terraform-contour-mirror/infrastructure.yaml

environments:
  prod:
    kafka_cluster_refs:
      prod:
        cluster_id: c9qks74g084g1419cpts
        default_partitions: 3
        default_replication_factor: 3
        max_replication_factor: 3
        default_topic_config:
          cleanup.policy: delete
          retention.ms: "604800000"
          min.insync.replicas: "2"

    kafka_policy:
      allow_create: true
      allow_delete: false
      allow_partition_increase: true
      allow_partition_decrease: false

    namespaces:
      - name: pulse
        labels:
          environment: stage
          project: pulse
          istio-injection: enabled
        annotations:
          managed-by: terraform
      - name: proc
        labels:
          team: proc
          istio-injection: enabled
        annotations:
          managed-by: terraform 

    secrets:
      - name: dockerhub
        namespace: pulse
        type: dockerconfigjson
        registry_url: cr.yandex

      - name: pulse-s3-secret
        namespace: pulse
        type: s3
        dependencies:
          bucket: pulse-prod
        lifecycle:
          ignore_changes: false


      - name: pulse-postgresql-secret
        namespace: pulse
        type: database
        dependencies:
          cluster: "c9quu72dj2ibu8dk54q5"
          db: pulse_db
          user: pulse
        lifecycle:
          ignore_changes: true

      - name: premises-s3-secret
        namespace: proc
        type: s3
        dependencies:
          bucket: premises-prod
        lifecycle:
          ignore_changes: true    

      - name: premises-postgresql-secret
        namespace: proc
        type: database
        dependencies:
          cluster: "c9quu72dj2ibu8dk54q5"
          db: premises_db
          user: premises
        lifecycle:
          ignore_changes: true  

      - name: premises-kafka-secret
        namespace: proc
        type: opaque
        custom_keys:
          host: "host:port"
        random_keys:
          password:
            length: 5
            special: false
          username:
            length: 5
            special: false
          cert:
            length: 5
            special: false
        lifecycle:
          ignore_changes: true      

      - name: session-secret
        namespace: pulse
        type: opaque
        random_keys:
          key:
            length: 32
            special: false
        lifecycle:
          ignore_changes: true

      - name: valkey-secret
        namespace: documentations-prod
        type: opaque
        custom_keys:
          url: "host:port"
        random_keys:
          host:
            length: 5
            special: false
          port:
            length: 5
            special: false
          cert:
            length: 5
            special: false
          login:
            length: 5
            special: false   
          password:
            length: 5
            special: false   
        lifecycle:
          ignore_changes: true   

      - name: cde-api-valkey-secret
        namespace: documentations-prod
        type: opaque
        custom_keys:
          url: "host:port"
        random_keys:
          host:
            length: 5
            special: false
          port:
            length: 5
            special: false
          cert:
            length: 5
            special: false
          login:
            length: 5
            special: false   
          password:
            length: 5
            special: false   
        lifecycle:
          ignore_changes: true 

      - name: cde-api-zeebe-secret
        namespace: documentations-prod
        type: opaque
        random_keys:
          gateway_address:
            length: 5
            special: false
          client_id:
            length: 5
            special: false
          client_secret:
            length: 5
            special: false
          auth_server_url:
            length: 5
            special: false   
        lifecycle:
          ignore_changes: true     

      - name: cde-api-s3-secret
        namespace: documentations-prod
        type: yc_sa
        dependencies:
          service_account: documentations-prod
        yc_sa_key_names:
          access_key: access_key
          secret_key: secret_key
          service_account_id: sa_id
        lifecycle:
          ignore_changes: true 

      - name: cde-api-postgresql-secret
        namespace: documentations-prod
        type: database
        dependencies:
          cluster: "c9qt5t4ccr0k4652f963"
          db: documentations
          user: prod-doc_user
        custom_keys:
          sslmode: "verify-full"
        random_keys:
          full-host:
            length: 32
            special: false
        lifecycle:
          ignore_changes: true  

      - name: hasher-rabbitmq-secret
        namespace: documentations-prod
        type: opaque
        custom_keys:
          host: "default-rabbit-cluster.rabbitmq.svc.cluster.local"
          hostname: "default-rabbit-cluster.rabbitmq.svc.cluster.local:5672"
          port: "5672"
          user: "camunda"
          vhost: "camunda_prod"
        random_keys:
          password:
            length: 32
            special: false   
        lifecycle:
          ignore_changes: true  
          
      - name: hasher-s3-secret
        namespace: documentations-prod
        type: yc_sa
        dependencies:
          service_account: documentations-prod
        yc_sa_key_names:
          access_key: access_key
          secret_key: secret_key
          service_account_id: sa_id
        lifecycle:
          ignore_changes: true                     

      # # Пример секрета для другой базы данных (test_db/test)
      # - name: test-db-secret
      #   namespace: pulse
      #   type: database
      #   dependencies:
      #     cluster: "c9qa2coo5ukgcg93fldm"
      #     db: test_db
      #     user: test
      #   random_keys:
      #     session_key:
      #       length: 32
      #       special: false
      #   lifecycle:
      #     ignore_changes: false

      # # Пример секрета из SA ключей
      # - name: dwg-sa-secret
      #   namespace: pulse
      #   type: yc_sa
      #   dependencies:
      #     service_account: dwg-sa
      #   yc_sa_key_names: # как назвать ключи в секрете
      #     access_key: access_key
      #     secret_key: secret_key
      #     service_account_id: sa_id
      #   lifecycle:
      #     ignore_changes: false

    buckets:
      - name: pulse-prod
        acl: private
        versioning:
          enabled: false
        cors:
          enabled: false

      - name: premises-prod
        acl: private
        versioning:
          enabled: false
        cors:
          enabled: false    

    # yc_service_accounts:
    #   - name: dwg-sa
    #     description: "DWG SA Uploader"
    #     folder_roles:
    #       - storage.uploader
    #     create_static_access_key: true


    databases:
      - cluster_id: "c9quu72dj2ibu8dk54q5"
        database:
          name: pulse_db
          extensions:
            - pg_stat_statements
        user:
          name: pulse
          password_length: 32
          password_special: false
          conn_limit: 10
          
      - cluster_id: "c9quu72dj2ibu8dk54q5"
        database:
          name: premises_db
          extensions:
            - uuid-ossp
        user:
          name: premises
          password_length: 32
          password_special: false
          conn_limit: 10