Merge branch 'master' of gitlab.sarex.io:infra/iac into aero

apps/attachments/base/helmrelease.yaml

@@ -90,9 +90,9 @@ spec:
             vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/postgresql/apps/attachments
             vault.hashicorp.com/agent-inject-template-attachments-db: |-
               {{- with secret "secrets/data/postgresql/apps/attachments" -}}
-              DATABASE_HOST=postgresql.attachments.svc.cluster.local
+              DATABASE_HOST={{ index .Data.data "host" }}
-              DATABASE_PORT=5432
+              DATABASE_PORT={{ index .Data.data "port" }}
-              DATABASE_NAME=attachments_db
+              DATABASE_NAME={{ index .Data.data "database" }}
               DATABASE_USER={{ index .Data.data "username" }}
               DATABASE_PASSWORD={{ index .Data.data "password" }}
               DATABASE_SSL_MODE=disable

apps/comparisons/base/backend-deployment.yaml

@@ -1,136 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backend
-  namespace: comparisons
-  labels:
-    app: backend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: backend
-  template:
-    metadata:
-      labels:
-        app: backend
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: comparisons
-        vault.hashicorp.com/agent-inject-secret-comparisons-db: secrets/data/postgresql/apps/comparisons
-        vault.hashicorp.com/agent-inject-template-comparisons-db: |-
-          {{- with secret "secrets/data/postgresql/apps/comparisons" -}}
-          DATABASE_HOST=postgresql.comparisons.svc.cluster.local
-          DATABASE_PORT=5432
-          DATABASE_DB=comparisons_db
-          DATABASE_USER={{ index .Data.data "username" }}
-          DATABASE_PASSWORD={{ index .Data.data "password" }}
-          POSTGRES_ADDRESS=postgresql.comparisons.svc.cluster.local
-          POSTGRES_PORT=5432
-          POSTGRES_DB=comparisons_db
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-comparisons-jwt-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-comparisons-jwt-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: comparisons-vault
-      volumes:
-        - name: tasks-execution-config
-          configMap:
-            name: tasks-execution-config-comparisons-v2
-            items:
-              - key: tasks-execution-config-comparisons-v2.json
-                path: tasks-execution-config.json
-      containers:
-        - name: backend
-          image: cr.yandex/crp3ccidau046kdj8g9q/comparisons_backend_prod:075fc0
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/bash", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/comparisons-db ] && . /vault/secrets/comparisons-db
-              [ -f /vault/secrets/comparisons-jwt-public ] && export AUTH_PUBLIC_KEY="$(cat /vault/secrets/comparisons-jwt-public)"
-              set +a
-              exec /app/entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: APP_NAME
-              value: comparisons
-            - name: APP_VERSION
-              value: 0.0.1
-            - name: LOGGER_LOG_LEVEL
-              value: info
-            - name: DATABASE_NAME
-              value: postgres
-            - name: ENABLE_SSL
-              value: "false"
-            - name: POSTGRES_POOL_SIZE
-              value: "10"
-            - name: HTTP_PORT
-              value: "8000"
-            - name: DOCUMENTATIONS_INTERNAL_HOST
-              value: http://documentations-service.documentations
-            - name: DOCUMENTATIONS_EXTERNAL_HOST
-              value: https://api.sarex.io/documentations
-            - name: DOCUMENTATION_FILESTREAM_URL
-              value: http://backend-filestream-svc.documentations.svc.cluster.local/
-            - name: WORKFLOWS_HOST
-              value: http://workflows-service.processing
-            - name: WORKFLOWS_IMAGE_VERSION
-              value: master
-            - name: WORKFLOWS_DJANGO_HOST
-              value: https://lk.sarex.io
-            - name: WORKFLOWS_BIMV2_INTERNAL_HOST
-              value: http://bim-backend-v2-service.bim-api
-            - name: WORKSPACES_HOST
-              value: http://workspaces-service.workspaces
-            - name: EAV_HOST
-              value: https://api.sarex.io/eav
-            - name: LAST_MASTER_BIM
-              value: "36311"
-            - name: LAST_SLAVE_1_BIM
-              value: "94015"
-            - name: LAST_SLAVE_2_BIM
-              value: "135771"
-            - name: ABAP_FIXED_CONC
-              value: "0"
-            - name: WORKFLOWS_CONFIG_FILEPATH
-              value: /etc/app/tasks-execution-config.json
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-          volumeMounts:
-            - name: tasks-execution-config
-              readOnly: true
-              mountPath: /etc/app/tasks-execution-config.json
-              subPath: tasks-execution-config.json
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 8000
-            initialDelaySeconds: 10
-            periodSeconds: 60
-            failureThreshold: 10
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 8000
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            failureThreshold: 20
-      imagePullSecrets:
-        - name: regcred

apps/comparisons/base/backend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-service
-  namespace: comparisons
-spec:
-  type: ClusterIP
-  selector:
-    app: backend
-  ports:
-    - name: http
-      port: 8000
-      targetPort: 8000
-      protocol: TCP

apps/comparisons/base/backend.yaml

@@ -0,0 +1,270 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: comparisons
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: comparisons-vault
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons_backend_prod:075fc0
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["/bin/bash", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/comparisons-db ] && . /vault/secrets/comparisons-db
+                [ -f /vault/secrets/comparisons-jwt-public ] && export AUTH_PUBLIC_KEY="$(cat /vault/secrets/comparisons-jwt-public)"
+                set +a
+                exec /app/entrypoint.sh
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 8000
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 60
+              failureThreshold:
+                _default: 10
+            readiness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 8000
+              initialDelaySeconds:
+                _default: 5
+              periodSeconds:
+                _default: 5
+              failureThreshold:
+                _default: 20
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        volumes:
+          _default:
+            - name: tasks-execution-config
+              mountPath:
+                _default: /etc/app/tasks-execution-config.json
+              subPath:
+                _default: tasks-execution-config.json
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: tasks-execution-config-comparisons-v2
+                items:
+                  - key: tasks-execution-config-comparisons-v2.json
+                    path:
+                      _default: tasks-execution-config.json
+
+        envs:
+          - name: APP_NAME
+            value:
+              _default: "comparisons"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOGGER_LOG_LEVEL
+            value:
+              _default: "info"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "postgres"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "false"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+
+          - name: DOCUMENTATIONS_INTERNAL_HOST
+            value:
+              _default: "http://documentations-service.documentations"
+
+          - name: DOCUMENTATIONS_EXTERNAL_HOST
+            value:
+              _default: "https://api.sarex.io/documentations"
+
+          - name: DOCUMENTATION_FILESTREAM_URL
+            value:
+              _default: "http://backend-filestream-svc.documentations.svc.cluster.local/"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-service.processing"
+
+          - name: WORKFLOWS_IMAGE_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOWS_DJANGO_HOST
+            value:
+              _default: "https://lk.sarex.io"
+
+          - name: WORKFLOWS_BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://bim-backend-v2-service.bim-api"
+
+          - name: WORKSPACES_HOST
+            value:
+              _default: "http://workspaces-service.workspaces"
+
+          - name: EAV_HOST
+            value:
+              _default: "https://api.sarex.io/eav"
+
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "94015"
+
+          - name: LAST_SLAVE_2_BIM
+            value:
+              _default: "135771"
+
+          - name: ABAP_FIXED_CONC
+            value:
+              _default: "0"
+
+          - name: WORKFLOWS_CONFIG_FILEPATH
+            value:
+              _default: "/etc/app/tasks-execution-config.json"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: comparisons
+            vault.hashicorp.com/agent-inject-secret-comparisons-db: secrets/data/postgresql/apps/comparisons
+            vault.hashicorp.com/agent-inject-template-comparisons-db: |-
+              {{- with secret "secrets/data/postgresql/apps/comparisons" -}}
+              DATABASE_HOST=postgresql.comparisons.svc.cluster.local
+              DATABASE_PORT=5432
+              DATABASE_DB=comparisons_db
+              DATABASE_USER={{ index .Data.data "username" }}
+              DATABASE_PASSWORD={{ index .Data.data "password" }}
+              POSTGRES_ADDRESS=postgresql.comparisons.svc.cluster.local
+              POSTGRES_PORT=5432
+              POSTGRES_DB=comparisons_db
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-comparisons-jwt-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-comparisons-jwt-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/comparisons/base/frontend-deployment.yaml

@@ -1,57 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: comparisons
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-    spec:
-      volumes:
-        - name: nginx-configmap
-          configMap:
-            name: nginx-configmap
-            items:
-              - key: nginx.conf
-                path: nginx.conf
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend:prod_6dc6e0c2
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-          volumeMounts:
-            - name: nginx-configmap
-              mountPath: /etc/nginx/nginx.conf
-              subPath: nginx.conf
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            failureThreshold: 10
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            failureThreshold: 20
-      imagePullSecrets:
-        - name: regcred

apps/comparisons/base/frontend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-service
-  namespace: comparisons
-spec:
-  type: ClusterIP
-  selector:
-    app: frontend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/comparisons/base/frontend.yaml

@@ -0,0 +1,135 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: comparisons
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend:prod_6dc6e0c2
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 80
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 10
+              failureThreshold:
+                _default: 10
+            readiness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 80
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 10
+              failureThreshold:
+                _default: 20
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        volumes:
+          _default:
+            - name: nginx-configmap
+              mountPath:
+                _default: /etc/nginx/nginx.conf
+              subPath:
+                _default: nginx.conf
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: nginx-configmap
+                items:
+                  - key: nginx.conf
+                    path:
+                      _default: nginx.conf

apps/comparisons/base/kustomization.yaml

@@ -4,10 +4,7 @@ kind: Kustomization
 namespace: comparisons
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
+  - backend.yaml
-  - backend-deployment.yaml
+  - frontend.yaml
-  - backend-service.yaml
-  - frontend-deployment.yaml
-  - frontend-service.yaml
   - nginx-configmap.yaml
   - tasks-execution-config.yaml

apps/comparisons/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: comparisons-vault
-  namespace: comparisons

apps/comparisons/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: comparisons

apps/comparisons/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: comparisons
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/comparisons/dsinv/backend.yaml

@@ -1,63 +1,134 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: backend
   namespace: comparisons
 spec:
-  template:
+  values:
-    spec:
+    services:
-      containers:
+      backend:
-      - name: backend
+        image:
-        image: cr.yandex/crp3ccidau046kdj8g9q/comparisons-backend:8df50db379f53c35a20fdffd4803883564a11844
+          name:
-        env:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-backend:8df50db379f53c35a20fdffd4803883564a11844
-        - name: HTTP_PORT
+
-          value: '8080'
+        envs:
-        - name: LAST_MASTER_BIM
+          - name: HTTP_PORT
-          value: '100_000'
+            value:
-        - name: APP_NAME
+              _default: "8080"
-          value: comparisons-api-v2
+
-        - name: APP_VERSION
+          - name: LAST_MASTER_BIM
-          value: 0.0.1
+            value:
-        - name: LOGGER_LOG_LEVEL
+              _default: "100_000"
-          value: info
+
-        - name: DATABASE_HOST
+          - name: APP_NAME
-          value: postgres-service
+            value:
-        - name: DATABASE_PORT
+              _default: "comparisons-api-v2"
-          value: '5432'
+
-        - name: DATABASE_NAME
+          - name: APP_VERSION
-          value: postgres
+            value:
-        - name: DATABASE_DB
+              _default: "0.0.1"
-          value: comparisons
+
-        - name: API_ADDRESS
+          - name: LOGGER_LOG_LEVEL
-          value: 0.0.0.0:8080
+            value:
-        - name: API_ADDRESS_FILE
+              _default: "info"
-          value: 0.0.0.0:8080
+
-        - name: ENABLE_SQL_QUERY
+          - name: DATABASE_HOST
-          value: '0'
+            value:
-        - name: DOCUMENTATIONS_INTERNAL_HOST
+              _default: "postgres-service"
-          value: http://documentations-service.documentations.svc.cluster.local:8080
+
-        - name: DOCUMENTATIONS_EXTERNAL_HOST
+          - name: DATABASE_PORT
-          value: http://documentations-service.documentations.svc.cluster.local:8080/
+            value:
-        - name: DOCUMENTATION_URL
+              _default: "5432"
-          value: http://documentations-service.documentations.svc.cluster.local:8080/
+
-        - name: DOCUMENTATION_FILESTREAM_URL
+          - name: DATABASE_NAME
-          value: http://documentations-filestream-service.documentations.svc.cluster.local:8080/
+            value:
-        - name: WORKFLOWS_HOST
+              _default: "postgres"
-          value: http://workflows-service.workflow.svc.cluster.local:8000/
+
-        - name: EAV_HOST
+          - name: DATABASE_DB
-          value: http://eav-service.eav.svc.cluster.local:8000
+            value:
-        - name: WORKSPACES_HOST
+              _default: "comparisons"
-          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
+
-        - name: COMPARISON_URL
+          - name: API_ADDRESS
-          value: http://backend-service.comparisons.svc.cluster.local:8080/
+            value:
-        - name: WORKFLOWS_IMAGE_VERSION
+              _default: "0.0.0.0:8080"
-          value: master
+
-        - name: EXTERNAL_DOCUMENTATION_URL
+          - name: API_ADDRESS_FILE
-          value: http://documentations-service.documentations.svc.cluster.local:8080/
+            value:
-        - name: WORKFLOWS_BIMV2_INTERNAL_HOST
+              _default: "0.0.0.0:8080"
-          value: http://backend-service.bim.svc.cluster.local:8000/
+
-        - name: ENABLE_SSL
+          - name: ENABLE_SQL_QUERY
-          value: '0'
+            value:
-        - name: WORKFLOWS_DJANGO_HOST
+              _default: "0"
-          value: http://backend.django.svc.cluster.local:8000
+
+          - name: DOCUMENTATIONS_INTERNAL_HOST
+            value:
+              _default: "http://documentations-service.documentations.svc.cluster.local:8080"
+
+          - name: DOCUMENTATIONS_EXTERNAL_HOST
+            value:
+              _default: "http://documentations-service.documentations.svc.cluster.local:8080/"
+
+          - name: DOCUMENTATION_URL
+            value:
+              _default: "http://documentations-service.documentations.svc.cluster.local:8080/"
+
+          - name: DOCUMENTATION_FILESTREAM_URL
+            value:
+              _default: "http://documentations-filestream-service.documentations.svc.cluster.local:8080/"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-service.workflow.svc.cluster.local:8000/"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: WORKSPACES_HOST
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+          - name: COMPARISON_URL
+            value:
+              _default: "http://backend-service.comparisons.svc.cluster.local:8080/"
+
+          - name: WORKFLOWS_IMAGE_VERSION
+            value:
+              _default: "master"
+
+          - name: EXTERNAL_DOCUMENTATION_URL
+            value:
+              _default: "http://documentations-service.documentations.svc.cluster.local:8080/"
+
+          - name: WORKFLOWS_BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: WORKFLOWS_DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "94015"
+
+          - name: LAST_SLAVE_2_BIM
+            value:
+              _default: "135771"
+
+          - name: ABAP_FIXED_CONC
+            value:
+              _default: "0"
+
+          - name: WORKFLOWS_CONFIG_FILEPATH
+            value:
+              _default: "/etc/app/tasks-execution-config.json"

apps/comparisons/dsinv/frontend.yaml

@@ -1,12 +1,13 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: frontend
   namespace: comparisons
 spec:
-  template:
+  values:
-    spec:
+    services:
-      containers:
+      frontend:
-      - name: frontend
+        image:
-        image: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend-static:9c422e6cd514603ea4092ed2430634cf4995039d
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend-static:9c422e6cd514603ea4092ed2430634cf4995039d

apps/comparisons/dsinv/kustomization.yaml

@@ -7,9 +7,9 @@ resources:
 patches:
 - path: backend.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: backend
 - path: frontend.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: frontend

apps/comparisons/yc-k8s-test/kustomization.yaml

@@ -7,5 +7,5 @@ resources:
 patches:
   - path: replicas.yaml
     target:
-      kind: Deployment
+      kind: HelmRelease
       name: backend

apps/comparisons/yc-k8s-test/replicas.yaml

@@ -1,8 +1,13 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: backend
   namespace: comparisons
 spec:
-  replicas: 1
+  values:
+    services:
+      backend:
+        deployment:
+          replicaCount:
+            _default: 1

apps/document-link/base/deployment.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: document-link
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-        version: stable
-    spec:
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:wb_cb2027ce
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-      imagePullSecrets:
-        - name: regcred

apps/document-link/base/frontend.yaml

@@ -0,0 +1,90 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: document-link
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:wb_cb2027ce
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred

apps/document-link/base/kustomization.yaml

@@ -4,5 +4,4 @@ kind: Kustomization
 namespace: document-link
 resources:
   - namespace.yaml
-  - deployment.yaml
+  - frontend.yaml
-  - service.yaml

apps/document-link/base/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-service
-  namespace: document-link
-spec:
-  type: ClusterIP
-  selector:
-    app: frontend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/document-link/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: document-link

apps/document-link/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: document-link
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/document-link/dsinv/frontend.yaml

@@ -1,12 +1,13 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: frontend
   namespace: document-link
 spec:
-  template:
+  values:
-    spec:
+    services:
-      containers:
+      frontend:
-      - name: frontend
+        image:
-        image: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:21f0ef3d66575901d554ba675ba677708e4635c7
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:21f0ef3d66575901d554ba675ba677708e4635c7

apps/document-link/dsinv/kustomization.yaml

@@ -8,5 +8,5 @@ resources:
 patches:
 - path: frontend.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: frontend

apps/drawings/base/backend.yaml

@@ -0,0 +1,134 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: drawings
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: drawings-vault
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/drawings-api:015e68e1b2a3dcc13f0b405e1f761b154a825d24
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/drawings-db ] && . /vault/secrets/drawings-db
+                set +a
+                exec ./entrypoint.sh
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: drawings
+            vault.hashicorp.com/agent-inject-secret-drawings-db: secrets/data/postgresql/apps/drawings
+            vault.hashicorp.com/agent-inject-template-drawings-db: |-
+              {{- with secret "secrets/data/postgresql/apps/drawings" -}}
+              POSTGRES_ADDRESS=postgresql.drawings.svc.cluster.local:5432
+              POSTGRES_DB=drawings_db
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/drawings/base/deployment.yaml

@@ -1,58 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backend
-  namespace: drawings
-  labels:
-    app: backend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: backend
-  template:
-    metadata:
-      labels:
-        app: backend
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: drawings
-        vault.hashicorp.com/agent-inject-secret-drawings-db: secrets/data/postgresql/apps/drawings
-        vault.hashicorp.com/agent-inject-template-drawings-db: |-
-          {{- with secret "secrets/data/postgresql/apps/drawings" -}}
-          POSTGRES_ADDRESS=postgresql.drawings.svc.cluster.local:5432
-          POSTGRES_DB=drawings_db
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: drawings-vault
-      containers:
-        - name: backend
-          image: cr.yandex/crp3ccidau046kdj8g9q/drawings-api:015e68e1b2a3dcc13f0b405e1f761b154a825d24
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/drawings-db ] && . /vault/secrets/drawings-db
-              set +a
-              exec ./entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: POSTGRES_POOL_SIZE
-              value: "3"
-            - name: API_ADDRESS
-              value: 0.0.0.0:8000
-            - name: ENABLE_SSL
-              value: "0"
-      imagePullSecrets:
-        - name: regcred

apps/drawings/base/kustomization.yaml

@@ -4,6 +4,4 @@ kind: Kustomization
 namespace: drawings
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
+  - backend.yaml
-  - deployment.yaml
-  - service.yaml

apps/drawings/base/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-service
-  namespace: drawings
-spec:
-  type: ClusterIP
-  selector:
-    app: backend
-  ports:
-    - name: http
-      port: 8000
-      targetPort: 8000
-      protocol: TCP

apps/drawings/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: drawings-vault
-  namespace: drawings

apps/drawings/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: drawings

apps/drawings/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: drawings
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/drawings/yc-k8s-test/kustomization.yaml

@@ -7,5 +7,5 @@ resources:
 patches:
   - path: replicas.yaml
     target:
-      kind: Deployment
+      kind: HelmRelease
       name: backend

apps/drawings/yc-k8s-test/replicas.yaml

@@ -1,8 +1,13 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: backend
   namespace: drawings
 spec:
-  replicas: 1
+  values:
+    services:
+      backend:
+        deployment:
+          replicaCount:
+            _default: 1

apps/faas/base/backend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: export-reviews-svc
-  namespace: faas
-spec:
-  type: ClusterIP
-  selector:
-    app: export-reviews
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8000
-      protocol: TCP

apps/faas/base/backend.yaml

@@ -0,0 +1,152 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: export-reviews
+  namespace: faas
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/export-reviews:prod_c4cae4ee
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: export-reviews
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: export-reviews-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        envs:
+          - name: BASE_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: REVIEWS_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech/flows"
+
+          - name: GATEWAY_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech/gateway"
+
+          - name: DOCUMENTATIONS_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech/documentations"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: TRANSMITTALS_INTERNAL_HOST
+            value:
+              _default: "http://transmittal-service.transmittal.svc.cluster.local:80/internal/v1"
+
+          - name: DJANGO_TIMEOUT
+            value:
+              _default: "180"
+
+          - name: REVIEWS_TIMEOUT
+            value:
+              _default: "180"
+
+          - name: GATEWAY_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATIONS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: EAV_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TRANSMITTALS_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/faas/base/export-reviews.yaml

@@ -1,64 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: export-reviews
-  namespace: faas
-  labels:
-    app: export-reviews
-    service: export-reviews
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: export-reviews
-  template:
-    metadata:
-      labels:
-        app: export-reviews
-        service: export-reviews
-    spec:
-      containers:
-        - name: api
-          image: cr.yandex/crp3ccidau046kdj8g9q/export-reviews:prod_c4cae4ee
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: BASE_HOST
-              value: https://sarex.contour.infra.sarex.tech
-            - name: DJANGO_HOST
-              value: https://sarex.contour.infra.sarex.tech
-            - name: REVIEWS_HOST
-              value: https://sarex.contour.infra.sarex.tech/flows
-            - name: GATEWAY_HOST
-              value: https://sarex.contour.infra.sarex.tech/gateway
-            - name: DOCUMENTATIONS_HOST
-              value: https://sarex.contour.infra.sarex.tech/documentations
-            - name: EAV_HOST
-              value: http://backend-svc.eav.svc.cluster.local:80
-            - name: TRANSMITTALS_INTERNAL_HOST
-              value: http://transmittal-service.transmittal.svc.cluster.local:80/internal/v1
-            - name: DJANGO_TIMEOUT
-              value: "180"
-            - name: REVIEWS_TIMEOUT
-              value: "180"
-            - name: GATEWAY_TIMEOUT
-              value: "60"
-            - name: DOCUMENTATIONS_TIMEOUT
-              value: "60"
-            - name: EAV_TIMEOUT
-              value: "30"
-            - name: TRANSMITTALS_TIMEOUT
-              value: "30"
-            - name: TIMEOUT
-              value: "180"
-
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/faas/base/kustomization.yaml

@@ -4,5 +4,4 @@ kind: Kustomization
 namespace: faas
 resources:
   - namespace.yaml
-  - export-reviews.yaml
+  - backend.yaml
-  - backend-service.yaml

apps/faas/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: faas

apps/faas/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: faas
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/mapper/base/backend.yaml

@@ -0,0 +1,190 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: mapper
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: mapper-vault
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/mapper:prod_b0d05a34
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 3
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["/bin/bash", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/mapper-django-auth ] && . /vault/secrets/mapper-django-auth
+                [ -f /vault/secrets/mapper-db ] && . /vault/secrets/mapper-db
+                [ -f /vault/secrets/mapper-rabbitmq ] && . /vault/secrets/mapper-rabbitmq
+                [ -f /vault/secrets/mapper-s3 ] && . /vault/secrets/mapper-s3
+                [ -f /vault/secrets/mapper-kafka ] && . /vault/secrets/mapper-kafka
+                set +a
+                exec /bin/bash /opt/entrypoint.sh
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        envs:
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: "https://api.sarex.io/documentations/api/v1"
+
+          - name: FLOW_HOST
+            value:
+              _default: "https://api.sarex.io/flows/api/v1"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "https://lk.sarex.io/api"
+
+          - name: NOTE_HOST
+            value:
+              _default: "https://api.sarex.io/notes/api/v1"
+
+          - name: REDIS_USE
+            value:
+              _default: "0"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: mapper
+            vault.hashicorp.com/agent-inject-secret-mapper-django-auth: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-mapper-django-auth: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              MAPPER_DJANGO_TOKEN={{ index .Data.data "key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-mapper-db: secrets/data/postgresql/apps/mapper
+            vault.hashicorp.com/agent-inject-template-mapper-db: |-
+              {{- with secret "secrets/data/postgresql/apps/mapper" -}}
+              MAPPER_DB_USER={{ index .Data.data "username" }}
+              MAPPER_DB_PASSWORD={{ index .Data.data "password" }}
+              MAPPER_DB_HOST=postgresql.mapper.svc.cluster.local
+              MAPPER_DB_PORT=5432
+              MAPPER_DB_NAME=mapper_db
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-mapper-rabbitmq: secrets/data/rabbitmq/apps/mapper
+            vault.hashicorp.com/agent-inject-template-mapper-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/mapper" -}}
+              MAPPER_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
+              MAPPER_RABBITMQ_USERNAME={{ index .Data.data "username" }}
+              MAPPER_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
+              MAPPER_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
+              MAPPER_RABBITMQ_PORT=5672
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-mapper-s3: secrets/data/minio/apps/mapper
+            vault.hashicorp.com/agent-inject-template-mapper-s3: |-
+              {{- with secret "secrets/data/minio/apps/mapper" -}}
+              MAPPER_S3_ENDPOINT={{ index .Data.data.client "endpoint" }}
+              MAPPER_S3_REGION={{ index .Data.data.client "region" }}
+              MAPPER_S3_BUCKET=mapper
+              MAPPER_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              MAPPER_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-mapper-kafka: secrets/data/kafka/apps/mapper
+            vault.hashicorp.com/agent-inject-template-mapper-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/mapper" -}}
+              MAPPER_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }}
+              MAPPER_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
+              MAPPER_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
+              MAPPER_KAFKA_USERNAME={{ index .Data.data "username" }}
+              MAPPER_KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/mapper/base/deployment.yaml

@@ -1,105 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backend
-  namespace: mapper
-  labels:
-    app: backend
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: backend
-  template:
-    metadata:
-      labels:
-        app: backend
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: mapper
-        vault.hashicorp.com/agent-inject-secret-mapper-django-auth: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-mapper-django-auth: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          MAPPER_DJANGO_TOKEN={{ index .Data.data "key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-mapper-db: secrets/data/postgresql/apps/mapper
-        vault.hashicorp.com/agent-inject-template-mapper-db: |-
-          {{- with secret "secrets/data/postgresql/apps/mapper" -}}
-          MAPPER_DB_USER={{ index .Data.data "username" }}
-          MAPPER_DB_PASSWORD={{ index .Data.data "password" }}
-          MAPPER_DB_HOST=postgresql.mapper.svc.cluster.local
-          MAPPER_DB_PORT=5432
-          MAPPER_DB_NAME=mapper_db
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-mapper-rabbitmq: secrets/data/rabbitmq/apps/mapper
-        vault.hashicorp.com/agent-inject-template-mapper-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/mapper" -}}
-          MAPPER_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
-          MAPPER_RABBITMQ_USERNAME={{ index .Data.data "username" }}
-          MAPPER_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
-          MAPPER_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
-          MAPPER_RABBITMQ_PORT=5672
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-mapper-s3: secrets/data/minio/apps/mapper
-        vault.hashicorp.com/agent-inject-template-mapper-s3: |-
-          {{- with secret "secrets/data/minio/apps/mapper" -}}
-          MAPPER_S3_ENDPOINT={{ index .Data.data.client "endpoint" }}
-          MAPPER_S3_REGION={{ index .Data.data.client "region" }}
-          MAPPER_S3_BUCKET=mapper
-          MAPPER_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          MAPPER_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-mapper-kafka: secrets/data/kafka/apps/mapper
-        vault.hashicorp.com/agent-inject-template-mapper-kafka: |-
-          {{- with secret "secrets/data/kafka/apps/mapper" -}}
-          MAPPER_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }}
-          MAPPER_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
-          MAPPER_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
-          MAPPER_KAFKA_USERNAME={{ index .Data.data "username" }}
-          MAPPER_KAFKA_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: mapper-vault
-      containers:
-        - name: backend
-          image: cr.yandex/crp3ccidau046kdj8g9q/mapper:prod_b0d05a34
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/bash", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/mapper-django-auth ] && . /vault/secrets/mapper-django-auth
-              [ -f /vault/secrets/mapper-db ] && . /vault/secrets/mapper-db
-              [ -f /vault/secrets/mapper-rabbitmq ] && . /vault/secrets/mapper-rabbitmq
-              [ -f /vault/secrets/mapper-s3 ] && . /vault/secrets/mapper-s3
-              [ -f /vault/secrets/mapper-kafka ] && . /vault/secrets/mapper-kafka
-              set +a
-              exec /bin/bash /opt/entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: DOCUMENTATION_HOST
-              value: https://api.sarex.io/documentations/api/v1
-            - name: FLOW_HOST
-              value: https://api.sarex.io/flows/api/v1
-            - name: DJANGO_HOST
-              value: https://lk.sarex.io/api
-            - name: NOTE_HOST
-              value: https://api.sarex.io/notes/api/v1
-            - name: REDIS_USE
-              value: "0"
-            - name: TIMEOUT
-              value: "120"
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/mapper/base/kustomization.yaml

@@ -4,6 +4,4 @@ kind: Kustomization
 namespace: mapper
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
+  - backend.yaml
-  - deployment.yaml
-  - service.yaml

apps/mapper/base/service.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-svc
-  namespace: mapper
-spec:
-  type: ClusterIP
-  selector:
-    app: backend
-  ports:
-    - port: 80
-      targetPort: 8000
-      protocol: TCP

apps/mapper/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: mapper-vault
-  namespace: mapper

apps/mapper/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: mapper

apps/mapper/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mapper
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/mapper/dsinv/backend.yaml

@@ -1,24 +1,42 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: backend
   namespace: mapper
 spec:
-  replicas: 1
+  values:
-  template:
+    services:
-    spec:
+      backend:
-      containers:
+        image:
-      - name: backend
+          name:
-        image: cr.yandex/crp3ccidau046kdj8g9q/mapper:0.0.8
+            _default: cr.yandex/crp3ccidau046kdj8g9q/mapper:0.0.8
-        env:
+
-        - name: DOCUMENTATION_HOST
+        deployment:
-          value: http://backend-service.flows.svc.cluster.local:8000/api/v1
+          replicaCount:
-        - name: FLOW_HOST
+            _default: 1
-          value: http://backend-service.flows.svc.cluster.local:8000/api/v1
+
-        - name: DJANGO_HOST
+        envs:
-          value: http://backend.django.svc.cluster.local:8000/api
+          - name: DOCUMENTATION_HOST
-        - name: NOTE_HOST
+            value:
-          value: http://backend-service.notes.svc.cluster.local:8000/api/v1
+              _default: "http://backend-service.flows.svc.cluster.local:8000/api/v1"
-        - name: REDIS_USE
+
-          value: '0'
+          - name: FLOW_HOST
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000/api/v1"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000/api"
+
+          - name: NOTE_HOST
+            value:
+              _default: "http://backend-service.notes.svc.cluster.local:8000/api/v1"
+
+          - name: REDIS_USE
+            value:
+              _default: "0"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"

apps/mapper/dsinv/kustomization.yaml

@@ -7,5 +7,5 @@ resources:
 patches:
 - path: backend.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: backend

apps/mapper/yc-k8s-test/kustomization.yaml

@@ -6,5 +6,5 @@ resources:
 patches:
   - path: replicas.yaml
     target:
-      kind: Deployment
+      kind: HelmRelease
       name: backend

apps/mapper/yc-k8s-test/replicas.yaml

@@ -1,8 +1,13 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: backend
   namespace: mapper
 spec:
-  replicas: 1
+  values:
+    services:
+      backend:
+        deployment:
+          replicaCount:
+            _default: 1

apps/measurements/base/backend.yaml

@@ -0,0 +1,130 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: measurements
+  namespace: measurements
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: measurements-vault
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:production_a5bb3e84
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: measurements
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["/bin/bash", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/measurements-s3 ] && . /vault/secrets/measurements-s3
+                set +a
+                exec /opt/entrypoint.sh
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: measurements-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        envs:
+          - name: TRACING_USE
+            value:
+              _default: "false"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: measurements
+            vault.hashicorp.com/agent-inject-secret-measurements-s3: secrets/data/minio/apps/measurements
+            vault.hashicorp.com/agent-inject-template-measurements-s3: |-
+              {{- with secret "secrets/data/minio/apps/measurements" -}}
+              S3_JSON_SETTINGS='{"host":"{{ index .Data.data.client "endpoint" }}","login":"{{ index .Data.data "access_key" }}","password":"{{ index .Data.data "secret_key" }}","verify":false,"buckets":["measurements"]}'
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/measurements/base/deployment.yaml

@@ -1,55 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: measurements
-  namespace: measurements
-  labels:
-    app: measurements
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: measurements
-  template:
-    metadata:
-      labels:
-        app: measurements
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: measurements
-        vault.hashicorp.com/agent-inject-secret-measurements-s3: secrets/data/minio/apps/measurements
-        vault.hashicorp.com/agent-inject-template-measurements-s3: |-
-          {{- with secret "secrets/data/minio/apps/measurements" -}}
-          S3_JSON_SETTINGS='{"host":"{{ index .Data.data.client "endpoint" }}","login":"{{ index .Data.data "access_key" }}","password":"{{ index .Data.data "secret_key" }}","verify":false,"buckets":["measurements"]}'
-          {{- end -}}
-    spec:
-      serviceAccountName: measurements-vault
-      containers:
-        - name: measurements
-          image: cr.yandex/crp3ccidau046kdj8g9q/measurements:production_a5bb3e84
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/bash", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/measurements-s3 ] && . /vault/secrets/measurements-s3
-              set +a
-              exec /opt/entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: TRACING_USE
-              value: "false"
-          resources:
-            requests:
-              cpu: 25m
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/measurements/base/kustomization.yaml

@@ -4,6 +4,4 @@ kind: Kustomization
 namespace: measurements
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
+  - backend.yaml
-  - deployment.yaml
-  - service.yaml

apps/measurements/base/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: measurements-svc
-  namespace: measurements
-spec:
-  type: ClusterIP
-  selector:
-    app: measurements
-  ports:
-    - name: http
-      port: 8000
-      targetPort: 8000
-      protocol: TCP

apps/measurements/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: measurements-vault
-  namespace: measurements

apps/measurements/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: measurements

apps/measurements/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: measurements
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/measurements/dsinv/kustomization.yaml

@@ -7,5 +7,5 @@ resources:
 patches:
 - path: measurements.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: measurements

apps/measurements/dsinv/measurements.yaml

@@ -1,15 +1,22 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: measurements
   namespace: measurements
 spec:
-  template:
+  values:
-    spec:
+    services:
-      containers:
+      backend:
-      - name: measurements
+        image:
-        image: cr.yandex/crp3ccidau046kdj8g9q/measurements:0.4.3
+          name:
-        env:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:0.4.3
-        - name: DJANGO_HOST
+
-          value: https://sarex.dsinv.ru
+        envs:
+          - name: TRACING_USE
+            value:
+              _default: "false"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.dsinv.ru"

apps/measurements/yc-k8s-test/kustomization.yaml

@@ -6,5 +6,5 @@ resources:
 patches:
   - path: replicas.yaml
     target:
-      kind: Deployment
+      kind: HelmRelease
       name: measurements

apps/measurements/yc-k8s-test/replicas.yaml

@@ -1,8 +1,13 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: measurements
   namespace: measurements
 spec:
-  replicas: 1
+  values:
+    services:
+      backend:
+        deployment:
+          replicaCount:
+            _default: 1

apps/notes/base/backend.yaml

@@ -123,9 +123,6 @@ spec:
           - name: ATTACHMENT_HOST
             value:
               _default: http://attachments-service.attachments.svc.cluster.local:80/api/v1
-          - name: PG_PORT
-            value:
-              _default: "5432"
         podAnnotations:
           _default:
             traffic.sidecar.istio.io/excludeOutboundPorts: "8200"

apps/prescriptions/base/deployment.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: prescriptions
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-        version: stable
-    spec:
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/prescriptions-frontend:production_d48699e6
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-      imagePullSecrets:
-        - name: regcred

apps/prescriptions/base/frontend.yaml

@@ -0,0 +1,90 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: prescriptions
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/prescriptions-frontend:production_d48699e6
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred

apps/prescriptions/base/kustomization.yaml

@@ -4,5 +4,4 @@ kind: Kustomization
 namespace: prescriptions
 resources:
   - namespace.yaml
-  - deployment.yaml
+  - frontend.yaml
-  - service.yaml

apps/prescriptions/base/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-service
-  namespace: prescriptions
-spec:
-  type: ClusterIP
-  selector:
-    app: frontend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/prescriptions/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: prescriptions

apps/prescriptions/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: prescriptions
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/processing/base/api-deployment.yaml

@@ -1,77 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: workflows-api
-  namespace: processing
-  labels:
-    app: workflows-api
-    service: workflows-api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: workflows-api
-  template:
-    metadata:
-      labels:
-        app: workflows-api
-        service: workflows-api
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: processing
-        vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/postgresql/apps/processing
-        vault.hashicorp.com/agent-inject-template-processing-postgresql: |-
-          {{- with secret "secrets/data/postgresql/apps/processing" -}}
-          POSTGRES_ADDRESS=postgresql.processing.svc.cluster.local
-          POSTGRES_PORT=5432
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          POSTGRES_DB=workflow_db
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-processing-jwt-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-processing-jwt-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: processing-vault
-      containers:
-        - name: workflows-api
-          image: cr.yandex/crp3ccidau046kdj8g9q/workflows-api_prod:075fc0
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/bash", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/processing-postgresql ] && . /vault/secrets/processing-postgresql
-              [ -f /vault/secrets/processing-jwt-public ] && export PUBLIC_KEY="$(cat /vault/secrets/processing-jwt-public)"
-              set +a
-              exec /httpserver migrate
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: POSTGRES_POOL_SIZE
-              value: "3"
-            - name: HTTP_HOST
-              value: 0.0.0.0:8080
-            - name: DJANGO_HOST
-              value: http://backend-svc.django.svc.cluster.local:80
-            - name: S3_SERVICE_ACCOUNT
-              value: /etc/sarex/yc-s3/yc-s3-service-account.json
-            - name: ENABLE_SQL_QUERY
-              value: "0"
-            - name: POSTGRES_SSL_USE
-              value: "0"
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/processing/base/api-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-svc
-  namespace: processing
-spec:
-  type: ClusterIP
-  selector:
-    app: workflows-api
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP

apps/processing/base/api.yaml

@@ -0,0 +1,160 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: workflows-api
+  namespace: processing
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: processing-vault
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-api_prod:075fc0
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: workflows-api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          command:
+            _default: ["/bin/bash", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/processing-postgresql ] && . /vault/secrets/processing-postgresql
+                [ -f /vault/secrets/processing-jwt-public ] && export PUBLIC_KEY="$(cat /vault/secrets/processing-jwt-public)"
+                set +a
+                exec /httpserver migrate
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: HTTP_HOST
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3/yc-s3-service-account.json"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: POSTGRES_SSL_USE
+            value:
+              _default: "0"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: processing
+            vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/postgresql/apps/processing
+            vault.hashicorp.com/agent-inject-template-processing-postgresql: |-
+              {{- with secret "secrets/data/postgresql/apps/processing" -}}
+              POSTGRES_ADDRESS=postgresql.processing.svc.cluster.local
+              POSTGRES_PORT=5432
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              POSTGRES_DB=workflow_db
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-processing-jwt-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-processing-jwt-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/processing/base/engine-low.yaml

@@ -1,218 +1,428 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: engine-low
   namespace: processing
-  labels:
-    app: engine-low
-    service: engine-low
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: engine-low
-  template:
-    metadata:
-      labels:
-        app: engine-low
-        service: engine-low
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: processing
-        vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/postgresql/apps/processing
-        vault.hashicorp.com/agent-inject-template-processing-postgresql: |-
-          {{- with secret "secrets/data/postgresql/apps/processing" -}}
-          POSTGRES_ADDRESS=postgresql.processing.svc.cluster.local
-          POSTGRES_PORT=5432
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          POSTGRES_DB=workflow_db
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-processing-rabbitmq: secrets/data/rabbitmq/apps/processing
-        vault.hashicorp.com/agent-inject-template-processing-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/processing" -}}
-          RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
-          RABBITMQ_PORT=5672
-          RABBITMQ_USER={{ index .Data.data "username" }}
-          RABBITMQ_PASS={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-processing-smtp: secrets/data/vault/common/smtp_auth
-        vault.hashicorp.com/agent-inject-template-processing-smtp: |-
-          {{- with secret "secrets/data/vault/common/smtp_auth" -}}
-          {{ index .Data.data "env_json" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: processing-vault
-      containers:
-        - name: engine-low
-          image: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_3ef5b462
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/bash", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/processing-postgresql ] && . /vault/secrets/processing-postgresql
-              [ -f /vault/secrets/processing-rabbitmq ] && . /vault/secrets/processing-rabbitmq
-              set +a
-              exec /engine
 
-          ports:
+spec:
-            - name: http
+  interval: 10m
-              containerPort: 8000
+
-              protocol: TCP
+  chart:
-          env:
+    spec:
-            - name: POSTGRES_POOL_SIZE
+      chart: universal-chart
-              value: "20"
+      version: "0.1.9"
-            - name: ENVIRONMENT
+      sourceRef:
-              value: prod
+        kind: HelmRepository
-            - name: WORKFLOWS_SENTRY_DSN
+        name: yc-oci-charts
-              value: https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123
+        namespace: flux-system
-            - name: WORKFLOWS_SENTRY_DEBUG
+      interval: 10m
-              value: "0"
+
-            - name: API_ADDRESS
+  install:
-              value: 0.0.0.0:8000
+    remediation:
-            - name: DJANGO_HOST
+      retries: 3
-              value: http://backend.django.svc.cluster.local:8000
+
-            - name: S3_SERVICE_ACCOUNT
+  upgrade:
-              value: /etc/sarex/yc-s3/yc-s3-service-account.json
+    remediation:
-            - name: BIM_API_V2_DB
+      retries: 3
-              value: /etc/sarex/bim-api-v2-db-prod.json
+
-            - name: PDM_API_DB
+  values:
-              value: /etc/pdm/pdm-api-db-prod.json
+    global:
-            - name: WORKSPACE_API_DB
+      env: _default
-              value: /etc/ws/ws-api-db-prod.json
+
-            - name: ISSUE_API_DB
+    services:
-              value: /etc/issues/issue-api-db-prod.json
+      backend:
-            - name: MAILGUN
+        enabled: true
-              value: /etc/mailgun-secret/env.json
+
-            - name: SMTP
+        serviceAccount:
-              value: /vault/secrets/processing-smtp
+          enabled:
-            - name: INTERNAL_PDM_URL
+            _default: true
-              value: http://documentations-api.documentations.svc.cluster.local:8080
+          name:
-            - name: INTERNAL_FILESTREAM_URL
+            _default: processing-vault
-              value: http://documentations-filestream.documentations.svc.cluster.local:8080
+
-            - name: EXTERNAL_PDM_URL
+        image:
-              value: http://documentations-api.documentations.svc.cluster.local:8080
+          name:
-            - name: EXTERNAL_FILESTREAM_URL
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_3ef5b462
-              value: http://documentations-filestream-service.documentations.svc.cluster.local:8080
+          pullPolicy:
-            - name: RESOURCES_API_INTERNAL_HOST
+            _default: IfNotPresent
-              value: http://resources-service.resources.svc.cluster.local:8000
+
-            - name: ENABLE_SQL_QUERY
+        deployment:
-              value: "0"
+          enabled: true
-            - name: ENABLE_S3_STORAGE
+
-              value: "1"
+          name:
-            - name: ENABLE_S3V2_STORAGE
+            _default: engine-low
-              value: "1"
+
-            - name: ENABLE_PDM_STORAGE
+          replicaCount:
-              value: "1"
+            _default: 1
-            - name: ENABLE_SMTP
+
-              value: "1"
+          port:
-            - name: ENABLE_URL_STORAGE
+            _default: 8000
-              value: "1"
+
-            - name: ENABLE_SRX_TMP
+          command:
-              value: "1"
+            _default: ["/bin/bash", "-ec"]
-            - name: ENABLE_BIM_API_V2_DB
+          args:
-              value: "1"
+            _default:
-            - name: ENABLE_WORKSPACE_API_DB
+              - |
-              value: "1"
+                set -a
-            - name: ENABLE_ISSUE_API_DB
+                [ -f /vault/secrets/processing-postgresql ] && . /vault/secrets/processing-postgresql
-              value: "1"
+                [ -f /vault/secrets/processing-rabbitmq ] && . /vault/secrets/processing-rabbitmq
-            - name: ENABLE_RESOURCES_API
+                set +a
-              value: "1"
+                exec /engine
-            - name: VAULT_USE
-              value: "true"
-            - name: ENABLE_PDM_API_DB
-              value: "1"
-            - name: ENABLE_COMPARISONS_API_DB
-              value: "1"
-            - name: ENABLE_MAIL_GUN
-              value: "1"
-            - name: ENABLE_AMQP_EXECUTOR
-              value: "0"
-            - name: ENABLE_KUBERNETES_EXECUTOR
-              value: "1"
-            - name: MAX_WORKFLOWS_LIMIT
-              value: "5"
-            - name: CPU_COUNT
-              value: "1"
-            - name: MEMORY_GI
-              value: "1"
-            - name: CPU_COUNT_LOW_RESOURCES
-              value: "1"
-            - name: MEMORY_GI_LOW_RESOURCES
-              value: "1"
-            - name: CPU_COUNT_HIGH_MEM
-              value: "1"
-            - name: MEMORY_GI_HIGH_MEM
-              value: "1"
-            - name: COUNT_RUNNING_WORKERS
-              value: "1"
-            - name: COUNT_CANCELING_WORKERS
-              value: "1"
-            - name: COUNT_HANDLE_JOB_WORKERS
-              value: "1"
-            - name: BIM_API_DEBUG
-              value: "0"
-            - name: BIM_API_V2_DEBUG
-              value: "0"
-            - name: PDM_API_DEBUG
-              value: "0"
-            - name: COMPARISONS_API_DEBUG
-              value: "0"
-            - name: WORKSPACE_API_DEBUG
-              value: "0"
-            - name: JOBS_NAMESPACE
-              value: processing
-            - name: ISSUE_API_DEBUG
-              value: "0"
-            - name: TOLERATION_KEY
-              value: dedicated
-            - name: TOLERATION_VALUE
-              value: processing
-            - name: TOLERATION_KEY_HIGH_MEM
-              value: dedicated
-            - name: TOLERATION_VALUE_HIGH_MEM
-              value: processing
-            - name: TOLERATION_KEY_PERSISTENT
-              value: dedicated
-            - name: TOLERATION_VALUE_PERSISTENT
-              value: processing
-            - name: RABBITMQ_CREATE_EXCHANGE
-              value: autodesk.inputMessage
-            - name: RABBITMQ_CANCEL_EXCHANGE
-              value: autodesk.cancelMessage
-            - name: RABBITMQ_CREATE_ROUTING_KEY
-              value: converting
-            - name: RABBITMQ_CANCEL_TOPIC
-              value: cancel
-            - name: RABBITMQ_COMPLETENESS_EXCHANGE
-              value: autodesk.outputMessage
-            - name: RABBITMQ_COMPLETENESS_TOPIC
-              value: output_navis
-            - name: CONTROL_PLANE_PERIOD
-              value: 10s
-            - name: WORKFLOW_PRIORITY
-              value: low
-            - name: ENABLE_TOLERATION
-              value: "1"
-            - name: DEFAULT_TOLERATION_KEY
-              value: dedicated
-            - name: DEFAULT_TOLERATION_VALUE
-              value: processing
-            - name: DEFAULT_NODE_SELECTOR_KEY
-              value: dedicated
-            - name: DEFAULT_NODE_SELECTOR_VALUE
-              value: processing
 
           resources:
             requests:
-              cpu: "25m"
+              cpu:
-              memory: 128Mi
+                _default: 25m
+              memory:
+                _default: 128Mi
 
-      imagePullSecrets:
+          probes:
-        - name: regcred
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+          name:
+            _default: engine-low-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: WORKFLOWS_SENTRY_DSN
+            value:
+              _default: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
+
+          - name: WORKFLOWS_SENTRY_DEBUG
+            value:
+              _default: "0"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3/yc-s3-service-account.json"
+
+          - name: BIM_API_V2_DB
+            value:
+              _default: "/etc/sarex/bim-api-v2-db-prod.json"
+
+          - name: PDM_API_DB
+            value:
+              _default: "/etc/pdm/pdm-api-db-prod.json"
+
+          - name: WORKSPACE_API_DB
+            value:
+              _default: "/etc/ws/ws-api-db-prod.json"
+
+          - name: ISSUE_API_DB
+            value:
+              _default: "/etc/issues/issue-api-db-prod.json"
+
+          - name: MAILGUN
+            value:
+              _default: "/etc/mailgun-secret/env.json"
+
+          - name: SMTP
+            value:
+              _default: "/vault/secrets/processing-smtp"
+
+          - name: INTERNAL_PDM_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: INTERNAL_FILESTREAM_URL
+            value:
+              _default: "http://documentations-filestream.documentations.svc.cluster.local:8080"
+
+          - name: EXTERNAL_PDM_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: EXTERNAL_FILESTREAM_URL
+            value:
+              _default: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
+
+          - name: RESOURCES_API_INTERNAL_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_S3_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_S3V2_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_PDM_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "1"
+
+          - name: ENABLE_URL_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_SRX_TMP
+            value:
+              _default: "1"
+
+          - name: ENABLE_BIM_API_V2_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_WORKSPACE_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_ISSUE_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_RESOURCES_API
+            value:
+              _default: "1"
+
+          - name: VAULT_USE
+            value:
+              _default: "true"
+
+          - name: ENABLE_PDM_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_COMPARISONS_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAIL_GUN
+            value:
+              _default: "1"
+
+          - name: ENABLE_AMQP_EXECUTOR
+            value:
+              _default: "0"
+
+          - name: ENABLE_KUBERNETES_EXECUTOR
+            value:
+              _default: "1"
+
+          - name: MAX_WORKFLOWS_LIMIT
+            value:
+              _default: "5"
+
+          - name: CPU_COUNT
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI
+            value:
+              _default: "1"
+
+          - name: CPU_COUNT_LOW_RESOURCES
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI_LOW_RESOURCES
+            value:
+              _default: "1"
+
+          - name: CPU_COUNT_HIGH_MEM
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI_HIGH_MEM
+            value:
+              _default: "1"
+
+          - name: COUNT_RUNNING_WORKERS
+            value:
+              _default: "1"
+
+          - name: COUNT_CANCELING_WORKERS
+            value:
+              _default: "1"
+
+          - name: COUNT_HANDLE_JOB_WORKERS
+            value:
+              _default: "1"
+
+          - name: BIM_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: BIM_API_V2_DEBUG
+            value:
+              _default: "0"
+
+          - name: PDM_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: COMPARISONS_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: WORKSPACE_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: JOBS_NAMESPACE
+            value:
+              _default: "processing"
+
+          - name: ISSUE_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: TOLERATION_KEY
+            value:
+              _default: "dedicated"
+
+          - name: TOLERATION_VALUE
+            value:
+              _default: "processing"
+
+          - name: TOLERATION_KEY_HIGH_MEM
+            value:
+              _default: "dedicated"
+
+          - name: TOLERATION_VALUE_HIGH_MEM
+            value:
+              _default: "processing"
+
+          - name: TOLERATION_KEY_PERSISTENT
+            value:
+              _default: "dedicated"
+
+          - name: TOLERATION_VALUE_PERSISTENT
+            value:
+              _default: "processing"
+
+          - name: RABBITMQ_CREATE_EXCHANGE
+            value:
+              _default: "autodesk.inputMessage"
+
+          - name: RABBITMQ_CANCEL_EXCHANGE
+            value:
+              _default: "autodesk.cancelMessage"
+
+          - name: RABBITMQ_CREATE_ROUTING_KEY
+            value:
+              _default: "converting"
+
+          - name: RABBITMQ_CANCEL_TOPIC
+            value:
+              _default: "cancel"
+
+          - name: RABBITMQ_COMPLETENESS_EXCHANGE
+            value:
+              _default: "autodesk.outputMessage"
+
+          - name: RABBITMQ_COMPLETENESS_TOPIC
+            value:
+              _default: "output_navis"
+
+          - name: CONTROL_PLANE_PERIOD
+            value:
+              _default: "10s"
+
+          - name: WORKFLOW_PRIORITY
+            value:
+              _default: "low"
+
+          - name: ENABLE_TOLERATION
+            value:
+              _default: "1"
+
+          - name: DEFAULT_TOLERATION_KEY
+            value:
+              _default: "dedicated"
+
+          - name: DEFAULT_TOLERATION_VALUE
+            value:
+              _default: "processing"
+
+          - name: DEFAULT_NODE_SELECTOR_KEY
+            value:
+              _default: "dedicated"
+
+          - name: DEFAULT_NODE_SELECTOR_VALUE
+            value:
+              _default: "processing"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: processing
+            vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/postgresql/apps/processing
+            vault.hashicorp.com/agent-inject-template-processing-postgresql: |-
+              {{- with secret "secrets/data/postgresql/apps/processing" -}}
+              POSTGRES_ADDRESS=postgresql.processing.svc.cluster.local
+              POSTGRES_PORT=5432
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              POSTGRES_DB=workflow_db
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-processing-rabbitmq: secrets/data/rabbitmq/apps/processing
+            vault.hashicorp.com/agent-inject-template-processing-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/processing" -}}
+              RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
+              RABBITMQ_PORT=5672
+              RABBITMQ_USER={{ index .Data.data "username" }}
+              RABBITMQ_PASS={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-processing-smtp: secrets/data/vault/common/smtp_auth
+            vault.hashicorp.com/agent-inject-template-processing-smtp: |-
+              {{- with secret "secrets/data/vault/common/smtp_auth" -}}
+              {{ index .Data.data "env_json" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/processing/base/engine.yaml

@@ -1,216 +1,420 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: engine
   namespace: processing
-  labels:
+
-    app: engine
-    service: engine
 spec:
-  replicas: 0
+  interval: 10m
-  selector:
+
-    matchLabels:
+  chart:
-      app: engine
-  template:
-    metadata:
-      labels:
-        app: engine
-        service: engine
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: processing
-        vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/postgresql/apps/processing
-        vault.hashicorp.com/agent-inject-template-processing-postgresql: |-
-          {{- with secret "secrets/data/postgresql/apps/processing" -}}
-          POSTGRES_ADDRESS=postgresql.processing.svc.cluster.local
-          POSTGRES_PORT=5432
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          POSTGRES_DB=workflow_db
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-processing-rabbitmq: secrets/data/rabbitmq/apps/processing
-        vault.hashicorp.com/agent-inject-template-processing-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/processing" -}}
-          RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
-          RABBITMQ_PORT=5672
-          RABBITMQ_USER={{ index .Data.data "username" }}
-          RABBITMQ_PASS={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-processing-smtp: secrets/data/vault/common/smtp_auth
-        vault.hashicorp.com/agent-inject-template-processing-smtp: |-
-          {{- with secret "secrets/data/vault/common/smtp_auth" -}}
-          {{ index .Data.data "env_json" }}
-          {{- end -}}
     spec:
-      serviceAccountName: processing-vault
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
 
-      containers:
+  install:
-        - name: engine
+    remediation:
-          image: cr.yandex/crp3ccidau046kdj8g9q/workflows-endigne_prod:075fc0
+      retries: 3
-          imagePullPolicy: IfNotPresent
+
-          command: ["/bin/bash", "-ec"]
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: processing-vault
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-endigne_prod:075fc0
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: engine
+
+          replicaCount:
+            _default: 0
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["/bin/bash", "-ec"]
           args:
-            - |
+            _default:
-              set -a
+              - |
-              [ -f /vault/secrets/processing-postgresql ] && . /vault/secrets/processing-postgresql
+                set -a
-              [ -f /vault/secrets/processing-rabbitmq ] && . /vault/secrets/processing-rabbitmq
+                [ -f /vault/secrets/processing-postgresql ] && . /vault/secrets/processing-postgresql
-              set +a
+                [ -f /vault/secrets/processing-rabbitmq ] && . /vault/secrets/processing-rabbitmq
-              exec /engine
+                set +a
-
+                exec /engine
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-
-          env:
-            - name: POSTGRES_POOL_SIZE
-              value: "20"
-            - name: ENVIRONMENT
-              value: prod
-            - name: WORKFLOWS_SENTRY_DSN
-              value: https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123
-            - name: WORKFLOWS_SENTRY_DEBUG
-              value: "0"
-            - name: API_ADDRESS
-              value: 0.0.0.0:8000
-            - name: DJANGO_HOST
-              value: http://backend.django.svc.cluster.local:8000
-            - name: S3_SERVICE_ACCOUNT
-              value: /etc/sarex/yc-s3/yc-s3-service-account.json
-            - name: BIM_API_V2_DB
-              value: /etc/sarex/bim-api-v2-db-prod.json
-            - name: PDM_API_DB
-              value: /etc/pdm/pdm-api-db-prod.json
-            - name: WORKSPACE_API_DB
-              value: /etc/ws/ws-api-db-prod.json
-            - name: ISSUE_API_DB
-              value: /etc/issues/issue-api-db-prod.json
-            - name: MAILGUN
-              value: /etc/mailgun-secret/env.json
-            - name: SMTP
-              value: /vault/secrets/processing-smtp
-            - name: INTERNAL_PDM_URL
-              value: http://documentations-api.documentations.svc.cluster.local:8080
-            - name: INTERNAL_FILESTREAM_URL
-              value: http://documentations-filestream.documentations.svc.cluster.local:8080
-            - name: EXTERNAL_PDM_URL
-              value: http://documentations-api.documentations.svc.cluster.local:8080
-            - name: EXTERNAL_FILESTREAM_URL
-              value: http://documentations-filestream-service.documentations.svc.cluster.local:8080
-            - name: RESOURCES_API_INTERNAL_HOST
-              value: http://resources-service.resources.svc.cluster.local:8000
-            - name: ENABLE_SQL_QUERY
-              value: "0"
-            - name: ENABLE_S3_STORAGE
-              value: "1"
-            - name: ENABLE_S3V2_STORAGE
-              value: "1"
-            - name: ENABLE_PDM_STORAGE
-              value: "1"
-            - name: ENABLE_SMTP
-              value: "1"
-            - name: ENABLE_URL_STORAGE
-              value: "1"
-            - name: ENABLE_SRX_TMP
-              value: "1"
-            - name: ENABLE_BIM_API_V2_DB
-              value: "1"
-            - name: ENABLE_WORKSPACE_API_DB
-              value: "1"
-            - name: ENABLE_ISSUE_API_DB
-              value: "1"
-            - name: ENABLE_RESOURCES_API
-              value: "1"
-            - name: ENABLE_PDM_API_DB
-              value: "1"
-            - name: ENABLE_COMPARISONS_API_DB
-              value: "1"
-            - name: ENABLE_MAIL_GUN
-              value: "1"
-            - name: ENABLE_AMQP_EXECUTOR
-              value: "0"
-            - name: ENABLE_KUBERNETES_EXECUTOR
-              value: "1"
-            - name: MAX_WORKFLOWS_LIMIT
-              value: "5"
-            - name: CPU_COUNT
-              value: "1"
-            - name: MEMORY_GI
-              value: "1"
-            - name: CPU_COUNT_LOW_RESOURCES
-              value: "1"
-            - name: MEMORY_GI_LOW_RESOURCES
-              value: "1"
-            - name: CPU_COUNT_HIGH_MEM
-              value: "1"
-            - name: MEMORY_GI_HIGH_MEM
-              value: "1"
-            - name: ENABLE_TOLERATION
-              value: "1"
-            - name: COUNT_RUNNING_WORKERS
-              value: "1"
-            - name: COUNT_CANCELING_WORKERS
-              value: "1"
-            - name: COUNT_HANDLE_JOB_WORKERS
-              value: "1"
-            - name: BIM_API_DEBUG
-              value: "0"
-            - name: BIM_API_V2_DEBUG
-              value: "0"
-            - name: PDM_API_DEBUG
-              value: "0"
-            - name: COMPARISONS_API_DEBUG
-              value: "0"
-            - name: WORKSPACE_API_DEBUG
-              value: "0"
-            - name: JOBS_NAMESPACE
-              value: processing
-            - name: ISSUE_API_DEBUG
-              value: "0"
-            - name: TOLERATION_KEY
-              value: dedicated
-            - name: TOLERATION_VALUE
-              value: processing
-            - name: TOLERATION_KEY_HIGH_MEM
-              value: dedicated
-            - name: TOLERATION_VALUE_HIGH_MEM
-              value: processing
-            - name: TOLERATION_KEY_PERSISTENT
-              value: dedicated
-            - name: TOLERATION_VALUE_PERSISTENT
-              value: processing
-            - name: RABBITMQ_CREATE_EXCHANGE
-              value: autodesk.inputMessage
-            - name: RABBITMQ_CANCEL_EXCHANGE
-              value: autodesk.cancelMessage
-            - name: RABBITMQ_CREATE_ROUTING_KEY
-              value: converting
-            - name: RABBITMQ_CANCEL_TOPIC
-              value: cancel
-            - name: RABBITMQ_COMPLETENESS_EXCHANGE
-              value: autodesk.outputMessage
-            - name: RABBITMQ_COMPLETENESS_TOPIC
-              value: output_navis
-            - name: CONTROL_PLANE_PERIOD
-              value: 10s
-            - name: DEFAULT_TOLERATION_KEY
-              value: dedicated
-            - name: DEFAULT_TOLERATION_VALUE
-              value: processing
-            - name: DEFAULT_NODE_SELECTOR_KEY
-              value: dedicated
-            - name: DEFAULT_NODE_SELECTOR_VALUE
-              value: processing
 
           resources:
             requests:
-              cpu: "25m"
+              cpu:
-              memory: 128Mi
+                _default: 25m
+              memory:
+                _default: 128Mi
 
-      imagePullSecrets:
+          probes:
-        - name: regcred
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+          name:
+            _default: engine-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: WORKFLOWS_SENTRY_DSN
+            value:
+              _default: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
+
+          - name: WORKFLOWS_SENTRY_DEBUG
+            value:
+              _default: "0"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3/yc-s3-service-account.json"
+
+          - name: BIM_API_V2_DB
+            value:
+              _default: "/etc/sarex/bim-api-v2-db-prod.json"
+
+          - name: PDM_API_DB
+            value:
+              _default: "/etc/pdm/pdm-api-db-prod.json"
+
+          - name: WORKSPACE_API_DB
+            value:
+              _default: "/etc/ws/ws-api-db-prod.json"
+
+          - name: ISSUE_API_DB
+            value:
+              _default: "/etc/issues/issue-api-db-prod.json"
+
+          - name: MAILGUN
+            value:
+              _default: "/etc/mailgun-secret/env.json"
+
+          - name: SMTP
+            value:
+              _default: "/vault/secrets/processing-smtp"
+
+          - name: INTERNAL_PDM_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: INTERNAL_FILESTREAM_URL
+            value:
+              _default: "http://documentations-filestream.documentations.svc.cluster.local:8080"
+
+          - name: EXTERNAL_PDM_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: EXTERNAL_FILESTREAM_URL
+            value:
+              _default: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
+
+          - name: RESOURCES_API_INTERNAL_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_S3_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_S3V2_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_PDM_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "1"
+
+          - name: ENABLE_URL_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_SRX_TMP
+            value:
+              _default: "1"
+
+          - name: ENABLE_BIM_API_V2_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_WORKSPACE_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_ISSUE_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_RESOURCES_API
+            value:
+              _default: "1"
+
+          - name: ENABLE_PDM_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_COMPARISONS_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAIL_GUN
+            value:
+              _default: "1"
+
+          - name: ENABLE_AMQP_EXECUTOR
+            value:
+              _default: "0"
+
+          - name: ENABLE_KUBERNETES_EXECUTOR
+            value:
+              _default: "1"
+
+          - name: MAX_WORKFLOWS_LIMIT
+            value:
+              _default: "5"
+
+          - name: CPU_COUNT
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI
+            value:
+              _default: "1"
+
+          - name: CPU_COUNT_LOW_RESOURCES
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI_LOW_RESOURCES
+            value:
+              _default: "1"
+
+          - name: CPU_COUNT_HIGH_MEM
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI_HIGH_MEM
+            value:
+              _default: "1"
+
+          - name: ENABLE_TOLERATION
+            value:
+              _default: "1"
+
+          - name: COUNT_RUNNING_WORKERS
+            value:
+              _default: "1"
+
+          - name: COUNT_CANCELING_WORKERS
+            value:
+              _default: "1"
+
+          - name: COUNT_HANDLE_JOB_WORKERS
+            value:
+              _default: "1"
+
+          - name: BIM_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: BIM_API_V2_DEBUG
+            value:
+              _default: "0"
+
+          - name: PDM_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: COMPARISONS_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: WORKSPACE_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: JOBS_NAMESPACE
+            value:
+              _default: "processing"
+
+          - name: ISSUE_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: TOLERATION_KEY
+            value:
+              _default: "dedicated"
+
+          - name: TOLERATION_VALUE
+            value:
+              _default: "processing"
+
+          - name: TOLERATION_KEY_HIGH_MEM
+            value:
+              _default: "dedicated"
+
+          - name: TOLERATION_VALUE_HIGH_MEM
+            value:
+              _default: "processing"
+
+          - name: TOLERATION_KEY_PERSISTENT
+            value:
+              _default: "dedicated"
+
+          - name: TOLERATION_VALUE_PERSISTENT
+            value:
+              _default: "processing"
+
+          - name: RABBITMQ_CREATE_EXCHANGE
+            value:
+              _default: "autodesk.inputMessage"
+
+          - name: RABBITMQ_CANCEL_EXCHANGE
+            value:
+              _default: "autodesk.cancelMessage"
+
+          - name: RABBITMQ_CREATE_ROUTING_KEY
+            value:
+              _default: "converting"
+
+          - name: RABBITMQ_CANCEL_TOPIC
+            value:
+              _default: "cancel"
+
+          - name: RABBITMQ_COMPLETENESS_EXCHANGE
+            value:
+              _default: "autodesk.outputMessage"
+
+          - name: RABBITMQ_COMPLETENESS_TOPIC
+            value:
+              _default: "output_navis"
+
+          - name: CONTROL_PLANE_PERIOD
+            value:
+              _default: "10s"
+
+          - name: DEFAULT_TOLERATION_KEY
+            value:
+              _default: "dedicated"
+
+          - name: DEFAULT_TOLERATION_VALUE
+            value:
+              _default: "processing"
+
+          - name: DEFAULT_NODE_SELECTOR_KEY
+            value:
+              _default: "dedicated"
+
+          - name: DEFAULT_NODE_SELECTOR_VALUE
+            value:
+              _default: "processing"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: processing
+            vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/postgresql/apps/processing
+            vault.hashicorp.com/agent-inject-template-processing-postgresql: |-
+              {{- with secret "secrets/data/postgresql/apps/processing" -}}
+              POSTGRES_ADDRESS=postgresql.processing.svc.cluster.local
+              POSTGRES_PORT=5432
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              POSTGRES_DB=workflow_db
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-processing-rabbitmq: secrets/data/rabbitmq/apps/processing
+            vault.hashicorp.com/agent-inject-template-processing-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/processing" -}}
+              RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
+              RABBITMQ_PORT=5672
+              RABBITMQ_USER={{ index .Data.data "username" }}
+              RABBITMQ_PASS={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-processing-smtp: secrets/data/vault/common/smtp_auth
+            vault.hashicorp.com/agent-inject-template-processing-smtp: |-
+              {{- with secret "secrets/data/vault/common/smtp_auth" -}}
+              {{ index .Data.data "env_json" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/processing/base/frontend-deployment.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: processing
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-    spec:
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/workflows-frontend:ugok2_85f6ce2c
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-      imagePullSecrets:
-        - name: regcred

apps/processing/base/frontend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-svc
-  namespace: processing
-spec:
-  type: ClusterIP
-  selector:
-    app: frontend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP

apps/processing/base/frontend.yaml

@@ -0,0 +1,90 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: processing
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-frontend:ugok2_85f6ce2c
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred

apps/processing/base/kustomization.yaml

@@ -4,10 +4,7 @@ kind: Kustomization
 namespace: processing
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
+  - api.yaml
-  - api-deployment.yaml
   - engine-low.yaml
   - engine.yaml
-  - frontend-deployment.yaml
+  - frontend.yaml
-  - api-service.yaml
-  - frontend-service.yaml

apps/processing/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: processing-vault
-  namespace: processing

apps/processing/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: processing

apps/processing/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: processing
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/projects/base/deployment.yaml

@@ -1,46 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: projects-frontend-static
-  namespace: projects
-  labels:
-    app: projects-frontend-static
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: projects-frontend-static
-  template:
-    metadata:
-      labels:
-        app: projects-frontend-static
-    spec:
-      containers:
-        - name: projects-frontend-static
-          image: cr.yandex/crp3ccidau046kdj8g9q/project-frontend-app:wb_fd49eb19
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 10
-            periodSeconds: 60
-            failureThreshold: 10
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 10
-            periodSeconds: 30
-            failureThreshold: 20
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-      imagePullSecrets:
-        - name: regcred

apps/projects/base/frontend.yaml

@@ -0,0 +1,118 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: projects
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/project-frontend-app:wb_fd49eb19
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: projects-frontend-static
+
+          replicaCount:
+            _default: 2
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 80
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 60
+              failureThreshold:
+                _default: 10
+            readiness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 80
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 30
+              failureThreshold:
+                _default: 20
+
+        service:
+          enabled: true
+
+          name:
+            _default: projects-frontend-static-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred

apps/projects/base/kustomization.yaml

@@ -4,5 +4,4 @@ kind: Kustomization
 namespace: projects
 resources:
   - namespace.yaml
-  - deployment.yaml
+  - frontend.yaml
-  - service.yaml

apps/projects/base/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: projects-frontend-static-service
-  namespace: projects
-spec:
-  type: ClusterIP
-  selector:
-    app: projects-frontend-static
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/projects/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: projects

apps/projects/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: projects
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/projects/dsinv/kustomization.yaml

@@ -7,5 +7,5 @@ resources:
 patches:
 - path: projects-frontend-static.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
-    name: projects-frontend-static
+    name: frontend

apps/projects/dsinv/projects-frontend-static.yaml

@@ -1,13 +1,17 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
-  name: projects-frontend-static
+  name: frontend
   namespace: projects
 spec:
-  replicas: 1
+  values:
-  template:
+    services:
-    spec:
+      frontend:
-      containers:
+        image:
-      - name: projects-frontend-static
+          name:
-        image: cr.yandex/crp3ccidau046kdj8g9q/projects-frontend-static:donstroi_front
+            _default: cr.yandex/crp3ccidau046kdj8g9q/projects-frontend-static:donstroi_front
+
+        deployment:
+          replicaCount:
+            _default: 1

apps/stamp-verification/base/deployment.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: stamp-verification
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-        version: stable
-    spec:
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/stamp-verification-frontend:e11a8f90be462fc325ff99c8c35a8a418815c27b
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-      imagePullSecrets:
-        - name: regcred

apps/stamp-verification/base/frontend.yaml

@@ -0,0 +1,90 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: stamp-verification
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/stamp-verification-frontend:e11a8f90be462fc325ff99c8c35a8a418815c27b
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred

apps/stamp-verification/base/kustomization.yaml

@@ -4,5 +4,4 @@ kind: Kustomization
 namespace: stamp-verification
 resources:
   - namespace.yaml
-  - deployment.yaml
+  - frontend.yaml
-  - service.yaml

apps/stamp-verification/base/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-service
-  namespace: stamp-verification
-spec:
-  type: ClusterIP
-  selector:
-    app: frontend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/stamp-verification/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: stamp-verification

apps/stamp-verification/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: stamp-verification
+  labels:
+    istio-injection: disabled
+    security.deckhouse.io/pod-policy: privileged

apps/system-log/base/api.yaml

@@ -0,0 +1,204 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: api
+  namespace: system-log
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: system-log-vault
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/system-log_prod:075fc0
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["/bin/bash", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/system-log-postgresql ] && . /vault/secrets/system-log-postgresql
+                [ -f /vault/secrets/system-log-kafka ] && . /vault/secrets/system-log-kafka
+                set +a
+                exec /app
+
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        envs:
+          - name: KAFKA_ENABLE
+            value:
+              _default: "1"
+
+          - name: KAFKA_USE_SSL
+            value:
+              _default: "0"
+
+          - name: KAFKA_ENABLE_LOGGING
+            value:
+              _default: "0"
+
+          - name: APP_NAME
+            value:
+              _default: "system_log"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: HTTP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+
+          - name: NAMESPACE
+            value:
+              _default: "system-log"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: KAFKA_GROUP
+            value:
+              _default: "system-log-stage"
+
+          - name: KAFKA_CLIENT_ID
+            value:
+              _default: "system-log-stage"
+
+          - name: KAFKA_PEM_PATH
+            value:
+              _default: "/tmp"
+
+          - name: KAFKA_TOPIC
+            value:
+              _default: "system-log.events"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: system-log
+            vault.hashicorp.com/agent-inject-secret-system-log-postgresql: secrets/data/postgresql/apps/system-log
+            vault.hashicorp.com/agent-inject-template-system-log-postgresql: |-
+              {{- with secret "secrets/data/postgresql/apps/system-log" -}}
+              POSTGRES_ADDRESS=postgresql.system-log.svc.cluster.local
+              POSTGRES_PORT=5432
+              POSTGRES_DB=system_log_db
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-system-log-kafka: secrets/data/kafka/apps/system-log
+            vault.hashicorp.com/agent-inject-template-system-log-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/system-log" -}}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              KAFKA_BROKERS={{ index .Data.data.auth "bootstrap_servers" }}
+              {{ $topics := index .Data.data "topics" }}
+              KAFKA_TOPIC={{ if gt (len $topics) 0 }}{{ index (index $topics 0) "name" }}{{ else }}system-log.events{{ end }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/system-log/base/backend-deployment.yaml

@@ -1,102 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: api
-  namespace: system-log
-  labels:
-    app: api
-    service: api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: api
-  template:
-    metadata:
-      labels:
-        app: api
-        service: api
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: system-log
-        vault.hashicorp.com/agent-inject-secret-system-log-postgresql: secrets/data/postgresql/apps/system-log
-        vault.hashicorp.com/agent-inject-template-system-log-postgresql: |-
-          {{- with secret "secrets/data/postgresql/apps/system-log" -}}
-          POSTGRES_ADDRESS=postgresql.system-log.svc.cluster.local
-          POSTGRES_PORT=5432
-          POSTGRES_DB=system_log_db
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-system-log-kafka: secrets/data/kafka/apps/system-log
-        vault.hashicorp.com/agent-inject-template-system-log-kafka: |-
-          {{- with secret "secrets/data/kafka/apps/system-log" -}}
-          KAFKA_USERNAME={{ index .Data.data "username" }}
-          KAFKA_PASSWORD={{ index .Data.data "password" }}
-          KAFKA_BROKERS={{ index .Data.data.auth "bootstrap_servers" }}
-          {{ $topics := index .Data.data "topics" }}
-          KAFKA_TOPIC={{ if gt (len $topics) 0 }}{{ index (index $topics 0) "name" }}{{ else }}system-log.events{{ end }}
-          {{- end -}}
-    spec:
-      serviceAccountName: system-log-vault
-      containers:
-        - name: api
-          image: cr.yandex/crp3ccidau046kdj8g9q/system-log_prod:075fc0
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/bash", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/system-log-postgresql ] && . /vault/secrets/system-log-postgresql
-              [ -f /vault/secrets/system-log-kafka ] && . /vault/secrets/system-log-kafka
-              set +a
-              exec /app
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: KAFKA_ENABLE
-              value: "1"
-            - name: KAFKA_USE_SSL
-              value: "0"
-            - name: KAFKA_ENABLE_LOGGING
-              value: "0"
-            - name: APP_NAME
-              value: system_log
-            - name: APP_VERSION
-              value: 0.0.1
-            - name: LOG_LEVEL
-              value: INFO
-            - name: HTTP_HOST
-              value: 0.0.0.0
-            - name: HTTP_PORT
-              value: "8000"
-            - name: NAMESPACE
-              value: system-log
-            - name: POSTGRES_POOL_SIZE
-              value: "3"
-            - name: ENABLE_SSL
-              value: "0"
-            - name: KAFKA_GROUP
-              value: system-log-stage
-            - name: KAFKA_CLIENT_ID
-              value: system-log-stage
-            - name: KAFKA_PEM_PATH
-              value: "/tmp"
-            - name: KAFKA_TOPIC
-              value: "system-log.events"
-            - name: DJANGO_HOST
-              value: http://backend.django.svc.cluster.local:8000
-
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/system-log/base/backend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-svc
-  namespace: system-log
-spec:
-  type: ClusterIP
-  selector:
-    app: api
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8000
-      protocol: TCP

apps/system-log/base/kustomization.yaml

@@ -4,7 +4,5 @@ kind: Kustomization
 namespace: system-log
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
+  - api.yaml
-  - backend-deployment.yaml
+  - worker.yaml
-  - backend-service.yaml
-  - worker-deployment.yaml

apps/system-log/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: system-log-vault
-  namespace: system-log

apps/system-log/base/worker-deployment.yaml

@@ -1,87 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: worker
-  namespace: system-log
-  labels:
-    app: worker
-    service: worker
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: worker
-  template:
-    metadata:
-      labels:
-        app: worker
-        service: worker
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: system-log
-        vault.hashicorp.com/agent-inject-secret-system-log-postgresql: secrets/data/postgresql/apps/system-log
-        vault.hashicorp.com/agent-inject-template-system-log-postgresql: |-
-          {{- with secret "secrets/data/postgresql/apps/system-log" -}}
-          POSTGRES_ADDRESS=postgresql.system-log.svc.cluster.local
-          POSTGRES_PORT=5432
-          POSTGRES_DB=system_log_db
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-system-log-django-auth: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-system-log-django-auth: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          SUPER_USERNAME={{ index .Data.data "username" }}
-          SUPER_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: system-log-vault
-      containers:
-        - name: worker
-          image: cr.yandex/crp3ccidau046kdj8g9q/system-log-worker_prod:075fc0
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/bash", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/system-log-postgresql ] && . /vault/secrets/system-log-postgresql
-              [ -f /vault/secrets/system-log-django-auth ] && . /vault/secrets/system-log-django-auth
-              set +a
-              exec /app
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: APP_NAME
-              value: system_log
-            - name: APP_VERSION
-              value: 0.0.1
-            - name: LOG_LEVEL
-              value: INFO
-            - name: HTTP_HOST
-              value: 0.0.0.0
-            - name: HTTP_PORT
-              value: "8000"
-            - name: NAMESPACE
-              value: sarex-system-log
-            - name: DOCUMENTATIONS_URL
-              value: http://documentations-api.documentations.svc.cluster.local:8080
-            - name: POSTGRES_POOL_SIZE
-              value: "3"
-            - name: ENABLE_SSL
-              value: "0"
-            - name: DJANGO_HOST
-              value: http://backend.django.svc.cluster.local:8000
-
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred