add prod infra

2026-08-05 18:31:00 +03:00 · 2026-01-30 16:19:32 +03:00 · 2026-01-30 16:19:32 +03:00 · 1f943ed404
commit 1f943ed404
parent 60636e8b34
3 changed files with 74 additions and 102 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -18,9 +18,11 @@ generate-pipeline:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "stage"'
+    - if: '$CI_COMMIT_BRANCH == "master"'
    - if: '$CI_COMMIT_BRANCH =~ /^feature\/.*/'

-trigger-downstream:
+# Stage environment
+trigger-downstream-stage:
  stage: trigger
  needs:
    - generate-pipeline
@ -41,7 +43,34 @@ trigger-downstream:
    S3_STATE_BUCKET: ${S3_STATE_BUCKET}
    AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
    AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
+    TARGET_ENV: "stage"
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "stage"'
    - if: '$CI_COMMIT_BRANCH =~ /^feature\/.*/'
+
+# Prod environment
+trigger-downstream-prod:
+  stage: trigger
+  needs:
+    - generate-pipeline
+  trigger:
+    include:
+      - artifact: .gitlab-ci.generated.yml
+        job: generate-pipeline
+    strategy: depend
+  variables:
+    TERRAFORM_IMAGE_NAME: cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.10
+    YC_SERVICE_ACCOUNT_KEY_FILE: ${YC_PROD_SERVICE_ACCOUNT_KEY_FILE}
+    YC_CLOUD_ID: ${YC_CLOUD_ID}
+    YC_STAGE_FOLDER_ID: ${YC_STAGE_FOLDER_ID}
+    YC_PROD_FOLDER_ID: ${YC_PROD_FOLDER_ID}
+    YC_PREPROD_FOLDER_ID: ${YC_PREPROD_FOLDER_ID}
+    S3_ACCESS_KEY: ${S3_PROD_ACCESS_KEY}
+    S3_SECRET_KEY: ${S3_PROD_SECRET_KEY}
+    S3_STATE_BUCKET: ${S3_PROD_STATE_BUCKET}
+    AWS_ACCESS_KEY_ID: ${AWS_PROD_ACCESS_KEY_ID}
+    AWS_SECRET_ACCESS_KEY: ${AWS_PROD_SECRET_ACCESS_KEY}
+    TARGET_ENV: "prod"
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "master"'
--- a/infrastructure.yaml
+++ b/infrastructure.yaml
@ -5,11 +5,7 @@ environments:
        labels:
          environment: stage
          project: pulse
-        annotations:
-          managed-by: terraform
-      - name: block-analyzer
-        labels:
-          project: block-analyzer
+          istio-injection: enabled
        annotations:
          managed-by: terraform

@ -23,7 +19,7 @@ environments:
        namespace: pulse
        type: s3
        dependencies:
-          bucket: pulse-stage
+          bucket: pulse-prod
        lifecycle:
          ignore_changes: false

@ -32,28 +28,12 @@ environments:
        namespace: pulse
        type: database
        dependencies:
-          cluster: "c9qa2coo5ukgcg93fldm"
+          cluster: "c9quu72dj2ibu8dk54q5"
          db: pulse_db
          user: pulse
        lifecycle:
          ignore_changes: true

-      - name: analyzer-postgresql-secret
-        namespace: block-analyzer
-        type: database
-        dependencies:
-          cluster: "c9qa2coo5ukgcg93fldm"
-          db: analyzer_db
-          user: analyzer
-        custom_keys:
-          sslmode: "verify-full"
-        random_keys:
-          full-host:
-            length: 32
-            special: false
-        lifecycle:
-          ignore_changes: true
-
      - name: session-secret
        namespace: pulse
        type: opaque
@ -80,83 +60,25 @@ environments:
      #     ignore_changes: false

    buckets:
-      - name: pulse-stage
-        acl: public-read
+      - name: pulse-prod
+        acl: private
        versioning:
          enabled: false
        cors:
-          enabled: true
-          allowed_headers: ["*"]
-          allowed_methods: ["GET", "PUT", "POST", "DELETE", "HEAD"]
-          allowed_origins: ["*"]
-          expose_headers: ["ETag"]
-          max_age_seconds: 3600
+          enabled: false
+  
  

    databases:
-      - cluster_id: "c9qa2coo5ukgcg93fldm"
+      - cluster_id: "c9quu72dj2ibu8dk54q5"
        database:
          name: pulse_db
+          extensions:
+            - pg_stat_statements
        user:
          name: pulse
          password_length: 32
          password_special: false
          conn_limit: 10
-      - cluster_id: "c9qa2coo5ukgcg93fldm"
-        database:
-          name: analyzer_db
-          extensions:
-            - pg_stat_statements
-        user:
-          name: analyzer
-          password_length: 32
-          password_special: false
-          conn_limit: 10
-          permissions:
-            - pulse_db
-            - attachments_db
-            - automation_db
-            - bi_db
-            - bim_db
-            - bimv2_db
-            - camera_db
-            - camunda_db
-            - checklists_db
-            - comparator_db
-            - comparisons_db
-            - contracts_db
-            - document-understanding
-            - documentations_db
-            - drawings_db
-            - eav_db
-            - flow
-            - ingrad-notifications
-            - inspections_db
-            - issues_db
-            - keycloak
-            - mailer_db
-            - mcc
-            - metrics
-            - mvp-agents
-            - notes_db
-            - orchestrator
-            - pm-backend
-            - processing_db
-            - remarks_db
-            - resources_db
-            - rfi_db
-            - sarex-management
-            - sarex-compute
-            - sarex_db
-            - srx-data-engine_db
-            - stage-sarex
-            - subscriptions_db
-            - superset_db
-            - system-log_db
-            - test_db
-            - transmittals_db
-            - workspaces_db
-            - zitadel
-            - zitadel-new
          

--- a/scripts/generate-pipeline.sh
+++ b/scripts/generate-pipeline.sh
@ -55,10 +55,25 @@ find live -name "terragrunt.hcl" -not -path "*/.terragrunt-cache/*" | sort | whi
    *) folder_var="YC_FOLDER_ID" ;;
  esac

+  # Определяем тег runner'а и правила в зависимости от окружения
+  if [ "$env" = "prod" ]; then
+    runner_tags="  tags:
+    - -prod"
+    branch_rules="    - if: '\$CI_COMMIT_BRANCH == \"master\"'
+    - if: '\$CI_PIPELINE_SOURCE == \"pipeline\" && \$TARGET_ENV == \"prod\"'"
+  else
+    runner_tags=""
+    branch_rules="    - if: '\$CI_PIPELINE_SOURCE == \"merge_request_event\"'
+    - if: '\$CI_COMMIT_BRANCH == \"stage\"'
+    - if: '\$CI_COMMIT_BRANCH =~ /^feature\\\\/.*/'
+    - if: '\$CI_PIPELINE_SOURCE == \"pipeline\" && \$TARGET_ENV == \"stage\"'"
+  fi
+
  cat >> "$OUTPUT_FILE" << VALIDATE_JOB
 validate-${job_prefix}:
  stage: validate
  image: \$TERRAFORM_IMAGE_NAME
+${runner_tags}
  variables:
    TG_ROOT: "${full_component_dir}"
    ENVIRONMENT: "${env}"
@ -72,10 +87,7 @@ validate-${job_prefix}:
    - terragrunt init -upgrade -reconfigure
    - terragrunt validate
  rules:
-    - if: '\$CI_PIPELINE_SOURCE == "merge_request_event"'
-    - if: '\$CI_COMMIT_BRANCH == "stage"'
-    - if: '\$CI_COMMIT_BRANCH =~ /^feature\\/.*/'
-    - if: '\$CI_PIPELINE_SOURCE == "pipeline"'
+${branch_rules}
  interruptible: true
  artifacts:
    paths:
@ -102,6 +114,7 @@ VALIDATE_JOB
 plan-${job_prefix}:
  stage: plan
  image: \$TERRAFORM_IMAGE_NAME
+${runner_tags}
  variables:
    TG_ROOT: "${full_component_dir}"
    ENVIRONMENT: "${env}"
@ -114,10 +127,7 @@ plan-${job_prefix}:
    - terragrunt init -upgrade -reconfigure
    - terragrunt plan -out=tfplan
  rules:
-    - if: '\$CI_PIPELINE_SOURCE == "merge_request_event"'
-    - if: '\$CI_COMMIT_BRANCH == "stage"'
-    - if: '\$CI_COMMIT_BRANCH =~ /^feature\\/.*/'
-    - if: '\$CI_PIPELINE_SOURCE == "pipeline"'
+${branch_rules}
  interruptible: true
  artifacts:
    paths:
@ -142,10 +152,24 @@ PLAN_JOB
    apply_before_script="cd live/${env}/namespace && terragrunt init -upgrade -reconfigure && cd ../s3 && terragrunt init -upgrade -reconfigure && cd ../database && terragrunt init -upgrade -reconfigure && cd ../secrets && ls -la"
  fi
  
+  # Apply rules в зависимости от окружения
+  if [ "$env" = "prod" ]; then
+    apply_rules="    - if: '\$CI_COMMIT_BRANCH == \"master\"'
+      when: ${when_clause}
+    - if: '\$CI_PIPELINE_SOURCE == \"pipeline\" && \$TARGET_ENV == \"prod\"'
+      when: ${when_clause}"
+  else
+    apply_rules="    - if: '\$CI_COMMIT_BRANCH == \"stage\"'
+      when: ${when_clause}
+    - if: '\$CI_PIPELINE_SOURCE == \"pipeline\" && \$TARGET_ENV == \"stage\"'
+      when: ${when_clause}"
+  fi
+
  cat >> "$OUTPUT_FILE" << APPLY_JOB
 apply-${job_prefix}:
  stage: apply
  image: \$TERRAFORM_IMAGE_NAME
+${runner_tags}
  variables:
    TG_ROOT: "${full_component_dir}"
    ENVIRONMENT: "${env}"
@ -158,10 +182,7 @@ apply-${job_prefix}:
    - terragrunt init -upgrade -reconfigure 
    - terragrunt apply -auto-approve
  rules:
-    - if: '\$CI_COMMIT_BRANCH == "stage"'
-      when: ${when_clause}
-    - if: '\$CI_PIPELINE_SOURCE == "pipeline" && \$CI_COMMIT_BRANCH == "stage"'
-      when: ${when_clause}
+${apply_rules}
  interruptible: true

 APPLY_JOB