sarex/iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master' into aero

Browse Source
This commit is contained in:
emelinda 2026-08-09 23:38:14 +03:00
commit c8555d432c
13 changed files with 896 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apps/flows/base/backend.yaml
View File

@ -42,7 +42,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_858029dd
_default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216
pullPolicy:
_default: IfNotPresent
deployment:

2
apps/flows/base/celery.yaml
View File

@ -42,7 +42,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_858029dd
_default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216
pullPolicy:
_default: IfNotPresent

167
apps/flows/d8-ugmk-prod/backend.yaml Normal file
View File

@ -0,0 +1,167 @@
---
# Патч backend для контура УГМК — подключение к Kafka.
#
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
# podAnnotations — map, мержится по ключам, поэтому переопределён только
# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: backend
namespace: flows
spec:
values:
services:
backend:
deployment:
args:
_default:
- |
set -a
[ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
[ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
[ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
[ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
[ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
[ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
set +a
exec /opt/entrypoint.sh
envs:
- name: LOG_LEVEL
value:
_default: "DEBUG"
- name: BASE_HOST
value:
_default: "https://srx.wb.ru"
- name: CELERY_QUEUE
value:
_default: "flow"
- name: EAV_HOST
value:
_default: "http://backend-svc.eav.svc.cluster.local:80"
- name: DJANGO_HOST
value:
_default: "http://backend-svc.django.svc.cluster.local:80/api"
- name: PLANNING_HOST
value:
_default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp"
- name: PLANNING_USE
value:
_default: "True"
- name: DOCUMENTATION_HOST
value:
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
- name: DOCUMENTATION_EXTERNAL_HOST
value:
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
- name: ENABLE_ANALYTICS
value:
_default: "1"
- name: ENABLE_CELERY
value:
_default: "1"
- name: ENABLE_MAILGUN
value:
_default: "0"
- name: ENABLE_METRICS
value:
_default: "0"
- name: FROM_EMAIL
value:
_default: "sarex@rwb.ru"
- name: GATEWAY_URL
value:
_default: "http://pdm-svc.documentations.svc.cluster.local:80"
- name: RESOURCE_URL
value:
_default: "http://iam-backend.iam.svc.cluster.local:8000"
- name: SERVICE_HOST
value:
_default: "https://srx.wb.ru/flows/api/v1"
- name: SMTP_HOST
value:
_default: "mail.rwb.ru"
- name: CHECKLIST_HOST
value:
_default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
- name: SMTP_PORT
value:
_default: "465"
- name: SYNC_RESOURCE_ID
value:
_default: "1"
- name: TIMEOUT
value:
_default: "120"
- name: WORKFLOWS_HOST
value:
_default: "http://backend-svc.processing.svc.cluster.local:80/api/v1"
- name: WORKFLOWS_TIMEOUT
value:
_default: "60"
- name: DOCUMENTATION_TIMEOUT
value:
_default: "60"
- name: KAFKA_HOST
value:
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
- name: KAFKA_SSL_CERT
value:
_default: |
-----BEGIN CERTIFICATE-----
MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
fdA17/ibw6gFrH2b3vZKcx8D455V
-----END CERTIFICATE-----
podAnnotations:
_default:
vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
vault.hashicorp.com/agent-inject-template-flows-kafka: |-
{{- with secret "secrets/data/kafka/apps/flows" -}}
KAFKA_USERNAME={{ index .Data.data "username" }}
KAFKA_PASSWORD={{ index .Data.data "password" }}
{{- end -}}

168
apps/flows/d8-ugmk-prod/celery.yaml Normal file
View File

@ -0,0 +1,168 @@
---
# Патч celery для контура УГМК — подключение к Kafka.
#
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml.
# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
# podAnnotations — map, мержится по ключам, поэтому переопределён только
# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: celery
namespace: flows
spec:
values:
services:
celery:
deployment:
args:
_default:
- |
set -a
[ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
[ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
[ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
[ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
[ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
[ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
set +a
exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow
envs:
- name: LOG_LEVEL
value:
_default: "DEBUG"
- name: BASE_HOST
value:
_default: "https://srx.wb.ru"
- name: CELERY_QUEUE
value:
_default: "flow"
- name: EAV_HOST
value:
_default: "http://backend-svc.eav.svc.cluster.local:80"
- name: DJANGO_HOST
value:
_default: "http://backend-svc.django.svc.cluster.local:80/api"
- name: PLANNING_HOST
value:
_default: "http://backend-service.pm.svc.cluster.local:80/api/pm/msp"
- name: PLANNING_USE
value:
_default: "True"
- name: DOCUMENTATION_HOST
value:
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
- name: DOCUMENTATION_EXTERNAL_HOST
value:
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
- name: ENABLE_ANALYTICS
value:
_default: "1"
- name: ENABLE_CELERY
value:
_default: "1"
- name: ENABLE_MAILGUN
value:
_default: "0"
- name: ENABLE_METRICS
value:
_default: "0"
- name: FROM_EMAIL
value:
_default: "sarex@rwb.ru"
- name: GATEWAY_URL
value:
_default: "http://pdm-api.documentations.svc.cluster.local:8080"
- name: RESOURCE_URL
value:
_default: "http://resources-service.resources.svc.cluster.local:8000"
- name: SERVICE_HOST
value:
_default: "https://srx.wb.ru/flows/api/v1"
- name: SMTP_HOST
value:
_default: "mail.rwb.ru"
- name: CHECKLIST_HOST
value:
_default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
- name: SMTP_PORT
value:
_default: "465"
- name: SYNC_RESOURCE_ID
value:
_default: "1"
- name: TIMEOUT
value:
_default: "120"
- name: WORKFLOWS_HOST
value:
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
- name: WORKFLOWS_TIMEOUT
value:
_default: "60"
- name: DOCUMENTATION_TIMEOUT
value:
_default: "60"
# См. подробные комментарии в apps/flows/d8-ugmk-prod/backend.yaml.
- name: KAFKA_HOST
value:
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
- name: KAFKA_SSL_CERT
value:
_default: |
-----BEGIN CERTIFICATE-----
MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
fdA17/ibw6gFrH2b3vZKcx8D455V
-----END CERTIFICATE-----
podAnnotations:
_default:
vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
vault.hashicorp.com/agent-inject-template-flows-kafka: |-
{{- with secret "secrets/data/kafka/apps/flows" -}}
KAFKA_USERNAME={{ index .Data.data "username" }}
KAFKA_PASSWORD={{ index .Data.data "password" }}
{{- end -}}

8
apps/flows/d8-ugmk-prod/kustomization.yaml
View File

@ -8,3 +8,11 @@ patches:
target:
kind: Namespace
name: flows
- path: backend.yaml
target:
kind: HelmRelease
name: backend
- path: celery.yaml
target:
kind: HelmRelease
name: celery

2
apps/issues/base/backend.yaml
View File

@ -42,7 +42,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa
_default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909
pullPolicy:
_default: IfNotPresent

2
apps/issues/base/celery.yaml
View File

@ -42,7 +42,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa
_default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909
pullPolicy:
_default: IfNotPresent

6
apps/issues/base/production-configmap.yaml
View File

@ -48,9 +48,9 @@ data:
WORKFLOWS_URL = "http://workflows-api-service.workflow.svc.cluster.local:8000"
DOCUMENTATIONS_URL = "http://backend-api-svc.documentations.svc.cluster.local:80"
RESOURCES_API_HOST = os.getenv("RESOURCES_API_HOST", default="http://resources-service.resources.svc.cluster:8000")
KAFKA_HOST = "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093"
KAFKA_USERNAME = "sarex"
KAFKA_PASSWORD = "nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC"
KAFKA_HOST = os.getenv("KAFKA_HOST", "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093")
KAFKA_USERNAME = os.getenv("KAFKA_USERNAME", "sarex")
KAFKA_PASSWORD = os.getenv("KAFKA_PASSWORD", "nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC")
KAFKA_SSL_CAFILE = os.getenv("KAFKA_SSL_CAFILE", "/usr/local/share/ca-certificates/kafka.crt")
KAFKA_EAV_ASSETS_TOPIC = os.getenv("KAFKA_EAV_ASSETS_TOPIC", "sarex")
KAFKA_ISSUES_TOPIC = os.getenv("KAFKA_ISSUES_TOPIC", "sarex-issues")

129
apps/issues/d8-ugmk-prod/backend-s3.yaml
View File

@ -1,4 +1,7 @@
---
# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml.
# podAnnotations — map, мержится по ключам.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
@ -8,6 +11,126 @@ spec:
values:
services:
backend:
deployment:
args:
_default:
- |
set -a
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
set +a
exec /src/entrypoint.sh
volumes:
_default:
- name: production-configmap
mountPath:
_default: /src/config/settings/production.py
subPath:
_default: production.py
readOnly:
_default: true
configMap:
name:
_default: production-configmap
items:
- key: production.py
path:
_default: production.py
- name: kafka-ca-cert
mountPath:
_default: /usr/local/share/ca-certificates/kafka.crt
subPath:
_default: kafka.crt
readOnly:
_default: true
configMap:
name:
_default: kafka-ca-cert
items:
- key: kafka.crt
path:
_default: kafka.crt
envs:
- name: ENVIRONMENT
value:
_default: "production"
- name: AERO_PUBLIC_HOST
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: AERO_HOST
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: BASE_AERO_URL
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: BASE_AUTH_URL
value:
_default: "http://backend-svc.django.svc.cluster.local:80"
- name: WORKFLOWS_HOST
value:
_default: "http://backend-svc.workflow.svc.cluster.local:80"
- name: WORKFLOWS_URL
value:
_default: "http://backend-svc.workflow.svc.cluster.local:80"
- name: RESOURCES_API_HOST
value:
_default: "http://iam-backend.iam.svc.cluster.local:8000"
- name: EAV_HOST
value:
_default: "http://backend-svc.eav.svc.cluster.local:80"
- name: SAREX_API
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: DOCUMENTATIONS_URL
value:
_default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
- name: DJANGO_SETTINGS_MODULE
value:
_default: "config.settings.production"
- name: API_ADDRESS
value:
_default: "8000"
# Kafka — код (kafka_app/app.py) ждёт KAFKA_HOST единой строкой "host:port",
# KAFKA_SSL_CAFILE — путь к файлу (не PEM-текст, в отличие от flows-backend).
# Хост/порт/CA — те же проверенные значения, что у message-hub/pm/flows.
- name: KAFKA_HOST
value:
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
- name: KAFKA_SSL_CAFILE
value:
_default: "/usr/local/share/ca-certificates/kafka.crt"
# Топики совпадают с тем, что уже провижено на брокере (см. topics
# в секрете kafka/apps/pm) и с SETTINGS_TOPICS у message-hub.
- name: KAFKA_ISSUES_TOPIC
value:
_default: "issues_broadcast_prod"
- name: KAFKA_EAV_ASSETS_TOPIC
value:
_default: "assets_broadcast"
podAnnotations:
_default:
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
@ -18,3 +141,9 @@ spec:
YC_S3_BUCKET_NAME=sarex-issues
YC_S3_ENDPOINT_URL=https://s3.uralmine.com
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
{{- with secret "secrets/data/kafka/apps/issues" -}}
KAFKA_USERNAME={{ index .Data.data "username" }}
KAFKA_PASSWORD={{ index .Data.data "password" }}
{{- end -}}

125
apps/issues/d8-ugmk-prod/celery-s3.yaml
View File

@ -1,4 +1,7 @@
---
# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
# поэтому здесь продублирован весь набор из apps/issues/base/celery.yaml.
# podAnnotations — map, мержится по ключам.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
@ -8,6 +11,122 @@ spec:
values:
services:
celery:
deployment:
args:
_default:
- |
set -a
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
set +a
exec celery -A config worker -l info -E
volumes:
_default:
- name: production-configmap
mountPath:
_default: /src/config/settings/production.py
subPath:
_default: production.py
readOnly:
_default: true
configMap:
name:
_default: production-configmap
items:
- key: production.py
path:
_default: production.py
- name: kafka-ca-cert
mountPath:
_default: /usr/local/share/ca-certificates/kafka.crt
subPath:
_default: kafka.crt
readOnly:
_default: true
configMap:
name:
_default: kafka-ca-cert
items:
- key: kafka.crt
path:
_default: kafka.crt
envs:
- name: ENVIRONMENT
value:
_default: "production"
- name: AERO_PUBLIC_HOST
value:
_default: "https://srx.wb.ru"
- name: AERO_HOST
value:
_default: "https://srx.wb.ru"
- name: BASE_AERO_URL
value:
_default: "https://srx.wb.ru"
- name: BASE_AUTH_URL
value:
_default: "http://backend-svc.django.svc.cluster.local:80"
- name: WORKFLOWS_HOST
value:
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
- name: WORKFLOWS_URL
value:
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
- name: RESOURCES_API_HOST
value:
_default: "http://iam-backend.iam.svc.cluster.local:8000"
- name: EAV_HOST
value:
_default: "http://backend-svc.eav.svc.cluster.local:80"
- name: SAREX_API
value:
_default: "https://srx.wb.ru"
- name: DOCUMENTATIONS_URL
value:
_default: "http://backend-api-svc.documentations.svc.cluster.local:80"
- name: DJANGO_SETTINGS_MODULE
value:
_default: "config.settings.production"
- name: API_ADDRESS
value:
_default: "8000"
# См. подробные комментарии в apps/issues/d8-ugmk-prod/backend-s3.yaml.
- name: KAFKA_HOST
value:
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
- name: KAFKA_SSL_CAFILE
value:
_default: "/usr/local/share/ca-certificates/kafka.crt"
- name: KAFKA_ISSUES_TOPIC
value:
_default: "issues_broadcast_prod"
- name: KAFKA_EAV_ASSETS_TOPIC
value:
_default: "assets_broadcast"
podAnnotations:
_default:
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
@ -18,3 +137,9 @@ spec:
YC_S3_BUCKET_NAME=sarex-issues
YC_S3_ENDPOINT_URL=https://s3.uralmine.com
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
{{- with secret "secrets/data/kafka/apps/issues" -}}
KAFKA_USERNAME={{ index .Data.data "username" }}
KAFKA_PASSWORD={{ index .Data.data "password" }}
{{- end -}}

263
apps/issues/d8-ugmk-prod/kafka-app.yaml Normal file
View File

@ -0,0 +1,263 @@
---
# Отдельный процесс-консьюмер Kafka для issues (src/run_kafka_app.py, слушает
# eav_router — see kafka_app/consumers/eav_assets_consumer.py). В base этого
# сервиса нет вообще, аналогов в других контурах тоже — только для УГМК.
# Использует тот же образ/DB/S3-креды, что backend (django.setup() требует
# полный конфиг), плюс отдельно креды Kafka.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: kafka-app
namespace: issues
spec:
interval: 10m
chart:
spec:
chart: universal-chart
version: "0.1.9"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
global:
env: _default
services:
kafka-app:
enabled: true
serviceAccount:
enabled:
_default: true
name:
_default: issues-vault
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa
pullPolicy:
_default: IfNotPresent
deployment:
enabled: true
name:
_default: kafka-app
replicaCount:
_default: 1
port:
_default: 8000
command:
_default: ["/bin/sh", "-ec"]
args:
_default:
- |
set -a
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
set +a
exec python3 run_kafka_app.py
resources:
requests:
cpu:
_default: 25m
memory:
_default: 128Mi
probes:
liveness:
enabled: false
readiness:
enabled: false
service:
enabled: false
imagePullSecrets:
enabled:
_default: true
name:
_default: regcred
volumes:
_default:
- name: production-configmap
mountPath:
_default: /src/config/settings/production.py
subPath:
_default: production.py
readOnly:
_default: true
configMap:
name:
_default: production-configmap
items:
- key: production.py
path:
_default: production.py
- name: kafka-ca-cert
mountPath:
_default: /usr/local/share/ca-certificates/kafka.crt
subPath:
_default: kafka.crt
readOnly:
_default: true
configMap:
name:
_default: kafka-ca-cert
items:
- key: kafka.crt
path:
_default: kafka.crt
envs:
- name: ENVIRONMENT
value:
_default: "production"
- name: AERO_PUBLIC_HOST
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: AERO_HOST
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: BASE_AERO_URL
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: BASE_AUTH_URL
value:
_default: "http://backend-svc.django.svc.cluster.local:80"
- name: WORKFLOWS_HOST
value:
_default: "http://backend-svc.workflow.svc.cluster.local:80"
- name: WORKFLOWS_URL
value:
_default: "http://backend-svc.workflow.svc.cluster.local:80"
- name: RESOURCES_API_HOST
value:
_default: "http://iam-backend.iam.svc.cluster.local:8000"
- name: EAV_HOST
value:
_default: "http://backend-svc.eav.svc.cluster.local:80"
- name: SAREX_API
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: DOCUMENTATIONS_URL
value:
_default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
- name: DJANGO_SETTINGS_MODULE
value:
_default: "config.settings.production"
- name: API_ADDRESS
value:
_default: "8000"
- name: KAFKA_HOST
value:
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
- name: KAFKA_SSL_CAFILE
value:
_default: "/usr/local/share/ca-certificates/kafka.crt"
- name: KAFKA_ISSUES_TOPIC
value:
_default: "issues_broadcast_prod"
- name: KAFKA_EAV_ASSETS_TOPIC
value:
_default: "assets_broadcast"
podAnnotations:
_default:
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/auth-path: auth/kubernetes
vault.hashicorp.com/role: issues
vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/apps/issues/postgres
vault.hashicorp.com/agent-inject-template-issues-db: |-
{{- with secret "secrets/data/apps/issues/postgres" -}}
DATABASE_PORT={{ index .Data.data "port" }}
DATABASE_HOST={{ index .Data.data "host" }}
DATABASE_USER={{ index .Data.data "username" }}
DATABASE_PASSWORD={{ index .Data.data "password" }}
DATABASE_NAME={{ index .Data.data "database" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues
vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |-
{{- with secret "secrets/data/rabbitmq/apps/issues" -}}
RABBITMQ_VHOST={{ index .Data.data "vhost" }}
RABBITMQ_USERNAME={{ index .Data.data "username" }}
RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local
RABBITMQ_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
vault.hashicorp.com/agent-inject-template-issues-s3: |-
{{- with secret "secrets/data/minio/apps/issues" -}}
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
YC_S3_BUCKET_NAME=sarex-issues
YC_S3_ENDPOINT_URL=https://s3.uralmine.com
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth
vault.hashicorp.com/agent-inject-template-issues-django-auth: |-
{{- with secret "secrets/data/vault/common/django_auth" -}}
DJANGO_TOKEN={{ index .Data.data "key" }}
SAREX_USERNAME={{ index .Data.data "username" }}
SAREX_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-issues-jwt-private: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "private_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-issues-jwt-public: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "public_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
{{- with secret "secrets/data/kafka/apps/issues" -}}
KAFKA_USERNAME={{ index .Data.data "username" }}
KAFKA_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
commitSha: ""
gitlabUri: ""
gitlabJobUrl: ""
owner: ""

27
apps/issues/d8-ugmk-prod/kafka-ca-configmap.yaml Normal file
View File

@ -0,0 +1,27 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: kafka-ca-cert
namespace: issues
data:
kafka.crt: |
-----BEGIN CERTIFICATE-----
MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
fdA17/ibw6gFrH2b3vZKcx8D455V
-----END CERTIFICATE-----

2
apps/issues/d8-ugmk-prod/kustomization.yaml
View File

@ -3,6 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../base
- kafka-ca-configmap.yaml
- kafka-app.yaml
patches:
- path: namespace.yaml
target: