---
# Патч message-hub для контура УГМК.
#
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
# поэтому здесь продублирован весь набор из apps/message-hub/base/message-hub.yaml.
# podAnnotations — map, мержится по ключам, поэтому переопределён только
# agent-inject-template-message-hub-kafka; остальные берутся из base.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: message-hub
  namespace: message-hub
spec:
  values:
    services:
      backend:
        # base: production_24425472 от 15.02.2026 — 18 production-релизов назад.
        # Здесь актуальный production от 31.07.2026.
        image:
          name:
            _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_e8010fe4

        envs:
          - name: WORKER_TIMEOUT
            value:
              _default: "60"

          - name: PYTHONPATH
            value:
              _default: "src"

          - name: SETTINGS_MAX_RETRIES
            value:
              _default: "1"

          - name: SETTINGS_TOPICS
            value:
              _default: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod", "resources_updated": "iam.resource.updated.v2", "resources_deleted": "iam.resource.deleted.v2"}'
          - name: SETTINGS_VERIFY_SSL
            value:
              _default: "0"

          - name: SAREX_BASE_HOST
            value:
              _default: "http://backend-svc.pm.svc.cluster.local:8000"

          - name: PM_HOST
            value:
              _default: "http://backend-svc.pm.svc.cluster.local:8000"

          - name: EAV_HOST
            value:
              _default: "http://backend-svc.eav.svc.cluster.local:80"

          - name: ISSUES_HOST
            value:
              _default: "http://backend-svc.issues.svc.cluster.local:80"

          - name: CACHE_HOST
            value:
              _default: "redis.pm.svc.cluster.local"

          - name: CACHE_PORT
            value:
              _default: "6379"

          - name: CACHE_SSL
            value:
              _default: "0"

          - name: KAFKA_HOST
            value:
              _default: "kafka-kafka-contour.kafka.svc.cluster.local"

          - name: KAFKA_PORT
            value:
              _default: "9092"

          - name: KAFKA_SSL_CAFILE
            value:
              _default: "/usr/local/share/ca-certificates/kafka.crt"
          - name: KAFKA_SECURITY_PROTOCOL
            value:
              _default: "SASL_SSL"

        volumes:
          _default:
            - name: kafka-ca-cert
              mountPath:
                _default: /usr/local/share/ca-certificates/kafka.crt
              subPath:
                _default: kafka.crt
              readOnly:
                _default: true
              configMap:
                name:
                  _default: kafka-ca-cert
                items:
                  - key: kafka.crt
                    path:
                      _default: kafka.crt

        podAnnotations:
          _default:
            vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/pm
            vault.hashicorp.com/agent-inject-template-message-hub-kafka: |-
              {{- with secret "secrets/data/kafka/apps/pm" -}}
              KAFKA_USERNAME={{ index .Data.data "username" }}
              KAFKA_PASSWORD={{ index .Data.data "password" }}
              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
              {{- end -}}