CLAUDE.md

@@ -39,8 +39,7 @@
 **Кластер.** `clusters/<cluster>/kustomization.yaml` — плоский список `../../apps/<app>/<cluster>`. Инфраструктура подключается двумя разными способами:
 
 - `d8-ugmk-prod` — прямо в корневом kustomization как `../../infrastructure/<comp>/d8-ugmk-prod`;
-- `brusnika-prod`, `brusnika-stage` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на оверлеи `../../../infrastructure/<comp>/<c>` (`base` + патч HelmRelease + сопутствующие манифесты компонента);
+- `brusnika-prod`, `brusnika-stage`, `wb` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/<c>/infrastructure/patches/*.yaml`.
-- `wb` — через `clusters/wb/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/wb/infrastructure/patches/*.yaml`.
 
 Кластеры: `brusnika-prod`, `brusnika-stage`, `d8-ugmk-prod`, `wb`, `yc-cps-prod`, `yc-ecp`, `yc-infra-prod`, `yc-k8s-test`, `yc-k8s-test-02`, `contour`.
 

apps/ams-sync/brusnika-stage/backend.yaml

@@ -138,10 +138,6 @@ spec:
           - name: KAFKA_SASL_MECHANISM
             value:
               _default: "SCRAM-SHA-512"
-          - name: RESOURCES_INTERNAL_HOST
-            value:
-              _default: "http://iams.iam.svc.cluster.local:8080"
-
         secretEnvs:
           - name: TELEGRAM_TOKEN
             secretName:

apps/attachments/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
+            _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:production_6dbb4dce
           pullPolicy:
             _default: IfNotPresent
 
@@ -110,10 +110,6 @@ spec:
           - name: YANDEX_S3_VERIFY
             value:
               _default: "false"
-          - name: YANDEX_S3_USE_SSL
-            value:
-              _default: "false"
-
         secretEnvs:
           - name: DATABASE_HOST
             secretName:

apps/attachments/uralkal/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: attachments
-resources:
-  - ../base
-patches:
-  - path: patch.yaml
-    target:
-      kind: HelmRelease
-      name: attachments

apps/attachments/uralkal/patch.yaml

@@ -1,34 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: attachments
-  namespace: attachments
-spec:
-  values:
-    services:
-      attachments:
-        podAnnotations:
-          _default:
-            vault.hashicorp.com/auth-path: auth/kubernetes
-            vault.hashicorp.com/role: attachments
-            vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/apps/attachments/postgres
-            vault.hashicorp.com/agent-inject-template-attachments-db: |-
-              {{- with secret "secrets/data/apps/attachments/postgres" -}}
-              DATABASE_HOST={{ index .Data.data "host" }}
-              DATABASE_PORT={{ index .Data.data "port" }}
-              DATABASE_NAME={{ index .Data.data "database" }}
-              DATABASE_USER={{ index .Data.data "username" }}
-              DATABASE_PASSWORD={{ index .Data.data "password" }}
-              DATABASE_SSL_MODE=disable
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments
-            vault.hashicorp.com/agent-inject-template-attachments-s3: |-
-              {{- with secret "secrets/data/minio/apps/attachments" -}}
-              YANDEX_S3_ENDPOINT_URL=s3-proxy.s3-proxy.svc.cluster.local
-              YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-              YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-              YANDEX_S3_USE_SSL=false
-              YANDEX_S3_REGION=ru-central
-              YANDEX_S3_VERIFY=false
-              BUCKET_NAME=attachments
-              {{- end -}}

apps/auth-flow/uralkal/helmrelease.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: frontend
-  namespace: auth-flow
-spec:
-  values:
-    services:
-      frontend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/auth-flow/uralkal/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: helmrelease.yaml
-    target:
-      kind: HelmRelease
-      name: frontend

apps/bi/base/backend.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 25m
+                _default: 500m
               memory:
-                _default: 128Mi
+                _default: 1Gi
 
           probes:
             liveness:

apps/bi/brusnika-stage/backend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_e607dcc6
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_37902c73
           pullPolicy:
             _default: IfNotPresent
 
@@ -119,10 +119,6 @@ spec:
             _default: regcred
 
         envs:
-          - name: SUPERSET_HOST
-            value:
-              _default: "https://superset.test.sarex.brusnika.tech"
-
           - name: SETTINGS_DEBUG
             value:
               _default: "0"

apps/bi/brusnika-stage/frontend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:contour_9cfd1a0b
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:production_afb137d4
           pullPolicy:
             _default: IfNotPresent
 

apps/bi/uralkal/backend.yaml

@@ -1,79 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: bi-backend
-  namespace: bi
-spec:
-  values:
-    services:
-      main:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null
-        envs:
-          - name: SETTINGS_DEBUG
-            value:
-              _default: "0"
-
-          - name: SETTINGS_VERIFY_SSL
-            value:
-              _default: "1"
-
-          - name: SETTINGS_API_V1_PREFIX
-            value:
-              _default: "/api/v1"
-
-          - name: AUTH_HOST
-            value:
-              _default: "https://sarex.local.uralkali.com"
-
-          - name: WORKER_TIMEOUT
-            value:
-              _default: "120"
-
-          - name: SUPERSET_HOST
-            value:
-              _default: "https://sarex-bi.sarex.local.uralkali.com/"
-
-          - name: PYTHONPATH
-            value:
-              _default: "src"
-
-          - name: ISSUES_SERVICE_HOST
-            value:
-              _default: "http://backend-svc.issues.svc.cluster.local"
-
-          - name: EAV_SERVICE_HOST
-            value:
-              _default: "http://backend-svc.eav.svc.cluster.local"
-
-          - name: PM_SERVICE_HOST
-            value:
-              _default: "http://backend-svc.pm.svc.cluster.local:8000"
-
-          - name: SUPERSET_SYSTEM_WIDGETS
-            value:
-              _default: '{"MDR": {"id": "e7343f21-1ee0-4a87-b712-e8cfd413cc49","name": "MDR"},"SC": {"id": "d63d25e4-eab6-452f-8b31-065094bc2cb6","name": "Стройконтроль"}}'
-
-          - name: SUPERSET_DOCUMENTATION_URL
-            value:
-              _default: "https://sarex.local.uralkali.com/documentations/"
-          
-          - name: SUPERSET_JWT_SECRET
-            value:
-              _default: "6TosZjqxxZ3kAPiht4miaGICRV5AbfvuenWnYfOUnxfbYJJXUNWedOS0QeJQaryr"
-
-          - name: KAFKA_BOOTSTRAP_SERVERS
-            value:
-              _default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]'
-
-          - name: KAFKA_TOPICS
-            value:
-              _default: '{"planning": "message-hub-prod"}'
-
-          - name: KAFKA_ENABLE
-            value:
-              _default: "0"

apps/bi/uralkal/frontend.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: bi-frontend
-  namespace: bi
-spec:
-  values:
-    services:
-      frontend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/bi/uralkal/kustomization.yaml

@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: bi-backend
-  - path: frontend.yaml
-    target:
-      kind: HelmRelease
-      name: bi-frontend

apps/bim/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
           pullPolicy:
             _default: IfNotPresent
 

apps/bim/uralkal/backend.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: bim
-spec:
-  values:
-    services:
-      backend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/bim/uralkal/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: backend

apps/cde/base/cde-flowscallback.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 25m
+                _default: 500m
               memory:
-                _default: 128Mi
+                _default: 1Gi
 
           probes:
             liveness:

apps/cde/base/cde-worker-copy.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 25m
+                _default: "1"
               memory:
-                _default: 228Mi
+                _default: 1Gi
 
           probes:
             liveness:

apps/cde/base/cde.yaml

@@ -71,7 +71,7 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 250m
+                _default: 500m
               memory:
                 _default: 512Mi
 

apps/cde/brusnika-stage/cde-flowscallback.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-flowscallback
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-flowscallback
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-flowscallback
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-flowscallback
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-flowscallback
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-splitpdf.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-splitpdf
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-splitpdf
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-splitpdf
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-splitpdf
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_4.4.1
-        imagePullPolicy: Always
-        name: cde-worker-splitpdf
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-alert.yaml

@@ -1,35 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-alert
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-alert
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 0
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-alert
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-alert
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/orchestrator:latest
-        imagePullPolicy: Always
-        name: cde-worker-alert
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copy.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-copy
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-copy
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-copy
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-copy
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-copy
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copyv2.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-copyv2
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-copyv2
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-copy
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-copy
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/copyv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-copy
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-markings.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-markings
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-markings
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-markings
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-markings
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:preprod_eb50f30e
-        imagePullPolicy: Always
-        name: cde-worker-markings
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-sign.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-sign
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-sign
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-sign
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-sign
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-sign
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-update-bundles.yaml

@@ -1,40 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-update-bundles
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-updatebundles
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-updatebundles
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-updatebundles
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-update-bundles
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/cde.yaml

@@ -1,55 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/cde:production_e5316bd0
-        imagePullPolicy: Always
-        livenessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 15
-          periodSeconds: 10
-          successThreshold: 1
-          tcpSocket:
-            port: 8080
-          timeoutSeconds: 1
-        name: cde
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-        readinessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 15
-          periodSeconds: 10
-          successThreshold: 1
-          tcpSocket:
-            port: 8080
-          timeoutSeconds: 1
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/createversionsv2-worke.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: createversionsv2-worke
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-createversions
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-createversions
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-createversions
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'true'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/createversionsv2-worker:preprod_90202b78
-        imagePullPolicy: Always
-        name: createversionsv2-worke
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/kustomization.yaml

@@ -1,19 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: orchestrator
+namespace: contracts
 resources:
-  - serviceaccount.yaml
+  - helmrelease.yaml
-  - service.yaml
-  - cde.yaml
-  - cde-flowscallback.yaml
-  - cde-splitpdf.yaml
-  - cde-worker-alert.yaml
-  - cde-worker-copy.yaml
-  - cde-worker-markings.yaml
-  - cde-worker-sign.yaml
-  - cde-worker-update-bundles.yaml
-  - cde-worker-copyv2.yaml
-  - createversionsv2-worke.yaml
-  - markingsv2-worker.yaml
-  - signv2-worker.yaml

apps/cde/brusnika-stage/markingsv2-worker.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: markingsv2-worker
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-markings
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-markings
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-markings
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/markingsv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-markings
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/brusnika-stage/service.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-  ports:
-  - name: http
-    port: 8080
-    protocol: TCP
-    targetPort: 8080

apps/cde/brusnika-stage/serviceaccount.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-    app.kubernetes.io/version: 0.0.1

apps/cde/brusnika-stage/signv2-worker.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: signv2-worker
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-sign
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-sign
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-sign
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/signv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-sign
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub

apps/cde/uralkal/cde-flowscallback.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-flowscallback
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-flowscallback:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde-splitpdf.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-splitpdf
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-splitpdf:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde-worker-alert.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-worker-alert
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-worker-alert:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde-worker-copy.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-worker-copy
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-worker-copy:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde-worker-copyv2.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-worker-copyv2
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-worker-copyv2:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde-worker-create-versions.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-worker-create-versions
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-worker-create-versions:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde-worker-create-versionsv2.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-worker-create-versionsv2
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-worker-create-versionsv2:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde-worker-markings.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-worker-markings
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-worker-markings:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde-worker-markingsv2.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-worker-markingsv2
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-worker-markingsv2:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde-worker-sign.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-worker-sign
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-worker-sign:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde-worker-signv2.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-worker-signv2
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-worker-signv2:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde-worker-update-bundles.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde-worker-update-bundles
-  namespace: cde
-spec:
-  values:
-    services:
-      cde-worker-update-bundles:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/cde.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cde
-  namespace: cde
-spec:
-  values:
-    services:
-      cde:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cde/uralkal/kustomization.yaml

@@ -1,57 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: cde-flowscallback.yaml
-    target:
-      kind: HelmRelease
-      name: cde-flowscallback
-  - path: cde-splitpdf.yaml
-    target:
-      kind: HelmRelease
-      name: cde-splitpdf
-  - path: cde-worker-alert.yaml
-    target:
-      kind: HelmRelease
-      name: cde-worker-alert
-  - path: cde-worker-copy.yaml
-    target:
-      kind: HelmRelease
-      name: cde-worker-copy
-  - path: cde-worker-copyv2.yaml
-    target:
-      kind: HelmRelease
-      name: cde-worker-copyv2
-  - path: cde-worker-create-versions.yaml
-    target:
-      kind: HelmRelease
-      name: cde-worker-create-versions
-  - path: cde-worker-create-versionsv2.yaml
-    target:
-      kind: HelmRelease
-      name: cde-worker-create-versionsv2
-  - path: cde-worker-markings.yaml
-    target:
-      kind: HelmRelease
-      name: cde-worker-markings
-  - path: cde-worker-markingsv2.yaml
-    target:
-      kind: HelmRelease
-      name: cde-worker-markingsv2
-  - path: cde-worker-sign.yaml
-    target:
-      kind: HelmRelease
-      name: cde-worker-sign
-  - path: cde-worker-signv2.yaml
-    target:
-      kind: HelmRelease
-      name: cde-worker-signv2
-  - path: cde-worker-update-bundles.yaml
-    target:
-      kind: HelmRelease
-      name: cde-worker-update-bundles
-  - path: cde.yaml
-    target:
-      kind: HelmRelease
-      name: cde

apps/checklists/uralkal/helmrelease.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: checklists
-  namespace: checklists
-spec:
-  values:
-    services:
-      checklists:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/checklists/uralkal/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: helmrelease.yaml
-    target:
-      kind: HelmRelease
-      name: checklists

apps/comparisons/uralkal/backend.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: comparisons
-spec:
-  values:
-    services:
-      backend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/comparisons/uralkal/frontend.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: frontend
-  namespace: comparisons
-spec:
-  values:
-    services:
-      frontend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/comparisons/uralkal/kustomization.yaml

@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: backend
-  - path: frontend.yaml
-    target:
-      kind: HelmRelease
-      name: frontend

apps/contracts/uralkal/backend.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: contracts
-  namespace: contracts
-spec:
-  values:
-    services:
-      contracts:
-        podAnnotations:
-          _default:
-            vault.hashicorp.com/agent-inject-template-contracts-db: |-
-              {{- with secret "secrets/data/apps/contracts/postgres" -}}
-              DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@{{ index .Data.data "host" }}:{{ index .Data.data "port" }}/{{ index .Data.data "database" }}?sslmode=disable
-              {{- end -}}

apps/contracts/uralkal/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: contracts

apps/control-interface/base/admin-frontend.yaml

@@ -1,94 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: admin-frontend
-  namespace: control-interface
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      admin-frontend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/admin-frontend:contour_9dc27b40
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: admin-frontend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 80
-
-          resources:
-            requests:
-              cpu:
-                _default: 100m
-              memory:
-                _default: 100Mi
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: admin-frontend-svc
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8080
-
-          targetPort:
-            _default: 80
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: regcred
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/control-interface/base/kustomization.yaml

@@ -4,5 +4,4 @@ kind: Kustomization
 namespace: control-interface
 resources:
   - helmrelease.yaml
-  - admin-frontend.yaml
 

apps/control-interface/uralkal/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - namespace.yaml
-  - psql-tools-debug.yaml

apps/control-interface/uralkal/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: control-interface
-  labels:
-    istio-injection: enabled

apps/control-interface/uralkal/psql-tools-debug.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: psql-tools-debug
-  namespace: control-interface
-  labels:
-    app: psql-tools-debug
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: psql-tools-debug
-  template:
-    metadata:
-      labels:
-        app: psql-tools-debug
-    spec:
-      containers:
-        - name: debug
-          image: cr.yandex/crp3ccidau046kdj8g9q/zitadel-bpmn:cc_contour_5.22.3_ca40c204
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-c"]
-          args:
-            - while true; do sleep 3600; done
-      imagePullSecrets:
-        - name: regcred

apps/cross-section/uralkal/helmrelease.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cross-section-static
-  namespace: cross-section
-spec:
-  values:
-    services:
-      frontend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/cross-section/uralkal/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: helmrelease.yaml
-    target:
-      kind: HelmRelease
-      name: cross-section-static

apps/django/base/django-configmap.yaml

@@ -87,7 +87,7 @@ data:
         'Bearer',
     )
 
-    HOST = os.environ.get("DJANGO_HOST", "https://sarex.contour.infra.sarex.tech")
+    HOST = "https://sarex.contour.infra.sarex.tech"
 
     POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
     POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')

apps/django/brusnika-prod/s3-proxy.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
+            _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_37a48176
           pullPolicy:
             _default: IfNotPresent
 
@@ -89,7 +89,7 @@ spec:
         envs:
           - name: AWS_API_ENDPOINT
             value:
-              _default: "https://obs.ru-moscow-1.hc.sbercloud.ru"
+              _default: "http://minio-svc.minio.svc.cluster.local:9000"
           - name: APP_PORT
             value:
               _default: "8000"

apps/django/brusnika-stage/celery.yaml

@@ -330,14 +330,6 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
-          - name: CACHE_HOST
-            value:
-              _default: "redis.pm.svc.cluster.local"
-
-          - name: RESOURCES_INTERNAL_HOST
-            value:
-              _default: "http://iams.iam.svc.cluster.local:8080"
-
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/brusnika-stage/export-project.yaml

@@ -88,11 +88,6 @@ spec:
         labels:
           monitoring: prometheus
 
-        envs:
-          - name: TIMEOUT
-            value:
-              _default: "180"
-
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/django/brusnika-stage/nginx-configmap.yaml

@@ -101,8 +101,7 @@ data:
 
             location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
                 alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
-                types { }
+                add_header Content-Type application/wasm always;
-                default_type application/wasm;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -111,8 +110,7 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
-                types { }
+                add_header Content-Type application/javascript always;
-                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -121,8 +119,7 @@ data:
 
             location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
                 alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
-                types { }
+                add_header Content-Type application/javascript always;
-                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -131,8 +128,7 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf.js;
-                types { }
+                add_header Content-Type application/javascript always;
-                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -140,8 +136,7 @@ data:
             }
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                types { }
+                add_header Content-Type application/wasm always;
-                default_type application/wasm;
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
             }
 
@@ -149,8 +144,7 @@ data:
             rewrite /workspaces-v2/(.+) /$1 break;
             proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
 
-            proxy_hide_header Content-Type;
+            add_header Content-Type application/wasm;
-            add_header Content-Type application/wasm always;
             proxy_set_header Accept application/wasm;
         }
 

apps/django/brusnika-stage/sarex-backend.yaml

@@ -313,18 +313,6 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
-          - name: RESOURCES_INTERNAL_HOST
-            value:
-              _default: "http://iams.iam.svc.cluster.local:8080"
-
-          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
-            value:
-              _default: "True"
-
-          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
-            value:
-              _default: "True"
-
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/d8-ugmk-prod/backend.yaml

@@ -18,9 +18,6 @@ spec:
           - name: SERVER_ZITADEL_ENABLED
             value:
               _default: "True"
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.uralmine.com"
           - name: DJANGO_SETTINGS_MODULE
             value:
               _default: config.settings.production

apps/django/uralkal/backend.yaml

@@ -1,163 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: django
-spec:
-  values:
-    services:
-      backend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null
-        envs:
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.local.uralkali.com"
-
-          - name: ALLOWED_HOSTS
-            value:
-              _default: "*"
-          - name: SERVER_USE_CHANGELOG
-            value:
-              _default: "0"
-          - name: SERVER_ZITADEL_ENABLED
-            value:
-              _default: "True"
-          - name: DJANGO_SETTINGS_MODULE
-            value:
-              _default: config.settings.production
-          - name: CELERY_REDIS_HOST
-            value:
-              _default: redis
-          - name: CELERY_REDIS_PORT
-            value:
-              _default: "6379"
-          - name: DJANGO_REDIS_HOST
-            value:
-              _default: redis
-          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
-            value:
-              _default: "True"
-          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
-            value:
-              _default: "True"
-          - name: DJANGO_REDIS_PORT
-            value:
-              _default: "6379"
-          - name: BIMV2_INTERNAL_HOST
-            value:
-              _default: http://bim-backend-v2-service.bim-api
-          - name: BIMV2_TIMEOUT
-            value:
-              _default: "60"
-          - name: JWT_KID
-            value:
-              _default: "1"
-          - name: PDM_SYNC
-            value:
-              _default: "1"
-          - name: KC_SYNC_ENABLE
-            value:
-              _default: "0"
-          - name: MEASUREMENTS_HOST
-            value:
-              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
-          - name: MEASUREMENTS_USE_MEASUREMENTS
-            value:
-              _default: "1"
-          - name: SERVER_API_HOST
-            value:
-              _default: https://sarex.local.uralkali.com
-          - name: SERVER_HOST
-            value:
-              _default: https://sarex.local.uralkali.com
-          - name: WORKFLOWS_HOST
-            value:
-              _default: http://backend-svc.processing.svc.cluster.local:80
-          - name: WORKFLOWS_BASE_HOST
-            value:
-              _default: http://backend-svc.django.svc.cluster.local:80
-          - name: WORKFLOWS_PREFIX
-            value:
-              _default: /internal/v1
-          - name: WORKFLOWS_USE
-            value:
-              _default: "1"
-          - name: SERVER_S3_STREAM_IMPORT
-            value:
-              _default: "1"
-          - name: SERVER_SAVE_DIFF_DEM
-            value:
-              _default: "1"
-          - name: SERVER_USE_CLICKHOUSE
-            value:
-              _default: "0"
-          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
-            value:
-              _default: "0"
-          - name: SERVER_USE_DJANGO_STORAGE
-            value:
-              _default: "1"
-          - name: SERVER_USE_METASHAPE
-            value:
-              _default: "0"
-          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
-            value:
-              _default: "1"
-          - name: SERVER_CHANGELOG_MODE
-            value:
-              _default: "0"
-          - name: SERVER_DJANGO_URLS
-            value:
-              _default: "1"
-          - name: CHECK_IMPORT_HASH
-            value:
-              _default: "1"
-          - name: EAV_ENABLE
-            value:
-              _default: "1"
-          - name: SERVER_CHECK_IMPORT_HASH
-            value:
-              _default: "1"
-          - name: SERVER_CHUNKED_PATH
-            value:
-              _default: /tmp/chunked_uploads/%Y/%m/%d
-          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
-            value:
-              _default: "0"
-          - name: SERVER_USE_WRORKFLOW_STATUS
-            value:
-              _default: "1"
-          - name: ZITADEL_HOST
-            value:
-              _default: https://login.sarex.local.uralkali.com
-          - name: SERVER_KAFKA_ENABLED
-            value:
-              _default: "False"
-          - name: KAFKA_TOPICS
-            value:
-              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
-          - name: KAFKA_SSL_CAFILE
-            value:
-              _default: /usr/local/share/ca-certificates/kafka.crt
-          - name: KC_USE_REDIRECT_LOGOUT
-            value:
-              _default: "False"
-        podAnnotations:
-          _default:
-            vault.hashicorp.com/agent-inject-template-django-s3: |-
-              {{- with secret "secrets/data/minio/apps/django" }}
-              AWS_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
-              S3_HOST=http://s3-proxy.s3-proxy.svc.cluster.local
-              {{- $buckets := index .Data.data "buckets" }}
-              S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
-              S3_LOGIN={{ index .Data.data "access_key" }}
-              S3_PASSWORD={{ index .Data.data "secret_key" }}
-              AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-              AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-              AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
-              {{- end }}

apps/django/uralkal/celery.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: celery
-  namespace: django
-spec:
-  values:
-    services:
-      celery:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/django/uralkal/frontend.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: frontend
-  namespace: django
-spec:
-  values:
-    services:
-      frontend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/django/uralkal/kustomization.yaml

@@ -1,33 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: nginx-configmap.yaml
-    target:
-      kind: ConfigMap
-      name: nginx-configmap
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: backend
-  - path: zitadel-configmap.yaml
-    target:
-      kind: ConfigMap
-      name: zitadel-configmap
-  - path: s3-proxy.yaml
-    target:
-      kind: HelmRelease
-      name: s3-proxy
-  - path: celery.yaml
-    target:
-      kind: HelmRelease
-      name: celery
-  - path: frontend.yaml
-    target:
-      kind: HelmRelease
-      name: frontend
-  - path: srx-admin.yaml
-    target:
-      kind: HelmRelease
-      name: srx-admin-frontend

apps/django/uralkal/nginx-configmap.yaml

@@ -1,160 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: nginx-configmap
-  namespace: django
-data:
-  nginx.conf: |
-    worker_processes auto;
-
-    pid /var/run/nginx.pid;
-
-    events {
-        use epoll;
-        worker_connections 1024;
-    }
-
-    http {
-
-        # Basic Settings
-        large_client_header_buffers 8 128k;
-        sendfile on;
-        tcp_nopush on;
-        tcp_nodelay on;
-        keepalive_timeout 300;
-        types_hash_max_size 2048;
-        client_max_body_size 5000M;
-        client_header_buffer_size 5M;
-        include /etc/nginx/mime.types;
-        default_type application/octet-stream;
-
-        # Logging Settings
-        access_log /var/log/nginx/access.log;
-        error_log /var/log/nginx/error.log;
-
-        # GZIP Settings
-        gzip on;
-        gzip_vary on;
-        gzip_proxied any;
-        gzip_comp_level 6;
-        gzip_buffers 16 8k;
-        gzip_http_version 1.1;
-        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
-
-        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-                        '$status $body_bytes_sent "$http_referer" '
-                        '"$http_user_agent" "$http_x_forwarded_for"';
-
-        server {
-            listen 80;
-            listen [::]:80;
-            root /opt/react_client/;
-
-            add_header 'Access-Control-Allow-Origin' '*' always;
-            add_header 'Access-Control-Allow-Methods' '*' always;
-            add_header 'Access-Control-Allow-Headers' '*' always;
-
-            location = /static/index.bundle.js {
-                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
-                if_modified_since off;
-                expires off;
-            }
-
-            location ~^/api/pm/ {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                proxy_set_header Host $host;
-                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            }
-
-            location ~^/api/v1/documents/ {
-                proxy_http_version 1.1;
-                proxy_set_header Host $host;
-                proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80;
-            }
-
-            location ~^/(api|admin)/ {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                proxy_set_header Host $host;
-                proxy_pass http://backend-svc.django.svc.cluster.local:80;
-            }
-
-            location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
-                alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
-                add_header Content-Type application/wasm always;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
-
-            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
-                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
-                add_header Content-Type application/javascript always;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
-
-            location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
-                alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
-                add_header Content-Type application/javascript always;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
-
-            location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
-                alias /opt/react_client/static/viewer-pdf/mupdf.js;
-                add_header Content-Type application/javascript always;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
-
-            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                add_header Content-Type application/wasm always;
-                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
-            }
-
-             location ~^/workspaces-v2/(.+).js {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                rewrite /workspaces-v2/(.+) /$1 break;
-                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
-            }
-
-            location ~^/workspaces-v2/(.+)\.wasm$ {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                rewrite ^/workspaces-v2/(.+) /$1 break;
-                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
-            }
-
-            location @index {
-                add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';
-                if_modified_since off;
-                expires off;
-                try_files /static/index.html =404;
-            }
-
-            location ~^/workflows/(.+).js {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                rewrite /workflows/(.+) /$1 break;
-                proxy_pass http://frontend-svc.processing.svc.cluster.local:80;
-            }
-
-            location /service-worker.js {
-                try_files /static/$uri @index;
-            }
-
-            location / {
-                try_files $uri @index;
-            }
-        }
-    }

apps/django/uralkal/s3-proxy.yaml

@@ -1,31 +0,0 @@
----
-# Патч s3-proxy для vad.
-#
-# В base зашит AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech —
-# в закрытом контуре этот хост недоступен, прокси не достучится до MinIO
-# и маршрут /media/ (s3-proxy-virt-service в istio-config) вернёт ошибку.
-#
-# podAnnotations — map, мержится по ключам, поэтому переопределён только
-# agent-inject-template-s3; остальные vault-аннотации берутся из base.
-# Эндпоинт задан литералом, а не через .Data.data.client.endpoint: так же
-# сделано в apps/django/vad/backend.yaml для того же секрета
-# secrets/data/minio/apps/django — держим один способ на весь ns.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: s3-proxy
-  namespace: django
-spec:
-  values:
-    services:
-      s3-proxy:
-        podAnnotations:
-          _default:
-            vault.hashicorp.com/agent-inject-template-s3: |
-              {{- with secret "secrets/data/minio/apps/django" }}
-              AWS_API_ENDPOINT=http://s3-proxy.s3-proxy.svc.cluster.local
-              {{- $buckets := index .Data.data "buckets" }}
-              AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
-              AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-              AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-              {{- end }}

apps/django/uralkal/srx-admin.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: srx-admin-frontend
-  namespace: django
-spec:
-  values:
-    services:
-      srx-admin:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null

apps/django/uralkal/zitadel-configmap.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: zitadel-configmap
-  namespace: django
-data:
-  config.json: |
-    {
-      "auth_type": "zitadel",
-      "zitadel": {
-        "client_id": "392748840802936023",
-        "host": "https://login.sarex.local.uralkali.com"
-      }
-    }

apps/django/vad/backend.yaml

@@ -9,10 +9,6 @@ spec:
     services:
       backend:
         envs:
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.vadroad.ru"
-
           - name: ALLOWED_HOSTS
             value:
               _default: "*"
@@ -130,6 +126,10 @@ spec:
           - name: ZITADEL_HOST
             value:
               _default: https://sarex-login.vadroad.ru
+          # Включено вместе с message-hub: он консьюмер топика message-hub-stage
+          # (SETTINGS_TOPICS в apps/message-hub/d8-ugmk-prod/message-hub.yaml),
+          # а писать в этот топик должен django. Vault-шаблон django-kafka
+          # и KAFKA_SSL_CAFILE уже есть в base — здесь только флаг.
           - name: SERVER_KAFKA_ENABLED
             value:
               _default: "True"

apps/django/vad/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            location ~^/api/pm/ {
+            # location ~^/api/pm/ {
-                proxy_http_version 1.1;
+            #     proxy_http_version 1.1;
-                proxy_set_header Connection "";
+            #     proxy_set_header Connection "";
-                proxy_set_header Host $host;
+            #     proxy_set_header Host $host;
-                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            }
+            # }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;
@@ -142,12 +142,12 @@ data:
                 try_files /static/index.html =404;
             }
 
-            location ~^/workflows/(.+).js {
+            # location ~^/workflows/(.+).js {
-                proxy_http_version 1.1;
+            #     proxy_http_version 1.1;
-                proxy_set_header Connection "";
+            #     proxy_set_header Connection "";
-                rewrite /workflows/(.+) /$1 break;
+            #     rewrite /workflows/(.+) /$1 break;
-                proxy_pass http://frontend-svc.processing.svc.cluster.local:80;
+            #     proxy_pass http://frontend-svc.processing.svc.cluster.local:80;
-            }
+            # }
 
             location /service-worker.js {
                 try_files /static/$uri @index;

apps/django/wb/django-configmap.yaml

@@ -248,10 +248,7 @@ data:
             "name": "Рабочие процессы",
             "uri": "/processes"
         },
-        {
+
-          "name": "Справочники",
-          "uri": "/assets"
-        },
         {
           "name": "Аналитика",
           "uri": "/analytics"

apps/document-link/uralkal/frontend.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: frontend
-  namespace: document-link
-spec:
-  values:
-    services:
-      frontend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:vad_60487abb

apps/document-link/uralkal/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-patches:
-  - path: frontend.yaml
-    target:
-      kind: HelmRelease
-      name: frontend

apps/documentations/base/api.yaml

@@ -65,7 +65,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_3f19a21d
           pullPolicy:
             _default: IfNotPresent
         service:
@@ -116,9 +116,6 @@ spec:
           - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
             value:
               _default: "5"
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
           - name: ENABLE_SQL_QUERY
             value:
               _default: "0"

apps/documentations/base/filestream.yaml

@@ -64,7 +64,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_179e518c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430
           pullPolicy:
             _default: IfNotPresent
         service:
@@ -94,9 +94,6 @@ spec:
           - name: ZITADEL_DOMAIN
             value:
               _default: zitadel-srx.wb.ru
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
           - name: USE_ZITADEL
             value:
               _default: "1"

apps/documentations/base/pdm.yaml

@@ -210,7 +210,7 @@ spec:
               _default: http://backend-svc.subscriptions.svc.cluster.local:80
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
+              _default: http://api-service.system-log.svc.cluster.local:80
           - name: TARGET_URL
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/brusnika-prod/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_b34286a7
           pullPolicy:
             _default: IfNotPresent
 
@@ -267,15 +267,6 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
-
-          - name: USE_LEGACY_BIM_FLOW
-            value:
-              _default: "true"
-
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
-
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
           pullPolicy:
             _default: IfNotPresent
 
@@ -100,10 +100,6 @@ spec:
         labels:
           monitoring: prometheus
         envs:
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
-
           - name: POSTGRES_ADDRESS
             value:
               _default: "192.168.2.45"
@@ -259,34 +255,6 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
-          - name: USE_LEGACY_BIM_FLOW
-            value:
-              _default: "true"
-
-          - name: USE_ZITADEL
-            value:
-              _default: "0"
-
-          - name: LAST_SLAVE_1_BIM
-            value:
-              _default: "1000000"
-
-          - name: ENABLE_SMTP
-            value:
-              _default: "True"
-
-          - name: ENABLE_MAILGUN
-            value:
-              _default: "False"
-
-          - name: ENABLE_AUTH_JWT_IN_URL
-            value:
-              _default: "false"
-
-          - name: ENABLE_SIGNATURE_IN_URL
-            value:
-              _default: "true"
-
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/filestream.yaml

@@ -255,19 +255,6 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
-
-          - name: USE_ZITADEL
-            value:
-              _default: "0"
-
-          - name: ENABLE_AUTH_JWT_IN_URL
-            value:
-              _default: "false"
-
-          - name: ENABLE_SIGNATURE_IN_URL
-            value:
-              _default: "true"
-
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/hasher.yaml

@@ -1,95 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hasher
-  namespace: documentations
-  labels:
-    app: hasher
-    service: normal
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hasher
-  template:
-    metadata:
-      labels:
-        app: hasher
-        service: normal
-    spec:
-      containers:
-      - env:
-        - name: HASHER_APP__LOG_LEVEL
-          value: INFO
-        - name: HASHER_APP__NUM_WORKERS
-          value: '4'
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
-          value: hash.compute.normal.tasks
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
-          value: hash.compute
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
-          value: direct
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
-          value: hash.compute.normal
-        - name: HASHER_S3__MAX_POOL_CONNECTIONS
-          value: '10'
-        - name: HASHER_S3__CONNECT_TIMEOUT
-          value: '10'
-        - name: HASHER_S3__READ_TIMEOUT
-          value: '30'
-        - name: HASHER_S3__REGION_NAME
-          value: ru-central1
-        - name: HASHER_S3__USE_SSL
-          value: 'true'
-        - name: HASHER_S3__VERIFY
-          value: 'true'
-        - name: HASHER_AMQP__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__PORT
-          valueFrom:
-            secretKeyRef:
-              key: port
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__VHOST
-          valueFrom:
-            secretKeyRef:
-              key: vhost
-              name: hasher-rabbitmq-secret
-        - name: HASHER_S3__ENDPOINT
-          valueFrom:
-            secretKeyRef:
-              key: endpoint
-              name: hasher-s3-secret
-        - name: HASHER_S3__ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              key: access_key
-              name: hasher-s3-secret
-        - name: HASHER_S3__SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              key: secret_key
-              name: hasher-s3-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
-        imagePullPolicy: IfNotPresent
-        name: normal
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-      imagePullSecrets:
-      - name: regcred

apps/documentations/brusnika-stage/kustomization.yaml

@@ -7,5 +7,3 @@ resources:
   - pdm.yaml
   - api.yaml
   - filestream.yaml
-  - hasher.yaml
-  - pdf-markings-amqp.yaml

apps/documentations/brusnika-stage/pdf-markings-amqp.yaml

@@ -1,125 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pdf-markings-amqp
-  namespace: documentations
-  labels:
-    app: pdf-markings-amqp
-    service: api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pdf-markings-amqp
-  strategy:
-    rollingUpdate:
-      maxSurge: 3
-      maxUnavailable: 3
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: pdf-markings-amqp
-        service: api
-    spec:
-      containers:
-      - env:
-        - name: MARKS_APP__LOG_LEVEL
-          value: INFO
-        - name: MARKS_CRYPTO__HASHING_ALGO
-          value: md_gost12_256
-        - name: MARKS_DOCUMENTS_DB__HOST
-          value: 192.168.2.45
-        - name: MARKS_DOCUMENTS_DB__PORT
-          value: '5432'
-        - name: MARKS_DOCUMENTS_DB__DATABASE
-          value: documentations
-        - name: MARKS_DOCUMENTS_DB__SSLMODE
-          value: disable
-        - name: MARKS_QR__REDIRECT_URL
-          value: https://stamp-verification.test.sarex.brusnika.tech/
-        - name: MARKS_QR__BASE_DOCUMENT_URL
-          value: https://test.sarex.brusnika.tech
-        - name: MARKS_S3__USE_SSL
-          value: 'false'
-        - name: MARKS_S3__SSL_VERIFY
-          value: 'false'
-        - name: MARKS_S3__REGION
-          value: ru-central1
-        - name: MARKS_S3__DEFAULT_BUCKET
-          value: documentations-stage-1-sarex-new
-        - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
-          value: pdf_markings_input
-        - name: MARKS_DOCUMENTS_DB__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: postgres-secret
-        - name: MARKS_DOCUMENTS_DB__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: postgres-secret
-        - name: MARKS_S3__URL
-          valueFrom:
-            secretKeyRef:
-              key: endpoint_url
-              name: yc-s3
-        - name: MARKS_S3__ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              key: key_id
-              name: yc-s3
-        - name: MARKS_S3__SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              key: access_key
-              name: yc-s3
-        - name: MARKS_RABBITMQ__HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__PORT
-          valueFrom:
-            secretKeyRef:
-              key: port
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__VHOST
-          valueFrom:
-            secretKeyRef:
-              key: vhost
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
-          valueFrom:
-            secretKeyRef:
-              key: heartbeat
-              name: rabbitmq
-        image: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
-        imagePullPolicy: IfNotPresent
-        name: api
-        ports:
-        - containerPort: 8000
-          name: http
-          protocol: TCP
-        volumeMounts:
-        - mountPath: /etc/sarex/yc-s3-storage
-          name: yc-s3
-          readOnly: true
-      volumes:
-      - name: yc-s3
-        secret:
-          secretName: yc-s3
-      imagePullSecrets:
-      - name: regcred

apps/documentations/brusnika-stage/pdm.yaml

@@ -124,11 +124,11 @@ spec:
 
           - name: TRANSMITTALS_BASE_URL
             value:
-              _default: "http://transmittal-service.transmittal.svc.cluster.local:80"
+              _default: ""
 
           - name: TRANSMITTALS_ENABLE
             value:
-              _default: "true"
+              _default: "false"
 
           - name: DRAWINGS_INTERNAL_URL
             value:
@@ -308,14 +308,6 @@ spec:
           - name: WORKSPACE_URL
             value:
               _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
-          - name: BUCKET_NAME
-            value:
-              _default: "attachments-storage"
-
-          - name: PERMISSIONS_FILTER_COMPANIES
-            value:
-              _default: "[1]"
-
         secretEnvs:
           - name: RELEASES_TOKEN
             secretName:

apps/documentations/d8-ugmk-prod/filestream.yaml

@@ -83,7 +83,7 @@ spec:
               _default: v1
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
+              _default: http://api-service.system-log.svc.cluster.local:80
           - name: DJANGO_HOST
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/ugok/api.yaml

@@ -1,4 +1,7 @@
 ---
+# standalone HelmRelease — base vault-native, в ugok Vault не используется.
+# Кастомный тег UGOK_4bf15a64 оставлен как есть (не как в wb — см.
+# предыдущее решение по этому приложению).
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -36,7 +39,7 @@ spec:
 
         image:
           name:
-            _default: 10.4.10.187:80/library/documentations:ugok_179e518c
+            _default: 10.4.10.187:80/library/documentations:ugok_0b17a10e
           pullPolicy:
             _default: IfNotPresent
 
@@ -150,9 +153,6 @@ spec:
           - name: CONTAINER_REGISTRY
             value:
               _default: cr.yandex/crp3ccidau046kdj8g9q
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
           - name: ENVIRONMENT
             value:
               _default: production

apps/documentations/ugok/filestream.yaml

@@ -1,4 +1,6 @@
 ---
+# standalone HelmRelease — base vault-native, в ugok Vault не используется.
+# Кастомный тег prod_dfaa58f7_ugok оставлен как есть (не как в wb).
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -36,7 +38,7 @@ spec:
 
         image:
           name:
-            _default: 10.4.10.187:80/library/documentations-api-files:ugok_179e518c
+            _default: 10.4.10.187:80/library/documentations-api-files:ugok_a62fce61
           pullPolicy:
             _default: IfNotPresent
 
@@ -127,9 +129,6 @@ spec:
           - name: ENABLE_SSL
             value:
               _default: "0"
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
           - name: ENABLE_S3
             value:
               _default: "1"

apps/documentations/uralkal/api.yaml

@@ -1,169 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: documentations-api
-  namespace: documentations
-spec:
-  values:
-    services:
-      backend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api:contour_8631bb0e
-        envs:
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "20"
-          - name: ZITADEL_ACCOUNT
-            value:
-              _default: /vault/secrets/documentations-zitadel-account-json
-          - name: ZITADEL_DOMAIN
-            value:
-              _default: login.sarex.local.uralkali.com
-          - name: ZITADEL_INSECURE_SKIP_VERIFY
-            value:
-              _default: "true"
-          - name: USE_ZITADEL
-            value:
-              _default: "1"
-          - name: FLOWS_URL
-            value:
-              _default: http://backend-svc.flows.svc.cluster.local:80
-          - name: LAST_MASTER_BIM
-            value:
-              _default: "36311"
-          - name: API_ADDRESS
-            value:
-              _default: 0.0.0.0:8080
-          - name: USE_LEGACY_BIM_FLOW
-            value:
-              _default: "true"
-          - name: API_ADDRESS_FILE
-            value:
-              _default: 0.0.0.0:8080
-          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-            value:
-              _default: "5"
-          - name: ENABLE_SQL_QUERY
-            value:
-              _default: "0"
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-          - name: WORKSPACE_V2_EXTERNAL_URL
-            value:
-              _default: https://sarex.local.uralkali.com/workspaces-v2/
-          - name: ENABLE_S3
-            value:
-              _default: "1"
-          - name: CONTAINER_REGISTRY
-            value:
-              _default: cr.yandex/crp3ccidau046kdj8g9q
-          - name: ENVIRONMENT
-            value:
-              _default: production
-          - name: LAST_SLAVE_1_BIM
-            value:
-              _default: "1000000"
-          - name: HOST
-            value:
-              _default: http://backend-api-svc.documentations.svc.cluster.local:80
-          - name: FILE_STREAM_HOST
-            value:
-              _default: sarex.local.uralkali.com
-          - name: DOCUMENTATION_URL
-            value:
-              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
-          - name: WORKFLOW_URL
-            value:
-              _default: http://backend-svc.processing.svc.cluster.local:80/
-          - name: WORKSPACE_URL
-            value:
-              _default: http://backend-svc.workspaces.svc.cluster.local:80/
-          - name: BIM_API_URL
-            value:
-              _default: http://backend-svc.bim.svc.cluster.local:80/
-          - name: BIM_API_V2_URL
-            value:
-              _default: http://backend-svc.bim.svc.cluster.local:80/
-          - name: WORKSPACE_BUNDLE_VERSION
-            value:
-              _default: v1
-          - name: SYSTEM_LOG_URL
-            value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
-          - name: DJANGO_HOST
-            value:
-              _default: http://backend-svc.django.svc.cluster.local:80
-          - name: MARKS_PROCESSING_URL
-            value:
-              _default: http://marks-service:8000
-          - name: USE_MARKS_RABBITMQ
-            value:
-              _default: "true"
-          - name: MARKS_RABBITMQ_HOST
-            value:
-              _default: rabbitmq.rabbitmq.svc.cluster.local
-          - name: MARKS_RABBITMQ_PORT
-            value:
-              _default: "5672"
-          - name: PUBLIC_LINK_HOST
-            value:
-              _default: https://document-link.sarex.local.uralkali.com
-          - name: NAMESPACE
-            value:
-              _default: documentations
-          - name: DJANGO_ORIGINATOR
-            value:
-              _default: docs_prod
-          - name: WORKFLOW_IMAGES_VERSION
-            value:
-              _default: master
-          - name: WORKFLOWS_IMAGES_VERSION
-            value:
-              _default: master
-          - name: S3_SERVICE_ACCOUNT
-            value:
-              _default: /vault/secrets/documentations-s3-account-json
-          - name: READ_WRITE_TIMEOUT_FILE_STREAM
-            value:
-              _default: 6h
-          - name: CACHE_DEFAULT_EXPIRATION
-            value:
-              _default: 60s
-          - name: ENABLE_SMTP
-            value:
-              _default: "True"
-          - name: ENABLE_MAILGUN
-            value:
-              _default: "False"
-          - name: CACHE_CLEANUP_INTERVAL
-            value:
-              _default: 60s
-          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
-            value:
-              _default: "mock"
-          - name: ENABLE_AUTH_JWT_IN_URL
-            value:
-              _default: "true"
-          - name: ENABLE_SIGNATURE_IN_URL
-            value:
-              _default: "false"
-          - name: USE_CACHE_IN_FILE_STREAMER
-            value:
-              _default: "0"
-          - name: VALKEY_ADDR
-            value:
-              _default: redis:6379
-          - name: VALKEY_HOST
-            value:
-              _default: redis
-          - name: VALKEY_PORT
-            value:
-              _default: "6379"

apps/documentations/uralkal/filestream.yaml

@@ -1,157 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: documentations-filestream
-  namespace: documentations
-spec:
-  values:
-    services:
-      backend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:contour_8631bb0e
-        envs:
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "20"
-          - name: ZITADEL_INSECURE_SKIP_VERIFY
-            value:
-              _default: "true"
-          - name: ZITADEL_ACCOUNT
-            value:
-              _default: /vault/secrets/documentations-zitadel-account-json
-          - name: ZITADEL_DOMAIN
-            value:
-              _default: login.sarex.local.uralkali.com
-          - name: USE_ZITADEL
-            value:
-              _default: "1"
-          - name: FLOWS_URL
-            value:
-              _default: http://backend-svc.flows.svc.cluster.local:80
-          - name: LAST_MASTER_BIM
-            value:
-              _default: "36311"
-          - name: API_ADDRESS
-            value:
-              _default: 0.0.0.0:8080
-          - name: API_ADDRESS_FILE
-            value:
-              _default: 0.0.0.0:8080
-          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-            value:
-              _default: "5"
-          - name: ENABLE_SQL_QUERY
-            value:
-              _default: "0"
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-          - name: WORKSPACE_V2_EXTERNAL_URL
-            value:
-              _default: https://sarex.local.uralkali.com/workspaces-v2/
-          - name: ENABLE_S3
-            value:
-              _default: "1"
-          - name: CONTAINER_REGISTRY
-            value:
-              _default: cr.yandex/crp3ccidau046kdj8g9q
-          - name: ENVIRONMENT
-            value:
-              _default: production
-          - name: LAST_SLAVE_1_BIM
-            value:
-              _default: "1000000"
-          - name: HOST
-            value:
-              _default: http://backend-api-svc.documentations.svc.cluster.local:80
-          - name: FILE_STREAM_HOST
-            value:
-              _default: sarex.local.uralkali.com
-          - name: DOCUMENTATION_URL
-            value:
-              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
-          - name: WORKFLOW_URL
-            value:
-              _default: http://workflows-api-service.workflow.svc.cluster.local:8000/
-          - name: WORKSPACE_URL
-            value:
-              _default: http://backend-svc.workspaces.svc.cluster.local:80/
-          - name: BIM_API_URL
-            value:
-              _default: http://backend-svc.bim.svc.cluster.local:80/
-          - name: BIM_API_V2_URL
-            value:
-              _default: http://backend-svc.bim.svc.cluster.local:80/
-          - name: WORKSPACE_BUNDLE_VERSION
-            value:
-              _default: v1
-          - name: SYSTEM_LOG_URL
-            value:
-              _default: http://api-service.system-log.svc.cluster.local:80
-          - name: DJANGO_HOST
-            value:
-              _default: http://backend-svc.django.svc.cluster.local:80
-          - name: MARKS_PROCESSING_URL
-            value:
-              _default: http://marks-service:8000
-          - name: PUBLIC_LINK_HOST
-            value:
-              _default: https://document-link.sarex.local.uralkali.com
-          - name: NAMESPACE
-            value:
-              _default: documentations
-          - name: DJANGO_ORIGINATOR
-            value:
-              _default: docs_prod
-          - name: WORKFLOW_IMAGES_VERSION
-            value:
-              _default: master
-          - name: WORKFLOWS_IMAGES_VERSION
-            value:
-              _default: master
-          - name: S3_SERVICE_ACCOUNT
-            value:
-              _default: /vault/secrets/documentations-s3-account-json
-          - name: READ_WRITE_TIMEOUT_FILE_STREAM
-            value:
-              _default: 6h
-          - name: CACHE_DEFAULT_EXPIRATION
-            value:
-              _default: 60s
-          - name: ENABLE_SMTP
-            value:
-              _default: "True"
-          - name: ENABLE_MAILGUN
-            value:
-              _default: "False"
-          - name: CACHE_CLEANUP_INTERVAL
-            value:
-              _default: 60s
-          - name: ENABLE_AUTH_JWT_IN_URL
-            value:
-              _default: "false"
-          - name: ENABLE_SIGNATURE_IN_URL
-            value:
-              _default: "true"
-          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
-            value:
-              _default: "mock"
-          - name: USE_CACHE_IN_FILE_STREAMER
-            value:
-              _default: "0"
-          - name: VALKEY_ADDR
-            value:
-              _default: redis:6379
-          - name: VALKEY_HOST
-            value:
-              _default: redis
-          - name: VALKEY_PORT
-            value:
-              _default: "6379"

apps/documentations/uralkal/frontend.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: frontend
-  namespace: documentations
-spec:
-  values:
-    services:
-      frontend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null