New service on universal-chart with Vault Agent: role premises, SA
premises-vault, creds for its own postgres, kafka and S3 plus the five
neighbour databases the sync script reads. The vad overlay mounts the Kafka CA
and drops the prod-sized resource requests; istio-config routes
sarex.vadroad.ru/premises/api/ to backend-svc.premises.
/orchestrator/api/process/, /orchestrator/api/sign and /orchestrator/ are
rewritten to /api/... before reaching cde.orchestrator:8080, same rules as
the cde-api virtual service in vad. Replaces the single prefix route that
passed the path through unchanged.
Same cde-api virtual service as d8-ugmk-prod: /orchestrator/api/process/,
/orchestrator/api/sign and /orchestrator/ are rewritten to /api/... and sent
to cde-svc.cde.svc.cluster.local:80.
New HelmRelease services.admin-frontend in apps/control-interface/base,
matching the live Deployment's image/port/resources (cpu 100m, memory
100Mi) and istio tracing podAnnotations. Downward-API envs (K8S_POD_UID/
K8S_POD_NAME/K8S_NAMESPACE/OTEL_RESOURCE_ATTRIBUTES) were left out — no
existing app in this repo uses valueFrom/fieldRef in the universal-chart
envs schema and the chart source isn't reachable to confirm support.
imagePullSecrets uses regcred (vad's actual convention) instead of the
source's dockerhub.
Since control-interface/vad and /uralkal both just inherit ../base
unmodified, this also shows up in uralkal as a side effect.
infrastructure/istio-config/vad: adds a plain admin-frontend route
(/admin-frontend/static/ -> admin-frontend-svc.control-interface, rewrite
/), matching the minimal style of the other sarex.vadroad.ru routes —
no cors block, per request.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds 13 new VirtualServices on the existing test.sarex.brusnika.tech host
and ingress-nginx/main-gateway, matching the active (non-commented)
location blocks in global-ingress's nginx-configmap (fetched live from the
cluster and cross-checked service/port/namespace names against what's
actually running). The root path (/) stays routed to
nginx-service.global-ingress as a fallback for anything not covered here.
Two deliberate deviations from literally replaying the nginx config:
- /comparisons/api/: nginx proxies to port 8080, but the real
backend-service.comparisons Service listens on 80 (targetPort 8080) —
used 80.
- /orchestrator/: nginx declares 4 location blocks, but the first
(bare ~^/orchestrator/) shadows the other three for any non-empty
path (nginx picks the first matching regex location, not the most
specific), so only one route (no rewrite) was ported, matching what
nginx actually does today.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
