apps/attachments/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
+            _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:production_6dbb4dce
           pullPolicy:
             _default: IfNotPresent
 

apps/bi/brusnika-stage/backend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_e607dcc6
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_37902c73
           pullPolicy:
             _default: IfNotPresent
 
@@ -119,10 +119,6 @@ spec:
             _default: regcred
 
         envs:
-          - name: SUPERSET_HOST
-            value:
-              _default: "https://superset.test.sarex.brusnika.tech"
-
           - name: SETTINGS_DEBUG
             value:
               _default: "0"

apps/bim/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
           pullPolicy:
             _default: IfNotPresent
 

apps/cde/brusnika-stage/cde-flowscallback.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-flowscallback
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-flowscallback
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-flowscallback
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-flowscallback
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-flowscallback
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-splitpdf.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-splitpdf
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-splitpdf
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-splitpdf
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-splitpdf
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_4.4.1
-        imagePullPolicy: Always
-        name: cde-worker-splitpdf
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-alert.yaml

@@ -1,35 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-alert
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-alert
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 0
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-alert
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-alert
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/orchestrator:latest
-        imagePullPolicy: Always
-        name: cde-worker-alert
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copy.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-copy
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-copy
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-copy
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-copy
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-copy
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copyv2.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-copyv2
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-copyv2
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-copy
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-copy
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/copyv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-copy
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-markings.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-markings
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-markings
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-markings
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-markings
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:preprod_eb50f30e
-        imagePullPolicy: Always
-        name: cde-worker-markings
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-sign.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-sign
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-sign
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-sign
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-sign
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-sign
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-update-bundles.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-update-bundles
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-updatebundles
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-updatebundles
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-updatebundles
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-update-bundles
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde.yaml

@@ -1,55 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/cde:production_e5316bd0
-        imagePullPolicy: Always
-        livenessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 15
-          periodSeconds: 10
-          successThreshold: 1
-          tcpSocket:
-            port: 8080
-          timeoutSeconds: 1
-        name: cde
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-        readinessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 15
-          periodSeconds: 10
-          successThreshold: 1
-          tcpSocket:
-            port: 8080
-          timeoutSeconds: 1
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/createversionsv2-worke.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: createversionsv2-worke
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-createversions
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-createversions
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-createversions
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'true'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/createversionsv2-worker:preprod_90202b78
-        imagePullPolicy: Always
-        name: createversionsv2-worke
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/kustomization.yaml

@@ -1,19 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: orchestrator
+namespace: contracts
 resources:
-  - serviceaccount.yaml
+  - helmrelease.yaml
-  - service.yaml
-  - cde.yaml
-  - cde-flowscallback.yaml
-  - cde-splitpdf.yaml
-  - cde-worker-alert.yaml
-  - cde-worker-copy.yaml
-  - cde-worker-markings.yaml
-  - cde-worker-sign.yaml
-  - cde-worker-update-bundles.yaml
-  - cde-worker-copyv2.yaml
-  - createversionsv2-worke.yaml
-  - markingsv2-worker.yaml
-  - signv2-worker.yaml

apps/cde/brusnika-stage/markingsv2-worker.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: markingsv2-worker
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-markings
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-markings
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-markings
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/markingsv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-markings
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/service.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-  ports:
-  - name: http
-    port: 8080
-    protocol: TCP
-    targetPort: 8080

apps/cde/brusnika-stage/serviceaccount.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-    app.kubernetes.io/version: 0.0.1

apps/cde/brusnika-stage/signv2-worker.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: signv2-worker
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-sign
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-sign
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-sign
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/signv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-sign
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/control-interface/uralkal/ams-sync.yaml

@@ -0,0 +1,183 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ams-sync
+  namespace: control-interface
+  labels:
+    app: ams-sync
+    service: backend
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ams-sync
+  template:
+    metadata:
+      labels:
+        app: ams-sync
+        service: backend
+    spec:
+      containers:
+        - name: backend
+          image: cr.yandex/crp3ccidau046kdj8g9q/ams-sync:ugok
+          command: ["sleep", "999999999999"]
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8000
+              protocol: TCP
+          env:
+            - name: AMS_SYNC_TOPIC
+              value: ams-sync
+            - name: ENVIRONMENT
+              value: PRODUCTION
+            - name: HOST_ORGANIZATION_ID
+              value: '392748423989716183'
+            - name: ALERT_ENABLED
+              value: 'False'
+            - name: USER_SERVER_HOST
+              value: https://sarex.local.uralkali.com
+            - name: AUTH_HOST
+              value: https://sarex.local.uralkali.com
+            - name: VERIFY_USERS
+              value: 'True'
+            - name: KAFKA_SECURITY_PROTOCOL
+              value: SSL
+            - name: KAFKA_SASL_MECHANISM
+              value: SCRAM-SHA-512
+            - name: RESOURCES_INTERNAL_HOST
+              value: http://iams.iam.svc.cluster.local:8080
+            - name: TELEGRAM_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: telegram-secret
+                  key: telegram-token
+            - name: TELEGRAM_GROUP_ID
+              valueFrom:
+                secretKeyRef:
+                  name: telegram-secret
+                  key: telegram-group-id
+            - name: ZITADEL_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: zitadel-token-secret
+                  key: zitadel-host
+            - name: ZITADEL_SERVICE_ACCESS_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: zitadel-token-secret
+                  key: zitadel-access-token
+            - name: KAFKA_BOOTSTRAP_SERVERS
+              valueFrom:
+                secretKeyRef:
+                  name: ams-kafka-secret
+                  key: kafka-bootstrap-servers
+            - name: KAFKA_SASL_PLAIN_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: ams-kafka-secret
+                  key: kafka-username
+            - name: KAFKA_SASL_PLAIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: ams-kafka-secret
+                  key: kafka-password
+            - name: KAFKA_SSL_CAFILE
+              valueFrom:
+                secretKeyRef:
+                  name: ams-kafka-secret
+                  key: kafka-ca-file
+            - name: AUTH_ADMIN_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: auth-secret
+                  key: admin-username
+            - name: AUTH_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: auth-secret
+                  key: admin-password
+            - name: USER_DB_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: user-db-secret
+                  key: user-db-name
+            - name: USER_DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: user-db-secret
+                  key: user-db-user
+            - name: USER_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: user-db-secret
+                  key: user-db-password
+            - name: USER_DB_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: user-db-secret
+                  key: user-db-host
+            - name: USER_DB_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: user-db-secret
+                  key: user-db-port
+      imagePullSecrets:
+        - name: regcred
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ams-kafka-secret
+  namespace: control-interface
+type: Opaque
+data:
+  kafka-bootstrap-servers: WyJicnVzbmlrYS1zdGFnZS1rYWZrYS1ib290c3RyYXAua2Fma2Euc3ZjLmNsdXN0ZXIubG9jYWw6OTA5MyJd
+  kafka-ca-file: L2V0Yy9jYS1jZXJ0aWZpY2F0ZXMvWWFuZGV4L1lhbmRleEludGVybmFsUm9vdENBLmNydA==
+  kafka-password: bkszNnNhc3ZTZm9JdEpuWFE0cXhhdjJPVVdJUFg1WkM=
+  kafka-username: c2FyZXg=
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: auth-secret
+  namespace: control-interface
+type: Opaque
+data:
+  admin-password: emVhbG90MDk2
+  admin-username: aGFnZW4wMTM=
+  host: aHR0cHM6Ly9zYXJleC5sb2NhbC51cmFsa2FsaS5jb20=
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: telegram-secret
+  namespace: control-interface
+type: Opaque
+data:
+  telegram-group-id: LTEwMDIzNTAyNzE=
+  telegram-token: NzAyOTgxMDQ2ODpBQUZBUUI1X0Y5TV92R2RndGlXOVBDRzVTUndIcFg2SnNUZw==
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: user-db-secret
+  namespace: control-interface
+type: Opaque
+data:
+  user-db-host: MTAuMTMzLjAuMjQ5
+  user-db-name: c2FyZXhfZGI=
+  user-db-password: QXNOUkE3WUhoUVlIWnNCRXFRUVBxRUUwdEU0ZmtwTTU=
+  user-db-port: NTQzMg==
+  user-db-user: ZGphbmdv
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: zitadel-token-secret
+  namespace: control-interface
+type: Opaque
+data:
+  zitadel-access-token: OXk5V0VZR05YYm11UXFxQlRjNDFNSTV1Yjc5R3R6VkR0dFZRM2ZiSE5PMnVpQU9YNTAwRzYyN3BDeUk5TEd2Y1Q0TFlHd2w=
+  zitadel-host: aHR0cHM6Ly9sb2dpbi5zYXJleC5sb2NhbC51cmFsa2FsaS5jb20=

apps/control-interface/uralkal/kustomization.yaml

@@ -3,4 +3,4 @@ kind: Kustomization
 resources:
   - ../base
   - namespace.yaml
-  - psql-tools-debug.yaml
+  - ams-sync.yaml

apps/control-interface/uralkal/psql-tools-debug.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: psql-tools-debug
-  namespace: control-interface
-  labels:
-    app: psql-tools-debug
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: psql-tools-debug
-  template:
-    metadata:
-      labels:
-        app: psql-tools-debug
-    spec:
-      containers:
-        - name: debug
-          image: cr.yandex/crp3ccidau046kdj8g9q/zitadel-bpmn:cc_contour_5.22.3_ca40c204
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-c"]
-          args:
-            - while true; do sleep 3600; done
-      imagePullSecrets:
-        - name: regcred

apps/django/base/django-configmap.yaml

@@ -87,7 +87,7 @@ data:
         'Bearer',
     )
 
-    HOST = os.environ.get("DJANGO_HOST", "https://sarex.contour.infra.sarex.tech")
+    HOST = "https://sarex.contour.infra.sarex.tech"
 
     POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
     POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')

apps/django/brusnika-stage/nginx-configmap.yaml

@@ -101,8 +101,7 @@ data:
 
             location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
                 alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
-                types { }
+                add_header Content-Type application/wasm always;
-                default_type application/wasm;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -111,8 +110,7 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
-                types { }
+                add_header Content-Type application/javascript always;
-                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -121,8 +119,7 @@ data:
 
             location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
                 alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
-                types { }
+                add_header Content-Type application/javascript always;
-                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -131,8 +128,7 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf.js;
-                types { }
+                add_header Content-Type application/javascript always;
-                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -140,8 +136,7 @@ data:
             }
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                types { }
+                add_header Content-Type application/wasm always;
-                default_type application/wasm;
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
             }
 
@@ -149,8 +144,7 @@ data:
             rewrite /workspaces-v2/(.+) /$1 break;
             proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
 
-            proxy_hide_header Content-Type;
+            add_header Content-Type application/wasm;
-            add_header Content-Type application/wasm always;
             proxy_set_header Accept application/wasm;
         }
 

apps/django/d8-ugmk-prod/backend.yaml

@@ -18,9 +18,6 @@ spec:
           - name: SERVER_ZITADEL_ENABLED
             value:
               _default: "True"
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.uralmine.com"
           - name: DJANGO_SETTINGS_MODULE
             value:
               _default: config.settings.production

apps/django/uralkal/backend.yaml

@@ -14,10 +14,6 @@ spec:
               cpu: null
               memory: null
         envs:
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.local.uralkali.com"
-
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/django/uralkal/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            location ~^/api/pm/ {
+            # location ~^/api/pm/ {
-                proxy_http_version 1.1;
+            #     proxy_http_version 1.1;
-                proxy_set_header Connection "";
+            #     proxy_set_header Connection "";
-                proxy_set_header Host $host;
+            #     proxy_set_header Host $host;
-                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            }
+            # }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;

apps/django/vad/backend.yaml

@@ -9,10 +9,6 @@ spec:
     services:
       backend:
         envs:
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.vadroad.ru"
-
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/documentations/base/pdm.yaml

@@ -210,7 +210,7 @@ spec:
               _default: http://backend-svc.subscriptions.svc.cluster.local:80
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
+              _default: http://api-service.system-log.svc.cluster.local:80
           - name: TARGET_URL
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/brusnika-stage/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
           pullPolicy:
             _default: IfNotPresent
 
@@ -100,10 +100,6 @@ spec:
         labels:
           monitoring: prometheus
         envs:
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
-
           - name: POSTGRES_ADDRESS
             value:
               _default: "192.168.2.45"

apps/documentations/brusnika-stage/hasher.yaml

@@ -1,95 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hasher
-  namespace: documentations
-  labels:
-    app: hasher
-    service: normal
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hasher
-  template:
-    metadata:
-      labels:
-        app: hasher
-        service: normal
-    spec:
-      containers:
-      - env:
-        - name: HASHER_APP__LOG_LEVEL
-          value: INFO
-        - name: HASHER_APP__NUM_WORKERS
-          value: '4'
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
-          value: hash.compute.normal.tasks
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
-          value: hash.compute
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
-          value: direct
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
-          value: hash.compute.normal
-        - name: HASHER_S3__MAX_POOL_CONNECTIONS
-          value: '10'
-        - name: HASHER_S3__CONNECT_TIMEOUT
-          value: '10'
-        - name: HASHER_S3__READ_TIMEOUT
-          value: '30'
-        - name: HASHER_S3__REGION_NAME
-          value: ru-central1
-        - name: HASHER_S3__USE_SSL
-          value: 'true'
-        - name: HASHER_S3__VERIFY
-          value: 'true'
-        - name: HASHER_AMQP__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__PORT
-          valueFrom:
-            secretKeyRef:
-              key: port
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__VHOST
-          valueFrom:
-            secretKeyRef:
-              key: vhost
-              name: hasher-rabbitmq-secret
-        - name: HASHER_S3__ENDPOINT
-          valueFrom:
-            secretKeyRef:
-              key: endpoint
-              name: hasher-s3-secret
-        - name: HASHER_S3__ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              key: access_key
-              name: hasher-s3-secret
-        - name: HASHER_S3__SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              key: secret_key
-              name: hasher-s3-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
-        imagePullPolicy: IfNotPresent
-        name: normal
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-      imagePullSecrets:
-      - name: regcred

apps/documentations/brusnika-stage/kustomization.yaml

@@ -7,5 +7,3 @@ resources:
   - pdm.yaml
   - api.yaml
   - filestream.yaml
-  - hasher.yaml
-  - pdf-markings-amqp.yaml

apps/documentations/brusnika-stage/pdf-markings-amqp.yaml

@@ -1,125 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pdf-markings-amqp
-  namespace: documentations
-  labels:
-    app: pdf-markings-amqp
-    service: api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pdf-markings-amqp
-  strategy:
-    rollingUpdate:
-      maxSurge: 3
-      maxUnavailable: 3
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: pdf-markings-amqp
-        service: api
-    spec:
-      containers:
-      - env:
-        - name: MARKS_APP__LOG_LEVEL
-          value: INFO
-        - name: MARKS_CRYPTO__HASHING_ALGO
-          value: md_gost12_256
-        - name: MARKS_DOCUMENTS_DB__HOST
-          value: 192.168.2.45
-        - name: MARKS_DOCUMENTS_DB__PORT
-          value: '5432'
-        - name: MARKS_DOCUMENTS_DB__DATABASE
-          value: documentations
-        - name: MARKS_DOCUMENTS_DB__SSLMODE
-          value: disable
-        - name: MARKS_QR__REDIRECT_URL
-          value: https://stamp-verification.test.sarex.brusnika.tech/
-        - name: MARKS_QR__BASE_DOCUMENT_URL
-          value: https://test.sarex.brusnika.tech
-        - name: MARKS_S3__USE_SSL
-          value: 'false'
-        - name: MARKS_S3__SSL_VERIFY
-          value: 'false'
-        - name: MARKS_S3__REGION
-          value: ru-central1
-        - name: MARKS_S3__DEFAULT_BUCKET
-          value: documentations-stage-1-sarex-new
-        - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
-          value: pdf_markings_input
-        - name: MARKS_DOCUMENTS_DB__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: postgres-secret
-        - name: MARKS_DOCUMENTS_DB__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: postgres-secret
-        - name: MARKS_S3__URL
-          valueFrom:
-            secretKeyRef:
-              key: endpoint_url
-              name: yc-s3
-        - name: MARKS_S3__ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              key: key_id
-              name: yc-s3
-        - name: MARKS_S3__SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              key: access_key
-              name: yc-s3
-        - name: MARKS_RABBITMQ__HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__PORT
-          valueFrom:
-            secretKeyRef:
-              key: port
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__VHOST
-          valueFrom:
-            secretKeyRef:
-              key: vhost
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
-          valueFrom:
-            secretKeyRef:
-              key: heartbeat
-              name: rabbitmq
-        image: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
-        imagePullPolicy: IfNotPresent
-        name: api
-        ports:
-        - containerPort: 8000
-          name: http
-          protocol: TCP
-        volumeMounts:
-        - mountPath: /etc/sarex/yc-s3-storage
-          name: yc-s3
-          readOnly: true
-      volumes:
-      - name: yc-s3
-        secret:
-          secretName: yc-s3
-      imagePullSecrets:
-      - name: regcred

apps/documentations/brusnika-stage/pdm.yaml

@@ -124,11 +124,11 @@ spec:
 
           - name: TRANSMITTALS_BASE_URL
             value:
-              _default: "http://transmittal-service.transmittal.svc.cluster.local:80"
+              _default: ""
 
           - name: TRANSMITTALS_ENABLE
             value:
-              _default: "true"
+              _default: "false"
 
           - name: DRAWINGS_INTERNAL_URL
             value:

apps/documentations/d8-ugmk-prod/filestream.yaml

@@ -83,7 +83,7 @@ spec:
               _default: v1
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
+              _default: http://api-service.system-log.svc.cluster.local:80
           - name: DJANGO_HOST
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/uralkal/api.yaml

@@ -13,9 +13,6 @@ spec:
             requests:
               cpu: null
               memory: null
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api:contour_8631bb0e
         envs:
           - name: POSTGRES_POOL_SIZE
             value:
@@ -26,12 +23,9 @@ spec:
           - name: ZITADEL_DOMAIN
             value:
               _default: login.sarex.local.uralkali.com
-          - name: ZITADEL_INSECURE_SKIP_VERIFY
-            value:
-              _default: "true"
           - name: USE_ZITADEL
             value:
-              _default: "1"
+              _default: "0"
           - name: FLOWS_URL
             value:
               _default: http://backend-svc.flows.svc.cluster.local:80

apps/documentations/uralkal/filestream.yaml

@@ -13,16 +13,10 @@ spec:
             requests:
               cpu: null
               memory: null
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:contour_8631bb0e
         envs:
           - name: POSTGRES_POOL_SIZE
             value:
               _default: "20"
-          - name: ZITADEL_INSECURE_SKIP_VERIFY
-            value:
-              _default: "true"
           - name: ZITADEL_ACCOUNT
             value:
               _default: /vault/secrets/documentations-zitadel-account-json
@@ -31,7 +25,7 @@ spec:
               _default: login.sarex.local.uralkali.com
           - name: USE_ZITADEL
             value:
-              _default: "1"
+              _default: "0"
           - name: FLOWS_URL
             value:
               _default: http://backend-svc.flows.svc.cluster.local:80

apps/documentations/wb/api.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
           pullPolicy:
             _default: IfNotPresent
 
@@ -307,23 +307,6 @@ spec:
             value:
               _default: "6379"
 
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
-
-          - name: USE_MARKS_RABBITMQ
-            value:
-              _default: '1'
-          - name: MARKS_RABBITMQ_HOST
-            value: 
-              _default: rabbitmq.rabbitmq.svc.cluster.local
-          - name: MARKS_RABBITMQ_PORT
-            value: 
-              _default: '5672'
-          - name: MARKS_RABBITMQ_API
-            value: 
-              _default: cde
-
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:
@@ -355,16 +338,6 @@ spec:
               _default: "django-auth"
             secretKey: "key"
 
-          - name: MARKS_RABBITMQ_USER
-            secretName:
-              _default: "hasher-rabbitmq-secret"
-            secretKey: "user"
-
-          - name: MARKS_RABBITMQ_PASSWORD
-            secretName:
-              _default: "hasher-rabbitmq-secret"
-            secretKey: "password"
-
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/flows/brusnika-stage/celery.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 
@@ -252,26 +252,6 @@ spec:
               _default: "https://test.sarex.brusnika.tech"
 
         secretEnvs:
-          - name: FLOWS_DB_DB
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: FLOWS_DB_USERNAME
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: FLOWS_DB_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: DJANGO_AUTH
-            secretName:
-              _default: "django-secret"
-            secretKey: "token"
-
           - name: ADMIN_PANEL_SECRET_KEY
             secretName:
               _default: "admin-secret"

apps/flows/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/d8-ugmk-prod/backend.yaml

@@ -1,4 +1,11 @@
 ---
+# Патч backend для контура УГМК — подключение к Kafka.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
+# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -22,19 +29,6 @@ spec:
                 set +a
                 exec /opt/entrypoint.sh
 
-        volumes:
-          _default:
-            - name: authentication
-              mountPath:
-                _default: /opt/src/flow/admin/authentication.py
-              subPath:
-                _default: authentication.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: authentication
-
         envs:
           - name: LOG_LEVEL
             value:
@@ -104,10 +98,6 @@ spec:
             value:
               _default: "https://sarex.uralmine.com/flows/api/v1"
 
-          - name: PROXY_PATH_PREFIX
-            value:
-              _default: /flows
-
           - name: SMTP_HOST
             value:
               _default: "post.uralmine.com"

apps/flows/uralkal/backend.yaml

@@ -82,10 +82,6 @@ spec:
           - name: ENABLE_MAILGUN
             value:
               _default: "0"
-          
-          - name: ENABLE_EVENTS
-            value:
-              _default: "0"
 
           - name: ENABLE_METRICS
             value:
@@ -143,11 +139,28 @@ spec:
             value:
               _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
 
-        secretEnvs:
           - name: KAFKA_SSL_CERT
-            secretName:
+            value:
-              _default: kafka-kafka-contour-tls
+              _default: |
-            secretKey: "ca.crt"
+                -----BEGIN CERTIFICATE-----
+                MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+                MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+                MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+                tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+                h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+                k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+                GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+                zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+                Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+                A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+                vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+                OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+                fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+                ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+                0FC16VuidLG0HUCCawFjRiAg9rIA
+                -----END CERTIFICATE-----
 
         podAnnotations:
           _default:

apps/flows/uralkal/celery.yaml

@@ -1,4 +1,11 @@
 ---
+# Патч celery для контура УГМК — подключение к Kafka.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml.
+# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -133,11 +140,28 @@ spec:
             value:
               _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
 
-        secretEnvs:
           - name: KAFKA_SSL_CERT
-            secretName:
+            value:
-              _default: kafka-kafka-contour-tls
+              _default: |
-            secretKey: "ca.crt"
+                -----BEGIN CERTIFICATE-----
+                MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+                MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+                MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+                tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+                h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+                k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+                GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+                zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+                Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+                A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+                vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+                OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+                fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+                ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+                0FC16VuidLG0HUCCawFjRiAg9rIA
+                -----END CERTIFICATE-----
 
         podAnnotations:
           _default:

apps/flows/wb/backend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/wb/celery.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/wb/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_b52d632c
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/uralkal/backend-s3.yaml

@@ -57,10 +57,6 @@ spec:
             value:
               _default: "iam"
 
-          - name: ZITADEL_TLS_INSECURE_SKIP_VERIFY
-            value:
-              _default: "true"
-
           - name: S3_REGION
             value:
               _default: "ru-central1"

apps/inspections/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
           pullPolicy:
             _default: IfNotPresent
 

apps/inspections/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/brusnika-stage/backend.yaml

@@ -176,6 +176,9 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
 
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID

apps/issues/uralkal/backend-s3.yaml

@@ -49,11 +49,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              secret:
+              configMap:
-                secretName:
+                name:
-                  _default: kafka-kafka-contour-tls
+                  _default: kafka-ca-cert
                 items:
-                  - key: ca.crt
+                  - key: kafka.crt
                     path:
                       _default: kafka.crt
 

apps/issues/uralkal/celery-s3.yaml

@@ -49,11 +49,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              secret:
+              configMap:
-                secretName:
+                name:
-                  _default: kafka-kafka-contour-tls
+                  _default: kafka-ca-cert
                 items:
-                  - key: ca.crt
+                  - key: kafka.crt
                     path:
                       _default: kafka.crt
 

apps/issues/uralkal/kafka-ca-configmap.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: kafka-ca-cert
-  namespace: premises
+  namespace: issues
 data:
   kafka.crt: |
     -----BEGIN CERTIFICATE-----

apps/issues/uralkal/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - kafka-ca-configmap.yaml
 patches:
   - path: backend-s3.yaml
     target:

apps/message-hub/uralkal/kafka-ca-configmap.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-ca-cert
+  namespace: message-hub
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+    0FC16VuidLG0HUCCawFjRiAg9rIA
+    -----END CERTIFICATE-----

apps/message-hub/uralkal/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - kafka-ca-configmap.yaml
 patches:
   - path: message-hub.yaml
     target:

apps/message-hub/uralkal/message-hub.yaml

@@ -91,11 +91,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              secret:
+              configMap:
-                secretName:
+                name:
-                  _default: kafka-kafka-contour-tls
+                  _default: kafka-ca-cert
                 items:
-                  - key: ca.crt
+                  - key: kafka.crt
                     path:
                       _default: kafka.crt
 
@@ -106,5 +106,5 @@ spec:
               {{- with secret "secrets/data/kafka/apps/pm" -}}
               KAFKA_USERNAME={{ index .Data.data "username" }}
               KAFKA_PASSWORD={{ index .Data.data "password" }}
-              KAFKA_SASL_MECHANISM={{ if .Data.data.auth }}{{ index .Data.data.auth "sasl_mechanism" }}{{ else }}{{ index .Data.data "sasl_mechanism" }}{{ end }}
+              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
               {{- end -}}

apps/notes/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:0.3.7
           pullPolicy:
             _default: IfNotPresent
 
@@ -87,14 +87,6 @@ spec:
           monitoring: prometheus
 
         envs:
-          - name: SYNC_RESOURCE_ID
-            value:
-              _default: "0"
-
-          - name: ENABLE_ND
-            value:
-              _default: "0"
-
           - name: DJANGO_HOST
             value:
               _default: "http://backend.django.svc.cluster.local:8000"

apps/notes/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:prod_55791cf6_relative
           pullPolicy:
             _default: IfNotPresent
 

apps/pm/brusnika-stage/frontend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_abfaba7c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_7f125269
           pullPolicy:
             _default: IfNotPresent
 

apps/pm/uralkal/backend.yaml

@@ -182,11 +182,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              secret:
+              configMap:
-                secretName:
+                name:
-                  _default: kafka-kafka-contour-tls
+                  _default: kafka-ca-cert
                 items:
-                  - key: ca.crt
+                  - key: kafka.crt
                     path:
                       _default: kafka.crt
 
@@ -204,7 +204,7 @@ spec:
             vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm
             vault.hashicorp.com/agent-inject-template-pm-kafka: |-
               {{- with secret "secrets/data/kafka/apps/pm" -}}
-              KAFKA_SASL_MECHANISM={{ if .Data.data.auth }}{{ index .Data.data.auth "sasl_mechanism" }}{{ else }}{{ index .Data.data "sasl_mechanism" }}{{ end }}
+              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
               KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
               KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
               {{- end -}}

apps/pm/uralkal/celery.yaml

@@ -191,11 +191,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              secret:
+              configMap:
-                secretName:
+                name:
-                  _default: kafka-kafka-contour-tls
+                  _default: kafka-ca-cert
                 items:
-                  - key: ca.crt
+                  - key: kafka.crt
                     path:
                       _default: kafka.crt
 
@@ -215,7 +215,7 @@ spec:
             vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm
             vault.hashicorp.com/agent-inject-template-pm-kafka: |-
               {{- with secret "secrets/data/kafka/apps/pm" -}}
-              KAFKA_SASL_MECHANISM={{ if .Data.data.auth }}{{ index .Data.data.auth "sasl_mechanism" }}{{ else }}{{ index .Data.data "sasl_mechanism" }}{{ end }}
+              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
               KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
               KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
               {{- end -}}

apps/pm/uralkal/kafka-ca-configmap.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-ca-cert
+  namespace: pm
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+    0FC16VuidLG0HUCCawFjRiAg9rIA
+    -----END CERTIFICATE-----

apps/pm/uralkal/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
   - ../base
   - redis.yaml
+  - kafka-ca-configmap.yaml
 patches:
   - path: backend.yaml
     target:

apps/premises/base/backend.yaml

@@ -1,313 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: premises
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.9"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      backend:
-        enabled: true
-
-        serviceAccount:
-          enabled:
-            _default: true
-          name:
-            _default: premises-vault
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/premises-backend:production_216148a9
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: premises-backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          command:
-            _default: ["/bin/sh", "-ec"]
-          args:
-            _default:
-              - |
-                set -a
-                [ -f /vault/secrets/premises-db ] && . /vault/secrets/premises-db
-                [ -f /vault/secrets/premises-kafka ] && . /vault/secrets/premises-kafka
-                [ -f /vault/secrets/premises-s3 ] && . /vault/secrets/premises-s3
-                [ -f /vault/secrets/premises-issues-db ] && . /vault/secrets/premises-issues-db
-                [ -f /vault/secrets/premises-inspections-db ] && . /vault/secrets/premises-inspections-db
-                [ -f /vault/secrets/premises-checklists-db ] && . /vault/secrets/premises-checklists-db
-                [ -f /vault/secrets/premises-eav-db ] && . /vault/secrets/premises-eav-db
-                [ -f /vault/secrets/premises-sarex-db ] && . /vault/secrets/premises-sarex-db
-                [ -f /usr/local/share/ca-certificates/kafka.crt ] && export KAFKA_SSL_CERT="$(cat /usr/local/share/ca-certificates/kafka.crt)"
-                set +a
-                exec ./entrypoint.sh
-
-          resources:
-            requests:
-              cpu:
-                _default: "1"
-              memory:
-                _default: 1Gi
-
-          probes:
-            liveness:
-              enabled:
-                _default: true
-              httpGet:
-                path:
-                  _default: /internal/healthz/live/
-              initialDelaySeconds:
-                _default: 10
-              periodSeconds:
-                _default: 60
-            readiness:
-              enabled:
-                _default: true
-              httpGet:
-                path:
-                  _default: /internal/healthz/ready/
-              initialDelaySeconds:
-                _default: 10
-              periodSeconds:
-                _default: 30
-
-        service:
-          enabled: true
-
-          name:
-            _default: backend-svc
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: regcred
-
-        envs:
-          - name: DEBUG
-            value:
-              _default: "false"
-
-          - name: HTTP_ROOT_PATH
-            value:
-              _default: "/premises"
-
-          - name: JWT_AUTH_ENABLE
-            value:
-              _default: "true"
-
-          - name: GUNICORN_WORKERS
-            value:
-              _default: "3"
-
-          - name: FASTSTREAM_WORKERS
-            value:
-              _default: "3"
-
-          - name: DATABASE_POOL_SIZE
-            value:
-              _default: "5"
-
-          - name: KAFKA_EAV_ASSET_TOPIC_NAME
-            value:
-              _default: "assets_broadcast"
-
-          - name: KAFKA_SSL_CERT
-            value:
-              _default: ""
-
-          - name: S3_BUCKET
-            value:
-              _default: "premises"
-
-          - name: EXPORT_TTL_MINUTES
-            value:
-              _default: "30"
-
-          - name: EXPORT_MAX_WORKERS
-            value:
-              _default: "4"
-
-          - name: EXPORT_S3_KEY_PREFIX
-            value:
-              _default: "premise-export"
-
-          - name: ATTACHMENT_MAX_SIZE_BYTES
-            value:
-              _default: "314572800"
-
-          - name: ATTACHMENT_S3_KEY_PREFIX
-            value:
-              _default: "attachment/"
-
-          - name: OTEL_ENABLE
-            value:
-              _default: "false"
-
-          - name: OTEL_URL
-            value:
-              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
-
-          - name: OTEL_SERVICE_NAME
-            value:
-              _default: "premises-backend"
-
-          - name: OTEL_INSECURE
-            value:
-              _default: "true"
-
-          - name: SRX_SDK_IAM_ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://backend-svc.processing.svc.cluster.local:80"
-
-          - name: WORKFLOWS_GENERATION_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/rendering-template:master"
-
-          - name: WORKFLOWS_DOCX_TO_PDF_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/docx-to-pdf:latest"
-
-          - name: WORKFLOWS_CALLBACK_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/webhook-caller:master"
-
-          - name: WORKFLOWS_CALLBACK_HOST
-            value:
-              _default: "http://backend-svc.premises.svc.cluster.local:80"
-
-          - name: WORKFLOWS_RESULT_PATH
-            value:
-              _default: "premises-prod"
-
-        podAnnotations:
-          _default:
-            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-            vault.hashicorp.com/agent-init-first: "true"
-            vault.hashicorp.com/agent-inject: "true"
-            vault.hashicorp.com/agent-pre-populate-only: "true"
-            vault.hashicorp.com/auth-path: auth/kubernetes
-            vault.hashicorp.com/role: premises
-            vault.hashicorp.com/agent-inject-secret-premises-db: secrets/data/apps/premises/postgres
-            vault.hashicorp.com/agent-inject-template-premises-db: |-
-              {{- with secret "secrets/data/apps/premises/postgres" -}}
-              DATABASE_HOST={{ index .Data.data "host" }}
-              DATABASE_PORT={{ index .Data.data "port" }}
-              DATABASE_NAME={{ index .Data.data "database" }}
-              DATABASE_USERNAME={{ index .Data.data "username" }}
-              DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-kafka: secrets/data/kafka/apps/premises
-            vault.hashicorp.com/agent-inject-template-premises-kafka: |-
-              {{- with secret "secrets/data/kafka/apps/premises" -}}
-              KAFKA_HOST={{ if .Data.data.auth }}{{ index .Data.data.auth "bootstrap_servers" }}{{ else }}{{ index .Data.data "bootstrap_servers" }}{{ end }}
-              KAFKA_USERNAME={{ index .Data.data "username" }}
-              KAFKA_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-s3: secrets/data/minio/apps/premises
-            vault.hashicorp.com/agent-inject-template-premises-s3: |-
-              {{- with secret "secrets/data/minio/apps/premises" -}}
-              S3_HOST={{ index .Data.data.client "endpoint" }}
-              S3_ACCESS_KEY={{ index .Data.data "access_key" }}
-              S3_SECRET_KEY={{ index .Data.data "secret_key" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-issues-db: secrets/data/apps/issues/postgres
-            vault.hashicorp.com/agent-inject-template-premises-issues-db: |-
-              {{- with secret "secrets/data/apps/issues/postgres" -}}
-              ISSUES_DATABASE_HOST={{ index .Data.data "host" }}
-              ISSUES_DATABASE_PORT={{ index .Data.data "port" }}
-              ISSUES_DATABASE_NAME={{ index .Data.data "database" }}
-              ISSUES_DATABASE_USERNAME={{ index .Data.data "username" }}
-              ISSUES_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-inspections-db: secrets/data/apps/inspections/postgres
-            vault.hashicorp.com/agent-inject-template-premises-inspections-db: |-
-              {{- with secret "secrets/data/apps/inspections/postgres" -}}
-              INSPECTIONS_DATABASE_HOST={{ index .Data.data "host" }}
-              INSPECTIONS_DATABASE_PORT={{ index .Data.data "port" }}
-              INSPECTIONS_DATABASE_NAME={{ index .Data.data "database" }}
-              INSPECTIONS_DATABASE_USERNAME={{ index .Data.data "username" }}
-              INSPECTIONS_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-checklists-db: secrets/data/apps/checklists/postgres
-            vault.hashicorp.com/agent-inject-template-premises-checklists-db: |-
-              {{- with secret "secrets/data/apps/checklists/postgres" -}}
-              CHECKLISTS_DATABASE_HOST={{ index .Data.data "host" }}
-              CHECKLISTS_DATABASE_PORT={{ index .Data.data "port" }}
-              CHECKLISTS_DATABASE_NAME={{ index .Data.data "database" }}
-              CHECKLISTS_DATABASE_USERNAME={{ index .Data.data "username" }}
-              CHECKLISTS_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-eav-db: secrets/data/apps/eav/postgres
-            vault.hashicorp.com/agent-inject-template-premises-eav-db: |-
-              {{- with secret "secrets/data/apps/eav/postgres" -}}
-              EAV_DATABASE_HOST={{ index .Data.data "host" }}
-              EAV_DATABASE_PORT={{ index .Data.data "port" }}
-              EAV_DATABASE_NAME={{ index .Data.data "database" }}
-              EAV_DATABASE_USERNAME={{ index .Data.data "username" }}
-              EAV_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-sarex-db: secrets/data/apps/django/postgres
-            vault.hashicorp.com/agent-inject-template-premises-sarex-db: |-
-              {{- with secret "secrets/data/apps/django/postgres" -}}
-              SAREX_DATABASE_HOST={{ index .Data.data "host" }}
-              SAREX_DATABASE_PORT={{ index .Data.data "port" }}
-              SAREX_DATABASE_NAME={{ index .Data.data "database" }}
-              SAREX_DATABASE_USERNAME={{ index .Data.data "username" }}
-              SAREX_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/premises/base/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: premises
-resources:
-  - namespace.yaml
-  - backend.yaml

apps/premises/base/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: premises
-  labels:
-    istio-injection: enabled

apps/premises/vad/backend.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: premises
-spec:
-  values:
-    services:
-      backend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null
-        volumes:
-          _default:
-            - name: kafka-ca-cert
-              mountPath:
-                _default: /usr/local/share/ca-certificates/kafka.crt
-              subPath:
-                _default: kafka.crt
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-ca-cert
-                items:
-                  - key: kafka.crt
-                    path:
-                      _default: kafka.crt

apps/premises/vad/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - kafka-ca-configmap.yaml
-patches:
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: backend

apps/processing/brusnika-stage/engine-low.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:production_f5fe4688
+            _default: cr.yandex/crp3ccidau046kdj8g9q/kubernetes-engine:3546957f1e7e8278fc6363da0287573e9454275a
           pullPolicy:
             _default: IfNotPresent
 
@@ -87,10 +87,6 @@ spec:
           monitoring: prometheus
 
         envs:
-          - name: ENABLE_TOLERATION
-            value:
-              _default: "1"
-
           - name: RABBITMQ_HOST
             value:
               _default: "rabbitmq-service.workflow.svc.cluster.local"
@@ -98,10 +94,6 @@ spec:
           - name: RABBITMQ_PORT
             value:
               _default: "5672/api"
-          
-          - name: ENABLE_TOLERATION
-            value:
-              _default: "1"
 
           - name: POSTGRES_ADDRESS
             value:

apps/processing/wb/engine-low.yaml

@@ -108,7 +108,7 @@ spec:
             - name: ENABLE_KUBERNETES_EXECUTOR
               value: "1"
             - name: MAX_WORKFLOWS_LIMIT
-              value: "10"
+              value: "5"
             - name: CPU_COUNT
               value: "1"
             - name: MEMORY_GI

apps/processing/wb/engine.yaml

@@ -125,7 +125,7 @@ spec:
             - name: ENABLE_KUBERNETES_EXECUTOR
               value: "1"
             - name: MAX_WORKFLOWS_LIMIT
-              value: "10"
+              value: "5"
             - name: CPU_COUNT
               value: "1"
             - name: MEMORY_GI

apps/system-log/d8-ugmk-prod/kustomization.yaml

@@ -8,7 +8,3 @@ patches:
     target:
       kind: Namespace
       name: system-log
-  - path: worker.yaml
-    target:
-      kind: HelmRelease
-      name: worker

apps/system-log/d8-ugmk-prod/worker.yaml

@@ -1,56 +0,0 @@
----
-# Адреса соседних сервисов в УГМК отличаются от base: там Service называются
-# backend-api-svc (documentations) и backend-svc (django), оба на порту 80.
-# Внимание: envs в universal-chart — список, и strategic merge его ЦЕЛИКОМ
-# заменяет, а не дополняет. Поэтому здесь перечислен весь набор переменных
-# worker из base, иначе обязательные APP_NAME/APP_VERSION/LOG_LEVEL потеряются
-# и воркер упадёт на старте.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: worker
-  namespace: system-log
-spec:
-  values:
-    services:
-      backend:
-        envs:
-          - name: APP_NAME
-            value:
-              _default: "system_log"
-
-          - name: APP_VERSION
-            value:
-              _default: "0.0.1"
-
-          - name: LOG_LEVEL
-            value:
-              _default: "INFO"
-
-          - name: HTTP_HOST
-            value:
-              _default: "0.0.0.0"
-
-          - name: HTTP_PORT
-            value:
-              _default: "8000"
-
-          - name: NAMESPACE
-            value:
-              _default: "sarex-system-log"
-
-          - name: DOCUMENTATIONS_URL
-            value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "3"
-
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"

apps/transmittal/brusnika-stage/backend.yaml

@@ -287,11 +287,11 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
             value:
-              _default: "minio.brusnika.lonsdaleites.ru"
+              _default: "minio-service.minio.svc.cluster.local:9000"
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
             value:
-              _default: "true"
+              _default: "false"
 
           - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
             value:

apps/transmittal/brusnika-stage/worker.yaml

@@ -278,7 +278,7 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
             value:
-              _default: "minio-svc.minio.svc.cluster.local:9000"
+              _default: "minio-service.minio.svc.cluster.local:9000"
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
             value:

apps/workspaces/base/frontend.yaml

@@ -29,7 +29,7 @@ spec:
         enabled: true
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_828f1bfc
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_07373a45
           pullPolicy:
             _default: IfNotPresent
         deployment:

clusters/brusnika-stage/kustomization.yaml

@@ -12,7 +12,6 @@ resources:
   - ../../apps/resources/brusnika-stage
   - ../../apps/workspaces/brusnika-stage
   - ../../apps/documentations/brusnika-stage
-  - ../../apps/cde/brusnika-stage
   - ../../apps/flows/brusnika-stage
   - ../../apps/processing/brusnika-stage
   - ../../apps/reviews/brusnika-stage

clusters/vad/kustomization.yaml

@@ -52,4 +52,3 @@ resources:
   - ../../apps/pm/vad
   - ../../apps/message-hub/vad
   - ../../apps/cde/vad
-  - ../../apps/premises/vad

clusters/vk-infra/flux-system/gotk-sync.yaml

@@ -1,27 +0,0 @@
-# This manifest was generated by flux. DO NOT EDIT.
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  ref:
-    branch: master
-  secretRef:
-    name: flux-system
-  url: ssh://git@gitlab.sarex.io/infra/iac.git
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  path: ./clusters/vk-infra
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system

clusters/vk-infra/flux-system/kustomization.yaml

@@ -1,59 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- gotk-components.yaml
-- gotk-sync.yaml
-patches:
-- target:
-    kind: Deployment
-    name: (source-controller|kustomize-controller|helm-controller|notification-controller)
-  patch: |
-    - op: add
-      path: /spec/template/spec/nodeSelector/sarex.io~1pool
-      value: svc
-- target:
-    kind: Deployment
-    name: kustomize-controller
-  patch: |
-    - op: replace
-      path: /spec/replicas
-      value: 3
-    - op: add
-      path: /spec/strategy
-      value:
-        type: RollingUpdate
-        rollingUpdate:
-          maxSurge: 0
-          maxUnavailable: 1
-    - op: add
-      path: /spec/template/spec/affinity
-      value:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - topologyKey: topology.kubernetes.io/zone
-              labelSelector:
-                matchLabels:
-                  app: kustomize-controller
-- target:
-    kind: Deployment
-    name: helm-controller
-  patch: |
-    - op: replace
-      path: /spec/replicas
-      value: 3
-    - op: add
-      path: /spec/strategy
-      value:
-        type: RollingUpdate
-        rollingUpdate:
-          maxSurge: 0
-          maxUnavailable: 1
-    - op: add
-      path: /spec/template/spec/affinity
-      value:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - topologyKey: topology.kubernetes.io/zone
-              labelSelector:
-                matchLabels:
-                  app: helm-controller

clusters/vk-infra/helm-repositories.yaml

@@ -1,11 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: yc-oci-charts
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 10m0s
-  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
-  secretRef:
-    name: yc-cr-auth

clusters/vk-infra/infrastructure/kustomization.yaml

@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../../../infrastructure/istio-base/vk-infra
-  - ../../../infrastructure/istio-pilot/vk-infra
-  - ../../../infrastructure/istio-gateway/vk-infra
-  - ../../../infrastructure/cert-manager/vk-infra
-  - ../../../infrastructure/istio-config/vk-infra
-  - ../../../infrastructure/zitadel/vk-infra
-  - ../../../infrastructure/vault-unseal/vk-infra
-  - ../../../infrastructure/vault/vk-infra
-  - ../../../infrastructure/kb/vk-infra
-  - ../../../infrastructure/gitlab-runner/vk-infra
-  - ../../../infrastructure/nexus/vk-infra

clusters/vk-infra/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./flux-system
-  - ./helm-repositories.yaml
-  - ./infrastructure

clusters/vk-prod/flux-system/gotk-sync.yaml

@@ -1,27 +0,0 @@
-# This manifest was generated by flux. DO NOT EDIT.
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  ref:
-    branch: master
-  secretRef:
-    name: flux-system
-  url: ssh://git@gitlab.sarex.io/infra/iac.git
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  path: ./clusters/vk-prod
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system

clusters/vk-prod/flux-system/kustomization.yaml

@@ -1,52 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- gotk-components.yaml
-- gotk-sync.yaml
-patches:
-- target:
-    kind: Deployment
-    name: kustomize-controller
-  patch: |
-    - op: replace
-      path: /spec/replicas
-      value: 3
-    - op: add
-      path: /spec/strategy
-      value:
-        type: RollingUpdate
-        rollingUpdate:
-          maxSurge: 0
-          maxUnavailable: 1
-    - op: add
-      path: /spec/template/spec/affinity
-      value:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - topologyKey: topology.kubernetes.io/zone
-              labelSelector:
-                matchLabels:
-                  app: kustomize-controller
-- target:
-    kind: Deployment
-    name: helm-controller
-  patch: |
-    - op: replace
-      path: /spec/replicas
-      value: 3
-    - op: add
-      path: /spec/strategy
-      value:
-        type: RollingUpdate
-        rollingUpdate:
-          maxSurge: 0
-          maxUnavailable: 1
-    - op: add
-      path: /spec/template/spec/affinity
-      value:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - topologyKey: topology.kubernetes.io/zone
-              labelSelector:
-                matchLabels:
-                  app: helm-controller

clusters/vk-prod/helm-repositories.yaml

@@ -1,11 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: yc-oci-charts
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 10m0s
-  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
-  secretRef:
-    name: yc-cr-auth

clusters/vk-prod/infrastructure/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../../../infrastructure/istio-base/vk-prod
-  - ../../../infrastructure/istio-pilot/vk-prod
-  - ../../../infrastructure/istio-gateway/vk-prod
-  - ../../../infrastructure/gitlab-runner/vk-prod

clusters/vk-prod/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./flux-system
-  - ./helm-repositories.yaml
-  - ./infrastructure

infrastructure/camunda/uralkal/camunda.yaml

@@ -14,169 +14,139 @@ spec:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
+                value: []
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: StatefulSet
+              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
+                value: []
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
           - target:
               group: batch
               version: v1
               kind: Job
+              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
+                value: []
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-connectors
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
+                value: []
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-identity
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
+                value: []
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-operate
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
+                value: []
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-optimize
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
+                value: []
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-tasklist
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
+                value: []
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-zeebe-gateway
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
+                value: []
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: StatefulSet
+              namespace: camunda
               name: camunda-zeebe
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
+                value: []
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
   values:
     global:
       vault:

infrastructure/cert-manager/vk-infra/cert-manager.yaml

@@ -1,36 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  interval: 5m
-  timeout: 10m
-  values:
-    global:
-      imagePullSecrets:
-        - istio-registry-secret
-    controller:
-      image:
-        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
-        repository: cert-manager
-        pullSecrets:
-          - istio-registry-secret
-      acmesolver:
-        image:
-          registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
-          repository: acmesolver
-          pullSecrets:
-            - istio-registry-secret
-    webhook:
-      image:
-        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
-        repository: cert-manager-webhook
-        pullSecrets:
-          - istio-registry-secret
-    cainjector:
-      image:
-        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
-        repository: cainjector
-        pullSecrets:
-          - istio-registry-secret

infrastructure/cert-manager/vk-infra/kustomization.yaml

@@ -1,34 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: ./cert-manager.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: cert-manager
-      namespace: cert-manager
-  - target:
-      group: cert-manager.io
-      version: v1
-      kind: ClusterIssuer
-      name: letsencrypt-issuer
-    patch: |-
-      $patch: delete
-      apiVersion: cert-manager.io/v1
-      kind: ClusterIssuer
-      metadata:
-        name: letsencrypt-issuer
-  - target:
-      group: cert-manager.io
-      version: v1
-      kind: ClusterIssuer
-      name: letsencrypt-issuer-istio
-    patch: |-
-      $patch: delete
-      apiVersion: cert-manager.io/v1
-      kind: ClusterIssuer
-      metadata:
-        name: letsencrypt-issuer-istio