++

apps/checklists/base/backend-deployment.yaml

@@ -1,80 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: checklists-backend
-  namespace: checklists
-  labels:
-    app: checklists-backend
-    service: api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: checklists-backend
-  template:
-    metadata:
-      labels:
-        app: checklists-backend
-        service: checklists-backend
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: checklists
-        vault.hashicorp.com/agent-inject-secret-checklists-db: secrets/data/postgresql/apps/checklists
-        vault.hashicorp.com/agent-inject-template-checklists-db: |-
-          {{- with secret "secrets/data/postgresql/apps/checklists" -}}
-          DATABASE_HOST=postgresql.checklists.svc.cluster.local
-          DATABASE_PORT=5432
-          DATABASE_NAME=checklists_db
-          DATABASE_USER={{ index .Data.data "username" }}
-          DATABASE_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-checklists-jwt-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-checklists-jwt-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: checklists-vault
-      containers:
-        - name: api
-          image: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/bash", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/checklists-db ] && . /vault/secrets/checklists-db
-              [ -f /vault/secrets/checklists-jwt-public ] && export JWT_AUTH_PUBLIC_KEY="$(cat /vault/secrets/checklists-jwt-public)"
-              set +a
-              exec ./entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: HTTP_APP_HOST
-              value: 0.0.0.0
-            - name: HTTP_APP_PORT
-              value: "8000"
-            - name: HTTP_APP_ROOT_PATH
-              value: /checklists
-            - name: HTTP_APP_WORKERS
-              value: "1"
-            - name: HTTP_APP_ADMIN_ENABLE
-              value: "true"
-            - name: JWT_AUTH_ENABLE
-              value: "true"
-            - name: DEBUG
-              value: "false"
-
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/checklists/base/backend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: rfi-backend-api-svc
-  namespace: checklists
-spec:
-  type: ClusterIP
-  selector:
-    app: checklists-backend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8000
-      protocol: TCP

apps/checklists/base/helmrelease.yaml

@@ -0,0 +1,124 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: checklists
+  namespace: checklists
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      checklists:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: checklists-vault
+        deployment:
+          enabled: true
+          name:
+            _default: checklists-backend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/bash", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/checklists-db ] && . /vault/secrets/checklists-db
+                [ -f /vault/secrets/checklists-jwt-public ] && export JWT_AUTH_PUBLIC_KEY="$(cat /vault/secrets/checklists-jwt-public)"
+                set +a
+                exec ./entrypoint.sh
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: rfi-backend-api-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8000
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: HTTP_APP_HOST
+            value:
+              _default: "0.0.0.0"
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: /checklists
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "1"
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+          - name: DEBUG
+            value:
+              _default: "false"
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: checklists
+            vault.hashicorp.com/agent-inject-secret-checklists-db: secrets/data/apps/checklists/postgres
+            vault.hashicorp.com/agent-inject-template-checklists-db: |-
+              {{- with secret "secrets/data/apps/checklists/postgres" -}}
+              DATABASE_HOST={{ index .Data.data "host" }}
+              DATABASE_PORT={{ index .Data.data "port" }}
+              DATABASE_NAME={{ index .Data.data "database" }}
+              DATABASE_USER={{ index .Data.data "username" }}
+              DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-checklists-jwt-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-checklists-jwt-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}

apps/checklists/base/kustomization.yaml

@@ -4,6 +4,4 @@ kind: Kustomization
 namespace: checklists
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
-  - backend-deployment.yaml 
-  - backend-service.yaml
+  - helmrelease.yaml

apps/checklists/base/namespace.yaml

@@ -5,3 +5,4 @@ metadata:
   name: checklists
   labels:
     istio-injection: enabled
+    security.deckhouse.io/pod-policy: privileged

apps/checklists/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: checklists-vault
-  namespace: checklists

clusters/d8-ugmk-prod/kustomization.yaml

@@ -28,3 +28,4 @@ resources:
   - ../../apps/eav/d8-ugmk-prod
   - ../../apps/django/d8-ugmk-prod
   - ../../apps/documentations/d8-ugmk-prod
+  - ../../apps/checklists/d8-ugmk-prod