iac/apps/bim/aero/bim-worker.yaml

---
# Воркер bimbackend. Крутит тот же образ и те же настройки, что api, —
# отличается только точкой входа (entrypoint_worker.sh) и отсутствием портов.
# Обоснования переменных не дублирую, они в bim-api.yaml.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bim-worker-sa
  namespace: bim
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: bim-worker
  namespace: bim
  labels:
    app: bim-worker
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: bim-worker
  template:
    metadata:
      labels:
        app: bim-worker
      annotations:
        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
        vault.hashicorp.com/agent-init-first: "true"
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-pre-populate-only: "true"
        vault.hashicorp.com/auth-path: auth/kubernetes
        vault.hashicorp.com/role: bim
        vault.hashicorp.com/agent-inject-secret-bim-db: secrets/data/apps/bim/postgres
        vault.hashicorp.com/agent-inject-template-bim-db: |-
          {{- with secret "secrets/data/apps/bim/postgres" -}}
          DB_HOST={{ index .Data.data "host" }}
          DB_PORT={{ index .Data.data "port" }}
          DB_USER={{ index .Data.data "username" }}
          DB_PASSWORD={{ index .Data.data "password" }}
          {{- end -}}          
        vault.hashicorp.com/agent-inject-secret-bim-rabbitmq: secrets/data/rabbitmq/apps/bim
        vault.hashicorp.com/agent-inject-template-bim-rabbitmq: |-
          {{- with secret "secrets/data/rabbitmq/apps/bim" -}}
          RABBIT_USER={{ index .Data.data "username" }}
          RABBIT_PASSWORD={{ index .Data.data "password" }}
          {{- end -}}          
        vault.hashicorp.com/agent-inject-secret-bim-s3: secrets/data/minio/apps/bim
        vault.hashicorp.com/agent-inject-template-bim-s3: |-
          {{- with secret "secrets/data/minio/apps/bim" -}}
          AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
          AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
          {{- end -}}          
        vault.hashicorp.com/agent-inject-secret-jwt-public: secrets/data/vault/common/rsa_keys
        vault.hashicorp.com/agent-inject-template-jwt-public: |-
          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
          {{ index .Data.data "public_key" }}
          {{- end -}}          
    spec:
      serviceAccountName: bim-worker-sa
      imagePullSecrets:
        - name: regcred
      containers:
        - name: bim-worker
          image: cr.yandex/crp3ccidau046kdj8g9q/bim-api:870965d1967cd761965029b0480884ab7fa7c951
          imagePullPolicy: IfNotPresent
          command: ["/bin/sh", "-ec"]
          args:
            - |
              set -a
              [ -f /vault/secrets/bim-db ] && . /vault/secrets/bim-db
              [ -f /vault/secrets/bim-rabbitmq ] && . /vault/secrets/bim-rabbitmq
              [ -f /vault/secrets/bim-s3 ] && . /vault/secrets/bim-s3
              set +a
              exec ./entrypoint_worker.sh              
          env:
            - name: JWT_PUBLIC_KEY_PATH
              value: /vault/secrets/jwt-public
            - name: FEATURE_ENABLE_JWT_AUTH
              value: "false"
            - name: FEATURE_ENABLE_SAREX_AUTH
              value: "false"
            - name: FEATURE_ENABLE_WORKSPACES
              value: "true"
            - name: FEATURE_ENABLE_GCLOUD
              value: "false"
            # Значение НЕ УДАЛЯТЬ, даже при выключенном флаге выше. settings.py
            # делает check_settings(): проходит по всем ключам ENV_FIELDS и
            # падает на первом же незаданном —
            #   Exception: ENV_VARIABLE NOT SET: GOOGLE_APPLICATION_CREDENTIALS
            # Флаги проверяются позже, до них дело не доходит. Файла по этому
            # пути нет и не будет: при FEATURE_ENABLE_GCLOUD=false его никто не
            # открывает, важно лишь наличие самой переменной.
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /etc/sarex/google-storage/service_account.json
            - name: FEATURE_ENABLE_S3
              value: "true"
            - name: S3_BUCKET
              value: sarex-media-storage
            - name: BIM_CURRENT_STORAGE
              value: s3
            - name: AWS_DEFAULT_REGION
              value: ru-central1
            - name: FEATURE_ENABLE_PROCESSING
              value: "1"
            - name: PROCESSING_API_URL
              value: http://backend-svc.processing.svc.cluster.local:80/internal
            - name: PROCESSING_C2M_VERSION
              value: stable
            - name: WORKSPACES_API_URL
              value: http://backend-svc.workspaces.svc.cluster.local:80/internal
            - name: COMPARATOR_API_URL
              value: http://comparator-api-service.comparator.svc.cluster.local/internal
            - name: BIM_API_EXTERNAL_HOST_SCHEMA
              value: https
            - name: BIM_API_EXTERNAL_HOST
              value: bim.sarex.local.lonsdaleites.ru
            - name: BIM_API_INTERNAL_HOST_SCHEMA
              value: http
            - name: BIM_API_INTERNAL_HOST
              value: bim-api-service.bim.svc.cluster.local:5555
            - name: WEBHOOK_URL
              value: http://bim-api-service.bim.svc.cluster.local:5555
            # В dsinv у воркера здесь rabbitmq-service.bim:5672 — брокера в
            # namespace bim нет ни там, ни здесь; у api в том же файле адрес
            # другой и правильный. Ставим общий брокер контура.
            - name: RABBIT_HOST
              value: rabbitmq.rabbitmq.svc.cluster.local:5672
            - name: RABBIT_VHOST
              value: "/"
            - name: MESH_OPTIMIZER_PATH
              value: gltfpack
            - name: DEBUG
              value: "0"
            - name: STORAGE_SEGMENT
              value: sarex-production-storage
            - name: STORAGE_PROJECT
              value: sarex-production
            - name: TMP_DIR
              value: /tmp
            - name: prometheus_multiproc_dir
              value: /tmp
            - name: BUNDLE_VERSION
              value: v1
            - name: DISABLE_INSTANCING
              value: "0"
          resources:
            requests:
              cpu: 25m
              memory: 200Mi
          volumeMounts:
            - mountPath: /tmp
              name: tmp-volume
      volumes:
        - name: tmp-volume
          emptyDir: {}