++ zitadel contract secret

fix: adding marks via rabbit value

See merge request infra/iac!7

CLAUDE.md

@@ -39,7 +39,8 @@
 **Кластер.** `clusters/<cluster>/kustomization.yaml` — плоский список `../../apps/<app>/<cluster>`. Инфраструктура подключается двумя разными способами:
 
 - `d8-ugmk-prod` — прямо в корневом kustomization как `../../infrastructure/<comp>/d8-ugmk-prod`;
-- `brusnika-prod`, `brusnika-stage`, `wb` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/<c>/infrastructure/patches/*.yaml`.
+- `brusnika-prod`, `brusnika-stage` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на оверлеи `../../../infrastructure/<comp>/<c>` (`base` + патч HelmRelease + сопутствующие манифесты компонента);
+- `wb` — через `clusters/wb/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/wb/infrastructure/patches/*.yaml`.
 
 Кластеры: `brusnika-prod`, `brusnika-stage`, `d8-ugmk-prod`, `wb`, `yc-cps-prod`, `yc-ecp`, `yc-infra-prod`, `yc-k8s-test`, `yc-k8s-test-02`, `contour`.
 

apps/ams-sync/brusnika-stage/backend.yaml

@@ -138,6 +138,10 @@ spec:
           - name: KAFKA_SASL_MECHANISM
             value:
               _default: "SCRAM-SHA-512"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: TELEGRAM_TOKEN
             secretName:

apps/attachments/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:production_6dbb4dce
+            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
           pullPolicy:
             _default: IfNotPresent
 
@@ -110,6 +110,10 @@ spec:
           - name: YANDEX_S3_VERIFY
             value:
               _default: "false"
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "false"
+
         secretEnvs:
           - name: DATABASE_HOST
             secretName:

apps/auth-flow/uralkal/helmrelease.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: auth-flow
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/auth-flow/uralkal/kustomization.yaml

@@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: frontend

apps/bi/base/backend.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 500m
+                _default: 25m
               memory:
-                _default: 1Gi
+                _default: 128Mi
 
           probes:
             liveness:

apps/bi/brusnika-stage/backend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_37902c73
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_e607dcc6
           pullPolicy:
             _default: IfNotPresent
 
@@ -119,6 +119,10 @@ spec:
             _default: regcred
 
         envs:
+          - name: SUPERSET_HOST
+            value:
+              _default: "https://superset.test.sarex.brusnika.tech"
+
           - name: SETTINGS_DEBUG
             value:
               _default: "0"

apps/bi/brusnika-stage/frontend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:production_afb137d4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:contour_9cfd1a0b
           pullPolicy:
             _default: IfNotPresent
 

apps/bi/uralkal/backend.yaml

@@ -8,6 +8,11 @@ spec:
   values:
     services:
       main:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
         envs:
           - name: SETTINGS_DEBUG
             value:

apps/bi/uralkal/frontend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: bi-frontend
+  namespace: bi
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/bi/uralkal/kustomization.yaml

@@ -7,3 +7,7 @@ patches:
     target:
       kind: HelmRelease
       name: bi-backend
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: bi-frontend

apps/bim/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a
           pullPolicy:
             _default: IfNotPresent
 

apps/bim/uralkal/backend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: bim
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/bim/uralkal/kustomization.yaml

@@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend

apps/cde/base/cde-flowscallback.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 500m
+                _default: 25m
               memory:
-                _default: 1Gi
+                _default: 128Mi
 
           probes:
             liveness:

apps/cde/base/cde-worker-copy.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: "1"
+                _default: 25m
               memory:
-                _default: 1Gi
+                _default: 228Mi
 
           probes:
             liveness:

apps/cde/base/cde.yaml

@@ -71,7 +71,7 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 500m
+                _default: 250m
               memory:
                 _default: 512Mi
 

apps/cde/brusnika-stage/cde-flowscallback.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-flowscallback
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-flowscallback
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-flowscallback
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-flowscallback
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-flowscallback
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-splitpdf.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-splitpdf
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-splitpdf
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-splitpdf
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-splitpdf
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_4.4.1
+        imagePullPolicy: Always
+        name: cde-worker-splitpdf
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-alert.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-alert
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-alert
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-alert
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-alert
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/orchestrator:latest
+        imagePullPolicy: Always
+        name: cde-worker-alert
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copy.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-copy
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-copy
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-copy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-copy
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-copy
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copyv2.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-copyv2
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-copyv2
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-copy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-copy
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/copyv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-copy
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-markings.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-markings
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-markings
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-markings
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-markings
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:preprod_eb50f30e
+        imagePullPolicy: Always
+        name: cde-worker-markings
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-sign.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-sign
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-sign
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-sign
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-sign
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-sign
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-update-bundles.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-update-bundles
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-updatebundles
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-updatebundles
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-updatebundles
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-update-bundles
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde.yaml

@@ -0,0 +1,55 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/cde:production_e5316bd0
+        imagePullPolicy: Always
+        livenessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          successThreshold: 1
+          tcpSocket:
+            port: 8080
+          timeoutSeconds: 1
+        name: cde
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          successThreshold: 1
+          tcpSocket:
+            port: 8080
+          timeoutSeconds: 1
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/createversionsv2-worke.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: createversionsv2-worke
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-createversions
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-createversions
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-createversions
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'true'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/createversionsv2-worker:preprod_90202b78
+        imagePullPolicy: Always
+        name: createversionsv2-worke
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/kustomization.yaml

@@ -1,6 +1,19 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: contracts
+namespace: orchestrator
 resources:
-  - helmrelease.yaml
+  - serviceaccount.yaml
+  - service.yaml
+  - cde.yaml
+  - cde-flowscallback.yaml
+  - cde-splitpdf.yaml
+  - cde-worker-alert.yaml
+  - cde-worker-copy.yaml
+  - cde-worker-markings.yaml
+  - cde-worker-sign.yaml
+  - cde-worker-update-bundles.yaml
+  - cde-worker-copyv2.yaml
+  - createversionsv2-worke.yaml
+  - markingsv2-worker.yaml
+  - signv2-worker.yaml

apps/cde/brusnika-stage/markingsv2-worker.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: markingsv2-worker
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-markings
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-markings
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-markings
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/markingsv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-markings
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/service.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: 8080

apps/cde/brusnika-stage/serviceaccount.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+    app.kubernetes.io/version: 0.0.1

apps/cde/brusnika-stage/signv2-worker.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: signv2-worker
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-sign
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-sign
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-sign
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/signv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-sign
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/uralkal/cde-flowscallback.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-flowscallback
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-flowscallback:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-splitpdf.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-splitpdf
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-splitpdf:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-alert.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-alert
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-alert:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-copy.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-copy
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-copy:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-copyv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-copyv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-copyv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-create-versions.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-create-versions
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-create-versions:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-create-versionsv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-create-versionsv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-create-versionsv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-markings.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-markings
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-markings:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-markingsv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-markingsv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-markingsv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-sign.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-sign
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-sign:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-signv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-signv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-signv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-update-bundles.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-update-bundles
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-update-bundles:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde
+  namespace: cde
+spec:
+  values:
+    services:
+      cde:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/kustomization.yaml

@@ -2,3 +2,56 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: cde-flowscallback.yaml
+    target:
+      kind: HelmRelease
+      name: cde-flowscallback
+  - path: cde-splitpdf.yaml
+    target:
+      kind: HelmRelease
+      name: cde-splitpdf
+  - path: cde-worker-alert.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-alert
+  - path: cde-worker-copy.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-copy
+  - path: cde-worker-copyv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-copyv2
+  - path: cde-worker-create-versions.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-create-versions
+  - path: cde-worker-create-versionsv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-create-versionsv2
+  - path: cde-worker-markings.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-markings
+  - path: cde-worker-markingsv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-markingsv2
+  - path: cde-worker-sign.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-sign
+  - path: cde-worker-signv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-signv2
+  - path: cde-worker-update-bundles.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-update-bundles
+  - path: cde.yaml
+    target:
+      kind: HelmRelease
+      name: cde

apps/checklists/uralkal/helmrelease.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: checklists
+  namespace: checklists
+spec:
+  values:
+    services:
+      checklists:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/checklists/uralkal/kustomization.yaml

@@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: checklists

apps/comparisons/uralkal/backend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: comparisons
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/comparisons/uralkal/frontend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: comparisons
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/comparisons/uralkal/kustomization.yaml

@@ -2,3 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend

apps/control-interface/base/admin-frontend.yaml

@@ -0,0 +1,94 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: admin-frontend
+  namespace: control-interface
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      admin-frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/admin-frontend:contour_9dc27b40
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: admin-frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: admin-frontend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/control-interface/base/kustomization.yaml

@@ -4,4 +4,5 @@ kind: Kustomization
 namespace: control-interface
 resources:
   - helmrelease.yaml
+  - admin-frontend.yaml
 

apps/control-interface/uralkal/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - ../base
   - namespace.yaml
+  - psql-tools-debug.yaml

apps/control-interface/uralkal/psql-tools-debug.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: psql-tools-debug
+  namespace: control-interface
+  labels:
+    app: psql-tools-debug
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: psql-tools-debug
+  template:
+    metadata:
+      labels:
+        app: psql-tools-debug
+    spec:
+      containers:
+        - name: debug
+          image: cr.yandex/crp3ccidau046kdj8g9q/zitadel-bpmn:cc_contour_5.22.3_ca40c204
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c"]
+          args:
+            - while true; do sleep 3600; done
+      imagePullSecrets:
+        - name: regcred

apps/cross-section/uralkal/helmrelease.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cross-section-static
+  namespace: cross-section
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cross-section/uralkal/kustomization.yaml

@@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: cross-section-static

apps/django/base/django-configmap.yaml

@@ -87,7 +87,7 @@ data:
         'Bearer',
     )
 
-    HOST = "https://sarex.contour.infra.sarex.tech"
+    HOST = os.environ.get("DJANGO_HOST", "https://sarex.contour.infra.sarex.tech")
 
     POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
     POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')

apps/django/brusnika-prod/s3-proxy.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_37a48176
+            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
           pullPolicy:
             _default: IfNotPresent
 
@@ -89,7 +89,7 @@ spec:
         envs:
           - name: AWS_API_ENDPOINT
             value:
-              _default: "http://minio-svc.minio.svc.cluster.local:9000"
+              _default: "https://obs.ru-moscow-1.hc.sbercloud.ru"
           - name: APP_PORT
             value:
               _default: "8000"

apps/django/brusnika-stage/celery.yaml

@@ -330,6 +330,14 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/brusnika-stage/export-project.yaml

@@ -88,6 +88,11 @@ spec:
         labels:
           monitoring: prometheus
 
+        envs:
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/django/brusnika-stage/nginx-configmap.yaml

@@ -101,7 +101,8 @@ data:
 
             location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
                 alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
-                add_header Content-Type application/wasm always;
+                types { }
+                default_type application/wasm;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -110,7 +111,8 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -119,7 +121,8 @@ data:
 
             location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
                 alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -128,7 +131,8 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -136,7 +140,8 @@ data:
             }
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                add_header Content-Type application/wasm always;
+                types { }
+                default_type application/wasm;
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
             }
 
@@ -144,7 +149,8 @@ data:
             rewrite /workspaces-v2/(.+) /$1 break;
             proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
 
-            add_header Content-Type application/wasm;
+            proxy_hide_header Content-Type;
+            add_header Content-Type application/wasm always;
             proxy_set_header Accept application/wasm;
         }
 

apps/django/brusnika-stage/sarex-backend.yaml

@@ -313,6 +313,18 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/d8-ugmk-prod/backend.yaml

@@ -18,6 +18,9 @@ spec:
           - name: SERVER_ZITADEL_ENABLED
             value:
               _default: "True"
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.uralmine.com"
           - name: DJANGO_SETTINGS_MODULE
             value:
               _default: config.settings.production

apps/django/uralkal/backend.yaml

@@ -8,7 +8,16 @@ spec:
   values:
     services:
       backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
         envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.local.uralkali.com"
+
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/django/uralkal/celery.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: django
+spec:
+  values:
+    services:
+      celery:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/django/uralkal/frontend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: django
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/django/uralkal/kustomization.yaml

@@ -19,3 +19,15 @@ patches:
     target:
       kind: HelmRelease
       name: s3-proxy
+  - path: celery.yaml
+    target:
+      kind: HelmRelease
+      name: celery
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
+  - path: srx-admin.yaml
+    target:
+      kind: HelmRelease
+      name: srx-admin-frontend

apps/django/uralkal/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            # location ~^/api/pm/ {
-            #     proxy_http_version 1.1;
-            #     proxy_set_header Connection "";
-            #     proxy_set_header Host $host;
-            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            # }
+            location ~^/api/pm/ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                proxy_set_header Host $host;
+                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;

apps/django/uralkal/srx-admin.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: srx-admin-frontend
+  namespace: django
+spec:
+  values:
+    services:
+      srx-admin:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/django/vad/backend.yaml

@@ -9,6 +9,10 @@ spec:
     services:
       backend:
         envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.vadroad.ru"
+
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/django/vad/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            # location ~^/api/pm/ {
-            #     proxy_http_version 1.1;
-            #     proxy_set_header Connection "";
-            #     proxy_set_header Host $host;
-            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            # }
+            location ~^/api/pm/ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                proxy_set_header Host $host;
+                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;

apps/document-link/uralkal/frontend.yaml

@@ -8,6 +8,11 @@ spec:
   values:
     services:
       frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
         image:
           name:
             _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:vad_60487abb

apps/documentations/base/pdm.yaml

@@ -210,7 +210,7 @@ spec:
               _default: http://backend-svc.subscriptions.svc.cluster.local:80
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://api-service.system-log.svc.cluster.local:80
+              _default: http://backend-svc.system-log.svc.cluster.local:80
           - name: TARGET_URL
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/brusnika-prod/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_b34286a7
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
           pullPolicy:
             _default: IfNotPresent
 
@@ -267,6 +267,15 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
           pullPolicy:
             _default: IfNotPresent
 
@@ -100,6 +100,10 @@ spec:
         labels:
           monitoring: prometheus
         envs:
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
           - name: POSTGRES_ADDRESS
             value:
               _default: "192.168.2.45"
@@ -255,6 +259,34 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/filestream.yaml

@@ -255,6 +255,19 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/hasher.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hasher
+  namespace: documentations
+  labels:
+    app: hasher
+    service: normal
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: hasher
+  template:
+    metadata:
+      labels:
+        app: hasher
+        service: normal
+    spec:
+      containers:
+      - env:
+        - name: HASHER_APP__LOG_LEVEL
+          value: INFO
+        - name: HASHER_APP__NUM_WORKERS
+          value: '4'
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
+          value: hash.compute.normal.tasks
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
+          value: hash.compute
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
+          value: direct
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
+          value: hash.compute.normal
+        - name: HASHER_S3__MAX_POOL_CONNECTIONS
+          value: '10'
+        - name: HASHER_S3__CONNECT_TIMEOUT
+          value: '10'
+        - name: HASHER_S3__READ_TIMEOUT
+          value: '30'
+        - name: HASHER_S3__REGION_NAME
+          value: ru-central1
+        - name: HASHER_S3__USE_SSL
+          value: 'true'
+        - name: HASHER_S3__VERIFY
+          value: 'true'
+        - name: HASHER_AMQP__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: user
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__HOST
+          valueFrom:
+            secretKeyRef:
+              key: host
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__PORT
+          valueFrom:
+            secretKeyRef:
+              key: port
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__VHOST
+          valueFrom:
+            secretKeyRef:
+              key: vhost
+              name: hasher-rabbitmq-secret
+        - name: HASHER_S3__ENDPOINT
+          valueFrom:
+            secretKeyRef:
+              key: endpoint
+              name: hasher-s3-secret
+        - name: HASHER_S3__ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access_key
+              name: hasher-s3-secret
+        - name: HASHER_S3__SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: secret_key
+              name: hasher-s3-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
+        imagePullPolicy: IfNotPresent
+        name: normal
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+      imagePullSecrets:
+      - name: regcred

apps/documentations/brusnika-stage/kustomization.yaml

@@ -7,3 +7,5 @@ resources:
   - pdm.yaml
   - api.yaml
   - filestream.yaml
+  - hasher.yaml
+  - pdf-markings-amqp.yaml

apps/documentations/brusnika-stage/pdf-markings-amqp.yaml

@@ -0,0 +1,125 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pdf-markings-amqp
+  namespace: documentations
+  labels:
+    app: pdf-markings-amqp
+    service: api
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pdf-markings-amqp
+  strategy:
+    rollingUpdate:
+      maxSurge: 3
+      maxUnavailable: 3
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: pdf-markings-amqp
+        service: api
+    spec:
+      containers:
+      - env:
+        - name: MARKS_APP__LOG_LEVEL
+          value: INFO
+        - name: MARKS_CRYPTO__HASHING_ALGO
+          value: md_gost12_256
+        - name: MARKS_DOCUMENTS_DB__HOST
+          value: 192.168.2.45
+        - name: MARKS_DOCUMENTS_DB__PORT
+          value: '5432'
+        - name: MARKS_DOCUMENTS_DB__DATABASE
+          value: documentations
+        - name: MARKS_DOCUMENTS_DB__SSLMODE
+          value: disable
+        - name: MARKS_QR__REDIRECT_URL
+          value: https://stamp-verification.test.sarex.brusnika.tech/
+        - name: MARKS_QR__BASE_DOCUMENT_URL
+          value: https://test.sarex.brusnika.tech
+        - name: MARKS_S3__USE_SSL
+          value: 'false'
+        - name: MARKS_S3__SSL_VERIFY
+          value: 'false'
+        - name: MARKS_S3__REGION
+          value: ru-central1
+        - name: MARKS_S3__DEFAULT_BUCKET
+          value: documentations-stage-1-sarex-new
+        - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
+          value: pdf_markings_input
+        - name: MARKS_DOCUMENTS_DB__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: postgres-secret
+        - name: MARKS_DOCUMENTS_DB__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret
+        - name: MARKS_S3__URL
+          valueFrom:
+            secretKeyRef:
+              key: endpoint_url
+              name: yc-s3
+        - name: MARKS_S3__ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: key_id
+              name: yc-s3
+        - name: MARKS_S3__SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access_key
+              name: yc-s3
+        - name: MARKS_RABBITMQ__HOST
+          valueFrom:
+            secretKeyRef:
+              key: host
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__PORT
+          valueFrom:
+            secretKeyRef:
+              key: port
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__VHOST
+          valueFrom:
+            secretKeyRef:
+              key: vhost
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
+          valueFrom:
+            secretKeyRef:
+              key: heartbeat
+              name: rabbitmq
+        image: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+        imagePullPolicy: IfNotPresent
+        name: api
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        volumeMounts:
+        - mountPath: /etc/sarex/yc-s3-storage
+          name: yc-s3
+          readOnly: true
+      volumes:
+      - name: yc-s3
+        secret:
+          secretName: yc-s3
+      imagePullSecrets:
+      - name: regcred

apps/documentations/brusnika-stage/pdm.yaml

@@ -124,11 +124,11 @@ spec:
 
           - name: TRANSMITTALS_BASE_URL
             value:
-              _default: ""
+              _default: "http://transmittal-service.transmittal.svc.cluster.local:80"
 
           - name: TRANSMITTALS_ENABLE
             value:
-              _default: "false"
+              _default: "true"
 
           - name: DRAWINGS_INTERNAL_URL
             value:
@@ -308,6 +308,14 @@ spec:
           - name: WORKSPACE_URL
             value:
               _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+          - name: BUCKET_NAME
+            value:
+              _default: "attachments-storage"
+
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+
         secretEnvs:
           - name: RELEASES_TOKEN
             secretName:

apps/documentations/d8-ugmk-prod/filestream.yaml

@@ -83,7 +83,7 @@ spec:
               _default: v1
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://api-service.system-log.svc.cluster.local:80
+              _default: http://backend-svc.system-log.svc.cluster.local:80
           - name: DJANGO_HOST
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/uralkal/api.yaml

@@ -8,6 +8,14 @@ spec:
   values:
     services:
       backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api:contour_8631bb0e
         envs:
           - name: POSTGRES_POOL_SIZE
             value:
@@ -18,6 +26,9 @@ spec:
           - name: ZITADEL_DOMAIN
             value:
               _default: login.sarex.local.uralkali.com
+          - name: ZITADEL_INSECURE_SKIP_VERIFY
+            value:
+              _default: "true"
           - name: USE_ZITADEL
             value:
               _default: "1"

apps/documentations/uralkal/filestream.yaml

@@ -8,10 +8,21 @@ spec:
   values:
     services:
       backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:contour_8631bb0e
         envs:
           - name: POSTGRES_POOL_SIZE
             value:
               _default: "20"
+          - name: ZITADEL_INSECURE_SKIP_VERIFY
+            value:
+              _default: "true"
           - name: ZITADEL_ACCOUNT
             value:
               _default: /vault/secrets/documentations-zitadel-account-json

apps/documentations/uralkal/frontend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: documentations
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/documentations/uralkal/hasher.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-hasher
+  namespace: documentations
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/documentations/uralkal/kustomization.yaml

@@ -15,3 +15,15 @@ patches:
     target:
       kind: HelmRelease
       name: documentations-pdf-markings-amqp
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
+  - path: hasher.yaml
+    target:
+      kind: HelmRelease
+      name: documentations-hasher
+  - path: pdm.yaml
+    target:
+      kind: HelmRelease
+      name: pdm-api

apps/documentations/uralkal/pdf-markings-amqp.yaml

@@ -8,6 +8,11 @@ spec:
   values:
     services:
       backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
         envs:
           - name: MARKS_APP__LOG_LEVEL
             value:

apps/documentations/uralkal/pdm.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdm-api
+  namespace: documentations
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/documentations/wb/api.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
           pullPolicy:
             _default: IfNotPresent
 
@@ -307,6 +307,23 @@ spec:
             value:
               _default: "6379"
 
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
+          - name: USE_MARKS_RABBITMQ
+            value:
+              _default: '1'
+          - name: MARKS_RABBITMQ_HOST
+            value: 
+              _default: rabbitmq.rabbitmq.svc.cluster.local
+          - name: MARKS_RABBITMQ_PORT
+            value: 
+              _default: '5672'
+          - name: MARKS_RABBITMQ_API
+            value: 
+              _default: cde
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:
@@ -338,6 +355,16 @@ spec:
               _default: "django-auth"
             secretKey: "key"
 
+          - name: MARKS_RABBITMQ_USER
+            secretName:
+              _default: "hasher-rabbitmq-secret"
+            secretKey: "user"
+
+          - name: MARKS_RABBITMQ_PASSWORD
+            secretName:
+              _default: "hasher-rabbitmq-secret"
+            secretKey: "password"
+
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/eav/brusnika-stage/helmrelease.yaml

@@ -166,6 +166,10 @@ spec:
           - name: YC_S3_BUCKET_NAME
             value:
               _default: "eav"
+          - name: KAFKA_ENABLED
+            value:
+              _default: "False"
+
         secretEnvs:
           - name: KAFKA_PASSWORD
             secretName:

apps/eav/uralkal/helmrelease.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: eav
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/eav/uralkal/kustomization.yaml

@@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: backend

apps/faas/uralkal/backend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: export-reviews
+  namespace: faas
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/faas/uralkal/kustomization.yaml

@@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: export-reviews

apps/flows/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 
@@ -225,6 +225,22 @@ spec:
           - name: DOCUMENTATION_TIMEOUT
             value:
               _default: "60"
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: PROXY_PATH_PREFIX
+            value:
+              _default: "/flows"
+
+          - name: CHECKLIST_HOST
+            value:
+              _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
+
         secretEnvs:
           - name: ADMIN_PANEL_SECRET_KEY
             secretName:

apps/flows/brusnika-stage/celery.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
           pullPolicy:
             _default: IfNotPresent
 
@@ -223,7 +223,55 @@ spec:
           - name: DOCUMENTATION_TIMEOUT
             value:
               _default: "60"
+          - name: FLOWS_HOST
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: RESOURCES_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: FLOWS_DB_HOST
+            value:
+              _default: "192.168.2.45"
+
+          - name: FLOWS_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_HOST
+            value:
+              _default: "192.168.2.45"
+
+          - name: DJANGO_BASE_HOST
+            value:
+              _default: "https://test.sarex.brusnika.tech"
+
         secretEnvs:
+          - name: FLOWS_DB_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: FLOWS_DB_USERNAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: FLOWS_DB_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_AUTH
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
           - name: ADMIN_PANEL_SECRET_KEY
             secretName:
               _default: "admin-secret"

apps/flows/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_dcc5b5e6
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
           pullPolicy:
             _default: IfNotPresent