172 lines
6.5 KiB
YAML
172 lines
6.5 KiB
YAML
---
|
||
# Патч backend для контура УГМК — подключение к Kafka.
|
||
#
|
||
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
|
||
# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
|
||
# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
|
||
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||
# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
|
||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||
kind: HelmRelease
|
||
metadata:
|
||
name: backend
|
||
namespace: flows
|
||
spec:
|
||
values:
|
||
services:
|
||
backend:
|
||
deployment:
|
||
args:
|
||
_default:
|
||
- |
|
||
set -a
|
||
[ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
|
||
[ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
|
||
[ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
|
||
[ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
|
||
[ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
|
||
[ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
|
||
set +a
|
||
exec /opt/entrypoint.sh
|
||
|
||
envs:
|
||
- name: LOG_LEVEL
|
||
value:
|
||
_default: "DEBUG"
|
||
|
||
- name: BASE_HOST
|
||
value:
|
||
_default: "https://srx.wb.ru"
|
||
|
||
- name: CELERY_QUEUE
|
||
value:
|
||
_default: "flow"
|
||
|
||
- name: EAV_HOST
|
||
value:
|
||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||
|
||
- name: DJANGO_HOST
|
||
value:
|
||
_default: "http://backend-svc.django.svc.cluster.local:80/api"
|
||
|
||
- name: PLANNING_HOST
|
||
value:
|
||
_default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp"
|
||
|
||
- name: PLANNING_USE
|
||
value:
|
||
_default: "True"
|
||
|
||
- name: DOCUMENTATION_HOST
|
||
value:
|
||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
|
||
|
||
- name: DOCUMENTATION_EXTERNAL_HOST
|
||
value:
|
||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
|
||
|
||
- name: ENABLE_ANALYTICS
|
||
value:
|
||
_default: "1"
|
||
|
||
- name: ENABLE_CELERY
|
||
value:
|
||
_default: "1"
|
||
|
||
- name: ENABLE_MAILGUN
|
||
value:
|
||
_default: "0"
|
||
|
||
- name: ENABLE_METRICS
|
||
value:
|
||
_default: "0"
|
||
|
||
- name: FROM_EMAIL
|
||
value:
|
||
_default: "sarex@rwb.ru"
|
||
|
||
- name: GATEWAY_URL
|
||
value:
|
||
_default: "http://pdm-svc.documentations.svc.cluster.local:80"
|
||
|
||
- name: RESOURCE_URL
|
||
value:
|
||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||
|
||
- name: SERVICE_HOST
|
||
value:
|
||
_default: "https://srx.wb.ru/flows/api/v1"
|
||
|
||
- name: SMTP_HOST
|
||
value:
|
||
_default: "mail.rwb.ru"
|
||
|
||
- name: CHECKLIST_HOST
|
||
value:
|
||
_default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
|
||
|
||
- name: SMTP_PORT
|
||
value:
|
||
_default: "465"
|
||
|
||
- name: SYNC_RESOURCE_ID
|
||
value:
|
||
_default: "1"
|
||
|
||
- name: TIMEOUT
|
||
value:
|
||
_default: "120"
|
||
|
||
- name: WORKFLOWS_HOST
|
||
value:
|
||
_default: "http://backend-svc.processing.svc.cluster.local:80/api/v1"
|
||
|
||
- name: WORKFLOWS_TIMEOUT
|
||
value:
|
||
_default: "60"
|
||
|
||
- name: DOCUMENTATION_TIMEOUT
|
||
value:
|
||
_default: "60"
|
||
|
||
# Kafka — код (flow/kafka.py) ждёт KAFKA_HOST как единую строку "host:port"
|
||
# (не список!), KAFKA_SSL_CERT — сырое PEM-содержимое CA (не путь к файлу,
|
||
# cadata= в ssl.create_default_context). Хост/порт/CA — те же проверенные
|
||
# значения, что и у message-hub/pm (apps/message-hub/d8-ugmk-prod).
|
||
- name: KAFKA_HOST
|
||
value:
|
||
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||
|
||
- name: KAFKA_SSL_CERT
|
||
value:
|
||
_default: |
|
||
-----BEGIN CERTIFICATE-----
|
||
MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
|
||
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
|
||
NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
|
||
MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
|
||
h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
|
||
D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
|
||
tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
|
||
Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
|
||
GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
|
||
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
|
||
Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
|
||
A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
|
||
QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
|
||
KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
|
||
kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
|
||
TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
|
||
fdA17/ibw6gFrH2b3vZKcx8D455V
|
||
-----END CERTIFICATE-----
|
||
|
||
podAnnotations:
|
||
_default:
|
||
vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
|
||
vault.hashicorp.com/agent-inject-template-flows-kafka: |-
|
||
{{- with secret "secrets/data/kafka/apps/flows" -}}
|
||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||
{{- end -}}
|