264 lines
9.2 KiB
YAML
264 lines
9.2 KiB
YAML
---
|
||
# Отдельный процесс-консьюмер Kafka для issues (src/run_kafka_app.py, слушает
|
||
# eav_router — see kafka_app/consumers/eav_assets_consumer.py). В base этого
|
||
# сервиса нет вообще, аналогов в других контурах тоже — только для УГМК.
|
||
# Использует тот же образ/DB/S3-креды, что backend (django.setup() требует
|
||
# полный конфиг), плюс отдельно креды Kafka.
|
||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||
kind: HelmRelease
|
||
metadata:
|
||
name: kafka-app
|
||
namespace: issues
|
||
spec:
|
||
interval: 10m
|
||
|
||
chart:
|
||
spec:
|
||
chart: universal-chart
|
||
version: "0.1.9"
|
||
sourceRef:
|
||
kind: HelmRepository
|
||
name: yc-oci-charts
|
||
namespace: flux-system
|
||
interval: 10m
|
||
|
||
install:
|
||
remediation:
|
||
retries: 3
|
||
|
||
upgrade:
|
||
remediation:
|
||
retries: 3
|
||
|
||
values:
|
||
global:
|
||
env: _default
|
||
|
||
services:
|
||
kafka-app:
|
||
enabled: true
|
||
|
||
serviceAccount:
|
||
enabled:
|
||
_default: true
|
||
name:
|
||
_default: issues-vault
|
||
|
||
image:
|
||
name:
|
||
_default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa
|
||
pullPolicy:
|
||
_default: IfNotPresent
|
||
|
||
deployment:
|
||
enabled: true
|
||
|
||
name:
|
||
_default: kafka-app
|
||
|
||
replicaCount:
|
||
_default: 1
|
||
|
||
port:
|
||
_default: 8000
|
||
|
||
command:
|
||
_default: ["/bin/sh", "-ec"]
|
||
args:
|
||
_default:
|
||
- |
|
||
set -a
|
||
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
|
||
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
|
||
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
|
||
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
|
||
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
|
||
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
|
||
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
|
||
set +a
|
||
exec python3 run_kafka_app.py
|
||
|
||
resources:
|
||
requests:
|
||
cpu:
|
||
_default: 25m
|
||
memory:
|
||
_default: 128Mi
|
||
|
||
probes:
|
||
liveness:
|
||
enabled: false
|
||
readiness:
|
||
enabled: false
|
||
|
||
service:
|
||
enabled: false
|
||
|
||
imagePullSecrets:
|
||
enabled:
|
||
_default: true
|
||
name:
|
||
_default: regcred
|
||
|
||
volumes:
|
||
_default:
|
||
- name: production-configmap
|
||
mountPath:
|
||
_default: /src/config/settings/production.py
|
||
subPath:
|
||
_default: production.py
|
||
readOnly:
|
||
_default: true
|
||
configMap:
|
||
name:
|
||
_default: production-configmap
|
||
items:
|
||
- key: production.py
|
||
path:
|
||
_default: production.py
|
||
- name: kafka-ca-cert
|
||
mountPath:
|
||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||
subPath:
|
||
_default: kafka.crt
|
||
readOnly:
|
||
_default: true
|
||
configMap:
|
||
name:
|
||
_default: kafka-ca-cert
|
||
items:
|
||
- key: kafka.crt
|
||
path:
|
||
_default: kafka.crt
|
||
|
||
envs:
|
||
- name: ENVIRONMENT
|
||
value:
|
||
_default: "production"
|
||
|
||
- name: AERO_PUBLIC_HOST
|
||
value:
|
||
_default: "https://sarex.contour.infra.sarex.tech"
|
||
|
||
- name: AERO_HOST
|
||
value:
|
||
_default: "https://sarex.contour.infra.sarex.tech"
|
||
|
||
- name: BASE_AERO_URL
|
||
value:
|
||
_default: "https://sarex.contour.infra.sarex.tech"
|
||
|
||
- name: BASE_AUTH_URL
|
||
value:
|
||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||
|
||
- name: WORKFLOWS_HOST
|
||
value:
|
||
_default: "http://backend-svc.workflow.svc.cluster.local:80"
|
||
|
||
- name: WORKFLOWS_URL
|
||
value:
|
||
_default: "http://backend-svc.workflow.svc.cluster.local:80"
|
||
|
||
- name: RESOURCES_API_HOST
|
||
value:
|
||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||
|
||
- name: EAV_HOST
|
||
value:
|
||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||
|
||
- name: SAREX_API
|
||
value:
|
||
_default: "https://sarex.contour.infra.sarex.tech"
|
||
|
||
- name: DOCUMENTATIONS_URL
|
||
value:
|
||
_default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
|
||
|
||
- name: DJANGO_SETTINGS_MODULE
|
||
value:
|
||
_default: "config.settings.production"
|
||
|
||
- name: API_ADDRESS
|
||
value:
|
||
_default: "8000"
|
||
|
||
- name: KAFKA_HOST
|
||
value:
|
||
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||
|
||
- name: KAFKA_SSL_CAFILE
|
||
value:
|
||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||
|
||
- name: KAFKA_ISSUES_TOPIC
|
||
value:
|
||
_default: "issues_broadcast_prod"
|
||
|
||
- name: KAFKA_EAV_ASSETS_TOPIC
|
||
value:
|
||
_default: "assets_broadcast"
|
||
|
||
podAnnotations:
|
||
_default:
|
||
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
|
||
vault.hashicorp.com/agent-init-first: "true"
|
||
vault.hashicorp.com/agent-inject: "true"
|
||
vault.hashicorp.com/agent-pre-populate-only: "true"
|
||
vault.hashicorp.com/auth-path: auth/kubernetes
|
||
vault.hashicorp.com/role: issues
|
||
vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/apps/issues/postgres
|
||
vault.hashicorp.com/agent-inject-template-issues-db: |-
|
||
{{- with secret "secrets/data/apps/issues/postgres" -}}
|
||
DATABASE_PORT={{ index .Data.data "port" }}
|
||
DATABASE_HOST={{ index .Data.data "host" }}
|
||
DATABASE_USER={{ index .Data.data "username" }}
|
||
DATABASE_PASSWORD={{ index .Data.data "password" }}
|
||
DATABASE_NAME={{ index .Data.data "database" }}
|
||
{{- end -}}
|
||
vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues
|
||
vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |-
|
||
{{- with secret "secrets/data/rabbitmq/apps/issues" -}}
|
||
RABBITMQ_VHOST={{ index .Data.data "vhost" }}
|
||
RABBITMQ_USERNAME={{ index .Data.data "username" }}
|
||
RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local
|
||
RABBITMQ_PASSWORD={{ index .Data.data "password" }}
|
||
{{- end -}}
|
||
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
|
||
vault.hashicorp.com/agent-inject-template-issues-s3: |-
|
||
{{- with secret "secrets/data/minio/apps/issues" -}}
|
||
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
|
||
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
|
||
YC_S3_BUCKET_NAME=sarex-issues
|
||
YC_S3_ENDPOINT_URL=https://s3.uralmine.com
|
||
{{- end -}}
|
||
vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth
|
||
vault.hashicorp.com/agent-inject-template-issues-django-auth: |-
|
||
{{- with secret "secrets/data/vault/common/django_auth" -}}
|
||
DJANGO_TOKEN={{ index .Data.data "key" }}
|
||
SAREX_USERNAME={{ index .Data.data "username" }}
|
||
SAREX_PASSWORD={{ index .Data.data "password" }}
|
||
{{- end -}}
|
||
vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys
|
||
vault.hashicorp.com/agent-inject-template-issues-jwt-private: |-
|
||
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
|
||
{{ index .Data.data "private_key" }}
|
||
{{- end -}}
|
||
vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys
|
||
vault.hashicorp.com/agent-inject-template-issues-jwt-public: |-
|
||
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
|
||
{{ index .Data.data "public_key" }}
|
||
{{- end -}}
|
||
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
|
||
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
|
||
{{- with secret "secrets/data/kafka/apps/issues" -}}
|
||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||
{{- end -}}
|
||
|
||
commitSha: ""
|
||
gitlabUri: ""
|
||
gitlabJobUrl: ""
|
||
owner: ""
|