Manifests exported from the live cluster with server-side and Helm/Lens
metadata stripped; selectors and pod labels kept as they are so Flux takes
the objects over without restarting pods.
orchestrator: cde API, its Service and ServiceAccount, the v1 workers
installed by the old helm release cde and the v2 workers rolled out today.
documentations: hasher and pdf-markings-amqp. Secrets (cde-secret,
hasher-*, postgres-secret, rabbitmq, yc-s3, dockerhub, regcred) stay in the
cluster only. The old apps/cde/brusnika-stage overlay (namespace contracts,
HelmRelease cde) was never wired; its kustomization now lists only these
manifests.
New service on universal-chart with Vault Agent: role premises, SA
premises-vault, creds for its own postgres, kafka and S3 plus the five
neighbour databases the sync script reads. The vad overlay mounts the Kafka CA
and drops the prod-sized resource requests; istio-config routes
sarex.vadroad.ru/premises/api/ to backend-svc.premises.
apps/<app>/uralkal mirrors apps/<app>/vad for all 36 apps from
clusters/vad/kustomization.yaml, with domains remapped (not a suffix swap —
vad's sarex-login.vadroad.ru etc. use a different host scheme than uralkal's
login.sarex.local.uralkali.com). Two things are left as explicit
placeholders pending real infra: the Zitadel client_id/org_id
(TBD_URALKAL_ZITADEL_CLIENT_ID, since uralkal's Zitadel has no application
registered yet) and the Kafka CA cert in pm/issues/message-hub/flows
(copied from vad, will need swapping once uralkal's Kafka actually
generates its own CA, same as vad's history).
infrastructure/s3-proxy/uralkal: new component, nginx upstream points at
the single uralkal minio endpoint (10.133.0.245:9000) from terraform,
unlike vad's 4-node list.
clusters/uralkal/kustomization.yaml: wires in s3-proxy + all 36 apps.
infrastructure/istio-config/uralkal/istio-config.yaml: adds the 28
path-routed virtualServices under sarex.local.uralkali.com (mirroring
vad's sarex.vadroad.ru routing, incl. the documentations-api CORS policy)
plus stamp-verification/document-link/s3 on their already-declared hosts.
Pre-existing zitadel/superset/camunda-operate blocks are untouched.
apps/django/vad/backend.yaml: drop a stale explanatory comment (also
removed from the uralkal copy before this commit).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
First business app on asterus, overlay copied from brusnika-prod
(no namespace.yaml — ns and regcred created manually, out of band).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Flux self-managed bootstrap files copied from ugok (controller images
already mirrored to cr.yandex), GitRepository/Kustomization pointed at
gitlab.sarex.io directly since the cluster has outbound internet access.
Starts with just flux-system + helm-repositories, infra/apps to be added
incrementally.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
django's nginx-configmap is patched for vad: pm and processing aren't
deployed there yet (kept commented out), documentations is enabled
since it's going in alongside django this time.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Все 4 — чистое наследование base:
- eav, bi — vault-зависимости (postgres [+ eav также minio]) заведены
через terraform (live/database, live/s3, applications-блок).
- auth-flow, document-link — чистые статические фронтенды без бэкенда
(см. CLAUDE.md), вообще без vault-зависимостей.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
apps/django/sarex-contour — чистое наследование base (backend, celery,
frontend, srx-admin, s3-proxy, redis, конфигмапы). Все vault-пути
(apps/django/postgres, rabbitmq/apps/django, minio/apps/django,
kafka/apps/django, vault/common/{rsa_keys,django_auth}) заведены через
terraform в infra/terraform. S3-эндпоинт в манифестах base захардкожен
на несуществующий домен — деплою как есть, патчить по факту если
помешает подняться (как с rabbitmq/zitadel).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
