux — `clusters/<кластер>/`. Источник (`gotk-sync.yaml`) различается: кластеры в +периметре Yandex Cloud смотрят прямо в GitLab, изолированные контуры — в **зеркало Gitea**. + +| Кластер | Git-источник Flux | Состав | +|---|---|---| +| `yc-infra-prod` | `gitlab.sarex.io/infra/iac` | argo-workflows, argo-events, postgresql, pg-sanitizer, vault, vault-unseal, yc-pg-dumper | +| `yc-k8s-test` | `gitlab.sarex.io/infra/iac` | `bootstrap-jobs`, состав задаётся в `kustomization.yaml` кластера | +| `yc-k8s-test-02` | `gitlab.sarex.io/infra/iac` | istio (base/pilot/gateway/config), dashboard, local-path-provisioner, minio, rabbitmq, kafka, redis, camunda, postgresql, zitadel, keycloak, vault | +| `yc-cps-prod` | `gitea.cloud.cps.sarex.lonsdaleites.ru/sarex/iac` | vault, istio, gitea-istio | +| `yc-ecp` | `gitea.invest.cps.sarex.lonsdaleites.ru/sarex/iac` | cert-manager, istio-config, dashboard, vault; apps: measurements, django, s3-proxy, s3-proxy-bim | +| `brusnika-prod` | `gitea.prod.brusnika.sarex.lonsdaleites.ru/sarex/iac` | istio, vault, zitadel, minio, openobserve, vmstack, otel operator/collector, goalert, экспортеры, failed-pod-cleanup | +| `brusnika-stage` | `gitea.stage.brusnika.sarex.lonsdaleites.ru/sarex/iac` | то же без minio | +| `wb` | `gitea-srx.wb.ru/sarex/iac` | istio-config, openobserve, vmstack, otel, goalert, экспортеры, superset, trino | +| `d8-ugmk-prod` | `10.222.255.165:3000/infra/iac` (Gitea) | только `istio-ingress` | +| `contour` | — (шаблон: `apps.yaml`, `infrastructure.yaml`, `helm-repositories.yaml`) | эталонная точка входа из README | + +### 5.2 `infrastructure/` — 36 компонентов + +`argo-events` · `argo-workflows` · `camunda` · `cert-manager` · `dashboard` · `example-infra` · +`failed-pod-cleanup` · `glitchtip` · `goalert` · `istio-base` · `istio-config` · `istio-gateway` · +`istio-pilot` · `kafka` · `kafka-exporter` · `keycloak` · `local-path-provisioner` · `minio` · +`openldap` · `openobserve` · `opentelemetry-collector` · `opentelemetry-operator` · `pg-sanitizer` · +`postgres-exporter` · `postgresql` · `prometheus-stack` · `rabbitmq` · `redis` · `s3-proxy` · +`superset` · `trino` · `vault` · `vault-unseal` · `vmstack` · `yc-pg-dumper` · `zitadel` + +Структура компонента: `base/` (namespace + HelmRelease/манифесты) + `patches/` + `kustomization.yaml`. + +### 5.3 `apps/` — 37 прикладных сервисов + +> ⚠️ `apps/` — **только манифесты деплоя**. Исходный код сервисов живёт в других группах GitLab +> (`platform`, `pdm`, `proc`, `planning`, `aero`, `generic`) — полная карта в **[§5.3.8](#538-где-лежит-код-приложений)**. +> Образы приезжают из одного реестра: `cr.yandex/crp3ccidau046kdj8g9q/<сервис>:<тег>`. + +#### 5.3.1 Единый шаблон приложения + +``` +apps// +├── base/ # общий для всех кластеров слой +│ ├── namespace.yaml # namespace = имя приложения +│ ├── <компонент>.yaml # HelmRelease на universal-chart (по одному на процесс) +│ └── kustomization.yaml +├── <кластер>/ # оверлей: brusnika-prod | brusnika-stage | d8-ugmk-prod | +│ └── kustomization.yaml # yc-ecp | yc-k8s-test | dsinv +├── .env.example # ─┐ +├── CONFIGURATION.md # │ «паспорт сервиса» — документация рядом с деплоем +├── ENDPOINTS.md # │ +└── openapi.yaml # ─┘ +``` + +Каждый процесс сервиса — отдельный `HelmRelease` на **общем чарте**: + +```yaml +chart: universal-chart # версия 0.1.9 (у 6 приложений осталась 0.1.7) +sourceRef: HelmRepository/yc-oci-charts # OCI-реестр cr.yandex, ns flux-system +values: + global: { env: _default } # ключ окружения + services: + backend: + image: { name: { _default: cr.yandex/…/bim-api:contour_f9f2a39-dirty } } + deployment: { replicaCount: {_default: 1}, port: {_default: 8000}, probes: … } + service: { name: {_default: backend-svc}, port: {_default: 80} } + imagePullSecrets: { name: { _default: regcred } } + envs: [ … ] + podAnnotations: { _default: { vault.hashicorp.com/*: … } } +``` + +Особенности, общие почти для всех приложений: + +- **все значения обёрнуты в `_default`** — механизм пер-окруженческих переопределений + `universal-chart` (`global.env` выбирает ключ); +- **секреты не хранятся в git** — их подставляет **Vault Agent Injector** через + `podAnnotations` (§5.3.5); +- `traffic.sidecar.istio.io/excludeOutboundPorts: "8200"` — обращение к Vault мимо sidecar Istio; +- поля `commitSha`/`gitlabUri`/`gitlabJobUrl`/`owner` в базовом слое пустые — заполняются CI. + +**Исключения:** `resources` и `subscriptions` описаны голыми `Deployment`+`Service`+`ServiceAccount` +без `HelmRelease`; у `ams-sync` и `control-interface` в `base/` нет `Namespace`. + +#### 5.3.2 Состав приложений + +Обозначения кластеров: **B** `brusnika-prod` · **S** `brusnika-stage` · **U** `d8-ugmk-prod` · +**E** `yc-ecp` · **T** `yc-k8s-test`. Код в скобках — **оверлей есть, но кластер его не подключает**. + +| Приложение | ns | Компоненты (HelmRelease) | Образы `…/crp3ccidau046kdj8g9q/` | Кластеры | +|---|---|---|---|---| +| `ams-sync` | — | `ams-sync` | `ams-sync` | S | +| `attachments` | `attachments` | `attachments` | `att9` | (B) S U T | +| `auth-flow` | `auth-flow` | `frontend` | `auth-flow-frontend` | (B) S U T | +| `bim` | `bim` | `backend` | `bim-api` | B S U T | +| `cde` | `cde` | **13**: `cde` + `cde-splitpdf`, `cde-flowscallback`, `cde-worker-{alert,copy,copyv2,create-versions,create-versionsv2,markings,markingsv2,sign,signv2,update-bundles}` | `cde`, `orchestrator`, 11 × `*-worker` | (B) (S) U T | +| `checklists` | `checklists` | `checklists` | `checklists-backend` | B S U T | +| `comparisons` | `comparisons` | `backend`, `frontend` + 2 ConfigMap | `comparisons_backend_prod`, `comparisons-frontend` | (B) (S) U T | +| `contracts` | `contracts` | `contracts` | `contracts` | B S U T | +| `control-interface` | — | `frontend` | `srx-admin` | B S U T | +| `cross-section` | `cross-section` | `cross-section-static` | `cross-section-app` | (B) (S) U T | +| `django` | `django` | `backend`, `celery`, `frontend`, `srx-admin-frontend`, `s3-proxy` + Deployment/Service `redis` + ConfigMap `django`/`nginx`/`uwsgi`/`zitadel` | `backend`, `sarex-frontend-dev`, `srx-admin`, `s3-proxy`, `redis` | B S U **E** T | +| `document-link` | `document-link` | `frontend` | `document-link-frontend` | B S U (T) | +| `documentations` | `documentations` | `documentations-api`, `-filestream`, `-hasher`, `-pdf-markings-amqp`, `pdm-api`, `frontend` + Deployment `redis` | `documentations`, `documentations-api-files`, `hasher`, `pdf-markings-amqp`, `pdmv2`, `documentation-frontend-app`, `redis` | B S U T | +| `drawings` | `drawings` | `backend` | `drawings-api` | B S U T | +| `eav` | `eav` | `backend` + ConfigMap | `eav` | B S U T | +| `faas` | `faas` | `export-reviews` | `export-reviews` | (B) (S) U T | +| `flows` | `flows` | `backend`, `celery`, `frontend` | `flows-backend`, `flows-backend_worker`, `flows-frontend` | B S U T | +| `iam` | `iam` | `iam-backend` + ConfigMap | `iams` | (B) S U (T) | +| `inspections` | `inspections` | `backend` | `sarex-inspections`, `notification:email` | B (S) U T | +| `issues` | `issues` | `backend`, `celery`, `frontend` + Deployment/Service `redis` + ConfigMap | `issues`, `contour_issues-frontend`, `redis` | B S U T | +| `mapper` | `mapper` | `backend` | `mapper` | B S U T | +| `measurements` | `measurements` | `measurements` | `measurements` | B S U **E** T | +| `message-hub` | `message-hub` | `message-hub` | `message-hub` | B S U T | +| `notes` | `notes` | `backend`, `frontend` + ConfigMap | `notes-backend`, `notes-frontend` | B S U T | +| `pm` | `pm` | `backend`, `celery`, `frontend`, `resources-static` + ConfigMap | `pm-backend`, `pm-frontend`, `resources-frontend` | B S U T | +| `prescriptions` | `prescriptions` | `frontend` | `prescriptions-frontend` | (B) (S) U T | +| `processing` | `processing` | `workflows-api`, `engine`, `engine-low`, `frontend` + Role/RoleBinding | `workflows-api_prod`, `workflows-engine`, `workflows-endigne_prod`, `workflows-frontend` | B S U T | +| `projects` | `projects` | `frontend` | `project-frontend-app` | (B) S U T | +| `remarks` | `remarks` | `frontend` | `remarks-frontend` | B S U T | +| `resources` | `resources` | — *(Deployment + Service + SA + 2 ConfigMap)* | `sarex-resources` | B S T | +| `reviews` | `reviews` | `frontend` | `reviews-frontend` | B S U T | +| `rfi` | `rfi` | `backend`, `celery`, `frontend` | `rfi-backend`, `rfi-frontend` | B S U T | +| `stamp-verification` | `stamp-verification` | `frontend` | `stamp-verification-frontend` | U T | +| `subscriptions` | `subscriptions` | — *(Deployment + Service + SA)* | `subscriptions` | B S U T | +| `system-log` | `system-log` | `api`, `worker` | `system-log_prod`, `system-log-worker_prod` | B S U T | +| `transmittal` | `transmittal` | `backend`, `frontend`, `worker` | `transmittal-api`, `transmittal-frontend` | B S U T | +| `workspaces` | `workspaces` | `backend`, `frontend` | `workspaces`, `workspaces-v2-frontend` | B S U T | + +**Как читать состав.** Типовой backend-сервис = `backend` (API) + `celery`/`worker` (асинхронные +задачи) + `frontend` (статика). Девять приложений — **чисто фронтендовые**: `auth-flow`, +`control-interface`, `cross-section`, `document-link`, `prescriptions`, `projects`, `remarks`, +`reviews`, `stamp-verification`. Самое крупное — `cde` (13 релизов: оркестратор + 11 воркеров +по типам операций над документами). + +#### 5.3.3 Где приложения реально разворачиваются + +| Кластер | Приложений подключено | Комментарий | +|---|---|---| +| `d8-ugmk-prod` | **35** | самый полный контур | +| `yc-k8s-test` | **34** | тестовый, близок к полному | +| `brusnika-stage` | **30** | | +| `brusnika-prod` | **26** | | +| `yc-ecp` | **2** | только `django` и `measurements` | +| `wb`, `yc-cps-prod`, `yc-infra-prod`, `yc-k8s-test-02`, `contour` | **0** | приложений из `apps/` не деплоят: эти кластеры несут только `infrastructure/` | + +**Мёртвые и неподключённые оверлеи** — каталог существует, но ни один +`clusters/*/kustomization.yaml` на него не ссылается, то есть Flux его не применяет: + +| Кластер | Неподключённые оверлеи | +|---|---| +| `brusnika-prod` | `attachments`, `auth-flow`, `cde`, `comparisons`, `cross-section`, `faas`, `iam`, `prescriptions`, `projects` | +| `brusnika-stage` | `cde`, `comparisons`, `cross-section`, `faas`, `inspections`, `prescriptions` | +| `yc-k8s-test` | `document-link`, `iam` | + +Отдельно **`dsinv/`** — оверлей у **25 приложений**, но **кластера `clusters/dsinv/` не существует** +и никто на него не ссылается. Судя по содержимому (готовые `Deployment` с `SERVICE_URL=https://srx.wb.ru`) +и по каталогу `snapshots/dsinv/`, это **материализованный снимок живого контура WB**, а не рабочий +оверлей. Использовать как справочник «что реально крутится», не как источник деплоя. + +#### 5.3.4 Две несовместимые конвенции оверлеев ⚠️ + +| Кластер | Как устроен оверлей | Приложений | +|---|---|---| +| `d8-ugmk-prod`, `yc-k8s-test`, `dsinv` | ✅ **наследует `base`**: `resources: [../base]` + `patches:` | 35 / 36 / 25 | +| `brusnika-prod`, `brusnika-stage`, `yc-ecp` | ⚠️ **самостоятельный**: `base` не подключается, `HelmRelease` скопирован целиком | 35 / 36 / 2 | + +Последствие — **тихий дрейф**. Пример: `apps/bim/base/backend.yaml` использует +`universal-chart` **0.1.9**, а его полная копия `apps/bim/brusnika-prod/backend.yaml` — **0.1.7**. +Правка в `base/` до контуров Брусники не доедет, и никакой ошибки при этом не возникнет. + +Это же объясняет разнобой версий чарта: 0.1.7 остался у `ams-sync`, `auth-flow`, +`control-interface`, `cross-section`, `remarks`, `reviews`. + +#### 5.3.5 Секреты: Vault Agent Injector + +Пароли БД в git не лежат. Под получает их файлом от sidecar-инжектора Vault: + +```yaml +vault.hashicorp.com/agent-inject: "true" +vault.hashicorp.com/agent-init-first: "true" +vault.hashicorp.com/agent-pre-populate-only: "true" # только init-контейнер, без постоянного sidecar +vault.hashicorp.com/auth-path: auth/kubernetes +vault.hashicorp.com/role: bim # роль = имя приложения +vault.hashicorp.com/agent-inject-secret-bim-postgresql: secrets/data/apps/bim/postgres +vault.hashicorp.com/agent-inject-template-bim-postgresql: |- # → env-файл + POSTGRES_ADDRESS={{ index .Data.data "host" }} … +``` + +Дальше контейнер стартует как `sh -ec 'set -a; . /vault/secrets/; set +a; exec ./httpserver'`. + +**Соглашение о путях:** `secrets/data/apps/<приложение>/postgres`; нестандартные — +`documentations/hasher/{rabbitmq,s3}`, `documentations/marks-s3`. +Соответствующие ServiceAccount называются `-vault`. + +Vault используют **26 приложений**. Больше всего инъекций — у `cde` (13), `documentations` (5), +`django` и `processing` (по 3). **Не используют** ровно те, у кого нет БД: девять фронтендов +(§5.3.2) плюс `ams-sync` и `faas`. + +> Сами БД, пользователи и бакеты, на которые ссылаются эти пути, создаются не здесь, +> а в [infra/terraform](https://gitlab.sarex.io/infra/terraform) (`infrastructure.yaml`). + +#### 5.3.6 Документация рядом с манифестами + +Нетипичная и полезная особенность: в каталоге приложения лежит его «паспорт». + +| Файл | Что внутри | Покрытие | +|---|---|---| +| `CONFIGURATION.md` | все переменные окружения, как они разбираются в коде, и **откуда берутся при каждом способе запуска** (локально / docker-compose / Helm в репозитории приложения / IaC+Vault / GitLab CI); команды и точки входа процессов | 32 / 37 | +| `ENDPOINTS.md` | **исходящие** HTTP-вызовы сервиса: библиотека клиента, таймауты, ретраи, проброс JWT, базовые хосты по окружениям, таблица методов и путей | 28 / 37 | +| `openapi.yaml` | **входящие** эндпоинты — спецификация того, что сервис предоставляет (от 9 КБ у `mapper` до 101 КБ у `issues`) | 25 / 37 | +| `.env.example` | образец переменных с комментариями | 32 / 37 | + +Многокомпонентные приложения используют префиксы вместо одного файла: у `documentations` — +`api.*`, `api-v2.*`, `pdm.*`, `frontend.*`, `dps-message-hub.*`; у `processing` — +`workflows-api.*`, `workflows-engine.*`, `workflows-frontend.*`; у `workspaces` — +`ENDPOINTS-workspaces-frontend.md` и `ENDPOINTS-workspace-v2-frontend.md`. + +**Пробелы в документации:** + +- нет `CONFIGURATION.md`: `control-interface`, `cross-section`, `faas`, `remarks`, `reviews`; +- нет `ENDPOINTS.md`: `attachments`, `checklists`, `drawings`, `eav`, `faas`, `measurements`, + `resources`, `subscriptions`, `system-log`; +- нет диаграммы в `docs/apps/`: `ams-sync`, `auth-flow`, `iam` *(остальные 34 покрыты)*. + +Дополняющий слой — [`docs/apps/`](./docs/apps/README.md): по mermaid-диаграмме на сервис +с его зависимостями, сгруппированные по доменам — Платформа/Core, Управление проектом, +Документы/CDE, Контроль качества, Полевые данные. + +#### 5.3.7 Внешние маршруты + +Правила Istio живут не в `apps/`, а в `infrastructure/istio-config/<кластер>` и в патчах кластеров. +Пример готовой карты маршрутов (`yc-ecp`): + +| Путь | Сервис назначения | +|---|---| +| `/api`, `/admin/` | `backend-service.django` | +| `/media/` | `s3-service.django` | +| `/s3/` | `s3-bim-service.django` | +| `/eav/api/`, `/eav/admin/` | `eav-service.eav` | +| `/bim-gazpromcps/{api,files}/` | `bim-api-gazpromcps-service.bim` | +| `/bim2-gazpromcps/api/` | `bim-backend-v2-service.bim` | +| `/workflows/api/` | `workflows-backend-service.processing` | +| `/projects/static/` | `projects-frontend-static-service.projects` | + +В контурах Брусники и WB прикладной трафик уходит одним правилом на +`nginx-service.global-ingress` — пути до конкретных сервисов раскрываются уже там, **вне этого +репозитория**. Через Istio там опубликованы только платформенные UI (Gitea, GoAlert, OpenObserve, +Superset, Kubernetes Dashboard, Camunda, Jupyter). + +#### 5.3.8 Где лежит код приложений + +Исходники продуктовых сервисов — **вне группы `infra`**: 14 групп верхнего уровня, ~393 проекта. +Ориентир по владению: + +| Группа | Домен | Что оттуда деплоится из `apps/` | +|---|---|---| +| [`platform`](https://gitlab.sarex.io/groups/platform) (95) | платформенное ядро, BIM, workflows, tracking | `bim`, `iam`, `mapper`, `contracts`, `eav`, `system-log`, `processing`, `control-interface`, `resources`, `ams-sync`, `auth-flow`, `cde` | +| [`pdm`](https://gitlab.sarex.io/groups/pdm) (41) | документооборот, CDE, PDF | `documentations`, `attachments`, `transmittal`, `workspaces`, `document-link`, `stamp-verification`, `subscriptions`, `comparisons` | +| [`proc`](https://gitlab.sarex.io/groups/proc) (24) | процессы и контроль качества | `inspections`, `issues`, `rfi`, `reviews`, `checklists`, `flows`, `remarks`, `prescriptions`, `faas` | +| [`planning`](https://gitlab.sarex.io/groups/planning) (10) | планирование | `pm`, `projects`, `message-hub` | +| [`aero`](https://gitlab.sarex.io/groups/aero) (50) | гео, полевые данные, обработка съёмки | `measurements`, `drawings`, `notes`, `cross-section` | +| [`generic`](https://gitlab.sarex.io/groups/generic) (56) | сквозное: монолит, CI-шаблоны, утилиты | `django` | +| [`algorithms`](https://gitlab.sarex.io/groups/algorithms) (82), [`render`](https://gitlab.sarex.io/groups/render) (16) | вычислительные библиотеки, конвертеры, рендер | напрямую не деплоятся — используются джобами и воркерами | +| `ai`, `marketing`, `hackathon`, `product`, `algorithms1`, `planning1` | прочее / архив | — | + +**Карта «приложение → репозитории с кодом».** Ключ сопоставления — имя образа +`cr.yandex/crp3ccidau046kdj8g9q/` и заголовок `CONFIGURATION.md` / `ENDPOINTS.md`. + +| `apps/` | Компонент (образ) | Репозиторий с кодом | +|---|---|---| +| `ams-sync` | `ams-sync` | [platform/ams-sync](https://gitlab.sarex.io/platform/ams-sync) ✅ *(смежный: [platform/ams](https://gitlab.sarex.io/platform/ams))* | +| `attachments` | `att9` / `attachments` | [pdm/attachments](https://gitlab.sarex.io/pdm/attachments) ✅ | +| `auth-flow` | `auth-flow-frontend` | [platform/auth-flow-frontend](https://gitlab.sarex.io/platform/auth-flow-frontend) ✅ | +| `bim` | `bim-backend-v2` | [platform/bim-backend-v2](https://gitlab.sarex.io/platform/bim-backend-v2) ✅ | +| | `bim-api` (legacy) | [platform/bim](https://gitlab.sarex.io/platform/bim) ◻️ — репозитория с именем `bim-api` нет, привязка по смыслу | +| `cde` | `cde`, `orchestrator`, 11 × `*-worker` | [platform/cde-orchestration-demo](https://gitlab.sarex.io/platform/cde-orchestration-demo) ✅ | +| | смежные | [pdm/cde-api](https://gitlab.sarex.io/pdm/cde-api), [generic/cde-v2-write-service](https://gitlab.sarex.io/generic/cde-v2-write-service), [generic/level-cde-migration](https://gitlab.sarex.io/generic/level-cde-migration) | +| `checklists` | `checklists-backend` | [proc/checklists-backend](https://gitlab.sarex.io/proc/checklists-backend) ✅ | +| `comparisons` | `comparisons-backend` | [pdm/comparisons-backend](https://gitlab.sarex.io/pdm/comparisons-backend) ✅, v2 → [pdm/comparisons-api-v2](https://gitlab.sarex.io/pdm/comparisons-api-v2) | +| | `comparisons-frontend` | [platform/comparisons-frontend](https://gitlab.sarex.io/platform/comparisons-frontend) ✅ | +| | движок сравнения | [platform/comparator](https://gitlab.sarex.io/platform/comparator), [algorithms/comparator-algorithms](https://gitlab.sarex.io/algorithms/comparator-algorithms), [render/comparator-bins](https://gitlab.sarex.io/render/comparator-bins), [algorithms/diff-pdf-algorithm](https://gitlab.sarex.io/algorithms/diff-pdf-algorithm) | +| `contracts` | `contracts` | [platform/contracts](https://gitlab.sarex.io/platform/contracts) ✅ + [platform/contracts-frontend](https://gitlab.sarex.io/platform/contracts-frontend) ✅ | +| `control-interface` | `srx-admin` | [platform/srx-admin](https://gitlab.sarex.io/platform/srx-admin) ✅ | +| `cross-section` | `cross-section-app` | [aero/cross-section](https://gitlab.sarex.io/aero/cross-section) ✅ *(джоба: [aero/cross-secttions-to-dwg-job](https://gitlab.sarex.io/aero/cross-secttions-to-dwg-job))* | +| `django` | `backend` | [generic/sarex-backend](https://gitlab.sarex.io/generic/sarex-backend) ✅ | +| | `sarex-frontend-dev` | [generic/sarex-frontend](https://gitlab.sarex.io/generic/sarex-frontend) ✅ | +| | `s3-proxy` | [generic/s3-proxy](https://gitlab.sarex.io/generic/s3-proxy) ✅ | +| | `srx-admin` | [platform/srx-admin](https://gitlab.sarex.io/platform/srx-admin) ✅ | +| `document-link` | `document-link-frontend` | [pdm/document-link-frontend](https://gitlab.sarex.io/pdm/document-link-frontend) ✅ | +| `documentations` | `documentations` | [pdm/documentation-api](https://gitlab.sarex.io/pdm/documentation-api) ✅ | +| | `documentations-api-files` (v2) | [pdm/documentation-api-v2](https://gitlab.sarex.io/pdm/documentation-api-v2) ✅ | +| | `hasher` | [pdm/documentation-hasher](https://gitlab.sarex.io/pdm/documentation-hasher) ✅ | +| | `pdf-markings-amqp` | [pdm/pdf-markings](https://gitlab.sarex.io/pdm/pdf-markings) ✅ | +| | `pdmv2` | [pdm/pdm](https://gitlab.sarex.io/pdm/pdm) ✅ | +| | `documentation-frontend-app` | [pdm/documentation-frontend](https://gitlab.sarex.io/pdm/documentation-frontend) ✅ | +| | `dps-message-hub` | [pdm/dps_message_hub](https://gitlab.sarex.io/pdm/dps_message_hub) ✅ | +| `drawings` | `drawings-api` | [aero/drawings-api](https://gitlab.sarex.io/aero/drawings-api) ✅ | +| `eav` | `eav` | [platform/eav_python](https://gitlab.sarex.io/platform/eav_python) ✅ *(gRPC-ветка: [platform/eav](https://gitlab.sarex.io/platform/eav))* | +| `faas` | `export-reviews` | [proc/export-reviews](https://gitlab.sarex.io/proc/export-reviews) ✅ *(в GitLab называется `flows-export`)* | +| `flows` | `flows-backend`, `flows-backend_worker` | [proc/flows-backend](https://gitlab.sarex.io/proc/flows-backend) ✅ | +| | `flows-frontend` | [proc/flows-frontend](https://gitlab.sarex.io/proc/flows-frontend) ✅ | +| `iam` | `iams` | [platform/iams-v2](https://gitlab.sarex.io/platform/iams-v2) ✅ *(смежный: [platform/srx-rebac](https://gitlab.sarex.io/platform/srx-rebac))* | +| `inspections` | `sarex-inspections` | [proc/inspections-backend](https://gitlab.sarex.io/proc/inspections-backend) ✅ — подтверждено аннотацией `gitlab-uri` | +| | фронтенд | [proc/inspections-frontend](https://gitlab.sarex.io/proc/inspections-frontend) ✅ | +| | `notification:email` | [generic/jobs/email-notification-task](https://gitlab.sarex.io/generic/jobs/email-notification-task) ✅ | +| `issues` | `issues` | [proc/issues-backend](https://gitlab.sarex.io/proc/issues-backend) ✅ | +| | `contour_issues-frontend` | [proc/issues-frontend](https://gitlab.sarex.io/proc/issues-frontend) ✅ | +| | `crop-issue-pin-area` | [proc/crop-issue-pin-area-task](https://gitlab.sarex.io/proc/crop-issue-pin-area-task) ✅ | +| | `docx-to-pdf`, `rendering-template` | [pdm/docx-to-pdf](https://gitlab.sarex.io/pdm/docx-to-pdf), [pdm/rendering-template](https://gitlab.sarex.io/pdm/rendering-template) ✅ | +| | `webhook-caller` | [platform/webhook-caller](https://gitlab.sarex.io/platform/webhook-caller) ✅ | +| `mapper` | `mapper` | [platform/mapper](https://gitlab.sarex.io/platform/mapper) ✅ | +| `measurements` | `measurements` | [aero/measurements](https://gitlab.sarex.io/aero/measurements) ✅ | +| `message-hub` | `message-hub` | [planning/message-hub](https://gitlab.sarex.io/planning/message-hub) ✅ | +| `notes` | `notes-backend` / `notes-frontend` | [aero/notes-backend](https://gitlab.sarex.io/aero/notes-backend), [aero/notes-frontend](https://gitlab.sarex.io/aero/notes-frontend) ✅ | +| `pm` | `pm-backend` / `pm-frontend` | [planning/pm-backend](https://gitlab.sarex.io/planning/pm-backend), [planning/pm-frontend](https://gitlab.sarex.io/planning/pm-frontend) ✅ | +| | `resources-frontend` | [planning/resources-frontend](https://gitlab.sarex.io/planning/resources-frontend) ✅ | +| `prescriptions` | `prescriptions-frontend` | [proc/prescriptions-frontend](https://gitlab.sarex.io/proc/prescriptions-frontend) ✅ | +| `processing` | `workflows-api` | [platform/workflows-api](https://gitlab.sarex.io/platform/workflows-api) ✅ | +| | `workflows-engine`, `kubernetes-engine` | [platform/workflows-engine](https://gitlab.sarex.io/platform/workflows-engine) ✅ | +| | `workflows-frontend` | [platform/workflows-frontend](https://gitlab.sarex.io/platform/workflows-frontend) ✅ | +| | смежные | [platform/workflows-backend](https://gitlab.sarex.io/platform/workflows-backend), [generic/workflows-tools](https://gitlab.sarex.io/generic/workflows-tools), [generic/processing/job_template](https://gitlab.sarex.io/generic/processing/job_template) | +| `projects` | `project-frontend-app` / `projects-frontend` | [planning/projects-frontend](https://gitlab.sarex.io/planning/projects-frontend) ✅ *(API: [planning/projects-backend](https://gitlab.sarex.io/planning/projects-backend))* | +| `remarks` | `remarks-frontend` | [proc/remarks-frontend](https://gitlab.sarex.io/proc/remarks-frontend) ✅ | +| | `remarks-api`, `export-remarks` | ⚠️ [proc/remarks-api](https://gitlab.sarex.io/proc/remarks-api), [proc/export-remarks](https://gitlab.sarex.io/proc/export-remarks) — **помечены `_archived_`** в GitLab, но образы ещё встречаются в манифестах | +| `resources` | `sarex-resources` | [platform/sarex-resources](https://gitlab.sarex.io/platform/sarex-resources) ✅ *(старая копия: [generic/sarex-resources1](https://gitlab.sarex.io/generic/sarex-resources1))* | +| `reviews` | `reviews-frontend` | [proc/reviews-frontend](https://gitlab.sarex.io/proc/reviews-frontend) ✅ | +| `rfi` | `rfi-backend` / `rfi-frontend` | [proc/rfi-backend](https://gitlab.sarex.io/proc/rfi-backend), [proc/rfi-frontend](https://gitlab.sarex.io/proc/rfi-frontend) ✅ | +| `stamp-verification` | `stamp-verification-frontend` | [pdm/stamp-verification-frontend](https://gitlab.sarex.io/pdm/stamp-verification-frontend) ✅ | +| `subscriptions` | `subscriptions` / `sarex-subscriptions` | [pdm/sarex-subscriptions](https://gitlab.sarex.io/pdm/sarex-subscriptions) ✅ | +| `system-log` | `system-log` / `system-log-worker` | [platform/system-log](https://gitlab.sarex.io/platform/system-log), [platform/system-log-worker](https://gitlab.sarex.io/platform/system-log-worker) ✅ | +| `transmittal` | `transmittal-api` / `transmittal-frontend` | [pdm/transmittal-api](https://gitlab.sarex.io/pdm/transmittal-api), [pdm/transmittal-frontend](https://gitlab.sarex.io/pdm/transmittal-frontend) ✅ | +| `workspaces` | `workspaces` | [pdm/workspaces-api](https://gitlab.sarex.io/pdm/workspaces-api) ✅ | +| | `workspaces-frontend-static` | [platform/workspaces-frontend](https://gitlab.sarex.io/platform/workspaces-frontend) ✅ | +| | `workspaces-v2-frontend` | [platform/workspace-v2-frontend](https://gitlab.sarex.io/platform/workspace-v2-frontend) ✅ | + +**Как искать самому, если компонента нет в таблице.** Порядок надёжности: + +1. Взять имя образа из `apps//base/*.yaml` — `cr.yandex/crp3ccidau046kdj8g9q/****:tag`. + В большинстве случаев `` = `path` репозитория. +2. Открыть `apps//CONFIGURATION.md` — в первой строке стоит **настоящее имя проекта** + (например `apps/eav` → «Конфигурация проекта eav-python» → `platform/eav_python`). +3. Искать по GitLab: `scope: projects`, термин ≥ 3 символов, матч идёт по `path_with_namespace` — + поэтому запрос по имени группы (`proc`, `pdm`, `planning`) выдаёт всю группу целиком. +4. Если сервис уже работает в кластере — у его `Deployment` есть аннотации + `gitlab-uri` и `gitlab-job`, проставляемые CI, с прямой ссылкой на репозиторий и джобу сборки. + +⚠️ Имя образа **не всегда** совпадает с репозиторием: `att9` → `pdm/attachments`, +`iams` → `platform/iams-v2`, `pdmv2` → `pdm/pdm`, `export-reviews` → `proc/export-reviews` +(в GitLab отображается как `flows-export`), `sarex-inspections` → `proc/inspections-backend`. +Суффиксы `_prod`, `contour_`, `-dev` в имени образа — артефакты веток CI, не часть имени проекта. + +Общий CI-конвейер для всех этих репозиториев — +[generic/common-ci](https://gitlab.sarex.io/generic/common-ci) (подключается в `.gitlab-ci.yml` +каждого сервиса), базовый образ — [generic/base-image](https://gitlab.sarex.io/generic/base-image). + +### 5.4 Вспомогательное в репозитории + +| Путь | Назначение | +|---|---| +| `inventory.yaml` | Сгенерированный инвентарь prod: namespace → тип ресурса → имена (ConfigMap/Secret/Deployment/Service/EnvoyFilter) | +| `snapshots/dsinv/` | Снимки живых манифестов (в `.gitignore`, локальный артефакт) | +| `docs/apps/` | Диаграмма и описание по каждому бизнес-сервису | +| `gitea-data/` | Локальные данные Gitea — рабочий артефакт, **не коммитить** | + +--- + +## 6. Перекрытия и как выбирать источник истины + +Для ~20 компонентов существуют оба источника — каталог в `infra/iac` и отдельный репозиторий. +Наблюдаемое правило (по факту содержимого, **стоит подтвердить с владельцами**): + +| Ситуация | Источник истины | +|---|---| +| Кластер перечислен в §5.1 (`yc-*`, `brusnika-*`, `wb`, `d8-ugmk-prod`) | **`infra/iac`**, ветка `master`. Правки в отдельном репозитории туда не доедут | +| Контур деплоится GitLab CI (ветки `stage`, `preprod`, `contour`, `infra`, `contour/cps`, `stronghold`) | **Отдельный репозиторий компонента**, ветка = имя контура | +| Контур ГПН | **`infra/iac-gpn`** (ArgoCD), не Flux | +| Namespace, БД, S3-бакет, Kafka-топик, пользователь, k8s-секрет | **`infra/terraform`** (`infrastructure.yaml`) — не создавать вручную и не дублировать в Flux | +| Изолированный контур без доступа к GitLab | `infra/iac` → зеркало **Gitea** → Flux. Пуш в GitLab обязателен, но недостаточен: нужно, чтобы зеркало обновилось | + +Особые случаи: + +- **`prometheus-stack` vs `kube-prometheus-stack`** — два разных репозитория с пересекающейся зоной; + в `iac` компонент один (`prometheus-stack`). Требует ревизии. +- **`terraform` vs `terraform-contour-mirror`** — README идентичны, `mirror` живёт только в ветке + `contour` и активен (2026-08-04). Расхождение между ними — реальный риск дрейфа. +- **`istio-config`** — самый «многоконтурный» репозиторий (7 веток) и одновременно компонент в `iac`. +- **`poc/iac`** — архив; не путать с `infra/iac`. + +--- + +## 7. Эксплуатация, аудит и данные + +| Репозиторий | Отвечает за | +|---|---| +| [infra/k8s-changelog](https://gitlab.sarex.io/infra/k8s-changelog) ✅ | Ежедневный снимок всех манифестов кластера в стабильную файловую структуру и коммит в git — **читаемый diff состояния кластера** для аудита и восстановления. Чистит `status`, `managedFields`, значения секретов | +| [infra/harvester](https://gitlab.sarex.io/infra/harvester) ✅ | **Резервное копирование данных платформы Sarex** (документация, планирование, замечания, рабочие процессы). Kafka-download/sync приложения, манифесты, mkdocs | +| [infra/scripts/extract-kuberntes-manifests-to-s3](https://gitlab.sarex.io/infra/scripts/extract-kuberntes-manifests-to-s3) ◻️ | Выгрузка манифестов кластера в S3 | +| [infra/yc-pg-dumper](https://gitlab.sarex.io/infra/yc-pg-dumper) ◻️ (+ компонент `infrastructure/yc-pg-dumper`) | Дампы PostgreSQL в Yandex Cloud | +| [infra/backups/*](https://gitlab.sarex.io/infra/backups) ◻️ | `frontend`, `workers`, `sendbox`, `collect-pdm-data-from-postgresql` — подсистема бэкапов | +| [infra/postgresql-ddl-extractor](https://gitlab.sarex.io/infra/postgresql-ddl-extractor) ◻️ | Извлечение DDL из PostgreSQL | +| [infra/k8s-hustler](https://gitlab.sarex.io/infra/k8s-hustler), [infra/revisor](https://gitlab.sarex.io/infra/revisor), [infra/peeping](https://gitlab.sarex.io/infra/peeping) ◻️ | Утилиты инспекции/ревизии кластера | +| [infra/compnay-cleanup-kit](https://gitlab.sarex.io/infra/compnay-cleanup-kit) ◻️ | Очистка данных компании *(опечатка в имени — так в GitLab)* | +| [infra/py-s3-size](https://gitlab.sarex.io/infra/py-s3-size), [infra/get_size_SOD](https://gitlab.sarex.io/infra/get_size_SOD), [infra/jobs/object-storage-size-by-project](https://gitlab.sarex.io/infra/jobs/object-storage-size-by-project) ◻️ | Учёт объёмов объектного хранилища | +| [infra/s3-replication-poc](https://gitlab.sarex.io/infra/s3-replication-poc) ◻️ | Репликация S3 (PoC) | +| [infra/wunderwaffe-operator](https://gitlab.sarex.io/infra/wunderwaffe-operator), [infra/wunderwaffe-tasks](https://gitlab.sarex.io/infra/wunderwaffe-tasks), [infra/wunderwaffe-dumpster](https://gitlab.sarex.io/infra/wunderwaffe-dumpster) ◻️ | Собственный k8s-оператор и его задачи | + +--- + +## 8. Контуры заказчиков + +| Подгруппа / репозиторий | Контур | Содержимое | +|---|---|---| +| [infra/wb/*](https://gitlab.sarex.io/infra/wb) ◻️ | WB | `manifestos-k8s`, `postgresql16`, `helm-of-business`. Кластер `wb` в `iac` синхронизируется из `gitea-srx.wb.ru` | +| [infra/gpnt/*](https://gitlab.sarex.io/infra/gpnt) ◻️ | ГПН, OpenShift | UBI-образы: `base`, `backend`, `nginx`, `postgres`, `rabbitmq`, `redis`, `comparator`; `gpnt-os` — «manifest and helm templates for openshift» | +| [infra/gpnr/*](https://gitlab.sarex.io/infra/gpnr) ◻️ | ГПН-Р | `docker-packaging-gdal-builder`, `docker-packaging-potree-builder`, `u190001439_skzssrx*` | +| [infra/severstal/*](https://gitlab.sarex.io/infra/severstal) ◻️ | Северсталь | UBI-образы + `ingress`, `provision` | +| [infra/iac-gpn](https://gitlab.sarex.io/infra/iac-gpn) ✅ | ГПН | ArgoCD-монорепозиторий контура | +| [infra/brusnika](https://gitlab.sarex.io/infra/brusnika), [infra/uralchem](https://gitlab.sarex.io/infra/uralchem), [infra/ugok](https://gitlab.sarex.io/infra/ugok), [infra/cps2](https://gitlab.sarex.io/infra/cps2) ◻️ | Брусника, Уралхим, УГОК, ЦПС | Контурные наборы (низкая активность — часть с 2025-01) | + +--- + +## 9. Инструменты, скрипты, документация + +| Репозиторий | Отвечает за | +|---|---| +| [infra/kafka-router](https://gitlab.sarex.io/infra/kafka-router) ✅ | Проксирование сообщений между Kafka-кластерами по `TOPIC_MAPPING`, с фильтрацией по компании (FastStream) | +| [infra/tools/sarex-cli-service](https://gitlab.sarex.io/infra/tools/sarex-cli-service) | Python-скрипт подъёма локального окружения разработчика *(описание из GitLab)* | +| [infra/tools/sdk-python](https://gitlab.sarex.io/infra/tools/sdk-python) ◻️ | Внутренний Python SDK | +| [infra/bash-scripts](https://gitlab.sarex.io/infra/bash-scripts), [infra/python-scripts](https://gitlab.sarex.io/infra/python-scripts), [infra/scripts/*](https://gitlab.sarex.io/infra/scripts), [d.emelin/infra-scripts](https://gitlab.sarex.io/d.emelin/infra-scripts) ◻️ | Разрозненные операционные скрипты | +| [infra/transfer-tools](https://gitlab.sarex.io/infra/transfer-tools) ◻️ | Перенос данных между контурами | +| [infra/docs/deploy](https://gitlab.sarex.io/infra/docs/deploy), [infra/docs/services](https://gitlab.sarex.io/infra/docs/services), [infra/kb](https://gitlab.sarex.io/infra/kb) ◻️ | Документация по деплою и сервисам, база знаний | +| [infra/automations/terraform-deletion_scheduled-454](https://gitlab.sarex.io/infra/automations/terraform-deletion_scheduled-454) ◻️ | Автоматизация; судя по имени — запланированное удаление ресурсов. **Проверить перед любыми действиями** | +| [infra/poc/*](https://gitlab.sarex.io/infra/poc) (~30 репозиториев) ◻️ | Песочница: `k8s-teleport`, `k8s-events`, `contour-storage`, `git-server`, `minikube`, `offline-sentry`, `offline-signoz`, `cdc`, `delta`, `trace-viewer`, `streaming-dump`, `system-tests`, `s3-*`, `unity/*` и др. **Не источник истины для прода** | + +--- + +## 10. Как пользоваться каталогом + +**Меняю поведение компонента в кластере из §5.1** → `infra/iac`, `infrastructure/<компонент>/patches/` +или оверлей кластера; проверка — `flux get kustomizations`, `flux get helmreleases -A`. + +**Меняю поведение компонента в CI-контуре** → соответствующий `infra/<компонент>`, **ветка контура**, +каталог `.helm/`. + +**Выкатываю новую версию приложения** → `apps//`: тег образа в `base/<компонент>.yaml`, +если кластер наследует базу (`d8-ugmk-prod`, `yc-k8s-test`), **и отдельно** в +`apps//brusnika-*/`, `apps//yc-ecp/` — эти оверлеи базу не подключают (§5.3.4). +Перед правкой сверься с §5.3.3: возможно, оверлей вообще не подключён к кластеру. + +**Нужен новый секрет для приложения** → положить в Vault по пути `secrets/data/apps//…` +и добавить `vault.hashicorp.com/agent-inject-*` в `podAnnotations` (§5.3.5). В git секрет не кладём. + +**Ищу исходники сервиса по имени namespace или образа** → карта «приложение → репозиторий» +в §5.3.8; там же порядок поиска, если компонента в таблице нет. + +**Нужен новый namespace / БД / бакет / топик / секрет** → `infra/terraform`, `infrastructure.yaml` +(секреты — через SOPS, см. `SOPS.md`); для контура — `terraform-contour` / `terraform-contour-mirror`. + +**Нужен новый кластер** → `kubespray` → `k8s-provision` → `flux bootstrap --path=clusters/<имя>` +в `infra/iac`. + +**Понять, что реально крутится в кластере** → `inventory.yaml` в этом репозитории и +`infra/k8s-changelog` (git-история состояния). + +--- + +### Открытые вопросы + +1. Привести оверлеи `brusnika-prod`, `brusnika-stage`, `yc-ecp` к наследованию `../base` — сейчас + это полные копии, которые молча расходятся с базой (§5.3.4). +2. Разобрать 17 неподключённых оверлеев приложений и 25 каталогов `dsinv/`: удалить или + подключить (§5.3.3). +3. Выровнять версию `universal-chart` — шесть приложений остались на 0.1.7 при базовой 0.1.9. +4. Разграничить `prometheus-stack` и `kube-prometheus-stack` — какой из них актуален. +5. Зафиксировать регламент синхронизации `terraform` ↔ `terraform-contour-mirror`. +6. Для ~60 компонентных репозиториев определить, какие мигрируют в `infra/iac`, а какие остаются + на CI-деплое; остальное — архивировать. +7. Закрыть пробелы в паспортах сервисов (§5.3.6) и подтвердить назначение репозиториев с ◻️. From ecd758d94442e0c4f5063f6a13aa6906e34ba653 Mon Sep 17 00:00:00 2001 From: ivan Date: Wed, 5 Aug 2026 13:57:32 +0500 Subject: [PATCH 53/85] ++ --- apps/flows/base/backend.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/apps/flows/base/backend.yaml b/apps/flows/base/backend.yaml index c399461..b8bf70b 100644 --- a/apps/flows/base/backend.yaml +++ b/apps/flows/base/backend.yaml @@ -167,11 +167,11 @@ spec: - name: GATEWAY_URL value: - _default: "http://pdm-api.documentations.svc.cluster.local:8080" + _default: "http://pdm-svc.documentations.svc.cluster.local:80" - name: RESOURCE_URL value: - _default: "http://resources-service.resources.svc.cluster.local:8000" + _default: "http://iam-backend.iam.svc.cluster.local:8000" - name: SERVICE_HOST value: @@ -199,7 +199,7 @@ spec: - name: WORKFLOWS_HOST value: - _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1" + _default: "http://backend-svc.processing.svc.cluster.local:80/api/v1" - name: WORKFLOWS_TIMEOUT value: From 3cd5600f239242d4a66f72ceb9c8c3b1930fbf85 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 13:44:47 +0300 Subject: [PATCH 54/85] Add `backend-s3`, `celery`, and `redis` HelmReleases to `d8-ugmk-prod`: configure charts, deployment settings, and include in cluster Kustomization --- apps/pm/d8-ugmk-prod/backend-s3.yaml | 21 ++++ apps/pm/d8-ugmk-prod/celery.yaml | 141 ++++++++++++++++++++++++ apps/pm/d8-ugmk-prod/kustomization.yaml | 9 ++ apps/pm/d8-ugmk-prod/redis.yaml | 98 ++++++++++++++++ 4 files changed, 269 insertions(+) create mode 100644 apps/pm/d8-ugmk-prod/backend-s3.yaml create mode 100644 apps/pm/d8-ugmk-prod/celery.yaml create mode 100644 apps/pm/d8-ugmk-prod/redis.yaml diff --git a/apps/pm/d8-ugmk-prod/backend-s3.yaml b/apps/pm/d8-ugmk-prod/backend-s3.yaml new file mode 100644 index 0000000..7368ee0 --- /dev/null +++ b/apps/pm/d8-ugmk-prod/backend-s3.yaml @@ -0,0 +1,21 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: pm +spec: + values: + services: + backend: + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-template-pm-s3: |- + {{- with secret "secrets/data/minio/apps/pm" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + S3_VERIFY=False + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}pm-bucket{{ end }} + {{- end -}} diff --git a/apps/pm/d8-ugmk-prod/celery.yaml b/apps/pm/d8-ugmk-prod/celery.yaml new file mode 100644 index 0000000..ec0991f --- /dev/null +++ b/apps/pm/d8-ugmk-prod/celery.yaml @@ -0,0 +1,141 @@ +--- +# Патч celery для контура УГМК. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/pm/base/celery.yaml. +# При добавлении переменной в base её нужно продублировать и сюда. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-pm-s3; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: pm +spec: + values: + services: + celery: + envs: + # base: http://backend-service.sarex.svc.cluster.local:8000 — ns sarex не существует + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + # base: http://sarex-resources-service.resources — ns resources не развёрнут в контуре + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + # base: http://eav-service.eav — сервис называется backend-svc и слушает 80 + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + - name: CACHE_ENABLE + value: + _default: "False" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "False" + + # base: https://lk.sarex.io/api/token/public/ + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://sarex.uralmine.com/api/token/public/" + + # base: https://lk.sarex.io + - name: SERVER_HOST + value: + _default: "https://sarex.uralmine.com" + + # base: https://api.sarex.io + - name: SERVER_API_HOST + value: + _default: "https://sarex.uralmine.com" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" + + podAnnotations: + _default: + # base склеивал S3_BUCKET с S3_VERIFY: {{- end -}} съедал перевод строки. + # S3_VERIFY поднят выше блока if, у {{ end }} убран хвостовой дефис. + vault.hashicorp.com/agent-inject-template-pm-s3: |- + {{- with secret "secrets/data/minio/apps/pm" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + S3_VERIFY=False + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}pm-bucket{{ end }} + {{- end -}} diff --git a/apps/pm/d8-ugmk-prod/kustomization.yaml b/apps/pm/d8-ugmk-prod/kustomization.yaml index 8c72385..d586033 100644 --- a/apps/pm/d8-ugmk-prod/kustomization.yaml +++ b/apps/pm/d8-ugmk-prod/kustomization.yaml @@ -3,8 +3,17 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base + - redis.yaml patches: - path: namespace.yaml target: kind: Namespace name: pm + - path: backend-s3.yaml + target: + kind: HelmRelease + name: backend + - path: celery.yaml + target: + kind: HelmRelease + name: celery diff --git a/apps/pm/d8-ugmk-prod/redis.yaml b/apps/pm/d8-ugmk-prod/redis.yaml new file mode 100644 index 0000000..46a4787 --- /dev/null +++ b/apps/pm/d8-ugmk-prod/redis.yaml @@ -0,0 +1,98 @@ +--- +# Redis для celery в ns pm. В base его нет — там CELERY_REDIS_HOST указывает +# на redis.pm.svc.cluster.local, но сам сервис не разворачивается. +# +# Имя Service обязано быть ровно "redis" (не redis-svc, как принято в остальных +# релизах), иначе не сойдётся с CELERY_REDIS_HOST в backend.yaml и celery.yaml. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: redis + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + redis: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest + pullPolicy: + _default: Always + + deployment: + enabled: true + + name: + _default: redis + + replicaCount: + _default: 1 + + port: + _default: 6379 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 64Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: redis + + type: + _default: ClusterIP + + port: + _default: 6379 + + targetPort: + _default: 6379 + + # НЕ http: чарт по умолчанию подставляет "http", и тогда Istio навесит + # на 6379 HTTP-фильтры и сломает RESP. Префикс tcp- переводит порт + # в режим обычного TCP-проксирования. + portName: + _default: tcp-redis + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred From 16c1c03b9e58cd03a6bb2d5d085c8782b851ed9e Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 14:13:14 +0300 Subject: [PATCH 55/85] Rename `backend-s3` HelmRelease to `backend` in `d8-ugmk-prod` and update deployment configuration with environment variable management and migration script adjustments. --- apps/pm/d8-ugmk-prod/backend-s3.yaml | 21 ----------- apps/pm/d8-ugmk-prod/backend.yaml | 47 +++++++++++++++++++++++++ apps/pm/d8-ugmk-prod/kustomization.yaml | 2 +- 3 files changed, 48 insertions(+), 22 deletions(-) delete mode 100644 apps/pm/d8-ugmk-prod/backend-s3.yaml create mode 100644 apps/pm/d8-ugmk-prod/backend.yaml diff --git a/apps/pm/d8-ugmk-prod/backend-s3.yaml b/apps/pm/d8-ugmk-prod/backend-s3.yaml deleted file mode 100644 index 7368ee0..0000000 --- a/apps/pm/d8-ugmk-prod/backend-s3.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: backend - namespace: pm -spec: - values: - services: - backend: - podAnnotations: - _default: - vault.hashicorp.com/agent-inject-template-pm-s3: |- - {{- with secret "secrets/data/minio/apps/pm" -}} - S3_HOST={{ index .Data.data.client "endpoint" }} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - S3_VERIFY=False - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}pm-bucket{{ end }} - {{- end -}} diff --git a/apps/pm/d8-ugmk-prod/backend.yaml b/apps/pm/d8-ugmk-prod/backend.yaml new file mode 100644 index 0000000..8f55130 --- /dev/null +++ b/apps/pm/d8-ugmk-prod/backend.yaml @@ -0,0 +1,47 @@ +--- +# Патч backend для контура УГМК. +# +# ВНИМАНИЕ: args — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь скрипт из apps/pm/base/backend.yaml. +# При правке args в base их нужно продублировать и сюда. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-pm-s3; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: pm +spec: + values: + services: + backend: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db + [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq + [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 + set +a + # В образе нет миграций под текущие модели pm — migrate пишет + # "Your models in app(s): 'pm' have changes that are not yet + # reflected in a migration". Генерируем их на старте. + # Ошибку не глотаем молча, но и не роняем контейнер: иначе + # неудачный makemigrations превратит рабочий под в CrashLoop. + python manage.py makemigrations pm --noinput \ + || echo "!!! makemigrations FAILED - продолжаю с существующими миграциями" + python manage.py migrate + exec /opt/sarex/entrypoint.sh + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-template-pm-s3: |- + {{- with secret "secrets/data/minio/apps/pm" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + S3_VERIFY=False + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}pm-bucket{{ end }} + {{- end -}} diff --git a/apps/pm/d8-ugmk-prod/kustomization.yaml b/apps/pm/d8-ugmk-prod/kustomization.yaml index d586033..828c142 100644 --- a/apps/pm/d8-ugmk-prod/kustomization.yaml +++ b/apps/pm/d8-ugmk-prod/kustomization.yaml @@ -9,7 +9,7 @@ patches: target: kind: Namespace name: pm - - path: backend-s3.yaml + - path: backend.yaml target: kind: HelmRelease name: backend From bc7f8c4950e6b877e9a68cf89d944f47246033cf Mon Sep 17 00:00:00 2001 From: ivan Date: Wed, 5 Aug 2026 16:42:30 +0500 Subject: [PATCH 56/85] ++ --- apps/pm/base/backend.yaml | 2 +- apps/pm/base/celery.yaml | 2 +- apps/pm/d8-ugmk-prod/backend.yaml | 2 +- apps/pm/d8-ugmk-prod/celery.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/pm/base/backend.yaml b/apps/pm/base/backend.yaml index 1a98551..14a9d1f 100644 --- a/apps/pm/base/backend.yaml +++ b/apps/pm/base/backend.yaml @@ -246,7 +246,7 @@ spec: S3_LOGIN={{ index .Data.data "access_key" }} S3_PASSWORD={{ index .Data.data "secret_key" }} {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}pm-bucket{{- end -}} + S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}sarex-media-storage{{- end -}} S3_VERIFY=False {{- end -}} diff --git a/apps/pm/base/celery.yaml b/apps/pm/base/celery.yaml index b04f8a7..3084eb0 100644 --- a/apps/pm/base/celery.yaml +++ b/apps/pm/base/celery.yaml @@ -228,7 +228,7 @@ spec: S3_LOGIN={{ index .Data.data "access_key" }} S3_PASSWORD={{ index .Data.data "secret_key" }} {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}pm-bucket{{- end -}} + S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}sarex-media-storage{{- end -}} S3_VERIFY=False {{- end -}} diff --git a/apps/pm/d8-ugmk-prod/backend.yaml b/apps/pm/d8-ugmk-prod/backend.yaml index 8f55130..7a30155 100644 --- a/apps/pm/d8-ugmk-prod/backend.yaml +++ b/apps/pm/d8-ugmk-prod/backend.yaml @@ -43,5 +43,5 @@ spec: S3_PASSWORD={{ index .Data.data "secret_key" }} S3_VERIFY=False {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}pm-bucket{{ end }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}sarex-media-storage{{ end }} {{- end -}} diff --git a/apps/pm/d8-ugmk-prod/celery.yaml b/apps/pm/d8-ugmk-prod/celery.yaml index ec0991f..7c3c71f 100644 --- a/apps/pm/d8-ugmk-prod/celery.yaml +++ b/apps/pm/d8-ugmk-prod/celery.yaml @@ -137,5 +137,5 @@ spec: S3_PASSWORD={{ index .Data.data "secret_key" }} S3_VERIFY=False {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}pm-bucket{{ end }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}sarex-media-storage{{ end }} {{- end -}} From ae70f63fa333289da248740c5d4c080d60a87296 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 14:51:51 +0300 Subject: [PATCH 57/85] Update `celery` and `backend` image tags in `d8-ugmk-prod` to `production_fa0f1551` and adjust deployment configuration accordingly. --- apps/pm/d8-ugmk-prod/backend.yaml | 14 ++++++-------- apps/pm/d8-ugmk-prod/celery.yaml | 6 ++++++ 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/apps/pm/d8-ugmk-prod/backend.yaml b/apps/pm/d8-ugmk-prod/backend.yaml index 8f55130..d40bcaa 100644 --- a/apps/pm/d8-ugmk-prod/backend.yaml +++ b/apps/pm/d8-ugmk-prod/backend.yaml @@ -15,6 +15,12 @@ spec: values: services: backend: + # base: production_a889f6a3 (релиз 1.14.1, 13.07.2026). + # Здесь 1.14.7 — pipeline 72144, зелёный. + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551 + deployment: args: _default: @@ -24,14 +30,6 @@ spec: [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 set +a - # В образе нет миграций под текущие модели pm — migrate пишет - # "Your models in app(s): 'pm' have changes that are not yet - # reflected in a migration". Генерируем их на старте. - # Ошибку не глотаем молча, но и не роняем контейнер: иначе - # неудачный makemigrations превратит рабочий под в CrashLoop. - python manage.py makemigrations pm --noinput \ - || echo "!!! makemigrations FAILED - продолжаю с существующими миграциями" - python manage.py migrate exec /opt/sarex/entrypoint.sh podAnnotations: diff --git a/apps/pm/d8-ugmk-prod/celery.yaml b/apps/pm/d8-ugmk-prod/celery.yaml index ec0991f..cfbd644 100644 --- a/apps/pm/d8-ugmk-prod/celery.yaml +++ b/apps/pm/d8-ugmk-prod/celery.yaml @@ -15,6 +15,12 @@ spec: values: services: celery: + # Образ общий с backend — держать в одной версии обязательно, + # иначе воркер разъедется с API по схеме задач и моделям. + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551 + envs: # base: http://backend-service.sarex.svc.cluster.local:8000 — ns sarex не существует - name: USERS_INTERNAL_HOST From 2993c1248736b956b64fbefe39f7ad0cd9da08d5 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 15:03:17 +0300 Subject: [PATCH 58/85] Add `python manage.py migrate` execution to `d8-ugmk-prod` backend entrypoint script --- apps/pm/d8-ugmk-prod/backend.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/apps/pm/d8-ugmk-prod/backend.yaml b/apps/pm/d8-ugmk-prod/backend.yaml index 11850b7..dc9462c 100644 --- a/apps/pm/d8-ugmk-prod/backend.yaml +++ b/apps/pm/d8-ugmk-prod/backend.yaml @@ -30,6 +30,7 @@ spec: [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 set +a + python manage.py migrate exec /opt/sarex/entrypoint.sh podAnnotations: From 2dbc0b92663c15112f57efa71026ee1366249023 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 15:09:35 +0300 Subject: [PATCH 59/85] add python manage.py makemigrations pm --noinput to pm entripoint --- apps/pm/d8-ugmk-prod/backend.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/apps/pm/d8-ugmk-prod/backend.yaml b/apps/pm/d8-ugmk-prod/backend.yaml index dc9462c..4f00baa 100644 --- a/apps/pm/d8-ugmk-prod/backend.yaml +++ b/apps/pm/d8-ugmk-prod/backend.yaml @@ -30,6 +30,7 @@ spec: [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 set +a + python manage.py makemigrations pm --noinput python manage.py migrate exec /opt/sarex/entrypoint.sh From 8447ab76bb142afb911522ac7df3ea7e4e6e1847 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 15:33:56 +0300 Subject: [PATCH 60/85] Add `frontend` HelmRelease to `d8-ugmk-prod` and configure Istio route for `s3-proxy` in Istio config --- apps/pm/d8-ugmk-prod/frontend.yaml | 22 +++++++++++++++++++ apps/pm/d8-ugmk-prod/kustomization.yaml | 4 ++++ .../d8-ugmk-prod/istio-config.yaml | 18 +++++++++++++++ 3 files changed, 44 insertions(+) create mode 100644 apps/pm/d8-ugmk-prod/frontend.yaml diff --git a/apps/pm/d8-ugmk-prod/frontend.yaml b/apps/pm/d8-ugmk-prod/frontend.yaml new file mode 100644 index 0000000..2d246e3 --- /dev/null +++ b/apps/pm/d8-ugmk-prod/frontend.yaml @@ -0,0 +1,22 @@ +--- +# Патч frontend для контура УГМК. +# +# ВНИМАНИЕ: тег обязан быть contour_*, НЕ production_*. +# Сборка prod-варианта тянет remoteEntry.js модулей с https://modules.sarex.io, +# который в закрытом контуре недоступен (configWebpack/config/endpoints.ts). +# В contour-сборке пути к remoteEntry относительные — только она здесь работает. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: pm +spec: + values: + services: + frontend: + # TODO(Дмитрий): подставить тег новой contour-сборки, когда pipeline + # добежит. Пока продублирован тег из base (contour_e5c3d387, + # 16.07.2026) — то есть патч сейчас ничего не меняет. + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_fc00e54f diff --git a/apps/pm/d8-ugmk-prod/kustomization.yaml b/apps/pm/d8-ugmk-prod/kustomization.yaml index 828c142..481f2b6 100644 --- a/apps/pm/d8-ugmk-prod/kustomization.yaml +++ b/apps/pm/d8-ugmk-prod/kustomization.yaml @@ -17,3 +17,7 @@ patches: target: kind: HelmRelease name: celery + - path: frontend.yaml + target: + kind: HelmRelease + name: frontend diff --git a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml index 8098569..3eaabec 100644 --- a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml +++ b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml @@ -434,6 +434,24 @@ spec: rewrite: / service: frontend-svc.control-interface.svc.cluster.local port: 8080 + s3-proxy: + # Отдача файлов из MinIO наружу. Бэкенды кладут в бакет и возвращают + # фронту ссылку вида /media/ — без этого маршрута она уходит + # в catch-all `/` на frontend-svc.django и отдаёт index.html. + # Префикс /media/ — тот же, что в yc-ecp и dsinv, менять нельзя: + # он зашит в ссылки, которые уже сохранены в БД. + name: s3-proxy-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /media/ + rewrite: / + service: s3-proxy-svc.django.svc.cluster.local + port: 80 camunda-keycloak: namespace: default hosts: From e1ca5d770637bbc6d72e2122d893b660145de336 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 15:50:18 +0300 Subject: [PATCH 61/85] Add `s3-proxy` HelmRelease to `d8-ugmk-prod` and configure endpoint and annotations for closed contour compatibility --- apps/django/d8-ugmk-prod/kustomization.yaml | 34 ++++++++++++--------- apps/django/d8-ugmk-prod/s3-proxy.yaml | 31 +++++++++++++++++++ 2 files changed, 50 insertions(+), 15 deletions(-) create mode 100644 apps/django/d8-ugmk-prod/s3-proxy.yaml diff --git a/apps/django/d8-ugmk-prod/kustomization.yaml b/apps/django/d8-ugmk-prod/kustomization.yaml index 84d7732..72d09c1 100644 --- a/apps/django/d8-ugmk-prod/kustomization.yaml +++ b/apps/django/d8-ugmk-prod/kustomization.yaml @@ -1,15 +1,19 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: django -resources: - - ../base -patches: - - path: backend.yaml - target: - kind: HelmRelease - name: backend - - path: zitadel-configmap.yaml - target: - kind: ConfigMap - name: zitadel-configmap \ No newline at end of file +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: django +resources: + - ../base +patches: + - path: backend.yaml + target: + kind: HelmRelease + name: backend + - path: zitadel-configmap.yaml + target: + kind: ConfigMap + name: zitadel-configmap + - path: s3-proxy.yaml + target: + kind: HelmRelease + name: s3-proxy \ No newline at end of file diff --git a/apps/django/d8-ugmk-prod/s3-proxy.yaml b/apps/django/d8-ugmk-prod/s3-proxy.yaml new file mode 100644 index 0000000..bf76839 --- /dev/null +++ b/apps/django/d8-ugmk-prod/s3-proxy.yaml @@ -0,0 +1,31 @@ +--- +# Патч s3-proxy для контура УГМК. +# +# В base зашит AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech — +# в закрытом контуре этот хост недоступен, прокси не достучится до MinIO +# и маршрут /media/ (s3-proxy-virt-service в istio-config) вернёт ошибку. +# +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# agent-inject-template-s3; остальные vault-аннотации берутся из base. +# Эндпоинт задан литералом, а не через .Data.data.client.endpoint: так же +# сделано в apps/django/d8-ugmk-prod/backend.yaml:145 для того же секрета +# secrets/data/minio/apps/django — держим один способ на весь ns. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: s3-proxy + namespace: django +spec: + values: + services: + s3-proxy: + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-template-s3: | + {{- with secret "secrets/data/minio/apps/django" }} + AWS_API_ENDPOINT=https://s3.uralmine.com + {{- $buckets := index .Data.data "buckets" }} + AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} + AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end }} From 3317bbf5cdf8027e720e93507a607b91bb129314 Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 16:02:56 +0300 Subject: [PATCH 62/85] Update `celery` and `backend` in `d8-ugmk-prod`: enable caching, configure Redis host/port, and adjust environment variables for deployment consistency --- apps/pm/d8-ugmk-prod/backend.yaml | 123 ++++++++++++++++++++++++++++++ apps/pm/d8-ugmk-prod/celery.yaml | 15 +++- 2 files changed, 137 insertions(+), 1 deletion(-) diff --git a/apps/pm/d8-ugmk-prod/backend.yaml b/apps/pm/d8-ugmk-prod/backend.yaml index 4f00baa..d32d734 100644 --- a/apps/pm/d8-ugmk-prod/backend.yaml +++ b/apps/pm/d8-ugmk-prod/backend.yaml @@ -34,6 +34,129 @@ spec: python manage.py migrate exec /opt/sarex/entrypoint.sh + # ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ, + # поэтому здесь продублирован весь набор из apps/pm/base/backend.yaml. + # Отличия от base помечены комментариями. + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + # base: "False". При False CACHE_CLIENT = None (config/settings/base.py:190), + # и GET /api/pm/msp/external-task-info/ падает с + # AttributeError: 'NoneType' object has no attribute 'get' — + # sarex/pm/utils/broker_producer.py:38 дёргает .get() без проверки на None. + - name: CACHE_ENABLE + value: + _default: "True" + + # Новые: в base их нет. Дефолт CacheSettings.host — localhost, + # т.е. без них включённый кэш стучится в собственный под. + # Redis разворачивается тут же — apps/pm/d8-ugmk-prod/redis.yaml. + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "False" + + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://sarex.uralmine.com/api/token/public/" + + - name: SERVER_HOST + value: + _default: "https://sarex.uralmine.com" + + - name: SERVER_API_HOST + value: + _default: "https://sarex.uralmine.com" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" + podAnnotations: _default: vault.hashicorp.com/agent-inject-template-pm-s3: |- diff --git a/apps/pm/d8-ugmk-prod/celery.yaml b/apps/pm/d8-ugmk-prod/celery.yaml index c636e81..6b2fe1e 100644 --- a/apps/pm/d8-ugmk-prod/celery.yaml +++ b/apps/pm/d8-ugmk-prod/celery.yaml @@ -85,9 +85,22 @@ spec: value: _default: "" + # base: "False". Держим в одном значении с backend: при enable + # config/celery.py включает периодическую синхронизацию ресурсов, + # которая пишет ключи service_accounts / resources:* — их читает + # backend в sarex/pm/utils/resources.py. - name: CACHE_ENABLE value: - _default: "False" + _default: "True" + + # Новые: в base их нет, дефолт CacheSettings.host — localhost. + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" - name: CLICKHOUSE_ENABLE value: From 15392f33736c9e62e4cd10d6a62d237c1c81d43f Mon Sep 17 00:00:00 2001 From: emelinda Date: Wed, 5 Aug 2026 17:09:39 +0300 Subject: [PATCH 63/85] Add `message-hub` HelmRelease to `d8-ugmk-prod`: configure Kafka topics, environment variables, and enable Kafka integration in `django`. --- apps/django/d8-ugmk-prod/backend.yaml | 6 +- .../d8-ugmk-prod/kustomization.yaml | 4 + .../message-hub/d8-ugmk-prod/message-hub.yaml | 119 ++++++++++++++++++ 3 files changed, 128 insertions(+), 1 deletion(-) create mode 100644 apps/message-hub/d8-ugmk-prod/message-hub.yaml diff --git a/apps/django/d8-ugmk-prod/backend.yaml b/apps/django/d8-ugmk-prod/backend.yaml index 9f4613b..22e45dc 100644 --- a/apps/django/d8-ugmk-prod/backend.yaml +++ b/apps/django/d8-ugmk-prod/backend.yaml @@ -126,9 +126,13 @@ spec: - name: ZITADEL_HOST value: _default: https://sarex-login.uralmine.com + # Включено вместе с message-hub: он консьюмер топика message-hub-stage + # (SETTINGS_TOPICS в apps/message-hub/d8-ugmk-prod/message-hub.yaml), + # а писать в этот топик должен django. Vault-шаблон django-kafka + # и KAFKA_SSL_CAFILE уже есть в base — здесь только флаг. - name: SERVER_KAFKA_ENABLED value: - _default: "False" + _default: "True" - name: KAFKA_TOPICS value: _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' diff --git a/apps/message-hub/d8-ugmk-prod/kustomization.yaml b/apps/message-hub/d8-ugmk-prod/kustomization.yaml index fed75be..d3995e3 100644 --- a/apps/message-hub/d8-ugmk-prod/kustomization.yaml +++ b/apps/message-hub/d8-ugmk-prod/kustomization.yaml @@ -8,3 +8,7 @@ patches: target: kind: Namespace name: message-hub + - path: message-hub.yaml + target: + kind: HelmRelease + name: message-hub diff --git a/apps/message-hub/d8-ugmk-prod/message-hub.yaml b/apps/message-hub/d8-ugmk-prod/message-hub.yaml new file mode 100644 index 0000000..3d08e55 --- /dev/null +++ b/apps/message-hub/d8-ugmk-prod/message-hub.yaml @@ -0,0 +1,119 @@ +--- +# Патч message-hub для контура УГМК. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/message-hub/base/message-hub.yaml. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# agent-inject-template-message-hub-kafka; остальные берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: message-hub + namespace: message-hub +spec: + values: + services: + backend: + # base: production_24425472 от 15.02.2026 — 18 production-релизов назад. + # Здесь актуальный production от 31.07.2026. + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_e8010fe4 + + envs: + - name: WORKER_TIMEOUT + value: + _default: "60" + + - name: PYTHONPATH + value: + _default: "src" + + - name: SETTINGS_MAX_RETRIES + value: + _default: "1" + + # base: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}' + # Два исправления: + # 1. ключ project_entity невалиден — TopicsType (src/enums.py) знает только + # assets / planning / issues / resources_updated / resources_deleted, + # на прочих валидатор check_topics_keys кидает ValueError при старте. + # Консьюмер лежит в project_entity.py, но подписан на TopicsType.issues. + # 2. planning был "pm", а django публикует в "message-hub-stage" + # (KAFKA_TOPICS, apps/django/d8-ugmk-prod/backend.yaml) — продюсер + # и консьюмер сидели на разных топиках. + - name: SETTINGS_TOPICS + value: + _default: '{"planning": "message-hub-stage", "assets": "assets_broadcast", "issues": "issues_broadcast"}' + + # В base нет, дефолт True. S3 контура (s3.uralmine.com) отдаёт + # самоподписанный сертификат — тот же случай, что S3_VERIFY=False у pm. + # Флаг общий: гасит проверку TLS сразу и для S3, и для всех HTTP-клиентов. + - name: SETTINGS_VERIFY_SSL + value: + _default: "0" + + # base: http://backend-service.pm.svc.cluster.local:8000 — сервис pm + # называется backend-svc (apps/pm/base/backend.yaml:91). + - name: SAREX_BASE_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:8000" + + # В base нет. Без него ServiceConfig с префиксом PM_ уходит + # в дефолт http://localhost:8001. В dsinv и brusnika задан. + - name: PM_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:8000" + + # Имена сверены с infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml. + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: ISSUES_HOST + value: + _default: "http://backend-svc.issues.svc.cluster.local:80" + + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + - name: CACHE_SSL + value: + _default: "0" + + # ВНИМАНИЕ: значение не подтверждено. В base было захардкожено + # kafka-kafka-contour-controller-headless — имя из другого контура, + # здесь HelmRelease называется kafka (infrastructure/kafka/d8-ugmk-prod). + # Проверить: kubectl -n kafka get svc + # Задано переменной, а не vault-шаблоном, специально: ошибка в шаблоне + # блокирует старт пода (agent-init-first), ошибка в env — только логи. + - name: KAFKA_HOST + value: + _default: "kafka-controller-headless.kafka.svc.cluster.local" + + - name: KAFKA_PORT + value: + _default: "9092" + + # listeners.client.protocol: SASL_SSL — без CA соединение не поднимется. + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + podAnnotations: + _default: + # Из base убраны KAFKA_HOST/KAFKA_PORT: файл /vault/secrets/message-hub-kafka + # подгружается через `set -a; . file`, то есть переписывает переменные + # окружения. Пока хост не подтверждён, держим его в envs. + vault.hashicorp.com/agent-inject-template-message-hub-kafka: |- + {{- with secret "secrets/data/kafka/apps/message-hub" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + {{- end -}} From c55bec5b5dba83f0daf8798a26e7c4ad8fc2cf69 Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Wed, 5 Aug 2026 17:22:50 +0300 Subject: [PATCH 64/85] ++ fix acme http01 challenges on external-stage, route all domains through istio instead of the dead nginx solver --- .../infrastructure/clusterissuer-letsencrypt.yaml | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/clusters/brusnika-stage/infrastructure/clusterissuer-letsencrypt.yaml b/clusters/brusnika-stage/infrastructure/clusterissuer-letsencrypt.yaml index 79afaf3..6d5405f 100644 --- a/clusters/brusnika-stage/infrastructure/clusterissuer-letsencrypt.yaml +++ b/clusters/brusnika-stage/infrastructure/clusterissuer-letsencrypt.yaml @@ -9,15 +9,6 @@ spec: name: letsencrypt server: https://acme-v02.api.letsencrypt.org/directory solvers: - - selector: - dnsNames: - - zitadel.test.sarex.brusnika.tech - - grafana.test.sarex.brusnika.tech - - openobserve.test.sarex.brusnika.tech - - vmalert.test.sarex.brusnika.tech - http01: - ingress: - class: istio - http01: ingress: - class: nginx + class: istio From 0b510fb9b2df4a968600e0747a7ee2beb4ae8acd Mon Sep 17 00:00:00 2001 From: ivan Date: Wed, 5 Aug 2026 19:26:00 +0500 Subject: [PATCH 65/85] ++ --- apps/message-hub/d8-ugmk-prod/message-hub.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apps/message-hub/d8-ugmk-prod/message-hub.yaml b/apps/message-hub/d8-ugmk-prod/message-hub.yaml index 3d08e55..29e63c4 100644 --- a/apps/message-hub/d8-ugmk-prod/message-hub.yaml +++ b/apps/message-hub/d8-ugmk-prod/message-hub.yaml @@ -110,8 +110,9 @@ spec: # Из base убраны KAFKA_HOST/KAFKA_PORT: файл /vault/secrets/message-hub-kafka # подгружается через `set -a; . file`, то есть переписывает переменные # окружения. Пока хост не подтверждён, держим его в envs. + vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/pm vault.hashicorp.com/agent-inject-template-message-hub-kafka: |- - {{- with secret "secrets/data/kafka/apps/message-hub" -}} + {{- with secret "secrets/data/kafka/apps/pm" -}} KAFKA_USERNAME={{ index .Data.data "username" }} KAFKA_PASSWORD={{ index .Data.data "password" }} KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} From a8624abfc1a7413a14d995cdce5db8455e9b6130 Mon Sep 17 00:00:00 2001 From: ivan Date: Thu, 6 Aug 2026 12:05:00 +0500 Subject: [PATCH 66/85] ++ --- apps/transmittal/base/backend.yaml | 2 +- apps/transmittal/base/worker.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/transmittal/base/backend.yaml b/apps/transmittal/base/backend.yaml index bb6c535..35cfcfe 100644 --- a/apps/transmittal/base/backend.yaml +++ b/apps/transmittal/base/backend.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4e0db600 pullPolicy: _default: IfNotPresent diff --git a/apps/transmittal/base/worker.yaml b/apps/transmittal/base/worker.yaml index e70e209..a0e8f6a 100644 --- a/apps/transmittal/base/worker.yaml +++ b/apps/transmittal/base/worker.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4e0db600 pullPolicy: _default: IfNotPresent From 45df0ed4d5212283f0dc210c6ef1e497227b708d Mon Sep 17 00:00:00 2001 From: ivan Date: Thu, 6 Aug 2026 12:44:49 +0500 Subject: [PATCH 67/85] ++ --- apps/documentations/base/api.yaml | 17 ++++++++++++++++ apps/documentations/base/hasher.yaml | 20 ++++++++++++------- .../base/pdf-markings-amqp.yaml | 10 +++++----- 3 files changed, 35 insertions(+), 12 deletions(-) diff --git a/apps/documentations/base/api.yaml b/apps/documentations/base/api.yaml index 07ec559..83b7f10 100644 --- a/apps/documentations/base/api.yaml +++ b/apps/documentations/base/api.yaml @@ -48,6 +48,7 @@ spec: set -a [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common + [ -f /vault/secrets/documentations-marks-rabbitmq ] && . /vault/secrets/documentations-marks-rabbitmq [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" set +a exec /app/entrypoint.sh @@ -169,6 +170,15 @@ spec: - name: MARKS_PROCESSING_URL value: _default: http://marks-service:8000 + - name: USE_MARKS_RABBITMQ + value: + _default: "true" + - name: MARKS_RABBITMQ_HOST + value: + _default: rabbitmq.rabbitmq.svc.cluster.local + - name: MARKS_RABBITMQ_PORT + value: + _default: "5672" - name: PUBLIC_LINK_HOST value: _default: https://document-link-srx.wb.ru @@ -261,3 +271,10 @@ spec: {{- with secret "secrets/data/vault/common/rsa_keys" -}} {{ index .Data.data "public_key" }} {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-marks-rabbitmq: secrets/data/rabbitmq/apps/cde + vault.hashicorp.com/agent-inject-template-documentations-marks-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/cde" -}} + MARKS_RABBITMQ_USER={{ index .Data.data "username" }} + MARKS_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + MARKS_RABBITMQ_API={{ index .Data.data "vhost" }} + {{- end -}} diff --git a/apps/documentations/base/hasher.yaml b/apps/documentations/base/hasher.yaml index dff8e51..874aeec 100644 --- a/apps/documentations/base/hasher.yaml +++ b/apps/documentations/base/hasher.yaml @@ -92,6 +92,14 @@ spec: value: _default: "4" + - name: HASHER_AMQP__HOST + value: + _default: rabbitmq.rabbitmq.svc.cluster.local + + - name: HASHER_AMQP__PORT + value: + _default: "5672" + - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE value: _default: hash.compute.normal.tasks @@ -140,19 +148,17 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: documentations - vault.hashicorp.com/agent-inject-secret-documentations-hasher-rabbitmq: secrets/data/apps/documentations/hasher/rabbitmq + vault.hashicorp.com/agent-inject-secret-documentations-hasher-rabbitmq: secrets/data/rabbitmq/apps/cde vault.hashicorp.com/agent-inject-template-documentations-hasher-rabbitmq: |- - {{- with secret "secrets/data/apps/documentations/hasher/rabbitmq" -}} - HASHER_AMQP__HOST={{ index .Data.data "host" }} - HASHER_AMQP__PORT={{ index .Data.data "port" }} + {{- with secret "secrets/data/rabbitmq/apps/cde" -}} HASHER_AMQP__USERNAME={{ index .Data.data "username" }} HASHER_AMQP__PASSWORD={{ index .Data.data "password" }} HASHER_AMQP__VHOST={{ index .Data.data "vhost" }} {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-hasher-s3: secrets/data/apps/documentations/hasher/s3 + vault.hashicorp.com/agent-inject-secret-documentations-hasher-s3: secrets/data/minio/apps/documentations vault.hashicorp.com/agent-inject-template-documentations-hasher-s3: |- - {{- with secret "secrets/data/apps/documentations/hasher/s3" -}} - HASHER_S3__ENDPOINT={{ index .Data.data "endpoint" }} + {{- with secret "secrets/data/minio/apps/documentations" -}} + HASHER_S3__ENDPOINT={{ index .Data.data.client "endpoint" }} HASHER_S3__ACCESS_KEY={{ index .Data.data "access_key" }} HASHER_S3__SECRET_KEY={{ index .Data.data "secret_key" }} {{- end -}} diff --git a/apps/documentations/base/pdf-markings-amqp.yaml b/apps/documentations/base/pdf-markings-amqp.yaml index 772dee2..9bb567f 100644 --- a/apps/documentations/base/pdf-markings-amqp.yaml +++ b/apps/documentations/base/pdf-markings-amqp.yaml @@ -151,17 +151,17 @@ spec: MARKS_DOCUMENTS_DB__PASSWORD={{ index .Data.data "password" }} MARKS_DOCUMENTS_DB__SSLMODE=disable {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-marks-rabbitmq: secrets/data/rabbitmq/apps/documentations + vault.hashicorp.com/agent-inject-secret-documentations-marks-rabbitmq: secrets/data/rabbitmq/apps/cde vault.hashicorp.com/agent-inject-template-documentations-marks-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/documentations" -}} + {{- with secret "secrets/data/rabbitmq/apps/cde" -}} MARKS_RABBITMQ__USERNAME={{ index .Data.data "username" }} MARKS_RABBITMQ__PASSWORD={{ index .Data.data "password" }} MARKS_RABBITMQ__VHOST={{ index .Data.data "vhost" }} {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-marks-s3: secrets/data/apps/documentations/marks-s3 + vault.hashicorp.com/agent-inject-secret-documentations-marks-s3: secrets/data/minio/apps/documentations vault.hashicorp.com/agent-inject-template-documentations-marks-s3: |- - {{- with secret "secrets/data/apps/documentations/marks-s3" -}} - MARKS_S3__URL={{ index .Data.data "endpoint_url" }} + {{- with secret "secrets/data/minio/apps/documentations" -}} + MARKS_S3__URL={{ index .Data.data.client "endpoint" }} MARKS_S3__ACCESS_KEY={{ index .Data.data "access_key" }} MARKS_S3__SECRET_KEY={{ index .Data.data "secret_key" }} {{- end -}} From fef5481432cf9f6b81217e6161b788c387cf08d2 Mon Sep 17 00:00:00 2001 From: ivan Date: Thu, 6 Aug 2026 13:02:09 +0500 Subject: [PATCH 68/85] ++ --- apps/documentations/base/pdf-markings-amqp.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/documentations/base/pdf-markings-amqp.yaml b/apps/documentations/base/pdf-markings-amqp.yaml index 9bb567f..79fe4b1 100644 --- a/apps/documentations/base/pdf-markings-amqp.yaml +++ b/apps/documentations/base/pdf-markings-amqp.yaml @@ -50,7 +50,7 @@ spec: [ -f /vault/secrets/documentations-marks-rabbitmq ] && . /vault/secrets/documentations-marks-rabbitmq [ -f /vault/secrets/documentations-marks-s3 ] && . /vault/secrets/documentations-marks-s3 set +a - exec ./server + start-amqp-worker resources: requests: cpu: From 12d2fe5a21312f925e12c017a47909468e30e0d6 Mon Sep 17 00:00:00 2001 From: ivan Date: Thu, 6 Aug 2026 13:06:00 +0500 Subject: [PATCH 69/85] ++ --- apps/documentations/base/hasher.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/documentations/base/hasher.yaml b/apps/documentations/base/hasher.yaml index 874aeec..4523a7c 100644 --- a/apps/documentations/base/hasher.yaml +++ b/apps/documentations/base/hasher.yaml @@ -49,7 +49,7 @@ spec: [ -f /vault/secrets/documentations-hasher-rabbitmq ] && . /vault/secrets/documentations-hasher-rabbitmq [ -f /vault/secrets/documentations-hasher-s3 ] && . /vault/secrets/documentations-hasher-s3 set +a - exec ./server + run-amqp-server resources: requests: cpu: From 6f231aaede14a5f844a86520e7f0a589f6787d3f Mon Sep 17 00:00:00 2001 From: ivan Date: Thu, 6 Aug 2026 14:25:30 +0500 Subject: [PATCH 70/85] ++ --- apps/documentations/base/pdf-markings-amqp.yaml | 4 ++-- apps/documentations/d8-ugmk-prod/api.yaml | 9 +++++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/apps/documentations/base/pdf-markings-amqp.yaml b/apps/documentations/base/pdf-markings-amqp.yaml index 79fe4b1..6fca5cd 100644 --- a/apps/documentations/base/pdf-markings-amqp.yaml +++ b/apps/documentations/base/pdf-markings-amqp.yaml @@ -95,11 +95,11 @@ spec: - name: MARKS_QR__REDIRECT_URL value: - _default: "https://stamp-verification.srx.wb.ru/" + _default: "https://sarex-stamp-verification.uralmine.com/" - name: MARKS_QR__BASE_DOCUMENT_URL value: - _default: "https://srx.wb.ru" + _default: "https://sarex.uralmine.com" - name: MARKS_S3__REGION value: diff --git a/apps/documentations/d8-ugmk-prod/api.yaml b/apps/documentations/d8-ugmk-prod/api.yaml index e15cd14..b0e4ded 100644 --- a/apps/documentations/d8-ugmk-prod/api.yaml +++ b/apps/documentations/d8-ugmk-prod/api.yaml @@ -93,6 +93,15 @@ spec: - name: MARKS_PROCESSING_URL value: _default: http://marks-service:8000 + - name: USE_MARKS_RABBITMQ + value: + _default: "true" + - name: MARKS_RABBITMQ_HOST + value: + _default: rabbitmq.rabbitmq.svc.cluster.local + - name: MARKS_RABBITMQ_PORT + value: + _default: "5672" - name: PUBLIC_LINK_HOST value: _default: https://sarex-document-link.uralmine.com From 15f472d9d3a493eef81a6eaba33cecb611a80fd3 Mon Sep 17 00:00:00 2001 From: ivan Date: Thu, 6 Aug 2026 19:12:50 +0500 Subject: [PATCH 71/85] ++ --- apps/message-hub/base/message-hub.yaml | 4 ++-- apps/message-hub/d8-ugmk-prod/message-hub.yaml | 13 +++++++------ 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/apps/message-hub/base/message-hub.yaml b/apps/message-hub/base/message-hub.yaml index eec8a25..3e40b3e 100644 --- a/apps/message-hub/base/message-hub.yaml +++ b/apps/message-hub/base/message-hub.yaml @@ -166,9 +166,9 @@ spec: {{- $buckets := index .Data.data "buckets" }} S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}rfi{{- end -}} {{- end -}} - vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/message-hub + vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/pm vault.hashicorp.com/agent-inject-template-message-hub-kafka: |- - {{- with secret "secrets/data/kafka/apps/message-hub" -}} + {{- with secret "secrets/data/kafka/apps/pm" -}} KAFKA_USERNAME={{ index .Data.data "username" }} KAFKA_PASSWORD={{ index .Data.data "password" }} KAFKA_HOST=kafka-kafka-contour-controller-headless.kafka.svc.cluster.local diff --git a/apps/message-hub/d8-ugmk-prod/message-hub.yaml b/apps/message-hub/d8-ugmk-prod/message-hub.yaml index 29e63c4..1fa3afa 100644 --- a/apps/message-hub/d8-ugmk-prod/message-hub.yaml +++ b/apps/message-hub/d8-ugmk-prod/message-hub.yaml @@ -86,19 +86,20 @@ spec: value: _default: "0" - # ВНИМАНИЕ: значение не подтверждено. В base было захардкожено - # kafka-kafka-contour-controller-headless — имя из другого контура, - # здесь HelmRelease называется kafka (infrastructure/kafka/d8-ugmk-prod). - # Проверить: kubectl -n kafka get svc + # Подтверждено: kubectl -n kafka get svc → + # kafka-kafka-contour-controller-headless.kafka.svc.cluster.local, + # порты 9094/9092/9093. 9094 — единственный клиентский листенер + # (listeners.client: SASL_SSL в infrastructure/kafka/d8-ugmk-prod/kafka.yaml), + # то же значение, что и в base, и в bootstrap_servers секрета pm. # Задано переменной, а не vault-шаблоном, специально: ошибка в шаблоне # блокирует старт пода (agent-init-first), ошибка в env — только логи. - name: KAFKA_HOST value: - _default: "kafka-controller-headless.kafka.svc.cluster.local" + _default: "kafka-kafka-contour-controller-headless.kafka.svc.cluster.local" - name: KAFKA_PORT value: - _default: "9092" + _default: "9094" # listeners.client.protocol: SASL_SSL — без CA соединение не поднимется. - name: KAFKA_SSL_CAFILE From 2aad903a2e3ae709bd823e7f8d674782cfc07833 Mon Sep 17 00:00:00 2001 From: ivan Date: Thu, 6 Aug 2026 20:08:49 +0500 Subject: [PATCH 72/85] ++ --- .../d8-ugmk-prod/kafka-ca-configmap.yaml | 27 ++++++++++ .../d8-ugmk-prod/kustomization.yaml | 1 + .../message-hub/d8-ugmk-prod/message-hub.yaml | 49 ++++++++++++++----- 3 files changed, 66 insertions(+), 11 deletions(-) create mode 100644 apps/message-hub/d8-ugmk-prod/kafka-ca-configmap.yaml diff --git a/apps/message-hub/d8-ugmk-prod/kafka-ca-configmap.yaml b/apps/message-hub/d8-ugmk-prod/kafka-ca-configmap.yaml new file mode 100644 index 0000000..43ffd32 --- /dev/null +++ b/apps/message-hub/d8-ugmk-prod/kafka-ca-configmap.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-ca-cert + namespace: message-hub +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw + NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC + h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy + D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV + tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM + Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C + GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA + A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL + QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP + KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j + kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j + TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8 + fdA17/ibw6gFrH2b3vZKcx8D455V + -----END CERTIFICATE----- diff --git a/apps/message-hub/d8-ugmk-prod/kustomization.yaml b/apps/message-hub/d8-ugmk-prod/kustomization.yaml index d3995e3..10bb06b 100644 --- a/apps/message-hub/d8-ugmk-prod/kustomization.yaml +++ b/apps/message-hub/d8-ugmk-prod/kustomization.yaml @@ -3,6 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base + - kafka-ca-configmap.yaml patches: - path: namespace.yaml target: diff --git a/apps/message-hub/d8-ugmk-prod/message-hub.yaml b/apps/message-hub/d8-ugmk-prod/message-hub.yaml index 1fa3afa..05da0ae 100644 --- a/apps/message-hub/d8-ugmk-prod/message-hub.yaml +++ b/apps/message-hub/d8-ugmk-prod/message-hub.yaml @@ -86,36 +86,63 @@ spec: value: _default: "0" - # Подтверждено: kubectl -n kafka get svc → - # kafka-kafka-contour-controller-headless.kafka.svc.cluster.local, - # порты 9094/9092/9093. 9094 — единственный клиентский листенер - # (listeners.client: SASL_SSL в infrastructure/kafka/d8-ugmk-prod/kafka.yaml), - # то же значение, что и в base, и в bootstrap_servers секрета pm. + # Подтверждено вживую (kubectl exec в kafka-kafka-contour-controller-0, + # server.properties): реальный CLIENT-листенер (SASL_SSL) — порт 9092 + # на обычном (не headless) сервисе kafka-kafka-contour. Порт 9094 — + # это INTERNAL (SASL_PLAINTEXT, inter-broker), не для приложений; + # 9093 — CONTROLLER (raft, свой API, METADATA не поддерживает). + # Сертификат брокера (SAN) покрывает голое имя kafka-kafka-contour, + # но НЕ голое имя headless-сервиса (только *. с одним + # префиксом-подом) — поэтому именно обычный сервис, не headless. # Задано переменной, а не vault-шаблоном, специально: ошибка в шаблоне # блокирует старт пода (agent-init-first), ошибка в env — только логи. - name: KAFKA_HOST value: - _default: "kafka-kafka-contour-controller-headless.kafka.svc.cluster.local" + _default: "kafka-kafka-contour.kafka.svc.cluster.local" - name: KAFKA_PORT value: - _default: "9094" + _default: "9092" # listeners.client.protocol: SASL_SSL — без CA соединение не поднимется. - name: KAFKA_SSL_CAFILE value: _default: "/usr/local/share/ca-certificates/kafka.crt" + # В секрете pm security_protocol = SASL_PLAINTEXT — верно для того, + # как им пользуется сам pm, но реальный листенер (см. выше) требует + # SASL_SSL. Фиксируем тут, а не из вольта, чтобы не переписать это + # значение обратно на PLAINTEXT — по той же причине, что и KAFKA_HOST/PORT. + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SASL_SSL" + + volumes: + _default: + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + podAnnotations: _default: - # Из base убраны KAFKA_HOST/KAFKA_PORT: файл /vault/secrets/message-hub-kafka - # подгружается через `set -a; . file`, то есть переписывает переменные - # окружения. Пока хост не подтверждён, держим его в envs. + # Из base убраны KAFKA_HOST/KAFKA_PORT/KAFKA_SECURITY_PROTOCOL: файл + # /vault/secrets/message-hub-kafka подгружается через `set -a; . file`, + # то есть переписывает переменные окружения поверх envs. vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/pm vault.hashicorp.com/agent-inject-template-message-hub-kafka: |- {{- with secret "secrets/data/kafka/apps/pm" -}} KAFKA_USERNAME={{ index .Data.data "username" }} KAFKA_PASSWORD={{ index .Data.data "password" }} - KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} {{- end -}} From d0f2386e7a55e8bddf57adf18a6db97fe696610f Mon Sep 17 00:00:00 2001 From: ivan Date: Fri, 7 Aug 2026 12:33:29 +0500 Subject: [PATCH 73/85] ++ --- apps/message-hub/base/message-hub.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/message-hub/base/message-hub.yaml b/apps/message-hub/base/message-hub.yaml index 3e40b3e..fb61e11 100644 --- a/apps/message-hub/base/message-hub.yaml +++ b/apps/message-hub/base/message-hub.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_24425472 + _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_e8010fe4 pullPolicy: _default: IfNotPresent @@ -122,7 +122,7 @@ spec: - name: SETTINGS_TOPICS value: - _default: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}' + _default: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod", "resources_updated": "iam.resource.updated.v2", "resources_deleted": "iam.resource.deleted.v2"}' - name: SETTINGS_PDF_CONVERTER_HOST value: From e61fb1614f69b76973c53f486234e376584dc83c Mon Sep 17 00:00:00 2001 From: ivan Date: Fri, 7 Aug 2026 12:39:02 +0500 Subject: [PATCH 74/85] ++ --- apps/message-hub/d8-ugmk-prod/message-hub.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/message-hub/d8-ugmk-prod/message-hub.yaml b/apps/message-hub/d8-ugmk-prod/message-hub.yaml index 05da0ae..c8a41d9 100644 --- a/apps/message-hub/d8-ugmk-prod/message-hub.yaml +++ b/apps/message-hub/d8-ugmk-prod/message-hub.yaml @@ -44,7 +44,7 @@ spec: # и консьюмер сидели на разных топиках. - name: SETTINGS_TOPICS value: - _default: '{"planning": "message-hub-stage", "assets": "assets_broadcast", "issues": "issues_broadcast"}' + _default: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod", "resources_updated": "iam.resource.updated.v2", "resources_deleted": "iam.resource.deleted.v2"}' # В base нет, дефолт True. S3 контура (s3.uralmine.com) отдаёт # самоподписанный сертификат — тот же случай, что S3_VERIFY=False у pm. From f2223ceab4f5bed001d16206e72ad1527f327de8 Mon Sep 17 00:00:00 2001 From: ivan Date: Fri, 7 Aug 2026 12:52:30 +0500 Subject: [PATCH 75/85] ++ --- .../message-hub/d8-ugmk-prod/message-hub.yaml | 37 -------------- apps/pm/d8-ugmk-prod/backend.yaml | 49 ++++++++++++++++--- apps/pm/d8-ugmk-prod/kafka-ca-configmap.yaml | 27 ++++++++++ apps/pm/d8-ugmk-prod/kustomization.yaml | 1 + 4 files changed, 70 insertions(+), 44 deletions(-) create mode 100644 apps/pm/d8-ugmk-prod/kafka-ca-configmap.yaml diff --git a/apps/message-hub/d8-ugmk-prod/message-hub.yaml b/apps/message-hub/d8-ugmk-prod/message-hub.yaml index c8a41d9..72f7467 100644 --- a/apps/message-hub/d8-ugmk-prod/message-hub.yaml +++ b/apps/message-hub/d8-ugmk-prod/message-hub.yaml @@ -33,39 +33,21 @@ spec: value: _default: "1" - # base: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}' - # Два исправления: - # 1. ключ project_entity невалиден — TopicsType (src/enums.py) знает только - # assets / planning / issues / resources_updated / resources_deleted, - # на прочих валидатор check_topics_keys кидает ValueError при старте. - # Консьюмер лежит в project_entity.py, но подписан на TopicsType.issues. - # 2. planning был "pm", а django публикует в "message-hub-stage" - # (KAFKA_TOPICS, apps/django/d8-ugmk-prod/backend.yaml) — продюсер - # и консьюмер сидели на разных топиках. - name: SETTINGS_TOPICS value: _default: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod", "resources_updated": "iam.resource.updated.v2", "resources_deleted": "iam.resource.deleted.v2"}' - - # В base нет, дефолт True. S3 контура (s3.uralmine.com) отдаёт - # самоподписанный сертификат — тот же случай, что S3_VERIFY=False у pm. - # Флаг общий: гасит проверку TLS сразу и для S3, и для всех HTTP-клиентов. - name: SETTINGS_VERIFY_SSL value: _default: "0" - # base: http://backend-service.pm.svc.cluster.local:8000 — сервис pm - # называется backend-svc (apps/pm/base/backend.yaml:91). - name: SAREX_BASE_HOST value: _default: "http://backend-svc.pm.svc.cluster.local:8000" - # В base нет. Без него ServiceConfig с префиксом PM_ уходит - # в дефолт http://localhost:8001. В dsinv и brusnika задан. - name: PM_HOST value: _default: "http://backend-svc.pm.svc.cluster.local:8000" - # Имена сверены с infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml. - name: EAV_HOST value: _default: "http://backend-svc.eav.svc.cluster.local:80" @@ -86,16 +68,6 @@ spec: value: _default: "0" - # Подтверждено вживую (kubectl exec в kafka-kafka-contour-controller-0, - # server.properties): реальный CLIENT-листенер (SASL_SSL) — порт 9092 - # на обычном (не headless) сервисе kafka-kafka-contour. Порт 9094 — - # это INTERNAL (SASL_PLAINTEXT, inter-broker), не для приложений; - # 9093 — CONTROLLER (raft, свой API, METADATA не поддерживает). - # Сертификат брокера (SAN) покрывает голое имя kafka-kafka-contour, - # но НЕ голое имя headless-сервиса (только *. с одним - # префиксом-подом) — поэтому именно обычный сервис, не headless. - # Задано переменной, а не vault-шаблоном, специально: ошибка в шаблоне - # блокирует старт пода (agent-init-first), ошибка в env — только логи. - name: KAFKA_HOST value: _default: "kafka-kafka-contour.kafka.svc.cluster.local" @@ -104,15 +76,9 @@ spec: value: _default: "9092" - # listeners.client.protocol: SASL_SSL — без CA соединение не поднимется. - name: KAFKA_SSL_CAFILE value: _default: "/usr/local/share/ca-certificates/kafka.crt" - - # В секрете pm security_protocol = SASL_PLAINTEXT — верно для того, - # как им пользуется сам pm, но реальный листенер (см. выше) требует - # SASL_SSL. Фиксируем тут, а не из вольта, чтобы не переписать это - # значение обратно на PLAINTEXT — по той же причине, что и KAFKA_HOST/PORT. - name: KAFKA_SECURITY_PROTOCOL value: _default: "SASL_SSL" @@ -136,9 +102,6 @@ spec: podAnnotations: _default: - # Из base убраны KAFKA_HOST/KAFKA_PORT/KAFKA_SECURITY_PROTOCOL: файл - # /vault/secrets/message-hub-kafka подгружается через `set -a; . file`, - # то есть переписывает переменные окружения поверх envs. vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/pm vault.hashicorp.com/agent-inject-template-message-hub-kafka: |- {{- with secret "secrets/data/kafka/apps/pm" -}} diff --git a/apps/pm/d8-ugmk-prod/backend.yaml b/apps/pm/d8-ugmk-prod/backend.yaml index d32d734..6d142ee 100644 --- a/apps/pm/d8-ugmk-prod/backend.yaml +++ b/apps/pm/d8-ugmk-prod/backend.yaml @@ -15,8 +15,6 @@ spec: values: services: backend: - # base: production_a889f6a3 (релиз 1.14.1, 13.07.2026). - # Здесь 1.14.7 — pipeline 72144, зелёный. image: name: _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551 @@ -29,14 +27,11 @@ spec: [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 + [ -f /vault/secrets/pm-kafka ] && . /vault/secrets/pm-kafka set +a python manage.py makemigrations pm --noinput python manage.py migrate exec /opt/sarex/entrypoint.sh - - # ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ, - # поэтому здесь продублирован весь набор из apps/pm/base/backend.yaml. - # Отличия от base помечены комментариями. envs: - name: USERS_INTERNAL_HOST value: @@ -123,7 +118,23 @@ spec: - name: KAFKA_ENABLE value: - _default: "False" + _default: "True" + + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]' + + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SASL_SSL" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-prod"}' - name: AUTH_PUBLIC_TOKEN_URL value: @@ -157,6 +168,23 @@ spec: value: _default: "INFO" + volumes: + _default: + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + podAnnotations: _default: vault.hashicorp.com/agent-inject-template-pm-s3: |- @@ -168,3 +196,10 @@ spec: {{- $buckets := index .Data.data "buckets" }} S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}sarex-media-storage{{ end }} {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm + vault.hashicorp.com/agent-inject-template-pm-kafka: |- + {{- with secret "secrets/data/kafka/apps/pm" -}} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} + KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/pm/d8-ugmk-prod/kafka-ca-configmap.yaml b/apps/pm/d8-ugmk-prod/kafka-ca-configmap.yaml new file mode 100644 index 0000000..9b76d6b --- /dev/null +++ b/apps/pm/d8-ugmk-prod/kafka-ca-configmap.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-ca-cert + namespace: pm +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw + NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC + h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy + D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV + tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM + Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C + GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA + A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL + QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP + KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j + kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j + TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8 + fdA17/ibw6gFrH2b3vZKcx8D455V + -----END CERTIFICATE----- diff --git a/apps/pm/d8-ugmk-prod/kustomization.yaml b/apps/pm/d8-ugmk-prod/kustomization.yaml index 481f2b6..b3cf4eb 100644 --- a/apps/pm/d8-ugmk-prod/kustomization.yaml +++ b/apps/pm/d8-ugmk-prod/kustomization.yaml @@ -4,6 +4,7 @@ kind: Kustomization resources: - ../base - redis.yaml + - kafka-ca-configmap.yaml patches: - path: namespace.yaml target: From 390eec0d1f36510514351ff6055d59cecc190c34 Mon Sep 17 00:00:00 2001 From: ivan Date: Fri, 7 Aug 2026 13:03:50 +0500 Subject: [PATCH 76/85] ++ --- apps/pm/d8-ugmk-prod/celery.yaml | 58 +++++++++++++++++++++++++++++++- 1 file changed, 57 insertions(+), 1 deletion(-) diff --git a/apps/pm/d8-ugmk-prod/celery.yaml b/apps/pm/d8-ugmk-prod/celery.yaml index 6b2fe1e..93c3c38 100644 --- a/apps/pm/d8-ugmk-prod/celery.yaml +++ b/apps/pm/d8-ugmk-prod/celery.yaml @@ -21,6 +21,20 @@ spec: name: _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551 + # base не переопределяет args, а нам нужно добавить sourcing pm-kafka — + # дублируем скрипт целиком (то же самое, что и в backend.yaml). + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db + [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq + [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 + [ -f /vault/secrets/pm-kafka ] && . /vault/secrets/pm-kafka + set +a + exec celery -A config worker -B -l info -E -Q pm -n default_worker.%h --concurrency=2 + envs: # base: http://backend-service.sarex.svc.cluster.local:8000 — ns sarex не существует - name: USERS_INTERNAL_HOST @@ -108,7 +122,25 @@ spec: - name: KAFKA_ENABLE value: - _default: "False" + _default: "True" + + # См. подробные комментарии в apps/pm/d8-ugmk-prod/backend.yaml — + # то же самое, воркер должен уметь публиковать в Kafka так же, как API. + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]' + + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SASL_SSL" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-prod"}' # base: https://lk.sarex.io/api/token/public/ - name: AUTH_PUBLIC_TOKEN_URL @@ -145,6 +177,23 @@ spec: value: _default: "INFO" + volumes: + _default: + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + podAnnotations: _default: # base склеивал S3_BUCKET с S3_VERIFY: {{- end -}} съедал перевод строки. @@ -158,3 +207,10 @@ spec: {{- $buckets := index .Data.data "buckets" }} S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}sarex-media-storage{{ end }} {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm + vault.hashicorp.com/agent-inject-template-pm-kafka: |- + {{- with secret "secrets/data/kafka/apps/pm" -}} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} + KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} + {{- end -}} From 7ff0388e153b3e79136a4e71d43fac0d429476c8 Mon Sep 17 00:00:00 2001 From: ivan Date: Fri, 7 Aug 2026 13:27:56 +0500 Subject: [PATCH 77/85] ++ --- apps/django/base/backend.yaml | 2 +- apps/django/base/celery.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/django/base/backend.yaml b/apps/django/base/backend.yaml index 2548704..f30aab3 100644 --- a/apps/django/base/backend.yaml +++ b/apps/django/base/backend.yaml @@ -67,7 +67,7 @@ spec: enabled: false image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_f813140d + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b pullPolicy: _default: IfNotPresent service: diff --git a/apps/django/base/celery.yaml b/apps/django/base/celery.yaml index 2d83de5..3ecbad3 100644 --- a/apps/django/base/celery.yaml +++ b/apps/django/base/celery.yaml @@ -67,7 +67,7 @@ spec: enabled: false image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0 + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b pullPolicy: _default: IfNotPresent service: From 88b7c3bee521aca3fbc587047063ba04f667a190 Mon Sep 17 00:00:00 2001 From: ivan Date: Fri, 7 Aug 2026 13:43:25 +0500 Subject: [PATCH 78/85] ++ --- apps/flows/base/backend.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/flows/base/backend.yaml b/apps/flows/base/backend.yaml index b8bf70b..1c8569e 100644 --- a/apps/flows/base/backend.yaml +++ b/apps/flows/base/backend.yaml @@ -131,7 +131,7 @@ spec: - name: PLANNING_HOST value: - _default: "http://backend-svc.pm.svc.cluster.local:80/api/pm/msp" + _default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp" - name: PLANNING_USE value: From a6d7db503078e04607795c8bca6ed74253d7de2a Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Fri, 7 Aug 2026 14:26:12 +0300 Subject: [PATCH 79/85] fix identity.fullURL for ugmk: was falling back to chart default identity.camunda.sarex.io instead of camunda-identity.sarex-k8s.uralmine.com --- infrastructure/camunda/d8-ugmk-prod/camunda.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infrastructure/camunda/d8-ugmk-prod/camunda.yaml b/infrastructure/camunda/d8-ugmk-prod/camunda.yaml index 30d0764..a14ed4f 100644 --- a/infrastructure/camunda/d8-ugmk-prod/camunda.yaml +++ b/infrastructure/camunda/d8-ugmk-prod/camunda.yaml @@ -269,6 +269,7 @@ spec: - name: regcred tolerations: [] identity: + fullURL: "https://camunda-identity.sarex-k8s.uralmine.com" externalDatabase: enabled: true host: 10.222.255.162 From 3c5687d970e4e40e44e1082fdd2233c080f96b25 Mon Sep 17 00:00:00 2001 From: ivan Date: Sat, 8 Aug 2026 12:41:36 +0500 Subject: [PATCH 80/85] ++ --- apps/cde/base/cde.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apps/cde/base/cde.yaml b/apps/cde/base/cde.yaml index b9e2f4e..f147cb1 100644 --- a/apps/cde/base/cde.yaml +++ b/apps/cde/base/cde.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /http resources: From 111e13acc91b6ff1a2d0901af1582c54469cf677 Mon Sep 17 00:00:00 2001 From: ivan Date: Sat, 8 Aug 2026 13:17:40 +0500 Subject: [PATCH 81/85] ++ --- apps/cde/base/cde-flowscallback.yaml | 3 ++- apps/cde/base/cde-splitpdf.yaml | 3 ++- apps/cde/base/cde-worker-alert.yaml | 3 ++- apps/cde/base/cde-worker-copy.yaml | 3 ++- apps/cde/base/cde-worker-copyv2.yaml | 3 ++- apps/cde/base/cde-worker-create-versions.yaml | 3 ++- apps/cde/base/cde-worker-create-versionsv2.yaml | 3 ++- apps/cde/base/cde-worker-markings.yaml | 3 ++- apps/cde/base/cde-worker-markingsv2.yaml | 3 ++- apps/cde/base/cde-worker-sign.yaml | 3 ++- apps/cde/base/cde-worker-signv2.yaml | 3 ++- apps/cde/base/cde-worker-update-bundles.yaml | 3 ++- 12 files changed, 24 insertions(+), 12 deletions(-) diff --git a/apps/cde/base/cde-flowscallback.yaml b/apps/cde/base/cde-flowscallback.yaml index f629edc..b3f4689 100644 --- a/apps/cde/base/cde-flowscallback.yaml +++ b/apps/cde/base/cde-flowscallback.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-splitpdf.yaml b/apps/cde/base/cde-splitpdf.yaml index 044e1a3..081d967 100644 --- a/apps/cde/base/cde-splitpdf.yaml +++ b/apps/cde/base/cde-splitpdf.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-alert.yaml b/apps/cde/base/cde-worker-alert.yaml index 6cc5d01..a530a3d 100644 --- a/apps/cde/base/cde-worker-alert.yaml +++ b/apps/cde/base/cde-worker-alert.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-copy.yaml b/apps/cde/base/cde-worker-copy.yaml index e190b28..1b04c4c 100644 --- a/apps/cde/base/cde-worker-copy.yaml +++ b/apps/cde/base/cde-worker-copy.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-copyv2.yaml b/apps/cde/base/cde-worker-copyv2.yaml index 2961697..6a9e872 100644 --- a/apps/cde/base/cde-worker-copyv2.yaml +++ b/apps/cde/base/cde-worker-copyv2.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-create-versions.yaml b/apps/cde/base/cde-worker-create-versions.yaml index e67eb33..34dbebc 100644 --- a/apps/cde/base/cde-worker-create-versions.yaml +++ b/apps/cde/base/cde-worker-create-versions.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-create-versionsv2.yaml b/apps/cde/base/cde-worker-create-versionsv2.yaml index 2a0378a..16e15a9 100644 --- a/apps/cde/base/cde-worker-create-versionsv2.yaml +++ b/apps/cde/base/cde-worker-create-versionsv2.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-markings.yaml b/apps/cde/base/cde-worker-markings.yaml index bf01157..06dfb48 100644 --- a/apps/cde/base/cde-worker-markings.yaml +++ b/apps/cde/base/cde-worker-markings.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-markingsv2.yaml b/apps/cde/base/cde-worker-markingsv2.yaml index 4aff52e..f592c8b 100644 --- a/apps/cde/base/cde-worker-markingsv2.yaml +++ b/apps/cde/base/cde-worker-markingsv2.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-sign.yaml b/apps/cde/base/cde-worker-sign.yaml index eb64503..3d3f18e 100644 --- a/apps/cde/base/cde-worker-sign.yaml +++ b/apps/cde/base/cde-worker-sign.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-signv2.yaml b/apps/cde/base/cde-worker-signv2.yaml index fbbb009..7363a0a 100644 --- a/apps/cde/base/cde-worker-signv2.yaml +++ b/apps/cde/base/cde-worker-signv2.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-update-bundles.yaml b/apps/cde/base/cde-worker-update-bundles.yaml index be24a12..2c60e0b 100644 --- a/apps/cde/base/cde-worker-update-bundles.yaml +++ b/apps/cde/base/cde-worker-update-bundles.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: From d17b56883c18a35f4d5a0fa7dade0addc56aa9ad Mon Sep 17 00:00:00 2001 From: ivan Date: Sat, 8 Aug 2026 14:10:20 +0500 Subject: [PATCH 82/85] ++ --- apps/reviews/base/helmrelease.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/reviews/base/helmrelease.yaml b/apps/reviews/base/helmrelease.yaml index 4f8c42e..71bc808 100644 --- a/apps/reviews/base/helmrelease.yaml +++ b/apps/reviews/base/helmrelease.yaml @@ -35,7 +35,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/reviews-frontend:contour_3a66be35 + _default: cr.yandex/crp3ccidau046kdj8g9q/reviews-frontend:contour_c5a6d3b4 pullPolicy: _default: IfNotPresent From dd942e6a4b8561aedbff2b14df1753e68ae18318 Mon Sep 17 00:00:00 2001 From: ivan Date: Sat, 8 Aug 2026 14:14:11 +0500 Subject: [PATCH 83/85] ++ --- apps/documentations/base/frontend.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/documentations/base/frontend.yaml b/apps/documentations/base/frontend.yaml index 2698745..dd268de 100644 --- a/apps/documentations/base/frontend.yaml +++ b/apps/documentations/base/frontend.yaml @@ -29,7 +29,7 @@ spec: enabled: true image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ae1bb076 + _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_e5f99d7c pullPolicy: _default: IfNotPresent deployment: From c9ae76d672f086b9016b63d6cd859833ad6f7ba0 Mon Sep 17 00:00:00 2001 From: ivan Date: Sat, 8 Aug 2026 16:11:12 +0500 Subject: [PATCH 84/85] ++ --- apps/documentations/base/api.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/documentations/base/api.yaml b/apps/documentations/base/api.yaml index 83b7f10..86558b6 100644 --- a/apps/documentations/base/api.yaml +++ b/apps/documentations/base/api.yaml @@ -65,7 +65,7 @@ spec: enabled: false image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430 + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_3f19a21d pullPolicy: _default: IfNotPresent service: From 8e51376de88d6b28109b80c752afe54fd7c447a9 Mon Sep 17 00:00:00 2001 From: ivan Date: Sat, 8 Aug 2026 20:17:39 +0500 Subject: [PATCH 85/85] ++ --- apps/flows/base/backend.yaml | 2 +- apps/flows/base/celery.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/flows/base/backend.yaml b/apps/flows/base/backend.yaml index 1c8569e..9b52b73 100644 --- a/apps/flows/base/backend.yaml +++ b/apps/flows/base/backend.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_2a439111 + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_858029dd pullPolicy: _default: IfNotPresent deployment: diff --git a/apps/flows/base/celery.yaml b/apps/flows/base/celery.yaml index 4e20e5f..4707076 100644 --- a/apps/flows/base/celery.yaml +++ b/apps/flows/base/celery.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_2a439111 + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_858029dd pullPolicy: _default: IfNotPresent