0d6d6d826b
KAFKA_SASL_MECHANISM is read from auth.sasl_mechanism when the nested auth map exists and from the top-level sasl_mechanism otherwise, so the pods start both before and after kafka/apps/pm switches to creds delivered from the kafka-topics terraform stack.
111 lines
3.5 KiB
YAML
111 lines
3.5 KiB
YAML
---
|
||
# Патч message-hub для vad.
|
||
#
|
||
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
|
||
# поэтому здесь продублирован весь набор из apps/message-hub/base/message-hub.yaml.
|
||
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||
# agent-inject-template-message-hub-kafka; остальные берутся из base.
|
||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||
kind: HelmRelease
|
||
metadata:
|
||
name: message-hub
|
||
namespace: message-hub
|
||
spec:
|
||
values:
|
||
services:
|
||
backend:
|
||
deployment:
|
||
resources:
|
||
requests:
|
||
cpu: null
|
||
memory: null
|
||
envs:
|
||
- name: WORKER_TIMEOUT
|
||
value:
|
||
_default: "60"
|
||
|
||
- name: PYTHONPATH
|
||
value:
|
||
_default: "src"
|
||
|
||
- name: SETTINGS_MAX_RETRIES
|
||
value:
|
||
_default: "1"
|
||
|
||
- name: SETTINGS_TOPICS
|
||
value:
|
||
_default: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod", "resources_updated": "iam.resource.updated.v2", "resources_deleted": "iam.resource.deleted.v2"}'
|
||
- name: SETTINGS_VERIFY_SSL
|
||
value:
|
||
_default: "0"
|
||
|
||
- name: SAREX_BASE_HOST
|
||
value:
|
||
_default: "http://backend-svc.pm.svc.cluster.local:8000"
|
||
|
||
- name: PM_HOST
|
||
value:
|
||
_default: "http://backend-svc.pm.svc.cluster.local:8000"
|
||
|
||
- name: EAV_HOST
|
||
value:
|
||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||
|
||
- name: ISSUES_HOST
|
||
value:
|
||
_default: "http://backend-svc.issues.svc.cluster.local:80"
|
||
|
||
- name: CACHE_HOST
|
||
value:
|
||
_default: "redis.pm.svc.cluster.local"
|
||
|
||
- name: CACHE_PORT
|
||
value:
|
||
_default: "6379"
|
||
|
||
- name: CACHE_SSL
|
||
value:
|
||
_default: "0"
|
||
|
||
- name: KAFKA_HOST
|
||
value:
|
||
_default: "kafka-kafka-contour.kafka.svc.cluster.local"
|
||
|
||
- name: KAFKA_PORT
|
||
value:
|
||
_default: "9092"
|
||
|
||
- name: KAFKA_SSL_CAFILE
|
||
value:
|
||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||
- name: KAFKA_SECURITY_PROTOCOL
|
||
value:
|
||
_default: "SASL_SSL"
|
||
|
||
volumes:
|
||
_default:
|
||
- name: kafka-ca-cert
|
||
mountPath:
|
||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||
subPath:
|
||
_default: kafka.crt
|
||
readOnly:
|
||
_default: true
|
||
secret:
|
||
secretName:
|
||
_default: kafka-kafka-contour-tls
|
||
items:
|
||
- key: ca.crt
|
||
path:
|
||
_default: kafka.crt
|
||
|
||
podAnnotations:
|
||
_default:
|
||
vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/pm
|
||
vault.hashicorp.com/agent-inject-template-message-hub-kafka: |-
|
||
{{- with secret "secrets/data/kafka/apps/pm" -}}
|
||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||
KAFKA_SASL_MECHANISM={{ if .Data.data.auth }}{{ index .Data.data.auth "sasl_mechanism" }}{{ else }}{{ index .Data.data "sasl_mechanism" }}{{ end }}
|
||
{{- end -}}
|