From 24521afd471079ac21d680b5903f1578e151fc9d Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 28 Jul 2026 19:10:02 +0500 Subject: [PATCH] ++ --- apps/checklists/base/backend-deployment.yaml | 80 ------------ apps/checklists/base/backend-service.yaml | 15 --- apps/checklists/base/helmrelease.yaml | 124 +++++++++++++++++++ apps/checklists/base/kustomization.yaml | 4 +- apps/checklists/base/namespace.yaml | 1 + apps/checklists/base/serviceaccount.yaml | 5 - clusters/d8-ugmk-prod/kustomization.yaml | 3 +- 7 files changed, 128 insertions(+), 104 deletions(-) delete mode 100644 apps/checklists/base/backend-deployment.yaml delete mode 100644 apps/checklists/base/backend-service.yaml create mode 100644 apps/checklists/base/helmrelease.yaml delete mode 100644 apps/checklists/base/serviceaccount.yaml diff --git a/apps/checklists/base/backend-deployment.yaml b/apps/checklists/base/backend-deployment.yaml deleted file mode 100644 index ec0dfa9..0000000 --- a/apps/checklists/base/backend-deployment.yaml +++ /dev/null @@ -1,80 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: checklists-backend - namespace: checklists - labels: - app: checklists-backend - service: api -spec: - replicas: 1 - selector: - matchLabels: - app: checklists-backend - template: - metadata: - labels: - app: checklists-backend - service: checklists-backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: checklists - vault.hashicorp.com/agent-inject-secret-checklists-db: secrets/data/postgresql/apps/checklists - vault.hashicorp.com/agent-inject-template-checklists-db: |- - {{- with secret "secrets/data/postgresql/apps/checklists" -}} - DATABASE_HOST=postgresql.checklists.svc.cluster.local - DATABASE_PORT=5432 - DATABASE_NAME=checklists_db - DATABASE_USER={{ index .Data.data "username" }} - DATABASE_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-checklists-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-checklists-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: checklists-vault - containers: - - name: api - image: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/checklists-db ] && . /vault/secrets/checklists-db - [ -f /vault/secrets/checklists-jwt-public ] && export JWT_AUTH_PUBLIC_KEY="$(cat /vault/secrets/checklists-jwt-public)" - set +a - exec ./entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: HTTP_APP_HOST - value: 0.0.0.0 - - name: HTTP_APP_PORT - value: "8000" - - name: HTTP_APP_ROOT_PATH - value: /checklists - - name: HTTP_APP_WORKERS - value: "1" - - name: HTTP_APP_ADMIN_ENABLE - value: "true" - - name: JWT_AUTH_ENABLE - value: "true" - - name: DEBUG - value: "false" - - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/checklists/base/backend-service.yaml b/apps/checklists/base/backend-service.yaml deleted file mode 100644 index fe681ef..0000000 --- a/apps/checklists/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: rfi-backend-api-svc - namespace: checklists -spec: - type: ClusterIP - selector: - app: checklists-backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/checklists/base/helmrelease.yaml b/apps/checklists/base/helmrelease.yaml new file mode 100644 index 0000000..f4fb2cd --- /dev/null +++ b/apps/checklists/base/helmrelease.yaml @@ -0,0 +1,124 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: checklists + namespace: checklists +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + checklists: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: checklists-vault + deployment: + enabled: true + name: + _default: checklists-backend + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/checklists-db ] && . /vault/secrets/checklists-db + [ -f /vault/secrets/checklists-jwt-public ] && export JWT_AUTH_PUBLIC_KEY="$(cat /vault/secrets/checklists-jwt-public)" + set +a + exec ./entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: rfi-backend-api-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: HTTP_APP_HOST + value: + _default: "0.0.0.0" + - name: HTTP_APP_PORT + value: + _default: "8000" + - name: HTTP_APP_ROOT_PATH + value: + _default: /checklists + - name: HTTP_APP_WORKERS + value: + _default: "1" + - name: HTTP_APP_ADMIN_ENABLE + value: + _default: "true" + - name: JWT_AUTH_ENABLE + value: + _default: "true" + - name: DEBUG + value: + _default: "false" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: checklists + vault.hashicorp.com/agent-inject-secret-checklists-db: secrets/data/apps/checklists/postgres + vault.hashicorp.com/agent-inject-template-checklists-db: |- + {{- with secret "secrets/data/apps/checklists/postgres" -}} + DATABASE_HOST={{ index .Data.data "host" }} + DATABASE_PORT={{ index .Data.data "port" }} + DATABASE_NAME={{ index .Data.data "database" }} + DATABASE_USER={{ index .Data.data "username" }} + DATABASE_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-checklists-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-checklists-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} diff --git a/apps/checklists/base/kustomization.yaml b/apps/checklists/base/kustomization.yaml index c3f2f24..a88ddc2 100644 --- a/apps/checklists/base/kustomization.yaml +++ b/apps/checklists/base/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization namespace: checklists resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml + - helmrelease.yaml diff --git a/apps/checklists/base/namespace.yaml b/apps/checklists/base/namespace.yaml index 0ec7137..ec18309 100644 --- a/apps/checklists/base/namespace.yaml +++ b/apps/checklists/base/namespace.yaml @@ -5,3 +5,4 @@ metadata: name: checklists labels: istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/checklists/base/serviceaccount.yaml b/apps/checklists/base/serviceaccount.yaml deleted file mode 100644 index b9b74e1..0000000 --- a/apps/checklists/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: checklists-vault - namespace: checklists diff --git a/clusters/d8-ugmk-prod/kustomization.yaml b/clusters/d8-ugmk-prod/kustomization.yaml index ee902b6..7b32f50 100644 --- a/clusters/d8-ugmk-prod/kustomization.yaml +++ b/clusters/d8-ugmk-prod/kustomization.yaml @@ -27,4 +27,5 @@ resources: - ../../apps/rfi/d8-ugmk-prod - ../../apps/eav/d8-ugmk-prod - ../../apps/django/d8-ugmk-prod - - ../../apps/documentations/d8-ugmk-prod \ No newline at end of file + - ../../apps/documentations/d8-ugmk-prod + - ../../apps/checklists/d8-ugmk-prod \ No newline at end of file