CLAUDE.md

@@ -39,8 +39,7 @@
 **Кластер.** `clusters/<cluster>/kustomization.yaml` — плоский список `../../apps/<app>/<cluster>`. Инфраструктура подключается двумя разными способами:
 
 - `d8-ugmk-prod` — прямо в корневом kustomization как `../../infrastructure/<comp>/d8-ugmk-prod`;
-- `brusnika-prod`, `brusnika-stage` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на оверлеи `../../../infrastructure/<comp>/<c>` (`base` + патч HelmRelease + сопутствующие манифесты компонента);
+- `brusnika-prod`, `brusnika-stage`, `wb` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/<c>/infrastructure/patches/*.yaml`.
-- `wb` — через `clusters/wb/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/wb/infrastructure/patches/*.yaml`.
 
 Кластеры: `brusnika-prod`, `brusnika-stage`, `d8-ugmk-prod`, `wb`, `yc-cps-prod`, `yc-ecp`, `yc-infra-prod`, `yc-k8s-test`, `yc-k8s-test-02`, `contour`.
 

apps/attachments/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
+            _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:production_6dbb4dce
           pullPolicy:
             _default: IfNotPresent
 

apps/bi/base/backend.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 25m
+                _default: 500m
               memory:
-                _default: 128Mi
+                _default: 1Gi
 
           probes:
             liveness:

apps/bi/brusnika-stage/backend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_e607dcc6
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_37902c73
           pullPolicy:
             _default: IfNotPresent
 
@@ -119,10 +119,6 @@ spec:
             _default: regcred
 
         envs:
-          - name: SUPERSET_HOST
-            value:
-              _default: "https://superset.test.sarex.brusnika.tech"
-
           - name: SETTINGS_DEBUG
             value:
               _default: "0"

apps/bim/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
           pullPolicy:
             _default: IfNotPresent
 

apps/cde/brusnika-stage/cde-flowscallback.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-flowscallback
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-flowscallback
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-flowscallback
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-flowscallback
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-flowscallback
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-splitpdf.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-splitpdf
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-splitpdf
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-splitpdf
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-splitpdf
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_4.4.1
-        imagePullPolicy: Always
-        name: cde-worker-splitpdf
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-alert.yaml

@@ -1,35 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-alert
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-alert
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 0
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-alert
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-alert
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/orchestrator:latest
-        imagePullPolicy: Always
-        name: cde-worker-alert
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copy.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-copy
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-copy
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-copy
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-copy
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-copy
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copyv2.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-copyv2
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-copyv2
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-copy
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-copy
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/copyv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-copy
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-markings.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-markings
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-markings
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-markings
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-markings
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:preprod_eb50f30e
-        imagePullPolicy: Always
-        name: cde-worker-markings
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-sign.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-sign
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-sign
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-sign
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-sign
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-sign
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-update-bundles.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-update-bundles
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-updatebundles
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-updatebundles
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-updatebundles
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-update-bundles
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde.yaml

@@ -1,55 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/cde:production_e5316bd0
-        imagePullPolicy: Always
-        livenessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 15
-          periodSeconds: 10
-          successThreshold: 1
-          tcpSocket:
-            port: 8080
-          timeoutSeconds: 1
-        name: cde
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-        readinessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 15
-          periodSeconds: 10
-          successThreshold: 1
-          tcpSocket:
-            port: 8080
-          timeoutSeconds: 1
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/createversionsv2-worke.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: createversionsv2-worke
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-createversions
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-createversions
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-createversions
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'true'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/createversionsv2-worker:preprod_90202b78
-        imagePullPolicy: Always
-        name: createversionsv2-worke
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/kustomization.yaml

@@ -1,19 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: orchestrator
+namespace: contracts
 resources:
-  - serviceaccount.yaml
+  - helmrelease.yaml
-  - service.yaml
-  - cde.yaml
-  - cde-flowscallback.yaml
-  - cde-splitpdf.yaml
-  - cde-worker-alert.yaml
-  - cde-worker-copy.yaml
-  - cde-worker-markings.yaml
-  - cde-worker-sign.yaml
-  - cde-worker-update-bundles.yaml
-  - cde-worker-copyv2.yaml
-  - createversionsv2-worke.yaml
-  - markingsv2-worker.yaml
-  - signv2-worker.yaml

apps/cde/brusnika-stage/markingsv2-worker.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: markingsv2-worker
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-markings
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-markings
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-markings
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/markingsv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-markings
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/service.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-  ports:
-  - name: http
-    port: 8080
-    protocol: TCP
-    targetPort: 8080

apps/cde/brusnika-stage/serviceaccount.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-    app.kubernetes.io/version: 0.0.1

apps/cde/brusnika-stage/signv2-worker.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: signv2-worker
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-sign
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-sign
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-sign
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/signv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-sign
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/control-interface/uralkal/kustomization.yaml

@@ -3,4 +3,3 @@ kind: Kustomization
 resources:
   - ../base
   - namespace.yaml
-  - psql-tools-debug.yaml

apps/control-interface/uralkal/psql-tools-debug.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: psql-tools-debug
-  namespace: control-interface
-  labels:
-    app: psql-tools-debug
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: psql-tools-debug
-  template:
-    metadata:
-      labels:
-        app: psql-tools-debug
-    spec:
-      containers:
-        - name: debug
-          image: cr.yandex/crp3ccidau046kdj8g9q/zitadel-bpmn:cc_contour_5.22.3_ca40c204
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-c"]
-          args:
-            - while true; do sleep 3600; done
-      imagePullSecrets:
-        - name: regcred

apps/django/base/django-configmap.yaml

@@ -87,7 +87,7 @@ data:
         'Bearer',
     )
 
-    HOST = os.environ.get("DJANGO_HOST", "https://sarex.contour.infra.sarex.tech")
+    HOST = "https://sarex.contour.infra.sarex.tech"
 
     POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
     POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')

apps/django/brusnika-prod/s3-proxy.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
+            _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_37a48176
           pullPolicy:
             _default: IfNotPresent
 
@@ -89,7 +89,7 @@ spec:
         envs:
           - name: AWS_API_ENDPOINT
             value:
-              _default: "https://obs.ru-moscow-1.hc.sbercloud.ru"
+              _default: "http://minio-svc.minio.svc.cluster.local:9000"
           - name: APP_PORT
             value:
               _default: "8000"

apps/django/brusnika-stage/nginx-configmap.yaml

@@ -101,8 +101,7 @@ data:
 
             location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
                 alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
-                types { }
+                add_header Content-Type application/wasm always;
-                default_type application/wasm;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -111,8 +110,7 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
-                types { }
+                add_header Content-Type application/javascript always;
-                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -121,8 +119,7 @@ data:
 
             location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
                 alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
-                types { }
+                add_header Content-Type application/javascript always;
-                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -131,8 +128,7 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf.js;
-                types { }
+                add_header Content-Type application/javascript always;
-                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -140,8 +136,7 @@ data:
             }
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                types { }
+                add_header Content-Type application/wasm always;
-                default_type application/wasm;
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
             }
 
@@ -149,8 +144,7 @@ data:
             rewrite /workspaces-v2/(.+) /$1 break;
             proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
 
-            proxy_hide_header Content-Type;
+            add_header Content-Type application/wasm;
-            add_header Content-Type application/wasm always;
             proxy_set_header Accept application/wasm;
         }
 

apps/django/d8-ugmk-prod/backend.yaml

@@ -18,9 +18,6 @@ spec:
           - name: SERVER_ZITADEL_ENABLED
             value:
               _default: "True"
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.uralmine.com"
           - name: DJANGO_SETTINGS_MODULE
             value:
               _default: config.settings.production

apps/django/uralkal/backend.yaml

@@ -14,10 +14,6 @@ spec:
               cpu: null
               memory: null
         envs:
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.local.uralkali.com"
-
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/django/uralkal/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            location ~^/api/pm/ {
+            # location ~^/api/pm/ {
-                proxy_http_version 1.1;
+            #     proxy_http_version 1.1;
-                proxy_set_header Connection "";
+            #     proxy_set_header Connection "";
-                proxy_set_header Host $host;
+            #     proxy_set_header Host $host;
-                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            }
+            # }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;

apps/django/vad/backend.yaml

@@ -9,10 +9,6 @@ spec:
     services:
       backend:
         envs:
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.vadroad.ru"
-
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/documentations/base/pdm.yaml

@@ -210,7 +210,7 @@ spec:
               _default: http://backend-svc.subscriptions.svc.cluster.local:80
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
+              _default: http://api-service.system-log.svc.cluster.local:80
           - name: TARGET_URL
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/brusnika-stage/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
           pullPolicy:
             _default: IfNotPresent
 
@@ -100,10 +100,6 @@ spec:
         labels:
           monitoring: prometheus
         envs:
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
-
           - name: POSTGRES_ADDRESS
             value:
               _default: "192.168.2.45"

apps/documentations/brusnika-stage/hasher.yaml

@@ -1,95 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hasher
-  namespace: documentations
-  labels:
-    app: hasher
-    service: normal
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hasher
-  template:
-    metadata:
-      labels:
-        app: hasher
-        service: normal
-    spec:
-      containers:
-      - env:
-        - name: HASHER_APP__LOG_LEVEL
-          value: INFO
-        - name: HASHER_APP__NUM_WORKERS
-          value: '4'
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
-          value: hash.compute.normal.tasks
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
-          value: hash.compute
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
-          value: direct
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
-          value: hash.compute.normal
-        - name: HASHER_S3__MAX_POOL_CONNECTIONS
-          value: '10'
-        - name: HASHER_S3__CONNECT_TIMEOUT
-          value: '10'
-        - name: HASHER_S3__READ_TIMEOUT
-          value: '30'
-        - name: HASHER_S3__REGION_NAME
-          value: ru-central1
-        - name: HASHER_S3__USE_SSL
-          value: 'true'
-        - name: HASHER_S3__VERIFY
-          value: 'true'
-        - name: HASHER_AMQP__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__PORT
-          valueFrom:
-            secretKeyRef:
-              key: port
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__VHOST
-          valueFrom:
-            secretKeyRef:
-              key: vhost
-              name: hasher-rabbitmq-secret
-        - name: HASHER_S3__ENDPOINT
-          valueFrom:
-            secretKeyRef:
-              key: endpoint
-              name: hasher-s3-secret
-        - name: HASHER_S3__ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              key: access_key
-              name: hasher-s3-secret
-        - name: HASHER_S3__SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              key: secret_key
-              name: hasher-s3-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
-        imagePullPolicy: IfNotPresent
-        name: normal
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-      imagePullSecrets:
-      - name: regcred

apps/documentations/brusnika-stage/kustomization.yaml

@@ -7,5 +7,3 @@ resources:
   - pdm.yaml
   - api.yaml
   - filestream.yaml
-  - hasher.yaml
-  - pdf-markings-amqp.yaml

apps/documentations/brusnika-stage/pdf-markings-amqp.yaml

@@ -1,125 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pdf-markings-amqp
-  namespace: documentations
-  labels:
-    app: pdf-markings-amqp
-    service: api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pdf-markings-amqp
-  strategy:
-    rollingUpdate:
-      maxSurge: 3
-      maxUnavailable: 3
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: pdf-markings-amqp
-        service: api
-    spec:
-      containers:
-      - env:
-        - name: MARKS_APP__LOG_LEVEL
-          value: INFO
-        - name: MARKS_CRYPTO__HASHING_ALGO
-          value: md_gost12_256
-        - name: MARKS_DOCUMENTS_DB__HOST
-          value: 192.168.2.45
-        - name: MARKS_DOCUMENTS_DB__PORT
-          value: '5432'
-        - name: MARKS_DOCUMENTS_DB__DATABASE
-          value: documentations
-        - name: MARKS_DOCUMENTS_DB__SSLMODE
-          value: disable
-        - name: MARKS_QR__REDIRECT_URL
-          value: https://stamp-verification.test.sarex.brusnika.tech/
-        - name: MARKS_QR__BASE_DOCUMENT_URL
-          value: https://test.sarex.brusnika.tech
-        - name: MARKS_S3__USE_SSL
-          value: 'false'
-        - name: MARKS_S3__SSL_VERIFY
-          value: 'false'
-        - name: MARKS_S3__REGION
-          value: ru-central1
-        - name: MARKS_S3__DEFAULT_BUCKET
-          value: documentations-stage-1-sarex-new
-        - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
-          value: pdf_markings_input
-        - name: MARKS_DOCUMENTS_DB__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: postgres-secret
-        - name: MARKS_DOCUMENTS_DB__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: postgres-secret
-        - name: MARKS_S3__URL
-          valueFrom:
-            secretKeyRef:
-              key: endpoint_url
-              name: yc-s3
-        - name: MARKS_S3__ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              key: key_id
-              name: yc-s3
-        - name: MARKS_S3__SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              key: access_key
-              name: yc-s3
-        - name: MARKS_RABBITMQ__HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__PORT
-          valueFrom:
-            secretKeyRef:
-              key: port
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__VHOST
-          valueFrom:
-            secretKeyRef:
-              key: vhost
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
-          valueFrom:
-            secretKeyRef:
-              key: heartbeat
-              name: rabbitmq
-        image: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
-        imagePullPolicy: IfNotPresent
-        name: api
-        ports:
-        - containerPort: 8000
-          name: http
-          protocol: TCP
-        volumeMounts:
-        - mountPath: /etc/sarex/yc-s3-storage
-          name: yc-s3
-          readOnly: true
-      volumes:
-      - name: yc-s3
-        secret:
-          secretName: yc-s3
-      imagePullSecrets:
-      - name: regcred

apps/documentations/brusnika-stage/pdm.yaml

@@ -124,11 +124,11 @@ spec:
 
           - name: TRANSMITTALS_BASE_URL
             value:
-              _default: "http://transmittal-service.transmittal.svc.cluster.local:80"
+              _default: ""
 
           - name: TRANSMITTALS_ENABLE
             value:
-              _default: "true"
+              _default: "false"
 
           - name: DRAWINGS_INTERNAL_URL
             value:

apps/documentations/d8-ugmk-prod/filestream.yaml

@@ -83,7 +83,7 @@ spec:
               _default: v1
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
+              _default: http://api-service.system-log.svc.cluster.local:80
           - name: DJANGO_HOST
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/uralkal/api.yaml

@@ -13,9 +13,6 @@ spec:
             requests:
               cpu: null
               memory: null
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api:contour_8631bb0e
         envs:
           - name: POSTGRES_POOL_SIZE
             value:
@@ -26,12 +23,9 @@ spec:
           - name: ZITADEL_DOMAIN
             value:
               _default: login.sarex.local.uralkali.com
-          - name: ZITADEL_INSECURE_SKIP_VERIFY
-            value:
-              _default: "true"
           - name: USE_ZITADEL
             value:
-              _default: "1"
+              _default: "0"
           - name: FLOWS_URL
             value:
               _default: http://backend-svc.flows.svc.cluster.local:80

apps/documentations/uralkal/filestream.yaml

@@ -13,16 +13,10 @@ spec:
             requests:
               cpu: null
               memory: null
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:contour_8631bb0e
         envs:
           - name: POSTGRES_POOL_SIZE
             value:
               _default: "20"
-          - name: ZITADEL_INSECURE_SKIP_VERIFY
-            value:
-              _default: "true"
           - name: ZITADEL_ACCOUNT
             value:
               _default: /vault/secrets/documentations-zitadel-account-json
@@ -31,7 +25,7 @@ spec:
               _default: login.sarex.local.uralkali.com
           - name: USE_ZITADEL
             value:
-              _default: "1"
+              _default: "0"
           - name: FLOWS_URL
             value:
               _default: http://backend-svc.flows.svc.cluster.local:80

apps/documentations/wb/api.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
           pullPolicy:
             _default: IfNotPresent
 
@@ -307,23 +307,6 @@ spec:
             value:
               _default: "6379"
 
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
-
-          - name: USE_MARKS_RABBITMQ
-            value:
-              _default: '1'
-          - name: MARKS_RABBITMQ_HOST
-            value: 
-              _default: rabbitmq.rabbitmq.svc.cluster.local
-          - name: MARKS_RABBITMQ_PORT
-            value: 
-              _default: '5672'
-          - name: MARKS_RABBITMQ_API
-            value: 
-              _default: cde
-
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:
@@ -355,16 +338,6 @@ spec:
               _default: "django-auth"
             secretKey: "key"
 
-          - name: MARKS_RABBITMQ_USER
-            secretName:
-              _default: "hasher-rabbitmq-secret"
-            secretKey: "user"
-
-          - name: MARKS_RABBITMQ_PASSWORD
-            secretName:
-              _default: "hasher-rabbitmq-secret"
-            secretKey: "password"
-
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/flows/brusnika-stage/celery.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 
@@ -252,26 +252,6 @@ spec:
               _default: "https://test.sarex.brusnika.tech"
 
         secretEnvs:
-          - name: FLOWS_DB_DB
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: FLOWS_DB_USERNAME
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: FLOWS_DB_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: DJANGO_AUTH
-            secretName:
-              _default: "django-secret"
-            secretKey: "token"
-
           - name: ADMIN_PANEL_SECRET_KEY
             secretName:
               _default: "admin-secret"

apps/flows/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/d8-ugmk-prod/backend.yaml

@@ -1,4 +1,11 @@
 ---
+# Патч backend для контура УГМК — подключение к Kafka.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
+# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -22,19 +29,6 @@ spec:
                 set +a
                 exec /opt/entrypoint.sh
 
-        volumes:
-          _default:
-            - name: authentication
-              mountPath:
-                _default: /opt/src/flow/admin/authentication.py
-              subPath:
-                _default: authentication.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: authentication
-
         envs:
           - name: LOG_LEVEL
             value:
@@ -104,10 +98,6 @@ spec:
             value:
               _default: "https://sarex.uralmine.com/flows/api/v1"
 
-          - name: PROXY_PATH_PREFIX
-            value:
-              _default: /flows
-
           - name: SMTP_HOST
             value:
               _default: "post.uralmine.com"

apps/flows/uralkal/backend.yaml

@@ -82,10 +82,6 @@ spec:
           - name: ENABLE_MAILGUN
             value:
               _default: "0"
-          
-          - name: ENABLE_EVENTS
-            value:
-              _default: "0"
 
           - name: ENABLE_METRICS
             value:
@@ -143,11 +139,28 @@ spec:
             value:
               _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
 
-        secretEnvs:
           - name: KAFKA_SSL_CERT
-            secretName:
+            value:
-              _default: kafka-kafka-contour-tls
+              _default: |
-            secretKey: "ca.crt"
+                -----BEGIN CERTIFICATE-----
+                MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+                MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+                MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+                tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+                h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+                k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+                GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+                zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+                Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+                A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+                vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+                OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+                fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+                ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+                0FC16VuidLG0HUCCawFjRiAg9rIA
+                -----END CERTIFICATE-----
 
         podAnnotations:
           _default:

apps/flows/uralkal/celery.yaml

@@ -1,4 +1,11 @@
 ---
+# Патч celery для контура УГМК — подключение к Kafka.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml.
+# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -133,11 +140,28 @@ spec:
             value:
               _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
 
-        secretEnvs:
           - name: KAFKA_SSL_CERT
-            secretName:
+            value:
-              _default: kafka-kafka-contour-tls
+              _default: |
-            secretKey: "ca.crt"
+                -----BEGIN CERTIFICATE-----
+                MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+                MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+                MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+                tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+                h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+                k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+                GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+                zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+                Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+                A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+                vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+                OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+                fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+                ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+                0FC16VuidLG0HUCCawFjRiAg9rIA
+                -----END CERTIFICATE-----
 
         podAnnotations:
           _default:

apps/flows/wb/backend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/wb/celery.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/wb/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_b52d632c
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/uralkal/backend-s3.yaml

@@ -57,10 +57,6 @@ spec:
             value:
               _default: "iam"
 
-          - name: ZITADEL_TLS_INSECURE_SKIP_VERIFY
-            value:
-              _default: "true"
-
           - name: S3_REGION
             value:
               _default: "ru-central1"

apps/inspections/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
           pullPolicy:
             _default: IfNotPresent
 

apps/inspections/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/brusnika-stage/backend.yaml

@@ -176,6 +176,9 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
 
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID

apps/issues/uralkal/backend-s3.yaml

@@ -49,11 +49,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              secret:
+              configMap:
-                secretName:
+                name:
-                  _default: kafka-kafka-contour-tls
+                  _default: kafka-ca-cert
                 items:
-                  - key: ca.crt
+                  - key: kafka.crt
                     path:
                       _default: kafka.crt
 

apps/issues/uralkal/celery-s3.yaml

@@ -49,11 +49,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              secret:
+              configMap:
-                secretName:
+                name:
-                  _default: kafka-kafka-contour-tls
+                  _default: kafka-ca-cert
                 items:
-                  - key: ca.crt
+                  - key: kafka.crt
                     path:
                       _default: kafka.crt
 

apps/issues/uralkal/kafka-ca-configmap.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: kafka-ca-cert
-  namespace: premises
+  namespace: issues
 data:
   kafka.crt: |
     -----BEGIN CERTIFICATE-----

apps/issues/uralkal/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - kafka-ca-configmap.yaml
 patches:
   - path: backend-s3.yaml
     target:

apps/message-hub/uralkal/kafka-ca-configmap.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-ca-cert
+  namespace: message-hub
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+    0FC16VuidLG0HUCCawFjRiAg9rIA
+    -----END CERTIFICATE-----

apps/message-hub/uralkal/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - kafka-ca-configmap.yaml
 patches:
   - path: message-hub.yaml
     target:

apps/message-hub/uralkal/message-hub.yaml

@@ -91,11 +91,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              secret:
+              configMap:
-                secretName:
+                name:
-                  _default: kafka-kafka-contour-tls
+                  _default: kafka-ca-cert
                 items:
-                  - key: ca.crt
+                  - key: kafka.crt
                     path:
                       _default: kafka.crt
 
@@ -106,5 +106,5 @@ spec:
               {{- with secret "secrets/data/kafka/apps/pm" -}}
               KAFKA_USERNAME={{ index .Data.data "username" }}
               KAFKA_PASSWORD={{ index .Data.data "password" }}
-              KAFKA_SASL_MECHANISM={{ if .Data.data.auth }}{{ index .Data.data.auth "sasl_mechanism" }}{{ else }}{{ index .Data.data "sasl_mechanism" }}{{ end }}
+              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
               {{- end -}}

apps/notes/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:0.3.7
           pullPolicy:
             _default: IfNotPresent
 
@@ -87,14 +87,6 @@ spec:
           monitoring: prometheus
 
         envs:
-          - name: SYNC_RESOURCE_ID
-            value:
-              _default: "0"
-
-          - name: ENABLE_ND
-            value:
-              _default: "0"
-
           - name: DJANGO_HOST
             value:
               _default: "http://backend.django.svc.cluster.local:8000"

apps/notes/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:prod_55791cf6_relative
           pullPolicy:
             _default: IfNotPresent
 

apps/pm/brusnika-stage/frontend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_abfaba7c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_7f125269
           pullPolicy:
             _default: IfNotPresent
 

apps/pm/uralkal/backend.yaml

@@ -182,11 +182,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              secret:
+              configMap:
-                secretName:
+                name:
-                  _default: kafka-kafka-contour-tls
+                  _default: kafka-ca-cert
                 items:
-                  - key: ca.crt
+                  - key: kafka.crt
                     path:
                       _default: kafka.crt
 
@@ -204,7 +204,7 @@ spec:
             vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm
             vault.hashicorp.com/agent-inject-template-pm-kafka: |-
               {{- with secret "secrets/data/kafka/apps/pm" -}}
-              KAFKA_SASL_MECHANISM={{ if .Data.data.auth }}{{ index .Data.data.auth "sasl_mechanism" }}{{ else }}{{ index .Data.data "sasl_mechanism" }}{{ end }}
+              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
               KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
               KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
               {{- end -}}

apps/pm/uralkal/celery.yaml

@@ -191,11 +191,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              secret:
+              configMap:
-                secretName:
+                name:
-                  _default: kafka-kafka-contour-tls
+                  _default: kafka-ca-cert
                 items:
-                  - key: ca.crt
+                  - key: kafka.crt
                     path:
                       _default: kafka.crt
 
@@ -215,7 +215,7 @@ spec:
             vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm
             vault.hashicorp.com/agent-inject-template-pm-kafka: |-
               {{- with secret "secrets/data/kafka/apps/pm" -}}
-              KAFKA_SASL_MECHANISM={{ if .Data.data.auth }}{{ index .Data.data.auth "sasl_mechanism" }}{{ else }}{{ index .Data.data "sasl_mechanism" }}{{ end }}
+              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
               KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
               KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
               {{- end -}}

apps/pm/uralkal/kafka-ca-configmap.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-ca-cert
+  namespace: pm
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+    0FC16VuidLG0HUCCawFjRiAg9rIA
+    -----END CERTIFICATE-----

apps/pm/uralkal/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
   - ../base
   - redis.yaml
+  - kafka-ca-configmap.yaml
 patches:
   - path: backend.yaml
     target:

apps/premises/base/backend.yaml

@@ -1,313 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: premises
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.9"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      backend:
-        enabled: true
-
-        serviceAccount:
-          enabled:
-            _default: true
-          name:
-            _default: premises-vault
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/premises-backend:production_216148a9
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: premises-backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          command:
-            _default: ["/bin/sh", "-ec"]
-          args:
-            _default:
-              - |
-                set -a
-                [ -f /vault/secrets/premises-db ] && . /vault/secrets/premises-db
-                [ -f /vault/secrets/premises-kafka ] && . /vault/secrets/premises-kafka
-                [ -f /vault/secrets/premises-s3 ] && . /vault/secrets/premises-s3
-                [ -f /vault/secrets/premises-issues-db ] && . /vault/secrets/premises-issues-db
-                [ -f /vault/secrets/premises-inspections-db ] && . /vault/secrets/premises-inspections-db
-                [ -f /vault/secrets/premises-checklists-db ] && . /vault/secrets/premises-checklists-db
-                [ -f /vault/secrets/premises-eav-db ] && . /vault/secrets/premises-eav-db
-                [ -f /vault/secrets/premises-sarex-db ] && . /vault/secrets/premises-sarex-db
-                [ -f /usr/local/share/ca-certificates/kafka.crt ] && export KAFKA_SSL_CERT="$(cat /usr/local/share/ca-certificates/kafka.crt)"
-                set +a
-                exec ./entrypoint.sh
-
-          resources:
-            requests:
-              cpu:
-                _default: "1"
-              memory:
-                _default: 1Gi
-
-          probes:
-            liveness:
-              enabled:
-                _default: true
-              httpGet:
-                path:
-                  _default: /internal/healthz/live/
-              initialDelaySeconds:
-                _default: 10
-              periodSeconds:
-                _default: 60
-            readiness:
-              enabled:
-                _default: true
-              httpGet:
-                path:
-                  _default: /internal/healthz/ready/
-              initialDelaySeconds:
-                _default: 10
-              periodSeconds:
-                _default: 30
-
-        service:
-          enabled: true
-
-          name:
-            _default: backend-svc
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: regcred
-
-        envs:
-          - name: DEBUG
-            value:
-              _default: "false"
-
-          - name: HTTP_ROOT_PATH
-            value:
-              _default: "/premises"
-
-          - name: JWT_AUTH_ENABLE
-            value:
-              _default: "true"
-
-          - name: GUNICORN_WORKERS
-            value:
-              _default: "3"
-
-          - name: FASTSTREAM_WORKERS
-            value:
-              _default: "3"
-
-          - name: DATABASE_POOL_SIZE
-            value:
-              _default: "5"
-
-          - name: KAFKA_EAV_ASSET_TOPIC_NAME
-            value:
-              _default: "assets_broadcast"
-
-          - name: KAFKA_SSL_CERT
-            value:
-              _default: ""
-
-          - name: S3_BUCKET
-            value:
-              _default: "premises"
-
-          - name: EXPORT_TTL_MINUTES
-            value:
-              _default: "30"
-
-          - name: EXPORT_MAX_WORKERS
-            value:
-              _default: "4"
-
-          - name: EXPORT_S3_KEY_PREFIX
-            value:
-              _default: "premise-export"
-
-          - name: ATTACHMENT_MAX_SIZE_BYTES
-            value:
-              _default: "314572800"
-
-          - name: ATTACHMENT_S3_KEY_PREFIX
-            value:
-              _default: "attachment/"
-
-          - name: OTEL_ENABLE
-            value:
-              _default: "false"
-
-          - name: OTEL_URL
-            value:
-              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
-
-          - name: OTEL_SERVICE_NAME
-            value:
-              _default: "premises-backend"
-
-          - name: OTEL_INSECURE
-            value:
-              _default: "true"
-
-          - name: SRX_SDK_IAM_ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://backend-svc.processing.svc.cluster.local:80"
-
-          - name: WORKFLOWS_GENERATION_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/rendering-template:master"
-
-          - name: WORKFLOWS_DOCX_TO_PDF_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/docx-to-pdf:latest"
-
-          - name: WORKFLOWS_CALLBACK_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/webhook-caller:master"
-
-          - name: WORKFLOWS_CALLBACK_HOST
-            value:
-              _default: "http://backend-svc.premises.svc.cluster.local:80"
-
-          - name: WORKFLOWS_RESULT_PATH
-            value:
-              _default: "premises-prod"
-
-        podAnnotations:
-          _default:
-            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-            vault.hashicorp.com/agent-init-first: "true"
-            vault.hashicorp.com/agent-inject: "true"
-            vault.hashicorp.com/agent-pre-populate-only: "true"
-            vault.hashicorp.com/auth-path: auth/kubernetes
-            vault.hashicorp.com/role: premises
-            vault.hashicorp.com/agent-inject-secret-premises-db: secrets/data/apps/premises/postgres
-            vault.hashicorp.com/agent-inject-template-premises-db: |-
-              {{- with secret "secrets/data/apps/premises/postgres" -}}
-              DATABASE_HOST={{ index .Data.data "host" }}
-              DATABASE_PORT={{ index .Data.data "port" }}
-              DATABASE_NAME={{ index .Data.data "database" }}
-              DATABASE_USERNAME={{ index .Data.data "username" }}
-              DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-kafka: secrets/data/kafka/apps/premises
-            vault.hashicorp.com/agent-inject-template-premises-kafka: |-
-              {{- with secret "secrets/data/kafka/apps/premises" -}}
-              KAFKA_HOST={{ if .Data.data.auth }}{{ index .Data.data.auth "bootstrap_servers" }}{{ else }}{{ index .Data.data "bootstrap_servers" }}{{ end }}
-              KAFKA_USERNAME={{ index .Data.data "username" }}
-              KAFKA_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-s3: secrets/data/minio/apps/premises
-            vault.hashicorp.com/agent-inject-template-premises-s3: |-
-              {{- with secret "secrets/data/minio/apps/premises" -}}
-              S3_HOST={{ index .Data.data.client "endpoint" }}
-              S3_ACCESS_KEY={{ index .Data.data "access_key" }}
-              S3_SECRET_KEY={{ index .Data.data "secret_key" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-issues-db: secrets/data/apps/issues/postgres
-            vault.hashicorp.com/agent-inject-template-premises-issues-db: |-
-              {{- with secret "secrets/data/apps/issues/postgres" -}}
-              ISSUES_DATABASE_HOST={{ index .Data.data "host" }}
-              ISSUES_DATABASE_PORT={{ index .Data.data "port" }}
-              ISSUES_DATABASE_NAME={{ index .Data.data "database" }}
-              ISSUES_DATABASE_USERNAME={{ index .Data.data "username" }}
-              ISSUES_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-inspections-db: secrets/data/apps/inspections/postgres
-            vault.hashicorp.com/agent-inject-template-premises-inspections-db: |-
-              {{- with secret "secrets/data/apps/inspections/postgres" -}}
-              INSPECTIONS_DATABASE_HOST={{ index .Data.data "host" }}
-              INSPECTIONS_DATABASE_PORT={{ index .Data.data "port" }}
-              INSPECTIONS_DATABASE_NAME={{ index .Data.data "database" }}
-              INSPECTIONS_DATABASE_USERNAME={{ index .Data.data "username" }}
-              INSPECTIONS_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-checklists-db: secrets/data/apps/checklists/postgres
-            vault.hashicorp.com/agent-inject-template-premises-checklists-db: |-
-              {{- with secret "secrets/data/apps/checklists/postgres" -}}
-              CHECKLISTS_DATABASE_HOST={{ index .Data.data "host" }}
-              CHECKLISTS_DATABASE_PORT={{ index .Data.data "port" }}
-              CHECKLISTS_DATABASE_NAME={{ index .Data.data "database" }}
-              CHECKLISTS_DATABASE_USERNAME={{ index .Data.data "username" }}
-              CHECKLISTS_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-eav-db: secrets/data/apps/eav/postgres
-            vault.hashicorp.com/agent-inject-template-premises-eav-db: |-
-              {{- with secret "secrets/data/apps/eav/postgres" -}}
-              EAV_DATABASE_HOST={{ index .Data.data "host" }}
-              EAV_DATABASE_PORT={{ index .Data.data "port" }}
-              EAV_DATABASE_NAME={{ index .Data.data "database" }}
-              EAV_DATABASE_USERNAME={{ index .Data.data "username" }}
-              EAV_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-sarex-db: secrets/data/apps/django/postgres
-            vault.hashicorp.com/agent-inject-template-premises-sarex-db: |-
-              {{- with secret "secrets/data/apps/django/postgres" -}}
-              SAREX_DATABASE_HOST={{ index .Data.data "host" }}
-              SAREX_DATABASE_PORT={{ index .Data.data "port" }}
-              SAREX_DATABASE_NAME={{ index .Data.data "database" }}
-              SAREX_DATABASE_USERNAME={{ index .Data.data "username" }}
-              SAREX_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/premises/base/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: premises
-resources:
-  - namespace.yaml
-  - backend.yaml

apps/premises/base/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: premises
-  labels:
-    istio-injection: enabled

apps/premises/vad/backend.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: premises
-spec:
-  values:
-    services:
-      backend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null
-        volumes:
-          _default:
-            - name: kafka-ca-cert
-              mountPath:
-                _default: /usr/local/share/ca-certificates/kafka.crt
-              subPath:
-                _default: kafka.crt
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-ca-cert
-                items:
-                  - key: kafka.crt
-                    path:
-                      _default: kafka.crt

apps/premises/vad/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - kafka-ca-configmap.yaml
-patches:
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: backend

apps/processing/brusnika-stage/engine-low.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:production_f5fe4688
+            _default: cr.yandex/crp3ccidau046kdj8g9q/kubernetes-engine:3546957f1e7e8278fc6363da0287573e9454275a
           pullPolicy:
             _default: IfNotPresent
 
@@ -87,10 +87,6 @@ spec:
           monitoring: prometheus
 
         envs:
-          - name: ENABLE_TOLERATION
-            value:
-              _default: "1"
-
           - name: RABBITMQ_HOST
             value:
               _default: "rabbitmq-service.workflow.svc.cluster.local"
@@ -98,10 +94,6 @@ spec:
           - name: RABBITMQ_PORT
             value:
               _default: "5672/api"
-          
-          - name: ENABLE_TOLERATION
-            value:
-              _default: "1"
 
           - name: POSTGRES_ADDRESS
             value:

apps/processing/wb/engine-low.yaml

@@ -108,7 +108,7 @@ spec:
             - name: ENABLE_KUBERNETES_EXECUTOR
               value: "1"
             - name: MAX_WORKFLOWS_LIMIT
-              value: "10"
+              value: "5"
             - name: CPU_COUNT
               value: "1"
             - name: MEMORY_GI

apps/processing/wb/engine.yaml

@@ -125,7 +125,7 @@ spec:
             - name: ENABLE_KUBERNETES_EXECUTOR
               value: "1"
             - name: MAX_WORKFLOWS_LIMIT
-              value: "10"
+              value: "5"
             - name: CPU_COUNT
               value: "1"
             - name: MEMORY_GI

apps/system-log/d8-ugmk-prod/kustomization.yaml

@@ -8,7 +8,3 @@ patches:
     target:
       kind: Namespace
       name: system-log
-  - path: worker.yaml
-    target:
-      kind: HelmRelease
-      name: worker

apps/system-log/d8-ugmk-prod/worker.yaml

@@ -1,56 +0,0 @@
----
-# Адреса соседних сервисов в УГМК отличаются от base: там Service называются
-# backend-api-svc (documentations) и backend-svc (django), оба на порту 80.
-# Внимание: envs в universal-chart — список, и strategic merge его ЦЕЛИКОМ
-# заменяет, а не дополняет. Поэтому здесь перечислен весь набор переменных
-# worker из base, иначе обязательные APP_NAME/APP_VERSION/LOG_LEVEL потеряются
-# и воркер упадёт на старте.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: worker
-  namespace: system-log
-spec:
-  values:
-    services:
-      backend:
-        envs:
-          - name: APP_NAME
-            value:
-              _default: "system_log"
-
-          - name: APP_VERSION
-            value:
-              _default: "0.0.1"
-
-          - name: LOG_LEVEL
-            value:
-              _default: "INFO"
-
-          - name: HTTP_HOST
-            value:
-              _default: "0.0.0.0"
-
-          - name: HTTP_PORT
-            value:
-              _default: "8000"
-
-          - name: NAMESPACE
-            value:
-              _default: "sarex-system-log"
-
-          - name: DOCUMENTATIONS_URL
-            value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "3"
-
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"

apps/transmittal/brusnika-stage/backend.yaml

@@ -287,11 +287,11 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
             value:
-              _default: "minio.brusnika.lonsdaleites.ru"
+              _default: "minio-service.minio.svc.cluster.local:9000"
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
             value:
-              _default: "true"
+              _default: "false"
 
           - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
             value:

apps/transmittal/brusnika-stage/worker.yaml

@@ -278,7 +278,7 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
             value:
-              _default: "minio-svc.minio.svc.cluster.local:9000"
+              _default: "minio-service.minio.svc.cluster.local:9000"
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
             value:

apps/workspaces/base/frontend.yaml

@@ -29,7 +29,7 @@ spec:
         enabled: true
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_828f1bfc
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_07373a45
           pullPolicy:
             _default: IfNotPresent
         deployment:

clusters/brusnika-prod/infrastructure/clusterissuer-letsencrypt.yaml

@@ -20,7 +20,6 @@ spec:
             - identity.camunda.cde.brusnika.ru
             - jupyter.brusnika.onprem.sarex.io
             - keycloak.camunda.cde.brusnika.ru
-            - minio-console.brusnika.onprem.sarex.io
             - minio.brusnika.onprem.sarex.io
             - openobserve.brusnika.onprem.sarex.io
             - operate.camunda.cde.brusnika.ru

clusters/brusnika-prod/infrastructure/kustomization.yaml

@@ -3,21 +3,134 @@ kind: Kustomization
 resources:
   - ../../../infrastructure/istio-base
   - ../../../infrastructure/istio-pilot
-  - ../../../infrastructure/istio-gateway/brusnika-prod
+  - ../../../infrastructure/istio-gateway
-  - ../../../infrastructure/istio-config/brusnika-prod
+  - ../../../infrastructure/istio-config
-  - ../../../infrastructure/vault/brusnika-prod
+  - ../../../infrastructure/vault
-  - ../../../infrastructure/zitadel/brusnika-prod
+  - ../../../infrastructure/zitadel
-  - ../../../infrastructure/minio/brusnika-prod
+  - ../../../infrastructure/minio
-  - ../../../infrastructure/openobserve/brusnika-prod
+  - ../../../infrastructure/openobserve
-  - ../../../infrastructure/vmstack/brusnika-prod
+  - ../../../infrastructure/vmstack
-  - ../../../infrastructure/prometheus-stack/brusnika-prod
+  - ../../../infrastructure/prometheus-stack
-  - ../../../infrastructure/opentelemetry-operator/brusnika-prod
+  - ../../../infrastructure/opentelemetry-operator
-  - ../../../infrastructure/opentelemetry-collector/brusnika-prod
+  - ../../../infrastructure/opentelemetry-collector
-  - ../../../infrastructure/goalert/brusnika-prod
+  - ../../../infrastructure/goalert
-  - ../../../infrastructure/kafka-exporter/brusnika-prod
+  - ../../../infrastructure/kafka-exporter
-  - ../../../infrastructure/postgres-exporter/brusnika-prod
+  - ../../../infrastructure/postgres-exporter
-  - ../../../infrastructure/pgbouncer/brusnika-prod
+  - ../../../infrastructure/pgbouncer
+  - ./vault-ingress.yaml
   - ./clusterissuer-letsencrypt.yaml
+  - ./node-exporter-vmnodescrape.yaml
+  - ./istio-gateway-stats-scrape.yaml
+  - ./istio-dashboard-compat-vmrule.yaml
   - ./camunda-servicemonitors.yaml
   - ./rabbitmq-exporter.yaml
-  - ../../../infrastructure/failed-pod-cleanup/brusnika-prod
+  - ./kafka-exporter-yc.yaml
+  - ./kafka-exporter-yc-rules.yaml
+  - ./kafka-exporter-yc-dashboard.yaml
+  - ../../../infrastructure/failed-pod-cleanup
+patches:
+  - path: ./patches/istio-gateway.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: ingressgateway
+      namespace: istio-system
+  - path: ./patches/istio-config.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istio-config
+      namespace: default
+  - path: ./patches/vault.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: vault
+      namespace: vault
+  - path: ./patches/zitadel.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: zitadel
+      namespace: zitadel
+  - path: ./patches/minio.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: minio
+      namespace: minio
+  - path: ./patches/openobserve.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: openobserve
+      namespace: openobserve
+  - path: ./patches/vmstack.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: vmstack
+      namespace: vmstack
+  - path: ./patches/prometheus-stack.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: prometheus-stack
+      namespace: prometheus-stack
+  - path: ./patches/opentelemetry-operator.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: opentelemetry-operator
+      namespace: opentelemetry-operator
+  - path: ./patches/opentelemetry-collector.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: opentelemetry-collector
+      namespace: opentelemetry-collector
+  - path: ./patches/goalert.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: goalert
+      namespace: goalert
+  - path: ./patches/kafka-exporter.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: kafka-exporter
+      namespace: kafka-exporter
+  - path: ./patches/postgres-exporter.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: postgres-exporter
+      namespace: postgres-exporter
+  - path: ./patches/failed-pod-cleanup.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: failed-pod-cleanup
+      namespace: default
+  - path: ./patches/pgbouncer.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: pgbouncer
+      namespace: pgbouncer

clusters/brusnika-prod/infrastructure/patches/istio-config.yaml

@@ -103,13 +103,6 @@ spec:
               issuerRef:
                 name: letsencrypt
                 kind: ClusterIssuer
-            minio-console-tls:
-              namespace: ingress-nginx
-              dnsNames:
-                - minio-console.brusnika.onprem.sarex.io
-              issuerRef:
-                name: letsencrypt
-                kind: ClusterIssuer
             projects-secret-name:
               namespace: ingress-nginx
               dnsNames:
@@ -285,16 +278,6 @@ spec:
                     - minio.brusnika.onprem.sarex.io
                   tls:
                     credentialName: brusnika-secret-name
-            minio-console:
-              name: minio-console-gw
-              namespace: ingress-nginx
-              selector:
-                istio: ingressgateway
-              servers:
-                - hosts:
-                    - minio-console.brusnika.onprem.sarex.io
-                  tls:
-                    credentialName: minio-console-tls
             sso-check:
               name: sso-check-gw
               namespace: ingress-nginx
@@ -543,554 +526,10 @@ spec:
                     prefix: /integration/
                   service: yet-another-nginx-service.global-ingress.svc.cluster.local
                   port: 80
-                - path:
-                    prefix: /checklists/admin/
-                  service: backend-service.checklist.svc.cluster.local
-                  port: 8000
-                - path:
-                    prefix: /checklists/api/
-                  rewrite: /api/
-                  service: backend-service.checklist.svc.cluster.local
-                  port: 8000
                 - path:
                     prefix: /
                   service: nginx-service.global-ingress.svc.cluster.local
                   port: 80
-            projects-frontend:
-              namespace: projects
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /projects/static/
-                  rewrite: /
-                  service: frontend-service.projects.svc.cluster.local
-                  port: 8000
-            transmittal-frontend-static:
-              namespace: transmittal
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /transmittal/static/
-                  rewrite: /
-                  service: transmittal-frontend-static.transmittal.svc.cluster.local
-                  port: 80
-            flows-frontend:
-              namespace: flows
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /flows/static/
-                  rewrite: /
-                  service: frontend-service.flows.svc.cluster.local
-                  port: 80
-            reviews-frontend:
-              namespace: reviews
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /reviews/static/
-                  rewrite: /
-                  service: frontend-service.reviews.svc.cluster.local
-                  port: 80
-            documentation-frontend-static:
-              namespace: documentations
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /documentations/static/
-                  rewrite: /
-                  service: documentation-frontend-static-service.documentations.svc.cluster.local
-                  port: 80
-            inspections-frontend:
-              namespace: inspections
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /inspections/static/
-                  rewrite: /
-                  service: frontend-service.inspections.svc.cluster.local
-                  port: 80
-            comparisons-static:
-              namespace: comparisons
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /comparisons/static/
-                  rewrite: /
-                  service: comparisons-service.comparisons.svc.cluster.local
-                  port: 8080
-            notes-frontend:
-              namespace: notes
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /notes/static/
-                  rewrite: /
-                  service: frontend-service.notes.svc.cluster.local
-                  port: 8080
-            transmittal-api-virt-service:
-              namespace: transmittal
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /transmittals/api/
-                  rewrite: /api/
-                  service: transmittal-service.transmittal.svc.cluster.local
-                  port: 80
-            inspections-backend:
-              namespace: inspections
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /inspections/api/
-                  rewrite: /api/
-                  service: backend-service.inspections.svc.cluster.local
-                  port: 8000
-            workflows-api:
-              namespace: workflow
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /workflows/api/
-                  rewrite: /api/
-                  service: workflows-api-service.workflow.svc.cluster.local
-                  port: 8000
-            workspaces-api:
-              namespace: workspaces
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /workspaces/api/
-                  rewrite: /api/
-                  service: workspaces-service.workspaces.svc.cluster.local
-                  port: 8000
-            bim-backend-v2:
-              namespace: bim
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /bimv2/api/
-                  rewrite: /api/
-                  service: backend-service.bim.svc.cluster.local
-                  port: 8000
-            notes-backend:
-              namespace: notes
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /notes/api/
-                  rewrite: /api/
-                  service: backend-service.notes.svc.cluster.local
-                  port: 8000
-            mapper-backend:
-              namespace: mapper
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /mapper/api/
-                  rewrite: /api/
-                  service: backend-service.mapper.svc.cluster.local
-                  port: 8000
-            eav:
-              namespace: eav
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /eav/api/
-                  rewrite: /api/
-                  service: eav-service.eav.svc.cluster.local
-                  port: 8000
-                - path:
-                    prefix: /eav/admin/
-                  service: eav-service.eav.svc.cluster.local
-                  port: 8000
-            comparisons-backend:
-              namespace: comparisons
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /comparisons/api/
-                  rewrite: /api/
-                  service: backend-service.comparisons.svc.cluster.local
-                  port: 80
-            django-media:
-              namespace: django
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /media/
-                  rewrite: /
-                  service: s3-proxy-service.django.svc.cluster.local
-                  port: 80
-            resources:
-              namespace: resources
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /resources/
-                  rewrite: /
-                  service: resources-service.resources.svc.cluster.local
-                  port: 8000
-                - path:
-                    prefix: /res-admin/
-                  service: resources-service.resources.svc.cluster.local
-                  port: 8000
-                - path:
-                    prefix: /resource-management/
-                  service: resources-service.resources.svc.cluster.local
-                  port: 8000
-            srx-admin:
-              namespace: django
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /control-interface/
-                  rewrite: /
-                  service: srx-admin-svc.django.svc.cluster.local
-                  port: 8080
-            administration-users:
-              namespace: django
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /administration/users
-                  service: frontend-service.django.svc.cluster.local
-                  port: 80
-            cde:
-              namespace: orchestrator
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              routes:
-                - path:
-                    prefix: /orchestrator/
-                  rewrite: /api/
-                  service: cde.orchestrator.svc.cluster.local
-                  port: 8080
-            pdm-api-api:
-              namespace: documentations
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-              headers:
-                request:
-                  remove:
-                    - Cookie
-              routes:
-                - path:
-                    prefix: /gateway/api/
-                  rewrite: /api/
-                  service: pdm-api.documentations.svc.cluster.local
-                  port: 8080
-            documentations:
-              namespace: documentations
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-                extraAllowMethods:
-                  - HEAD
-                extraAllowHeaders:
-                  - Range
-                  - Cache-Control
-              routes:
-                - path:
-                    prefix: /documentations/api/
-                  rewrite: /api/
-                  service: documentations-api.documentations.svc.cluster.local
-                  port: 8080
-                - path:
-                    prefix: /files/api/
-                  rewrite: /api/
-                  service: documentations-filestream.documentations.svc.cluster.local
-                  port: 8080
-            issues-vs:
-              namespace: issues
-              hosts:
-                - cde.brusnika.ru
-              gateways:
-                - ingress-nginx/global-cde-gw
-              cors:
-                allowCredentials: true
-                allowOrigins:
-                  - exact: https://cde.brusnika.ru
-                  - exact: https://stamp-verification.cde.brusnika.ru
-                  - exact: https://document-link.cde.brusnika.ru
-              routes:
-                - path:
-                    prefix: /issues-management/
-                  service: issues-service.issues.svc.cluster.local
-                  port: 80
-                - path:
-                    prefix: /issues/api/
-                  rewrite: /api/
-                  service: issues-service.issues.svc.cluster.local
-                  port: 80
-                - path:
-                    prefix: /issues/static/
-                  rewrite: /
-                  service: static-service.issues.svc.cluster.local
-                  port: 80
-                - path:
-                    prefix: /remarks/static/
-                  rewrite: /
-                  service: remarks-static.issues.svc.cluster.local
-                  port: 80
             jupyter-vs:
               namespace: jupyter
               hosts:
@@ -1141,28 +580,7 @@ spec:
                 - ingress-nginx/minio-gw
               cors:
                 allowOrigins:
-                  - exact: https://minio.brusnika.onprem.sarex.io
+                  - regex: ".*"
-              routes:
-                - match:
-                    - port: 80
-                      uri:
-                        prefix: /
-                  redirect:
-                    scheme: https
-                    redirectCode: 308
-                - path:
-                    prefix: /
-                  service: minio.minio.svc.cluster.local
-                  port: 9000
-            minio-console-vs:
-              namespace: minio
-              hosts:
-                - minio-console.brusnika.onprem.sarex.io
-              gateways:
-                - ingress-nginx/minio-console-gw
-              cors:
-                allowOrigins:
-                  - exact: https://minio-console.brusnika.onprem.sarex.io
               routes:
                 - match:
                     - port: 80

clusters/brusnika-prod/infrastructure/patches/minio.yaml

@@ -11,7 +11,7 @@ spec:
     mode: standalone
     environment:
       MINIO_SERVER_URL: "https://minio.brusnika.onprem.sarex.io"
-      MINIO_BROWSER_REDIRECT_URL: "https://minio-console.brusnika.onprem.sarex.io"
+      MINIO_BROWSER_REDIRECT_URL: "https://minio.brusnika.onprem.sarex.io/console/"
       MINIO_API_CORS_ALLOW_ORIGIN: "https://minio.brusnika.onprem.sarex.io"
     imagePullSecrets:
       - name: regcred