From 66cfb61bf210318d7bcb0fd6122272062640364f Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 28 Jul 2026 18:11:41 +0500 Subject: [PATCH] ++ --- apps/django/base/backend-deployment.yaml | 221 --------------- apps/django/base/backend-service.yaml | 15 - apps/django/base/backend.yaml | 312 +++++++++++++++++++++ apps/django/base/celery-deployment.yaml | 203 -------------- apps/django/base/celery.yaml | 279 ++++++++++++++++++ apps/django/base/frontend-deployment.yaml | 55 ---- apps/django/base/frontend-service.yaml | 15 - apps/django/base/frontend.yaml | 86 ++++++ apps/django/base/kustomization.yaml | 13 +- apps/django/base/s3-proxy-service.yaml | 15 - apps/django/base/s3-proxy.yaml | 152 ++++++---- apps/django/base/serviceaccount.yaml | 5 - apps/django/base/srx-admin-deployment.yaml | 32 --- apps/django/base/srx-admin-service.yaml | 15 - apps/django/base/srx-admin.yaml | 70 +++++ apps/django/dsinv/backend.yaml | 261 ++++++++++------- apps/django/dsinv/celery.yaml | 202 +++++++------ apps/django/dsinv/frontend.yaml | 15 +- apps/django/dsinv/kustomization.yaml | 6 +- apps/eav/CONFIGURATION.md | 4 +- apps/eav/base/backend-deployment.yaml | 117 -------- apps/eav/base/backend-service.yaml | 15 - apps/eav/base/helmrelease.yaml | 176 ++++++++++++ apps/eav/base/kustomization.yaml | 4 +- apps/eav/base/serviceaccount.yaml | 5 - apps/eav/dsinv/backend.yaml | 52 ++-- apps/eav/dsinv/kustomization.yaml | 2 +- apps/eav/yc-k8s-test/kustomization.yaml | 2 +- apps/eav/yc-k8s-test/replicas.yaml | 11 +- 29 files changed, 1347 insertions(+), 1013 deletions(-) delete mode 100644 apps/django/base/backend-deployment.yaml delete mode 100644 apps/django/base/backend-service.yaml create mode 100644 apps/django/base/backend.yaml delete mode 100644 apps/django/base/celery-deployment.yaml create mode 100644 apps/django/base/celery.yaml delete mode 100644 apps/django/base/frontend-deployment.yaml delete mode 100644 apps/django/base/frontend-service.yaml create mode 100644 apps/django/base/frontend.yaml delete mode 100644 apps/django/base/s3-proxy-service.yaml delete mode 100644 apps/django/base/serviceaccount.yaml delete mode 100644 apps/django/base/srx-admin-deployment.yaml delete mode 100644 apps/django/base/srx-admin-service.yaml create mode 100644 apps/django/base/srx-admin.yaml delete mode 100644 apps/eav/base/backend-deployment.yaml delete mode 100644 apps/eav/base/backend-service.yaml create mode 100644 apps/eav/base/helmrelease.yaml delete mode 100644 apps/eav/base/serviceaccount.yaml diff --git a/apps/django/base/backend-deployment.yaml b/apps/django/base/backend-deployment.yaml deleted file mode 100644 index ad16495..0000000 --- a/apps/django/base/backend-deployment.yaml +++ /dev/null @@ -1,221 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: django - labels: - app: backend - service: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - service: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: django - vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres - vault.hashicorp.com/agent-inject-template-django-postgresql: |- - {{- with secret "secrets/data/apps/django/postgres" -}} - DJANGO_POSTGRES_HOST={{ index .Data.data "host" }} - DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }} - DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }} - DJANGO_POSTGRES_USER={{ index .Data.data "username" }} - DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django - vault.hashicorp.com/agent-inject-template-django-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/django" -}} - CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - CELERY_RABBITMQ_USER={{ index .Data.data "username" }} - CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} - CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} - DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local - DJANGO_RABBIT_USER={{ index .Data.data "username" }} - DJANGO_RABBIT_PASS={{ index .Data.data "password" }} - DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django - vault.hashicorp.com/agent-inject-template-django-s3: |- - {{- with secret "secrets/data/minio/apps/django" }} - AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech - S3_HOST=https://minio.contour.infra.sarex.tech - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - {{- end }} - vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django - vault.hashicorp.com/agent-inject-template-django-kafka: |- - {{- with secret "secrets/data/kafka/apps/django" -}} - KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]" - KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} - KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} - KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} - KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-django-jwt-private: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "private_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-django-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-django-common: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }} - {{- end -}} - spec: - serviceAccountName: django-vault - volumes: - - name: django-configmap - configMap: - name: django-configmap - items: - - key: production.py - path: production.py - defaultMode: 420 - - name: uwsgi-configmap - configMap: - name: uwsgi-configmap - items: - - key: uwsgi.ini - path: uwsgi.ini - defaultMode: 420 - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql - [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq - [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3 - [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka - [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)" - [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)" - set +a - exec /opt/sarex/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: ALLOWED_HOSTS - value: '*' - - name: SERVER_USE_CHANGELOG - value: "0" - - name: SERVER_ZITADEL_ENABLED - value: "True" - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: CELERY_REDIS_HOST - value: redis - - name: CELERY_REDIS_PORT - value: "6379" - - name: DJANGO_REDIS_HOST - value: redis - - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED - value: "True" - - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED - value: "True" - - name: DJANGO_REDIS_PORT - value: "6379" - - name: BIMV2_INTERNAL_HOST - value: http://bim-backend-v2-service.bim-api - - name: BIMV2_TIMEOUT - value: "60" - - name: JWT_KID - value: "1" - - name: PDM_SYNC - value: "1" - - name: KC_SYNC_ENABLE - value: "0" - - name: MEASUREMENTS_HOST - value: http://measurements-service.measurements.svc.cluster.local:8000/api - - name: MEASUREMENTS_USE_MEASUREMENTS - value: "1" - - name: SERVER_API_HOST - value: https://sarex.contour.infra.sarex.tech - - name: SERVER_HOST - value: https://sarex.contour.infra.sarex.tech - - name: WORKFLOWS_HOST - value: http://backend-svc.processing.svc.cluster.local:80 - - name: WORKFLOWS_BASE_HOST - value: http://backend-svc.django.svc.cluster.local:80 - - name: WORKFLOWS_PREFIX - value: /internal/v1 - - name: WORKFLOWS_USE - value: "1" - - name: SERVER_S3_STREAM_IMPORT - value: "1" - - name: SERVER_SAVE_DIFF_DEM - value: "1" - - name: SERVER_USE_CLICKHOUSE - value: "0" - - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK - value: "0" - - name: SERVER_USE_DJANGO_STORAGE - value: "1" - - name: SERVER_USE_METASHAPE - value: "0" - - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG - value: "1" - - name: SERVER_CHANGELOG_MODE - value: "0" - - name: SERVER_DJANGO_URLS - value: "1" - - name: CHECK_IMPORT_HASH - value: "1" - - name: EAV_ENABLE - value: "1" - - name: SERVER_CHECK_IMPORT_HASH - value: "1" - - name: SERVER_CHUNKED_PATH - value: /tmp/chunked_uploads/%Y/%m/%d - - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS - value: "0" - - name: SERVER_USE_WRORKFLOW_STATUS - value: "1" - - name: ZITADEL_HOST - value: https://zitadel.contour.infra.sarex.tech - - name: SERVER_KAFKA_ENABLED - value: "False" - - name: KAFKA_TOPICS - value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' - - name: KAFKA_SSL_CAFILE - value: /usr/local/share/ca-certificates/kafka.crt - - name: KC_USE_REDIRECT_LOGOUT - value: "False" - - - - resources: - requests: - cpu: "25m" - memory: 128Mi - volumeMounts: - - name: django-configmap - mountPath: /opt/sarex/config/settings/production.py - subPath: production.py - - name: uwsgi-configmap - mountPath: /opt/sarex/uwsgi.ini - subPath: uwsgi.ini - imagePullSecrets: - - name: regcred diff --git a/apps/django/base/backend-service.yaml b/apps/django/base/backend-service.yaml deleted file mode 100644 index f46fcaf..0000000 --- a/apps/django/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: django -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/django/base/backend.yaml b/apps/django/base/backend.yaml new file mode 100644 index 0000000..af29473 --- /dev/null +++ b/apps/django/base/backend.yaml @@ -0,0 +1,312 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: django +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: django-vault + deployment: + enabled: true + name: + _default: backend + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql + [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq + [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3 + [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka + [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)" + [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)" + set +a + exec /opt/sarex/entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: + _default: + - name: django-configmap + mountPath: + _default: /opt/sarex/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + - name: uwsgi-configmap + mountPath: + _default: /opt/sarex/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: uwsgi-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + envs: + - name: ALLOWED_HOSTS + value: + _default: "*" + - name: SERVER_USE_CHANGELOG + value: + _default: "0" + - name: SERVER_ZITADEL_ENABLED + value: + _default: "True" + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: CELERY_REDIS_HOST + value: + _default: redis + - name: CELERY_REDIS_PORT + value: + _default: "6379" + - name: DJANGO_REDIS_HOST + value: + _default: redis + - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED + value: + _default: "True" + - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED + value: + _default: "True" + - name: DJANGO_REDIS_PORT + value: + _default: "6379" + - name: BIMV2_INTERNAL_HOST + value: + _default: http://bim-backend-v2-service.bim-api + - name: BIMV2_TIMEOUT + value: + _default: "60" + - name: JWT_KID + value: + _default: "1" + - name: PDM_SYNC + value: + _default: "1" + - name: KC_SYNC_ENABLE + value: + _default: "0" + - name: MEASUREMENTS_HOST + value: + _default: http://measurements-service.measurements.svc.cluster.local:8000/api + - name: MEASUREMENTS_USE_MEASUREMENTS + value: + _default: "1" + - name: SERVER_API_HOST + value: + _default: https://sarex.contour.infra.sarex.tech + - name: SERVER_HOST + value: + _default: https://sarex.contour.infra.sarex.tech + - name: WORKFLOWS_HOST + value: + _default: http://backend-svc.processing.svc.cluster.local:80 + - name: WORKFLOWS_BASE_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: WORKFLOWS_PREFIX + value: + _default: /internal/v1 + - name: WORKFLOWS_USE + value: + _default: "1" + - name: SERVER_S3_STREAM_IMPORT + value: + _default: "1" + - name: SERVER_SAVE_DIFF_DEM + value: + _default: "1" + - name: SERVER_USE_CLICKHOUSE + value: + _default: "0" + - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK + value: + _default: "0" + - name: SERVER_USE_DJANGO_STORAGE + value: + _default: "1" + - name: SERVER_USE_METASHAPE + value: + _default: "0" + - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG + value: + _default: "1" + - name: SERVER_CHANGELOG_MODE + value: + _default: "0" + - name: SERVER_DJANGO_URLS + value: + _default: "1" + - name: CHECK_IMPORT_HASH + value: + _default: "1" + - name: EAV_ENABLE + value: + _default: "1" + - name: SERVER_CHECK_IMPORT_HASH + value: + _default: "1" + - name: SERVER_CHUNKED_PATH + value: + _default: /tmp/chunked_uploads/%Y/%m/%d + - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS + value: + _default: "0" + - name: SERVER_USE_WRORKFLOW_STATUS + value: + _default: "1" + - name: ZITADEL_HOST + value: + _default: https://zitadel.contour.infra.sarex.tech + - name: SERVER_KAFKA_ENABLED + value: + _default: "False" + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + - name: KAFKA_SSL_CAFILE + value: + _default: /usr/local/share/ca-certificates/kafka.crt + - name: KC_USE_REDIRECT_LOGOUT + value: + _default: "False" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: django + vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres + vault.hashicorp.com/agent-inject-template-django-postgresql: |- + {{- with secret "secrets/data/apps/django/postgres" -}} + DJANGO_POSTGRES_HOST={{ index .Data.data "host" }} + DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }} + DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }} + DJANGO_POSTGRES_USER={{ index .Data.data "username" }} + DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django + vault.hashicorp.com/agent-inject-template-django-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/django" -}} + CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + CELERY_RABBITMQ_USER={{ index .Data.data "username" }} + CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local + DJANGO_RABBIT_USER={{ index .Data.data "username" }} + DJANGO_RABBIT_PASS={{ index .Data.data "password" }} + DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django + vault.hashicorp.com/agent-inject-template-django-s3: |- + {{- with secret "secrets/data/minio/apps/django" }} + AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech + S3_HOST=https://minio.contour.infra.sarex.tech + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + {{- end }} + vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django + vault.hashicorp.com/agent-inject-template-django-kafka: |- + {{- with secret "secrets/data/kafka/apps/django" -}} + KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]" + KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} + KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-django-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-django-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-django-common: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }} + {{- end -}} diff --git a/apps/django/base/celery-deployment.yaml b/apps/django/base/celery-deployment.yaml deleted file mode 100644 index 843d210..0000000 --- a/apps/django/base/celery-deployment.yaml +++ /dev/null @@ -1,203 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: celery - namespace: django - labels: - app: celery - service: celery -spec: - replicas: 1 - selector: - matchLabels: - app: celery - template: - metadata: - labels: - app: celery - service: celery - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: django - vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres - vault.hashicorp.com/agent-inject-template-django-postgresql: |- - {{- with secret "secrets/data/apps/django/postgres" -}} - DJANGO_POSTGRES_HOST={{ index .Data.data "host" }} - DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }} - DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }} - DJANGO_POSTGRES_USER={{ index .Data.data "username" }} - DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django - vault.hashicorp.com/agent-inject-template-django-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/django" -}} - CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - CELERY_RABBITMQ_USER={{ index .Data.data "username" }} - CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} - CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} - DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local - DJANGO_RABBIT_USER={{ index .Data.data "username" }} - DJANGO_RABBIT_PASS={{ index .Data.data "password" }} - DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django - vault.hashicorp.com/agent-inject-template-django-s3: |- - {{- with secret "secrets/data/minio/apps/django" -}} - AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech - S3_HOST=https://minio.contour.infra.sarex.tech - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}django{{- end -}} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django - vault.hashicorp.com/agent-inject-template-django-kafka: |- - {{- with secret "secrets/data/kafka/apps/django" -}} - KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]" - KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} - KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} - KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} - KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-django-jwt-private: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "private_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-django-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-django-common: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }} - {{- end -}} - spec: - serviceAccountName: django-vault - volumes: - - name: django-configmap - configMap: - name: django-configmap - items: - - key: production.py - path: production.py - defaultMode: 420 - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql - [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq - [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3 - [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka - [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)" - [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)" - set +a - exec celery -A config worker -B -l info -E -Q default -n default_worker.%h --concurrency=2 - - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: ALLOWED_HOSTS - value: '*' - - name: SERVER_USE_CHANGELOG - value: "0" - - name: SERVER_ZITADEL_ENABLED - value: "False" - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: CELERY_REDIS_HOST - value: redis - - name: CELERY_REDIS_PORT - value: "6379" - - name: DJANGO_REDIS_HOST - value: redis - - name: DJANGO_REDIS_PORT - value: "6379" - - name: BIMV2_INTERNAL_HOST - value: http://bim-backend-v2-service.bim-api - - name: BIMV2_TIMEOUT - value: "60" - - name: JWT_KID - value: "1" - - name: PDM_SYNC - value: "1" - - name: KC_SYNC_ENABLE - value: "0" - - name: MEASUREMENTS_HOST - value: http://measurements-service.measurements.svc.cluster.local:8000/api - - name: MEASUREMENTS_USE_MEASUREMENTS - value: "1" - - name: SERVER_API_HOST - value: https://wb.sarex.io - - name: SERVER_HOST - value: https://wb.sarex.io - - name: WORKFLOWS_HOST - value: https://wb.sarex.io - - name: WORKFLOWS_BASE_HOST - value: https://wb.sarex.io - - name: WORKFLOWS_USE - value: "1" - - name: SERVER_S3_STREAM_IMPORT - value: "1" - - name: SERVER_SAVE_DIFF_DEM - value: "1" - - name: SERVER_USE_CLICKHOUSE - value: "0" - - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK - value: "0" - - name: SERVER_USE_DJANGO_STORAGE - value: "1" - - name: SERVER_USE_METASHAPE - value: "0" - - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG - value: "1" - - name: SERVER_CHANGELOG_MODE - value: "0" - - name: SERVER_DJANGO_URLS - value: "1" - - name: CHECK_IMPORT_HASH - value: "1" - - name: EAV_ENABLE - value: "1" - - name: SERVER_CHECK_IMPORT_HASH - value: "1" - - name: SERVER_CHUNKED_PATH - value: /tmp/chunked_uploads/%Y/%m/%d - - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS - value: "0" - - name: SERVER_USE_WRORKFLOW_STATUS - value: "1" - - name: ZITADEL_HOST - value: https://zitadel-srx.wb.ru - - name: SERVER_KAFKA_ENABLED - value: "False" - - name: KAFKA_TOPICS - value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' - - name: KAFKA_SSL_CAFILE - value: /usr/local/share/ca-certificates/kafka.crt - - name: KC_USE_REDIRECT_LOGOUT - value: "False" - resources: - requests: - cpu: "25m" - memory: 128Mi - volumeMounts: - - name: django-configmap - mountPath: /opt/sarex/config/settings/production.py - subPath: production.py - imagePullSecrets: - - name: regcred diff --git a/apps/django/base/celery.yaml b/apps/django/base/celery.yaml new file mode 100644 index 0000000..2d83de5 --- /dev/null +++ b/apps/django/base/celery.yaml @@ -0,0 +1,279 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: django +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + celery: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: django-vault + deployment: + enabled: true + name: + _default: celery + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql + [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq + [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3 + [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka + [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)" + [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)" + set +a + exec celery -A config worker -B -l info -E -Q default -n default_worker.%h --concurrency=2 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0 + pullPolicy: + _default: IfNotPresent + service: + enabled: false + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: + _default: + - name: django-configmap + mountPath: + _default: /opt/sarex/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + envs: + - name: ALLOWED_HOSTS + value: + _default: "*" + - name: SERVER_USE_CHANGELOG + value: + _default: "0" + - name: SERVER_ZITADEL_ENABLED + value: + _default: "False" + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: CELERY_REDIS_HOST + value: + _default: redis + - name: CELERY_REDIS_PORT + value: + _default: "6379" + - name: DJANGO_REDIS_HOST + value: + _default: redis + - name: DJANGO_REDIS_PORT + value: + _default: "6379" + - name: BIMV2_INTERNAL_HOST + value: + _default: http://bim-backend-v2-service.bim-api + - name: BIMV2_TIMEOUT + value: + _default: "60" + - name: JWT_KID + value: + _default: "1" + - name: PDM_SYNC + value: + _default: "1" + - name: KC_SYNC_ENABLE + value: + _default: "0" + - name: MEASUREMENTS_HOST + value: + _default: http://measurements-service.measurements.svc.cluster.local:8000/api + - name: MEASUREMENTS_USE_MEASUREMENTS + value: + _default: "1" + - name: SERVER_API_HOST + value: + _default: https://wb.sarex.io + - name: SERVER_HOST + value: + _default: https://wb.sarex.io + - name: WORKFLOWS_HOST + value: + _default: https://wb.sarex.io + - name: WORKFLOWS_BASE_HOST + value: + _default: https://wb.sarex.io + - name: WORKFLOWS_USE + value: + _default: "1" + - name: SERVER_S3_STREAM_IMPORT + value: + _default: "1" + - name: SERVER_SAVE_DIFF_DEM + value: + _default: "1" + - name: SERVER_USE_CLICKHOUSE + value: + _default: "0" + - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK + value: + _default: "0" + - name: SERVER_USE_DJANGO_STORAGE + value: + _default: "1" + - name: SERVER_USE_METASHAPE + value: + _default: "0" + - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG + value: + _default: "1" + - name: SERVER_CHANGELOG_MODE + value: + _default: "0" + - name: SERVER_DJANGO_URLS + value: + _default: "1" + - name: CHECK_IMPORT_HASH + value: + _default: "1" + - name: EAV_ENABLE + value: + _default: "1" + - name: SERVER_CHECK_IMPORT_HASH + value: + _default: "1" + - name: SERVER_CHUNKED_PATH + value: + _default: /tmp/chunked_uploads/%Y/%m/%d + - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS + value: + _default: "0" + - name: SERVER_USE_WRORKFLOW_STATUS + value: + _default: "1" + - name: ZITADEL_HOST + value: + _default: https://zitadel-srx.wb.ru + - name: SERVER_KAFKA_ENABLED + value: + _default: "False" + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + - name: KAFKA_SSL_CAFILE + value: + _default: /usr/local/share/ca-certificates/kafka.crt + - name: KC_USE_REDIRECT_LOGOUT + value: + _default: "False" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: django + vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres + vault.hashicorp.com/agent-inject-template-django-postgresql: |- + {{- with secret "secrets/data/apps/django/postgres" -}} + DJANGO_POSTGRES_HOST={{ index .Data.data "host" }} + DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }} + DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }} + DJANGO_POSTGRES_USER={{ index .Data.data "username" }} + DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django + vault.hashicorp.com/agent-inject-template-django-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/django" -}} + CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + CELERY_RABBITMQ_USER={{ index .Data.data "username" }} + CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local + DJANGO_RABBIT_USER={{ index .Data.data "username" }} + DJANGO_RABBIT_PASS={{ index .Data.data "password" }} + DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django + vault.hashicorp.com/agent-inject-template-django-s3: |- + {{- with secret "secrets/data/minio/apps/django" -}} + AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech + S3_HOST=https://minio.contour.infra.sarex.tech + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}django{{- end -}} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django + vault.hashicorp.com/agent-inject-template-django-kafka: |- + {{- with secret "secrets/data/kafka/apps/django" -}} + KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]" + KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} + KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-django-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-django-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-django-common: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }} + {{- end -}} diff --git a/apps/django/base/frontend-deployment.yaml b/apps/django/base/frontend-deployment.yaml deleted file mode 100644 index 47d8639..0000000 --- a/apps/django/base/frontend-deployment.yaml +++ /dev/null @@ -1,55 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: django - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - volumes: - - name: nginx-configmap - configMap: - name: nginx-configmap - items: - - key: nginx.conf - path: nginx.conf - defaultMode: 420 - # - name: zitadel-configmap - # configMap: - # name: zitadel-configmap - # items: - # - key: config.json - # path: config.json - # defaultMode: 420 - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.0 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - volumeMounts: - - name: nginx-configmap - mountPath: /etc/nginx/nginx.conf - subPath: nginx.conf - # - name: zitadel-configmap - # readOnly: true - # mountPath: /opt/react_client/static/config.json - # subPath: config.json - imagePullSecrets: - - name: regcred diff --git a/apps/django/base/frontend-service.yaml b/apps/django/base/frontend-service.yaml deleted file mode 100644 index f2c3ba6..0000000 --- a/apps/django/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: django -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/django/base/frontend.yaml b/apps/django/base/frontend.yaml new file mode 100644 index 0000000..81af020 --- /dev/null +++ b/apps/django/base/frontend.yaml @@ -0,0 +1,86 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: django +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + frontend: + enabled: true + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.0 + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + name: + _default: frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + service: + enabled: true + name: + _default: frontend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: + _default: + - name: nginx-configmap + mountPath: + _default: /etc/nginx/nginx.conf + subPath: + _default: nginx.conf + readOnly: + _default: true + configMap: + name: + _default: nginx-configmap + items: + - key: nginx.conf + path: + _default: nginx.conf diff --git a/apps/django/base/kustomization.yaml b/apps/django/base/kustomization.yaml index 5507f04..e86d3df 100644 --- a/apps/django/base/kustomization.yaml +++ b/apps/django/base/kustomization.yaml @@ -4,17 +4,12 @@ kind: Kustomization namespace: django resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - celery-deployment.yaml - - frontend-deployment.yaml - - backend-service.yaml - - frontend-service.yaml - django-configmap.yaml - - srx-admin-deployment.yaml - - srx-admin-service.yaml - nginx-configmap.yaml - uwsgi-configmap.yaml - zitadel-configmap.yaml - - s3-proxy-service.yaml + - backend.yaml + - celery.yaml + - frontend.yaml + - srx-admin.yaml - s3-proxy.yaml diff --git a/apps/django/base/s3-proxy-service.yaml b/apps/django/base/s3-proxy-service.yaml deleted file mode 100644 index cc2290c..0000000 --- a/apps/django/base/s3-proxy-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: s3-proxy-svc - namespace: django -spec: - type: ClusterIP - selector: - app: s3-proxy - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/django/base/s3-proxy.yaml b/apps/django/base/s3-proxy.yaml index 044ebcc..b03508d 100644 --- a/apps/django/base/s3-proxy.yaml +++ b/apps/django/base/s3-proxy.yaml @@ -1,69 +1,97 @@ -apiVersion: apps/v1 -kind: Deployment +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: s3-proxy namespace: django - labels: - app: s3-proxy - spec: - replicas: 1 - - selector: - matchLabels: - app: s3-proxy - - template: - metadata: - labels: - app: s3-proxy - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: django - - vault.hashicorp.com/agent-inject-secret-s3: secrets/data/minio/apps/django - - vault.hashicorp.com/agent-inject-template-s3: | - {{- with secret "secrets/data/minio/apps/django" }} - AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech - {{- $buckets := index .Data.data "buckets" }} - AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} - AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end }} - + interval: 10m + chart: spec: - serviceAccountName: django-vault - - containers: - - name: s3-proxy - image: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:vault_6e586217 - imagePullPolicy: Always - + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + s3-proxy: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: django-vault + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:vault_6e586217 + pullPolicy: + _default: Always + deployment: + enabled: true + name: + _default: s3-proxy + replicaCount: + _default: 1 + port: + _default: 80 command: - - /bin/sh - - -ec - + _default: ["/bin/sh", "-ec"] args: - - | - set -a - [ -f /vault/secrets/s3 ] && . /vault/secrets/s3 - set +a - - exec /s3-proxy - - ports: - - name: http - containerPort: 80 - - env: - - name: ACCESS_LOG - value: "true" - - - name: CORS_ALLOW_HEADERS - value: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding" \ No newline at end of file + _default: + - | + set -a + [ -f /vault/secrets/s3 ] && . /vault/secrets/s3 + set +a + exec /s3-proxy + probes: + liveness: + enabled: false + readiness: + enabled: false + service: + enabled: true + name: + _default: s3-proxy-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + envs: + - name: ACCESS_LOG + value: + _default: "true" + - name: CORS_ALLOW_HEADERS + value: + _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: django + vault.hashicorp.com/agent-inject-secret-s3: secrets/data/minio/apps/django + vault.hashicorp.com/agent-inject-template-s3: | + {{- with secret "secrets/data/minio/apps/django" }} + AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech + {{- $buckets := index .Data.data "buckets" }} + AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} + AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end }} diff --git a/apps/django/base/serviceaccount.yaml b/apps/django/base/serviceaccount.yaml deleted file mode 100644 index 5222954..0000000 --- a/apps/django/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: django-vault - namespace: django diff --git a/apps/django/base/srx-admin-deployment.yaml b/apps/django/base/srx-admin-deployment.yaml deleted file mode 100644 index a6f93ae..0000000 --- a/apps/django/base/srx-admin-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: srx-admin-frontend - namespace: django - labels: - app: srx-admin-frontend -spec: - replicas: 1 - selector: - matchLabels: - app: srx-admin-frontend - template: - metadata: - labels: - app: srx-admin-frontend - spec: - containers: - - name: srx-admin-frontend - image: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_3b9cb250 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/django/base/srx-admin-service.yaml b/apps/django/base/srx-admin-service.yaml deleted file mode 100644 index 0d1b912..0000000 --- a/apps/django/base/srx-admin-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: srx-admin-svc - namespace: django -spec: - type: ClusterIP - selector: - app: srx-admin - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/django/base/srx-admin.yaml b/apps/django/base/srx-admin.yaml new file mode 100644 index 0000000..d8ec105 --- /dev/null +++ b/apps/django/base/srx-admin.yaml @@ -0,0 +1,70 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: srx-admin-frontend + namespace: django +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + srx-admin: + enabled: true + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_3b9cb250 + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + name: + _default: srx-admin-frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + service: + enabled: true + name: + _default: srx-admin-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/django/dsinv/backend.yaml b/apps/django/dsinv/backend.yaml index 074397e..acb04f7 100644 --- a/apps/django/dsinv/backend.yaml +++ b/apps/django/dsinv/backend.yaml @@ -1,110 +1,161 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: django spec: - replicas: 2 - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1 - env: - - name: GK_ENCRYPTION_KEY - value: zfDjuszywHSbAhY8KJQbESbpUYN74XTs - - name: SERVER_DONSTROI_STYLE - value: 'True' - - name: SERVER_API_HOST - value: https://sarex.dsinv.ru - - name: SERVER_VERIFY_SSL - value: 'False' - - name: SERVER_SUPERSET_HOST - value: https://bi.sarex.dsinv.ru - - name: GATEWAY_HOST - value: http://pdm-api.documentations.svc.cluster.local:8080 - - name: KC_DEFAULT_COMPANY_NAME - value: Донстрой - - name: KC_SYNC_USER_GROUPS - value: '0' - - name: SERVER_ZITADEL_ENABLED - value: 'False' - - name: KC_SYNC_USER_POSITIONS - value: '0' - - name: KC_SYNC_USER_DEPARTMENTS - value: '0' - - name: SERVER_CHANGELOG_MODE_CELERY - value: 'True' - - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG - value: 'True' - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: CC_PATH - value: /usr/local/bin/CloudCompare - - name: CC_COMPARISONS_BASE_DIR - value: /tmp - - name: PCVT_PATH - value: /usr/local/bin/PotreeConverter - - name: POTREE_CONVERTER_PATH - value: /usr/local/bin/PotreeConverter - - name: WORKFLOWS_BASE_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: WORKFLOWS_HOST - value: http://workflows-service.workflow.svc.cluster.local:8000 - - name: WORKFLOWS_PREFIX - value: /api/v1 - - name: SERVER_HOST - value: https://sarex.dsinv.ru - - name: S3_HOST - value: http://minio-service.minio.svc.cluster.local:9000 - - name: AWS_S3_ENDPOINT_URL - value: http://minio-service.minio.svc.cluster.local:9000 - - name: MEASUREMENTS_USE_MEASUREMENTS - value: '1' - - name: MEASUREMENTS_HOST - value: http://measurement-service.measurements.svc.cluster.local:8000/api - - name: SERVER_USE_DJANGO_STORAGE - value: '1' - - name: SERVER_DJANGO_URLS - value: '1' - - name: SERVER_S3_STREAM_IMPORT - value: '1' - - name: WORKFLOWS_USE - value: '1' - - name: SERVER_KAFKA_ENABLED - value: 'True' - - name: KAFKA_TOPICS - value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' - - name: KAFKA_BOOTSTRAP_SERVERS - value: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]' - - name: KAFKA_SECURITY_PROTOCOL - value: SSL - - name: KAFKA_SASL_MECHANISM - value: SCRAM-SHA-512 - - name: KAFKA_SSL_CAFILE - value: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt - - name: WORKFLOWS_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: DJANGO_REDIS_HOST - value: redis-service.django.svc.cluster.local - - name: DJANGO_RABBIT_HOSTNAME - value: rabbitmq-service.django.svc.cluster.local - - name: CELERY_RABBITMQ_HOST - value: rabbitmq-service.django.svc.cluster.local - - name: DJANGO_POSTGRES_HOST - value: postgres-service - - name: DJANGO_POSTGRES_PORTS - value: '5432' - - name: ALLOWED_HOSTS - value: '*' - - name: USE_SSL_FOR_URL_SERIALIZATION - value: '0' - - name: SERVER_REPLACE_HOST - value: '1' - - name: SERVER_JWT_PROXY - value: '0' - - name: PDM_SYNC - value: '1' - - name: CELERY_REDIS_HOST - value: redis-service + values: + services: + backend: + deployment: + replicaCount: + _default: 2 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1 + envs: + - name: GK_ENCRYPTION_KEY + value: + _default: zfDjuszywHSbAhY8KJQbESbpUYN74XTs + - name: SERVER_DONSTROI_STYLE + value: + _default: "True" + - name: SERVER_API_HOST + value: + _default: https://sarex.dsinv.ru + - name: SERVER_VERIFY_SSL + value: + _default: "False" + - name: SERVER_SUPERSET_HOST + value: + _default: https://bi.sarex.dsinv.ru + - name: GATEWAY_HOST + value: + _default: http://pdm-api.documentations.svc.cluster.local:8080 + - name: KC_DEFAULT_COMPANY_NAME + value: + _default: Донстрой + - name: KC_SYNC_USER_GROUPS + value: + _default: "0" + - name: SERVER_ZITADEL_ENABLED + value: + _default: "False" + - name: KC_SYNC_USER_POSITIONS + value: + _default: "0" + - name: KC_SYNC_USER_DEPARTMENTS + value: + _default: "0" + - name: SERVER_CHANGELOG_MODE_CELERY + value: + _default: "True" + - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG + value: + _default: "True" + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: CC_PATH + value: + _default: /usr/local/bin/CloudCompare + - name: CC_COMPARISONS_BASE_DIR + value: + _default: /tmp + - name: PCVT_PATH + value: + _default: /usr/local/bin/PotreeConverter + - name: POTREE_CONVERTER_PATH + value: + _default: /usr/local/bin/PotreeConverter + - name: WORKFLOWS_BASE_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: WORKFLOWS_HOST + value: + _default: http://workflows-service.workflow.svc.cluster.local:8000 + - name: WORKFLOWS_PREFIX + value: + _default: /api/v1 + - name: SERVER_HOST + value: + _default: https://sarex.dsinv.ru + - name: S3_HOST + value: + _default: http://minio-service.minio.svc.cluster.local:9000 + - name: AWS_S3_ENDPOINT_URL + value: + _default: http://minio-service.minio.svc.cluster.local:9000 + - name: MEASUREMENTS_USE_MEASUREMENTS + value: + _default: "1" + - name: MEASUREMENTS_HOST + value: + _default: http://measurement-service.measurements.svc.cluster.local:8000/api + - name: SERVER_USE_DJANGO_STORAGE + value: + _default: "1" + - name: SERVER_DJANGO_URLS + value: + _default: "1" + - name: SERVER_S3_STREAM_IMPORT + value: + _default: "1" + - name: WORKFLOWS_USE + value: + _default: "1" + - name: SERVER_KAFKA_ENABLED + value: + _default: "True" + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]' + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: SSL + - name: KAFKA_SASL_MECHANISM + value: + _default: SCRAM-SHA-512 + - name: KAFKA_SSL_CAFILE + value: + _default: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt + - name: WORKFLOWS_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: DJANGO_REDIS_HOST + value: + _default: redis-service.django.svc.cluster.local + - name: DJANGO_RABBIT_HOSTNAME + value: + _default: rabbitmq-service.django.svc.cluster.local + - name: CELERY_RABBITMQ_HOST + value: + _default: rabbitmq-service.django.svc.cluster.local + - name: DJANGO_POSTGRES_HOST + value: + _default: postgres-service + - name: DJANGO_POSTGRES_PORTS + value: + _default: "5432" + - name: ALLOWED_HOSTS + value: + _default: "*" + - name: USE_SSL_FOR_URL_SERIALIZATION + value: + _default: "0" + - name: SERVER_REPLACE_HOST + value: + _default: "1" + - name: SERVER_JWT_PROXY + value: + _default: "0" + - name: PDM_SYNC + value: + _default: "1" + - name: CELERY_REDIS_HOST + value: + _default: redis-service diff --git a/apps/django/dsinv/celery.yaml b/apps/django/dsinv/celery.yaml index 2a8b34a..948511e 100644 --- a/apps/django/dsinv/celery.yaml +++ b/apps/django/dsinv/celery.yaml @@ -1,87 +1,125 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: celery namespace: django spec: - template: - spec: - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1 - env: - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: CC_PATH - value: /usr/local/bin/CloudCompare - - name: CC_COMPARISONS_BASE_DIR - value: /tmp - - name: AWS_S3_ENDPOINT_URL - value: http://minio-service.minio.svc.cluster.local:9000 - - name: PCVT_PATH - value: /usr/local/bin/PotreeConverter - - name: POTREE_CONVERTER_PATH - value: /usr/local/bin/PotreeConverter - - name: WORKFLOWS_BASE_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: WORKFLOWS_HOST - value: https://sarex.dsinv.ru - - name: SERVER_CACHE_ENABLED - value: 'True' - - name: SERVER_API_HOST - value: https://sarex.dsinv.ru - - name: SERVER_VERIFY_SSL - value: 'False' - - name: SERVER_HOST - value: https://sarex.dsinv.ru - - name: S3_HOST - value: http://minio-service.minio.svc.cluster.local:9000 - - name: MEASUREMENTS_USE_MEASUREMENTS - value: '1' - - name: MEASUREMENTS_HOST - value: http://measurements-service.measurements.svc.cluster.local:8000/api - - name: SERVER_USE_DJANGO_STORAGE - value: '1' - - name: SERVER_DJANGO_URLS - value: '1' - - name: CACHE_HOST - value: redis.pm.svc.cluster.local - - name: SERVER_DONSTROI_STYLE - value: 'True' - - name: SERVER_S3_STREAM_IMPORT - value: '1' - - name: WORKFLOWS_USE - value: '1' - - name: WORKFLOWS_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: CELERY_REDIS_HOST - value: redis-service - - name: CELERY_RABBITMQ_HOST - value: rabbitmq-service.django.svc.cluster.local - - name: DJANGO_POSTGRES_HOST - value: postgres-service - - name: SERVER_KAFKA_ENABLED - value: 'True' - - name: KAFKA_TOPICS - value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' - - name: KAFKA_BOOTSTRAP_SERVERS - value: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]' - - name: KAFKA_SECURITY_PROTOCOL - value: SSL - - name: KAFKA_SASL_MECHANISM - value: SCRAM-SHA-512 - - name: KAFKA_SSL_CAFILE - value: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt - - name: DJANGO_POSTGRES_PORTS - value: '5432' - - name: ALLOWED_HOSTS - value: '*' - - name: USE_SSL_FOR_URL_SERIALIZATION - value: '0' - - name: SERVER_REPLACE_HOST - value: '1' - - name: SERVER_JWT_PROXY - value: '1' - - name: PDM_SYNC - value: '1' + values: + services: + celery: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1 + envs: + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: CC_PATH + value: + _default: /usr/local/bin/CloudCompare + - name: CC_COMPARISONS_BASE_DIR + value: + _default: /tmp + - name: AWS_S3_ENDPOINT_URL + value: + _default: http://minio-service.minio.svc.cluster.local:9000 + - name: PCVT_PATH + value: + _default: /usr/local/bin/PotreeConverter + - name: POTREE_CONVERTER_PATH + value: + _default: /usr/local/bin/PotreeConverter + - name: WORKFLOWS_BASE_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: WORKFLOWS_HOST + value: + _default: https://sarex.dsinv.ru + - name: SERVER_CACHE_ENABLED + value: + _default: "True" + - name: SERVER_API_HOST + value: + _default: https://sarex.dsinv.ru + - name: SERVER_VERIFY_SSL + value: + _default: "False" + - name: SERVER_HOST + value: + _default: https://sarex.dsinv.ru + - name: S3_HOST + value: + _default: http://minio-service.minio.svc.cluster.local:9000 + - name: MEASUREMENTS_USE_MEASUREMENTS + value: + _default: "1" + - name: MEASUREMENTS_HOST + value: + _default: http://measurements-service.measurements.svc.cluster.local:8000/api + - name: SERVER_USE_DJANGO_STORAGE + value: + _default: "1" + - name: SERVER_DJANGO_URLS + value: + _default: "1" + - name: CACHE_HOST + value: + _default: redis.pm.svc.cluster.local + - name: SERVER_DONSTROI_STYLE + value: + _default: "True" + - name: SERVER_S3_STREAM_IMPORT + value: + _default: "1" + - name: WORKFLOWS_USE + value: + _default: "1" + - name: WORKFLOWS_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: CELERY_REDIS_HOST + value: + _default: redis-service + - name: CELERY_RABBITMQ_HOST + value: + _default: rabbitmq-service.django.svc.cluster.local + - name: DJANGO_POSTGRES_HOST + value: + _default: postgres-service + - name: SERVER_KAFKA_ENABLED + value: + _default: "True" + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]' + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: SSL + - name: KAFKA_SASL_MECHANISM + value: + _default: SCRAM-SHA-512 + - name: KAFKA_SSL_CAFILE + value: + _default: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt + - name: DJANGO_POSTGRES_PORTS + value: + _default: "5432" + - name: ALLOWED_HOSTS + value: + _default: "*" + - name: USE_SSL_FOR_URL_SERIALIZATION + value: + _default: "0" + - name: SERVER_REPLACE_HOST + value: + _default: "1" + - name: SERVER_JWT_PROXY + value: + _default: "1" + - name: PDM_SYNC + value: + _default: "1" diff --git a/apps/django/dsinv/frontend.yaml b/apps/django/dsinv/frontend.yaml index 7010cc6..87764b6 100644 --- a/apps/django/dsinv/frontend.yaml +++ b/apps/django/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: django spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.15.7 + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.15.7 diff --git a/apps/django/dsinv/kustomization.yaml b/apps/django/dsinv/kustomization.yaml index cc8d355..02448fb 100644 --- a/apps/django/dsinv/kustomization.yaml +++ b/apps/django/dsinv/kustomization.yaml @@ -8,13 +8,13 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend - path: celery.yaml target: - kind: Deployment + kind: HelmRelease name: celery - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend diff --git a/apps/eav/CONFIGURATION.md b/apps/eav/CONFIGURATION.md index 804ee9b..852bdc6 100644 --- a/apps/eav/CONFIGURATION.md +++ b/apps/eav/CONFIGURATION.md @@ -22,7 +22,7 @@ | Локально (manage.py / uWSGI) | Переменные окружения процесса (`.env` нужно экспортировать вручную) | | Локально (docker-compose) | `docker-compose.yml`: блок `environment` сервиса `backend` + образ `postgres` (timescaledb-postgis) | | Kubernetes (Helm, репозиторий приложения) | `.helm/values-.yaml`: блоки `backend.deployment.envs` (обычные значения) и `backend.deployment.secrets` (из k8s-секретов через `secretKeyRef`); шаблон `templates/server.yaml`, роутинг — `templates/mesh-config.yaml` (Istio VirtualService) | -| Kubernetes (infra, Flux/Kustomize) | `infra/iac/apps/eav/base/backend-deployment.yaml`: секреты инъектируются Vault-агентом (`vault.hashicorp.com/agent-inject-*`) и экспортируются в окружение в `args`; настройки `production.py` монтируются из `django-configmap` | +| Kubernetes (infra, Flux/Kustomize) | `infra/iac/apps/eav/base/helmrelease.yaml` (universal-chart): секреты инъектируются Vault-агентом (`vault.hashicorp.com/agent-inject-*`) и экспортируются в окружение в `args`; настройки `production.py` монтируются из `django-configmap` | | CI/CD (GitLab) | `.gitlab-ci.yml`: общие шаблоны `generic/common-ci`, переменные пайплайна в `workflow.rules` | Способы запуска процессов: @@ -153,7 +153,7 @@ ## Переменные в infra-манифесте (Flux/Kustomize, `infra/iac/apps/eav`) -В отличие от Helm-чарта приложения, боевой деплой Sarex использует Vault-инъекцию (`base/backend-deployment.yaml`). Секреты рендерятся Vault-агентом в файлы `/vault/secrets/*` и экспортируются в окружение в `args` контейнера перед запуском `entrypoint.sh`: +В отличие от Helm-чарта приложения, боевой деплой Sarex использует Vault-инъекцию (`base/helmrelease.yaml`, чарт `universal-chart`). Секреты рендерятся Vault-агентом в файлы `/vault/secrets/*` и экспортируются в окружение в `args` контейнера перед запуском `entrypoint.sh`: | Переменная(ые) | Источник (Vault path) | | --- | --- | diff --git a/apps/eav/base/backend-deployment.yaml b/apps/eav/base/backend-deployment.yaml deleted file mode 100644 index 5bbbf25..0000000 --- a/apps/eav/base/backend-deployment.yaml +++ /dev/null @@ -1,117 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: eav - labels: - app: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: eav - vault.hashicorp.com/agent-inject-secret-eav-db: secrets/data/apps/eav/postgres - vault.hashicorp.com/agent-inject-template-eav-db: |- - {{- with secret "secrets/data/apps/eav/postgres" -}} - DJANGO_POSTGRES_HOST={{ index .Data.data "host" }} - DJANGO_POSTGRES_PORT={{ index .Data.data "port" }} - DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }} - DJANGO_POSTGRES_USER={{ index .Data.data "username" }} - DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-eav-s3: secrets/data/minio/apps/eav - vault.hashicorp.com/agent-inject-template-eav-s3: |- - {{- with secret "secrets/data/minio/apps/eav" -}} - YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} - YC_S3_BUCKET_NAME=eav - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-eav-jwt-private: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-eav-jwt-private: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "private_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-eav-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-eav-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: eav-vault - volumes: - - name: django-configmap - configMap: - name: django-configmap - items: - - key: production.py - path: production.py - defaultMode: 420 - - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/eav-db ] && . /vault/secrets/eav-db - [ -f /vault/secrets/eav-s3 ] && . /vault/secrets/eav-s3 - [ -f /vault/secrets/eav-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/eav-jwt-private)" - [ -f /vault/secrets/eav-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/eav-jwt-public)" - set +a - exec /server/entrypoint.sh - - ports: - - name: http - containerPort: 8000 - protocol: TCP - - env: - - name: KAFKA_ENABLED - value: "False" - - name: ASSETS_TOPIC - value: sarex - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - resources: - requests: - cpu: 25m - memory: 100Mi - - volumeMounts: - - name: django-configmap - mountPath: /server/config/settings/production.py - subPath: production.py - - livenessProbe: - tcpSocket: - port: 8000 - initialDelaySeconds: 20 - periodSeconds: 30 - timeoutSeconds: 3 - failureThreshold: 5 - - readinessProbe: - tcpSocket: - port: 8000 - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 3 - failureThreshold: 6 - - imagePullSecrets: - - name: regcred diff --git a/apps/eav/base/backend-service.yaml b/apps/eav/base/backend-service.yaml deleted file mode 100644 index d5f5ec3..0000000 --- a/apps/eav/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: eav -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/eav/base/helmrelease.yaml b/apps/eav/base/helmrelease.yaml new file mode 100644 index 0000000..229a21c --- /dev/null +++ b/apps/eav/base/helmrelease.yaml @@ -0,0 +1,176 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: eav +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: eav-vault + deployment: + enabled: true + name: + _default: backend + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/eav-db ] && . /vault/secrets/eav-db + [ -f /vault/secrets/eav-s3 ] && . /vault/secrets/eav-s3 + [ -f /vault/secrets/eav-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/eav-jwt-private)" + [ -f /vault/secrets/eav-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/eav-jwt-public)" + set +a + exec /server/entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: + _default: true + type: + _default: tcpSocket + tcpSocket: + port: + _default: 8000 + initialDelaySeconds: + _default: 20 + periodSeconds: + _default: 30 + timeoutSeconds: + _default: 3 + failureThreshold: + _default: 5 + readiness: + enabled: + _default: true + type: + _default: tcpSocket + tcpSocket: + port: + _default: 8000 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 10 + timeoutSeconds: + _default: 3 + failureThreshold: + _default: 6 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: + _default: + - name: django-configmap + mountPath: + _default: /server/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + envs: + - name: KAFKA_ENABLED + value: + _default: "False" + - name: ASSETS_TOPIC + value: + _default: sarex + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: eav + vault.hashicorp.com/agent-inject-secret-eav-db: secrets/data/apps/eav/postgres + vault.hashicorp.com/agent-inject-template-eav-db: |- + {{- with secret "secrets/data/apps/eav/postgres" -}} + DJANGO_POSTGRES_HOST={{ index .Data.data "host" }} + DJANGO_POSTGRES_PORT={{ index .Data.data "port" }} + DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }} + DJANGO_POSTGRES_USER={{ index .Data.data "username" }} + DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-eav-s3: secrets/data/minio/apps/eav + vault.hashicorp.com/agent-inject-template-eav-s3: |- + {{- with secret "secrets/data/minio/apps/eav" -}} + YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} + YC_S3_BUCKET_NAME=eav + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-eav-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-eav-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-eav-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-eav-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} diff --git a/apps/eav/base/kustomization.yaml b/apps/eav/base/kustomization.yaml index ad9cf5d..4d46352 100644 --- a/apps/eav/base/kustomization.yaml +++ b/apps/eav/base/kustomization.yaml @@ -4,7 +4,5 @@ kind: Kustomization namespace: eav resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml + - helmrelease.yaml - django-configmap.yaml diff --git a/apps/eav/base/serviceaccount.yaml b/apps/eav/base/serviceaccount.yaml deleted file mode 100644 index c2d7154..0000000 --- a/apps/eav/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: eav-vault - namespace: eav diff --git a/apps/eav/dsinv/backend.yaml b/apps/eav/dsinv/backend.yaml index ea240c3..3ab9d92 100644 --- a/apps/eav/dsinv/backend.yaml +++ b/apps/eav/dsinv/backend.yaml @@ -1,27 +1,35 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: eav spec: - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_ddce2b51 - env: - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: ASSETS_TOPIC - value: sarex - - name: KAFKA_SSL_CAFILE - value: /usr/local/share/ca-certificates/ca.crt - - name: DJANGO_POSTGRES_HOST - value: postgres-service - - name: DJANGO_POSTGRES_DATABASE - value: eav_db - - name: YC_S3_ENDPOINT_URL - value: http://minio-service.minio.svc.cluster.local:9000 - - name: YC_S3_BUCKET_NAME - value: eav + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_ddce2b51 + envs: + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: ASSETS_TOPIC + value: + _default: sarex + - name: KAFKA_SSL_CAFILE + value: + _default: /usr/local/share/ca-certificates/ca.crt + - name: DJANGO_POSTGRES_HOST + value: + _default: postgres-service + - name: DJANGO_POSTGRES_DATABASE + value: + _default: eav_db + - name: YC_S3_ENDPOINT_URL + value: + _default: http://minio-service.minio.svc.cluster.local:9000 + - name: YC_S3_BUCKET_NAME + value: + _default: eav diff --git a/apps/eav/dsinv/kustomization.yaml b/apps/eav/dsinv/kustomization.yaml index 0733885..7aa19ef 100644 --- a/apps/eav/dsinv/kustomization.yaml +++ b/apps/eav/dsinv/kustomization.yaml @@ -7,5 +7,5 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend diff --git a/apps/eav/yc-k8s-test/kustomization.yaml b/apps/eav/yc-k8s-test/kustomization.yaml index 050d882..c8f7064 100644 --- a/apps/eav/yc-k8s-test/kustomization.yaml +++ b/apps/eav/yc-k8s-test/kustomization.yaml @@ -7,5 +7,5 @@ resources: patches: - path: replicas.yaml target: - kind: Deployment + kind: HelmRelease name: backend diff --git a/apps/eav/yc-k8s-test/replicas.yaml b/apps/eav/yc-k8s-test/replicas.yaml index bc22003..bd0603a 100644 --- a/apps/eav/yc-k8s-test/replicas.yaml +++ b/apps/eav/yc-k8s-test/replicas.yaml @@ -1,8 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: eav spec: - replicas: 1 + values: + services: + backend: + deployment: + replicaCount: + _default: 1