90e684d0a9
flows, issues, pm and message-hub read ca.crt from a copy of the Kafka TLS secret in their own namespace instead of an inline PEM (flows) or a per-namespace kafka-ca-cert ConfigMap (issues, pm, message-hub). Mount paths and env names are unchanged. The secret must exist in each namespace before the pods restart.
150 lines
4.4 KiB
YAML
150 lines
4.4 KiB
YAML
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: celery
|
|
namespace: flows
|
|
spec:
|
|
values:
|
|
services:
|
|
celery:
|
|
deployment:
|
|
resources:
|
|
requests:
|
|
cpu: null
|
|
memory: null
|
|
deployment:
|
|
args:
|
|
_default:
|
|
- |
|
|
set -a
|
|
[ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
|
|
[ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
|
|
[ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
|
|
[ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
|
|
[ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
|
|
[ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
|
|
set +a
|
|
exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow
|
|
|
|
envs:
|
|
- name: LOG_LEVEL
|
|
value:
|
|
_default: "DEBUG"
|
|
|
|
- name: BASE_HOST
|
|
value:
|
|
_default: "https://sarex.local.uralkali.com"
|
|
|
|
- name: CELERY_QUEUE
|
|
value:
|
|
_default: "flow"
|
|
|
|
- name: EAV_HOST
|
|
value:
|
|
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
|
|
|
- name: DJANGO_HOST
|
|
value:
|
|
_default: "http://backend-svc.django.svc.cluster.local:80/api"
|
|
|
|
- name: PLANNING_HOST
|
|
value:
|
|
_default: "http://backend-service.pm.svc.cluster.local:80/api/pm/msp"
|
|
|
|
- name: PLANNING_USE
|
|
value:
|
|
_default: "True"
|
|
|
|
- name: DOCUMENTATION_HOST
|
|
value:
|
|
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
|
|
|
|
- name: DOCUMENTATION_EXTERNAL_HOST
|
|
value:
|
|
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
|
|
|
|
- name: ENABLE_ANALYTICS
|
|
value:
|
|
_default: "1"
|
|
|
|
- name: ENABLE_CELERY
|
|
value:
|
|
_default: "1"
|
|
|
|
- name: ENABLE_MAILGUN
|
|
value:
|
|
_default: "0"
|
|
|
|
- name: ENABLE_METRICS
|
|
value:
|
|
_default: "0"
|
|
|
|
- name: FROM_EMAIL
|
|
value:
|
|
_default: "sarex@sarex.local.uralkali.com"
|
|
|
|
- name: GATEWAY_URL
|
|
value:
|
|
_default: "http://pdm-api.documentations.svc.cluster.local:8080"
|
|
|
|
- name: RESOURCE_URL
|
|
value:
|
|
_default: "http://resources-service.resources.svc.cluster.local:8000"
|
|
|
|
- name: SERVICE_HOST
|
|
value:
|
|
_default: "https://sarex.local.uralkali.com/flows/api/v1"
|
|
|
|
- name: SMTP_HOST
|
|
value:
|
|
_default: "post.sarex.local.uralkali.com"
|
|
|
|
- name: CHECKLIST_HOST
|
|
value:
|
|
_default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
|
|
|
|
- name: SMTP_PORT
|
|
value:
|
|
_default: "587"
|
|
|
|
- name: SYNC_RESOURCE_ID
|
|
value:
|
|
_default: "1"
|
|
|
|
- name: TIMEOUT
|
|
value:
|
|
_default: "120"
|
|
|
|
- name: WORKFLOWS_HOST
|
|
value:
|
|
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
|
|
|
|
- name: WORKFLOWS_TIMEOUT
|
|
value:
|
|
_default: "60"
|
|
|
|
- name: DOCUMENTATION_TIMEOUT
|
|
value:
|
|
_default: "60"
|
|
|
|
# См. подробные комментарии в apps/flows/d8-ugmk-prod/backend.yaml.
|
|
- name: KAFKA_HOST
|
|
value:
|
|
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
|
|
|
secretEnvs:
|
|
- name: KAFKA_SSL_CERT
|
|
secretName:
|
|
_default: kafka-kafka-contour-tls
|
|
secretKey: "ca.crt"
|
|
|
|
podAnnotations:
|
|
_default:
|
|
vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
|
|
vault.hashicorp.com/agent-inject-template-flows-kafka: |-
|
|
{{- with secret "secrets/data/kafka/apps/flows" -}}
|
|
KAFKA_USERNAME={{ index .Data.data "username" }}
|
|
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
|
{{- end -}}
|