The base django-configmap hardcoded HOST to the yc-k8s-test domain, and every
cluster inheriting it got that value. HOST now reads DJANGO_HOST with the old
value as the default; backend in vad, uralkal and d8-ugmk-prod sets its own
public host. celery is left on the default.
Manifests exported from the live cluster with server-side and Helm/Lens
metadata stripped; selectors and pod labels kept as they are so Flux takes
the objects over without restarting pods.
orchestrator: cde API, its Service and ServiceAccount, the v1 workers
installed by the old helm release cde and the v2 workers rolled out today.
documentations: hasher and pdf-markings-amqp. Secrets (cde-secret,
hasher-*, postgres-secret, rabbitmq, yc-s3, dockerhub, regcred) stay in the
cluster only. The old apps/cde/brusnika-stage overlay (namespace contracts,
HelmRelease cde) was never wired; its kustomization now lists only these
manifests.
New service on universal-chart with Vault Agent: role premises, SA
premises-vault, creds for its own postgres, kafka and S3 plus the five
neighbour databases the sync script reads. The vad overlay mounts the Kafka CA
and drops the prod-sized resource requests; istio-config routes
sarex.vadroad.ru/premises/api/ to backend-svc.premises.
/orchestrator/api/process/, /orchestrator/api/sign and /orchestrator/ are
rewritten to /api/... before reaching cde.orchestrator:8080, same rules as
the cde-api virtual service in vad. Replaces the single prefix route that
passed the path through unchanged.
Same cde-api virtual service as d8-ugmk-prod: /orchestrator/api/process/,
/orchestrator/api/sign and /orchestrator/ are rewritten to /api/... and sent
to cde-svc.cde.svc.cluster.local:80.
KAFKA_SASL_MECHANISM is read from auth.sasl_mechanism when the nested auth
map exists and from the top-level sasl_mechanism otherwise, so the pods start
both before and after kafka/apps/pm switches to creds delivered from the
kafka-topics terraform stack.
flows, issues, pm and message-hub read ca.crt from a copy of the Kafka TLS
secret in their own namespace instead of an inline PEM (flows) or a
per-namespace kafka-ca-cert ConfigMap (issues, pm, message-hub). Mount paths
and env names are unchanged. The secret must exist in each namespace before
the pods restart.
