From 8d12527af4a514aeef8d5e6128952085f8dbc7f5 Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Tue, 7 Jul 2026 17:10:06 +0300 Subject: [PATCH] ++ adopt prod --- .gitignore | 1 + README.md | 558 +++++++---- infrastructure-secrets.yaml | 240 +++++ infrastructure.yaml | 1390 ++++++++++++++++++++++---- live/prod/rabbitmq/terragrunt.hcl | 3 + live/prod/secrets/terragrunt.hcl | 56 ++ modules/k8s-secret/main.tf | 4 +- modules/kafka-topics-yc/outputs.tf | 19 + modules/kafka-topics-yc/variables.tf | 4 + modules/rabbitmq/main.tf | 44 +- modules/rabbitmq/outputs.tf | 15 +- modules/rabbitmq/variables.tf | 32 +- 12 files changed, 1924 insertions(+), 442 deletions(-) create mode 100644 infrastructure-secrets.yaml diff --git a/.gitignore b/.gitignore index 95c5d3e..28a5ebb 100644 --- a/.gitignore +++ b/.gitignore @@ -13,6 +13,7 @@ override.tf.json *_override.tf.json .terraformrc terraform.rc +.claude/ # Terragrunt .terragrunt-cache/ diff --git a/README.md b/README.md index af15dbf..7a02385 100644 --- a/README.md +++ b/README.md @@ -1,141 +1,125 @@ -# Terraform Infrastructure +# Terraform Infrastructure (stage) -Infrastructure as Code для управления ресурсами Yandex Cloud и Kubernetes. +Infrastructure as Code для управления ресурсами **Yandex Cloud** и **Kubernetes** окружения `stage`. +Всё описывается декларативно в одном файле `infrastructure.yaml`; секретные значения — в зашифрованном `infrastructure-secrets.yaml` (sops). Terragrunt читает конфиг и раскладывает по модулям. -## Структура +> TL;DR для «мне нужно задеплоить X»: см. раздел [Рецепты](#рецепты--как-завести-новую-сущность). + +--- + +## Содержание +- [Структура репозитория](#структура-репозитория) +- [Как это работает](#как-это-работает) +- [Сущности `infrastructure.yaml`](#сущности-infrastructureyaml) + - [namespaces](#namespaces) · [buckets (S3)](#buckets-s3) · [yc_service_accounts](#yc_service_accounts) · [databases](#databases) · [kafka](#kafka) · [rabbitmq](#rabbitmq) · [secrets](#secrets) +- [Секреты подробно](#секреты-подробно) +- [Секретные значения (sops)](#секретные-значения-sops) +- [Рецепты](#рецепты--как-завести-новую-сущность) +- [Запуск](#запуск) +- [CI/CD](#cicd) +- [Бэкап и откат](#бэкап-и-откат) +- [Траблшутинг](#траблшутинг) +- [Требования](#требования) + +--- + +## Структура репозитория ``` terraform/ -├── infrastructure.yaml # Конфигурация всех ресурсов (единый источник правды) -├── live/ # Terragrunt конфигурации по окружениям -│ ├── terragrunt.hcl # Общие настройки (backend, providers) -│ └── stage/ # Stage окружение -│ ├── env.hcl -│ ├── namespace/ -│ ├── database/ -│ ├── s3/ -│ └── secrets/ -└── modules/ # Terraform модули - ├── k8s-namespace/ # Создание Kubernetes namespaces - ├── k8s-secret/ # Создание Kubernetes secrets (с зависимостями) - ├── k8s-secrets/ # Простое создание secrets - ├── yc-database/ # PostgreSQL users и databases в Yandex Cloud - ├── yc-valkey-user/ # Valkey/Redis users в Yandex Cloud - └── yc-s3/ # S3 бакеты с изолированным доступом +├── infrastructure.yaml # ЕДИНЫЙ источник правды: все несекретные описания сущностей +├── infrastructure-secrets.yaml # sops-зашифрованные секретные значения (secret_values) +├── .sops.yaml # правило шифрования (age-recipient) +├── SOPS.md # как работать с sops-ключом и secret-values +├── Dockerfile # образ раннера: terraform + terragrunt + sops +├── .gitlab-ci.yml # родительский pipeline (генерит дочерний и триггерит) +├── scripts/generate-pipeline.sh# генератор дочернего pipeline по юнитам live/ +├── live/ +│ ├── terragrunt.hcl # root: S3 backend + генерация provider'ов +│ ├── provider.tf, backend.tf # сгенерированные (не редактировать руками) +│ └── stage/ +│ ├── env.hcl # параметры окружения stage +│ ├── namespace/ # юнит: k8s namespaces +│ ├── s3/ # юнит: S3 бакеты + YC service accounts +│ ├── database/ # юнит: PostgreSQL users/databases +│ ├── kafka-topics/ # юнит: Kafka topics/users/permissions +│ ├── rabbitmq/ # юнит: RabbitMQ vhosts/users/permissions/routing +│ └── secrets/ # юнит: k8s secrets (зависит от всех выше) +└── modules/ + ├── k8s-namespace/ # Kubernetes namespaces + ├── k8s-secret/ # Kubernetes secrets (основной, из outputs/random/явных значений) + ├── kafka-topics-yc/ # Kafka topics/users/permissions в YC Managed Kafka + ├── rabbitmq/ # RabbitMQ сущности через Management API + ├── yc-database/ # PostgreSQL users/databases + └── yc-s3/ # S3 бакеты с изолированным доступом ``` -## Принцип работы +Один «юнит» = одна папка в `live/stage/` со своим `terragrunt.hcl` и своим terraform-state +(`s3://tfstate-terragrunt-stage/stage//terraform.tfstate`). -### infrastructure.yaml +--- -Единый файл конфигурации для всех ресурсов. Структура: +## Как это работает +1. Ты правишь `infrastructure.yaml` (и при необходимости `infrastructure-secrets.yaml` через sops). +2. Terragrunt в нужном юните читает конфиг: `yamldecode(file(".../infrastructure.yaml")).environments.stage`. +3. Передаёт срез в соответствующий модуль как `inputs`. +4. `terragrunt plan/apply` создаёт/меняет ресурсы. State — в S3 (versioning включён). + +### Порядок применения (зависимости) + +``` +namespace ──▶ s3 ─┐ + database ─┤ + kafka-topics ─┼──▶ secrets + rabbitmq ─┘ +``` + +`secrets` зависит от outputs всех инфраструктурных юнитов (берёт оттуда хосты/пароли/ключи). +CI сам выстраивает `needs`; при ручном прогоне соблюдай порядок. + +--- + +## Сущности `infrastructure.yaml` + +Всё живёт под `environments.stage.*`. Ниже — по одному разделу на тип. + +### namespaces +Kubernetes namespaces (юнит `namespace`). ```yaml -environments: - stage: # Имя окружения - namespaces: # Kubernetes namespaces - - name: pulse - labels: {} - annotations: {} - - buckets: # S3 бакеты - - name: pulse-stage - acl: private - role: storage.uploader # опционально - versioning: - enabled: false - cors: - enabled: true - allowed_methods: [GET, PUT] - - databases: # PostgreSQL databases - - cluster_id: "xxx" - database: - name: mydb - extensions: [pg_stat_statements] - user: - name: myuser - password_length: 32 - conn_limit: 10 - - valkey_users: # Valkey/Redis users - - cluster_id: "xxx" - host: rc1a-example.mdb.yandexcloud.net - user: - name: myuser - permissions: - patterns: allkeys - pubSubChannels: allchannels - - secrets: # Kubernetes secrets - - name: my-secret - namespace: pulse - type: database # database | database_url | valkey | s3 | dockerconfigjson | opaque - dependencies: - cluster: "xxx" - db: mydb - user: myuser +namespaces: + - name: pulse + labels: { environment: stage } + annotations: { managed-by: terraform } ``` -### Terragrunt - -Terragrunt читает `infrastructure.yaml` и передаёт данные в модули: - -```hcl -locals { - infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml")) - env_config = local.infra_config.environments[local.env_name] -} - -inputs = { - buckets = local.env_config.buckets -} -``` - -### Порядок применения - -Модули имеют зависимости и применяются в порядке: - -``` -namespace → database / s3 / valkey-users → secrets -``` - -## Модули - -### yc-s3 - -Создание S3 бакетов с изолированным доступом. - -**Особенности:** -- Каждый бакет получает отдельный Service Account -- SA не имеет глобальных IAM ролей на storage на уровне folder -- Доступ к бакету через IAM binding (`yandex_storage_bucket_iam_binding`) -- SA может работать только со своим бакетом - -**Роли (Yandex Cloud IAM):** -- `storage.uploader` (default) — загрузка объектов -- `storage.viewer` — чтение объектов -- `storage.editor` — полный доступ - -**Пример:** +### buckets (S3) +S3-бакеты Yandex Object Storage с **изолированным** доступом (юнит `s3`, модуль `yc-s3`). +Каждый бакет получает отдельный SA с доступом только к нему (через `yandex_storage_bucket_iam_binding`). ```yaml buckets: - - name: my-bucket + - name: pulse-stage acl: private - role: storage.uploader # опционально + role: storage.uploader # storage.uploader(def) | storage.viewer | storage.editor + versioning: { enabled: false } + cors: + enabled: true + allowed_methods: [GET, PUT] + +yc_service_accounts: # доп. YC SA (не привязанные к бакету), опционально + - name: app-external-sa + description: External integration SA + folder_roles: [storage.viewer] + create_static_access_key: true ``` -### yc-database +### yc_service_accounts +Дополнительные YC Service Accounts с folder-ролями и (опц.) статическим ключом. Создаются в юните `s3`, +их данные доступны секретам типа `yc_sa`. -Создание PostgreSQL users и databases в существующем кластере. - -**Особенности:** -- Пароль генерируется автоматически -- Поддержка extensions -- Поддержка permissions на другие БД -- `ignore_changes` на password - -**Пример:** +### databases +PostgreSQL users и databases в существующем кластере YC (юнит `database`, модуль `yc-database`). +Пароль генерируется автоматически, на password стоит `ignore_changes`. ```yaml databases: - cluster_id: "c9qa2coo5ukgcg93fldm" @@ -146,129 +130,271 @@ databases: name: myuser password_length: 32 conn_limit: 10 - permissions: [other_db] + permissions: [other_db] # доступ к другим БД, опционально ``` -### yc-valkey-user +### kafka +YC Managed Kafka: **topics, users, permissions** (юнит `kafka-topics`, модуль `kafka-topics-yc`). +Кластеры описаны в `kafka_cluster_refs` (id/host/port/sasl/…); в сущностях ссылаешься по `clusterRef`. -Создание Valkey/Redis users в существующем кластере Yandex Cloud. - -**Особенности:** -- Пароль генерируется автоматически -- Поддержка ACL permissions -- `ignore_changes` на password - -**Пример:** ```yaml -valkey_users: - - cluster_id: "c9qa2coo5ukgcg93fldm" - host: rc1a-example.mdb.yandexcloud.net - port: "6380" - user: - name: myuser - password_length: 32 - permissions: - patterns: allkeys - pubSubChannels: allchannels - categories: "+@read +@write" - commands: "+GET -FLUSHALL" - sanitizePayload: sanitize-payload +kafka_cluster_refs: + stage: + cluster_id: c9qo2dr244cohj4amaia + host: rc1a-....mdb.yandexcloud.net + port: 9091 + sasl_mechanism: SCRAM-SHA-512 + security_protocol: SASL_SSL + default_partitions: 3 + default_replication_factor: 1 + +kafka: + topics: + - name: sarex.stage.myservice.events.v1 + owner: myservice # kafka-user, которому принадлежит топик + clusterRef: stage + partitions: 1 + replicationFactor: 1 + config: { cleanup.policy: delete, retention.ms: "604800000", min.insync.replicas: "1" } + deletionPolicy: orphan # orphan = не удалять топик при удалении из конфига + users: + # (A) НОВЫЙ юзер — пароль генерирует terraform (random_password): + - name: myservice + clusterRef: stage + permissions: + - topic: sarex.stage.myservice.events.v1 + roles: ["ACCESS_ROLE_PRODUCER"] # PRODUCER | CONSUMER | ADMIN + # (B) юзер, чей пароль берётся из существующего k8s-секрета (adopt/переезд): + - name: checklists + clusterRef: stage + passwordSource: { namespace: proc, secret: checklists-kafka-secret, key: password } + permissions: [] ``` +На kafka-юзере стоит `prevent_destroy` и `ignore_changes = [password]` (реальный пароль в кластере +не перезаписывается сгенерированным). -### k8s-secret - -Создание Kubernetes secrets с поддержкой зависимостей. - -**Типы секретов:** -- `database` — host, port, database, username, password, ca.crt -- `database_url` — database_url в формате postgresql+asyncpg -- `valkey` — cert, host, login, password, port, url -- `s3` — access_key, secret_key, bucket, endpoint -- `dockerconfigjson` — credentials для container registry -- `opaque` — произвольные данные - -**Особенности:** -- Автоматическое получение данных из database/s3 модулей -- Поддержка `random_keys` для генерации паролей -- Поддержка `custom_keys` для статических значений -- `ignore_changes` для предотвращения перезаписи - -**Пример:** +### rabbitmq +RabbitMQ через провайдер `cyrilgdn/rabbitmq` (юнит `rabbitmq`, модуль `rabbitmq`): vhosts, users, +permissions, topic_permissions, exchanges, queues, bindings, policies. Требует доступ к Management API +кластера (обычно только с CI-раннера). ```yaml -secrets: - - name: my-db-secret - namespace: pulse - type: database - dependencies: - cluster: "c9qa2coo5ukgcg93fldm" - db: mydb - user: myuser - random_keys: - session_key: - length: 32 - special: false - lifecycle: - ignore_changes: true +rabbitmq: + policy: { allow_delete: false } + vhosts: [ { name: app_stage } ] + users: [ { name: app, tags: [], password_length: 32 } ] + permissions: + - { vhost: app_stage, user: app, configure: ".*", write: ".*", read: ".*" } + exchanges: [ { vhost: app_stage, name: app.events, type: topic, durable: true } ] + queues: [ { vhost: app_stage, name: app.events.q, durable: true } ] + bindings: + - { vhost: app_stage, source: app.events, destination: app.events.q, destination_type: queue, routing_key: "#" } + policies: + - { vhost: app_stage, name: ttl, pattern: ".*", apply_to: queues, priority: 0, definition: { message-ttl: 86400000 } } ``` -### k8s-namespace +### secrets +Kubernetes secrets (юнит `secrets`, модуль `k8s-secret`). Подробно — ниже. -Создание Kubernetes namespaces. +--- -**Пример:** +## Секреты подробно + +Секрет описывается в `secrets:` и собирает `data` из одного или нескольких источников. +Ключ секрета для оверрайдов/импорта = `resource_key` (если задан) иначе `name`. + +**Типы (`type`)** и их «дефолтные» поля (когда `credential_keys` не заданы — берутся все): +| type | откуда data | +|--------------------|-------------| +| `database` | host, port, database, username, password, ca.crt (из database-модуля) | +| `rabbitmq` | host, hostname, port, vhost, user, username, password, uri, management_endpoint | +| `kafka` | host, hostname, port, username, user, password, sasl_mechanism, security_protocol, bootstrap_server(s), bootstrap_servers_json | +| `s3` | access_key, secret_key, bucket, endpoint | +| `yc_sa` | access_key, secret_key, service_account_id, endpoint | +| `dockerconfigjson` | `.dockerconfigjson` из `DOCKER_REGISTRY_USERNAME/PASSWORD` | +| `opaque` | только из custom/constant/random/secret_values | + +**Способы наполнить `data`** (можно комбинировать, если не используется `secret_values`): +- `dependencies` + (опц.) `credential_keys` — тянуть значения из outputs kafka/rabbitmq/database/s3. + `credential_keys` = `{ имя_ключа_в_секрете: имя_поля_источника }`, позволяет переименовать/выбрать подмножество. +- `random_keys` — сгенерировать значения (random_password), напр. токены/сессии. +- `custom_keys` — **несекретные** статические значения прямо в yaml (host, url, флаги). +- `constant_keys` — значения из общих `constants` (`kafka_ca`, `postgres_ca`, `postgres_port`, `s3_endpoint`). +- `secret_values` (sops) — **секретные явные значения** 1:1 (см. ниже). Оверрайд на весь секрет. + +**Пример (kafka-секрет с выбором и переименованием полей + CA из constants):** ```yaml -namespaces: - - name: pulse - labels: - environment: stage - annotations: - managed-by: terraform +- name: cde-api-kafka-secret + namespace: documentations + type: kafka + dependencies: { kafka_ref: stage, kafka_user: pdm-outbox-relay } + credential_keys: + host: host + port: port + username: username + password: password + sasl_mechanism: sasl_mechanism + security_protocol: security_protocol + constant_keys: { ssl_cafile: kafka_ca } ``` -## Использование +**`lifecycle.ignore_changes: true`** — терраформ управляет ресурсом, но не сверяет `data` +(используется для секретов, которые наполняет кто-то ещё, напр. helm). -### Локальный запуск +**`adopt: true`** — существующий, созданный руками секрет заводится под управление terraform +**1:1 как есть**: его текущая `.data` берётся из `infrastructure-secrets.yaml` (secret_values) и +не меняется. См. [Рецепты](#взять-существующий-секрет-под-terraform-adopt-11). +--- + +## Секретные значения (sops) + +Секретные значения **не хранятся** в `infrastructure.yaml`. Они лежат в зашифрованном +`infrastructure-secrets.yaml`: +```yaml +environments: + stage: + secret_values: + : + : # base64 = как в k8s .data +``` +- Шифрование: `.sops.yaml` → age-recipient (тот же, что в `terraform-contour`). Приватный ключ — + в CI-переменной `SOPS_AGE_KEY` (в репу не коммитится). Подробности и команды — в [SOPS.md](SOPS.md). +- В CI job'ы `*-secrets` делают `sops --decrypt` во временный файл и передают путь через + `INFRA_SECRET_VALUES_FILE`. Локально terragrunt расшифровывает сам, если доступен `SOPS_AGE_KEY`. +- Если для `resource_key` есть запись в `secret_values` — вся `data` секрета берётся оттуда + (computed/random по этому секрету игнорируется). Это и «adopt как есть», и «полностью явный секрет». + +Редактировать: `sops infrastructure-secrets.yaml`. Зашифровать заново после ручной правки: +`sops -e -i infrastructure-secrets.yaml`. **Расшифрованный файл никогда не коммитить** (в `.gitignore`). + +--- + +## Рецепты — как завести новую сущность + +### Новый namespace / bucket / database / kafka-topic / rabbitmq-vhost +1. Добавь запись в соответствующий раздел `infrastructure.yaml` (см. примеры выше). +2. `plan` → `apply` соответствующего юнита (или через CI). + +### Новый kafka/rabbitmq пользователь (пароль генерит terraform) +1. Добавь в `kafka.users` / `rabbitmq.users` **без** `passwordSource` → terraform создаст `random_password`. +2. Заведи секрет с этим юзером, чтобы приложение получило креды (см. следующий рецепт). + +### Секрет с динамически сгенерированными паролями +```yaml +- name: my-secret + namespace: myns + type: opaque + random_keys: + password: { length: 32, special: false } + token: { length: 48 } +``` +`adopt` не нужен. Значения сгенерируются и сохранятся в state. + +### Секрет из инфраструктуры (kafka/rabbitmq/db/s3) +```yaml +- name: my-kafka-secret + namespace: myns + type: kafka + dependencies: { kafka_ref: stage, kafka_user: myservice } + # credential_keys опционально — если нужно подмножество/переименование +``` + +### Секрет с чётко указанными полями +- Несекретные поля → `custom_keys` в `infrastructure.yaml`. +- Секретные поля → в `infrastructure-secrets.yaml`: + 1. `sops infrastructure-secrets.yaml` + 2. добавь `environments.stage.secret_values..: ` + (`printf '%s' 'значение' | base64`) + 3. заведи сам секрет в `infrastructure.yaml` (`type: opaque`, тот же `resource_key`/`name`). +> Нюанс: `secret_values` перекрывает **всю** `data` секрета. Смешать «часть из outputs + одно явное +> секретное поле» одним `secret_values` нельзя — нужен либо `custom_keys` (если не секрет), +> либо доработка модуля (merge-режим). + +### Взять существующий секрет под terraform (adopt 1:1) +1. Захвати текущую `.data` из кластера (base64 берётся как есть): + ```bash + kubectl --context yc-sarex-stage -n get secret -o jsonpath='{.data}' + ``` +2. Впиши значения в `infrastructure-secrets.yaml` под `secret_values.` и `sops -e -i`. +3. В `infrastructure.yaml` добавь секрет с `adopt: true` (генерация import-блоков — в + `live/stage/secrets/terragrunt.hcl`). +4. `plan` → ожидаемо `import, 0 change` по data. + +--- + +## Запуск + +### Локально ```bash -cd terraform/live/stage/s3 +# окружение (см. также «Траблшутинг» про формат .env со встроенным SA-ключом) +export S3_ACCESS_KEY=... S3_SECRET_KEY=... +export YC_SERVICE_ACCOUNT_KEY_FILE=/path/to/sa-key.json # ключ SA (файл или JSON-содержимое) +export YC_STAGE_FOLDER_ID=... +export KUBECONFIG=$HOME/.kube/config +export KUBE_CONTEXT=yc-sarex-stage # ВАЖНО: иначе возьмётся текущий контекст (часто prod!) +export SOPS_AGE_KEY='AGE-SECRET-KEY-...' # для расшифровки secret_values + +cd live/stage/ terragrunt init terragrunt plan terragrunt apply ``` +> `rabbitmq` и `secrets` требуют сетевого доступа к кластеру/RabbitMQ Management API — с локальной +> машины план этих юнитов может не подняться (нет доступа к in-cluster RabbitMQ). Прогоняй в CI. -### Применение всех модулей +### Провайдеры/бэкенд +- State: S3 `tfstate-terragrunt-stage`, ключ `stage//terraform.tfstate` (versioning включён). +- Бакет без SSE и не поддерживает часть AWS-проверок → в `live/terragrunt.hcl` стоят + `skip_bucket_ssencryption`/`skip_bucket_versioning`/… (не убирать `skip_bucket_ssencryption`). -```bash -cd terraform/live/stage -terragrunt run-all plan -terragrunt run-all apply -``` - -### Переменные окружения - -```bash -export YC_TOKEN="..." # IAM токен (или YC_SERVICE_ACCOUNT_KEY_FILE) -export YC_CLOUD_ID="..." -export YC_FOLDER_ID="..." # Default folder -export YC_STAGE_FOLDER_ID="..." # Stage folder (опционально) -export KUBECONFIG="~/.kube/config" -export KUBE_CONTEXT="stage" -export S3_ACCESS_KEY="..." # Для terraform state -export S3_SECRET_KEY="..." -export DOCKER_REGISTRY_USERNAME="..." # Для dockerconfigjson secrets -export DOCKER_REGISTRY_PASSWORD="..." -``` +--- ## CI/CD -Pipeline автоматически: -1. Читает изменённые файлы -2. Определяет затронутые модули -3. Запускает `terragrunt plan` / `terragrunt apply` +- `.gitlab-ci.yml` (родительский): job `generate-pipeline` вызывает `scripts/generate-pipeline.sh`, + который по папкам `live/**/terragrunt.hcl` генерит дочерний pipeline (validate → plan → apply на юнит), + затем `trigger-downstream` его запускает. +- Образ раннера: `cr.yandex/.../terraform/terragrunt:v9.11` (terraform 1.5.7 + terragrunt 0.93.11 + sops), + собирается из `Dockerfile`. **Сейчас пересобирается вручную** (`docker build --platform linux/amd64 …` + + `docker push`); тег задаётся в `.gitlab-ci.yml`. +- Секреты в CI (переменные): `S3_ACCESS_KEY/SECRET`, `YC_*_FOLDER_ID`, `YC_SERVICE_ACCOUNT_KEY_FILE`, + `SOPS_AGE_KEY`, `DOCKER_REGISTRY_*`, `SAREX_REGISTRY_KEY` (для пуша образа). +- `apply` — ручной (manual) в pipeline. + +--- + +## Бэкап и откат + +Перед массовым `apply` (особенно adopt) делай бэкап: +- **k8s-секреты**: `kubectl ... get secret -o yaml` → файл (для отката `kubectl apply -f`). +- **state**: `aws --endpoint-url=https://storage.yandexcloud.net s3 cp s3://tfstate-terragrunt-stage/stage//terraform.tfstate ./backup/`. +- **versioning бакета включён** → предыдущую версию state можно достать через + `aws s3api list-object-versions … / get-object --version-id …`. + +Откат данных секрета: `kubectl --context yc-sarex-stage apply -f .yaml`. + +--- + +## Траблшутинг + +- **`error checking if SSE is enabled for AWS S3 bucket … 404`** — свежий terragrunt проверяет SSE + бакета стейта, которого у Object Storage нет. Лечится флагами `skip_bucket_ssencryption`/`…` в + `live/terragrunt.hcl` (уже стоят). Не удаляй их. +- **secrets plan показывает `N change` с `~ data`** — не подгрузились `secret_values` + (нет `SOPS_AGE_KEY`/`INFRA_SECRET_VALUES_FILE`) → модуль ушёл в computed. Проверь ключ sops. +- **`+ wait_for_service_account_token = true`** на импортируемых секретах — служебный флаг провайдера, + к данным отношения не имеет; в модуле выставлен `false`, чтобы не шуметь. +- **kubectl берёт не тот кластер** — задай `KUBE_CONTEXT=yc-sarex-stage` (дефолтный контекст часто prod). +- **`.env` со встроенным SA-ключом** — если локальный `.env` держит JSON SA-ключа инлайном после + `YC_SERVICE_ACCOUNT_KEY_FILE=`, `source .env` сломается: вынеси JSON в отдельный файл и укажи путь. +- **Дрейф версий образа** — версия terragrunt/terraform в `Dockerfile` должна совпадать с тем, что + реально в теге образа; расхождение уже ломало init (SSE-проверка). Держи их синхронно. + +--- ## Требования -- Terraform >= 1.0 -- Terragrunt >= 0.45 -- Yandex Cloud провайдер ~> 0.100 -- IAM токен с правами `storage.admin` для создания бакетов и bucket policy +- Terraform 1.5.7 / Terragrunt 0.93.x (в образе); OpenTofu локально не резолвит провайдер `yandex`. +- Провайдеры: `yandex-cloud/yandex`, `hashicorp/kubernetes`, `hashicorp/random`, `cyrilgdn/rabbitmq`. +- `sops` + age-ключ (`SOPS_AGE_KEY`) для secret_values. +- Доступ: S3 (state), YC SA-ключ, kubeconfig на `yc-sarex-stage`, RabbitMQ Management API (для юнита rabbitmq). diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml new file mode 100644 index 0000000..124ec4e --- /dev/null +++ b/infrastructure-secrets.yaml @@ -0,0 +1,240 @@ +environments: + prod: + secret_values: + ams-kafka-secret: + kafka-bootstrap-servers: ENC[AES256_GCM,data:eFBt5EdjTt5LmD/3TxgA1/RZQ/kWxexGpqx55BDwkucHKCQ4+MY2ypdsDeH/u03VnsWyNR/tnrbzWJoHv0MzaGlDqaU=,iv:a933adllp4qVtGkayoiEOnEsMF9lor1ktUomkGKRZiY=,tag:5Ei7tE7eFLKgWG9Yz3Tlqg==,type:str] + kafka-ca-file: ENC[AES256_GCM,data:iKHPJJ/DAuxh090Vtf5tm0hIJoFVvBhWzRBmKVbWAmYR3QR4IV8xFxJCmpyS9ms1Yq8/gmsHDBHrY2QuYridDRAVypwj6Hfq,iv:WEhLgHivbCtYqwwgK3tONU+JUxTO0qvPR75H9NaAY+c=,tag:BxPEEVFIYqOAZ9Hddu94MA==,type:str] + kafka-password: ENC[AES256_GCM,data:e9xd0A6kB75qrlZcMoQrjVjhMuKdHx0JEZMhp1FPmS7BIa4q/ls3OOo6f6c=,iv:l/uNcODHEi/9+DqO9ZCGsNgPMB4TppJFd0MvEZ3P8sg=,tag:6GIZB9EbkTPdXeaA0YSN+Q==,type:str] + kafka-username: ENC[AES256_GCM,data:BzvrWPLmKuHUQIiF,iv:YUK1lgr1sVMCV+UejLxHwm4UpzqRNffPZqBGhdIcM3Q=,tag:aYb/amrEF0DYQbDstJs+yQ==,type:str] + checklists-kafka-secret: + cert: ENC[AES256_GCM,data:RUmN+H2YfcIUyAReGjtmv8UVUl3Fm8OudCZH5yOnvrJixeBUI0LuweGCvLBy9cFpRQaCnKwC9d8yNbG0m61LdLVXRAz4o0JzlSaMguEV44Y1Z/rfzFamfwCXujOTk0drzlA+ag2TDM09oR4T3m4vV/icQUtTlaiJxLhryR1aPMCD7wxhcWewyWV9I7l3HHvOh/tKTan2wuisOhnVctnbyPPxs+GHt3+Eg9AFPJLsLXXmVWjJuPyTelZ6PB33g8ch1uet8qodA1lMfhTiRt/rrol8euoWOLtEnpXwd/34OOw+9i2RR8zJG6359/lZMs1hzhRX//+u2v5ldn+A5BChh5UA3U70KoxCiFngTG2lIW85QKKi3rRMkzATpYct29sA/dCdAZs/Kwh0bU8w8FsnaIxuyDY8Lh2pLeX9VWhl7h9E9kaumNYz+TAW22yln2SMhzvDAaPMKoAy5v3s3ifkJzYlI5vT11ViPFeysDFJMEi7Cz738nOxR//r+YocduAgMkK13vXQ2znOT1avohCDFa+xYircAfY13tRa1kGMGfgwmE9cTkyfpan6kIJ0xkTlSmaPweSP0dYJBfnl/ugolf/b3fGhSjx7yz+w1suD99lhrol+Rq8Q+f1tQxWt6HWbGU6oiVmBSKcGNN8sI/fpYMA/9i9LKMks5IedovljUZVZjSDDi94OWR+5JQBmCbxXfFnViZ0wInps6lczdNf+1f5gfKzNtXLsWMtWR7Pf0j/Os4gTKlWA4wjlfu141iM7afH/muRD/hBcbpEzsp89qLb5TpthBdxBZdtldzh/895LaTm4I1pq5PnV+6VYh3eQLaf8b7xVRGgPMKRIn2nPNOjo7Hlo3r4iNa9ZS3Upw+1omffVA7xiIuSHp0T+TKs3MMIVPRmw6R0jDhMI7NWjHQmCEX8iDRd0k3n9TTmfOw+xHGv/X8rCUnnzhllkZRcULXXg3iHOb2QqfIUtlAVHYmDUYqRw5VeaFQTuLQgXSC2r2/0EJE3ed/2zQ0SaGHjJSDnxG1aozm+/xaQMiI0QdXtSDHjCFKYPS3X9aXmxbptE82JQNLVZX0FMAd5jZJV0DLFqsnPWPoeSaUwZ/3r3aXMywUTzdp+t+KtDN0eZOiuJfczsB30j+jKSXi2Iw4V/eM/jdR5OR7tno/kjuqYLMGzS6RMBIChEJbqPuOB70ni2s82cJF5cj5NoOELSiWYU41OTDKJdx7JEUR8i1IPDBYJjE8t3PC/9HvvgJ4mkEkg8pd3IL34S26MolcOZ/clnIikwF9S4K+z5QvU5MI2oBEiPdRuMg1NUT4/tZyKg3muMAZ1zgYkh2iMJUhhP8FbAYF8bzKPVP/YexUnlgceBSRqmZ47VZ/fnYOBOBmnwLqdmF5rSZ38x9TW937cpHUYYy7xT5agGIdybGnAu1YQmf7+2jI1OhHhnOfzRT+at9925j8HETqOc7fz/ECvzePdw2+N2GsRzRQIz4u8YCtPCuzKkYXNXwchVUed8qJBRF/TYkdN2MDNZ1/8SsEWrng0FnT9/fCaRlZnGfjVswrSBuGCR8D13AaD9UFY4TLaqjmVW3KoOtpshE01vYyphaq+lZUOl/nG7GWWMPX1pYVn6ZCyRxzR+0A1kRr9PZkN692KWhRE8xIdfhE92fVPRJELe1bgF6Y1hukrHUs5iXTcINUPbq7S1hqGkazm0T2HOzh4AUAEQkw/q5lxXxohCfa648eVFU2PFQcgmdB09zXyaas9h3U8gbvFTLDWQevNrxtFte6CU4+SdDKsEz8GspGPDLFlM47hejj1txL0530zw24xAaso86Mok5IPXOcOeT/v7SKUmE2syZLl49mVV4G99N68h/nBwRnttPBAjIwQGR1czbSL+cIWV14y4lzE2HxEBbWFE48nelpDgBHvQm1rGODTWTUdxE1DBT2dgMxdpkylHQAZV9bl7ttgfI5n7rQAK/q0mPMIe2AlPrmDllrnb2pEYsNuLG/HoNt0IZYtZsoLGGViEQzrgqKYO0HTyoJS98uTcLLa6pQ9IsfT+gs9nqm1AUK9sTV3w7MoeKnR9pYWZQNu3kwBURb2jJjifcDmTOcx5jhSH183rAa/3j0eQDsFPppcNmpOoXj6g9N87qg3x7LQI7Bt3gOr/yqYcX8DLigQvEnPFJliPJ8C+7J40QPeAspNCnTaEkUl11CgfyDJu5D/IzffaZ292UA6bSSfDatAA+r8yaFSfPq/VMO/ByC00K/v3cWMBW78Y4qTl5pz8TdfOZuiJnh06RHArOCm1/zVUhwaCM5Wvm95gFtAPM86GXqCex2A1Y39l6Uf8VQN8IkxyxnCqnH19jXvQn904ryvK+uXF9OHjBnUINvf9FAL7OCE86vR5zuOtCOsg/ZP30wmYc71n9YCFoh5yGhFGIed5DMQujg9sDe2gfSnjasrtD48C+rqU191+qb3hYz4lMkMB7SrsSyShMZro2KsQnh+KhhA0zocQmF+SF7EKxL0M3WdudIlbBL8qKRH2/mT1oxO6nrNziZBDBk9u1Fk39XHjZAn9jmfXCnwLHWaXT/YmIwgJIQBJmeaE78FhqQZ0+x62QoAqopV4xMwg3zPRdDo1XpjkwSW0Eo5qT7HE6z8X6FYLbUqZLtWhDatslmYHoYZg+SimtgPkLQQA0JC4jCls7Iny6ma/y1bXwgyzJoKcA8f3ycDsFm3n8L8PVtdGbyTpDngq+g/0sIqLt2BYEMTd/f81HRbKuUKUiHgM1VElXkJgNxDfnqOSBovtkMkCOkWolC86DyIx823xE3c+kCUytfE0EJNcQZcwyrpLe/YoUFK/Vlcx9Zwcx/G6xqBunzBc1mPtfSpSllZ7kp7KzjGHLf4q21LMiREfVCMiZP7zh6p9kvPpwvBqhnJHSV9eUHz9Af4bJ7Au3VPi1CXcXQZdBMmjIjkRSQwK6fbI5Bj70bN3P9N3hBXIPL+fAJRw7I5y5HQXCIp3nZwCdFtsoLk/Pcew7BCJ5MDcumBM4p8eKD5EP2QZNIrnpt2wg6k1ywDK1NFm4r+RLhpUlX6xeCDVQaX/9Ro+YFrafB4v52+Ef4SX/aedc7JO8lWz9AfRox8U/9JhEOZhjA+RVmoflo1l9NojIDx0oQ3uY1MRpNDDVx7EGiEV9/E2tLyutScezEqowj3ie9GcnlpNExPr5gObetrq60YIs/PZ2pUQk3NzBPzqDKOcjr1pUyMmZS4jupi1u1h2G/b77uioCXd2PdG1TabvsCmbgNrFlYd7N3qrhNkODehcIyo24WLg92wV1TE65EIGXC5jJrLJxMzDSVsPip3mOEEOdzhVQk+Im0G3/3g7ZjrSObqGbIjjvsMS4Ub1UptiWfgjMU38ZMYAn2pip5eJzZOq/6822hixOEXhkMDWYOtz/t3Z9SfdfxsCm9VuUpQYuJmwNArbOpPXFntmM4Vqhz2SbZesv6/fegzEdFd0JB1jpDB5pZlrSV+9CvcnKu2qi4cexB5HqYnftE0EONrUlvzVxr5HfkIx4GkHE0gZoTSrWCu3cvQiXaG1DjIK31z7ZAqEBKdFlrlLBFiN3FKWauXyhe7x+rfuN5Vj8zc4dE0cbP3+VROQl4fjUQyolv39NiMehSb/cYgdFmbBozJpCQRjqOAygdrVcNURu31LRn8ZfntECq3ktjXn/mMy8c9eNFwB4YBdm0w+bJ34JtpDmAewdgB5cD4oryzfCqKkBBJsy0+YqH1BizcugLqI1WlP0VkTAuTkdepz/vhZuLkLfaaeX3k84E+1pg+gPaRc7VrNon3d69w6K2Wddk7kXbpLxSPLwHxDdhn7hZwxR5PMTmwB2+e/g03cEJCqYs3aIvKAq3L3sxY+WAqD9UnWwky/N4wN6Tf7uQcdvoUuNHIG5SDEX9zJ6D8tdZg0TCyTH9FxJxC03k2r1kYI0uBv7d/WCtbo4UyOtMLmCwdbXdu8pVmLovxZAkBDHZ2KC7unC7TTkvoAG9psUO0VE0tO2taWier6ac11V6fDIdcD6nNzRzboL9u6HO5ez5uMfbhE9kgk8XdkW7KFBUh0wwl8A1XVcFQRP0gVouAsSB13I83nUOk0pd6iatTSU5R8DEqtTLrPofQHDmPeNUIomql8qDhzOLF2r4HnLH0IxAqB7nh0wtuk86JOWQykdWjr83At+J2Eo/17xBpR2+730GpukHyIsb9HIUTL2od9MGdegMVJLecMsWxC+W2Ih8tVKV0kblHHsNfIHewQjcv3HzYV5GBm2j0twkc1krdg2vDYULyBCQwH+v/JFyn+22XpuTGaNGZ+XxZcd28/2huhfCyDrT2GqiRb8oS0NtMAYdEASvzT+hKfFjjq08kAQJMu+lj2ZePejsQucAc5l5CAPW4sqnc+Ux9IwgQ5ja8Ey7BNa0oCkIopwvXZ3ZAaZgYBIBrPxHgT+xxN+/ZPcz8y4FUXiinTzctn/eRrf+ITJglL2FgtxwyKnMLQ3pEFHBmOrJM1E+OURPaRFYpxymKTJ44h2rGJvq0TZXoqxqsGosKoRrSCQTb/8Do1CPnJdOSpLM7Dadl7ZDI89+ZDregmhAsk5hp4+9M1zZeC9S7UPUWAtrdETi6RZvYduUURZT0EHbkVQhHwG3a69mh+xlj3QCP8x6rMA0K6M5a0b+qgU5rdbZLCkfZjoxQ6TSNTHFl/Krhb80Yj7YEybZN0UfW81dztBSvjj2qudWSYK/F/vNC+ZffMi8zwKpkf3BuzaCZouIOVLMlLMfq/hVld9ex6Ze1biMZ7PBwx5jZ77paET6fiJW62ilFSmsEkRCXcyfn0DqyXcfzTvq4akafKPcRUwOk3vzX8iOqyfAylPc0mCkUEfg0/QNM58wr3R5kYr0F/98pZ9OW8Pu802nja6Q0DkyQQ2VsH2iDBrdfHEO1UCxMEfVaLGBj37QL3Wh3AmYnRKldnMVuY/krlndaMZjHG2dxdxhzTqI0M9p2ZiIoaxHiiE3+CrMBM3I2m5EIXzU/p7rszG1r+6DbmHgNhAdUokOuQr2ts3grY9chnGkBdeCxbOgbFkc5A2CZ4lHyQ3shCNa8OIBMrkq7+lmISyEe9zqOLIpLUm5IRi9K8KykDCAa/tlvOleyv/fKK/5/iPTfvA2ombxggzRuae7qrwtnFUQJGuC61Gr1mEN00qeRk820TphrV+IU43WQnvoAy/a7lBRb//jV9/kFg7a9/br725Uj9k0OGbV3VuvejkgVXjL7abzNfSBLgoUpRot3r04DspBS0xMd9uDEHPFKZS4H1Kfy11OnwLX3rRV9YCVPBHUMIf0SZlUxY5lc5dCYJfomxqmEdePHtsvNRp/hQmgmcjglpwODsY0GTnqWRRaibZi+4KCSNIIu4r6D694h2qFcYVFDKptJyrgNr1T0Y3ExldyfGL9b2BC2py7+hZmGK8X8SkoXyu8UnjvBUNnAZEiIGU61Ldm2Oc0tekCrI1rIb9pxMc7VknShyo3xaTR/k1f7/qSKOqyU/4aAn+awOJwHIF2iwud+xahdODL0MsYB4Wp72GNiGTsezjQKLpTRKILVdEVXE6Zk+xAEExw1lTnll4Dix+62SMMSUw3F6StC9cv62SEoJ5+OnoQQGFhDgzSIPz4a7IlvanmCDkEPOqu0qJAX6UpbJ7Jby84mbD9BXfjb/tcv2UtCVt6oL0AINgIxxYuTfrxA9oopySpzpe700LOCA0Xs8yuISM4WmySQKOtE9TC/ZJimITpTQrZkDJUmkrCMMt0zFjbyX9djmf/M+kVkEpvQRpuPF7lz2O4/T4xlilhQn6tdCcXFrI2tiLL+xNfylca10d7hcmhuZUrQ9W9bTeHwpQPUu6KOnVYPAys5wCCoxTD0ttrf+rlndI7gdoA/5eIgCaGr3FYJc1PDxxWqrkmQ1mB3n6GnQYA3jws/4DUajKPgWHvbrpLYfp7zpp70U8CoTpx20ZMJsZd2NwjVcJUsfkWU2tjLX9E3YFsTyO7OOK8KTX06oZTQWa9WhwKiUo0E6BlGg0vH3jOuqMKZ1NktCDJAQZweGIk0kU/5Wf5qTCNRv30n6Sjiy4y8f/9IaWy+Op4FUyCtP56TyCpP3UObA7WgeeIa2b7VfNqrb+IULMN0fKNsfczJxGbVxFr+Lh91gneaxYpEX7JhxkWG1+MxIeqCTos6pC4JweyHRNxiLYE0G4YmqA3+9+r5e8GKpfh3GH9W58teN0i1DaRzqKA5702QAMD5/QV7pSWc8Vjim43to6J/BQ/Pvz8Ot8d3rn8YC0U0C9lw0Di3uNH41RxxYC/7cEcXGTIoJdJoMvVCB+DzoKPhvM9V/5YlGKifc6eWs362fG89nZ66Ak06CImSJNs3p9+xAjH192JU=,iv:571a9itkcGViI/qVCsOMMqUAF6WcB2H6aCk68rfCdsc=,tag:+LWz3fFwJ4k9dyAxx3EpQw==,type:str] + host: ENC[AES256_GCM,data:R/JR3HVIEgFOo2LAtc6t9G5djDRqz+J4h15Qyo+yyNTsMzqB3HqESQ+9EqUkJqpPNyoWcu1XPqplfGhBBY5Aig==,iv:YQwEWo9JRR3tO4J4+ngDe02XqDZGnYD0fnK3QjhsWh8=,tag:Xudvs7GqQHNfweyruQadkQ==,type:str] + password: ENC[AES256_GCM,data:VCbP7jBl6ozptphcLJg2gt4vqmFXqYKiwIiXpMV/YRQ=,iv:hHX8/35qoxHhjZg+kRyFzrjVX2t3LSOSIIhCxwHowlo=,tag:mPbsggg6YrYEaxAuXJ3LVg==,type:str] + username: ENC[AES256_GCM,data:vZIqaOH2XAsSwoXKZ61+s3MjYqI=,iv:jcZ8qXysuCTperSFW2hxHXsMYKXPfKfHmfeYnpl9AZk=,tag:4Lh7n7/2as7Ad3TY6fexjw==,type:str] + documentations-prod-kafka-secret: + password: ENC[AES256_GCM,data:6kpiZzyJINkveYLd6EcDlcbgRXK4mH+vKxY/S6kpy9cAwHcyO9Ni9vrmdT0=,iv:g/jy7TEBoEz7YEOuIcTJr38bVlF8ioI1VRuMpooLdDU=,tag:EccVSBtCQo+hjE/udM7M2Q==,type:str] + username: ENC[AES256_GCM,data:dzfSEh+45/kF1JYnWXbFiHDr3wLzIqyD,iv:y7dHiny4va8peSh3wEYd4XQltBrI+nV0U2KPGkfSPEo=,tag:FuGlkw4ha10KVGO9MQs1UA==,type:str] + eav-prod-yc-kafka-secret: + host: ENC[AES256_GCM,data:WwojKSSrQCPR+6mMmO68zNIM4CNDnYrFg68VR3o6z0MBOobBUlFbLk/S7L0GT/2oocvpkKb20IGRIvgtdEX05Q==,iv:Gona1luEw6ne2UtmyOkFE6tdy0M7PFxbExfTgL8dnwk=,tag:wquwgOd934b8yAuk6bNSpw==,type:str] + password: ENC[AES256_GCM,data:LA+TrBLcDV7TN4G7RnDsgTJB7Qihqgco6/Cyb2voLKw=,iv:Za2g5SpatX4mB1ZShI39ZntplytwDeKzsXGENlnAwdo=,tag:HUCYUHci4+ThmFwLrtMzRQ==,type:str] + username: ENC[AES256_GCM,data:A1tCatro6B7vHyke9XGB7qKmr8w=,iv:7bYTijpqvO8ATH0DQ6NHUQnWIkSxRAkDdFC8UfA9JK4=,tag:FCYF8UbHlyq90rF7qd3NXw==,type:str] + iams-secret: + db-dsn: ENC[AES256_GCM,data:JxslMZ46Lhs/g2qRBqJDQXLQsBjkGCwc5CHyfuCGZqRqUBAE8qNKuom8fZds6XKViyK6qx3hfvEx3Ay/MTlhyemkDNba4d+YtBRX7xwW9RfaYvfok7Kajmf3TC89LnjQm3fY3aVKUTCHMww1wMXk9ONvnNVQ1r4h7EgRyWgNBozzK8+HK5D8sTeO0Ig=,iv:pXxbgOyRVG0hvn1+b2iLn9dUXJyPXnP4P+DMdS72P+M=,tag:E9H8nQGAUne80GRP83e2pA==,type:str] + kafka-sasl-plain-password: ENC[AES256_GCM,data:t1VM5ECuFcyVsmwY6epdCpwopmMMN/OE2DRklsYpgem2gdSyHSJdgBGYaik=,iv:E+OW32F29+0e0x5iIMdtozdpZ0uHbzJB5GHncZh/C64=,tag:+NmIVwP+KyIPN8WSBmvABw==,type:str] + kafka-sasl-plain-username: ENC[AES256_GCM,data:0R5jHw==,iv:4Yr9AznPPO4Hdz2BzrlDJ4n9e11m67v3tPi2lln6Tg0=,tag:jgvq7sY04XCDNMsUj8L79w==,type:str] + zitadel-access-token: ENC[AES256_GCM,data:ZUWKLjkfrwc++ISB9fgjS6l7+JI8ncPA54ZKXt+o77esG/jhasyvTARsqfi2iAxA1DezTICFTuI0TZMsOfzlHPhW6OszVxSnPyOWXSWZnplZllZcan2lBnJmCxy4u7rW,iv:r9oUFgufhzYZq+S8dYUvWVZEFjMmTBDOGJEj9I2EYSc=,tag:9gNKkaKUkwSbno01ORdONQ==,type:str] + zitadel-host: ENC[AES256_GCM,data:w9YHnD58gJFIV7EAtvFqI1N2skxRuYdgtqrqfsHcrf0=,iv:/M6qZPdtejYcT0mrDnNpfcpCgfS9oADIQWr1zGsKADs=,tag:UzVyP+QG9c5Mq6Xtpz0C/Q==,type:str] + inspections-kafka-secret: + cert: ENC[AES256_GCM,data:trQP+RGqYNvu9nVa/22UpU+DUmbPPIjWbAPEfuO2V+1xS7+DY2ng3chR7BWuAuBnclH7Jhh9X2dwHrOXzbs91DLL1K18TmSmXnORHM0uVM0AFlz7xZK2V8Rm3xr8jAWXG+rUn5d+/MIVD4lDkv0Dl7JMQcEUgGPFGr0of1iAjjrDuoyel4DFS2B1wSMMa2Il4Nsfho5TJTQJH197rVLVPQ/PL3Ek+kLSGQK1bVv5q8uTUNIxdHORt43WqHEIRxL/ub2TqMccJ96e3SKCRJ9VZaYTIwnqAuzznq4HurYdu/IUcurH1X/kUBS6C7Ic1fl79CSxMbQQf5q+cEOP/OPTqJqwcqiGFBZdDWfwZgJbk8y7PfOlomr682a0uJhFYEnOAjGrQ8/ntDu47GnmLuzEqa0BQ+h9A/Fx+cJpLmDmyQ8C+GJfDQROZUkA9blqNyC9W4/Xny9nErqjqertfqmEXDPvgeSCNgXFEWM5pEWVO7GOCfixKYChthkK4ArhunqZZlLsiwxP99XkTFe7geuEte4HCn7O22ooX71X64kmoo95+33yZARmIfSiQrOJFjDHFFbdPTQzgokVeKEY/bSw9HaOeP8qp8WNpFA9g2mkoXEtpZG9M+pgaj9H2dDjfS/Nqpb9xGnjSQm7dhaqH0JPuefREfQRrr5oc+TQYWAbF96vwLVI57pY7RNfObF5FXufAbZlHN6T0YohxRPaQ0dvVAML9hvbzRSc1whChXNQboD0dUNJvLGJZ7z+oy9WgvRCcyL80E7Lk8YDgvyey+bnVF2QLE8ICi8ijXgrTJlsBjZBhGqyGywGKqr7qBIoBTMJumCKlWyRawIDqh9/i3Clkw9OlOCooOUcHM6lNquh62KmMe6sfDAmaNYXjyqPKsiC2wHjsHV/lT974Y+vjKQfMNghyaebMGbKOSuulKQCnUKkMBcV9SnKwo0tq8JGy1MRjhL+Tl7KL9GMhuyZrfNe9rAbyv/wCbJhkIWPsTB2+loTc1tLZxnUsJJ0puG8vWqDksKSPFLr4hYuEznLO5nUcbYwhMVRQDQSVVy3uGGfFON3MXgjx/yxf2zES90jjKLW69/cTnUkbQhuguVz1U+XqZN0LFEfEXf5hWxwm0NnxKkcX2L5Bnpx8op807UK/4vCNoGmHsfx2cN1Wpriil82THcGsThOP5mdfSNECQUA5KtX7KgfjXd6tF9p9JD2oM/NH9A/kx4UBpE4D4f+Qn3nE8ilrybokGXc+aREMKFM04kDqSA2pkEQgzkAzuThyMOxnOSeQmMaoxlYWQ/L3Mv3pM3eGbYspGaBkq993/bHU+yj+GTxOGMxN5b3oNtVZk6/DUOHpD+W3fvKMeUDvnLXXwS7TWvE6i2Kg5jrv3jCwKh0XqLS66vpKlXRbv8saZZbP8a6w+TDq7IS8BKfwf3KQkVW2OCEdRWO1/jSZf+mJUTj2GWkXJSlCISs36nYsHGEs41MT69ZC6oc5ywUEoajlSsic7POSNKljPI8J+rYkZCRw5bJYRRvnNJUrmh/VrXICdZvcOf1Lq035U2/2rspe/WWzWDOOUblRg8oY272hF4VcsZd+g+9yaxZWLhEjib+0pT1aROG9rhjNSl16PlIgp+aONHpTCzI6H5/0gWqY3CA+b+msvzDy5lQdJ7m5BQDQVgwk3LU1uarnXhI8GkXsi2t0iWfIO9wDTxEU8JnfYlv227Hb/x6qmzLdjIxhYLAMeBKNNfR2dovj8NBZL+pWWPNd9V73LwXJQaPAv0290ukZ6z8z74Wz73qJ6XVZjOg+PhNOtPpHcc4A4i7UMYWKz2Le5OzPK6KYTjjWIObdcSbh2mZ1fpJCq4ZObLRpfKOFfim/rRYuXqreCSROXw/2ko4JYeqUqE3LkNZe8W8BJ5QIewGa1X5gWgBtFAY2NIi/yKKbGvuo/VoO8O5S4c8vqHO8zusTT3NPethfDaFJ5dUd/WhKUS9/C1JmHQBj1j/O1e8rqwY1QAes2JvX/fgO/SQaZ6vUzEH5Upbbx0hq4owEyDsgztljWVNVQc0a7ITT52Ia94BarKTyiNnLMLCnV2dV8sqNbJ/j9s5ZH6irjoyugUfXkJE9JcgQFRxO5gIpFFkdioicfJtMTr+skjoYY/nW/u74qr11nitjdWuPdj+DWEkSQvR0VWX9xz3fX9oMoPeGeWVq8HHWjpvMOti57Qq9QN/DCgsoCXqkIJpJxLnZytlDdVz2meUeczFxir8GrQvorFjI0SNeRAwh7GzJh7Qhc/w8atODZKJhjERyWmboOIpGxg3kz3kn3iABsJcEkCqB/Ji4zbJ/QLUHN+yKl+IOAZzyjtyakKHCYOrgVQrrU95wp8z7eEX8fOssNhP0mOar/7oMJBLuNnrP5mUw9luQNd+trg1cQLZVBOVniAgW2Eo6MdC6DOrylTJXRBwpLtLUFYEi4HeQ9Lce2CeC4S88qz4nJMcohQtfDCrZTv+eSKkA6GWu4pz0Gr0ip0Ub7QSJY/mZBafyM03orLt6kgCfJg4cAGFscQK7U7YcCVzTD7IYRgTRAjWyp1mgesO6rxXxJsNl08plQh/AZ2xSSp6MjflYC+BxMBs06y+hd0C1gF42D/8PSqbaDha9ccIEMSdtQGeRS4cM7sZoONDaWWIWM97C4JnxSrsyG7icGDDWY3u5rVWpvUZBiHD8DcefAVOTRFBXdjp0rltIxCq2CUIIAs81YXZ6WKciQ5dyqh2jiNT/vi+nDrT4pu26pNlopoH/FvY5xLyQWkzIwx7Khh66KeS1Vl6xi4bsS+e8hdcge0I8R5uJKYW0jDx+Po6ByauqUkkQThP2Hm+evsH6IOVVUScKBW8qtQenyi4ar9a4yqItXVE40nK9RiKp9jf+SA2PDDhtPclSV1/hcEk5gAWBr3TXNLpqWUtrUvJsZjP1IEyEBDJZIs0XQVhvizU5QMiNeULLdCX6/UEfR2zSIkFY78KKsDOP+5XGC6P8v0Hk5FiW5TiauziuVmRfW6oN9Qd8bJEaHAReYj0xWbWnNKQc4yV0/qsC+7vzY7MZZnYjsyiq+VBnSYepJC9QfdQ9KtJFTsbN+Go5eC1G41OvMGUFwXfMWzsE4ln+zu0aB6nnMBMa3c5SjhFNh9iFpmega4t56R0apol4b2oK4yIEFYh0fCVUEP1/7NBcoCdxeXUoS/ah02gcV/AFNrSUWvoAQArypWgkHELRwSqNZYWyO69d1CUV57e4PX8U0JpWUYG6Ii6Clgfyl4YutIdW7ffGRXnbv++MpqziY3NwJygjrbJLUFBP9X0zP2nW4CboCuKErQf4Vvyo8zfd0RsUZ58Zf+uRl9uA1llPXNmrVQtX7iKFaqGf85VYzaXOHb5hBKwH2YzPpqZZZRy9TvIAE4+7Lr+SqJd9PRnxal7nJiI9WU3L68Fm3WI10IKXtKByFOM0SprkG3naT5cxXzcEyaBfBAKtqs/cv7dg3sqqmX+8DW9Ki4n60y2Y7gOjFbcDi4m2s9psGQfTQx4TpGUlwKk2IbDOqBnssj4xtdU6O2mBQEWIvx2a5cJX/rQ40+rnN66qzF0+vLqYND31gnMlgGPfV35Qz2e4NUG9U3wj+RUFx0d5pcjqpmzy278ZxR3N4delOxFoNEkRpQr2HYbWDki/ZzST5y52UiwlL5X3OhnqeGck+M/ZABddiNuf6IN6xHdqxe4+D/HE3VtCU0+yVh5TwDf6bMwn3Ss269bXaEGLAFADSRFBnU0k4AH8Zso5z4DOH9ii3c2fVZPyIf4A5PG7guih+VUGbPwhvjKyP6k41mfm4GiNBU4BAGVu0FkfPh2hp92hLC/Wt3TAtp6x3NbMAFquiBF6uwXU38VSYaxQZiZzthAq02/A8Yn7xi87zbMfvnujT5wO8i/pQjmOIlKekZggKb8CbIjSvJhahGgz47b+aPTi1MD4hqQ10+QdTyjCp85g22gTkukJdUJE/A6yU9WtaEgO9KR3G5ZvnUo2U+aeDioE0aVMVWxdIax4jrrN4WpSDwIS/aECefEv6ul+Oktg4oYOXCBxjHkz/8IJ4Gt3UDlxVJjnmRf0eQBIyPZ0FkWgIXH616aD+tiM6d0UkiClNwo1Tb4ropZmf/ZUsNwI/IpEQ7yKdcLe4R6yb4VFrSud3h0ILzeETF3aL51SUy9aU+9Xu0QwWWUXMHGW453r8kV9Yuoph/J8L7+jkl5wiJ7nSmiiGKaEYVlnvY106koh+ruamdUzjdhQrfbCY4jVVj0i/N2ni5C4xQOB22W21JlM9CSUSRjdlbIOiig2nbzu0TBH3YhetorGuCfserk0CCgGsFy+S2U00hbK3AmLWozgtc+B2hMBb+2up5kM7C3MymtKX+J+9Uv/64C9f2qiil8Ru0Ls4awY6xJKYvTt4dn2Ns0tMSQAtvTqFocw2Jgskupip0hZbbM1EM1IheN/kJRcba+uNze9nHfI5LiFNbuwINMgYIAgu04crykBmH9uFQho4Bp9pyy54rrUhqclIBXEJoN4CxFu2JqlESgM1/koAXZ6oBMCT374YuMeFCniRu1Aq1ISx7OlWwOSOOZFQ46AA2fhchdcKYQp07n068A8vxYt2iQFf5UY4b250XSffBHDYyNRacLbsIiXqcf0bKEEsG+JmJV/3pnnF9CBH47ZCZMYzVFJNKAnrrMHqUjk6jRweykLshn3kDZb9+PtSRU3NbM0vw8T0HnjvU+qjSOJM6tffDYjU4ansZBZkwpjpFzHBLSTkCuPivv1x8nKtsPsQ9klzpBGmdclKBkAfUZpAkduis1XADaw5igOY3ZlcRvOOORNLK2RJXlRt0B79noeCPatZk86cSTWLO9oUXuotMEgbOBEJolHkfVtKZ1tgYBcTeIy9YIdiZ+vbXPMDnCpNiBb/Tjy9D33KUrcWuc7C4k+vQl3+m8tUx188h5100iRMRSyNifXLVEjI0VO629Z2CUkXX1fpjBJ2qjpRPCBoGFR5KCB+BjOdPcQRjXB+8zLEptFBBfq72qpD8P44q6RPgBMv9YsqmbwMEwsu8GqZqES0x32Vq5FHmJ0bl1PPmcmlSvLtuTM1CCo+x5v2DMjSgd2Kuv7uiN0Y4h2mdYO+wiXABwmypGYcPGS/qvq26L8wHMC1xe2/4ttoDA+5mLtISiLegBMrKXKJvJwVHnqzBXKz5z3Me1Ska3psQUAfBO6GMyiwdfTsDK/Ap5R7j6Dwu3apHZiDilCiFzgMc/HxfxUC1vh6mJVaUNcNwbsO0icaVSI0IaM76SMNrp5yPzXWRJE8OnmqpZgiV7ruAhp0+fXqQ+PM0El8huxib/vcc0q+FSSjOl5bMQ9Yqg7OkisZIyJlwh8xBnPfrt2AhxzYkkzI4Xw/yoYi/AZB5Cd/8tl3Mv2v0609YvovFzoNNVSJnBpcsFBTFxSLfmQn9ypaPTJb9LhtUKxeopB8cAbb4HdMrOpx//71RhGvQ4OVNsoNmK7Gg5xLfd1yc5nyD2+1a0H82HsEfGpTvgkGSdych659/mfaM3RRJJXn0zgUG1ajkcefVB9Roa7xPsNJZfYZji/WbC8i104QmYVAheOV2Diaje4j/jM9LS/H19crjg4fOFkvIcuquBlHmQGjTxoPdL8bVMWncptQl3euoYGDMmugEkRteLk+C5B91fGHBeLwxn823IJAnijt40kZyaVB2/kdIIQXQjBDoC3IFH4x1b24WOW2HBsZyaSdGvhJ/moDivcpditJ8cxoY1wLZR2C1mgMDAfBG8RceJEW0guRgkpdb1Y0vXO403o0yDRYT1Ltz3OiL2h2xtEWt+aO17fyDRDT6nI6WTa0HXMW/asbNkW/+XONLPOQxH/LgcZvD90d2uTQVuwwivzBiVr1mBMBUpFp6uctE4Alzf7dvAhGt/CIWIjU6JUY7WAC/XdfyEQipM63fvaci5YFNFv2aQV2/XpCPwd8JNfxxW/ecnsl/ohtFAK7WsuDfGkidcm5QOumNcFDHpNUZTSm5pBNWRjoGsZ9zv3b5hdHx1uC5UoFWqUfmNQFKm+zBH9IKZoIUM8DO9j7XVBpTnbQcPbIZTNd1hDlVsQM/RjzpEgI90sk07eaXG3uIgO5LU1nr6dWMPvXG7+22MEtVYhbNNbXcwc5elkuZILf60aFURy/pDZCp+/+T590VUFVffwc1Xpmrlwsvuro/jEYA96O87qEHUuWf7qQlnVf3TACBjYfJQlA4JaWeqEAgaHYaTtwL3zS2hg67WsWqRCsKJarlLpX8iQUlqYvRgTWiHT73SC4JBpAw9vJ878qT6eaqecWZGeJ6BCnG8oakz4s8+oCQ/I9HqE0DDo/kQAj/OH6lcMAnDK+Q7GpCEBzSI3O4i1LGhDt0=,iv:wXilZMgsa8fRNFKIkPbhTjvbTiAPjyo7BesIca6QcUw=,tag:elI2q871gIa2EiEisSMgcg==,type:str] + host: ENC[AES256_GCM,data:/Lf7R+m2jKiXEysEduItg1uFx6bN7yCtmLoG7pKvnMckW7KFlCP2HUrlf9rAe+36pUMVWDi6OQO9VOaJFkk1rw==,iv:cD2tRvmz1HkdAurzPG0YY/qnAlRmstJQFBfNG4KyZ5s=,tag:huAYmLioD0WHy3aKuLVPIw==,type:str] + password: ENC[AES256_GCM,data:qYOzHfmg4W+8sFQW0iwhAQ==,iv:IpnUViiK+uqQnly5BzWPMs5M+JgSvSYaKDuO3SMGq0w=,tag:3vkAafZ4fCVIk9yU85wzZw==,type:str] + username: ENC[AES256_GCM,data:KhMmcc7B4+eDRrPh23YoFA==,iv:Mg2eFSWAr7fqR2z5g8OPkzM5dSG5gR43yBih6Ve0V+s=,tag:moHcBOgKjPj095dGBSGLWA==,type:str] + inspections-prod-yc-kafka-secret: + host: ENC[AES256_GCM,data:DJudneFbcPz7pskjD3e0OM9E2JR2jxO/xuZ8K8eV8tXkd6rNHjMAXPz0kd9EM856xly7SWXTU1ZLeU3PtSCqag==,iv:qrw3LIHjJ3rlcunXb8h983IPdxcqpCEr8y6U6sDZOhc=,tag:tFnrx3GPanXbwaskcg3C4Q==,type:str] + password: ENC[AES256_GCM,data:xj+fM/HWSd/OTZet88Yr+A==,iv:Z10W7SPcghZKcW2s4vIaWW/VgaIJPAZrd/ZIaaZgLRo=,tag:4nFVZHtYKwiVvCnsmA4hIQ==,type:str] + username: ENC[AES256_GCM,data:MhCNFlVKmpXtakVBE8gEDw==,iv:k0qkSv/EumfMEv627KB3gUsbiNg+Oj20e5bu+gfS/y4=,tag:kcHwQmyZASh9i8F2HrYCnQ==,type:str] + issues-prod-yc-kafka-secret: + host: ENC[AES256_GCM,data:gXnVRP430xzApxGwLBMhJnHj8EafgK8AFhEekjWaUQ6DZSwYqUanIHOCUcJlEd1g2L0KmRG8BAfOtgGpwJyRvA==,iv:H0Fe+G416KtrSFkXWNRBoHpyYpOZazYeIK6fVcO3Jlg=,tag:JqOJTl5ZxmLv7EoYy9dWug==,type:str] + password: ENC[AES256_GCM,data:NPGYFOEMn1O7pPvQEJIa3Crefm1LMoAd76Izqiu1Deg=,iv:xpNiTPwCDAZ4zsgzmqM2gM6ktJV0n7B1u8Jj8IblqW8=,tag:0HIW3DSfloo9AlCw8SmHWw==,type:str] + username: ENC[AES256_GCM,data:5A19GpQuhKQ=,iv:TQn2pkaiyUuQvNyNFv5OQl1pTIwe8hfDT2NXdDe76as=,tag:/GMKQIUZAQMAwlVz4ONpaA==,type:str] + message-hub-prod-kafka-secret: + host: ENC[AES256_GCM,data:uRRaSirYLRTRlep9b3hBYET7YtmzCEVEAulbh5gfyTSwMI6LjgyBs1ggEOzNMqfzGLTYgy20X7Q=,iv:bBLDCY5YYwQFW67Jo3t61jCwQNWOB3i5eNemabp3BVk=,tag:1uGe5axNjY8pvvbPr7PO/g==,type:str] + password: ENC[AES256_GCM,data:RBNyFE9++lFYW8YoM5Qfh0846JsInvqDY3fb3VDOaMCM9sUmrJODmY4NYis=,iv:Bf8X6VulgsqZ2GlGABEhJNtxtqd8PyDJ/VOnG1fCGfE=,tag:hNDz1iCkJIYzhfAngD3hMA==,type:str] + port: ENC[AES256_GCM,data:LAnDrUbuea0=,iv:JaJ9iWMFyQ7DzXbfU/NO46wLSOWdinEX+Wgj6PgNvIM=,tag:NhMNeVPYEgFxqH4mOc0SLQ==,type:str] + sasl_mechanism: ENC[AES256_GCM,data:7n55WiGUoOngSafo6R4aV/uJEAo=,iv:UOP0OMXkWeXyG7VM3uPU4FZ2cpBbMVqQLum2EWDbCeM=,tag:xDAcez8MaSLdZTR0NqC+Dw==,type:str] + security_protocol: ENC[AES256_GCM,data:FzwKouog88ft3Sfg,iv:qYphx/LlrZe/cBkk8iDzBDj/0fUsyfKctaQxStgc4kU=,tag:3HCxm3sTys62Gznwe/HvSQ==,type:str] + ssl_cafile: ENC[AES256_GCM,data:AgwP7IFjnvPnEYYSydBb8RwN9Fj7pDl5X/NBsk6rGmWdsAsViXYIqRNoJt6iaLhy3OVphkf8HM6V5rG+1Dmv2gzz1G/Z5XUyOn9+eif+34NuzHOahdqv02AZSUSffc8BWQRuoVwPniz4koSpzqw1afUcA0d9ufBRtZLUpAPt1ycxQYU++SYrctRvUMNikG7syFsTvdKvlMp+TOxqVfjWGRQWGOJ8TrVO5XE98MXIzIiRPCT6svypFv+dPeiGWKQJalFg3iG1lGKmQkcHLfdDzjYPDd8B/Sy14M7Wuj49ZdQWfa3tsRAkRVCBh/LyNtkwPjGosTOROfUZ9/dOmV79UvdjygRJ61tRaS7InRHOXiwzO02GrMxC17VF2sCk108t4r31iYT0K38EB8Okq6BhBuPBS+fFdLtojyhqcX/XZ3hxiPKLc7KPoqfsL9HC2Sm2P3v1+Bp3eRK3GyELMhtvsQocVgTAiHD+GNTNSqMS3lPswZDG1iHysauaHYfwaWfGIe2xhXRGcIlsZlXTvsLGDEB4Al5xBlWYnRX4/u+e6UbumqQ/gSalud9C670KRFiKpcHJWL6b92SRbpkO2w9W7eOfaWUEAoL++PoCbBVZLGjaM9YZOtWTLObMaYm4H9iuRdieDJa60FdCgG2VfOtYVWGjhtMFreJ1kEDoE6wkmOPz0nnkJalukZyqL+fQeiqQDD0lggv8c60fJywzZ8BBN9U+W1DCduzFm7V/AZStxwrEtS9/baYjxmnZQRoSO6MROdYtX2TT+61TsrqInm+hEJIzg/sbvfMI2U4qX/BHeF/u86ldDD/f78F2fwqXmbHkVI51Oj1PA8Kbd6gpRjBcUYuTZAZ5B5y5pwyFSrJMu8Q05MijwbqLJvBxVdsVhsqU0WzahJ53qC6/rfDl7oQEF4ihTirD4TLj/fNcAsvRt3+5nxb/3Z0bHzErUyGxFMhVerrlT6fdN19BGitnpc06RYko9TT2k1xVWFM+Pi8rNwaZI8sL621UIkQv9/bV75k7g0JL5AycNXu+2FbivshOdLG72vcEJJBsnRK/PtD6d+pZSSXitJKSKOuZv8VBwTm7R8FI3YzXIoOwuX48Wx5g/TSD7YFjgzdPnoHALZ4vYMA145Imo4UPoEQqLHc//7Tle0lqUrBp36zw5DKLZdjEWdNE7FbDmdsK23nn1VDO4H0yzovMJinqn/QxqFC4qJWXMtzBGRBTL6tt7sxCpKLBAhPi659jdqCcGEdSx8TgYQL4FVI06gEr7mpF7g3+6WT+IY+fhIsvo9cMbfD/IyNbNO9ZwOZCCkNf9Cs4/d6Fuo1bVYLf69Q1RJnlhwWuajperLs+qdmiWUp7UAnGbHh8VwN2EDNFNcF05J3jvB5iQ1KvRw3FaDVc3+aiJ1X2xATIkWMre4RULxZ/iwirqTAHWSw6rOT8zCyT19bHlIZRpNuZNoa/TZmPJLndT+8IfeDT6KEAVHZ9gwF2IS/ePt0GXHYPa4jUiDrI6PTjfxcxilNiqI1O5tax7FeCHriet/gBHG/exX7lGXp7nyj0pzyN/8QN/aVaNeThrg3dOPxjBaYKM03km7RIUGimb9qv06BxNIXOAX3IyOf/cApGK6VhoeRa192sXWpHMtzGy90kU8/y+M23Uq9Z/hanYjElx3H/cujLMJLKvPdKyH4dVq0FVPKSDgoaHOcMocFUFi4zjWSrGt0yKFzq7Fs53PApC1FEvQnvFfNXr4rcvNGzvRRBgDK9qmCQW3026aJZtx7qYi6GtJ9l1hRmcGAcoqkpRT6GCsud9pHs0E5n6/0xYQSWf72XAkcQ6wIII6380R+UoItWyhQjvXLxE9Ig2Wk3yYNcozWLr3XWf1SmWgn0ATPxeNowXS5AIWTht90elKmYrHjh2L7zFqQOiT/5hK6C5K2EGqBEoXIAmSy5v2Y28o8UpzGog8wCH2NYjzmSc1mhLYnRAR1K3+trk7MsgVE7kKmVc8wezBEyVlHoBAF32CGH75XfiKDVDqNprin7u979Ib1tZuBLQRCTuZe4T/sjZ49ObORuqRLkIcbBVUE+VyyFiU99byYwiwrmGk36sLzQKoAn98v/W2Z8oRC+dbGyNoSBCP1C8v4c3y8xo7/iGR5radEUqkwod/LYzxEQPZsHSZPi4cnxt6ll3gY4FA3ACcp/+0oQh2qW9Z71pwc11jhVPHmMbfk4pmCnV8C4nVBPeCzNwCv7S1oq6dltdCw7oLzv8vJ1UIk9rTKF7tEsW5lT34PexvuKJpJHhxT0nPWUYEv3dHEPqB+12huoeak2utYpqmuiBnFLiOe9/cyKD3dl1cV3i997mUqudTG7N+gd8ca4xGMqpfgsiKpLEFEPdXESoE2v1brJxgJ0LYIEva5PFC6b4nfEpR6umzU+SKa0d34HBT4tuwkJmLZTLdk26Lwa6uyHNGYSXtvy6/Vcpte41lIO+uXMJdQUCNyDsvCz/3RgNc2AnbrDdSH7DJtxFZyF//I8WAj/RBi77ai2gblpAHU56tQBr6X2aqDDPPWlhBqkKVj/VrdP3k7Iu8P+Ej9X3YH5KaTDNwGJ8beZJ4syHsvAHoBJXRhIr6U0scJnuPVJXwTm/FTj66UhfcanhGFjWPPS1XU3/00M3RkTWIl9m/c9oSPXd3q+wWZzyATzHyYHL77LVT5dJxsL06XbJU1lSOPUglFfLHEsGZ/P6+ZPF+9vG8l1tRqYKu5OtcraQ6dpgsWtpZeIYdWVMhkv8gjNXhAI10LWz/M9qmzof+ysueBpTOS8ygjTuLWFbTakNZ5Ow74KKnCcs1oJ2PwxbHML53/JKb87siS4LqgHDlcD1Q7pEK6dlGX1LSf2BrxTeYXPbA0pOCEqqevISBwuDzfrZy2o8vhnbpeNWAJfjlpEPOcQ2gSx6lnYJIm7yIQKarmQQEEVRwfhQblx/AEkfFKjlsIYkhjj0YKJsXScf45nZowAjZw0Wr3luZe42trqcTdN9XMl5assHvI6K6t2x67W5684BJGLSvIkCZ4ZtJpgEDebXTF/303iM3W0OEaSFlD1+3Rg+QuaFUxAk/+PezBV6jpqX/ul8+hR/QBOpZkWYFAhHAnj+qctjqvtfMMBh3OOK+Tgs4qlbGkqTvdCpPxFkl4mPrJQ/LwlANrpCHZ0LPB7WSnET/FRGrIYk6Jb7F2/+eOgyVMzN1u8U5iyY5VAklgZLGRil4t2lAY9r4v8ZtF71a63YsakK6SUvK5pPPG6s6evzYdCUQZt9YOVU9vzVxgcMVNJkX6TfSa/JfQ/qqEUAtRsY2g2FAxUbXveGlg5eONgqK6suwyDqQqBbAXm+eyzl02mz8o6/R5nT+EmHEIxLjYnXnnvcQ6p5jzMu4xLU7k4mlKCV425sk+Hv2be14O8nbGiNkbnd8cpM1U3YFt/q2YRMZcVNkeNPUtsjfeOv/Ev12ZZOOAkhc76++MCFp55QqF6oBnTFiCIfNyUXkjHC1JQDH1mmMjTwrsUomXU+/FmrlciTHBfxTQg3FUu6bodUZTm2KY4aRTYC6Sj1Eok/I787tzaH36/Y/2TrHwnjgjJt1cz+1WnaWVDbtWPW1CzUEsKgHtWp4IBb3WyWYViLQNSFN/oSv4oP722juI/hxkGjAD/km8L4rtG1JCwlNmQGCfH8AaKjzpuNYwur914UVyvh4wi++W7w2TQWaVkGe7WyCxQUMx7LKFNjkm4rvzknvDCrSJSzu/lxekCJu6+jnSIufC6EdS1ZN3VxTU0riL50KoXlvxbU8/nrH2wwYcQcLWGvi2WL0U9Ueaz8h+5hlUXkbO14uDdgFKGaWiqLpQRERDy6mWVREUagLOtds+/4zPE4ul4PQHyou+xsCyDROkZPema4g1VLLQdhWZqJxryQjcz1lr2EKA3zVbmUTdeoZomAtmk424vokL0K2AEmNSRtyK83m1PzzACrjVmg3sOBjR2HK2q7Fw+KrPP0qVOkqgkIMSaXBWpW1tpxbfzJkIrVcf8XN3xpLrSnH64raxgbpfe7kJ93CLRK/+Vo2jxwK2Pm0+kmTuEhXrhKIVgEjcmiLUrwQARkBWWoea01eXhDTvUDSPCogS7lh0mJ2WheNJ7rvj8QFa/8ZotpMnZ0MwOeYIY/H6Kx3OBJxJxc5P5HpygnAIm04GWre533D6B2y00GRDO4iE6rfNDmspi7jUEdlbPmGvcZ+lf1ZrY+OjRd89NLjSM3AD3tUPMEvQcI0NYVfo1tjYBhoYHLsVzRtdwpf09kMD5qbfq3zXXIpitpM7sOQoaBjP4T/8MKLjRdvsqfOLE9LNTuPGJy40j7HAAMS2DWqCbioQsfju+7/52BNoXEQF9pCcrZYzXYvCtFpazjLfItm7BDBeJm/8BDKwkRx8yVrJKWuV1FLzS3g7ILe8ch0o0UA6pRSbrZHTP3hUJd40jdkd345SSQ5IMuFBwXeigL+QhjrfafyHNWDFkcrPkrMkL7zUJxLNSdKlvJcyrZrdV0YK76REyA8xC7MlMWkfwlRGGFDs7z8BUD5+0UcmN8uq2zyraTum3z+ZrcdfPV/lv3b8+7dddIsP+7MSGxd/Ev1f2f5xX2Od0Ep782hxZ4oY4uAkhvZNowxwm6sVSLCavIGNXPJQi58DCF0LUwpDYdpIazuIvUjE3EtM4nMVTQ5GXPZDQF+NTWKeDLdtttRdIzEp048SHR/IXIP989qL4WWQScOJstNSEzi1dlbWwzGsE319Tu6hXylasFofEyqX7YMyykQChbQHcSxmtkH5n0+caRICs89Pt4jJBKsK5z3mE8VcncS4zDsSJSKsjNNV9JvKdNrwInOVjWBavQj7hYR8HLb+w3UvZgtiNwJM+hO3iiNuM2NBYHCh8nkdsDdsSDMK+P78kGiqYUr84vlpkHwgYxf0bBHjHOg695cfRm07+KHqmCgCqFnTC/7GUIORXiCPqstTVzDDp8c6St4nEzveU2p1WFxwZa8yEEmphq4tdm+1QFJF09pkKaoYRrjyCaAyy7lk+BCpC3SJojcmpNZSXiBIUdj+S6wpINrL3VaiquhyezUTF1sctw+IuuP9VH1jMAL2FIySRycpBK0F4z4+HJSRGqPATAOt3d/EtBEgICReQCIQ5OdXYLl+C+HEwayYsK01UdO8WA1amChKdnSdWDz9wGy8fFiT3GFEbuk4ynHxSzWmY80cjUdAtTuh6syPJaLoDA1am+zdC2raKvt+zsQS5nNstYYjYfhMjyTwR9D+GDDspko8dOSlAUy6HFliriT2d5mqI5JtywA63gbdOdD7HOin7ks7w6JXgYR93PtHfEdZiPZWEROGNVwmmdMwWK+0UR7R9GFxE4+GRe7kpRgB00sw2efh7Ch2ze4pPhoFEOKypJWj5uO0HxeCGi/il7tMt+0lkqZn5riK6DoPJi/XKGH46SnuPURoqPEn/O8HS61suzq2IhPQuha2ZGKqSRDoOTRBzX2wWXMAKckZs0diWOhSG+qpwq1qFjllcGMpwJbTgxi2ZRcEx1+dQOxE/9CdRV+NRLidpKN52g7F6MnTheBEv5GaGvWKRML3Taltb5K+7uEsusuSd2C1Z1SpnLK+qW5cvKhqgg2aW21coqqwf+dvJ/gz1mmzR8nobH1fD55vX+iZvyxA0G4DvYlDm50e+F4n8H5CtPCSs82z+8mFuvCEh//ifEZny01mo5nPBoxGkEOowblVzV7Fw9Rz8b7xHHW2GmdGLTejeOYnedWFfB9z4bfO0Dh1wU6St8/qrgGiBaPgQjMAafRn/TX0OJLd7FNoQf6BmABiMKIK7P2Jwfwaaqq+IvsZudHPwMo/BMif+flsIzxKoU5MnQ/cQXhzyJ/mEcUNfgMFyz6qERmRqDM+CwQUwy5opJZHiKfbBYoa7FDzhwiAWT5/WH/jwjNA9FD9Gs4EakZpcRlmVDiC+r06NQO/DVaMUwd7vA1+cTcQG8X65uSMpXMi+mYtpxSnGodwr5y7wRejQoFwGn+6gEN/ImW0XCpEoZ+EKRoyLqZ9jlIu6BGgLjNEQpV59Y4RURjxuYYZlx29+M6rxeftdOGWIaf1s0A4wSosHyp6OEx+Zapj3JVo23SVbpRkKoZRTNijIeWyER1UbL0gbkirvY6ZaWTuiyhfCTcT3z4nzXvubUvWIUUvBVq1DB0oIF1w2fIsIzP+BEQpkCFa59jcMwvL/n0VeRznNsvKz3XVXpuOaYBS7YZVdtyMnUvePA6V8kSIXobHazjJD8qCcwgO0HcMdnh8+tsUnGBqybuuFXd4G8oVET3HUQ9TkxxzKF/g9go+9qKZEcLwr1olaznG8kB5I0kY434Qu3BHQY/Az9bcWmoG4InkEAzCo6G4oQP3F9x486lY=,iv:AcJ0x3TrmNM0UI2RTSrdKubLBTCo7wwaqQVIJ7ea8dA=,tag:R3gdgykbWqDK9IIE2L7Clw==,type:str] + topic: ENC[AES256_GCM,data:p5aohU4kQiNsv1EPXQkmImUmZJtJotW1,iv:whoeqZRtyk5vy9HIyvE2YBE5DkZU2uOKqAMo3tDvb74=,tag:5zJ7ausQx1Abhjc8wxFlOA==,type:str] + username: ENC[AES256_GCM,data:v0LAnaGgFhKZuaoIxcUe3vdPeXqoWLLV,iv:9nGO4v+d8r2KC+B5oLCxrD94h3psPueXihsYfoywKEQ=,tag:TxKqVRM28VWJCP4CZMlUeQ==,type:str] + ya-kafka-secret-pm: + bootstrap_servers: ENC[AES256_GCM,data:VX0V2qROC8tT4Kwc0zXKR0IHUK4Qqyxjl14tVXn6lXn4HBBW3nmwN3bEuqoMg36EmlO/ExSaASLVbMQIOqyFL5VBZsQ=,iv:rfRQJtDNe0iPKgsu3uYWxVKeIcE/mgvWy0qqMjX7HLI=,tag:t0qJPpJkz8o+n3g1KR9LUg==,type:str] + enable: ENC[AES256_GCM,data:ZDhy4g==,iv:PW6/EAL5SEdMWataBRqRxOWQck9c1yVhZINxMjiz+Z4=,tag:M99fDXyAXCqmVU1m5is/kg==,type:str] + sasl_mechanism: ENC[AES256_GCM,data:LTqiyepe+icQp3TZ/ZMia/wL3nM=,iv:rQQTZEIKdUck+LWRKVHxXbE6pvg5TkEqcyonVKn5SaU=,tag:oC8AAXRGp1x5IE1Onoy5aA==,type:str] + sasl_password: ENC[AES256_GCM,data:iLzLOareQW7+uva+x8mFi3paDksL9bLeG/JMt1NvjNHNnCiVJ1UgPGTprXM=,iv:IQWOIGz4AfAiSkBhxdt29tb/5mW8HYXF5sxm+33D2UE=,tag:4BjachGZuWTFH4x43PLWAA==,type:str] + sasl_username: ENC[AES256_GCM,data:kcrGag==,iv:g1yQEupf/+Kav8hJ/UnkXg8XVEFWeAr/dkw7Ov3aHwE=,tag:p+SOnuo2xlgMQbm+GoZmMQ==,type:str] + security_protocol: ENC[AES256_GCM,data:UFXazh7SyYnn/GvG,iv:qeMhf77HKiMzoKxC/BhLfOtYDpOfK3vMx2n3/Va9adI=,tag:ynqwaFuZbV5QIpC/xSuUYA==,type:str] + ssl_cafile: ENC[AES256_GCM,data:xG/dtVvcId28EZ7ySmC91t2cJPa6aZo0uVY9p9bqb+MkyIg5,iv:vtEzcS99Yk7Tu5rLNxWl/hXQTrFvEWbQvxvz2cNSZIg=,tag:zWm9U++Ugdy6mZe2MVs+ew==,type:str] + topics: ENC[AES256_GCM,data:l6eHb8JwYYFT7kl9etpaNw/7smWwDj1CehOiLswsLrUepZnCCP6r8iXjBFQ=,iv:CvzjYms66Nta6ezy6Ams4Yam5Np6/qW3jZFNA416AGI=,tag:vxDeydoH9CH4P1uY/5saFQ==,type:str] + premises-kafka-secret: + cert: ENC[AES256_GCM,data:npXdpUTgBd9OV61e2CY6NDOCDxKH6OIM/S4u93Tl3QVGZ506L9b8Bb3CMVQBTnCxSjRkMcp8B7jerTkYw1gZhMjAxlpFa/OBJNjokYmYGCFXL6I1I4NppstN1+tWnO7oeFNRw4ZUbMKv6CSs0e4sjJJ2SokJlLPHvIRYvHqM71d/tt+xkktjpCkRl5rzCcA5pU+PPashMClLiR0Cr44YSnm1NqQkncp2lb2GzEGFlul5QbHojs4ojHrhs9eaEMr7/nKAKKTZ6fKNNGouX1xmDwUDDRzw5g7HFLKwTtbwkqZy7fcKZVkIW2+r3Cv6XFJPPFZhNmHbxjaaRhQtOKJ2uJDyo6g+Gpep4ix1vHWHusOxaTBIIa/EWmPIAJOhLQXvY0fxPFjTEKyUdpGI6H35eATDUE19KKDRg+6qZeXfz8B6COa2EYDRkuzngUe6wHQGJ+XfCR6M6vBlIyTofyrTkfdY2G7+O3HtB3Url0IOUQ/9BeDSHWcX/zEMxgsWcetpYpeN/pcyMsWlR8LGw38RX3q/PYIEIETm7YiPu5IIXHBL8PmfTfk06hWOvP9PV7PN6Wrk98TuDbgiA6C1DR1Hf9fDUvzDRZY+xidkH9CepcCnaCSly+PW0obNb2rmun07Kdg9li0K6FG+plei+xajLuPEi8Hei1op3PP1sMGzvDBXxilHORPD0ig6xPAOzo72ewfgB1qx2jjl5f3Xgicopnrt9Kzp7xWwFZJOFHA+P6Z49WcZApyVvOMaunEaadfNf26o4EGo05iulnHBiSIr9LNwCr1aDnuilzE9WQPNxTFK3wgM01uu8uJHrMUZMjhTit0xX+kDrJajLI0QBao1sWQ4kheKDk3CB4Bai5NTQ3Ush9rCGy/X9CQTafcVNUeYmb5ql/Z4eknIH6Z1Wi1JjnGkmND7YZ+O+yrOk+aCLqskwCTPkEbsjGK/VdhdRaYE2UkfpLTGzx14UwU3O1MfZ09ucHoYD2jlh/QjcKHGU+hnq+ZWPRpjPzKzQTJcnBXAaazBCXPD6OQnA7PmtgWeFLXKGYBl7LcfTw5bZdZ+tuRIhASU4pffGZd7JSvVRS7L1TFDFh7kuxSjzVXBFShPBAswVvzZTARcaxE5HcFN7gYDPvLyiYjAoGvqwNcK0Mv1s5TBUCTrd5QSIqBI/yTNXwKhgayWIZTYfNtZUaukGyjN4Nlxfs1NzXkHj8PZH1AdYnan2MaBa6qzlibx0pPhSSZZjnkXrXkkuR7Jgd3NPxMOQC/Ny0fmoLGaT9v5z56Ce9JTj7L3RVLX7kA+d+Rl+TsMk+nD25rg9OcY6J5SLSKNod23nyx/RV/eKLU1elsyi0OjXe+zlRL93HVXc3FwtBmsV9uH4ZAgMUuEIynbfQoaulBdtYP7SHNkATRXRt7XAA8XrA+4zo5ecYXvZLzDV7XlLcFp4bAg+QKnWChYVtWwEn0LAQOuu7Nt2dFMnqtcGZpDZs2F9LGXRcQWAoCyt16GUMjq8nqbKQsqh//cHTux+IfmtWi9g/K7XEOk0a1HZ/VzcaZtAV/e3xG7PD7Ywr1H1DNKIDoPoIxwBW7GioHt1Eodw6NLcy1y4Xbnlj+E6GMgGZYwu0nqEMJqznlnGko6NTMCbqAEN0uZ+5xj9voiiqMU7zdtLAdgKopZHQY/br+tbc9SAr7rDANcqfzLrEco9ZoVxC4ZSOP92wGFeugtcUT9p3XvAyJDm5YTVewEP8vcG1JTSmWcHwMpxANhyevXWEypC9i0F4IuROwoElvkBK+nejpqPVYaaBgcO17REfGhN06NrJhuCGIbMAN2xwKUj4OGFg//IytJyKJnjr+TFQ7FOiw6qQp7Cdw6Jn8xW3gYpUwBb3dBr4+o0/e0cn5NatKuDLG9ZwMpta+G/Wd9aY1M/HllphCRZly9XmxW2ynFuhMZvVDNtEYWFMKM1nH/ZIKtV9BJ7UI5qZTVDGzc4IBuJ+s2/NsEMRGCc7zdCJ8O2r+tMNDga8HH3+AQ/2AQA6IhlXWwt3QMXb60fxBpOcCcj/gZj0pdpECTaSbH4han1HjGSrKqMGoWFXT0qRNocOukOGkdGqdIG2QbENuBEq73XhoT3O8dsaPcdsZQaMBLlpOKvTjdQ0uMTOU3rIWV7zEY4eif5IDzOZzHyKD9y6+O/1oWN9X+lGZIlZvmRJcxj5D7bKnEWQJ29fwOsNVGGpxmZxt8EY6mkzSoZ3qwRWSXI0K0KxFof+GgDMI5Ji5AMRhHYO8yyWDHR/G8GFHjCpetQOPr04HpH7AK73OVkE98o01reobBAyAYPyz2SQKKe3AP91GPKn2LWjHePnrQhGdvVE7UgKdrL5Zdnk0WU5X1X61rOcvYEujeNZhlXzXfzjQiO745JG+/tvxvVHqJDQU0vTL9B/m+badyIET8hCCpKXvMb2pI2VJlfqSpb9TTZo0msDnemHeMtOaZ5KvOuADF3tehy3mkVgMlcbRm3hEepk38DkLkPsba9Nv1bgMcHnMpOerghucwNLeVVUwMBkX9HApezMq9Pi71UhhDLDnYQKgxflqlxbLjDBkoCFMpreqpVUWNKX1ZxR+9FEHpCUjYFA7Ef/zflVsMqez6a+Zw9D0m2F6/VA+X8fuU6AlLxTzPJCT1Rtd3ON7pXi6QAqRoHBphVA4NL+EfSSUedsWA52a823p+5XzQu8oSy0Qn2WerJBhQZhQhrxZc9G0tvWa4XEn4KNqzdxqexs0AutCkSQV2Xi+rIW5EFix0bvGAKuJQyE2Zi8UD2siFGCk+2IaGXpLN9a0/utdZHdAL/vaQonUX+xFxwNcsNWKbJyxPIi9dtp93qA/hCbOmcSJsPpDmNdGYWN95KW6x1VywYnzk+wpQiWmRm66WXNZC1o8Fayeh8kgmMFvCv3gQCpZHxLqNBXhtLeQ0XHw5tWN0UKz1TXePjgiSlZRU8Q1kjtl5LL9F9EUjs+egtIiZF0/GCJOXPE6EWHGy8WEKhRE9x9lGG+IB7nLz1SeBeTsy/REvSiXcmS9P+bW7yr1vMt3z5mgknLu2yJu3sOgZSNVP6oPI2Yvgk7cPPC7sTTC7T7D4LO2EXmPxU2uFfzr8Joj/miqC9i9W6j6pmBkjkHql8IK62T2Yp+o+ObBK09WakqiGYBoXjvnYjYkGVowvGL+iHxFWIQLLKR11G7+2Jq+V272RGmJ8AvZ9ZbKdlp5nK691brMQUygGzelQZ68zmifGI6ZUy7OhG3/zzNKyoqUWhL0HovNz2KegALLP5xAaMHuTHgs8LLC5VodAKAJoA5xG0+IPZ776Flkf+Qf/BWagBqYLZkoDMGUYJLRCCGirV1mkqQZVV9jjv9EWk0wpuEmm2zBwvImUsD8ZIRjmh6eSFm9mjnzeIJlGTkLlrdferMstI/Cpmb00ZZ6G5VeNNPuc923KAX5LI3Sp65t8R87Rr3TGHHjNgPJ4fyg5XaBV/S8Uz7LyuF/bto+QPqWie0ypPlFN9tGIbtNJUadY7SgdUUn01FwMvYMVTJ1kcYjsM2tB7G6QpR/V9+RYjnf8C2iv5VJDgr3idXj5R/4Rl43mBvBMoH1fgB2mW2oTkpHK82pUJib2RpNw7NEB7e07o2WOPgHkUalWDcw/s4ChHGrP8zM6PI8trSjYP1wGklxelScilnzCksH5obAXVRcSXW7xmgGU855bmPvVKtAxMLNAkoW9wqpxdY3krCYoN3G0ntrEL1NkbmJicdfRQlnaW9O5qo0j3SR7yA3UztbpW9wNSQRB5lr7HWb+JGWoECEPSsqcOji3NzSTKE6jsBc+NIkzRvueN1vnm8y0WH+45j1mSb75vy8ffwoZHmMDWOCwa2rlVMyPDtMCwVjdltO3z84bgvxuOWSoOA/LgcyJ4XMu/IAFoIrIXt92HI6R5gXfHoV2TmLsDxxapiUpYmxFj6yzmRB8ELHQzXQB7AcDSYZ3RaOy4Qz2Z/PvzSrQjjNmVD4ztklIiUcGCeMM2DqWlVAaRic6U1HM2puNaqCFFBnNrHOpNlL0le2cWPM/o9b8FYNrAqTTN9lXceByJRPYI76rpRFQgqOY3EzH0JNn2v+X9ppKN/CgYKbhZ9KOAg7D90ZrQb4SaJx1941OmwHjr6PQCOUHusWghH5s6ws/ZZaWNEn1rpRB7KOdZ6AlR+G1H+KiH+bofVOYpXRDFs3Ae3gn1ps1Hi01dtvMme2SwaGguoI1F8X8x1R9xezbY4zUiFzTs6/yDSVQaE0M51KS2Toc8h2+6VWg4WDcWz9U3z+fzzfG+Y3BqGIMfIq4Ai/tKg37SZP8IF50pAWf7lRnyBuTX9l8xa8+95iuGYv6YoJ2rhRV5GzrE4ZJ9ctwMDeRlSsmBfEzR2eB4O8AjBl49KGd1ykRWSnNyOroS3TlD/cW9J1RECs54K0HBeFhhOUvXROE4LD6WEfwJZ1fQRVXOjjQpXa/3uTM20A4QPEQ0j3QsHJ2NK+5tkW69JeSa9mGR9HN2fxvhsVOCI/vPPM48mbs0flb9vcjVl91ZO+wmyQzrDaQvFWe/Cs/2UfbPLnZhax7uzBqx5oxtCPYwcXHI/bjgkAgLuezOhxwQ4QOqL9lF9VeHg+9WolMhARghG5eKCIHbQtLnEGmT38M4AhNqxHb8pbVrXYh1KlTg+Q3ThfUItEKb2tx83bHLz2Js4w9eTJi0wt3ve98YhsXv194PfERaSBfQqWkUediqN02daPmPU/FcX9YLo04sUVOHPtHjGSeYxHfAeKpEqa0XJoh+7+OtLVwUe3Zmws5QnJXFYlvm90UG09x9qz4m9ECatN99Wbv5eIBJJhmCOyPrDTRbPLfDbMUVV5C14S00n01WItfTQYvE29JpyvZjZF7G/8sOMMjtjPJIGsPGPFJGQQDPmbBfwuSdITwlbUg6gO+slxIWdqMH2ovJQsav+toSoVwXQ4zxNfP0+3D2udL1F8aEHxVh8qaWwfD1YB50Jt6AvRZz/2eQF0qh7SHY7yvTAvyM7fT5jEVeZq4u+CqVeop5g1ZeGQwyoIGio2c18uGMWG1IddrYNVBcZVeHuvPm+lO0sZJk415zejo+Lv6DwUvicwraC0tXuMbOcj1RovqfmO21D0nXSI+yG+27XlwpoohMHA6rJD9njjzgxAoVA2ByurYUbA7Tpa3aijsfpQ5Z8VRcHfqtZYvHYXnKRGPhwVj/L3U3lwoQQkI6rwwBhOUuJnDHzZSGjL1GwF1L7qFIr6RIxv2VSUAftOIA6TzXXXookuLUu/ZUjzagHJig0UJwGr04kw6UTr1+yce0F7dSCwPDvhYzf+zypklfzFOZp3WDoUJfWftoWkzsjJMcNF+7u9fAcLNO2/uOAjcT0aZLkCXRv0XmlDo1wednoyJGg2vyx215AC1KKNxGtc+xq8i6gwu2kpNJeNLVbns6y50q0svMuLenoU2F3Dj32P6WrEG12zU3iobStfzBkhqy0BchVRDFHKzbpW8uSRrjFA0NpphY0Lwjk13J+mgUpzkVgWRFWyMISiE9x86ijqA9ygT3BA9QbJOX2y5HRkCOSwJpvr2gKR1hjp+UXxL7mQswMQLfUPYZTKhcBv5kB0RUFtQeDczWozyNWdLkXYp+3dZmo43i4qsCKH0yP4CusjTm9LXXsxbDDykFLaY+cNiUcoHurXlLlqMGnzIs1Bd613PrTle3V5GGQgKo3DjHd3vFn0UKkINkZKnxf3DXgOG7R2IhU9I0HLUSwh4+Sty4d4Jegm/dBbCsuQbYaV3rfmfxZsk1cWqxCVujQYw7MA3VQKs0Y/Q/C86IoYya6fHp6hE0kRk053BXzpRx40tfaIXWxl69CAKp3IN9ElREWODtzdgdeKNsa5st4ZpPypuPI5q3Hn9u2gYAoz/Ym4b14+TqrD7Tv4r9pLnFl5qD1PR0QoQCXNvM81sxJr1YOp1jkXS2bHastgrKPJYSS/RRqWWWvsJz+YiwVer6sOss8pWsbLYAJjPl9kzc19zBu56vmxVMayEWuuh8CS/RtOhPgCYrFajxi4dhUf7IA47Sk8SbDE7guWPuqYSbDEv9qaH8m8aa9X6kTuHlQngVbFw8lWoLGXu/7chYlqUf8Rq2OA8VsEHzYlSPTUfOElpEHdlBWUXjgV0x3gimiKZboYuu3aNx8an0BnS3rtBvllXj+rQvQaNjLbTqc3FytZea/nyDGjSziPg/7bNZKWUEB+iQJMDem9djTLgACMuKwY1rvGXnD860wUz0DU1sXjxhzm2aWC55dDB63hopiycKsC/qCmXMgzGX4KqLKiDgXcj8ei3CQc70HefRaXDnaYzY1i2JzZbadhBJb9UdvX5WPzSYJRVXqCe5atiDkkNp2Upr9nw7sys+UqhK3Q=,iv:AM8fVlgfZ9DHL+B+i17LhxY4+jI0CySCdaOHnnj46Ic=,tag:UzXDI+Q6h4G743HHAH9zug==,type:str] + host: ENC[AES256_GCM,data:nVtXzBah4QOUtl2VPAK2vH9P/RW9HBSR1B0uSpD3Kv9QxIb2QfHPKjkBAcMW4lJUe/y5wb+PrwRPSr2HEPRkQA==,iv:UojANlxefg41Liot3wphZDYRg0by5bdp2sV1K6hbz5Y=,tag:Ow8zCaLbEUp2x/FMvlz7jw==,type:str] + password: ENC[AES256_GCM,data:VA1UZ60rZ59pHfIJceozqQ9l5v8pzFfE2wlYrQ==,iv:+kicCpSyBGnf6zDGwTz3XrwzItDD75ZX4Ys39JzhB9Y=,tag:1BToVYDAtvaN62Erg0kuJg==,type:str] + username: ENC[AES256_GCM,data:8eNZK6iEpnA71XzU,iv:XFTdJXpfh1WKTsSnSeaaLuySqBRLNgVLbz7HG3LrAZ4=,tag:YzpbskBnDpqrhhK8ohdk/A==,type:str] + sarex-prod-kafka-secret: + host: ENC[AES256_GCM,data:dcAGN3uWw1EitebqPuEM068zLU3ok27UWbJ9GGl+IPX03/LjcvmtMSzysU8ugP/HtTNyxkONpP8=,iv:/rifnYSng3BOlmgHB8WQ5vvje1ZERwrBpGcltSixzpc=,tag:iDuQ+YPhKUsNOtI10Mmmfw==,type:str] + password: ENC[AES256_GCM,data:b3mcb0dJc8FAhJef2ESAwoaMt+9sCDIjNIlrM8EzIPAHrLFxhCo8dTiembo=,iv:At3Ig5bqoiI4nYCq19Fau8vGKOFgRFiBj4sCY0YiG2o=,tag:XcPGQQJFhPtFJcL7XMuLoA==,type:str] + port: ENC[AES256_GCM,data:2rYE1jIEGeI=,iv:JxuOgLmk5Q/UE6oSFjaP5IfluiiFodtG3EP/kaOTunI=,tag:l4tZ/HCerNpZHN+Jz6/cXA==,type:str] + sasl_mechanism: ENC[AES256_GCM,data:9sGG0WHJIOYkiBqfZAg6v0SPIJU=,iv:TBwza1TtilglMByfg15jHmwrsrU12/GbQGO9DbezGrU=,tag:motsSjtRJRvvLOxzY4i8oA==,type:str] + security_protocol: ENC[AES256_GCM,data:V/c2Pu25GEH0862n,iv:tsPK021v9gjdFhuJOPaG9uyLflbsIHpPpVrrwHZULPc=,tag:M3t6899MmoRIgBDzwoQYoQ==,type:str] + ssl_cafile: ENC[AES256_GCM,data:Meo18US3u+kUvHHISgVOphZEFmh22vsKqmTPogCcJzMzeBixM+ydTwTFFxJh4jUs2W5gAB40PHE/VkzJLb8eq5D0CWyNLeUqBiTKW9k6TX+GylffL91U+anC1aT1LvqZ4W1OTdsJvQ5c4CttL5S68E/EtskPFnPxuOiy4hB/kkoK+Un0geEkodc6tOtkxB6ei3yYfk19O2JrS9nFXagzbzqzJUMDmLk/FXMjabsFqynhqrm2xJlSd6DSwnnpdDV6xhdkaIPX30cc54dRUelQp+35X9W3kadog4aDugboTJwIjoTcrdgX1ftC9ugZP8yGV1e7aQ+TSzqBHxzkais2n6dzQEurI0zYJnuwD7sLR4pmWjcvdQj/E6NykO88jnbFnflzHxxMRenYNlNuZZhz/b7dzpjEOxOV6+rk6xQHnOoeELWst1UKrDSWsCcJz0BwnDSFknhvr3BVQqU8S4+U9Zbe7SIa62XJFQqIIqaBc43hmkQDxiZbBhjmYxrDX3heSaZ2JPXw4adB7DrXRfafoAX8LMIMXX0OgV4gmGRc7H+dEpWj47kpRBew6suaym80ZX+hZRkQ36nFM3VliwNdXvzphkVuoHBVY80JLvLu0GuLiO1bzGfE8UV7U3RYigKhQemv/kCdOrukeXOPB6Ua60rf9Zxvi3gpGyBvSTRJz5vcUiuBsZRDXaqTLIhk8LDr7tmOEC/WzVfTr9ZsILVl57VFuLXY4uf1UgL5BViDEfjHK8m9iyX8ydeF/Tfx3Bv302IOjkl3ocabz6QPfs0/8Fu53HdktpImolbNkLOIqE3k+NK7pcaJa2Ro1uKO1khBCRHBPO0kpo69tO9oKzCvQp1hV6py9uESbc34ipgOiuSXoq4S07oj7rPjCluUmFv9MZH1iJzrhREkp4hX2QIrR822zc+gTtGB/Itb/ApKbraDg/7qIbYoWvoxzJfA2Y9FU2AAga+wBFrO07dPfb0KveAWglJqlYFMpIMdPXaL3kiya7td44yhxDkv5cox8S7YnQE9ypMpo5YWfVT5WR2z8KnMqyfh8qvjZNyHjNp3CqrLOylbYhDdba8mF03n7j/2cLGEfZqiNcaHejF3ZLNjOxSRKNCFNJmQbvNRc5UWyG7NCXl1JXHcwntLzj2rz90AW+rOqqhbiniUTUpnFD7igzqPZXHtCXcon8CCK9ArSIkVVL55kFOxG0WeqsomsPDbhv5AOMX0kUy3HLxn+xGhkGLT0WW6Jc7HumCpBcRzEVIK4HGrEL9r6etDHtA3hRC7wmdlkiDJJjZSyXzFzCqgc0f++saoSlGOi4BdLKetsbfCkKTuDjcBrQ0DYCyQJ4cbS4AZMOySe3wjqBvoodBWTBbYzmTdV2zIy4yIYpBQmoE0+Npuo8uftchAOV1X7RZ27uoeoLrpmlBVWICKrtXsQQzNcTq0pn3UFlT5bT5PtPcU/BDa1KZ3n3Hb28To/OH89OiQMEep4k7ofCR/6m3p2zV7mGrA1T1DZLXRlCWwwcUnbWWMf1vmU3ILX6nj5E7K2dhm7QIYTPQFyvaEw9lfVOgOyFzd1Ey3WfxxMHRjt0qgJE8SBAii+S39Dev4r1j9IE51cQlR/Ig0gjGs1Mwq2XRjA7HuhdVt19YsGH+O/8Gi9FKe2MPULlv1e1W0+ux8yH6ZfV622P/pvH5UznjNc8kU1T+n1uN2i5kgAyjJjnaPBdJH5wzay7r+0war5Q1A3liT+rRmVRiAFt6er9K1DAKsjhba3oHMZcAk7LEBIv/DBlnIdj118dS9tUyz9r7GcuUlwVimouUXctXVoZPFtHq0eJPyAnuunF3gyenymEisLFENBCD9z3VomIkPD4NSQdqeudIQ+nOBV3LdxDcZPk/s7LTY9poxI9AqW49EVlGb3vtzH5gxvFaP0Q/YtqGCTpjaG2yDeTxOAxV7l5PfWS5b3vQI8lw+Cuok9xLgXp54E4almmz66yoGclMrJc05zgTJut3x0Q+92Kiw7pAljn0juOjE7v9nuLqkkS1DAqEfYqcpzbZbR2Kv02umHIRUbcK2tQVDLFUTc8yoznLHlktXcbUwdL8HXj960rTkoodtGVB1lmmPcqbOB7WL6DyJPlxzocQWemlAwg1yJ5SB6rVk4lI38/venpDLLelqL9HxOksrmgEaPRyeK40r/qp8C6ovw65KHyhLe31PgMXjcbiQzuV0WhkONobi7gIwvxSylTQaIKZuFRBZjVbw3/FfLyDaK580HJo5GrGNgsRmzV+htsU/2xADOULtiNrdI3XSNEBErx8EZjvC2Y6tQwd23YupPuv9bc/Fa4ThOf23rChCuWzAREeBZUy7I19g8HxhYG+GGWaOLLP+ehJaPF9GU05ha/YS4dHrk6bAyzF3KOwHRQKt5117YRBD9VU4QWmsFVNJJNh3lQM22bind+A8nW1nyOdLijU3uRHVuB8S088on/ADUAQ6vEduOJxUTmMLVsRxqQ+vN8QA+QhFxhM0eJq5fKOGQpawbXCbPOhD/kSNmKB/Fxdc6Lmjql906h3x4U/GxafwX+/jVWpsNyD/78/5KnyJPcieOhQkY3RdDxAhWL1LocqtTPTqpgk1riedYDXfp46FOTESWwU+XQ+xzFYsyWNR0obCORwHfjH1D3GfnSwAltYGSbddKq563Jry1FnfVSrBAyGblpRGrdt6fHWiEV0S8FeLOtSytERPtD2+RgSsdbwiiNuZfGLCDK8bDFNHxdz7+3Pk0Ju5NDWTUHumlLbwC02UGQ/lt7U8HdKbxKl2G5Xj18ZSR+N/c1XKbL/RwbWDQkQGZbSoxdSXthqFAKXHoYhEEWtAAMEjpE7X/8+O895ODII7jPm60mPjUpYS2ms+R+qaaSItB0cSek7mBcpJwbVCZG4R6T000LGt9VVsxsNlvC5FVPNy84YbW7jAitqrhEzEpG3xD0F7msJ4TXeigIIPPJtl8TsFZNFAYcYfn+CNwdG8gp2zjP7HrNJucCG3Y/u/B32EwVTXiVQpSTRxf/2MQ4QpAAk0O3NuTR3Yn//g69G6QDmA/b8Z3euC0NntUzl+JUEkTbBuTww2dHWuBDusyxDlUrcXkKmzXYJ4nT/UhKfWvLnQu4IOSTZevF7Vq7xj95ATYX/dxnSd9ZZQNa/7tPqo2W/E4EPqUK2ZrSBPMNC7ph984bb2+I9+PIodgm+A+t9IXQII7pAz1Ors535ccqWwhCUBOHOy5NMyAzfbZPK2dVA2z9NK41mSeq4QzlBnYfv18gocIIAn2Iga1OPgin0tiOQDZlZXg8WvH76+fUefh9JiOSprF0lpQc8wYPBu1JEjRgOz33WbqMgmVmjvxFg66JUVJOaRBCsn25ndg6ixdGTUPCnxPCaPyxh8IjTB/ALi7GcUCBdeU/dNdLOkY5TePRDqgTXLhe/xkYYuimxsMR2gV0LH5jt0GFD/ndluV2SlFUtkztfFi31lD2WNwvOqGv/1IPunT3TOev74FqbkoptSBhO0aOafli+AMKc61cjVh0fJXv3x01d5r/srrvGVZBqdioPuGD8EuzWgtYjI7RaAuHZeacvFYc8z9dWWaUjLwJNWfYZrZ65PQQJaTHGdqgXpPSgTAckm+7ouvX47m699GOv5Hzi8Ip2vb5RzApeDYxcHyKL9UQptw7ztz/fIBAcewUz3IsV4BN0UBKj+m4WYarJOysla4KWojGnKaFNZUZWccBoL5uidU+rLJ3rjkpeSDGQOY2lh1Gz4tjC37+Aywi90n14CT5Cq+d7AGNmza1p3rF6GqvWNuT9SrP4Cdakno9niSj7uzbxF2EsymnJ3NOSTSYGnxjjGggLnbQDjkATtkOp2GPb2NuNrA+kJd9sJmvcdliH7fan0BZaUfJR1bzb0JHVQZdD4or0JndsIaTrMFkZwmzVm/pcnVZlFsXHZn4+BZCbJ/bLgzPjYZ0m5Jsy4e5YmKOGVOFfsRoauHzxO3WS2rrWl1KODa+9WQSbVxMmR2MrRjfypgxaeA5M8Wxp9SieNhPEiVEcLy6dDqwKG1TF9ZgH/WE01XBdxuLwISn9SxngoXWUR9biYEo4jCyJ2c3dYo7fjBUjlP8NFhjtWE2SRUWlg1Rjmw4ouAyBteRGIi74abdGLF3vEbyFo+7XCFJKw5TiskzpqrP5oMhYalbeeX6ldfZnrQ7fPzpYGe3X8ln3mFH7WolS0imkp3975BGPtj7bhu2BHdT9stJNlwPCebLZSN9F2JrIdQnb9ETxI7P3GEJklC/VhTb8pu6XZ8M2qcC92RtYQag6TC0bWMBi0nbt8Fky9AyI0WoBIe80ZCvXjZQDemGgGHUG4bd8jnDUG391kyk3dhdzM9VZls8LUwif8IHG7/mfTsZYBhG+w5dJv3C4PmgBmkJMok3GbD9YY1+jcMVPuPVgelUwagi93maWufWKOYosw9iytLD/byZK1uvGjNHnslk1VT/lIOBgHOJItNh/Ccpb4Zq3BysjxuP7eK4diiQohry5etGp4xYCQ4BTnPHd5rnyaYxkizPQhUxdyGpTr4h6Ic2ntNiuad8sgjrltQjekj8VK+OAgviZMtThchoyrb+awfWKoJi4IEuxFTZFxmglDYpGb8whoesXQhAqqreXRAstXezVWyZ6xGo0QcvVPwdtqGhRBsdYkm14xOOMyLNpE9GxWr9CrGsGusf0OLEZYOdOXlmaK8lYnvycO6BhAnNXZ24GwecbFu762b6ox9Ibsv6ea8CrbKhozNu18o+W/Y8yREtBYWaQzuxBfMNS70oYlZmCGJGCsLEN7cK2lmAbi4Jw4XeOVv0CH8NVZWE4EJFKE6ehh1na/TlDdvDYm9dGlz9KyNKQS3VrYie2gulJi49TDEmZyaSMmx3/e6XyUiwb3XoUc4gE7DL4E33ezqw6Bdf3HTHyt10JZNpEAMQdwVCdveON89D4+sd5kT6MNPQXVsI3Ssf/a84Kdnl8+lWnFxVgBwm/s7iE0NXYLZpL/bnck+1TZyNi3RzMhJZWn0ODakacEav8hvm3UFWf7pXK+IecWhNB1j77OAmv9V8QflUe1/aZ9gf7PFbOzZ9pXIFh6tjWhtcWBuiHf9eSy/aG0hv5q9n+bStECC5k93YlwtxXOX71DLLlGnd3MYOxl/IjMriPOT9rzI1n8Kfaypa9NPgiFz0ubzKFA13wXNXsOuumfbqcPYUJykXu8h8KovioWgGnH5j3z8bxL+Zt0rnnJMNJYWpcG70wmdD5bCvEdaLic2hgnpiV9JPACrJsJfklkC8dJ1zb+x0IMooiFDOWJRCzO41hRP1Yg4Y+pLdzGhOY/vlL3Ub+vR54Vc8y4Y1/VFLWfCcwRcHvQ6YDemvs1gBDWVEMXFwU07ZeCjFwYTMj7oeWobicw6Z1etind1ZZO5kxt/TG2j03/e3HkmKajYZ/GhEGcWL+xwqc7ZZL4Y8knoLTfZ3FzgdUyiGX3fLR2zFwrfSOE+fEyha6HVGBwGsc2mSREig1z9hmKUrt9P71K7OJFbHariL+9ztExwsf2EhrgyN9cXwAyL5/+VLihW1Dq9yzDFYIKtmSko48iAOxv5w/Z8yhnqnxllDsI4ChrQy85eKiqZZruGDbdlLb+/V+CNPtszbdVaGeFI3gaSZG1/3mdwTNZTfLyvPo+TA2MHcJQjlM+OmUPe3395EiffZIbtM/S2tJriMVaTlg8zvi6bX8uP59D2zdQk+lg42cskY2j9XYaCzI3l9oLVAty5E3PJi22MPEXLQ+sftnRRhu999COpYn95uArMG7dMxiCM0nAzYOjRTJ6T1EijOKroGyK9M9Rlzbpx9VnAtaBDpcDCsNO5wX+bnO5gAEJD1xzEXh01F1urbOJaTfrLIgSY65IyClTuc607Pc+Etm2jZRRS5GeCqS9XNaVa3glRc56AXNzxG08jkKsxV0bhBPJW5ffdoEzYZbf8FovRReDply91ypN3uS80LxLexqbmtbMwzG1kHJO19fmgFWm4Z08+uHu2cGPm3Kb+MOA3wTXZS/7vZQa1YJj4UpJFq+plwz/6XsTwi5fv23Ps7IblfpEmYblA88RmetTvaRSfMtjjLP5nAbP2rdFI8xrszo5Y/XS5EBVT0Lg70oBNy5LGE94hne/jVGgQKBR6gAufQzb0zpeh9kbjge3JtiKv2ICezV+0whwTlQstTaQToJI224P+SEl7pSfOohICDSVC3BvFamSBq803znPMTNb9WDEL1oLdstiQ1p+FHhO99hVN5Pd02r/r2urG6h7RIom+IzX1TEkhpPW+HYMfjaS2F7bb6hAWJIrmbL6hEIthlGsNTIh2UccHdTUqjCtLj568DjQgfTpDUe7/cp6qibBRnOPaQmtchHW0TY=,iv:LLV4naggr5bN4h35w1DL8/eocx9JqX0puMh1dvKbT/c=,tag:9YyJkCR4jdhvwIABcBcV7w==,type:str] + topic: ENC[AES256_GCM,data:Jzpku6e74/TR9CJ1zKYnGh3jzg0JTZQc,iv:oeqSSzbaoOhWRTrPM+FyqSKmt20/8OwycsVhdVX7854=,tag:hSB24PD56dGYmuQWN04/UA==,type:str] + username: ENC[AES256_GCM,data:oAPrA3MHQiIRA2FFJX41LeCpjavDSkgh,iv:7qPXfVOZBEMGVlW0GXcmIjkV+0ulqGDNu9N1GSdR2aI=,tag:uRGqzzmGirhRg3nGLc2ctA==,type:str] + ya-kafka-secret: + password: ENC[AES256_GCM,data:ti5pevQA6RfkYX0bEs77aDUxrGcI+cznjyVUAw==,iv:Qp9rZ1Wwr6mUot6NnI6WtQ4ynn/rSh2KWV8Ah0Sn6qg=,tag:4j8r1xHS1qRjcZf1ofCMnw==,type:str] + username: ENC[AES256_GCM,data:YCInwi96jMn0A7yjpjjidDjpasA=,iv:W1XyeTpod2rlD5/BU4xlx2eu5GTUYptZMYNxl/ZyHDM=,tag:r/VubFw8XLfuiUe1avjo9Q==,type:str] + ams-sync-prod-rabbitmq-secret: + host: ENC[AES256_GCM,data:3f+4op5l31bq6nOeIyahiWJCvvf6o59VjgOfIWDB9miDseLS/Zzqbtuo1sgKJd21,iv:od1kRu7GLIWgGmcFDQIgC3lR0Dww95mOcnne9N0jIzk=,tag:XvF9JVGPpukMINBV1hgPJg==,type:str] + password: ENC[AES256_GCM,data:rRoZolr9DdHB/qsN8eIrGCNyxaWTTiGk+dKMRvklSVsP2qIV0Bnin2IGyCw=,iv:hg+8rG7TlZE7A2kFu7IgDhA9VQQ89HsmCgtM8O8OmfI=,tag:rvWfVb/nfYbjBAZrHirUhQ==,type:str] + username: ENC[AES256_GCM,data:tcK0A8IiWfg=,iv:RNMM5CT2SmULuRsYqg1c58tl9/INeLAuO+25V1yONyI=,tag:hKAr6bGEnO3pia0Q8GvGbw==,type:str] + vhost: ENC[AES256_GCM,data:RvvhNxUIVm4=,iv:FNux/MikK+F22nuoGKJyMhkJofO9kr18CXyvOiojdPs=,tag:ip1SC+SPOgaCsugqtE+5Hg==,type:str] + default-rabbit-cluster-bim-api-prod: + password: ENC[AES256_GCM,data:0oMXkHObHitDHgIzfDMredXOSFYBQcIMuyQ9aNB8wLFcIvVoWzIjRTmO68c=,iv:XAqa0eU/XnFAvy3X3szGH8OlWWg67OHZNAjKuJqVR0U=,tag:ZEPyiKdi9PPHwKhyYUUp3w==,type:str] + username: ENC[AES256_GCM,data:K+GxXq0nEggW6ReuCUWWZQ==,iv:nw3IeBSoh9mxQM6mTWCgUiSx9QjVuxu9mUJnz8rqwSo=,tag:OSmKIbcJKsgFaseNDLf17Q==,type:str] + default-rabbit-cluster-bim-api-prod-gazpromcps: + password: ENC[AES256_GCM,data:pxOi/YMlUZ6lHRP9BQ6O0PwmomBiLU0Z0zqCfUmGD0I2fCPD2vNbzz3+WcU=,iv:ooWWSJOUPB/iNhjVJrwMQAuBo6dmVJ2/m1VGTagXpds=,tag:JQxQGaHvRWqyJQ5UnF4VxQ==,type:str] + username: ENC[AES256_GCM,data:VEJpuKXO8asl5QIyLAq/YjkX6AFgPTPg4LyCJrVerzc=,iv:756yBX23a0YMVWBWsYqTZ7443XLZOQcJCE51uRb7Aro=,tag:+aDa91D772D4Macxl76muw==,type:str] + default-rabbit-cluster-comparator-prod: + password: ENC[AES256_GCM,data:3/1BsQzccscsO8x4ygjl2gOhnjK506JqlGugUo3HN8cTK32wpCF9oHM8LNc=,iv:66+Le30M87tx/11jVgWji1LY8vJLdBe4yt4BfKmie6U=,tag:29bdBYsp/KeYkd9dnAMkVA==,type:str] + username: ENC[AES256_GCM,data:daMk+Y8yKp3xN+HqmMSSMbUVKvM=,iv:deeJVgaKAwSl/nEhPoC8+3IrSuGpQ2S+QJ1JChW16aU=,tag:R+n8EwZZ6qO+zHzXM8BXJw==,type:str] + data-engine-rabbitmq-secret: + host: ENC[AES256_GCM,data:njf16qIncFYw0ZojmFatHL+EJ2xHy5HsmIk5GaKzZSORtLjm3E1OI9klM0Q8TYcO,iv:sfJr1ToBZC1mGnVcKeHhGXmWnKAErBh9g1H5kNojG94=,tag:8eaLJG9+6b7y2XoE+ei5qg==,type:str] + password: ENC[AES256_GCM,data:V/r4zBeb41TMFDe/j3c+gQ5YRwuSlO3n9EeYs8YCIL7fFWQBuM/h/CS0vYA=,iv:nzgAGaXpbLuZlooFUtts+wH663uFrPKbnhOUghOXRLw=,tag:OwyFMfewcTh8hbFwLxrKAA==,type:str] + port: ENC[AES256_GCM,data:7B3KarTu13s=,iv:pt0IqADaB5bfzcRQe2eJ5hCh8iGmROiAWWYppYFSyZs=,tag:N32kFlKFY2KpEzLAp3O77w==,type:str] + user: ENC[AES256_GCM,data:MPz5dd3Y41s6S3twembZbQ==,iv:pR9jF7ZNDQy/7TZ+NdVSej44M1SzSf1cxN/RlJXpj/g=,tag:I7hXjflxwEmpKj5cUvhlOw==,type:str] + vhost: ENC[AES256_GCM,data:bh/sK2d6cDP3WDYrjaBtGuZ2vAlL+5RX,iv:pZFhh9iA666s/kgkCf3ZP2GVc/2vnm2hR4ZE0o8n3f4=,tag:RWh/XQB0dKyy9v6N6OwbRQ==,type:str] + data-engine-prod-rabbitmq-secret: + password: ENC[AES256_GCM,data:9u3ucJT119f9yhRQ5cK4vchSh39S4PuW4LWQNM1eG8By1tNtrgn8c2jHSow=,iv:I0iZ7Tnd3juWHDCU9KN04tkzn032BuSygvBR/BX+W+s=,tag:1+282WRFhKGxhGOEHorxyg==,type:str] + username: ENC[AES256_GCM,data:Ihzh2PSA9emO7MguTlzURA==,iv:qlWSRP7zFU1xAr+vWctzJ0n2I0dYOMxw/gonhkR+l14=,tag:I2HU+CRhZAoGe/NptH0/0A==,type:str] + vhost: ENC[AES256_GCM,data:gJdUXmdPz3rbe5gBsuMe+E4k8NAznAAT,iv:3BPEykxShSVnY3XLwwVz4BS0KHK4ypOPyXoNvIrxn2E=,tag:eSxec4YPzsH0GfL8JdWXfA==,type:str] + default-rabbit: + heartbeat: ENC[AES256_GCM,data:2hcrUPgIbf0=,iv:opbk7AgDw/Yw4cA/l/uXP7Cb7ycZP9phxLT2Ct77YGc=,tag:otUV8dk/o9RbIYMrvM5Iag==,type:str] + host: ENC[AES256_GCM,data:eDqS9tDJV9XvP2KZni+eKoOUQx9nJfhvn62dlcaoaaDts+UK+JXFY/DjlDKcBfmK,iv:p+PZXq8yksnaeZ+XDHjl8JPqTwvYWgOwVt27LrWYZ6I=,tag:rAeeqlIBP7PZaeXDy4cVzw==,type:str] + password: ENC[AES256_GCM,data:gDqscoDLM9DeamcyojTCutqGUYlJ5HGYdw2cJK7OTxWeZu0P5RgnyhxEUYk=,iv:10QNK78fcJgZX1i2Pm8he5SM3MGIi4YIJAu3gW3J8A8=,tag:wUVXXULWnRO0ayvV6bkrQQ==,type:str] + port: ENC[AES256_GCM,data:UUZ9cbIBbTE=,iv:ip9/fYvHvuQ1JG2bisPkQBkAqZ1QcuSDyN37Zujj4rU=,tag:xI2+bRFFDvLVfjyxOoJrwQ==,type:str] + username: ENC[AES256_GCM,data:i7egRH0miq8zfQBg,iv:EybU41j7ZzfFyYRjFHxikC677oOimGIUYD5DdXs/wL4=,tag:J7ze6hE1PGySzGDecoenLg==,type:str] + vhost: ENC[AES256_GCM,data:tcZT+X5PF3wZ5SIp5mD71Q==,iv:9T1otBBEdIrjk2l1IPix5EwSHq/Ghbc2lkuipel1MX8=,tag:1orMjK6yA4lAfXI6iBcC4Q==,type:str] + default-rabbitmq: + heartbeat: ENC[AES256_GCM,data:ORl2W/ign8U=,iv:Mzpjn9/yWlwK0HO0OdjYZosHq0nvnL+neERuxFITQ2I=,tag:erD3UBcG8sH+zS0bFfP5dA==,type:str] + host: ENC[AES256_GCM,data:CyRZ4ZwAIkC+CsIg6PGmORTQ/WzAz+u8HHTVMqaWOOQcl5peavUlJ3gJp7XshGhi,iv:dwcGYoC7zN1KBbZMDnzVHoZbzLI7J6N5A79cajWmnZA=,tag:F9InPRuiuVjGxjtuSiPMXg==,type:str] + password: ENC[AES256_GCM,data:GS5/6fsJykREvBO1QPVYetezYyIkcSRH3btplkAFXH/hqlLa+iavKj9rEIg=,iv:gSXh3/blvsMX3+BCsc3LIvTUHV6CHslIY8CWybo23Uk=,tag:XdVjgbZ0Htuns4wbOYXhMw==,type:str] + port: ENC[AES256_GCM,data:GeYkRPmMahE=,iv:SzjyKDxxboR/B38DApOrwpJ3bBdRa9KBRFg9O8uWvp4=,tag:OR24HeWaBcqtfwi9Y2Fz6w==,type:str] + username: ENC[AES256_GCM,data:Yr9mVhetWuC79daT,iv:vqSMYvmJNhk/91gfRxjtaAwGHNg7q+67fiMi0WoJRzQ=,tag:YlyCU0bzaH/Ga65eSdOPrg==,type:str] + vhost: ENC[AES256_GCM,data:kKWzuF5Z0W5Vh2ZGh4gn+A==,iv:AijAE8er7LBC0KQaRmSy3DhNS7T+LHXxmP67mY6+JkE=,tag:cd0x4RoId+MVW74jP9AgWw==,type:str] + dwg-rabbitmq-secret: + host: ENC[AES256_GCM,data:40rIDTNl5Kzg2fK9B07X/tiC2D+8mB04Yv2vorDD5uP7ga3LDP7pjDQyqqjebLOhk4wkkOltzYJUzdo1UOJAtM1gMzs=,iv:iM4Mgvwby8e+91Ty+p5Y8MTy7o5cMdcXVtrLJRR6tGQ=,tag:Rgh919izGxQGQsb2pfAUvg==,type:str] + hostname: ENC[AES256_GCM,data:KkVBOjwxJQw+BAhbQ8dUPWOxBWuAwHzFfnzU3GkiqvViBBAF31V/kINHqdQjuR7XL/oMZWID+jGC+LkBlptIqVXo8eIwHPuD,iv:RGbTFLE8PwNBL6Kr/ZI61/zF6gre+F/HvaIzJbOZ/EU=,tag:NcKkM+1CHqbAwRINUWC4cQ==,type:str] + password: ENC[AES256_GCM,data:OpOMgSmmtVv/d6gBLll/iJ3Xb6l+mhfL2lmkVGuOUV/ydmbzvQENR920tHo=,iv:AWYV5JByvEshZ04Tb+TjxJY5C/i19IAPFpuiYxQLkA4=,tag:2OqxfA1BBi9GYXDjhsB9gA==,type:str] + port: ENC[AES256_GCM,data:yLMjeIXEG2I=,iv:18k57DGWxaTIPjnJ33Q2L1ynKxzCgz+YkTa8fnruI88=,tag:HLcmT7udmQo1Bdvpqb7u7Q==,type:str] + username: ENC[AES256_GCM,data:PfDXbQ==,iv:AHDvb+/6tEvb8jLK3rDAFq1VLhKOdlFiMK5LI5qzBiU=,tag:wJwUw97ltRLkBme/6+v6QA==,type:str] + vhost: ENC[AES256_GCM,data:l4gquefjQ53Qjn6Z,iv:/+58oId9MrD1w0+0ftX9ZPqF/VVvy+p8F3soIKNR1go=,tag:/agC7gAfBAH9GEhzoPR+Ww==,type:str] + hasher-rabbitmq-secret: + host: ENC[AES256_GCM,data:DxmYL/ESDMLmoeZPcuRRKKKaE9CpcjAsu151AGKL8zui88+Mp0CPQLOSm4zfxRDg46UEnAAb5k9r2u03ansgeiNActI=,iv:ZvTsLgtocy+t3O8ug7F4gwM4il19UyLq/GOkt6qdeL4=,tag:BoSeJUXPMwRTv6ztKzBKpQ==,type:str] + hostname: ENC[AES256_GCM,data:tJQLEXRmv6dhPwJCNXctyKAyDeCGsti+H13SEvbG4WFkGZzcaMkCrcq7/yK4Mg/pZzrCw5/Yj7MaJDaHvSkMayQ6SK51rvjq,iv:/wuwTCJYWrNfNa0NDTcTPeYVEHPvpziBoIQxFO4lwb0=,tag:CdTh1AgLWIjcYLf6Fr7VAw==,type:str] + password: ENC[AES256_GCM,data:rldwh4tkUSD1fib0d9eJjX6CxsdZVRqG43+wzW4uoQ/R0GVLQ2JLMm4dsxI=,iv:7uIrgUWQafYZFLm/dCQr4un0zkD0mdGG4j0pU4bmjxU=,tag:L4mFrE0o9z5PrHMOZWaTzw==,type:str] + port: ENC[AES256_GCM,data:GZnWvFtmdkU=,iv:Ssn5quDZAFxm8+KfvUYseqdd5HE2znhh5FTdoiP4ZyA=,tag:jwAVMzrAYXSNdNnNZWKwcA==,type:str] + user: ENC[AES256_GCM,data:IQA+sTN2IIATgwzg,iv:WHj6l33XmJFmEb7cbmDCvV1Asjcfncx84AOEB7RV5uA=,tag:3hThGgwcXDlyfP8mgSfRlQ==,type:str] + vhost: ENC[AES256_GCM,data:XiXHCa5TKKb499QzdqKCWw==,iv:/sWrCPu/0zgtk47QviIqu2PwyjEm+3996B8mPUJQBSs=,tag:Irk2wbD3/+t22Ya5vhKr/A==,type:str] + pdf-splitting-rabbit-secret: + password: ENC[AES256_GCM,data:N0o6u/erOurSuw+dsl4s0qzq00TW3LTl4EheHui1Nbhyp9M9TwjvmkwGKtI=,iv:YXHeY/a9/dviP8nXyzMuc/+hq0Cx9qhsq1bJ33x5+Y0=,tag:m+peu7GdVgLVIA0bC3pFmw==,type:str] + username: ENC[AES256_GCM,data:LtC3kdVUZlmR+Iiytww/37dfbRPfEVJ/,iv:4c/QnY5AMrOjVTbx3+WJR5LbOGIMJ9tBf9aIimKnQNk=,tag:9v3zclQzXmxY46ITFv7Ksw==,type:str] + flows-prod-rabbitmq-secret: + password: ENC[AES256_GCM,data:WXNudIv3wAGjlPY4boVJmgOJZJIqkTJkyN7fRfgpPhjHnfYddArFTYSL0JI=,iv:a/585wLDSXvr85FE85xrGYCXMZkc1G47ErYFdjhE1FY=,tag:otN01VbxlzROsg0SG2oF0w==,type:str] + username: ENC[AES256_GCM,data:M6F6WOqurMZ6a+gm,iv:4ra0070E0UrqC4qsbqVmGUkqIA62QTCPsm8WaUIWZWs=,tag:JbCsSq+AkfW+YMUA7k9v6g==,type:str] + issues-prod-rabbitmq-secret: + host: ENC[AES256_GCM,data:zQ68/VAoCNzCK7G1zDiA223qpcysG9fmAmACcCRWIxwKjg4458ghK+TStIk=,iv:Cax4aA7S6/4zwc5YbVghvdyDpDthZqxKKQ7hhO3ch20=,tag:zRne2z/zNXnaOD54DUXC0w==,type:str] + password: ENC[AES256_GCM,data:6qjn3tKtMTg3Nz9qCRaCc1nVBZxGbPA/NC0GWw==,iv:NL/UARccVJhvH62zJgMqcdVCOXdxwChJLjVD84UrQqE=,tag:mXU0xCWdTCPrGZes6hutBA==,type:str] + user: ENC[AES256_GCM,data:Atx7B57feHA=,iv:6HQYYXMTNqDBkF3Oy3hTpRSIfXCeb2wDJ0LteDUC4ls=,tag:6eSs4wC7MgXdo5Fvg8U1ug==,type:str] + username: ENC[AES256_GCM,data:wGLqBWHxCqw=,iv:9L+pDskewfs1Wik+zoCdQEbZiBGzLgC1QeNx0eukEDM=,tag:hEcH4cMaxB80WzNYpZiuww==,type:str] + vhost: ENC[AES256_GCM,data:98TUsR9J4whYBdlxupIkMQ==,iv:UuzOWGvFw+TrF9Fj0KySY9Yr7pGPqAjuKxAtHdgf/8A=,tag:ZiBYcPH6MjZWCt3hZXhWZA==,type:str] + cde-secret: + AMQP_HOST: ENC[AES256_GCM,data:GMm1jx9zM0HrPKlfG2zjbgVgsK1Ie0IgNwKQnLBmlx8GNp4vDlEn9DXavKtv2fLx,iv:ysZAzP+mjOAIHTBDLvIgbbNHpLUCpt93O3iN0zY726Q=,tag:PYOU2KBH47feCNGN9+JLPA==,type:str] + AMQP_PASSWORD: ENC[AES256_GCM,data:80WT3fFhi27lWsEGY+q1txTDJhSPtUzYoSSiIKUcb2nYCWysl3n3yJHDnJM=,iv:AGKfcBRlCxGIffI3DWy5eud/0sP+tIoQSbXsKDn1BoU=,tag:QmHkyES/r+ax+t/Y0y7AhA==,type:str] + AMQP_PATH_API: ENC[AES256_GCM,data:k/b98bIfsfcxBEfDm1X0SQ==,iv:tisCwsegnUkhL78hyoy3qqGqCDx6/mWE8VgZ5A9ZPx0=,tag:HZz7D4/q8wgb7I8mhKRIdg==,type:str] + AMQP_PORT: ENC[AES256_GCM,data:bvO8/tVdETM=,iv:Ojb6G/1WfAcDanBUue3OiNYYL9qO7IF0K4hAgzxCqu0=,tag:FC/JyuqCTGBMYKpTLpjHtg==,type:str] + AMQP_USER: ENC[AES256_GCM,data:hMoPY+jxwCL4WTNS,iv:dCTIe/qvxLVoh3CpJ4EkO12pvqy/7Seg4HQXdKeUIn0=,tag:+26O5vub/dHTj88CSdMpxg==,type:str] + AUTH_HOST: ENC[AES256_GCM,data:IUwiiNO70qfDwF37tXe3lDYH6oGWMfoKrKV39lyMNkY=,iv:P8ELc2ALIIuHLmYONIkGiEGLQqgd+rc7kYcTITs0RIY=,tag:rrhsXQmWGnIzkliJNyQj/w==,type:str] + CAMUNDA_CLIENT_ID: ENC[AES256_GCM,data:IwDgi4E8vMVP7Dan,iv:/mqIH28TuCL6g5lseJNXEL2wx5cfUc3KgEbEccjwprw=,tag:QSiIVoWXiTsKPl1QEKNfkQ==,type:str] + CAMUNDA_CLIENT_SECRET: ENC[AES256_GCM,data:3uTkd/Ui9oZwFZHtKlKSGLtD2ld96hxNxtUNJrpAwpxZLBa5Tb3P4Q==,iv:UOc5QDbvzmymjpDVrYeyRlMB7kzsBoNxPTnXBJq/BGQ=,tag:bCeyrb2bEwhpmmY3aJE6Zg==,type:str] + CAMUNDA_KEYCLOAK_URL: ENC[AES256_GCM,data:biEuyKr2UiUontk4VdOBQyxTnPjqZfg8pMUXZ7Mj7VIRxb5xhqrlyAKcacTHGASdPRaS4pa2zCW8b3ReCRFUZn0PcwG2QQlM,iv:ddCMQeYieZgj4hgp6JLtsmgt/6KJ8XlcrMFSNhkk/CU=,tag:olRYU14/xgbbt+cjYCr+WA==,type:str] + CAMUNDA_PROCESS_DEFINITION_ID: ENC[AES256_GCM,data:L9o/NeDwUblnGNPWHk4s9B9QzQY2QGJH,iv:zt5XBfUqx72sRUBB4PzN78BoxkuA7/OI2FaX/wQnZNQ=,tag:OAJg2B1/Bj5/46OV3P4W3g==,type:str] + DATABASE_URL: ENC[AES256_GCM,data:5cfNqEvQfTIliZ2Z7GdeWoaXXGHL/1THZsyuMCaTy4MBjIa86MTeFN0h1S4lfrmO/chkvwcAs45cDlyHDhkYJy5eAO8BCWkiwLOkaiMAGnl0netgb1N1qQ85sKVQOYYRglrU8gRlUJcw3gTnTuZKQICImFfxu+EBPss2bcQLhAjtkikpza9M0dFnVEF7eTK1+6+5+zIWa1mNqwv+yBLWx7sIkBS7h6bzE5Vay2PBe1BJWil7eHSFng==,iv:RS0meXROJIVNshaQUAW9OclJe/LrIVoICUZtLD947OY=,tag:fczniFx8FpEUQtwWlhLgsg==,type:str] + ENVIRONMENT: ENC[AES256_GCM,data:RXG6qd67beURX+8aoVi7mA==,iv:RZXDvCywJSdnGyI/5RsOv5EyujZ3/t+8rvjF4vrcOJE=,tag:Ak8XzIERSFFrLNTkHciGWw==,type:str] + FLOWS_INTERNAL_URL: ENC[AES256_GCM,data:0G1OFMX1dqTLMWrvT9bHZ6M62DxIZvYP1gKNYLJlsx7E7TfZIhh7gZgVuianiE7NDbNngtnKSeuamFUpv0dFzL+UE7OqG47I3bdoxaiu/uiDghLSbn0+jeFvjTU=,iv:tipQZGqu0EU4sQ5YpkIkTo8fdhYQkEJYcBEezJkDdoY=,tag:QrAZ50J9p0ibQyyqqoFqNw==,type:str] + FLOWS_URL: ENC[AES256_GCM,data:qs2hBgsDlnXFDxCt2C7DyI+Kew3/0KpcU30Bvz3+i9Ojw+buwLpZVC4k1bKkXqH7F5YZGgInVSAAQKeXnY3AwseZ5g8/2cwomA2sdgWN5pvU+R9n,iv:eeEoNSDzI4xYwbIbOPF3QU9zvlNXcI8ntYQbx3VaexU=,tag:4D+/EfPL552iLSRYnhN4oQ==,type:str] + IS_CONTOUR: ENC[AES256_GCM,data:x4A+Dh6J4EI=,iv:jj7KITwdQlvQ4ivmv78kwT9OrncQleLj0+d0zaiI5BM=,tag:GjSsE+ITHbzcP/OdebScFA==,type:str] + LOG_LEVEL: ENC[AES256_GCM,data:fZYdfwtH4QA=,iv:Nw3f45JKCDkRgmxOY77wsNSLL+9rK4M9XnW1Unh7Hu4=,tag:VMa3RsOk75rILgCpK5ldOQ==,type:str] + OPERATE_URL: ENC[AES256_GCM,data:OZmnorlT8X4QdOwAc8N3AfkA/dQFKT/XuEkmfkcJ0GvG2iPiiPnujOVDCyygn/pnJ3+XKYpW538Cfkb0lR2ADLoV18nZLh9N,iv:/UHh6jeavd8gLSJO72UJV1YM2qnfnKyPAPq3fXQTrhI=,tag:wDKXyPKC3ZCn5IgNBUTHKQ==,type:str] + PASSWORD: ENC[AES256_GCM,data:pWSCSpBBqGbsekxw,iv:LKTcwGyLmovSIkRfm/FNigAN6MNGnUr/Fw8nZgPk6kE=,tag:9rgGYZoXKUuvWwbY5e0HkQ==,type:str] + PDM_URL: ENC[AES256_GCM,data:iKe462MfR8DGs/qjNj0UHux3Uv11SSbDPQliiOQzPp47LGWTfJDi+Z62PZY3WJX2BzGAlDZA8u0=,iv:y6EzeyMGQOFAt+E31ubVcX8tJC9FXsd1NoMtLPC9atw=,tag:WcJjEOf7c2jWOW85UAHouQ==,type:str] + PUBLIC_KEY: ENC[AES256_GCM,data:Ozbl1xMn9mgM3afpE7vY/ZSx03vg8ONu02/cUPluGCuTAqYCvcXDds5GyCycnp4XjzQ/gYT1zdo1MMWPVcYQ+bD55F8rowaNYlfgzJlptJ7saJM3Syb01AFGERXGOA8xUc8uotxvJfMd1/vK+h0P1WtKK6AZuN4+6/+wXiaKJN7Va4PN4rCooU9CQULX1b/Di9UQ2ITckzjxTqu1MzVi6YfV+xK1i8pZQLfoiq3yo88U74zA/mx8fmCAOje9NCmuahlXkA5uZhLjwi5DLWIaVBUqF705+ACGKcwjezKE+PYgTpn3RrsczJQ+jVRAuFYVqpPojE7iksYZoBKjDtJjZPvoGnTtW3uzusEAPfqgChpFIlYHoc1IMrtE4eBVM0pWQjLfBb2+UNcol0CepZspGFIr+JMcOwbrYHpIAejDRBK6wTFEmqZiCm2IOJ8lpTmFrQkrynLDyTGcsVwMIprbFspdK4t4LEZeckYz7Py6RaVYa6Chdv3wf03w8bK1zUcKf1DsW5/e4jG0zYeAjRQXPYgd8ld+llE2Qjd5CCYbYZSOKtGxbgNJ24Nod76ltaXN8sxaIGWYbiIsT6jVTq29cW877HlMn5utKLTYSH9ePxpYy2Yy7JTk6PJz0xuTwI6LFYNex6VacjF7Vdstx51fREMNtz8qD20bFf+84SQHy6Kyg0u5GTozRjGLwaSxiV78JgkX67nnmK+f3JPfHOSlr+Im/DTEqYDb+mlE+wGwUdFQ7RLYAs14wt+17BGX8SesodfUnkdh8aiu2gw1ENgLVm3ggA8yVxMUGk116FycWjYyeabSdcguSiytmFoSxgQets66/IhO8l3QCtDzGqzzZ51Uf28V0zpQxhsH8d1CHED846kGWGcs/px4vDBoQwZ+wXJfzTvtuOZX2Q1XD4FuMyJJAmbo6EQb2SSp4tUJPlxww90LZJd1nUhl0LU6pcEKCGtJAggWVqqJViJ2yU/LDLMiNkjZh3sAN2wcrXkjkglCpwwZWFv4hZmw4kPiBVIaMyYsHJ3PeGynwNUY/F/CTnai6F7KxfJ7k29s6Gp6/LEJ/9Iuyq2Dususj7GzxUvv1Yvy+7nwtHFWii4wwfJpUBtUEFFQIi7k4ZhNlYbuJghWGEQBv93gvFrmuD8Sdopm+vhCGzqM4NT9girXaMglwdeQnhMNQ3tZgao6Ua5zcXcA8AA9bEkx1E0RSW4oOq3mAywpUej2BjC27x6DgajpNZ+JU8bjhSTEcAvP5K/r29vBHotF08M7NLs9Nk1wl0cEIrAQO9TbYEdKQ81cqWEDYhxfy+AXbE38kPiloizbAN5If4UNUTQ/uB8RJ+6103IcOw7HYTxSClmC7Nc9juKfjmxpfpD21zxSF+PgYaeI2IR4EBN9O110oZa46Q0Odsqau5Ueykn3BeJWt8mX,iv:UVGqBkzrz2swvcFVyj0S3pTJ24LkAGBOZIjNziLylig=,tag:ujF6PabbrJqq4QGAWXcOPw==,type:str] + S3_ACCESS_KEY_ID: ENC[AES256_GCM,data:szVUxfaUHSRB7X9iY6xJF4ZzHMq0OgQ4UlCLDw==,iv:ganqJm44BswjwTtCtPx/L7rug8JVPjpoKq6ISfBOG4o=,tag:wGeeYgstuAQtm2LmoQB80g==,type:str] + S3_ENDPOINT_URL: ENC[AES256_GCM,data:Pft7l494kWPkJUUKAWPn5wgNlCeEj+g+CTbNIBRZuq7UahXRFYMJ73OQMik=,iv:tRNrXDa3Ce31eVCxDqiQ2L7jHsHKO27rvpCmcK/sp+c=,tag:Hcefxn+PLZlPrWaXkiSvmA==,type:str] + S3_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:bsgHZvOA/4P7h17mXJsTG7H7cnQLr/wTzJrnF04lJQ269LHbEhXlO/J5BdmDSLnTOs2vcXkDcnY=,iv:WO3/Fk9ys4ZR4qyxKMZZt3K/m53nnaNsORkfQ7ckUnY=,tag:3oIEU4uLOobux1a5Gg0WMA==,type:str] + SYSTEM_LOG_URL: ENC[AES256_GCM,data:m69N+13hvFuu9v3R7JVYsxUAF++VqQklFN9waF1t6f95FEuOUJ74VA/LkUlwuJVm,iv:xjUDhXZ1T/2qNb7tPSBwvzf5+9z7Hwkb4U+P3V0KzG4=,tag:njl6xC7+VsSoNZ9NXyRTyg==,type:str] + TELEGRAM_ALERT_GROUP_ID: ENC[AES256_GCM,data:wKgw4opWyJXFVmqxFd4/YvvM2Ns=,iv:OEbBE48rwuVziqyGqMlHexonuo8YfUxURY+paMJUEqY=,tag:5MJnOdL6IzJEXBtet2BPBg==,type:str] + TELEGRAM_TOKEN: ENC[AES256_GCM,data:Q0KQc5NHUu9S9JzCGCFa/dHh6Ku4WpiuuS0o7UJPZmAhN/ofEGWxDzsp2G9nKDkrYI2eP9hMYyGb8aU2plCLPA==,iv:UGvW+oo3m5C74htbXvYCDpxu02jNngNTefjCRAioYWI=,tag:jvkdkU6qfkCfp6raPKSPEQ==,type:str] + USERNAME: ENC[AES256_GCM,data:n5pyXsc2wg7ZFXXd,iv:bcbI0EAKjk37H60nKJa/ixaa1lXCMEkLXGKfnoaZyTo=,tag:2c0/sGcEpG8BMiClLV+oQA==,type:str] + WORKFLOWS_HOST: ENC[AES256_GCM,data:BHDUywDhFP0UZRehW3J3E1VhQDcIzZ2T71UzXXBJP8nWQBPOt4p3abOrib4z8t0pjvfYl4ELdA3G6tppV4xSfvYAGvtfROhz1IGXOZNqE8k=,iv:1lII+JsJp1KI8Sw/cugsV0YQsXuFtiCVHSUGRDvrSzU=,tag:VHpOZSVNg8hlvfxGqTYRYw==,type:str] + WORKFLOWS_IMAGE_TAG: ENC[AES256_GCM,data:tpm9e22H6v8=,iv:kinvW3DRjiTTCP2dHB8Rly/Pb/Ie9xtq/DekobI+oJ8=,tag:5xFnpc1MQL6pzmffcwXiug==,type:str] + WORKSPACES_URL: ENC[AES256_GCM,data:6+WX+Gzk1FMFFa+7NSp2uQoy5BuX6vERZqLQaWX0Oh5uCYhJSdQes8bDl8d8DPMd7gzXDS9G4oY=,iv:jDUdY4GfE8vK2mc/cT/iBm+xHZOpPWF+VUSKx1ESSeA=,tag:kQtKWitIbh3rBpag9JDrDg==,type:str] + ZEEBE_GATEWAY: ENC[AES256_GCM,data:++SRiiv0HqwB5ZC8HK+d1fpw1CVDF0f2w5/HegPusPuaR7Z0l1yUNqtgfU+lsgmuksL9RFft/e/U/GqOO8+gpwKZC2NNkFX8zYOJe3vNLMM=,iv:KZUK61NedkDkcR0RQKBJDIbtm6USFFb9FW6YmWDiQt0=,tag:e8W6tWPhCSe+/K45S/4tWA==,type:str] + rabbit-secret-pm: + host: ENC[AES256_GCM,data:h9SjMx12Fdo6q2GCO4+vQGfl1eUN9XwuU94c2iVXB6+rZaUX2f/FBtm8HaK08tS+,iv:TIF27mA1CLhEmYM04DN4NfUckkHevblPBGiCxQMXumw=,tag:+SR0E9fF9KIJ08om9ua5pw==,type:str] + password: ENC[AES256_GCM,data:HUXkkjQntlobWrqVfTEKUQ96/JDY/6+x6xMnz97d2wKK5XX8rbmEm0daBxk=,iv:tZi7vVJoPk/Hoy14vnyC6VtC+L4gHTvX33fHtW9iQHk=,tag:2IrxdqjL0uHl6Y6OgMun4g==,type:str] + port: ENC[AES256_GCM,data:s2x62RkbngE=,iv:EiCCXuft71iM6qX6mHeTN53+ZV8tVORvLuBNnkrhRrA=,tag:4LruhMIyJKo2dWrlq/S2MQ==,type:str] + user: ENC[AES256_GCM,data:BQiJTw==,iv:Cxwc8MJEIkrhSxCZGaWp429gSeIzrslg/Qt+Z4tDp30=,tag:ugcL7JFdH1ZaNZ7VOflD0Q==,type:str] + vhost: ENC[AES256_GCM,data:XY3apO9AmSMaM9P9,iv:ruN8677SyuboYLO2LoXsWthF7VRVZ7BMXt8AoxpWnbE=,tag:4PMgFCQ/nkm61dd2t6VIQw==,type:str] + documentation-rabbit-cred: + password: ENC[AES256_GCM,data:QaVHXsnzHS95P7sHd8lgZDKsM7kusMIHITzZ+5YsDY8DKfTSyt2EDEeF7kc=,iv:2AdhPs99hhuXddROGEFcfHEl9nE6Eh1jq+STqx9n/Qg=,tag:b0xzBUE9YxGMK4BbrLQvJQ==,type:str] + username: ENC[AES256_GCM,data:kaLwgNU/XHRlryhX4SiO8clUMYoY86l/Sg7/9g==,iv:MvQ/cbMoW5gEhgxfe051ywEFmgUE4FT8or8gP++c3lM=,tag:8gPfWpSDRDztppYl8m0B8g==,type:str] + processing-prod-rabbitmq: + heartbeat: ENC[AES256_GCM,data:q+6XsQO3Fcw=,iv:UKeV0kLfj5EQhc8IwMiDlbzhW7rbcK4P1XDIKoityaU=,tag:QhaXgwtkQKwEYOCU271NFg==,type:str] + host: ENC[AES256_GCM,data:usdVXm+2y8pBhLwvoeM+/19muXRxwOYeDvODnlBwqj2TZhLy8ry7GCtPqiCX4XGc,iv:NW1jP8r2Id1X4Y6cAHqo9gcgve/tpvaaLw1gvIWwdbQ=,tag:dGYanPXM20VnDzQbuJLASQ==,type:str] + password: ENC[AES256_GCM,data:ZjEUzzENwuynbxvEVnBramBy0BijJ8NlSiuB30Z3BNIL2dADCaLpe/SecXw=,iv:aLf7Qx8VnRXgEAAXP7Q6l6EMLQlLihRCDUydAZUWVIU=,tag:cbH0FO/cSKNI6ldoSECDyw==,type:str] + port: ENC[AES256_GCM,data:GMmFthNqC3E=,iv:y3gh4H5mK7IbkkOLubGg8kT2q3/0bXQ1HBx8U4NL4Lw=,tag:3WyOta21V3SSiDUk423nnw==,type:str] + username: ENC[AES256_GCM,data:tDcKtSr/ilOZJeAJ,iv:rttBiw+cOyaonZc7oC4vLfxd/9AL0kt5bP/16ybfZK0=,tag:9mEpJB/S5DGwVTm2VucrqA==,type:str] + vhost: ENC[AES256_GCM,data:oHUBGjuMmMZruoURQjWCIw==,iv:s+hieaJJ+Fp45ZgzAnM5YBNncxlT7S5LRXLI6JIo9ro=,tag:ShSp71HyhydtfEAfg/Om4Q==,type:str] + rabbitmq-iac-smoke-secret: + host: ENC[AES256_GCM,data:eVVnHDfwIt+htJ8+qpM++v3DEk0XRX2WOWXWd+DiYzaZg55XaXSW0Y4ntlIiN4FIwpVcpyiKcYPXfpOgh77xGAUDNjc=,iv:EuwXweCvmcs3MGNH7QLNRpaV72hP/fmdqIMr8etXj38=,tag:v78xf4eKX3bM3DsV328QyA==,type:str] + hostname: ENC[AES256_GCM,data:VKSfIoFLCN156UgX/WetJ5a4WE/+EUFASuUA9qsOyZusOHi9jHpucL64d9QeDyGsrttaJrqgH+hiMVKtP54g4NLOaP4s0y4v,iv:wS/aZPF3Vzrb+g8FhWRXYKTCoJywk+34lBTuAmfEjAA=,tag:8JOWHGnq5mdcp74SWjkoQQ==,type:str] + management_endpoint: ENC[AES256_GCM,data:h6iQ65dNy5MtB1rDrIhGmkuaRtCnWa9e0LeT/oIDTwDzBw/yRqkpBVY5NXbnLEWmvt/PwOWdhvmDnZgc8dganwOz8HgtCa8HA6BTGyj/QmL0xiU1,iv:/dmawSXS5iFE/7HtZupfiB4LkvDUSwyyABFs93esT58=,tag:P4yChybEENZJdqjml7ggOQ==,type:str] + password: ENC[AES256_GCM,data:dWi1lDq7pPLq7355EFQi7eeYOv8p2wQiXkDKjiywaDda3sb423DYh64dNYY=,iv:9y9ooZAiEmrp763WksEw0uCSGjycHK5Max4sVftVgH0=,tag:bboRg82cMyjOCZOSxuOh/g==,type:str] + port: ENC[AES256_GCM,data:0wt3M4cO0Ec=,iv:rrS4rP9beTvfAziANnDEztPMHcR482PVe3Jr6czQLhc=,tag:HGmAD754NRWqT/jM1brcMQ==,type:str] + uri: ENC[AES256_GCM,data:7S1wr6pHFV4HvUQFY1bBk2xPa9wNV9o+vwNejmUtrWsCgIvX1L8S/1OZUeY1Rjky5G/J9BVV33Sxi8+8aWBR8ueJCa3kMecQ+Aed4hnRyYpCSFFa7izJ1I5VHnGSD7OrN6upeP+xspE0q3opOd+U1g6T22/GYwoT+iRqRXm615jRv/iEdHcBv/rjrs8RSuKEHmtz3mOpuBKE+dQcKQNysuEqWdNBZLIl,iv:MUD+POrjLLIELwhuthjQ+++Vqf6qZW2gp+hyGNkSDts=,tag:ZQ0fbwZhI3tLjyD8l06lyA==,type:str] + user: ENC[AES256_GCM,data:3giBqVyUIdh4j9zSESq93y0CPqo=,iv:SrwPFItz3KZgMys/qWt/0g3HSsDQEIeNPDj6ZIK/MnY=,tag:gaPSARNAppZjkR9cxHFX6A==,type:str] + username: ENC[AES256_GCM,data:YS1Df17MZjqRzWZHgHa7vg+By28=,iv:scLr6u7Lj+yP6Y6w4EoLxTZ0Ea3+9xlMm2MhKggYNZs=,tag:cfWdTn/StQT5746kzecPLA==,type:str] + vhost: ENC[AES256_GCM,data:oNhRI2zwZrVLMUFk08CRvU5+2kU=,iv:RdDn9DXtF2mOhd0wQzyKn3viyiaXtrqeH9gLkYomKDA=,tag:swHLL87BKqbk4u87MRIDBQ==,type:str] + default-rabbit-cluster-remarks-api-prod: + password: ENC[AES256_GCM,data:AIr7tgG32Y3tspv4/1iKdQCtisQCLeZ4fGtm9MUKxxYfeeNbpz1FDTR6ZYM=,iv:uMwI510jYZQQovWBonpwd9p+Lc3/p9pbg03canElgbQ=,tag:haOFdwARDmTAbzts3NiSDg==,type:str] + username: ENC[AES256_GCM,data:LfpbVdQ148ngFGrJ5LSEfVKG1ALBTyjX,iv:owkRO7p/ibUpeaxWKNDbhBRXYQyP+ingyYNKOd6qByY=,tag:98BJ+U9L1djplvbD50aZvg==,type:str] + rfi-prod-rabbitmq-secret: + password: ENC[AES256_GCM,data:q8FJoWQ6WwfYcHKKsk/vLtmw6D2KLIK2TbwtT5PWvKMdYk3CRRdySx/zQeI=,iv:hPd8X/m40Ae2VBVc9xJf0eL84lN7IUnYCVgmKr5CKZo=,tag:i7EnZzMfmJ6+pBwYf8vs7A==,type:str] + username: ENC[AES256_GCM,data:YsbsEw==,iv:S5pjf69w1DSEtAjFJI/j8KxM4yTbzwt1iEOAgEGavmI=,tag:9NSy9uQ3V6eKUPIycCKlhA==,type:str] + vhost: ENC[AES256_GCM,data:QllF9QgvK8YfVWhk,iv:hatSJ1WPBB9VC2FHhEpOQDc8DXZ30nX20lLj6KWkzD0=,tag:nnQj1ry8k1H9AKzcelwM4g==,type:str] + sarex-preprod-rabbitmq-secret: + host: ENC[AES256_GCM,data:dxCLsVYFpDYlsGAW42ICfzfak2J257deoKWilIyHNIoXxpAOTw4cG/ikOkPBpmAP,iv:LMkEb2wx12t+2jFSGPBdB5QAPsyPHUl1gN/A/uarLVs=,tag:tjwXXC8Hu2pZUigWrcWuWA==,type:str] + password: ENC[AES256_GCM,data:/V/d737Ny4u5tsQtvwFKTGFDokhCCFFzkKXtCQ7KPRhxbixZ+ysYYnATfPQ=,iv:p+9ua4+WGDYR2/zZ0wHOAvmvRR/v0ZapeXp/2rGiSK0=,tag:d6d2lco3TtVlIeu/c60gfw==,type:str] + username: ENC[AES256_GCM,data:IILdBntB6xY=,iv:i62KieatLDgY+4dWEVE75osg5A1QT3I4u+MiMPRwOm8=,tag:lWFsM5lPZeY8WzOiKgVfdg==,type:str] + vhost: ENC[AES256_GCM,data:+PtSY6PpK+0=,iv:sL595HAeZb8my6PBMD5pC/w+RF50HZkUlqTwUK/p6Zo=,tag:v1gAhrRJQg53Znuo25vyFg==,type:str] + sarex-prod-rabbitmq-secret: + host: ENC[AES256_GCM,data:lWJdUrNmr3HyBIOR10w11mJCN5DkljzFGG3vThmjG5yQXuAtW6CN32rX13XFSR0Z,iv:Qp3Cd8QY8SDuEHXyLXJ1IUklCKh/SyMZ560PDV2oweg=,tag:MCYKgOMSnnoegU6sDGEjjg==,type:str] + password: ENC[AES256_GCM,data:gaFmBLTFSZJBQr8CcF9uUDqBpuh1Ozjp+16/XBAtM9naTC5JNqtDmMhaznE=,iv:mfdQiqOLiL7xFl8HPs5JL7HjHSMenkz1eAAFhAOYuUA=,tag:tR3KrrgBnN83gzoMSc4hQg==,type:str] + user: ENC[AES256_GCM,data:Km4Chsw22xc=,iv:tPJIuKCdrt9imdIcbAmdC4pSNqaB5Szfm05/XO3UTTU=,tag:RIZQCb06fqHRDpWq9rdpfw==,type:str] + username: ENC[AES256_GCM,data:J20YVU+izSY=,iv:Rmw28ZINggnUNoSWQORL4yLudr3eFyPdkAMSjsCjNUc=,tag:pq3yYTLJfXsrdT6nDfzV2A==,type:str] + vhost: ENC[AES256_GCM,data:s5qJ1h07bjg=,iv:O7zU+DJS4idZo54t4g74yogias3R2Iq7OgWEQDTloWA=,tag:8U0bYGsOQ2BZW6toaVuvWQ==,type:str] + default-rabbit-cluster-tracking-prod: + password: ENC[AES256_GCM,data:sNSxjQEhx18xcwhD2gj2VrjMRQrNK1ZKYJY2K0uEZDDQLY0FksabVX7p55s=,iv:L3OADWf+mkSBmsIj6d6JGFlM1ry+IXQSsQw6SOsz4CI=,tag:0qXbhyugxlAtciY90S4SgQ==,type:str] + username: ENC[AES256_GCM,data:jAvckwR3wX/HDX9IxvP1Qgc4x6k=,iv:xrdkz1AcY/05lP+nDfaI7UNpC8si8epYKKW7AIsMJIA=,tag:VcQFNAqttCdLki9RDJP1fA==,type:str] + rabbitmq-cred: + password: ENC[AES256_GCM,data:KvGtyVzcKQx1geKbHWiFsZpUb36uUVHCSRXqQ0GM6/bfBeJ5Qno8AglsCVc=,iv:f+nTLqu0+M2Z9VAvPyYPqq9BsuBuRJGgu75u6rJAQYQ=,tag:/yobLMum+ji/dCmfWmyHUA==,type:str] + username: ENC[AES256_GCM,data:cDbE13wHBp7BcdxcmIaPwxf0NgL/ojo7,iv:P/mtZoJOjHl7r8VIMld6+pabcL6vEurF+tzLe7Esqkk=,tag:Z9JgAKPBXe9IyXYaNWm8cA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age198ea80z7gan2ruetn288ln6rl2qh7xtsqqpwrjtyn8maya3364fsvpdd63 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKYUFOakx4RE9aZDYvazhn + TWtYYjU1b01NSkM5OU5KWGFwTVRhWXBLa0MwCkgrQ3RMZmY5Z2Q0WU1FNXZRU1RC + eUNxQ1hiUGVVR25HUzJkeDlDbWxINFkKLS0tIEJtRUdleUN0ZXJrUkp1cTNhRWd3 + eGdzRjJmbjVWNjkvbi9kaDRETXlCWEEKp8FQO/iTu2o/FuHW7SlEAuIu+AhpWhDS + BURBmPCNGijsFo3My61NQjtZlxwtO1U65FoSnBNpY3tUUqCgd2Aovw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-07-07T11:52:54Z" + mac: ENC[AES256_GCM,data:T7afIMU6aX5LpZvFHRzkQxwIG2alOAdNbA4civXYec7BXbayhxtZ9E32dfwyUXDqNJjHfv3fFgomUJkXBy9NRPPj26atgpMgx6gg9Ius3n+t7g7zESFoCrRFNxuDfDoJCQomk1pwIxCbew7OBjP/8jYEty375Ydf2kbrZ40S7RU=,iv:D5+5StNgcR3rFf3jjERUzQjz5bWgv5eL/8/4FnyEfqw=,tag:q64g0ypzL8P3/3xFM6UL0w==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.9.0 diff --git a/infrastructure.yaml b/infrastructure.yaml index 8dcb1af..5b592c4 100644 --- a/infrastructure.yaml +++ b/infrastructure.yaml @@ -3,6 +3,10 @@ environments: kafka_cluster_refs: prod: cluster_id: c9qks74g084g1419cpts + host: rc1d-s0a1ujcbj6fdk26b.mdb.yandexcloud.net + port: 9091 + sasl_mechanism: SCRAM-SHA-512 + security_protocol: SASL_SSL default_partitions: 3 default_replication_factor: 1 max_replication_factor: 1 @@ -337,6 +341,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.user.updated.v1 owner: platform clusterRef: prod @@ -347,6 +352,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.position.created.v1 owner: platform clusterRef: prod @@ -357,6 +363,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.position.updated.v1 owner: platform clusterRef: prod @@ -367,6 +374,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.position.deleted.v1 owner: platform clusterRef: prod @@ -377,6 +385,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.department.created.v1 owner: platform clusterRef: prod @@ -387,6 +396,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.department.updated.v1 owner: platform clusterRef: prod @@ -397,6 +407,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.department.deleted.v1 owner: platform clusterRef: prod @@ -407,6 +418,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.resource.created.v1 owner: platform clusterRef: prod @@ -417,6 +429,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.resource.updated.v1 owner: platform clusterRef: prod @@ -427,6 +440,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.resource.deleted.v1 owner: platform clusterRef: prod @@ -437,6 +451,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.resource_permission.created.v1 owner: platform clusterRef: prod @@ -447,6 +462,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.resource_permission.deleted.v1 owner: platform clusterRef: prod @@ -457,6 +473,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.company_resource_permission.created.v1 owner: platform clusterRef: prod @@ -467,6 +484,7 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: iam.company_resource_permission.deleted.v1 owner: platform clusterRef: prod @@ -477,131 +495,109 @@ environments: retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan + ownerRoles: [] - name: ams-sync owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 12 replicationFactor: 1 config: cleanup.policy: delete - retention.ms: "604800000" - min.insync.replicas: "1" + compression.type: COMPRESSION_TYPE_GZIP deletionPolicy: orphan ownerRoles: [] - name: assets_broadcast owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 12 replicationFactor: 1 - config: - cleanup.policy: delete - retention.ms: "604800000" - min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] - name: assets_broadcast_preprod owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 12 replicationFactor: 1 - config: - cleanup.policy: delete - retention.ms: "604800000" - min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] - name: bru.cde.folders.prod owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 3 replicationFactor: 1 config: - cleanup.policy: delete - retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] - name: bru.cde.folders.stage owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 3 replicationFactor: 1 config: - cleanup.policy: delete - retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] - name: company_resource_permissions owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 6 replicationFactor: 1 - config: - cleanup.policy: delete - retention.ms: "604800000" - min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] - name: issues_broadcast_prod owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 12 replicationFactor: 1 - config: - cleanup.policy: delete - retention.ms: "604800000" - min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] - name: message-hub-prod owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 12 replicationFactor: 1 - config: - cleanup.policy: delete - retention.ms: "604800000" - min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] - name: premises owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 6 replicationFactor: 1 - config: - cleanup.policy: delete - retention.ms: "604800000" - min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] - name: resource_permissions owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 3 replicationFactor: 1 config: cleanup.policy: delete - retention.ms: "604800000" - min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] - name: resources owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 1 replicationFactor: 1 - config: - cleanup.policy: delete - retention.ms: "604800000" - min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] - name: sarex.prod.blackbox-exporter.probes.v1 owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 3 replicationFactor: 1 config: @@ -613,23 +609,19 @@ environments: - name: system-log-prod owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 12 replicationFactor: 1 config: - cleanup.policy: delete - retention.ms: "604800000" min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] - name: system-log-sarex-backend-prod owner: platform clusterRef: prod + inheritDefaultConfig: false partitions: 12 replicationFactor: 1 - config: - cleanup.policy: delete - retention.ms: "604800000" - min.insync.replicas: "1" deletionPolicy: orphan ownerRoles: [] users: @@ -645,6 +637,8 @@ environments: roles: ["ACCESS_ROLE_CONSUMER"] - topic: issues_broadcast_prod roles: ["ACCESS_ROLE_CONSUMER", "ACCESS_ROLE_PRODUCER"] + - topic: issues_broadcast_test + roles: ["ACCESS_ROLE_CONSUMER", "ACCESS_ROLE_PRODUCER"] - name: srx-broadcast clusterRef: prod adoptExisting: true @@ -806,240 +800,683 @@ environments: allow_create: true allow_delete: false vhosts: + - name: / + description: Default virtual host + - name: b6V7WU8PZpVe5rUt + description: sarex--vhost - name: bim-prod - name: bim-prod-gazpromcps - name: camunda_prod - name: comparator-prod - name: data_engine_prod - name: django + - name: egts-receiver-vhost + - name: events_prod - name: flow_prod + - name: iac-smoke-prod - name: issues_prod - name: marking_prod - name: pdf_processing + - name: pm - name: pm_prod - name: remarks-prod - name: rfi_prod + - name: sarex-backend - name: tracking-prod + - name: tracking-receiver-prod - name: transmitalls_prod_host - name: workflows - - name: iac-smoke-prod + - name: workflows_prod users: - name: bim-api-prod adoptExisting: true + password_special: true - name: bim-api-prod-gazpromcps adoptExisting: true + password_special: true - name: camunda adoptExisting: true - tags: ["administrator"] + password_special: true + tags: + - administrator - name: comparator-prod adoptExisting: true - tags: ["administrator"] + password_special: true + tags: + - administrator - name: data_engine adoptExisting: true + password_special: true - name: documentation_go adoptExisting: true + password_special: true - name: documentation_python adoptExisting: true - - name: dwf - adoptExisting: true + password_special: true - name: dwg adoptExisting: true + password_special: true - name: flow_prod adoptExisting: true + password_special: true + - name: iac-smoke-prod - name: issues adoptExisting: true - - name: marking - adoptExisting: true + password_length: 20 + password_special: true - name: pm adoptExisting: true + password_special: true - name: remarks-api-prod adoptExisting: true + password_special: true - name: rfi adoptExisting: true + password_special: true - name: sarex adoptExisting: true + password_special: true - name: tracking-prod adoptExisting: true + password_special: true - name: transmitalls_prod adoptExisting: true - - name: iac-smoke-prod + password_special: true + unmanaged_output_users: + - dwf + - marking + unmanaged_output_permissions: + - vhost: marking_prod + user: marking permissions: - vhost: bim-prod user: bim-api-prod - configure: ".*" - write: ".*" - read: ".*" + configure: .* + write: .* + read: .* - vhost: bim-prod-gazpromcps user: bim-api-prod - configure: ".*" - write: ".*" - read: ".*" + configure: .* + write: .* + read: .* - vhost: bim-prod-gazpromcps user: bim-api-prod-gazpromcps - configure: ".*" - write: ".*" - read: ".*" + configure: .* + write: .* + read: .* - vhost: camunda_prod user: camunda - configure: ".*" - write: ".*" - read: ".*" + configure: .* + write: .* + read: .* - vhost: comparator-prod user: comparator-prod - configure: ".*" - write: ".*" - read: ".*" + configure: .* + write: .* + read: .* - vhost: data_engine_prod user: data_engine - configure: ".*" - write: ".*" - read: ".*" + configure: .* + write: .* + read: .* - vhost: django user: sarex - configure: ".*" - write: ".*" - read: ".*" + configure: .* + write: .* + read: .* - vhost: flow_prod user: flow_prod - configure: ".*" - write: ".*" - read: ".*" - - vhost: issues_prod - user: issues - configure: ".*" - write: ".*" - read: ".*" - - vhost: marking_prod - user: marking - configure: ".*" - write: ".*" - read: ".*" - - vhost: pdf_processing - user: documentation_go - configure: ".*" - write: ".*" - read: ".*" - - vhost: pdf_processing - user: documentation_python - configure: ".*" - write: ".*" - read: ".*" - - vhost: pm_prod - user: pm - configure: ".*" - write: ".*" - read: ".*" - - vhost: remarks-prod - user: remarks-api-prod - configure: ".*" - write: ".*" - read: ".*" - - vhost: rfi_prod - user: rfi - configure: ".*" - write: ".*" - read: ".*" - - vhost: tracking-prod - user: tracking-prod - configure: ".*" - write: ".*" - read: ".*" - - vhost: transmitalls_prod_host - user: transmitalls_prod - configure: ".*" - write: ".*" - read: ".*" - - vhost: workflows - user: dwg - configure: ".*" - write: ".*" - read: ".*" + configure: .* + write: .* + read: .* - vhost: iac-smoke-prod user: iac-smoke-prod - configure: "^iac\\.smoke\\..*" - write: "^iac\\.smoke\\..*" - read: "^iac\\.smoke\\..*" + configure: ^iac\.smoke\..* + write: ^iac\.smoke\..* + read: ^iac\.smoke\..* + - vhost: issues_prod + user: issues + configure: .* + write: .* + read: .* + - vhost: pdf_processing + user: documentation_go + configure: .* + write: .* + read: .* + - vhost: pdf_processing + user: documentation_python + configure: .* + write: .* + read: .* + - vhost: pm_prod + user: pm + configure: .* + write: .* + read: .* + - vhost: remarks-prod + user: remarks-api-prod + configure: .* + write: .* + read: .* + - vhost: rfi_prod + user: rfi + configure: .* + write: .* + read: .* + - vhost: tracking-prod + user: tracking-prod + configure: .* + write: .* + read: .* + - vhost: transmitalls_prod_host + user: transmitalls_prod + configure: .* + write: .* + read: .* + - vhost: workflows + user: dwg + configure: .* + write: .* + read: .* exchanges: + - vhost: / + name: events-prod + type: fanout + durable: true + auto_delete: false + arguments: + x-max-age: 7D + - vhost: b6V7WU8PZpVe5rUt + name: celeryev + type: topic + durable: true + auto_delete: false + - vhost: b6V7WU8PZpVe5rUt + name: default + type: direct + durable: true + auto_delete: false + - vhost: b6V7WU8PZpVe5rUt + name: documents + type: direct + durable: true + auto_delete: false + - vhost: b6V7WU8PZpVe5rUt + name: high-resources + type: direct + durable: true + auto_delete: false + - vhost: b6V7WU8PZpVe5rUt + name: hight-resouces + type: direct + durable: true + auto_delete: false + - vhost: bim-prod + name: celery + type: direct + durable: true + auto_delete: false + - vhost: bim-prod + name: celeryev + type: topic + durable: true + auto_delete: false + - vhost: bim-prod-gazpromcps + name: celery + type: direct + durable: true + auto_delete: false + - vhost: bim-prod-gazpromcps + name: celeryev + type: topic + durable: true + auto_delete: false + - vhost: camunda_prod + name: hash.compute + type: direct + durable: true + auto_delete: false + - vhost: comparator-prod + name: comparator_exchange + type: direct + durable: true + auto_delete: false + - vhost: django + name: celeryev + type: topic + durable: true + auto_delete: false + - vhost: django + name: default + type: direct + durable: true + auto_delete: false + - vhost: django + name: pm + type: direct + durable: true + auto_delete: false + - vhost: flow_prod + name: celery + type: direct + durable: true + auto_delete: false + - vhost: flow_prod + name: celeryev + type: topic + durable: true + auto_delete: false + - vhost: flow_prod + name: flow + type: direct + durable: true + auto_delete: false - vhost: iac-smoke-prod name: iac.smoke.events type: topic durable: true auto_delete: false + - vhost: issues_prod + name: celery + type: direct + durable: true + auto_delete: false + - vhost: issues_prod + name: celeryev + type: topic + durable: true + auto_delete: false + - vhost: pdf_processing + name: bim_360_input + type: fanout + durable: true + auto_delete: false + - vhost: pm_prod + name: celeryev + type: topic + durable: true + auto_delete: false + - vhost: pm_prod + name: pm + type: direct + durable: true + auto_delete: false + - vhost: remarks-prod + name: remark_mail_exchange + type: direct + durable: true + auto_delete: false + - vhost: rfi_prod + name: celery + type: direct + durable: true + auto_delete: false + - vhost: rfi_prod + name: celeryev + type: topic + durable: true + auto_delete: false + - vhost: transmitalls_prod_host + name: taskiq + type: topic + durable: false + auto_delete: false + - vhost: workflows + name: input_tasks + type: direct + durable: true + auto_delete: false + - vhost: workflows + name: output_tasks + type: direct + durable: true + auto_delete: false + - vhost: workflows + name: pdf_data_input + type: fanout + durable: true + auto_delete: false queues: + - vhost: b6V7WU8PZpVe5rUt + name: default + durable: true + auto_delete: false + - vhost: b6V7WU8PZpVe5rUt + name: documents + durable: true + auto_delete: false + - vhost: b6V7WU8PZpVe5rUt + name: high-resources + durable: true + auto_delete: false + - vhost: bim-prod + name: celery + durable: true + auto_delete: false + - vhost: bim-prod-gazpromcps + name: celery + durable: true + auto_delete: false + - vhost: camunda_prod + name: hash.compute.normal.tasks + durable: true + auto_delete: false + - vhost: camunda_prod + name: pdf_markings_input + durable: true + auto_delete: false + arguments: + x-queue-type: classic + - vhost: comparator-prod + name: cloud_to_cloud + durable: true + auto_delete: false + - vhost: comparator-prod + name: cloud_to_model + durable: true + auto_delete: false + - vhost: comparator-prod + name: deviation + durable: true + auto_delete: false + - vhost: comparator-prod + name: potree + durable: true + auto_delete: false + - vhost: django + name: default + durable: true + auto_delete: false + - vhost: django + name: pm + durable: true + auto_delete: false + - vhost: flow_prod + name: celery + durable: true + auto_delete: false + - vhost: flow_prod + name: flow + durable: true + auto_delete: false + arguments: + x-queue-type: classic - vhost: iac-smoke-prod name: iac.smoke.queue durable: true auto_delete: false arguments: x-queue-type: quorum + - vhost: issues_prod + name: celery + durable: true + auto_delete: false + - vhost: pdf_processing + name: new_tiling + durable: true + auto_delete: false + - vhost: pdf_processing + name: processing + durable: true + auto_delete: false + - vhost: pm_prod + name: pm + durable: true + auto_delete: false + - vhost: remarks-prod + name: remark_mail + durable: true + auto_delete: false + - vhost: rfi_prod + name: celery + durable: true + auto_delete: false + - vhost: sarex-backend + name: sarex-backend + durable: true + auto_delete: false + arguments: + x-queue-type: classic + - vhost: transmitalls_prod_host + name: taskiq + durable: false + auto_delete: false + arguments: + x-dead-letter-exchange: '' + x-dead-letter-routing-key: taskiq.dead_letter + - vhost: transmitalls_prod_host + name: taskiq.dead_letter + durable: false + auto_delete: false + - vhost: transmitalls_prod_host + name: taskiq.delay + durable: false + auto_delete: false + arguments: + x-dead-letter-exchange: '' + x-dead-letter-routing-key: taskiq + - vhost: workflows + name: dwg_to_geojson + durable: true + auto_delete: false + - vhost: workflows + name: processing + durable: true + auto_delete: false bindings: + - vhost: b6V7WU8PZpVe5rUt + source: default + destination: default + destination_type: queue + routing_key: default + properties_key: default + - vhost: b6V7WU8PZpVe5rUt + source: documents + destination: documents + destination_type: queue + routing_key: documents + properties_key: documents + - vhost: b6V7WU8PZpVe5rUt + source: high-resources + destination: high-resources + destination_type: queue + routing_key: high-resources + properties_key: high-resources + - vhost: b6V7WU8PZpVe5rUt + source: hight-resouces + destination: high-resources + destination_type: queue + routing_key: high-resources + properties_key: high-resources + - vhost: bim-prod + source: celery + destination: celery + destination_type: queue + routing_key: celery + properties_key: celery + - vhost: bim-prod-gazpromcps + source: celery + destination: celery + destination_type: queue + routing_key: celery + properties_key: celery + - vhost: camunda_prod + source: amq.topic + destination: pdf_markings_input + destination_type: queue + routing_key: pdf_markings_input + properties_key: pdf_markings_input + - vhost: camunda_prod + source: hash.compute + destination: hash.compute.normal.tasks + destination_type: queue + routing_key: hash.compute.normal + properties_key: hash.compute.normal + - vhost: comparator-prod + source: comparator_exchange + destination: cloud_to_cloud + destination_type: queue + routing_key: cloud_to_cloud + properties_key: cloud_to_cloud + - vhost: comparator-prod + source: comparator_exchange + destination: cloud_to_model + destination_type: queue + routing_key: cloud_to_model + properties_key: cloud_to_model + - vhost: comparator-prod + source: comparator_exchange + destination: deviation + destination_type: queue + routing_key: deviation + properties_key: deviation + - vhost: comparator-prod + source: comparator_exchange + destination: potree + destination_type: queue + routing_key: potree + properties_key: potree + - vhost: django + source: default + destination: default + destination_type: queue + routing_key: default + properties_key: default + - vhost: django + source: pm + destination: pm + destination_type: queue + routing_key: pm + properties_key: pm + - vhost: flow_prod + source: celery + destination: celery + destination_type: queue + routing_key: celery + properties_key: celery + - vhost: flow_prod + source: flow + destination: flow + destination_type: queue + routing_key: flow + properties_key: flow - vhost: iac-smoke-prod source: iac.smoke.events destination: iac.smoke.queue destination_type: queue routing_key: iac.smoke.created + properties_key: iac.smoke.created + - vhost: issues_prod + source: celery + destination: celery + destination_type: queue + routing_key: celery + properties_key: celery + - vhost: pdf_processing + source: bim_360_input + destination: processing + destination_type: queue + routing_key: '' + properties_key: '~' + - vhost: pm_prod + source: pm + destination: pm + destination_type: queue + routing_key: pm + properties_key: pm + - vhost: remarks-prod + source: remark_mail_exchange + destination: remark_mail + destination_type: queue + routing_key: remark_mail + properties_key: remark_mail + - vhost: rfi_prod + source: celery + destination: celery + destination_type: queue + routing_key: celery + properties_key: celery + - vhost: transmitalls_prod_host + source: taskiq + destination: taskiq + destination_type: queue + routing_key: '#' + properties_key: '%23' + - vhost: workflows + source: input_tasks + destination: dwg_to_geojson + destination_type: queue + routing_key: dwg_to_geojson + properties_key: dwg_to_geojson + - vhost: workflows + source: pdf_data_input + destination: processing + destination_type: queue + routing_key: '' + properties_key: '~' policies: - vhost: bim-prod name: ha-two - pattern: ".*" + pattern: .* apply_to: all priority: 0 definition: - "ha-mode": "exactly" - "ha-params": 2 - "ha-sync-mode": "automatic" + ha-mode: exactly + ha-params: 2 + ha-sync-mode: automatic - vhost: bim-prod-gazpromcps name: ha-two - pattern: ".*" + pattern: .* apply_to: all priority: 0 definition: - "ha-mode": "exactly" - "ha-params": 2 - "ha-sync-mode": "automatic" + ha-mode: exactly + ha-params: 2 + ha-sync-mode: automatic - vhost: comparator-prod name: ha-two - pattern: ".*" + pattern: .* apply_to: all priority: 0 definition: - "ha-mode": "exactly" - "ha-params": 2 - "ha-sync-mode": "automatic" - - vhost: remarks-prod - name: ha-two - pattern: ".*" - apply_to: all - priority: 0 - definition: - "ha-mode": "exactly" - "ha-params": 2 - "ha-sync-mode": "automatic" - - vhost: tracking-prod - name: ha-two - pattern: ".*" - apply_to: all - priority: 0 - definition: - "ha-mode": "exactly" - "ha-params": 2 - "ha-sync-mode": "automatic" - - vhost: tracking-receiver-prod - name: ha-two - pattern: ".*" - apply_to: all - priority: 0 - definition: - "ha-mode": "exactly" - "ha-params": 2 - "ha-sync-mode": "automatic" + ha-mode: exactly + ha-params: 2 + ha-sync-mode: automatic - vhost: iac-smoke-prod name: iac-smoke-queue-ttl - pattern: "^iac\\.smoke\\..*" + pattern: ^iac\.smoke\..* apply_to: queues priority: 1 definition: message-ttl: 600000 + - vhost: remarks-prod + name: ha-two + pattern: .* + apply_to: all + priority: 0 + definition: + ha-mode: exactly + ha-params: 2 + ha-sync-mode: automatic + - vhost: tracking-prod + name: ha-two + pattern: .* + apply_to: all + priority: 0 + definition: + ha-mode: exactly + ha-params: 2 + ha-sync-mode: automatic + - vhost: tracking-receiver-prod + name: ha-two + pattern: .* + apply_to: all + priority: 0 + definition: + ha-mode: exactly + ha-params: 2 + ha-sync-mode: automatic namespaces: - name: block-analyzer @@ -1205,26 +1642,34 @@ environments: namespace: pulse type: rabbitmq dependencies: + rabbitmq_ref: default rabbitmq_vhost: iac-smoke-prod rabbitmq_user: iac-smoke-prod + credential_keys: + host: host + hostname: hostname + password: password + port: port + uri: uri + user: username + username: username + vhost: vhost + adopt: true lifecycle: - ignore_changes: true + ignore_changes: false - name: iams-secret namespace: iam - type: opaque - random_keys: - db-dsn: - length: 5 - special: false - kafka-sasl-plain-username: - length: 5 - special: false - kafka-sasl-plain-password: - length: 5 - special: false + type: kafka + dependencies: + kafka_ref: prod + kafka_user: iam + credential_keys: + kafka-sasl-plain-password: password + kafka-sasl-plain-username: username + adopt: true lifecycle: - ignore_changes: true + ignore_changes: false - name: yc-s3-secret namespace: iam @@ -1260,21 +1705,19 @@ environments: - name: premises-kafka-secret namespace: proc - type: opaque - custom_keys: - host: "host:port" - random_keys: - password: - length: 5 - special: false - username: - length: 5 - special: false - cert: - length: 5 - special: false + type: kafka + dependencies: + kafka_ref: prod + kafka_user: premises + credential_keys: + host: hostname + password: password + username: username + constant_keys: + cert: kafka_ca + adopt: true lifecycle: - ignore_changes: true + ignore_changes: false - name: session-secret namespace: pulse @@ -1383,20 +1826,22 @@ environments: - name: hasher-rabbitmq-secret namespace: documentations-prod - type: opaque - custom_keys: - host: "default-rabbit-cluster.rabbitmq.svc.cluster.local" - hostname: "default-rabbit-cluster.rabbitmq.svc.cluster.local:5672" - port: "5672" - user: "camunda" - vhost: "camunda_prod" - random_keys: - password: - length: 32 - special: false + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: camunda_prod + rabbitmq_user: camunda + credential_keys: + host: host + hostname: hostname + password: password + port: port + user: username + vhost: vhost + adopt: true lifecycle: - ignore_changes: true - + ignore_changes: false + - name: hasher-s3-secret namespace: documentations-prod type: yc_sa @@ -1466,6 +1911,537 @@ environments: # lifecycle: # ignore_changes: false + + # Adopted messaging secrets from prod k8s. Secret data lives in infrastructure-secrets.yaml. + + - name: ams-kafka-secret + namespace: ams-sync-prod + type: kafka + dependencies: + kafka_ref: prod + kafka_user: platform + credential_keys: + kafka-bootstrap-servers: bootstrap_servers_json + kafka-password: password + kafka-username: username + constant_keys: + kafka-ca-file: kafka_ca + adopt: true + lifecycle: + ignore_changes: false + + - name: checklists-kafka-secret + namespace: checklists-prod + type: kafka + dependencies: + kafka_ref: prod + kafka_user: srx-broadcast + credential_keys: + host: hostname + password: password + username: username + constant_keys: + cert: kafka_ca + adopt: true + lifecycle: + ignore_changes: false + + - name: kafka-secret + resource_key: documentations-prod-kafka-secret + namespace: documentations-prod + type: kafka + dependencies: + kafka_ref: prod + kafka_user: message-hub-user + credential_keys: + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: yc-kafka-secret + resource_key: eav-prod-yc-kafka-secret + namespace: eav-prod + type: kafka + dependencies: + kafka_ref: prod + kafka_user: srx-broadcast + credential_keys: + host: hostname + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: inspections-kafka-secret + namespace: inspections-prod + type: kafka + dependencies: + kafka_ref: prod + kafka_user: inspections + credential_keys: + host: hostname + password: password + username: username + constant_keys: + cert: kafka_ca + adopt: true + lifecycle: + ignore_changes: false + + - name: yc-kafka-secret + resource_key: inspections-prod-yc-kafka-secret + namespace: inspections-prod + type: kafka + dependencies: + kafka_ref: prod + kafka_user: inspections + credential_keys: + host: hostname + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: yc-kafka-secret + resource_key: issues-prod-yc-kafka-secret + namespace: issues-prod + type: kafka + dependencies: + kafka_ref: prod + kafka_user: issues + credential_keys: + host: hostname + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: kafka-secret + resource_key: message-hub-prod-kafka-secret + namespace: message-hub-prod + type: kafka + dependencies: + kafka_ref: prod + kafka_user: message-hub-user + credential_keys: + host: hostname + password: password + port: port + sasl_mechanism: sasl_mechanism + security_protocol: security_protocol + username: username + constant_keys: + ssl_cafile: kafka_ca + adopt: true + lifecycle: + ignore_changes: false + + - name: ya-kafka-secret-pm + namespace: pm-prod + type: kafka + dependencies: + kafka_ref: prod + kafka_user: pm + credential_keys: + bootstrap_servers: bootstrap_servers + sasl_mechanism: sasl_mechanism + sasl_password: password + sasl_username: username + security_protocol: security_protocol + constant_keys: + ssl_cafile: kafka_ca + adopt: true + lifecycle: + ignore_changes: false + + - name: kafka-secret + resource_key: sarex-prod-kafka-secret + namespace: sarex-prod + type: kafka + dependencies: + kafka_ref: prod + kafka_user: sarex-backend-prod + credential_keys: + host: hostname + password: password + port: port + sasl_mechanism: sasl_mechanism + security_protocol: security_protocol + username: username + constant_keys: + ssl_cafile: kafka_ca + adopt: true + lifecycle: + ignore_changes: false + + - name: ya-kafka-secret + namespace: system-log-prod + type: kafka + dependencies: + kafka_ref: prod + kafka_user: system_log_user + credential_keys: + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbitmq-secret + resource_key: ams-sync-prod-rabbitmq-secret + namespace: ams-sync-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: django + rabbitmq_user: sarex + credential_keys: + host: host + password: password + username: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: default-rabbit-cluster-bim-api-prod + namespace: bim-api-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: bim-prod + rabbitmq_user: bim-api-prod + credential_keys: + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: default-rabbit-cluster-bim-api-prod-gazpromcps + namespace: bim-api-prod-gazpromcps + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: bim-prod-gazpromcps + rabbitmq_user: bim-api-prod-gazpromcps + credential_keys: + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: default-rabbit-cluster-comparator-prod + namespace: comparator-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: comparator-prod + rabbitmq_user: comparator-prod + credential_keys: + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: data-engine-rabbitmq-secret + namespace: data-engine-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: data_engine_prod + rabbitmq_user: data_engine + credential_keys: + host: host + password: password + port: port + user: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbitmq-secret + resource_key: data-engine-prod-rabbitmq-secret + namespace: data-engine-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: data_engine_prod + rabbitmq_user: data_engine + credential_keys: + password: password + username: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbit + resource_key: default-rabbit + namespace: default + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: camunda_prod + rabbitmq_user: camunda + credential_keys: + host: host + password: password + port: port + username: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbitmq + resource_key: default-rabbitmq + namespace: default + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: camunda_prod + rabbitmq_user: camunda + credential_keys: + host: host + password: password + port: port + username: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: dwg-rabbitmq-secret + namespace: documentations-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: workflows + rabbitmq_user: dwg + credential_keys: + host: host + hostname: hostname + password: password + port: port + username: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: pdf-splitting-rabbit-secret + namespace: documentations-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: pdf_processing + rabbitmq_user: documentation_go + credential_keys: + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbitmq-secret + resource_key: flows-prod-rabbitmq-secret + namespace: flows-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: flow_prod + rabbitmq_user: flow_prod + credential_keys: + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbitmq-secret + resource_key: issues-prod-rabbitmq-secret + namespace: issues-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: issues_prod + rabbitmq_user: issues + credential_keys: + host: host + password: password + user: username + username: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: cde-secret + namespace: orchestrator + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: camunda_prod + rabbitmq_user: camunda + credential_keys: + AMQP_PASSWORD: password + AMQP_USER: username + PASSWORD: password + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbit-secret-pm + namespace: pm-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: pm_prod + rabbitmq_user: pm + credential_keys: + host: host + password: password + port: port + user: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: documentation-rabbit-cred + namespace: processing-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: pdf_processing + rabbitmq_user: documentation_python + credential_keys: + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbitmq + resource_key: processing-prod-rabbitmq + namespace: processing-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: camunda_prod + rabbitmq_user: camunda + credential_keys: + host: host + password: password + port: port + username: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: default-rabbit-cluster-remarks-api-prod + namespace: remarks-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: remarks-prod + rabbitmq_user: remarks-api-prod + credential_keys: + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbitmq-secret + resource_key: rfi-prod-rabbitmq-secret + namespace: rfi-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: rfi_prod + rabbitmq_user: rfi + credential_keys: + password: password + username: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbitmq-secret + resource_key: sarex-preprod-rabbitmq-secret + namespace: sarex-preprod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: django + rabbitmq_user: sarex + credential_keys: + host: host + password: password + username: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbitmq-secret + resource_key: sarex-prod-rabbitmq-secret + namespace: sarex-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: django + rabbitmq_user: sarex + credential_keys: + host: host + password: password + user: username + username: username + vhost: vhost + adopt: true + lifecycle: + ignore_changes: false + + - name: default-rabbit-cluster-tracking-prod + namespace: tracking-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: tracking-prod + rabbitmq_user: tracking-prod + credential_keys: + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + + - name: rabbitmq-cred + namespace: transmittal-api-prod + type: rabbitmq + dependencies: + rabbitmq_ref: default + rabbitmq_vhost: transmitalls_prod_host + rabbitmq_user: transmitalls_prod + credential_keys: + password: password + username: username + adopt: true + lifecycle: + ignore_changes: false + buckets: - name: pulse-prod acl: private diff --git a/live/prod/rabbitmq/terragrunt.hcl b/live/prod/rabbitmq/terragrunt.hcl index 2fdf8d6..1707768 100644 --- a/live/prod/rabbitmq/terragrunt.hcl +++ b/live/prod/rabbitmq/terragrunt.hcl @@ -35,10 +35,13 @@ inputs = { vhosts = try(local.rabbitmq_config.vhosts, []) users = try(local.rabbitmq_config.users, []) permissions = try(local.rabbitmq_config.permissions, []) + topic_permissions = try(local.rabbitmq_config.topic_permissions, []) exchanges = try(local.rabbitmq_config.exchanges, []) queues = try(local.rabbitmq_config.queues, []) bindings = try(local.rabbitmq_config.bindings, []) policies = try(local.rabbitmq_config.policies, []) + unmanaged_output_users = try(local.rabbitmq_config.unmanaged_output_users, []) + unmanaged_output_permissions = try(local.rabbitmq_config.unmanaged_output_permissions, []) yc_token = get_env("YC_TOKEN", "") yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "") diff --git a/live/prod/secrets/terragrunt.hcl b/live/prod/secrets/terragrunt.hcl index 642322c..5e52d04 100644 --- a/live/prod/secrets/terragrunt.hcl +++ b/live/prod/secrets/terragrunt.hcl @@ -49,6 +49,15 @@ dependency "rabbitmq" { skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true" } +dependency "kafka_topics" { + config_path = "../kafka-topics" + mock_outputs = { + kafka_outputs_map = {} + } + mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"] + skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true" +} + dependency "valkey_users" { config_path = "../valkey-users" mock_outputs = { @@ -136,6 +145,51 @@ EOT terraform { source = "${get_terragrunt_dir()}/../../../modules//k8s-secret" + + extra_arguments "infrastructure_tfvars" { + commands = get_terraform_commands_that_need_vars() + arguments = ["-var-file=terragrunt.auto.tfvars.json"] + } +} + +generate "import_existing" { + path = "import_existing.tf" + if_exists = "overwrite" + contents = join("\n\n", [ + for secret in local.env_config.secrets : <<-EOF + import { + to = kubernetes_secret.without_ignore["${try(secret.resource_key, "") != "" ? secret.resource_key : secret.name}"] + id = "${secret.namespace}/${secret.name}" + } + EOF + if try(secret.adopt, false) + ]) +} + +generate "tfvars" { + path = "terragrunt.auto.tfvars.json" + if_exists = "overwrite" + disable_signature = true + contents = jsonencode({ + secrets = [ + for secret in local.env_config.secrets : { + resource_key = try(secret.resource_key, "") + name = secret.name + namespace = secret.namespace + secret_type = secret.type + registry_url = try(secret.registry_url, "") + dependencies = try(secret.dependencies, {}) + yc_sa_key_names = try(secret.yc_sa_key_names, {}) + custom_keys = try(secret.custom_keys, {}) + constant_keys = try(secret.constant_keys, {}) + random_keys = try(secret.random_keys, {}) + credential_keys = try(secret.credential_keys, {}) + labels = try(secret.labels, {}) + annotations = try(secret.annotations, {}) + ignore_changes = try(secret.lifecycle.ignore_changes, false) + } + ] + }) } inputs = { @@ -172,12 +226,14 @@ inputs = { database_outputs_map = dependency.database.outputs.database_outputs_map rabbitmq_outputs_map = try(dependency.rabbitmq.outputs.rabbitmq_outputs_map, {}) + kafka_outputs_map = try(dependency.kafka_topics.outputs.kafka_outputs_map, {}) valkey_outputs_map = dependency.valkey_users.outputs.valkey_outputs_map constants = { s3_endpoint = "https://storage.yandexcloud.net" postgres_port = "6432" postgres_ca = local.yc_postgresql_ca_cert + kafka_ca = local.yc_postgresql_ca_cert valkey_port = "6380" valkey_ca = local.yc_postgresql_ca_cert } diff --git a/modules/k8s-secret/main.tf b/modules/k8s-secret/main.tf index a2b3b95..9f9d3d6 100644 --- a/modules/k8s-secret/main.tf +++ b/modules/k8s-secret/main.tf @@ -287,7 +287,7 @@ resource "kubernetes_secret" "with_ignore" { lifecycle { # Игнорируем data, type и metadata чтобы не было phantom updates - ignore_changes = [data, type, metadata] + ignore_changes = [data, type, metadata, wait_for_service_account_token] } depends_on = [random_password.secrets] @@ -312,7 +312,7 @@ resource "kubernetes_secret" "without_ignore" { lifecycle { # type и metadata игнорируем чтобы не было phantom updates - ignore_changes = [type, metadata] + ignore_changes = [type, metadata, wait_for_service_account_token] } depends_on = [random_password.secrets] diff --git a/modules/kafka-topics-yc/outputs.tf b/modules/kafka-topics-yc/outputs.tf index d43018b..dda18c7 100644 --- a/modules/kafka-topics-yc/outputs.tf +++ b/modules/kafka-topics-yc/outputs.tf @@ -7,3 +7,22 @@ output "user_names" { description = "Kafka users managed by this service manifest state." value = [for user in yandex_mdb_kafka_user.this : user.name] } + +output "kafka_outputs_map" { + description = "Map for k8s-secret module. Key format: clusterRef:user." + value = { + for key, item in local.user_clusters : key => { + host = try(var.kafka_cluster_refs[item.cluster_ref].host, "") + hostname = try(format("%s:%s", var.kafka_cluster_refs[item.cluster_ref].host, tostring(var.kafka_cluster_refs[item.cluster_ref].port)), "") + port = tostring(try(var.kafka_cluster_refs[item.cluster_ref].port, 9091)) + username = item.user + password = try(random_password.kafka_user[key].result, "") + sasl_mechanism = try(var.kafka_cluster_refs[item.cluster_ref].sasl_mechanism, "SCRAM-SHA-512") + security_protocol = try(var.kafka_cluster_refs[item.cluster_ref].security_protocol, "SASL_SSL") + bootstrap_server = try(format("%s:%s", var.kafka_cluster_refs[item.cluster_ref].host, tostring(var.kafka_cluster_refs[item.cluster_ref].port)), "") + bootstrap_servers = try(format("%s:%s", var.kafka_cluster_refs[item.cluster_ref].host, tostring(var.kafka_cluster_refs[item.cluster_ref].port)), "") + bootstrap_servers_json = try(jsonencode([format("%s:%s", var.kafka_cluster_refs[item.cluster_ref].host, tostring(var.kafka_cluster_refs[item.cluster_ref].port))]), "[]") + } + } + sensitive = true +} diff --git a/modules/kafka-topics-yc/variables.tf b/modules/kafka-topics-yc/variables.tf index 059ccb9..10fa5e9 100644 --- a/modules/kafka-topics-yc/variables.tf +++ b/modules/kafka-topics-yc/variables.tf @@ -37,6 +37,10 @@ variable "kafka_cluster_refs" { description = "Environment clusterRef mapping from infrastructure.yaml." type = map(object({ cluster_id = string + host = optional(string, "") + port = optional(number, 9091) + sasl_mechanism = optional(string, "SCRAM-SHA-512") + security_protocol = optional(string, "SASL_SSL") default_partitions = optional(number, 3) default_replication_factor = optional(number, 1) max_replication_factor = optional(number, 1) diff --git a/modules/rabbitmq/main.tf b/modules/rabbitmq/main.tf index 572cba3..076b010 100644 --- a/modules/rabbitmq/main.tf +++ b/modules/rabbitmq/main.tf @@ -1,5 +1,5 @@ locals { - rabbitmq_enabled = length(var.vhosts) + length(var.users) + length(var.permissions) + length(var.exchanges) + length(var.queues) + length(var.bindings) + length(var.policies) > 0 + rabbitmq_enabled = length(var.vhosts) + length(var.users) + length(var.permissions) + length(var.topic_permissions) + length(var.exchanges) + length(var.queues) + length(var.bindings) + length(var.policies) > 0 management_endpoint = local.rabbitmq_enabled ? var.management_endpoint : "http://127.0.0.1:15672" management_username = local.rabbitmq_enabled ? var.management_username : "noop" @@ -7,7 +7,9 @@ locals { vhosts = { for vhost in var.vhosts : vhost.name => { - name = vhost.name + name = vhost.name + description = try(vhost.description, null) + tracing = try(vhost.tracing, false) } } @@ -30,6 +32,14 @@ locals { } } + topic_permissions = { + for permission in var.topic_permissions : "${permission.vhost}:${permission.user}" => { + vhost = permission.vhost + user = permission.user + permissions = try(permission.permissions, []) + } + } + exchanges = { for exchange in var.exchanges : "${exchange.vhost}:${exchange.name}" => { name = exchange.name @@ -52,7 +62,7 @@ locals { } bindings = { - for idx, binding in var.bindings : "${binding.vhost}:${binding.source}:${binding.destination_type}:${binding.destination}:${try(binding.routing_key, "")}:${idx}" => { + for binding in var.bindings : "${binding.vhost}:${binding.source}:${binding.destination_type}:${binding.destination}:${try(binding.properties_key, format("%s:%s", try(binding.routing_key, ""), sha1(jsonencode(try(binding.arguments, {})))))}" => { vhost = binding.vhost source = binding.source destination = binding.destination @@ -92,7 +102,9 @@ provider "rabbitmq" { resource "rabbitmq_vhost" "this" { for_each = local.vhosts - name = each.value.name + name = each.value.name + description = each.value.description + tracing = each.value.tracing lifecycle { prevent_destroy = true @@ -139,6 +151,26 @@ resource "rabbitmq_permissions" "this" { } } +resource "rabbitmq_topic_permissions" "this" { + for_each = local.topic_permissions + + user = rabbitmq_user.this[each.value.user].name + vhost = rabbitmq_vhost.this[each.value.vhost].name + + dynamic "permissions" { + for_each = each.value.permissions + content { + exchange = permissions.value.exchange + write = tostring(try(permissions.value.write, "")) + read = tostring(try(permissions.value.read, "")) + } + } + + lifecycle { + prevent_destroy = true + } +} + resource "rabbitmq_exchange" "this" { for_each = local.exchanges @@ -177,7 +209,7 @@ resource "rabbitmq_queue" "this" { resource "rabbitmq_binding" "this" { for_each = local.bindings - source = rabbitmq_exchange.this["${each.value.vhost}:${each.value.source}"].name + source = each.value.source vhost = rabbitmq_vhost.this[each.value.vhost].name destination = each.value.destination destination_type = each.value.destination_type @@ -187,6 +219,8 @@ resource "rabbitmq_binding" "this" { lifecycle { prevent_destroy = true } + + depends_on = [rabbitmq_exchange.this, rabbitmq_queue.this] } resource "rabbitmq_policy" "this" { diff --git a/modules/rabbitmq/outputs.tf b/modules/rabbitmq/outputs.tf index aabfadc..54d96b0 100644 --- a/modules/rabbitmq/outputs.tf +++ b/modules/rabbitmq/outputs.tf @@ -5,19 +5,24 @@ output "vhosts" { output "users" { description = "RabbitMQ users managed by this component." - value = keys(rabbitmq_user.this) + value = sort(concat(keys(rabbitmq_user.this), tolist(var.unmanaged_output_users))) } output "rabbitmq_outputs_map" { description = "Map for k8s-secret module. Key format: default:vhost:user." value = { - for key, item in local.user_vhosts : "default:${item.vhost}:${item.user}" => { + for key, item in merge(local.user_vhosts, { + for item in var.unmanaged_output_permissions : "${item.vhost}:${item.user}" => { + vhost = item.vhost + user = item.user + } + }) : "default:${item.vhost}:${item.user}" => { host = var.amqp_host port = tostring(var.amqp_port) vhost = item.vhost - username = rabbitmq_user.this[item.user].name - password = random_password.user[item.user].result - uri = "amqp://${rabbitmq_user.this[item.user].name}:${urlencode(random_password.user[item.user].result)}@${var.amqp_host}:${var.amqp_port}/${urlencode(item.vhost)}" + username = try(rabbitmq_user.this[item.user].name, item.user) + password = try(random_password.user[item.user].result, "") + uri = try("amqp://${rabbitmq_user.this[item.user].name}:${urlencode(random_password.user[item.user].result)}@${var.amqp_host}:${var.amqp_port}/${urlencode(item.vhost)}", "") management_endpoint = var.management_endpoint } } diff --git a/modules/rabbitmq/variables.tf b/modules/rabbitmq/variables.tf index fc796d8..5a10b11 100644 --- a/modules/rabbitmq/variables.tf +++ b/modules/rabbitmq/variables.tf @@ -43,43 +43,61 @@ variable "rabbitmq_policy" { variable "vhosts" { description = "RabbitMQ vhosts declared in infrastructure.yaml." - type = list(any) + type = any default = [] } variable "users" { description = "RabbitMQ users declared in infrastructure.yaml." - type = list(any) + type = any default = [] } variable "permissions" { description = "RabbitMQ permissions declared in infrastructure.yaml." - type = list(any) + type = any + default = [] +} + +variable "topic_permissions" { + description = "RabbitMQ topic permissions declared in infrastructure.yaml." + type = any default = [] } variable "exchanges" { description = "RabbitMQ exchanges declared in infrastructure.yaml." - type = list(any) + type = any default = [] } variable "queues" { description = "RabbitMQ queues declared in infrastructure.yaml." - type = list(any) + type = any default = [] } variable "bindings" { description = "RabbitMQ bindings declared in infrastructure.yaml." - type = list(any) + type = any default = [] } variable "policies" { description = "RabbitMQ policies declared in infrastructure.yaml." - type = list(any) + type = any + default = [] +} + +variable "unmanaged_output_users" { + description = "Existing RabbitMQ users intentionally not managed, kept only for output compatibility." + type = any + default = [] +} + +variable "unmanaged_output_permissions" { + description = "Existing RabbitMQ user/vhost pairs intentionally not managed, kept only for output compatibility." + type = any default = [] }