diff --git a/apps/flows/base/backend.yaml b/apps/flows/base/backend.yaml index 9b52b73..206a6e3 100644 --- a/apps/flows/base/backend.yaml +++ b/apps/flows/base/backend.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_858029dd + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216 pullPolicy: _default: IfNotPresent deployment: diff --git a/apps/flows/base/celery.yaml b/apps/flows/base/celery.yaml index 4707076..1636648 100644 --- a/apps/flows/base/celery.yaml +++ b/apps/flows/base/celery.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_858029dd + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216 pullPolicy: _default: IfNotPresent diff --git a/apps/flows/d8-ugmk-prod/backend.yaml b/apps/flows/d8-ugmk-prod/backend.yaml new file mode 100644 index 0000000..41ef91c --- /dev/null +++ b/apps/flows/d8-ugmk-prod/backend.yaml @@ -0,0 +1,167 @@ +--- +# Патч backend для контура УГМК — подключение к Kafka. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml. +# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: flows +spec: + values: + services: + backend: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql + [ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db + [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq + [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth + [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" + [ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka + set +a + exec /opt/entrypoint.sh + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://srx.wb.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@rwb.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-svc.documentations.svc.cluster.local:80" + + - name: RESOURCE_URL + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: SERVICE_HOST + value: + _default: "https://srx.wb.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "mail.rwb.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "465" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://backend-svc.processing.svc.cluster.local:80/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CERT + value: + _default: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw + NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC + h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy + D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV + tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM + Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C + GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA + A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL + QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP + KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j + kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j + TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8 + fdA17/ibw6gFrH2b3vZKcx8D455V + -----END CERTIFICATE----- + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows + vault.hashicorp.com/agent-inject-template-flows-kafka: |- + {{- with secret "secrets/data/kafka/apps/flows" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/flows/d8-ugmk-prod/celery.yaml b/apps/flows/d8-ugmk-prod/celery.yaml new file mode 100644 index 0000000..87b9226 --- /dev/null +++ b/apps/flows/d8-ugmk-prod/celery.yaml @@ -0,0 +1,168 @@ +--- +# Патч celery для контура УГМК — подключение к Kafka. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml. +# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: flows +spec: + values: + services: + celery: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql + [ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db + [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq + [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth + [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" + [ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka + set +a + exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://srx.wb.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:80/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@rwb.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: SERVICE_HOST + value: + _default: "https://srx.wb.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "mail.rwb.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "465" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + # См. подробные комментарии в apps/flows/d8-ugmk-prod/backend.yaml. + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CERT + value: + _default: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw + NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC + h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy + D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV + tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM + Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C + GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA + A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL + QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP + KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j + kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j + TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8 + fdA17/ibw6gFrH2b3vZKcx8D455V + -----END CERTIFICATE----- + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows + vault.hashicorp.com/agent-inject-template-flows-kafka: |- + {{- with secret "secrets/data/kafka/apps/flows" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/flows/d8-ugmk-prod/kustomization.yaml b/apps/flows/d8-ugmk-prod/kustomization.yaml index d399533..21c47bf 100644 --- a/apps/flows/d8-ugmk-prod/kustomization.yaml +++ b/apps/flows/d8-ugmk-prod/kustomization.yaml @@ -8,3 +8,11 @@ patches: target: kind: Namespace name: flows + - path: backend.yaml + target: + kind: HelmRelease + name: backend + - path: celery.yaml + target: + kind: HelmRelease + name: celery diff --git a/apps/issues/base/backend.yaml b/apps/issues/base/backend.yaml index cc341c8..83e4616 100644 --- a/apps/issues/base/backend.yaml +++ b/apps/issues/base/backend.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909 pullPolicy: _default: IfNotPresent diff --git a/apps/issues/base/celery.yaml b/apps/issues/base/celery.yaml index 5caf9ee..a5c2565 100644 --- a/apps/issues/base/celery.yaml +++ b/apps/issues/base/celery.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909 pullPolicy: _default: IfNotPresent diff --git a/apps/issues/base/production-configmap.yaml b/apps/issues/base/production-configmap.yaml index 012e486..162690d 100644 --- a/apps/issues/base/production-configmap.yaml +++ b/apps/issues/base/production-configmap.yaml @@ -48,9 +48,9 @@ data: WORKFLOWS_URL = "http://workflows-api-service.workflow.svc.cluster.local:8000" DOCUMENTATIONS_URL = "http://backend-api-svc.documentations.svc.cluster.local:80" RESOURCES_API_HOST = os.getenv("RESOURCES_API_HOST", default="http://resources-service.resources.svc.cluster:8000") - KAFKA_HOST = "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093" - KAFKA_USERNAME = "sarex" - KAFKA_PASSWORD = "nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC" + KAFKA_HOST = os.getenv("KAFKA_HOST", "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093") + KAFKA_USERNAME = os.getenv("KAFKA_USERNAME", "sarex") + KAFKA_PASSWORD = os.getenv("KAFKA_PASSWORD", "nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC") KAFKA_SSL_CAFILE = os.getenv("KAFKA_SSL_CAFILE", "/usr/local/share/ca-certificates/kafka.crt") KAFKA_EAV_ASSETS_TOPIC = os.getenv("KAFKA_EAV_ASSETS_TOPIC", "sarex") KAFKA_ISSUES_TOPIC = os.getenv("KAFKA_ISSUES_TOPIC", "sarex-issues") diff --git a/apps/issues/d8-ugmk-prod/backend-s3.yaml b/apps/issues/d8-ugmk-prod/backend-s3.yaml index 4c56193..dd37264 100644 --- a/apps/issues/d8-ugmk-prod/backend-s3.yaml +++ b/apps/issues/d8-ugmk-prod/backend-s3.yaml @@ -1,4 +1,7 @@ --- +# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml. +# podAnnotations — map, мержится по ключам. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -8,6 +11,126 @@ spec: values: services: backend: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka + set +a + exec /src/entrypoint.sh + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: AERO_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AERO_URL + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: WORKFLOWS_URL + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + # Kafka — код (kafka_app/app.py) ждёт KAFKA_HOST единой строкой "host:port", + # KAFKA_SSL_CAFILE — путь к файлу (не PEM-текст, в отличие от flows-backend). + # Хост/порт/CA — те же проверенные значения, что у message-hub/pm/flows. + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + # Топики совпадают с тем, что уже провижено на брокере (см. topics + # в секрете kafka/apps/pm) и с SETTINGS_TOPICS у message-hub. + - name: KAFKA_ISSUES_TOPIC + value: + _default: "issues_broadcast_prod" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + podAnnotations: _default: vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues @@ -18,3 +141,9 @@ spec: YC_S3_BUCKET_NAME=sarex-issues YC_S3_ENDPOINT_URL=https://s3.uralmine.com {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-kafka: |- + {{- with secret "secrets/data/kafka/apps/issues" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/issues/d8-ugmk-prod/celery-s3.yaml b/apps/issues/d8-ugmk-prod/celery-s3.yaml index 9ab021a..7c02f31 100644 --- a/apps/issues/d8-ugmk-prod/celery-s3.yaml +++ b/apps/issues/d8-ugmk-prod/celery-s3.yaml @@ -1,4 +1,7 @@ --- +# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/issues/base/celery.yaml. +# podAnnotations — map, мержится по ключам. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -8,6 +11,122 @@ spec: values: services: celery: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka + set +a + exec celery -A config worker -l info -E + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://srx.wb.ru" + + - name: AERO_HOST + value: + _default: "https://srx.wb.ru" + + - name: BASE_AERO_URL + value: + _default: "https://srx.wb.ru" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://srx.wb.ru" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + # См. подробные комментарии в apps/issues/d8-ugmk-prod/backend-s3.yaml. + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_ISSUES_TOPIC + value: + _default: "issues_broadcast_prod" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + podAnnotations: _default: vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues @@ -18,3 +137,9 @@ spec: YC_S3_BUCKET_NAME=sarex-issues YC_S3_ENDPOINT_URL=https://s3.uralmine.com {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-kafka: |- + {{- with secret "secrets/data/kafka/apps/issues" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/issues/d8-ugmk-prod/kafka-app.yaml b/apps/issues/d8-ugmk-prod/kafka-app.yaml new file mode 100644 index 0000000..67f9ba7 --- /dev/null +++ b/apps/issues/d8-ugmk-prod/kafka-app.yaml @@ -0,0 +1,263 @@ +--- +# Отдельный процесс-консьюмер Kafka для issues (src/run_kafka_app.py, слушает +# eav_router — see kafka_app/consumers/eav_assets_consumer.py). В base этого +# сервиса нет вообще, аналогов в других контурах тоже — только для УГМК. +# Использует тот же образ/DB/S3-креды, что backend (django.setup() требует +# полный конфиг), плюс отдельно креды Kafka. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kafka-app + namespace: issues +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + kafka-app: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: issues-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: kafka-app + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka + set +a + exec python3 run_kafka_app.py + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: AERO_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AERO_URL + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: WORKFLOWS_URL + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_ISSUES_TOPIC + value: + _default: "issues_broadcast_prod" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: issues + vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/apps/issues/postgres + vault.hashicorp.com/agent-inject-template-issues-db: |- + {{- with secret "secrets/data/apps/issues/postgres" -}} + DATABASE_PORT={{ index .Data.data "port" }} + DATABASE_HOST={{ index .Data.data "host" }} + DATABASE_USER={{ index .Data.data "username" }} + DATABASE_PASSWORD={{ index .Data.data "password" }} + DATABASE_NAME={{ index .Data.data "database" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues + vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/issues" -}} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=sarex-issues + YC_S3_ENDPOINT_URL=https://s3.uralmine.com + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-issues-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + SAREX_USERNAME={{ index .Data.data "username" }} + SAREX_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-kafka: |- + {{- with secret "secrets/data/kafka/apps/issues" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/d8-ugmk-prod/kafka-ca-configmap.yaml b/apps/issues/d8-ugmk-prod/kafka-ca-configmap.yaml new file mode 100644 index 0000000..9424d65 --- /dev/null +++ b/apps/issues/d8-ugmk-prod/kafka-ca-configmap.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-ca-cert + namespace: issues +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw + NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC + h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy + D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV + tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM + Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C + GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA + A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL + QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP + KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j + kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j + TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8 + fdA17/ibw6gFrH2b3vZKcx8D455V + -----END CERTIFICATE----- diff --git a/apps/issues/d8-ugmk-prod/kustomization.yaml b/apps/issues/d8-ugmk-prod/kustomization.yaml index a4cf8c2..549a8b2 100644 --- a/apps/issues/d8-ugmk-prod/kustomization.yaml +++ b/apps/issues/d8-ugmk-prod/kustomization.yaml @@ -3,6 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base + - kafka-ca-configmap.yaml + - kafka-app.yaml patches: - path: namespace.yaml target: