++ zitadel contract secret

fix: adding marks via rabbit value

See merge request infra/iac!7

apps/attachments/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:production_6dbb4dce
+            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
           pullPolicy:
             _default: IfNotPresent
 

apps/bi/brusnika-stage/backend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_37902c73
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_e607dcc6
           pullPolicy:
             _default: IfNotPresent
 
@@ -119,6 +119,10 @@ spec:
             _default: regcred
 
         envs:
+          - name: SUPERSET_HOST
+            value:
+              _default: "https://superset.test.sarex.brusnika.tech"
+
           - name: SETTINGS_DEBUG
             value:
               _default: "0"

apps/bim/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a
           pullPolicy:
             _default: IfNotPresent
 

apps/cde/brusnika-stage/cde-flowscallback.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-flowscallback
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-flowscallback
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-flowscallback
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-flowscallback
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-flowscallback
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-splitpdf.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-splitpdf
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-splitpdf
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-splitpdf
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-splitpdf
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_4.4.1
+        imagePullPolicy: Always
+        name: cde-worker-splitpdf
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-alert.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-alert
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-alert
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-alert
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-alert
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/orchestrator:latest
+        imagePullPolicy: Always
+        name: cde-worker-alert
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copy.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-copy
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-copy
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-copy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-copy
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-copy
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copyv2.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-copyv2
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-copyv2
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-copy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-copy
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/copyv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-copy
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-markings.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-markings
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-markings
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-markings
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-markings
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:preprod_eb50f30e
+        imagePullPolicy: Always
+        name: cde-worker-markings
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-sign.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-sign
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-sign
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-sign
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-sign
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-sign
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-update-bundles.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-update-bundles
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-updatebundles
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-updatebundles
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-updatebundles
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-update-bundles
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde.yaml

@@ -0,0 +1,55 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/cde:production_e5316bd0
+        imagePullPolicy: Always
+        livenessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          successThreshold: 1
+          tcpSocket:
+            port: 8080
+          timeoutSeconds: 1
+        name: cde
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          successThreshold: 1
+          tcpSocket:
+            port: 8080
+          timeoutSeconds: 1
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/createversionsv2-worke.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: createversionsv2-worke
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-createversions
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-createversions
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-createversions
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'true'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/createversionsv2-worker:preprod_90202b78
+        imagePullPolicy: Always
+        name: createversionsv2-worke
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/kustomization.yaml

@@ -1,6 +1,19 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: contracts
+namespace: orchestrator
 resources:
-  - helmrelease.yaml
+  - serviceaccount.yaml
+  - service.yaml
+  - cde.yaml
+  - cde-flowscallback.yaml
+  - cde-splitpdf.yaml
+  - cde-worker-alert.yaml
+  - cde-worker-copy.yaml
+  - cde-worker-markings.yaml
+  - cde-worker-sign.yaml
+  - cde-worker-update-bundles.yaml
+  - cde-worker-copyv2.yaml
+  - createversionsv2-worke.yaml
+  - markingsv2-worker.yaml
+  - signv2-worker.yaml

apps/cde/brusnika-stage/markingsv2-worker.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: markingsv2-worker
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-markings
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-markings
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-markings
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/markingsv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-markings
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/service.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: 8080

apps/cde/brusnika-stage/serviceaccount.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+    app.kubernetes.io/version: 0.0.1

apps/cde/brusnika-stage/signv2-worker.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: signv2-worker
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-sign
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-sign
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-sign
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/signv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-sign
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/control-interface/uralkal/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - ../base
   - namespace.yaml
+  - psql-tools-debug.yaml

apps/control-interface/uralkal/psql-tools-debug.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: psql-tools-debug
+  namespace: control-interface
+  labels:
+    app: psql-tools-debug
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: psql-tools-debug
+  template:
+    metadata:
+      labels:
+        app: psql-tools-debug
+    spec:
+      containers:
+        - name: debug
+          image: cr.yandex/crp3ccidau046kdj8g9q/zitadel-bpmn:cc_contour_5.22.3_ca40c204
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c"]
+          args:
+            - while true; do sleep 3600; done
+      imagePullSecrets:
+        - name: regcred

apps/django/base/django-configmap.yaml

@@ -87,7 +87,7 @@ data:
         'Bearer',
     )
 
-    HOST = "https://sarex.contour.infra.sarex.tech"
+    HOST = os.environ.get("DJANGO_HOST", "https://sarex.contour.infra.sarex.tech")
 
     POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
     POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')

apps/django/brusnika-stage/nginx-configmap.yaml

@@ -101,7 +101,8 @@ data:
 
             location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
                 alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
-                add_header Content-Type application/wasm always;
+                types { }
+                default_type application/wasm;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -110,7 +111,8 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -119,7 +121,8 @@ data:
 
             location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
                 alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -128,7 +131,8 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -136,7 +140,8 @@ data:
             }
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                add_header Content-Type application/wasm always;
+                types { }
+                default_type application/wasm;
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
             }
 
@@ -144,7 +149,8 @@ data:
             rewrite /workspaces-v2/(.+) /$1 break;
             proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
 
-            add_header Content-Type application/wasm;
+            proxy_hide_header Content-Type;
+            add_header Content-Type application/wasm always;
             proxy_set_header Accept application/wasm;
         }
 

apps/django/d8-ugmk-prod/backend.yaml

@@ -18,6 +18,9 @@ spec:
           - name: SERVER_ZITADEL_ENABLED
             value:
               _default: "True"
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.uralmine.com"
           - name: DJANGO_SETTINGS_MODULE
             value:
               _default: config.settings.production

apps/django/uralkal/backend.yaml

@@ -14,6 +14,10 @@ spec:
               cpu: null
               memory: null
         envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.local.uralkali.com"
+
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/django/uralkal/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            # location ~^/api/pm/ {
-            #     proxy_http_version 1.1;
-            #     proxy_set_header Connection "";
-            #     proxy_set_header Host $host;
-            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            # }
+            location ~^/api/pm/ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                proxy_set_header Host $host;
+                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;

apps/django/vad/backend.yaml

@@ -9,6 +9,10 @@ spec:
     services:
       backend:
         envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.vadroad.ru"
+
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/documentations/base/pdm.yaml

@@ -210,7 +210,7 @@ spec:
               _default: http://backend-svc.subscriptions.svc.cluster.local:80
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://api-service.system-log.svc.cluster.local:80
+              _default: http://backend-svc.system-log.svc.cluster.local:80
           - name: TARGET_URL
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/brusnika-stage/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
           pullPolicy:
             _default: IfNotPresent
 
@@ -100,6 +100,10 @@ spec:
         labels:
           monitoring: prometheus
         envs:
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
           - name: POSTGRES_ADDRESS
             value:
               _default: "192.168.2.45"

apps/documentations/brusnika-stage/hasher.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hasher
+  namespace: documentations
+  labels:
+    app: hasher
+    service: normal
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: hasher
+  template:
+    metadata:
+      labels:
+        app: hasher
+        service: normal
+    spec:
+      containers:
+      - env:
+        - name: HASHER_APP__LOG_LEVEL
+          value: INFO
+        - name: HASHER_APP__NUM_WORKERS
+          value: '4'
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
+          value: hash.compute.normal.tasks
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
+          value: hash.compute
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
+          value: direct
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
+          value: hash.compute.normal
+        - name: HASHER_S3__MAX_POOL_CONNECTIONS
+          value: '10'
+        - name: HASHER_S3__CONNECT_TIMEOUT
+          value: '10'
+        - name: HASHER_S3__READ_TIMEOUT
+          value: '30'
+        - name: HASHER_S3__REGION_NAME
+          value: ru-central1
+        - name: HASHER_S3__USE_SSL
+          value: 'true'
+        - name: HASHER_S3__VERIFY
+          value: 'true'
+        - name: HASHER_AMQP__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: user
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__HOST
+          valueFrom:
+            secretKeyRef:
+              key: host
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__PORT
+          valueFrom:
+            secretKeyRef:
+              key: port
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__VHOST
+          valueFrom:
+            secretKeyRef:
+              key: vhost
+              name: hasher-rabbitmq-secret
+        - name: HASHER_S3__ENDPOINT
+          valueFrom:
+            secretKeyRef:
+              key: endpoint
+              name: hasher-s3-secret
+        - name: HASHER_S3__ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access_key
+              name: hasher-s3-secret
+        - name: HASHER_S3__SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: secret_key
+              name: hasher-s3-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
+        imagePullPolicy: IfNotPresent
+        name: normal
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+      imagePullSecrets:
+      - name: regcred

apps/documentations/brusnika-stage/kustomization.yaml

@@ -7,3 +7,5 @@ resources:
   - pdm.yaml
   - api.yaml
   - filestream.yaml
+  - hasher.yaml
+  - pdf-markings-amqp.yaml

apps/documentations/brusnika-stage/pdf-markings-amqp.yaml

@@ -0,0 +1,125 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pdf-markings-amqp
+  namespace: documentations
+  labels:
+    app: pdf-markings-amqp
+    service: api
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pdf-markings-amqp
+  strategy:
+    rollingUpdate:
+      maxSurge: 3
+      maxUnavailable: 3
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: pdf-markings-amqp
+        service: api
+    spec:
+      containers:
+      - env:
+        - name: MARKS_APP__LOG_LEVEL
+          value: INFO
+        - name: MARKS_CRYPTO__HASHING_ALGO
+          value: md_gost12_256
+        - name: MARKS_DOCUMENTS_DB__HOST
+          value: 192.168.2.45
+        - name: MARKS_DOCUMENTS_DB__PORT
+          value: '5432'
+        - name: MARKS_DOCUMENTS_DB__DATABASE
+          value: documentations
+        - name: MARKS_DOCUMENTS_DB__SSLMODE
+          value: disable
+        - name: MARKS_QR__REDIRECT_URL
+          value: https://stamp-verification.test.sarex.brusnika.tech/
+        - name: MARKS_QR__BASE_DOCUMENT_URL
+          value: https://test.sarex.brusnika.tech
+        - name: MARKS_S3__USE_SSL
+          value: 'false'
+        - name: MARKS_S3__SSL_VERIFY
+          value: 'false'
+        - name: MARKS_S3__REGION
+          value: ru-central1
+        - name: MARKS_S3__DEFAULT_BUCKET
+          value: documentations-stage-1-sarex-new
+        - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
+          value: pdf_markings_input
+        - name: MARKS_DOCUMENTS_DB__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: postgres-secret
+        - name: MARKS_DOCUMENTS_DB__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret
+        - name: MARKS_S3__URL
+          valueFrom:
+            secretKeyRef:
+              key: endpoint_url
+              name: yc-s3
+        - name: MARKS_S3__ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: key_id
+              name: yc-s3
+        - name: MARKS_S3__SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access_key
+              name: yc-s3
+        - name: MARKS_RABBITMQ__HOST
+          valueFrom:
+            secretKeyRef:
+              key: host
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__PORT
+          valueFrom:
+            secretKeyRef:
+              key: port
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__VHOST
+          valueFrom:
+            secretKeyRef:
+              key: vhost
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
+          valueFrom:
+            secretKeyRef:
+              key: heartbeat
+              name: rabbitmq
+        image: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+        imagePullPolicy: IfNotPresent
+        name: api
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        volumeMounts:
+        - mountPath: /etc/sarex/yc-s3-storage
+          name: yc-s3
+          readOnly: true
+      volumes:
+      - name: yc-s3
+        secret:
+          secretName: yc-s3
+      imagePullSecrets:
+      - name: regcred

apps/documentations/brusnika-stage/pdm.yaml

@@ -124,11 +124,11 @@ spec:
 
           - name: TRANSMITTALS_BASE_URL
             value:
-              _default: ""
+              _default: "http://transmittal-service.transmittal.svc.cluster.local:80"
 
           - name: TRANSMITTALS_ENABLE
             value:
-              _default: "false"
+              _default: "true"
 
           - name: DRAWINGS_INTERNAL_URL
             value:

apps/documentations/d8-ugmk-prod/filestream.yaml

@@ -83,7 +83,7 @@ spec:
               _default: v1
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://api-service.system-log.svc.cluster.local:80
+              _default: http://backend-svc.system-log.svc.cluster.local:80
           - name: DJANGO_HOST
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/wb/api.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
           pullPolicy:
             _default: IfNotPresent
 
@@ -307,6 +307,23 @@ spec:
             value:
               _default: "6379"
 
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
+          - name: USE_MARKS_RABBITMQ
+            value:
+              _default: '1'
+          - name: MARKS_RABBITMQ_HOST
+            value: 
+              _default: rabbitmq.rabbitmq.svc.cluster.local
+          - name: MARKS_RABBITMQ_PORT
+            value: 
+              _default: '5672'
+          - name: MARKS_RABBITMQ_API
+            value: 
+              _default: cde
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:
@@ -338,6 +355,16 @@ spec:
               _default: "django-auth"
             secretKey: "key"
 
+          - name: MARKS_RABBITMQ_USER
+            secretName:
+              _default: "hasher-rabbitmq-secret"
+            secretKey: "user"
+
+          - name: MARKS_RABBITMQ_PASSWORD
+            secretName:
+              _default: "hasher-rabbitmq-secret"
+            secretKey: "password"
+
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/flows/brusnika-stage/celery.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
           pullPolicy:
             _default: IfNotPresent
 
@@ -252,6 +252,26 @@ spec:
               _default: "https://test.sarex.brusnika.tech"
 
         secretEnvs:
+          - name: FLOWS_DB_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: FLOWS_DB_USERNAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: FLOWS_DB_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_AUTH
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
           - name: ADMIN_PANEL_SECRET_KEY
             secretName:
               _default: "admin-secret"

apps/flows/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/d8-ugmk-prod/backend.yaml

@@ -1,11 +1,4 @@
 ---
-# Патч backend для контура УГМК — подключение к Kafka.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
-# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
-# podAnnotations — map, мержится по ключам, поэтому переопределён только
-# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -29,6 +22,19 @@ spec:
                 set +a
                 exec /opt/entrypoint.sh
 
+        volumes:
+          _default:
+            - name: authentication
+              mountPath:
+                _default: /opt/src/flow/admin/authentication.py
+              subPath:
+                _default: authentication.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: authentication
+
         envs:
           - name: LOG_LEVEL
             value:
@@ -98,6 +104,10 @@ spec:
             value:
               _default: "https://sarex.uralmine.com/flows/api/v1"
 
+          - name: PROXY_PATH_PREFIX
+            value:
+              _default: /flows
+
           - name: SMTP_HOST
             value:
               _default: "post.uralmine.com"

apps/flows/uralkal/backend.yaml

@@ -83,6 +83,10 @@ spec:
             value:
               _default: "0"
           
+          - name: ENABLE_EVENTS
+            value:
+              _default: "0"
+
           - name: ENABLE_METRICS
             value:
               _default: "0"

apps/flows/wb/backend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_e8a366a3
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_81d0fa17
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/wb/celery.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/wb/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
           pullPolicy:
             _default: IfNotPresent
 

apps/inspections/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
           pullPolicy:
             _default: IfNotPresent
 

apps/inspections/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/brusnika-stage/backend.yaml

@@ -176,9 +176,6 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
-          - name: RABBITMQ_HOSTNAME
-            value:
-              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
 
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID

apps/notes/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:0.3.7
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854
           pullPolicy:
             _default: IfNotPresent
 
@@ -87,6 +87,14 @@ spec:
           monitoring: prometheus
 
         envs:
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "0"
+
+          - name: ENABLE_ND
+            value:
+              _default: "0"
+
           - name: DJANGO_HOST
             value:
               _default: "http://backend.django.svc.cluster.local:8000"

apps/notes/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:prod_55791cf6_relative
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f
           pullPolicy:
             _default: IfNotPresent
 

apps/pm/brusnika-stage/frontend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_7f125269
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_abfaba7c
           pullPolicy:
             _default: IfNotPresent
 

apps/premises/base/backend.yaml

@@ -0,0 +1,313 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: premises
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: premises-vault
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/premises-backend:production_216148a9
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: premises-backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/premises-db ] && . /vault/secrets/premises-db
+                [ -f /vault/secrets/premises-kafka ] && . /vault/secrets/premises-kafka
+                [ -f /vault/secrets/premises-s3 ] && . /vault/secrets/premises-s3
+                [ -f /vault/secrets/premises-issues-db ] && . /vault/secrets/premises-issues-db
+                [ -f /vault/secrets/premises-inspections-db ] && . /vault/secrets/premises-inspections-db
+                [ -f /vault/secrets/premises-checklists-db ] && . /vault/secrets/premises-checklists-db
+                [ -f /vault/secrets/premises-eav-db ] && . /vault/secrets/premises-eav-db
+                [ -f /vault/secrets/premises-sarex-db ] && . /vault/secrets/premises-sarex-db
+                [ -f /usr/local/share/ca-certificates/kafka.crt ] && export KAFKA_SSL_CERT="$(cat /usr/local/share/ca-certificates/kafka.crt)"
+                set +a
+                exec ./entrypoint.sh
+
+          resources:
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 1Gi
+
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              httpGet:
+                path:
+                  _default: /internal/healthz/live/
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 60
+            readiness:
+              enabled:
+                _default: true
+              httpGet:
+                path:
+                  _default: /internal/healthz/ready/
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 30
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        envs:
+          - name: DEBUG
+            value:
+              _default: "false"
+
+          - name: HTTP_ROOT_PATH
+            value:
+              _default: "/premises"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: GUNICORN_WORKERS
+            value:
+              _default: "3"
+
+          - name: FASTSTREAM_WORKERS
+            value:
+              _default: "3"
+
+          - name: DATABASE_POOL_SIZE
+            value:
+              _default: "5"
+
+          - name: KAFKA_EAV_ASSET_TOPIC_NAME
+            value:
+              _default: "assets_broadcast"
+
+          - name: KAFKA_SSL_CERT
+            value:
+              _default: ""
+
+          - name: S3_BUCKET
+            value:
+              _default: "premises"
+
+          - name: EXPORT_TTL_MINUTES
+            value:
+              _default: "30"
+
+          - name: EXPORT_MAX_WORKERS
+            value:
+              _default: "4"
+
+          - name: EXPORT_S3_KEY_PREFIX
+            value:
+              _default: "premise-export"
+
+          - name: ATTACHMENT_MAX_SIZE_BYTES
+            value:
+              _default: "314572800"
+
+          - name: ATTACHMENT_S3_KEY_PREFIX
+            value:
+              _default: "attachment/"
+
+          - name: OTEL_ENABLE
+            value:
+              _default: "false"
+
+          - name: OTEL_URL
+            value:
+              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
+
+          - name: OTEL_SERVICE_NAME
+            value:
+              _default: "premises-backend"
+
+          - name: OTEL_INSECURE
+            value:
+              _default: "true"
+
+          - name: SRX_SDK_IAM_ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://backend-svc.processing.svc.cluster.local:80"
+
+          - name: WORKFLOWS_GENERATION_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/rendering-template:master"
+
+          - name: WORKFLOWS_DOCX_TO_PDF_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/docx-to-pdf:latest"
+
+          - name: WORKFLOWS_CALLBACK_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/webhook-caller:master"
+
+          - name: WORKFLOWS_CALLBACK_HOST
+            value:
+              _default: "http://backend-svc.premises.svc.cluster.local:80"
+
+          - name: WORKFLOWS_RESULT_PATH
+            value:
+              _default: "premises-prod"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: premises
+            vault.hashicorp.com/agent-inject-secret-premises-db: secrets/data/apps/premises/postgres
+            vault.hashicorp.com/agent-inject-template-premises-db: |-
+              {{- with secret "secrets/data/apps/premises/postgres" -}}
+              DATABASE_HOST={{ index .Data.data "host" }}
+              DATABASE_PORT={{ index .Data.data "port" }}
+              DATABASE_NAME={{ index .Data.data "database" }}
+              DATABASE_USERNAME={{ index .Data.data "username" }}
+              DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-kafka: secrets/data/kafka/apps/premises
+            vault.hashicorp.com/agent-inject-template-premises-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/premises" -}}
+              KAFKA_HOST={{ if .Data.data.auth }}{{ index .Data.data.auth "bootstrap_servers" }}{{ else }}{{ index .Data.data "bootstrap_servers" }}{{ end }}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-s3: secrets/data/minio/apps/premises
+            vault.hashicorp.com/agent-inject-template-premises-s3: |-
+              {{- with secret "secrets/data/minio/apps/premises" -}}
+              S3_HOST={{ index .Data.data.client "endpoint" }}
+              S3_ACCESS_KEY={{ index .Data.data "access_key" }}
+              S3_SECRET_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-issues-db: secrets/data/apps/issues/postgres
+            vault.hashicorp.com/agent-inject-template-premises-issues-db: |-
+              {{- with secret "secrets/data/apps/issues/postgres" -}}
+              ISSUES_DATABASE_HOST={{ index .Data.data "host" }}
+              ISSUES_DATABASE_PORT={{ index .Data.data "port" }}
+              ISSUES_DATABASE_NAME={{ index .Data.data "database" }}
+              ISSUES_DATABASE_USERNAME={{ index .Data.data "username" }}
+              ISSUES_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-inspections-db: secrets/data/apps/inspections/postgres
+            vault.hashicorp.com/agent-inject-template-premises-inspections-db: |-
+              {{- with secret "secrets/data/apps/inspections/postgres" -}}
+              INSPECTIONS_DATABASE_HOST={{ index .Data.data "host" }}
+              INSPECTIONS_DATABASE_PORT={{ index .Data.data "port" }}
+              INSPECTIONS_DATABASE_NAME={{ index .Data.data "database" }}
+              INSPECTIONS_DATABASE_USERNAME={{ index .Data.data "username" }}
+              INSPECTIONS_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-checklists-db: secrets/data/apps/checklists/postgres
+            vault.hashicorp.com/agent-inject-template-premises-checklists-db: |-
+              {{- with secret "secrets/data/apps/checklists/postgres" -}}
+              CHECKLISTS_DATABASE_HOST={{ index .Data.data "host" }}
+              CHECKLISTS_DATABASE_PORT={{ index .Data.data "port" }}
+              CHECKLISTS_DATABASE_NAME={{ index .Data.data "database" }}
+              CHECKLISTS_DATABASE_USERNAME={{ index .Data.data "username" }}
+              CHECKLISTS_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-eav-db: secrets/data/apps/eav/postgres
+            vault.hashicorp.com/agent-inject-template-premises-eav-db: |-
+              {{- with secret "secrets/data/apps/eav/postgres" -}}
+              EAV_DATABASE_HOST={{ index .Data.data "host" }}
+              EAV_DATABASE_PORT={{ index .Data.data "port" }}
+              EAV_DATABASE_NAME={{ index .Data.data "database" }}
+              EAV_DATABASE_USERNAME={{ index .Data.data "username" }}
+              EAV_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-sarex-db: secrets/data/apps/django/postgres
+            vault.hashicorp.com/agent-inject-template-premises-sarex-db: |-
+              {{- with secret "secrets/data/apps/django/postgres" -}}
+              SAREX_DATABASE_HOST={{ index .Data.data "host" }}
+              SAREX_DATABASE_PORT={{ index .Data.data "port" }}
+              SAREX_DATABASE_NAME={{ index .Data.data "database" }}
+              SAREX_DATABASE_USERNAME={{ index .Data.data "username" }}
+              SAREX_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/premises/base/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: premises
+resources:
+  - namespace.yaml
+  - backend.yaml

apps/premises/base/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: premises
+  labels:
+    istio-injection: enabled

apps/premises/vad/backend.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: premises
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        volumes:
+          _default:
+            - name: kafka-ca-cert
+              mountPath:
+                _default: /usr/local/share/ca-certificates/kafka.crt
+              subPath:
+                _default: kafka.crt
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-ca-cert
+                items:
+                  - key: kafka.crt
+                    path:
+                      _default: kafka.crt

apps/premises/vad/kafka-ca-configmap.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-ca-cert
+  namespace: premises
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+    0FC16VuidLG0HUCCawFjRiAg9rIA
+    -----END CERTIFICATE-----

apps/premises/vad/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - kafka-ca-configmap.yaml
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend

apps/processing/brusnika-stage/engine-low.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/kubernetes-engine:3546957f1e7e8278fc6363da0287573e9454275a
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:production_f5fe4688
           pullPolicy:
             _default: IfNotPresent
 
@@ -87,6 +87,10 @@ spec:
           monitoring: prometheus
 
         envs:
+          - name: ENABLE_TOLERATION
+            value:
+              _default: "1"
+
           - name: RABBITMQ_HOST
             value:
               _default: "rabbitmq-service.workflow.svc.cluster.local"
@@ -95,6 +99,10 @@ spec:
             value:
               _default: "5672/api"
           
+          - name: ENABLE_TOLERATION
+            value:
+              _default: "1"
+
           - name: POSTGRES_ADDRESS
             value:
               _default: "192.168.2.45"

apps/processing/wb/engine-low.yaml

@@ -108,7 +108,7 @@ spec:
             - name: ENABLE_KUBERNETES_EXECUTOR
               value: "1"
             - name: MAX_WORKFLOWS_LIMIT
-              value: "5"
+              value: "10"
             - name: CPU_COUNT
               value: "1"
             - name: MEMORY_GI

apps/processing/wb/engine.yaml

@@ -125,7 +125,7 @@ spec:
             - name: ENABLE_KUBERNETES_EXECUTOR
               value: "1"
             - name: MAX_WORKFLOWS_LIMIT
-              value: "5"
+              value: "10"
             - name: CPU_COUNT
               value: "1"
             - name: MEMORY_GI

apps/system-log/d8-ugmk-prod/kustomization.yaml

@@ -8,3 +8,7 @@ patches:
     target:
       kind: Namespace
       name: system-log
+  - path: worker.yaml
+    target:
+      kind: HelmRelease
+      name: worker

apps/system-log/d8-ugmk-prod/worker.yaml

@@ -0,0 +1,56 @@
+---
+# Адреса соседних сервисов в УГМК отличаются от base: там Service называются
+# backend-api-svc (documentations) и backend-svc (django), оба на порту 80.
+# Внимание: envs в universal-chart — список, и strategic merge его ЦЕЛИКОМ
+# заменяет, а не дополняет. Поэтому здесь перечислен весь набор переменных
+# worker из base, иначе обязательные APP_NAME/APP_VERSION/LOG_LEVEL потеряются
+# и воркер упадёт на старте.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: worker
+  namespace: system-log
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: APP_NAME
+            value:
+              _default: "system_log"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: HTTP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+
+          - name: NAMESPACE
+            value:
+              _default: "sarex-system-log"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"

apps/transmittal/brusnika-stage/backend.yaml

@@ -287,11 +287,11 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
             value:
-              _default: "minio-service.minio.svc.cluster.local:9000"
+              _default: "minio.brusnika.lonsdaleites.ru"
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
             value:
-              _default: "false"
+              _default: "true"
 
           - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
             value:

apps/transmittal/brusnika-stage/worker.yaml

@@ -278,7 +278,7 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
             value:
-              _default: "minio-service.minio.svc.cluster.local:9000"
+              _default: "minio-svc.minio.svc.cluster.local:9000"
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
             value:

apps/workspaces/base/frontend.yaml

@@ -29,7 +29,7 @@ spec:
         enabled: true
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_07373a45
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_828f1bfc
           pullPolicy:
             _default: IfNotPresent
         deployment:

clusters/brusnika-stage/kustomization.yaml

@@ -12,6 +12,7 @@ resources:
   - ../../apps/resources/brusnika-stage
   - ../../apps/workspaces/brusnika-stage
   - ../../apps/documentations/brusnika-stage
+  - ../../apps/cde/brusnika-stage
   - ../../apps/flows/brusnika-stage
   - ../../apps/processing/brusnika-stage
   - ../../apps/reviews/brusnika-stage

clusters/vad/kustomization.yaml

@@ -52,3 +52,4 @@ resources:
   - ../../apps/pm/vad
   - ../../apps/message-hub/vad
   - ../../apps/cde/vad
+  - ../../apps/premises/vad

clusters/vk-infra/flux-system/gotk-sync.yaml

@@ -0,0 +1,27 @@
+# This manifest was generated by flux. DO NOT EDIT.
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: master
+  secretRef:
+    name: flux-system
+  url: ssh://git@gitlab.sarex.io/infra/iac.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./clusters/vk-infra
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

clusters/vk-infra/flux-system/kustomization.yaml

@@ -0,0 +1,59 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gotk-components.yaml
+- gotk-sync.yaml
+patches:
+- target:
+    kind: Deployment
+    name: (source-controller|kustomize-controller|helm-controller|notification-controller)
+  patch: |
+    - op: add
+      path: /spec/template/spec/nodeSelector/sarex.io~1pool
+      value: svc
+- target:
+    kind: Deployment
+    name: kustomize-controller
+  patch: |
+    - op: replace
+      path: /spec/replicas
+      value: 3
+    - op: add
+      path: /spec/strategy
+      value:
+        type: RollingUpdate
+        rollingUpdate:
+          maxSurge: 0
+          maxUnavailable: 1
+    - op: add
+      path: /spec/template/spec/affinity
+      value:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: topology.kubernetes.io/zone
+              labelSelector:
+                matchLabels:
+                  app: kustomize-controller
+- target:
+    kind: Deployment
+    name: helm-controller
+  patch: |
+    - op: replace
+      path: /spec/replicas
+      value: 3
+    - op: add
+      path: /spec/strategy
+      value:
+        type: RollingUpdate
+        rollingUpdate:
+          maxSurge: 0
+          maxUnavailable: 1
+    - op: add
+      path: /spec/template/spec/affinity
+      value:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: topology.kubernetes.io/zone
+              labelSelector:
+                matchLabels:
+                  app: helm-controller

clusters/vk-infra/helm-repositories.yaml

@@ -0,0 +1,11 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: yc-oci-charts
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 10m0s
+  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
+  secretRef:
+    name: yc-cr-auth

clusters/vk-infra/infrastructure/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-base/vk-infra
+  - ../../../infrastructure/istio-pilot/vk-infra
+  - ../../../infrastructure/istio-gateway/vk-infra
+  - ../../../infrastructure/cert-manager/vk-infra
+  - ../../../infrastructure/istio-config/vk-infra
+  - ../../../infrastructure/zitadel/vk-infra
+  - ../../../infrastructure/vault-unseal/vk-infra
+  - ../../../infrastructure/vault/vk-infra
+  - ../../../infrastructure/kb/vk-infra
+  - ../../../infrastructure/gitlab-runner/vk-infra
+  - ../../../infrastructure/nexus/vk-infra

clusters/vk-infra/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./flux-system
+  - ./helm-repositories.yaml
+  - ./infrastructure

clusters/vk-prod/flux-system/gotk-sync.yaml

@@ -0,0 +1,27 @@
+# This manifest was generated by flux. DO NOT EDIT.
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: master
+  secretRef:
+    name: flux-system
+  url: ssh://git@gitlab.sarex.io/infra/iac.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./clusters/vk-prod
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

clusters/vk-prod/flux-system/kustomization.yaml

@@ -0,0 +1,52 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gotk-components.yaml
+- gotk-sync.yaml
+patches:
+- target:
+    kind: Deployment
+    name: kustomize-controller
+  patch: |
+    - op: replace
+      path: /spec/replicas
+      value: 3
+    - op: add
+      path: /spec/strategy
+      value:
+        type: RollingUpdate
+        rollingUpdate:
+          maxSurge: 0
+          maxUnavailable: 1
+    - op: add
+      path: /spec/template/spec/affinity
+      value:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: topology.kubernetes.io/zone
+              labelSelector:
+                matchLabels:
+                  app: kustomize-controller
+- target:
+    kind: Deployment
+    name: helm-controller
+  patch: |
+    - op: replace
+      path: /spec/replicas
+      value: 3
+    - op: add
+      path: /spec/strategy
+      value:
+        type: RollingUpdate
+        rollingUpdate:
+          maxSurge: 0
+          maxUnavailable: 1
+    - op: add
+      path: /spec/template/spec/affinity
+      value:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: topology.kubernetes.io/zone
+              labelSelector:
+                matchLabels:
+                  app: helm-controller

clusters/vk-prod/helm-repositories.yaml

@@ -0,0 +1,11 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: yc-oci-charts
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 10m0s
+  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
+  secretRef:
+    name: yc-cr-auth

clusters/vk-prod/infrastructure/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-base/vk-prod
+  - ../../../infrastructure/istio-pilot/vk-prod
+  - ../../../infrastructure/istio-gateway/vk-prod
+  - ../../../infrastructure/gitlab-runner/vk-prod

clusters/vk-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./flux-system
+  - ./helm-repositories.yaml
+  - ./infrastructure

infrastructure/camunda/uralkal/camunda.yaml

@@ -14,139 +14,169 @@ spec:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: StatefulSet
-              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: batch
               version: v1
               kind: Job
-              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-connectors
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-identity
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-operate
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-optimize
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-tasklist
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-zeebe-gateway
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: StatefulSet
-              namespace: camunda
               name: camunda-zeebe
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
   values:
     global:
       vault:

infrastructure/cert-manager/vk-infra/cert-manager.yaml

@@ -0,0 +1,36 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      imagePullSecrets:
+        - istio-registry-secret
+    controller:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cert-manager
+        pullSecrets:
+          - istio-registry-secret
+      acmesolver:
+        image:
+          registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+          repository: acmesolver
+          pullSecrets:
+            - istio-registry-secret
+    webhook:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cert-manager-webhook
+        pullSecrets:
+          - istio-registry-secret
+    cainjector:
+      image:
+        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
+        repository: cainjector
+        pullSecrets:
+          - istio-registry-secret

infrastructure/cert-manager/vk-infra/kustomization.yaml

@@ -0,0 +1,34 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./cert-manager.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: cert-manager
+      namespace: cert-manager
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer
+  - target:
+      group: cert-manager.io
+      version: v1
+      kind: ClusterIssuer
+      name: letsencrypt-issuer-istio
+    patch: |-
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: ClusterIssuer
+      metadata:
+        name: letsencrypt-issuer-istio

infrastructure/gitlab-runner/vk-infra/gitlab-runner.yaml

@@ -0,0 +1,79 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitlab-runner
+  namespace: gitlab-managed-apps
+spec:
+  interval: 10m
+  timeout: 10m
+  chart:
+    spec:
+      chart: gitlab-runner-infra
+      version: "17.5.4"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    gitlabUrl: https://gitlab.sarex.io
+    concurrent: 20
+    checkInterval: 10
+    unregisterRunners: true
+    terminationGracePeriodSeconds: 3600
+    image:
+      registry: cr.yandex/crp3ccidau046kdj8g9q
+      image: mirror/gitlab-runner
+    imagePullSecrets:
+      - name: istio-registry-secret
+    nodeSelector:
+      sarex.io/pool: svc
+    rbac:
+      create: true
+      clusterWideAccess: false
+    serviceAccount:
+      create: true
+    podSecurityContext:
+      fsGroup: 65533
+      runAsUser: 100
+    metrics:
+      enabled: false
+    runners:
+      secret: gitlab-runner-secret
+      executor: kubernetes
+      cache: {}
+      config: |
+        [[runners]]
+          [runners.kubernetes]
+            namespace = "{{.Release.Namespace}}"
+            image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/docker:24.0.5"
+            helper_image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/gitlab-runner-helper:x86_64-v17.5.3"
+            image_pull_secrets = ["istio-registry-secret"]
+            poll_interval = 10
+            poll_timeout = 600
+            privileged = true
+            tls_verify = false
+            cpu_request = "0.1"
+            cpu_limit = "3"
+            memory_request = "128Mi"
+            memory_limit = "3Gi"
+            helper_cpu_request = "0.05"
+            helper_cpu_limit = "3"
+            helper_memory_request = "32Mi"
+            helper_memory_limit = "10Gi"
+            service_cpu_request = "0.5"
+            service_cpu_limit = "3"
+            service_memory_request = "3Gi"
+
+            [runners.feature_flags]
+              FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY = false
+            [runners.kubernetes.node_selector]
+              "sarex.io/pool" = "runners"
+            [runners.kubernetes.node_tolerations]
+              "sarex.io/pool=runners" = "NoSchedule"

infrastructure/gitlab-runner/vk-infra/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - gitlab-runner.yaml
+  - rbac.yaml

infrastructure/gitlab-runner/vk-infra/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitlab-managed-apps

infrastructure/gitlab-runner/vk-infra/rbac.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: gitlab-runner-jobs-cluster-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: gitlab-managed-apps

infrastructure/gitlab-runner/vk-prod/gitlab-runner.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitlab-runner
+  namespace: gitlab-managed-apps
+spec:
+  interval: 10m
+  timeout: 10m
+  chart:
+    spec:
+      chart: gitlab-runner-infra
+      version: "17.5.4"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    gitlabUrl: https://gitlab.sarex.io
+    concurrent: 20
+    checkInterval: 10
+    unregisterRunners: true
+    terminationGracePeriodSeconds: 3600
+    image:
+      registry: cr.yandex/crp3ccidau046kdj8g9q
+      image: mirror/gitlab-runner
+    imagePullSecrets:
+      - name: istio-registry-secret
+    rbac:
+      create: true
+      clusterWideAccess: false
+    serviceAccount:
+      create: true
+    podSecurityContext:
+      fsGroup: 65533
+      runAsUser: 100
+    metrics:
+      enabled: false
+    runners:
+      secret: gitlab-runner-secret
+      executor: kubernetes
+      cache: {}
+      config: |
+        [[runners]]
+          [runners.kubernetes]
+            namespace = "{{.Release.Namespace}}"
+            image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/docker:24.0.5"
+            helper_image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/gitlab-runner-helper:x86_64-v17.5.3"
+            image_pull_secrets = ["istio-registry-secret"]
+            poll_interval = 10
+            poll_timeout = 600
+            privileged = true
+            tls_verify = false
+            cpu_request = "0.1"
+            cpu_limit = "3"
+            memory_request = "128Mi"
+            memory_limit = "3Gi"
+            helper_cpu_request = "0.05"
+            helper_cpu_limit = "3"
+            helper_memory_request = "32Mi"
+            helper_memory_limit = "10Gi"
+            service_cpu_request = "0.5"
+            service_cpu_limit = "3"
+            service_memory_request = "3Gi"
+
+            [runners.feature_flags]
+              FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY = false

infrastructure/gitlab-runner/vk-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - gitlab-runner.yaml
+  - rbac.yaml

infrastructure/gitlab-runner/vk-prod/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitlab-managed-apps

infrastructure/gitlab-runner/vk-prod/rbac.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: gitlab-runner-jobs-cluster-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: gitlab-managed-apps

infrastructure/istio-base/vk-infra/istio-base.yaml

@@ -0,0 +1,14 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-base
+  namespace: istio-system
+spec:
+  chart:
+    spec:
+      chart: base-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system

infrastructure/istio-base/vk-infra/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./istio-base.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istio-base
+      namespace: istio-system

infrastructure/istio-base/vk-prod/istio-base.yaml

@@ -0,0 +1,14 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-base
+  namespace: istio-system
+spec:
+  chart:
+    spec:
+      chart: base-infra
+      version: "1.30.5"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system

infrastructure/istio-base/vk-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./istio-base.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istio-base
+      namespace: istio-system

infrastructure/istio-config/brusnika-stage/istio-config.yaml

@@ -671,8 +671,19 @@ spec:
                 allowOrigins:
                   - regex: ".*"
               routes:
+                - path:
+                    prefix: /orchestrator/api/process/
+                  rewrite: /api/process/
+                  service: cde.orchestrator.svc.cluster.local
+                  port: 8080
+                - path:
+                    prefix: /orchestrator/api/sign
+                  rewrite: /api/sign
+                  service: cde.orchestrator.svc.cluster.local
+                  port: 8080
                 - path:
                     prefix: /orchestrator/
+                  rewrite: /api/
                   service: cde.orchestrator.svc.cluster.local
                   port: 8080
             global-test-vs:
@@ -1188,6 +1199,20 @@ spec:
                   service: workspaces-service.workspaces.svc.cluster.local
                   port: 8000
 
+            vs-iam-api:
+              namespace: ingress-nginx
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              routes:
+                - match:
+                    - uri:
+                        prefix: /iam/api/
+                  rewrite: /external/api/
+                  service: iam-backend.iam.svc.cluster.local
+                  port: 8000
+
             vs-resources-admin:
               namespace: ingress-nginx
               hosts:

infrastructure/istio-config/uralkal/istio-config.yaml

@@ -388,6 +388,29 @@ spec:
                   rewrite: /eav/admin/
                   service: backend-svc.eav.svc.cluster.local
                   port: 80
+            cde-api:
+              name: cde-api-virt-service
+              namespace: default
+              hosts:
+                - sarex.local.uralkali.com
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /orchestrator/api/process/
+                  rewrite: /api/process/
+                  service: cde-svc.cde.svc.cluster.local
+                  port: 80
+                - path:
+                    prefix: /orchestrator/api/sign
+                  rewrite: /api/sign
+                  service: cde-svc.cde.svc.cluster.local
+                  port: 80
+                - path:
+                    prefix: /orchestrator/
+                  rewrite: /api/
+                  service: cde-svc.cde.svc.cluster.local
+                  port: 80
             srx-admin-frontend:
               name: srx-admin-frontend-virt-service
               namespace: default

infrastructure/istio-config/vad/istio-config.yaml

@@ -335,6 +335,19 @@ spec:
                   rewrite: /api/
                   service: backend-svc.inspections.svc.cluster.local
                   port: 80
+            premises-api:
+              name: premises-api-virt-service
+              namespace: default
+              hosts:
+                - sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /premises/api/
+                  rewrite: /api/
+                  service: backend-svc.premises.svc.cluster.local
+                  port: 80
             reviews-frontend:
               name: reviews-frontend-virt-service
               namespace: default
@@ -386,6 +399,29 @@ spec:
                   rewrite: /eav/admin/
                   service: backend-svc.eav.svc.cluster.local
                   port: 80
+            cde-api:
+              name: cde-api-virt-service
+              namespace: default
+              hosts:
+                - sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /orchestrator/api/process/
+                  rewrite: /api/process/
+                  service: cde-svc.cde.svc.cluster.local
+                  port: 80
+                - path:
+                    prefix: /orchestrator/api/sign
+                  rewrite: /api/sign
+                  service: cde-svc.cde.svc.cluster.local
+                  port: 80
+                - path:
+                    prefix: /orchestrator/
+                  rewrite: /api/
+                  service: cde-svc.cde.svc.cluster.local
+                  port: 80
             srx-admin-frontend:
               name: srx-admin-frontend-virt-service
               namespace: default

infrastructure/istio-config/vk-infra/istio-config.yaml

@@ -0,0 +1,173 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  interval: 5m
+  timeout: 10m
+  dependsOn:
+    - name: istio-base
+      namespace: istio-system
+    - name: istiod
+      namespace: istio-system
+    - name: cert-manager
+      namespace: cert-manager
+  values:
+    global:
+      env: vk-infra
+    environments:
+      vk-infra:
+        certManager:
+          clusterIssuers:
+            letsencrypt-issuer-istio:
+              spec:
+                acme:
+                  email: pavel@sarex.io
+                  privateKeySecretRef:
+                    name: letsencrypt-istio-account-key
+                  server: https://acme-v02.api.letsencrypt.org/directory
+                  solvers:
+                    - http01:
+                        ingress:
+                          class: istio
+                          podTemplate:
+                            spec:
+                              imagePullSecrets:
+                                - name: istio-registry-secret
+          certificates:
+            vault-tls:
+              dnsNames:
+                - vault.infra.sarex.tech
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              spec:
+                duration: 2160h0m0s
+                renewBefore: 360h0m0s
+                privateKey:
+                  rotationPolicy: Always
+            kb-tls:
+              dnsNames:
+                - kb.infra.sarex.tech
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              spec:
+                duration: 2160h0m0s
+                renewBefore: 360h0m0s
+                privateKey:
+                  rotationPolicy: Always
+            nexus-tls:
+              dnsNames:
+                - nexus.infra.sarex.tech
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              spec:
+                duration: 2160h0m0s
+                renewBefore: 360h0m0s
+                privateKey:
+                  rotationPolicy: Always
+            idp-tls:
+              dnsNames:
+                - iam.sarex.io
+              issuerRef:
+                name: letsencrypt-issuer-istio
+                kind: ClusterIssuer
+              spec:
+                duration: 2160h0m0s
+                renewBefore: 360h0m0s
+                privateKey:
+                  rotationPolicy: Always
+        istio:
+          gateways:
+            vault:
+              name: vault-gateway
+              namespace: istio-system
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - vault.infra.sarex.tech
+                  tls:
+                    credentialName: vault-tls
+                    mode: SIMPLE
+            kb:
+              name: kb-gateway
+              namespace: istio-system
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - kb.infra.sarex.tech
+                  tls:
+                    credentialName: kb-tls
+                    mode: SIMPLE
+            nexus:
+              name: nexus-gateway
+              namespace: istio-system
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - nexus.infra.sarex.tech
+                  tls:
+                    credentialName: nexus-tls
+                    mode: SIMPLE
+            idp:
+              name: idp-gateway
+              namespace: istio-system
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - iam.sarex.io
+                  tls:
+                    credentialName: idp-tls
+                    mode: SIMPLE
+          virtualServices:
+            vault-virt-service:
+              namespace: istio-system
+              hosts:
+                - vault.infra.sarex.tech
+              gateways:
+                - istio-system/vault-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: vault-vault-contour-active.vault.svc.cluster.local
+                  port: 8200
+            kb-virt-service:
+              namespace: istio-system
+              hosts:
+                - kb.infra.sarex.tech
+              gateways:
+                - istio-system/kb-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: kb-service.kb.svc.cluster.local
+                  port: 80
+            nexus-virt-service:
+              namespace: istio-system
+              hosts:
+                - nexus.infra.sarex.tech
+              gateways:
+                - istio-system/nexus-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: nexus.nexus.svc.cluster.local
+                  port: 8081
+            idp-virt-service:
+              namespace: istio-system
+              hosts:
+                - iam.sarex.io
+              gateways:
+                - istio-system/idp-gateway
+              routes:
+                - path:
+                    prefix: /
+                  service: idp.zitadel.svc.cluster.local
+                  port: 8080