apps/attachments/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
+            _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:production_6dbb4dce
           pullPolicy:
             _default: IfNotPresent
 

apps/bi/brusnika-stage/backend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_e607dcc6
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_37902c73
           pullPolicy:
             _default: IfNotPresent
 
@@ -119,10 +119,6 @@ spec:
             _default: regcred
 
         envs:
-          - name: SUPERSET_HOST
-            value:
-              _default: "https://superset.test.sarex.brusnika.tech"
-
           - name: SETTINGS_DEBUG
             value:
               _default: "0"

apps/bim/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
           pullPolicy:
             _default: IfNotPresent
 

apps/cde/brusnika-stage/cde-flowscallback.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-flowscallback
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-flowscallback
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-flowscallback
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-flowscallback
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-flowscallback
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-splitpdf.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-splitpdf
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-splitpdf
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-splitpdf
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-splitpdf
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_4.4.1
-        imagePullPolicy: Always
-        name: cde-worker-splitpdf
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-alert.yaml

@@ -1,35 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-alert
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-alert
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 0
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-alert
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-alert
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/orchestrator:latest
-        imagePullPolicy: Always
-        name: cde-worker-alert
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copy.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-copy
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-copy
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-copy
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-copy
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-copy
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copyv2.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-copyv2
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-copyv2
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-copy
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-copy
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/copyv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-copy
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-markings.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-markings
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-markings
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-markings
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-markings
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:preprod_eb50f30e
-        imagePullPolicy: Always
-        name: cde-worker-markings
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-sign.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-sign
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-sign
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-sign
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-sign
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-sign
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-update-bundles.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-update-bundles
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-updatebundles
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-updatebundles
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-updatebundles
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-update-bundles
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde.yaml

@@ -1,55 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/cde:production_e5316bd0
-        imagePullPolicy: Always
-        livenessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 15
-          periodSeconds: 10
-          successThreshold: 1
-          tcpSocket:
-            port: 8080
-          timeoutSeconds: 1
-        name: cde
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-        readinessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 15
-          periodSeconds: 10
-          successThreshold: 1
-          tcpSocket:
-            port: 8080
-          timeoutSeconds: 1
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/createversionsv2-worke.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: createversionsv2-worke
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-createversions
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-createversions
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-createversions
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'true'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/createversionsv2-worker:preprod_90202b78
-        imagePullPolicy: Always
-        name: createversionsv2-worke
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/kustomization.yaml

@@ -1,19 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: orchestrator
+namespace: contracts
 resources:
-  - serviceaccount.yaml
-  - service.yaml
-  - cde.yaml
-  - cde-flowscallback.yaml
-  - cde-splitpdf.yaml
-  - cde-worker-alert.yaml
-  - cde-worker-copy.yaml
-  - cde-worker-markings.yaml
-  - cde-worker-sign.yaml
-  - cde-worker-update-bundles.yaml
-  - cde-worker-copyv2.yaml
-  - createversionsv2-worke.yaml
-  - markingsv2-worker.yaml
-  - signv2-worker.yaml
+  - helmrelease.yaml

apps/cde/brusnika-stage/markingsv2-worker.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: markingsv2-worker
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-markings
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-markings
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-markings
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/markingsv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-markings
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/service.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-  ports:
-  - name: http
-    port: 8080
-    protocol: TCP
-    targetPort: 8080

apps/cde/brusnika-stage/serviceaccount.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-    app.kubernetes.io/version: 0.0.1

apps/cde/brusnika-stage/signv2-worker.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: signv2-worker
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-sign
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-sign
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-sign
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/signv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-sign
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/control-interface/uralkal/psql-tools-debug.yaml

@@ -1,4 +1,6 @@
 ---
+# Отладочный под: ничего не запускает, просто спит. Заходить через
+#   kubectl exec -it -n control-interface deploy/psql-tools-debug -c debug -- sh
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -18,7 +20,7 @@ spec:
     spec:
       containers:
         - name: debug
-          image: cr.yandex/crp3ccidau046kdj8g9q/zitadel-bpmn:cc_contour_5.22.3_ca40c204
+          image: cr.yandex/crp3ccidau046kdj8g9q/documentations-psql-tools:create-disk
           imagePullPolicy: IfNotPresent
           command: ["/bin/sh", "-c"]
           args:

apps/django/base/django-configmap.yaml

@@ -87,7 +87,7 @@ data:
         'Bearer',
     )
 
-    HOST = os.environ.get("DJANGO_HOST", "https://sarex.contour.infra.sarex.tech")
+    HOST = "https://sarex.contour.infra.sarex.tech"
 
     POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
     POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')

apps/django/brusnika-stage/nginx-configmap.yaml

@@ -101,8 +101,7 @@ data:
 
             location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
                 alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
-                types { }
-                default_type application/wasm;
+                add_header Content-Type application/wasm always;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -111,8 +110,7 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
-                types { }
-                default_type application/javascript;
+                add_header Content-Type application/javascript always;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -121,8 +119,7 @@ data:
 
             location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
                 alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
-                types { }
-                default_type application/javascript;
+                add_header Content-Type application/javascript always;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -131,8 +128,7 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf.js;
-                types { }
-                default_type application/javascript;
+                add_header Content-Type application/javascript always;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -140,8 +136,7 @@ data:
             }
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                types { }
-                default_type application/wasm;
+                add_header Content-Type application/wasm always;
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
             }
 
@@ -149,8 +144,7 @@ data:
             rewrite /workspaces-v2/(.+) /$1 break;
             proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
 
-            proxy_hide_header Content-Type;
-            add_header Content-Type application/wasm always;
+            add_header Content-Type application/wasm;
             proxy_set_header Accept application/wasm;
         }
 

apps/django/d8-ugmk-prod/backend.yaml

@@ -18,9 +18,6 @@ spec:
           - name: SERVER_ZITADEL_ENABLED
             value:
               _default: "True"
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.uralmine.com"
           - name: DJANGO_SETTINGS_MODULE
             value:
               _default: config.settings.production

apps/django/uralkal/backend.yaml

@@ -14,10 +14,6 @@ spec:
               cpu: null
               memory: null
         envs:
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.local.uralkali.com"
-
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/django/uralkal/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            location ~^/api/pm/ {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                proxy_set_header Host $host;
-                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            }
+            # location ~^/api/pm/ {
+            #     proxy_http_version 1.1;
+            #     proxy_set_header Connection "";
+            #     proxy_set_header Host $host;
+            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            # }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;

apps/django/vad/backend.yaml

@@ -9,10 +9,6 @@ spec:
     services:
       backend:
         envs:
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.vadroad.ru"
-
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/documentations/base/pdm.yaml

@@ -210,7 +210,7 @@ spec:
               _default: http://backend-svc.subscriptions.svc.cluster.local:80
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
+              _default: http://api-service.system-log.svc.cluster.local:80
           - name: TARGET_URL
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/brusnika-stage/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
           pullPolicy:
             _default: IfNotPresent
 
@@ -100,10 +100,6 @@ spec:
         labels:
           monitoring: prometheus
         envs:
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
-
           - name: POSTGRES_ADDRESS
             value:
               _default: "192.168.2.45"

apps/documentations/brusnika-stage/hasher.yaml

@@ -1,95 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hasher
-  namespace: documentations
-  labels:
-    app: hasher
-    service: normal
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hasher
-  template:
-    metadata:
-      labels:
-        app: hasher
-        service: normal
-    spec:
-      containers:
-      - env:
-        - name: HASHER_APP__LOG_LEVEL
-          value: INFO
-        - name: HASHER_APP__NUM_WORKERS
-          value: '4'
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
-          value: hash.compute.normal.tasks
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
-          value: hash.compute
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
-          value: direct
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
-          value: hash.compute.normal
-        - name: HASHER_S3__MAX_POOL_CONNECTIONS
-          value: '10'
-        - name: HASHER_S3__CONNECT_TIMEOUT
-          value: '10'
-        - name: HASHER_S3__READ_TIMEOUT
-          value: '30'
-        - name: HASHER_S3__REGION_NAME
-          value: ru-central1
-        - name: HASHER_S3__USE_SSL
-          value: 'true'
-        - name: HASHER_S3__VERIFY
-          value: 'true'
-        - name: HASHER_AMQP__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__PORT
-          valueFrom:
-            secretKeyRef:
-              key: port
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__VHOST
-          valueFrom:
-            secretKeyRef:
-              key: vhost
-              name: hasher-rabbitmq-secret
-        - name: HASHER_S3__ENDPOINT
-          valueFrom:
-            secretKeyRef:
-              key: endpoint
-              name: hasher-s3-secret
-        - name: HASHER_S3__ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              key: access_key
-              name: hasher-s3-secret
-        - name: HASHER_S3__SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              key: secret_key
-              name: hasher-s3-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
-        imagePullPolicy: IfNotPresent
-        name: normal
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-      imagePullSecrets:
-      - name: regcred

apps/documentations/brusnika-stage/kustomization.yaml

@@ -7,5 +7,3 @@ resources:
   - pdm.yaml
   - api.yaml
   - filestream.yaml
-  - hasher.yaml
-  - pdf-markings-amqp.yaml

apps/documentations/brusnika-stage/pdf-markings-amqp.yaml

@@ -1,125 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pdf-markings-amqp
-  namespace: documentations
-  labels:
-    app: pdf-markings-amqp
-    service: api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pdf-markings-amqp
-  strategy:
-    rollingUpdate:
-      maxSurge: 3
-      maxUnavailable: 3
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: pdf-markings-amqp
-        service: api
-    spec:
-      containers:
-      - env:
-        - name: MARKS_APP__LOG_LEVEL
-          value: INFO
-        - name: MARKS_CRYPTO__HASHING_ALGO
-          value: md_gost12_256
-        - name: MARKS_DOCUMENTS_DB__HOST
-          value: 192.168.2.45
-        - name: MARKS_DOCUMENTS_DB__PORT
-          value: '5432'
-        - name: MARKS_DOCUMENTS_DB__DATABASE
-          value: documentations
-        - name: MARKS_DOCUMENTS_DB__SSLMODE
-          value: disable
-        - name: MARKS_QR__REDIRECT_URL
-          value: https://stamp-verification.test.sarex.brusnika.tech/
-        - name: MARKS_QR__BASE_DOCUMENT_URL
-          value: https://test.sarex.brusnika.tech
-        - name: MARKS_S3__USE_SSL
-          value: 'false'
-        - name: MARKS_S3__SSL_VERIFY
-          value: 'false'
-        - name: MARKS_S3__REGION
-          value: ru-central1
-        - name: MARKS_S3__DEFAULT_BUCKET
-          value: documentations-stage-1-sarex-new
-        - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
-          value: pdf_markings_input
-        - name: MARKS_DOCUMENTS_DB__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: postgres-secret
-        - name: MARKS_DOCUMENTS_DB__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: postgres-secret
-        - name: MARKS_S3__URL
-          valueFrom:
-            secretKeyRef:
-              key: endpoint_url
-              name: yc-s3
-        - name: MARKS_S3__ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              key: key_id
-              name: yc-s3
-        - name: MARKS_S3__SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              key: access_key
-              name: yc-s3
-        - name: MARKS_RABBITMQ__HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__PORT
-          valueFrom:
-            secretKeyRef:
-              key: port
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__VHOST
-          valueFrom:
-            secretKeyRef:
-              key: vhost
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
-          valueFrom:
-            secretKeyRef:
-              key: heartbeat
-              name: rabbitmq
-        image: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
-        imagePullPolicy: IfNotPresent
-        name: api
-        ports:
-        - containerPort: 8000
-          name: http
-          protocol: TCP
-        volumeMounts:
-        - mountPath: /etc/sarex/yc-s3-storage
-          name: yc-s3
-          readOnly: true
-      volumes:
-      - name: yc-s3
-        secret:
-          secretName: yc-s3
-      imagePullSecrets:
-      - name: regcred

apps/documentations/brusnika-stage/pdm.yaml

@@ -124,11 +124,11 @@ spec:
 
           - name: TRANSMITTALS_BASE_URL
             value:
-              _default: "http://transmittal-service.transmittal.svc.cluster.local:80"
+              _default: ""
 
           - name: TRANSMITTALS_ENABLE
             value:
-              _default: "true"
+              _default: "false"
 
           - name: DRAWINGS_INTERNAL_URL
             value:

apps/documentations/d8-ugmk-prod/filestream.yaml

@@ -83,7 +83,7 @@ spec:
               _default: v1
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
+              _default: http://api-service.system-log.svc.cluster.local:80
           - name: DJANGO_HOST
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/wb/api.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
           pullPolicy:
             _default: IfNotPresent
 
@@ -307,23 +307,6 @@ spec:
             value:
               _default: "6379"
 
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
-
-          - name: USE_MARKS_RABBITMQ
-            value:
-              _default: '1'
-          - name: MARKS_RABBITMQ_HOST
-            value: 
-              _default: rabbitmq.rabbitmq.svc.cluster.local
-          - name: MARKS_RABBITMQ_PORT
-            value: 
-              _default: '5672'
-          - name: MARKS_RABBITMQ_API
-            value: 
-              _default: cde
-
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:
@@ -355,16 +338,6 @@ spec:
               _default: "django-auth"
             secretKey: "key"
 
-          - name: MARKS_RABBITMQ_USER
-            secretName:
-              _default: "hasher-rabbitmq-secret"
-            secretKey: "user"
-
-          - name: MARKS_RABBITMQ_PASSWORD
-            secretName:
-              _default: "hasher-rabbitmq-secret"
-            secretKey: "password"
-
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/flows/brusnika-stage/celery.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 
@@ -252,26 +252,6 @@ spec:
               _default: "https://test.sarex.brusnika.tech"
 
         secretEnvs:
-          - name: FLOWS_DB_DB
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: FLOWS_DB_USERNAME
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: FLOWS_DB_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: DJANGO_AUTH
-            secretName:
-              _default: "django-secret"
-            secretKey: "token"
-
           - name: ADMIN_PANEL_SECRET_KEY
             secretName:
               _default: "admin-secret"

apps/flows/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/d8-ugmk-prod/backend.yaml

@@ -1,4 +1,11 @@
 ---
+# Патч backend для контура УГМК — подключение к Kafka.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
+# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -22,19 +29,6 @@ spec:
                 set +a
                 exec /opt/entrypoint.sh
 
-        volumes:
-          _default:
-            - name: authentication
-              mountPath:
-                _default: /opt/src/flow/admin/authentication.py
-              subPath:
-                _default: authentication.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: authentication
-
         envs:
           - name: LOG_LEVEL
             value:
@@ -104,10 +98,6 @@ spec:
             value:
               _default: "https://sarex.uralmine.com/flows/api/v1"
 
-          - name: PROXY_PATH_PREFIX
-            value:
-              _default: /flows
-
           - name: SMTP_HOST
             value:
               _default: "post.uralmine.com"

apps/flows/wb/backend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/wb/celery.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/wb/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
           pullPolicy:
             _default: IfNotPresent
 

apps/inspections/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
           pullPolicy:
             _default: IfNotPresent
 

apps/inspections/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/brusnika-stage/backend.yaml

@@ -176,6 +176,9 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
 
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID

apps/notes/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:0.3.7
           pullPolicy:
             _default: IfNotPresent
 
@@ -87,14 +87,6 @@ spec:
           monitoring: prometheus
 
         envs:
-          - name: SYNC_RESOURCE_ID
-            value:
-              _default: "0"
-
-          - name: ENABLE_ND
-            value:
-              _default: "0"
-
           - name: DJANGO_HOST
             value:
               _default: "http://backend.django.svc.cluster.local:8000"

apps/notes/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:prod_55791cf6_relative
           pullPolicy:
             _default: IfNotPresent
 

apps/pm/brusnika-stage/frontend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_abfaba7c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_7f125269
           pullPolicy:
             _default: IfNotPresent
 

apps/premises/base/backend.yaml

@@ -1,313 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: premises
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.9"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      backend:
-        enabled: true
-
-        serviceAccount:
-          enabled:
-            _default: true
-          name:
-            _default: premises-vault
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/premises-backend:production_216148a9
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: premises-backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          command:
-            _default: ["/bin/sh", "-ec"]
-          args:
-            _default:
-              - |
-                set -a
-                [ -f /vault/secrets/premises-db ] && . /vault/secrets/premises-db
-                [ -f /vault/secrets/premises-kafka ] && . /vault/secrets/premises-kafka
-                [ -f /vault/secrets/premises-s3 ] && . /vault/secrets/premises-s3
-                [ -f /vault/secrets/premises-issues-db ] && . /vault/secrets/premises-issues-db
-                [ -f /vault/secrets/premises-inspections-db ] && . /vault/secrets/premises-inspections-db
-                [ -f /vault/secrets/premises-checklists-db ] && . /vault/secrets/premises-checklists-db
-                [ -f /vault/secrets/premises-eav-db ] && . /vault/secrets/premises-eav-db
-                [ -f /vault/secrets/premises-sarex-db ] && . /vault/secrets/premises-sarex-db
-                [ -f /usr/local/share/ca-certificates/kafka.crt ] && export KAFKA_SSL_CERT="$(cat /usr/local/share/ca-certificates/kafka.crt)"
-                set +a
-                exec ./entrypoint.sh
-
-          resources:
-            requests:
-              cpu:
-                _default: "1"
-              memory:
-                _default: 1Gi
-
-          probes:
-            liveness:
-              enabled:
-                _default: true
-              httpGet:
-                path:
-                  _default: /internal/healthz/live/
-              initialDelaySeconds:
-                _default: 10
-              periodSeconds:
-                _default: 60
-            readiness:
-              enabled:
-                _default: true
-              httpGet:
-                path:
-                  _default: /internal/healthz/ready/
-              initialDelaySeconds:
-                _default: 10
-              periodSeconds:
-                _default: 30
-
-        service:
-          enabled: true
-
-          name:
-            _default: backend-svc
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: regcred
-
-        envs:
-          - name: DEBUG
-            value:
-              _default: "false"
-
-          - name: HTTP_ROOT_PATH
-            value:
-              _default: "/premises"
-
-          - name: JWT_AUTH_ENABLE
-            value:
-              _default: "true"
-
-          - name: GUNICORN_WORKERS
-            value:
-              _default: "3"
-
-          - name: FASTSTREAM_WORKERS
-            value:
-              _default: "3"
-
-          - name: DATABASE_POOL_SIZE
-            value:
-              _default: "5"
-
-          - name: KAFKA_EAV_ASSET_TOPIC_NAME
-            value:
-              _default: "assets_broadcast"
-
-          - name: KAFKA_SSL_CERT
-            value:
-              _default: ""
-
-          - name: S3_BUCKET
-            value:
-              _default: "premises"
-
-          - name: EXPORT_TTL_MINUTES
-            value:
-              _default: "30"
-
-          - name: EXPORT_MAX_WORKERS
-            value:
-              _default: "4"
-
-          - name: EXPORT_S3_KEY_PREFIX
-            value:
-              _default: "premise-export"
-
-          - name: ATTACHMENT_MAX_SIZE_BYTES
-            value:
-              _default: "314572800"
-
-          - name: ATTACHMENT_S3_KEY_PREFIX
-            value:
-              _default: "attachment/"
-
-          - name: OTEL_ENABLE
-            value:
-              _default: "false"
-
-          - name: OTEL_URL
-            value:
-              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
-
-          - name: OTEL_SERVICE_NAME
-            value:
-              _default: "premises-backend"
-
-          - name: OTEL_INSECURE
-            value:
-              _default: "true"
-
-          - name: SRX_SDK_IAM_ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://backend-svc.processing.svc.cluster.local:80"
-
-          - name: WORKFLOWS_GENERATION_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/rendering-template:master"
-
-          - name: WORKFLOWS_DOCX_TO_PDF_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/docx-to-pdf:latest"
-
-          - name: WORKFLOWS_CALLBACK_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/webhook-caller:master"
-
-          - name: WORKFLOWS_CALLBACK_HOST
-            value:
-              _default: "http://backend-svc.premises.svc.cluster.local:80"
-
-          - name: WORKFLOWS_RESULT_PATH
-            value:
-              _default: "premises-prod"
-
-        podAnnotations:
-          _default:
-            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-            vault.hashicorp.com/agent-init-first: "true"
-            vault.hashicorp.com/agent-inject: "true"
-            vault.hashicorp.com/agent-pre-populate-only: "true"
-            vault.hashicorp.com/auth-path: auth/kubernetes
-            vault.hashicorp.com/role: premises
-            vault.hashicorp.com/agent-inject-secret-premises-db: secrets/data/apps/premises/postgres
-            vault.hashicorp.com/agent-inject-template-premises-db: |-
-              {{- with secret "secrets/data/apps/premises/postgres" -}}
-              DATABASE_HOST={{ index .Data.data "host" }}
-              DATABASE_PORT={{ index .Data.data "port" }}
-              DATABASE_NAME={{ index .Data.data "database" }}
-              DATABASE_USERNAME={{ index .Data.data "username" }}
-              DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-kafka: secrets/data/kafka/apps/premises
-            vault.hashicorp.com/agent-inject-template-premises-kafka: |-
-              {{- with secret "secrets/data/kafka/apps/premises" -}}
-              KAFKA_HOST={{ if .Data.data.auth }}{{ index .Data.data.auth "bootstrap_servers" }}{{ else }}{{ index .Data.data "bootstrap_servers" }}{{ end }}
-              KAFKA_USERNAME={{ index .Data.data "username" }}
-              KAFKA_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-s3: secrets/data/minio/apps/premises
-            vault.hashicorp.com/agent-inject-template-premises-s3: |-
-              {{- with secret "secrets/data/minio/apps/premises" -}}
-              S3_HOST={{ index .Data.data.client "endpoint" }}
-              S3_ACCESS_KEY={{ index .Data.data "access_key" }}
-              S3_SECRET_KEY={{ index .Data.data "secret_key" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-issues-db: secrets/data/apps/issues/postgres
-            vault.hashicorp.com/agent-inject-template-premises-issues-db: |-
-              {{- with secret "secrets/data/apps/issues/postgres" -}}
-              ISSUES_DATABASE_HOST={{ index .Data.data "host" }}
-              ISSUES_DATABASE_PORT={{ index .Data.data "port" }}
-              ISSUES_DATABASE_NAME={{ index .Data.data "database" }}
-              ISSUES_DATABASE_USERNAME={{ index .Data.data "username" }}
-              ISSUES_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-inspections-db: secrets/data/apps/inspections/postgres
-            vault.hashicorp.com/agent-inject-template-premises-inspections-db: |-
-              {{- with secret "secrets/data/apps/inspections/postgres" -}}
-              INSPECTIONS_DATABASE_HOST={{ index .Data.data "host" }}
-              INSPECTIONS_DATABASE_PORT={{ index .Data.data "port" }}
-              INSPECTIONS_DATABASE_NAME={{ index .Data.data "database" }}
-              INSPECTIONS_DATABASE_USERNAME={{ index .Data.data "username" }}
-              INSPECTIONS_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-checklists-db: secrets/data/apps/checklists/postgres
-            vault.hashicorp.com/agent-inject-template-premises-checklists-db: |-
-              {{- with secret "secrets/data/apps/checklists/postgres" -}}
-              CHECKLISTS_DATABASE_HOST={{ index .Data.data "host" }}
-              CHECKLISTS_DATABASE_PORT={{ index .Data.data "port" }}
-              CHECKLISTS_DATABASE_NAME={{ index .Data.data "database" }}
-              CHECKLISTS_DATABASE_USERNAME={{ index .Data.data "username" }}
-              CHECKLISTS_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-eav-db: secrets/data/apps/eav/postgres
-            vault.hashicorp.com/agent-inject-template-premises-eav-db: |-
-              {{- with secret "secrets/data/apps/eav/postgres" -}}
-              EAV_DATABASE_HOST={{ index .Data.data "host" }}
-              EAV_DATABASE_PORT={{ index .Data.data "port" }}
-              EAV_DATABASE_NAME={{ index .Data.data "database" }}
-              EAV_DATABASE_USERNAME={{ index .Data.data "username" }}
-              EAV_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-sarex-db: secrets/data/apps/django/postgres
-            vault.hashicorp.com/agent-inject-template-premises-sarex-db: |-
-              {{- with secret "secrets/data/apps/django/postgres" -}}
-              SAREX_DATABASE_HOST={{ index .Data.data "host" }}
-              SAREX_DATABASE_PORT={{ index .Data.data "port" }}
-              SAREX_DATABASE_NAME={{ index .Data.data "database" }}
-              SAREX_DATABASE_USERNAME={{ index .Data.data "username" }}
-              SAREX_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/premises/base/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: premises
-resources:
-  - namespace.yaml
-  - backend.yaml

apps/premises/base/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: premises
-  labels:
-    istio-injection: enabled

apps/premises/vad/backend.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: premises
-spec:
-  values:
-    services:
-      backend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null
-        volumes:
-          _default:
-            - name: kafka-ca-cert
-              mountPath:
-                _default: /usr/local/share/ca-certificates/kafka.crt
-              subPath:
-                _default: kafka.crt
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-ca-cert
-                items:
-                  - key: kafka.crt
-                    path:
-                      _default: kafka.crt

apps/premises/vad/kafka-ca-configmap.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-ca-cert
-  namespace: premises
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-    0FC16VuidLG0HUCCawFjRiAg9rIA
-    -----END CERTIFICATE-----

apps/premises/vad/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - kafka-ca-configmap.yaml
-patches:
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: backend

apps/processing/brusnika-stage/engine-low.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:production_f5fe4688
+            _default: cr.yandex/crp3ccidau046kdj8g9q/kubernetes-engine:3546957f1e7e8278fc6363da0287573e9454275a
           pullPolicy:
             _default: IfNotPresent
 
@@ -87,10 +87,6 @@ spec:
           monitoring: prometheus
 
         envs:
-          - name: ENABLE_TOLERATION
-            value:
-              _default: "1"
-
           - name: RABBITMQ_HOST
             value:
               _default: "rabbitmq-service.workflow.svc.cluster.local"
@@ -99,10 +95,6 @@ spec:
             value:
               _default: "5672/api"
 
-          - name: ENABLE_TOLERATION
-            value:
-              _default: "1"
-
           - name: POSTGRES_ADDRESS
             value:
               _default: "192.168.2.45"

apps/processing/wb/engine-low.yaml

@@ -108,7 +108,7 @@ spec:
             - name: ENABLE_KUBERNETES_EXECUTOR
               value: "1"
             - name: MAX_WORKFLOWS_LIMIT
-              value: "10"
+              value: "5"
             - name: CPU_COUNT
               value: "1"
             - name: MEMORY_GI

apps/processing/wb/engine.yaml

@@ -125,7 +125,7 @@ spec:
             - name: ENABLE_KUBERNETES_EXECUTOR
               value: "1"
             - name: MAX_WORKFLOWS_LIMIT
-              value: "10"
+              value: "5"
             - name: CPU_COUNT
               value: "1"
             - name: MEMORY_GI

apps/system-log/d8-ugmk-prod/kustomization.yaml

@@ -8,7 +8,3 @@ patches:
     target:
       kind: Namespace
       name: system-log
-  - path: worker.yaml
-    target:
-      kind: HelmRelease
-      name: worker

apps/system-log/d8-ugmk-prod/worker.yaml

@@ -1,56 +0,0 @@
----
-# Адреса соседних сервисов в УГМК отличаются от base: там Service называются
-# backend-api-svc (documentations) и backend-svc (django), оба на порту 80.
-# Внимание: envs в universal-chart — список, и strategic merge его ЦЕЛИКОМ
-# заменяет, а не дополняет. Поэтому здесь перечислен весь набор переменных
-# worker из base, иначе обязательные APP_NAME/APP_VERSION/LOG_LEVEL потеряются
-# и воркер упадёт на старте.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: worker
-  namespace: system-log
-spec:
-  values:
-    services:
-      backend:
-        envs:
-          - name: APP_NAME
-            value:
-              _default: "system_log"
-
-          - name: APP_VERSION
-            value:
-              _default: "0.0.1"
-
-          - name: LOG_LEVEL
-            value:
-              _default: "INFO"
-
-          - name: HTTP_HOST
-            value:
-              _default: "0.0.0.0"
-
-          - name: HTTP_PORT
-            value:
-              _default: "8000"
-
-          - name: NAMESPACE
-            value:
-              _default: "sarex-system-log"
-
-          - name: DOCUMENTATIONS_URL
-            value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "3"
-
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"

apps/transmittal/brusnika-stage/backend.yaml

@@ -287,11 +287,11 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
             value:
-              _default: "minio.brusnika.lonsdaleites.ru"
+              _default: "minio-service.minio.svc.cluster.local:9000"
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
             value:
-              _default: "true"
+              _default: "false"
 
           - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
             value:

apps/transmittal/brusnika-stage/worker.yaml

@@ -278,7 +278,7 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
             value:
-              _default: "minio-svc.minio.svc.cluster.local:9000"
+              _default: "minio-service.minio.svc.cluster.local:9000"
 
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
             value:

apps/workspaces/base/frontend.yaml

@@ -29,7 +29,7 @@ spec:
         enabled: true
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_828f1bfc
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_07373a45
           pullPolicy:
             _default: IfNotPresent
         deployment:

clusters/brusnika-stage/kustomization.yaml

@@ -12,7 +12,6 @@ resources:
   - ../../apps/resources/brusnika-stage
   - ../../apps/workspaces/brusnika-stage
   - ../../apps/documentations/brusnika-stage
-  - ../../apps/cde/brusnika-stage
   - ../../apps/flows/brusnika-stage
   - ../../apps/processing/brusnika-stage
   - ../../apps/reviews/brusnika-stage

clusters/vad/kustomization.yaml

@@ -52,4 +52,3 @@ resources:
   - ../../apps/pm/vad
   - ../../apps/message-hub/vad
   - ../../apps/cde/vad
-  - ../../apps/premises/vad

clusters/vk-infra/flux-system/gotk-sync.yaml

@@ -1,27 +0,0 @@
-# This manifest was generated by flux. DO NOT EDIT.
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  ref:
-    branch: master
-  secretRef:
-    name: flux-system
-  url: ssh://git@gitlab.sarex.io/infra/iac.git
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  path: ./clusters/vk-infra
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system

clusters/vk-infra/flux-system/kustomization.yaml

@@ -1,59 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- gotk-components.yaml
-- gotk-sync.yaml
-patches:
-- target:
-    kind: Deployment
-    name: (source-controller|kustomize-controller|helm-controller|notification-controller)
-  patch: |
-    - op: add
-      path: /spec/template/spec/nodeSelector/sarex.io~1pool
-      value: svc
-- target:
-    kind: Deployment
-    name: kustomize-controller
-  patch: |
-    - op: replace
-      path: /spec/replicas
-      value: 3
-    - op: add
-      path: /spec/strategy
-      value:
-        type: RollingUpdate
-        rollingUpdate:
-          maxSurge: 0
-          maxUnavailable: 1
-    - op: add
-      path: /spec/template/spec/affinity
-      value:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - topologyKey: topology.kubernetes.io/zone
-              labelSelector:
-                matchLabels:
-                  app: kustomize-controller
-- target:
-    kind: Deployment
-    name: helm-controller
-  patch: |
-    - op: replace
-      path: /spec/replicas
-      value: 3
-    - op: add
-      path: /spec/strategy
-      value:
-        type: RollingUpdate
-        rollingUpdate:
-          maxSurge: 0
-          maxUnavailable: 1
-    - op: add
-      path: /spec/template/spec/affinity
-      value:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - topologyKey: topology.kubernetes.io/zone
-              labelSelector:
-                matchLabels:
-                  app: helm-controller

clusters/vk-infra/helm-repositories.yaml

@@ -1,11 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: yc-oci-charts
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 10m0s
-  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
-  secretRef:
-    name: yc-cr-auth

clusters/vk-infra/infrastructure/kustomization.yaml

@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../../../infrastructure/istio-base/vk-infra
-  - ../../../infrastructure/istio-pilot/vk-infra
-  - ../../../infrastructure/istio-gateway/vk-infra
-  - ../../../infrastructure/cert-manager/vk-infra
-  - ../../../infrastructure/istio-config/vk-infra
-  - ../../../infrastructure/zitadel/vk-infra
-  - ../../../infrastructure/vault-unseal/vk-infra
-  - ../../../infrastructure/vault/vk-infra
-  - ../../../infrastructure/kb/vk-infra
-  - ../../../infrastructure/gitlab-runner/vk-infra
-  - ../../../infrastructure/nexus/vk-infra

clusters/vk-infra/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./flux-system
-  - ./helm-repositories.yaml
-  - ./infrastructure

clusters/vk-prod/flux-system/gotk-sync.yaml

@@ -1,27 +0,0 @@
-# This manifest was generated by flux. DO NOT EDIT.
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  ref:
-    branch: master
-  secretRef:
-    name: flux-system
-  url: ssh://git@gitlab.sarex.io/infra/iac.git
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  path: ./clusters/vk-prod
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system

clusters/vk-prod/flux-system/kustomization.yaml

@@ -1,52 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- gotk-components.yaml
-- gotk-sync.yaml
-patches:
-- target:
-    kind: Deployment
-    name: kustomize-controller
-  patch: |
-    - op: replace
-      path: /spec/replicas
-      value: 3
-    - op: add
-      path: /spec/strategy
-      value:
-        type: RollingUpdate
-        rollingUpdate:
-          maxSurge: 0
-          maxUnavailable: 1
-    - op: add
-      path: /spec/template/spec/affinity
-      value:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - topologyKey: topology.kubernetes.io/zone
-              labelSelector:
-                matchLabels:
-                  app: kustomize-controller
-- target:
-    kind: Deployment
-    name: helm-controller
-  patch: |
-    - op: replace
-      path: /spec/replicas
-      value: 3
-    - op: add
-      path: /spec/strategy
-      value:
-        type: RollingUpdate
-        rollingUpdate:
-          maxSurge: 0
-          maxUnavailable: 1
-    - op: add
-      path: /spec/template/spec/affinity
-      value:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - topologyKey: topology.kubernetes.io/zone
-              labelSelector:
-                matchLabels:
-                  app: helm-controller

clusters/vk-prod/helm-repositories.yaml

@@ -1,11 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: yc-oci-charts
-  namespace: flux-system
-spec:
-  type: oci
-  interval: 10m0s
-  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
-  secretRef:
-    name: yc-cr-auth

clusters/vk-prod/infrastructure/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../../../infrastructure/istio-base/vk-prod
-  - ../../../infrastructure/istio-pilot/vk-prod
-  - ../../../infrastructure/istio-gateway/vk-prod
-  - ../../../infrastructure/gitlab-runner/vk-prod

clusters/vk-prod/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./flux-system
-  - ./helm-repositories.yaml
-  - ./infrastructure

infrastructure/camunda/uralkal/camunda.yaml

@@ -14,169 +14,139 @@ spec:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
+                value: []
           - target:
               group: apps
               version: v1
               kind: StatefulSet
+              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
+                value: []
           - target:
               group: batch
               version: v1
               kind: Job
+              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
+                value: []
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-connectors
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
+                value: []
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-identity
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
+                value: []
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-operate
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
+                value: []
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-optimize
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
+                value: []
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-tasklist
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
+                value: []
           - target:
               group: apps
               version: v1
               kind: Deployment
+              namespace: camunda
               name: camunda-zeebe-gateway
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
+                value: []
           - target:
               group: apps
               version: v1
               kind: StatefulSet
+              namespace: camunda
               name: camunda-zeebe
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: processing
+                  dedicated: generic
               - op: add
                 path: /spec/template/spec/tolerations
-                value:
-                  - key: dedicated
-                    operator: Equal
-                    value: processing
-                    effect: NoSchedule
+                value: []
   values:
     global:
       vault:

infrastructure/cert-manager/vk-infra/cert-manager.yaml

@@ -1,36 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  interval: 5m
-  timeout: 10m
-  values:
-    global:
-      imagePullSecrets:
-        - istio-registry-secret
-    controller:
-      image:
-        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
-        repository: cert-manager
-        pullSecrets:
-          - istio-registry-secret
-      acmesolver:
-        image:
-          registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
-          repository: acmesolver
-          pullSecrets:
-            - istio-registry-secret
-    webhook:
-      image:
-        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
-        repository: cert-manager-webhook
-        pullSecrets:
-          - istio-registry-secret
-    cainjector:
-      image:
-        registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
-        repository: cainjector
-        pullSecrets:
-          - istio-registry-secret

infrastructure/cert-manager/vk-infra/kustomization.yaml

@@ -1,34 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: ./cert-manager.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: cert-manager
-      namespace: cert-manager
-  - target:
-      group: cert-manager.io
-      version: v1
-      kind: ClusterIssuer
-      name: letsencrypt-issuer
-    patch: |-
-      $patch: delete
-      apiVersion: cert-manager.io/v1
-      kind: ClusterIssuer
-      metadata:
-        name: letsencrypt-issuer
-  - target:
-      group: cert-manager.io
-      version: v1
-      kind: ClusterIssuer
-      name: letsencrypt-issuer-istio
-    patch: |-
-      $patch: delete
-      apiVersion: cert-manager.io/v1
-      kind: ClusterIssuer
-      metadata:
-        name: letsencrypt-issuer-istio

infrastructure/gitlab-runner/vk-infra/gitlab-runner.yaml

@@ -1,79 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitlab-runner
-  namespace: gitlab-managed-apps
-spec:
-  interval: 10m
-  timeout: 10m
-  chart:
-    spec:
-      chart: gitlab-runner-infra
-      version: "17.5.4"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  values:
-    gitlabUrl: https://gitlab.sarex.io
-    concurrent: 20
-    checkInterval: 10
-    unregisterRunners: true
-    terminationGracePeriodSeconds: 3600
-    image:
-      registry: cr.yandex/crp3ccidau046kdj8g9q
-      image: mirror/gitlab-runner
-    imagePullSecrets:
-      - name: istio-registry-secret
-    nodeSelector:
-      sarex.io/pool: svc
-    rbac:
-      create: true
-      clusterWideAccess: false
-    serviceAccount:
-      create: true
-    podSecurityContext:
-      fsGroup: 65533
-      runAsUser: 100
-    metrics:
-      enabled: false
-    runners:
-      secret: gitlab-runner-secret
-      executor: kubernetes
-      cache: {}
-      config: |
-        [[runners]]
-          [runners.kubernetes]
-            namespace = "{{.Release.Namespace}}"
-            image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/docker:24.0.5"
-            helper_image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/gitlab-runner-helper:x86_64-v17.5.3"
-            image_pull_secrets = ["istio-registry-secret"]
-            poll_interval = 10
-            poll_timeout = 600
-            privileged = true
-            tls_verify = false
-            cpu_request = "0.1"
-            cpu_limit = "3"
-            memory_request = "128Mi"
-            memory_limit = "3Gi"
-            helper_cpu_request = "0.05"
-            helper_cpu_limit = "3"
-            helper_memory_request = "32Mi"
-            helper_memory_limit = "10Gi"
-            service_cpu_request = "0.5"
-            service_cpu_limit = "3"
-            service_memory_request = "3Gi"
-
-            [runners.feature_flags]
-              FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY = false
-            [runners.kubernetes.node_selector]
-              "sarex.io/pool" = "runners"
-            [runners.kubernetes.node_tolerations]
-              "sarex.io/pool=runners" = "NoSchedule"

infrastructure/gitlab-runner/vk-infra/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - gitlab-runner.yaml
-  - rbac.yaml

infrastructure/gitlab-runner/vk-infra/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitlab-managed-apps

infrastructure/gitlab-runner/vk-infra/rbac.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: gitlab-runner-jobs-cluster-admin
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-  - kind: ServiceAccount
-    name: default
-    namespace: gitlab-managed-apps

infrastructure/gitlab-runner/vk-prod/gitlab-runner.yaml

@@ -1,73 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitlab-runner
-  namespace: gitlab-managed-apps
-spec:
-  interval: 10m
-  timeout: 10m
-  chart:
-    spec:
-      chart: gitlab-runner-infra
-      version: "17.5.4"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  values:
-    gitlabUrl: https://gitlab.sarex.io
-    concurrent: 20
-    checkInterval: 10
-    unregisterRunners: true
-    terminationGracePeriodSeconds: 3600
-    image:
-      registry: cr.yandex/crp3ccidau046kdj8g9q
-      image: mirror/gitlab-runner
-    imagePullSecrets:
-      - name: istio-registry-secret
-    rbac:
-      create: true
-      clusterWideAccess: false
-    serviceAccount:
-      create: true
-    podSecurityContext:
-      fsGroup: 65533
-      runAsUser: 100
-    metrics:
-      enabled: false
-    runners:
-      secret: gitlab-runner-secret
-      executor: kubernetes
-      cache: {}
-      config: |
-        [[runners]]
-          [runners.kubernetes]
-            namespace = "{{.Release.Namespace}}"
-            image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/docker:24.0.5"
-            helper_image = "cr.yandex/crp3ccidau046kdj8g9q/mirror/gitlab-runner-helper:x86_64-v17.5.3"
-            image_pull_secrets = ["istio-registry-secret"]
-            poll_interval = 10
-            poll_timeout = 600
-            privileged = true
-            tls_verify = false
-            cpu_request = "0.1"
-            cpu_limit = "3"
-            memory_request = "128Mi"
-            memory_limit = "3Gi"
-            helper_cpu_request = "0.05"
-            helper_cpu_limit = "3"
-            helper_memory_request = "32Mi"
-            helper_memory_limit = "10Gi"
-            service_cpu_request = "0.5"
-            service_cpu_limit = "3"
-            service_memory_request = "3Gi"
-
-            [runners.feature_flags]
-              FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY = false

infrastructure/gitlab-runner/vk-prod/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - gitlab-runner.yaml
-  - rbac.yaml

infrastructure/gitlab-runner/vk-prod/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitlab-managed-apps

infrastructure/gitlab-runner/vk-prod/rbac.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: gitlab-runner-jobs-cluster-admin
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-  - kind: ServiceAccount
-    name: default
-    namespace: gitlab-managed-apps

infrastructure/istio-base/vk-infra/istio-base.yaml

@@ -1,14 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: istio-base
-  namespace: istio-system
-spec:
-  chart:
-    spec:
-      chart: base-infra
-      version: "1.30.5"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system

infrastructure/istio-base/vk-infra/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: ./istio-base.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: istio-base
-      namespace: istio-system

infrastructure/istio-base/vk-prod/istio-base.yaml

@@ -1,14 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: istio-base
-  namespace: istio-system
-spec:
-  chart:
-    spec:
-      chart: base-infra
-      version: "1.30.5"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system

infrastructure/istio-base/vk-prod/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: ./istio-base.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: istio-base
-      namespace: istio-system

infrastructure/istio-config/brusnika-stage/istio-config.yaml

@@ -671,19 +671,8 @@ spec:
                 allowOrigins:
                   - regex: ".*"
               routes:
-                - path:
-                    prefix: /orchestrator/api/process/
-                  rewrite: /api/process/
-                  service: cde.orchestrator.svc.cluster.local
-                  port: 8080
-                - path:
-                    prefix: /orchestrator/api/sign
-                  rewrite: /api/sign
-                  service: cde.orchestrator.svc.cluster.local
-                  port: 8080
                 - path:
                     prefix: /orchestrator/
-                  rewrite: /api/
                   service: cde.orchestrator.svc.cluster.local
                   port: 8080
             global-test-vs:
@@ -1199,20 +1188,6 @@ spec:
                   service: workspaces-service.workspaces.svc.cluster.local
                   port: 8000
 
-            vs-iam-api:
-              namespace: ingress-nginx
-              hosts:
-                - test.sarex.brusnika.tech
-              gateways:
-                - ingress-nginx/main-gateway
-              routes:
-                - match:
-                    - uri:
-                        prefix: /iam/api/
-                  rewrite: /external/api/
-                  service: iam-backend.iam.svc.cluster.local
-                  port: 8000
-
             vs-resources-admin:
               namespace: ingress-nginx
               hosts:

infrastructure/istio-config/uralkal/istio-config.yaml

@@ -388,29 +388,6 @@ spec:
                   rewrite: /eav/admin/
                   service: backend-svc.eav.svc.cluster.local
                   port: 80
-            cde-api:
-              name: cde-api-virt-service
-              namespace: default
-              hosts:
-                - sarex.local.uralkali.com
-              gateways:
-                - default/platform-gateway
-              routes:
-                - path:
-                    prefix: /orchestrator/api/process/
-                  rewrite: /api/process/
-                  service: cde-svc.cde.svc.cluster.local
-                  port: 80
-                - path:
-                    prefix: /orchestrator/api/sign
-                  rewrite: /api/sign
-                  service: cde-svc.cde.svc.cluster.local
-                  port: 80
-                - path:
-                    prefix: /orchestrator/
-                  rewrite: /api/
-                  service: cde-svc.cde.svc.cluster.local
-                  port: 80
             srx-admin-frontend:
               name: srx-admin-frontend-virt-service
               namespace: default

infrastructure/istio-config/vad/istio-config.yaml

@@ -335,19 +335,6 @@ spec:
                   rewrite: /api/
                   service: backend-svc.inspections.svc.cluster.local
                   port: 80
-            premises-api:
-              name: premises-api-virt-service
-              namespace: default
-              hosts:
-                - sarex.vadroad.ru
-              gateways:
-                - default/platform-gateway
-              routes:
-                - path:
-                    prefix: /premises/api/
-                  rewrite: /api/
-                  service: backend-svc.premises.svc.cluster.local
-                  port: 80
             reviews-frontend:
               name: reviews-frontend-virt-service
               namespace: default
@@ -399,29 +386,6 @@ spec:
                   rewrite: /eav/admin/
                   service: backend-svc.eav.svc.cluster.local
                   port: 80
-            cde-api:
-              name: cde-api-virt-service
-              namespace: default
-              hosts:
-                - sarex.vadroad.ru
-              gateways:
-                - default/platform-gateway
-              routes:
-                - path:
-                    prefix: /orchestrator/api/process/
-                  rewrite: /api/process/
-                  service: cde-svc.cde.svc.cluster.local
-                  port: 80
-                - path:
-                    prefix: /orchestrator/api/sign
-                  rewrite: /api/sign
-                  service: cde-svc.cde.svc.cluster.local
-                  port: 80
-                - path:
-                    prefix: /orchestrator/
-                  rewrite: /api/
-                  service: cde-svc.cde.svc.cluster.local
-                  port: 80
             srx-admin-frontend:
               name: srx-admin-frontend-virt-service
               namespace: default

infrastructure/istio-config/vk-infra/istio-config.yaml

@@ -1,173 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: istio-config
-  namespace: default
-spec:
-  interval: 5m
-  timeout: 10m
-  dependsOn:
-    - name: istio-base
-      namespace: istio-system
-    - name: istiod
-      namespace: istio-system
-    - name: cert-manager
-      namespace: cert-manager
-  values:
-    global:
-      env: vk-infra
-    environments:
-      vk-infra:
-        certManager:
-          clusterIssuers:
-            letsencrypt-issuer-istio:
-              spec:
-                acme:
-                  email: pavel@sarex.io
-                  privateKeySecretRef:
-                    name: letsencrypt-istio-account-key
-                  server: https://acme-v02.api.letsencrypt.org/directory
-                  solvers:
-                    - http01:
-                        ingress:
-                          class: istio
-                          podTemplate:
-                            spec:
-                              imagePullSecrets:
-                                - name: istio-registry-secret
-          certificates:
-            vault-tls:
-              dnsNames:
-                - vault.infra.sarex.tech
-              issuerRef:
-                name: letsencrypt-issuer-istio
-                kind: ClusterIssuer
-              spec:
-                duration: 2160h0m0s
-                renewBefore: 360h0m0s
-                privateKey:
-                  rotationPolicy: Always
-            kb-tls:
-              dnsNames:
-                - kb.infra.sarex.tech
-              issuerRef:
-                name: letsencrypt-issuer-istio
-                kind: ClusterIssuer
-              spec:
-                duration: 2160h0m0s
-                renewBefore: 360h0m0s
-                privateKey:
-                  rotationPolicy: Always
-            nexus-tls:
-              dnsNames:
-                - nexus.infra.sarex.tech
-              issuerRef:
-                name: letsencrypt-issuer-istio
-                kind: ClusterIssuer
-              spec:
-                duration: 2160h0m0s
-                renewBefore: 360h0m0s
-                privateKey:
-                  rotationPolicy: Always
-            idp-tls:
-              dnsNames:
-                - iam.sarex.io
-              issuerRef:
-                name: letsencrypt-issuer-istio
-                kind: ClusterIssuer
-              spec:
-                duration: 2160h0m0s
-                renewBefore: 360h0m0s
-                privateKey:
-                  rotationPolicy: Always
-        istio:
-          gateways:
-            vault:
-              name: vault-gateway
-              namespace: istio-system
-              selector:
-                istio: ingressgateway
-              servers:
-                - hosts:
-                    - vault.infra.sarex.tech
-                  tls:
-                    credentialName: vault-tls
-                    mode: SIMPLE
-            kb:
-              name: kb-gateway
-              namespace: istio-system
-              selector:
-                istio: ingressgateway
-              servers:
-                - hosts:
-                    - kb.infra.sarex.tech
-                  tls:
-                    credentialName: kb-tls
-                    mode: SIMPLE
-            nexus:
-              name: nexus-gateway
-              namespace: istio-system
-              selector:
-                istio: ingressgateway
-              servers:
-                - hosts:
-                    - nexus.infra.sarex.tech
-                  tls:
-                    credentialName: nexus-tls
-                    mode: SIMPLE
-            idp:
-              name: idp-gateway
-              namespace: istio-system
-              selector:
-                istio: ingressgateway
-              servers:
-                - hosts:
-                    - iam.sarex.io
-                  tls:
-                    credentialName: idp-tls
-                    mode: SIMPLE
-          virtualServices:
-            vault-virt-service:
-              namespace: istio-system
-              hosts:
-                - vault.infra.sarex.tech
-              gateways:
-                - istio-system/vault-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: vault-vault-contour-active.vault.svc.cluster.local
-                  port: 8200
-            kb-virt-service:
-              namespace: istio-system
-              hosts:
-                - kb.infra.sarex.tech
-              gateways:
-                - istio-system/kb-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: kb-service.kb.svc.cluster.local
-                  port: 80
-            nexus-virt-service:
-              namespace: istio-system
-              hosts:
-                - nexus.infra.sarex.tech
-              gateways:
-                - istio-system/nexus-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: nexus.nexus.svc.cluster.local
-                  port: 8081
-            idp-virt-service:
-              namespace: istio-system
-              hosts:
-                - iam.sarex.io
-              gateways:
-                - istio-system/idp-gateway
-              routes:
-                - path:
-                    prefix: /
-                  service: idp.zitadel.svc.cluster.local
-                  port: 8080

infrastructure/istio-config/vk-infra/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: ./istio-config.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: istio-config
-      namespace: default

infrastructure/istio-gateway/vk-infra/ingressgateway-me1.yaml

@@ -1,43 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: ingressgateway-me1
-  namespace: istio-system
-spec:
-  interval: 10m
-  dependsOn:
-    - name: istio-base
-      namespace: istio-system
-    - name: istiod
-      namespace: istio-system
-  chart:
-    spec:
-      chart: gateway-infra
-      version: "1.30.5"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  values:
-    name: istio-ingressgateway-me1
-    labels:
-      app: istio-ingressgateway
-      istio: ingressgateway
-    replicaCount: 1
-    autoscaling:
-      enabled: false
-    nodeSelector:
-      sarex.io/pool: svc
-      topology.kubernetes.io/zone: ME1
-    imagePullSecrets:
-      - name: istio-registry-secret
-    service:
-      type: ClusterIP
-      externalTrafficPolicy: ""