sarex/iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

++

Browse Source
This commit is contained in:
ivan 2026-07-28 18:11:41 +05:00
parent 5c43502cba
commit 66cfb61bf2
29 changed files with 1347 additions and 1013 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

221
apps/django/base/backend-deployment.yaml
View File

@ -1,221 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: backend
namespace: django
labels:
app: backend
service: backend
spec:
replicas: 1
selector:
matchLabels:
app: backend
template:
metadata:
labels:
app: backend
service: backend
annotations:
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/auth-path: auth/kubernetes
vault.hashicorp.com/role: django
vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres
vault.hashicorp.com/agent-inject-template-django-postgresql: |-
{{- with secret "secrets/data/apps/django/postgres" -}}
DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }}
DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django
vault.hashicorp.com/agent-inject-template-django-rabbitmq: |-
{{- with secret "secrets/data/rabbitmq/apps/django" -}}
CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
CELERY_RABBITMQ_USER={{ index .Data.data "username" }}
CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local
DJANGO_RABBIT_USER={{ index .Data.data "username" }}
DJANGO_RABBIT_PASS={{ index .Data.data "password" }}
DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django
vault.hashicorp.com/agent-inject-template-django-s3: |-
{{- with secret "secrets/data/minio/apps/django" }}
AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech
S3_HOST=https://minio.contour.infra.sarex.tech
{{- $buckets := index .Data.data "buckets" }}
S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
S3_LOGIN={{ index .Data.data "access_key" }}
S3_PASSWORD={{ index .Data.data "secret_key" }}
{{- end }}
vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django
vault.hashicorp.com/agent-inject-template-django-kafka: |-
{{- with secret "secrets/data/kafka/apps/django" -}}
KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]"
KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "private_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "public_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth
vault.hashicorp.com/agent-inject-template-django-common: |-
{{- with secret "secrets/data/vault/common/django_auth" -}}
ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }}
{{- end -}}
spec:
serviceAccountName: django-vault
volumes:
- name: django-configmap
configMap:
name: django-configmap
items:
- key: production.py
path: production.py
defaultMode: 420
- name: uwsgi-configmap
configMap:
name: uwsgi-configmap
items:
- key: uwsgi.ini
path: uwsgi.ini
defaultMode: 420
containers:
- name: backend
image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0
imagePullPolicy: IfNotPresent
command: ["/bin/sh", "-ec"]
args:
- |
set -a
[ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
[ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
[ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
[ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka
[ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
[ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
set +a
exec /opt/sarex/entrypoint.sh
ports:
- name: http
containerPort: 8000
protocol: TCP
env:
- name: ALLOWED_HOSTS
value: '*'
- name: SERVER_USE_CHANGELOG
value: "0"
- name: SERVER_ZITADEL_ENABLED
value: "True"
- name: DJANGO_SETTINGS_MODULE
value: config.settings.production
- name: CELERY_REDIS_HOST
value: redis
- name: CELERY_REDIS_PORT
value: "6379"
- name: DJANGO_REDIS_HOST
value: redis
- name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
value: "True"
- name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
value: "True"
- name: DJANGO_REDIS_PORT
value: "6379"
- name: BIMV2_INTERNAL_HOST
value: http://bim-backend-v2-service.bim-api
- name: BIMV2_TIMEOUT
value: "60"
- name: JWT_KID
value: "1"
- name: PDM_SYNC
value: "1"
- name: KC_SYNC_ENABLE
value: "0"
- name: MEASUREMENTS_HOST
value: http://measurements-service.measurements.svc.cluster.local:8000/api
- name: MEASUREMENTS_USE_MEASUREMENTS
value: "1"
- name: SERVER_API_HOST
value: https://sarex.contour.infra.sarex.tech
- name: SERVER_HOST
value: https://sarex.contour.infra.sarex.tech
- name: WORKFLOWS_HOST
value: http://backend-svc.processing.svc.cluster.local:80
- name: WORKFLOWS_BASE_HOST
value: http://backend-svc.django.svc.cluster.local:80
- name: WORKFLOWS_PREFIX
value: /internal/v1
- name: WORKFLOWS_USE
value: "1"
- name: SERVER_S3_STREAM_IMPORT
value: "1"
- name: SERVER_SAVE_DIFF_DEM
value: "1"
- name: SERVER_USE_CLICKHOUSE
value: "0"
- name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
value: "0"
- name: SERVER_USE_DJANGO_STORAGE
value: "1"
- name: SERVER_USE_METASHAPE
value: "0"
- name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
value: "1"
- name: SERVER_CHANGELOG_MODE
value: "0"
- name: SERVER_DJANGO_URLS
value: "1"
- name: CHECK_IMPORT_HASH
value: "1"
- name: EAV_ENABLE
value: "1"
- name: SERVER_CHECK_IMPORT_HASH
value: "1"
- name: SERVER_CHUNKED_PATH
value: /tmp/chunked_uploads/%Y/%m/%d
- name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
value: "0"
- name: SERVER_USE_WRORKFLOW_STATUS
value: "1"
- name: ZITADEL_HOST
value: https://zitadel.contour.infra.sarex.tech
- name: SERVER_KAFKA_ENABLED
value: "False"
- name: KAFKA_TOPICS
value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
- name: KAFKA_SSL_CAFILE
value: /usr/local/share/ca-certificates/kafka.crt
- name: KC_USE_REDIRECT_LOGOUT
value: "False"
resources:
requests:
cpu: "25m"
memory: 128Mi
volumeMounts:
- name: django-configmap
mountPath: /opt/sarex/config/settings/production.py
subPath: production.py
- name: uwsgi-configmap
mountPath: /opt/sarex/uwsgi.ini
subPath: uwsgi.ini
imagePullSecrets:
- name: regcred

15
apps/django/base/backend-service.yaml
View File

@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: backend-svc
namespace: django
spec:
type: ClusterIP
selector:
app: backend
ports:
- name: http
port: 80
targetPort: 8000
protocol: TCP

312
apps/django/base/backend.yaml Normal file
View File

@ -0,0 +1,312 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: backend
namespace: django
spec:
interval: 10m
chart:
spec:
chart: universal-chart
version: "0.1.9"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
global:
env: _default
services:
backend:
enabled: true
serviceAccount:
enabled:
_default: true
name:
_default: django-vault
deployment:
enabled: true
name:
_default: backend
replicaCount:
_default: 1
port:
_default: 8000
command:
_default: ["/bin/sh", "-ec"]
args:
_default:
- |
set -a
[ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
[ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
[ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
[ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka
[ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
[ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
set +a
exec /opt/sarex/entrypoint.sh
resources:
requests:
cpu:
_default: 25m
memory:
_default: 128Mi
probes:
liveness:
enabled: false
readiness:
enabled: false
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0
pullPolicy:
_default: IfNotPresent
service:
enabled: true
name:
_default: backend-svc
type:
_default: ClusterIP
port:
_default: 80
targetPort:
_default: 8000
portName:
_default: http
imagePullSecrets:
enabled:
_default: true
name:
_default: regcred
volumes:
_default:
- name: django-configmap
mountPath:
_default: /opt/sarex/config/settings/production.py
subPath:
_default: production.py
readOnly:
_default: true
configMap:
name:
_default: django-configmap
items:
- key: production.py
path:
_default: production.py
- name: uwsgi-configmap
mountPath:
_default: /opt/sarex/uwsgi.ini
subPath:
_default: uwsgi.ini
readOnly:
_default: true
configMap:
name:
_default: uwsgi-configmap
items:
- key: uwsgi.ini
path:
_default: uwsgi.ini
envs:
- name: ALLOWED_HOSTS
value:
_default: "*"
- name: SERVER_USE_CHANGELOG
value:
_default: "0"
- name: SERVER_ZITADEL_ENABLED
value:
_default: "True"
- name: DJANGO_SETTINGS_MODULE
value:
_default: config.settings.production
- name: CELERY_REDIS_HOST
value:
_default: redis
- name: CELERY_REDIS_PORT
value:
_default: "6379"
- name: DJANGO_REDIS_HOST
value:
_default: redis
- name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
value:
_default: "True"
- name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
value:
_default: "True"
- name: DJANGO_REDIS_PORT
value:
_default: "6379"
- name: BIMV2_INTERNAL_HOST
value:
_default: http://bim-backend-v2-service.bim-api
- name: BIMV2_TIMEOUT
value:
_default: "60"
- name: JWT_KID
value:
_default: "1"
- name: PDM_SYNC
value:
_default: "1"
- name: KC_SYNC_ENABLE
value:
_default: "0"
- name: MEASUREMENTS_HOST
value:
_default: http://measurements-service.measurements.svc.cluster.local:8000/api
- name: MEASUREMENTS_USE_MEASUREMENTS
value:
_default: "1"
- name: SERVER_API_HOST
value:
_default: https://sarex.contour.infra.sarex.tech
- name: SERVER_HOST
value:
_default: https://sarex.contour.infra.sarex.tech
- name: WORKFLOWS_HOST
value:
_default: http://backend-svc.processing.svc.cluster.local:80
- name: WORKFLOWS_BASE_HOST
value:
_default: http://backend-svc.django.svc.cluster.local:80
- name: WORKFLOWS_PREFIX
value:
_default: /internal/v1
- name: WORKFLOWS_USE
value:
_default: "1"
- name: SERVER_S3_STREAM_IMPORT
value:
_default: "1"
- name: SERVER_SAVE_DIFF_DEM
value:
_default: "1"
- name: SERVER_USE_CLICKHOUSE
value:
_default: "0"
- name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
value:
_default: "0"
- name: SERVER_USE_DJANGO_STORAGE
value:
_default: "1"
- name: SERVER_USE_METASHAPE
value:
_default: "0"
- name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
value:
_default: "1"
- name: SERVER_CHANGELOG_MODE
value:
_default: "0"
- name: SERVER_DJANGO_URLS
value:
_default: "1"
- name: CHECK_IMPORT_HASH
value:
_default: "1"
- name: EAV_ENABLE
value:
_default: "1"
- name: SERVER_CHECK_IMPORT_HASH
value:
_default: "1"
- name: SERVER_CHUNKED_PATH
value:
_default: /tmp/chunked_uploads/%Y/%m/%d
- name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
value:
_default: "0"
- name: SERVER_USE_WRORKFLOW_STATUS
value:
_default: "1"
- name: ZITADEL_HOST
value:
_default: https://zitadel.contour.infra.sarex.tech
- name: SERVER_KAFKA_ENABLED
value:
_default: "False"
- name: KAFKA_TOPICS
value:
_default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
- name: KAFKA_SSL_CAFILE
value:
_default: /usr/local/share/ca-certificates/kafka.crt
- name: KC_USE_REDIRECT_LOGOUT
value:
_default: "False"
podAnnotations:
_default:
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/auth-path: auth/kubernetes
vault.hashicorp.com/role: django
vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres
vault.hashicorp.com/agent-inject-template-django-postgresql: |-
{{- with secret "secrets/data/apps/django/postgres" -}}
DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }}
DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django
vault.hashicorp.com/agent-inject-template-django-rabbitmq: |-
{{- with secret "secrets/data/rabbitmq/apps/django" -}}
CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
CELERY_RABBITMQ_USER={{ index .Data.data "username" }}
CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local
DJANGO_RABBIT_USER={{ index .Data.data "username" }}
DJANGO_RABBIT_PASS={{ index .Data.data "password" }}
DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django
vault.hashicorp.com/agent-inject-template-django-s3: |-
{{- with secret "secrets/data/minio/apps/django" }}
AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech
S3_HOST=https://minio.contour.infra.sarex.tech
{{- $buckets := index .Data.data "buckets" }}
S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
S3_LOGIN={{ index .Data.data "access_key" }}
S3_PASSWORD={{ index .Data.data "secret_key" }}
{{- end }}
vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django
vault.hashicorp.com/agent-inject-template-django-kafka: |-
{{- with secret "secrets/data/kafka/apps/django" -}}
KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]"
KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "private_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "public_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth
vault.hashicorp.com/agent-inject-template-django-common: |-
{{- with secret "secrets/data/vault/common/django_auth" -}}
ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }}
{{- end -}}

203
apps/django/base/celery-deployment.yaml
View File

@ -1,203 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: celery
namespace: django
labels:
app: celery
service: celery
spec:
replicas: 1
selector:
matchLabels:
app: celery
template:
metadata:
labels:
app: celery
service: celery
annotations:
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/auth-path: auth/kubernetes
vault.hashicorp.com/role: django
vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres
vault.hashicorp.com/agent-inject-template-django-postgresql: |-
{{- with secret "secrets/data/apps/django/postgres" -}}
DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }}
DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django
vault.hashicorp.com/agent-inject-template-django-rabbitmq: |-
{{- with secret "secrets/data/rabbitmq/apps/django" -}}
CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
CELERY_RABBITMQ_USER={{ index .Data.data "username" }}
CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local
DJANGO_RABBIT_USER={{ index .Data.data "username" }}
DJANGO_RABBIT_PASS={{ index .Data.data "password" }}
DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django
vault.hashicorp.com/agent-inject-template-django-s3: |-
{{- with secret "secrets/data/minio/apps/django" -}}
AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech
S3_HOST=https://minio.contour.infra.sarex.tech
{{- $buckets := index .Data.data "buckets" }}
S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}django{{- end -}}
S3_LOGIN={{ index .Data.data "access_key" }}
S3_PASSWORD={{ index .Data.data "secret_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django
vault.hashicorp.com/agent-inject-template-django-kafka: |-
{{- with secret "secrets/data/kafka/apps/django" -}}
KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]"
KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "private_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "public_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth
vault.hashicorp.com/agent-inject-template-django-common: |-
{{- with secret "secrets/data/vault/common/django_auth" -}}
ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }}
{{- end -}}
spec:
serviceAccountName: django-vault
volumes:
- name: django-configmap
configMap:
name: django-configmap
items:
- key: production.py
path: production.py
defaultMode: 420
containers:
- name: celery
image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0
imagePullPolicy: IfNotPresent
command: ["/bin/sh", "-ec"]
args:
- |
set -a
[ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
[ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
[ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
[ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka
[ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
[ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
set +a
exec celery -A config worker -B -l info -E -Q default -n default_worker.%h --concurrency=2
ports:
- name: http
containerPort: 8000
protocol: TCP
env:
- name: ALLOWED_HOSTS
value: '*'
- name: SERVER_USE_CHANGELOG
value: "0"
- name: SERVER_ZITADEL_ENABLED
value: "False"
- name: DJANGO_SETTINGS_MODULE
value: config.settings.production
- name: CELERY_REDIS_HOST
value: redis
- name: CELERY_REDIS_PORT
value: "6379"
- name: DJANGO_REDIS_HOST
value: redis
- name: DJANGO_REDIS_PORT
value: "6379"
- name: BIMV2_INTERNAL_HOST
value: http://bim-backend-v2-service.bim-api
- name: BIMV2_TIMEOUT
value: "60"
- name: JWT_KID
value: "1"
- name: PDM_SYNC
value: "1"
- name: KC_SYNC_ENABLE
value: "0"
- name: MEASUREMENTS_HOST
value: http://measurements-service.measurements.svc.cluster.local:8000/api
- name: MEASUREMENTS_USE_MEASUREMENTS
value: "1"
- name: SERVER_API_HOST
value: https://wb.sarex.io
- name: SERVER_HOST
value: https://wb.sarex.io
- name: WORKFLOWS_HOST
value: https://wb.sarex.io
- name: WORKFLOWS_BASE_HOST
value: https://wb.sarex.io
- name: WORKFLOWS_USE
value: "1"
- name: SERVER_S3_STREAM_IMPORT
value: "1"
- name: SERVER_SAVE_DIFF_DEM
value: "1"
- name: SERVER_USE_CLICKHOUSE
value: "0"
- name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
value: "0"
- name: SERVER_USE_DJANGO_STORAGE
value: "1"
- name: SERVER_USE_METASHAPE
value: "0"
- name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
value: "1"
- name: SERVER_CHANGELOG_MODE
value: "0"
- name: SERVER_DJANGO_URLS
value: "1"
- name: CHECK_IMPORT_HASH
value: "1"
- name: EAV_ENABLE
value: "1"
- name: SERVER_CHECK_IMPORT_HASH
value: "1"
- name: SERVER_CHUNKED_PATH
value: /tmp/chunked_uploads/%Y/%m/%d
- name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
value: "0"
- name: SERVER_USE_WRORKFLOW_STATUS
value: "1"
- name: ZITADEL_HOST
value: https://zitadel-srx.wb.ru
- name: SERVER_KAFKA_ENABLED
value: "False"
- name: KAFKA_TOPICS
value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
- name: KAFKA_SSL_CAFILE
value: /usr/local/share/ca-certificates/kafka.crt
- name: KC_USE_REDIRECT_LOGOUT
value: "False"
resources:
requests:
cpu: "25m"
memory: 128Mi
volumeMounts:
- name: django-configmap
mountPath: /opt/sarex/config/settings/production.py
subPath: production.py
imagePullSecrets:
- name: regcred

279
apps/django/base/celery.yaml Normal file
View File

@ -0,0 +1,279 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: celery
namespace: django
spec:
interval: 10m
chart:
spec:
chart: universal-chart
version: "0.1.9"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
global:
env: _default
services:
celery:
enabled: true
serviceAccount:
enabled:
_default: true
name:
_default: django-vault
deployment:
enabled: true
name:
_default: celery
replicaCount:
_default: 1
port:
_default: 8000
command:
_default: ["/bin/sh", "-ec"]
args:
_default:
- |
set -a
[ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
[ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
[ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
[ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka
[ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
[ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
set +a
exec celery -A config worker -B -l info -E -Q default -n default_worker.%h --concurrency=2
resources:
requests:
cpu:
_default: 25m
memory:
_default: 128Mi
probes:
liveness:
enabled: false
readiness:
enabled: false
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0
pullPolicy:
_default: IfNotPresent
service:
enabled: false
imagePullSecrets:
enabled:
_default: true
name:
_default: regcred
volumes:
_default:
- name: django-configmap
mountPath:
_default: /opt/sarex/config/settings/production.py
subPath:
_default: production.py
readOnly:
_default: true
configMap:
name:
_default: django-configmap
items:
- key: production.py
path:
_default: production.py
envs:
- name: ALLOWED_HOSTS
value:
_default: "*"
- name: SERVER_USE_CHANGELOG
value:
_default: "0"
- name: SERVER_ZITADEL_ENABLED
value:
_default: "False"
- name: DJANGO_SETTINGS_MODULE
value:
_default: config.settings.production
- name: CELERY_REDIS_HOST
value:
_default: redis
- name: CELERY_REDIS_PORT
value:
_default: "6379"
- name: DJANGO_REDIS_HOST
value:
_default: redis
- name: DJANGO_REDIS_PORT
value:
_default: "6379"
- name: BIMV2_INTERNAL_HOST
value:
_default: http://bim-backend-v2-service.bim-api
- name: BIMV2_TIMEOUT
value:
_default: "60"
- name: JWT_KID
value:
_default: "1"
- name: PDM_SYNC
value:
_default: "1"
- name: KC_SYNC_ENABLE
value:
_default: "0"
- name: MEASUREMENTS_HOST
value:
_default: http://measurements-service.measurements.svc.cluster.local:8000/api
- name: MEASUREMENTS_USE_MEASUREMENTS
value:
_default: "1"
- name: SERVER_API_HOST
value:
_default: https://wb.sarex.io
- name: SERVER_HOST
value:
_default: https://wb.sarex.io
- name: WORKFLOWS_HOST
value:
_default: https://wb.sarex.io
- name: WORKFLOWS_BASE_HOST
value:
_default: https://wb.sarex.io
- name: WORKFLOWS_USE
value:
_default: "1"
- name: SERVER_S3_STREAM_IMPORT
value:
_default: "1"
- name: SERVER_SAVE_DIFF_DEM
value:
_default: "1"
- name: SERVER_USE_CLICKHOUSE
value:
_default: "0"
- name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
value:
_default: "0"
- name: SERVER_USE_DJANGO_STORAGE
value:
_default: "1"
- name: SERVER_USE_METASHAPE
value:
_default: "0"
- name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
value:
_default: "1"
- name: SERVER_CHANGELOG_MODE
value:
_default: "0"
- name: SERVER_DJANGO_URLS
value:
_default: "1"
- name: CHECK_IMPORT_HASH
value:
_default: "1"
- name: EAV_ENABLE
value:
_default: "1"
- name: SERVER_CHECK_IMPORT_HASH
value:
_default: "1"
- name: SERVER_CHUNKED_PATH
value:
_default: /tmp/chunked_uploads/%Y/%m/%d
- name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
value:
_default: "0"
- name: SERVER_USE_WRORKFLOW_STATUS
value:
_default: "1"
- name: ZITADEL_HOST
value:
_default: https://zitadel-srx.wb.ru
- name: SERVER_KAFKA_ENABLED
value:
_default: "False"
- name: KAFKA_TOPICS
value:
_default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
- name: KAFKA_SSL_CAFILE
value:
_default: /usr/local/share/ca-certificates/kafka.crt
- name: KC_USE_REDIRECT_LOGOUT
value:
_default: "False"
podAnnotations:
_default:
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/auth-path: auth/kubernetes
vault.hashicorp.com/role: django
vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres
vault.hashicorp.com/agent-inject-template-django-postgresql: |-
{{- with secret "secrets/data/apps/django/postgres" -}}
DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }}
DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django
vault.hashicorp.com/agent-inject-template-django-rabbitmq: |-
{{- with secret "secrets/data/rabbitmq/apps/django" -}}
CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
CELERY_RABBITMQ_USER={{ index .Data.data "username" }}
CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local
DJANGO_RABBIT_USER={{ index .Data.data "username" }}
DJANGO_RABBIT_PASS={{ index .Data.data "password" }}
DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django
vault.hashicorp.com/agent-inject-template-django-s3: |-
{{- with secret "secrets/data/minio/apps/django" -}}
AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech
S3_HOST=https://minio.contour.infra.sarex.tech
{{- $buckets := index .Data.data "buckets" }}
S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}django{{- end -}}
S3_LOGIN={{ index .Data.data "access_key" }}
S3_PASSWORD={{ index .Data.data "secret_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django
vault.hashicorp.com/agent-inject-template-django-kafka: |-
{{- with secret "secrets/data/kafka/apps/django" -}}
KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]"
KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "private_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "public_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth
vault.hashicorp.com/agent-inject-template-django-common: |-
{{- with secret "secrets/data/vault/common/django_auth" -}}
ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }}
{{- end -}}

55
apps/django/base/frontend-deployment.yaml
View File

@ -1,55 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: frontend
namespace: django
labels:
app: frontend
spec:
replicas: 1
selector:
matchLabels:
app: frontend
template:
metadata:
labels:
app: frontend
spec:
volumes:
- name: nginx-configmap
configMap:
name: nginx-configmap
items:
- key: nginx.conf
path: nginx.conf
defaultMode: 420
# - name: zitadel-configmap
# configMap:
# name: zitadel-configmap
# items:
# - key: config.json
# path: config.json
# defaultMode: 420
containers:
- name: frontend
image: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.0
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 80
protocol: TCP
resources:
requests:
cpu: 25m
memory: 100Mi
volumeMounts:
- name: nginx-configmap
mountPath: /etc/nginx/nginx.conf
subPath: nginx.conf
# - name: zitadel-configmap
# readOnly: true
# mountPath: /opt/react_client/static/config.json
# subPath: config.json
imagePullSecrets:
- name: regcred

15
apps/django/base/frontend-service.yaml
View File

@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: frontend-svc
namespace: django
spec:
type: ClusterIP
selector:
app: frontend
ports:
- name: http
port: 80
targetPort: 80
protocol: TCP

86
apps/django/base/frontend.yaml Normal file
View File

@ -0,0 +1,86 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: frontend
namespace: django
spec:
interval: 10m
chart:
spec:
chart: universal-chart
version: "0.1.9"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
global:
env: _default
services:
frontend:
enabled: true
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.0
pullPolicy:
_default: IfNotPresent
deployment:
enabled: true
name:
_default: frontend
replicaCount:
_default: 1
port:
_default: 80
resources:
requests:
cpu:
_default: 25m
memory:
_default: 100Mi
probes:
liveness:
enabled: false
readiness:
enabled: false
service:
enabled: true
name:
_default: frontend-svc
type:
_default: ClusterIP
port:
_default: 80
targetPort:
_default: 80
portName:
_default: http
imagePullSecrets:
enabled:
_default: true
name:
_default: regcred
volumes:
_default:
- name: nginx-configmap
mountPath:
_default: /etc/nginx/nginx.conf
subPath:
_default: nginx.conf
readOnly:
_default: true
configMap:
name:
_default: nginx-configmap
items:
- key: nginx.conf
path:
_default: nginx.conf

13
apps/django/base/kustomization.yaml
View File

@ -4,17 +4,12 @@ kind: Kustomization
namespace: django
resources:
- namespace.yaml
- serviceaccount.yaml
- backend-deployment.yaml
- celery-deployment.yaml
- frontend-deployment.yaml
- backend-service.yaml
- frontend-service.yaml
- django-configmap.yaml
- srx-admin-deployment.yaml
- srx-admin-service.yaml
- nginx-configmap.yaml
- uwsgi-configmap.yaml
- zitadel-configmap.yaml
- s3-proxy-service.yaml
- backend.yaml
- celery.yaml
- frontend.yaml
- srx-admin.yaml
- s3-proxy.yaml

15
apps/django/base/s3-proxy-service.yaml
View File

@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: s3-proxy-svc
namespace: django
spec:
type: ClusterIP
selector:
app: s3-proxy
ports:
- name: http
port: 80
targetPort: 80
protocol: TCP

128
apps/django/base/s3-proxy.yaml
View File

@ -1,33 +1,92 @@
apiVersion: apps/v1
kind: Deployment
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: s3-proxy
namespace: django
labels:
app: s3-proxy
spec:
replicas: 1
selector:
matchLabels:
app: s3-proxy
template:
metadata:
labels:
app: s3-proxy
annotations:
interval: 10m
chart:
spec:
chart: universal-chart
version: "0.1.9"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
global:
env: _default
services:
s3-proxy:
enabled: true
serviceAccount:
enabled:
_default: true
name:
_default: django-vault
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:vault_6e586217
pullPolicy:
_default: Always
deployment:
enabled: true
name:
_default: s3-proxy
replicaCount:
_default: 1
port:
_default: 80
command:
_default: ["/bin/sh", "-ec"]
args:
_default:
- |
set -a
[ -f /vault/secrets/s3 ] && . /vault/secrets/s3
set +a
exec /s3-proxy
probes:
liveness:
enabled: false
readiness:
enabled: false
service:
enabled: true
name:
_default: s3-proxy-svc
type:
_default: ClusterIP
port:
_default: 80
targetPort:
_default: 80
portName:
_default: http
envs:
- name: ACCESS_LOG
value:
_default: "true"
- name: CORS_ALLOW_HEADERS
value:
_default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
podAnnotations:
_default:
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/auth-path: auth/kubernetes
vault.hashicorp.com/role: django
vault.hashicorp.com/agent-inject-secret-s3: secrets/data/minio/apps/django
vault.hashicorp.com/agent-inject-template-s3: |
{{- with secret "secrets/data/minio/apps/django" }}
AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech
@ -36,34 +95,3 @@ spec:
AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
{{- end }}
spec:
serviceAccountName: django-vault
containers:
- name: s3-proxy
image: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:vault_6e586217
imagePullPolicy: Always
command:
- /bin/sh
- -ec
args:
- |
set -a
[ -f /vault/secrets/s3 ] && . /vault/secrets/s3
set +a
exec /s3-proxy
ports:
- name: http
containerPort: 80
env:
- name: ACCESS_LOG
value: "true"
- name: CORS_ALLOW_HEADERS
value: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"

5
apps/django/base/serviceaccount.yaml
View File

@ -1,5 +0,0 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: django-vault
namespace: django

32
apps/django/base/srx-admin-deployment.yaml
View File

@ -1,32 +0,0 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: srx-admin-frontend
namespace: django
labels:
app: srx-admin-frontend
spec:
replicas: 1
selector:
matchLabels:
app: srx-admin-frontend
template:
metadata:
labels:
app: srx-admin-frontend
spec:
containers:
- name: srx-admin-frontend
image: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_3b9cb250
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 80
protocol: TCP
resources:
requests:
cpu: 25m
memory: 100Mi
imagePullSecrets:
- name: regcred

15
apps/django/base/srx-admin-service.yaml
View File

@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: srx-admin-svc
namespace: django
spec:
type: ClusterIP
selector:
app: srx-admin
ports:
- name: http
port: 80
targetPort: 80
protocol: TCP

70
apps/django/base/srx-admin.yaml Normal file
View File

@ -0,0 +1,70 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: srx-admin-frontend
namespace: django
spec:
interval: 10m
chart:
spec:
chart: universal-chart
version: "0.1.9"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
global:
env: _default
services:
srx-admin:
enabled: true
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_3b9cb250
pullPolicy:
_default: IfNotPresent
deployment:
enabled: true
name:
_default: srx-admin-frontend
replicaCount:
_default: 1
port:
_default: 80
resources:
requests:
cpu:
_default: 25m
memory:
_default: 100Mi
probes:
liveness:
enabled: false
readiness:
enabled: false
service:
enabled: true
name:
_default: srx-admin-svc
type:
_default: ClusterIP
port:
_default: 80
targetPort:
_default: 80
portName:
_default: http
imagePullSecrets:
enabled:
_default: true
name:
_default: regcred

165
apps/django/dsinv/backend.yaml
View File

@ -1,110 +1,161 @@
---
apiVersion: apps/v1
kind: Deployment
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: backend
namespace: django
spec:
replicas: 2
template:
spec:
containers:
- name: backend
image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1
env:
values:
services:
backend:
deployment:
replicaCount:
_default: 2
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1
envs:
- name: GK_ENCRYPTION_KEY
value: zfDjuszywHSbAhY8KJQbESbpUYN74XTs
value:
_default: zfDjuszywHSbAhY8KJQbESbpUYN74XTs
- name: SERVER_DONSTROI_STYLE
value: 'True'
value:
_default: "True"
- name: SERVER_API_HOST
value: https://sarex.dsinv.ru
value:
_default: https://sarex.dsinv.ru
- name: SERVER_VERIFY_SSL
value: 'False'
value:
_default: "False"
- name: SERVER_SUPERSET_HOST
value: https://bi.sarex.dsinv.ru
value:
_default: https://bi.sarex.dsinv.ru
- name: GATEWAY_HOST
value: http://pdm-api.documentations.svc.cluster.local:8080
value:
_default: http://pdm-api.documentations.svc.cluster.local:8080
- name: KC_DEFAULT_COMPANY_NAME
value: Донстрой
value:
_default: Донстрой
- name: KC_SYNC_USER_GROUPS
value: '0'
value:
_default: "0"
- name: SERVER_ZITADEL_ENABLED
value: 'False'
value:
_default: "False"
- name: KC_SYNC_USER_POSITIONS
value: '0'
value:
_default: "0"
- name: KC_SYNC_USER_DEPARTMENTS
value: '0'
value:
_default: "0"
- name: SERVER_CHANGELOG_MODE_CELERY
value: 'True'
value:
_default: "True"
- name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
value: 'True'
value:
_default: "True"
- name: DJANGO_SETTINGS_MODULE
value: config.settings.production
value:
_default: config.settings.production
- name: CC_PATH
value: /usr/local/bin/CloudCompare
value:
_default: /usr/local/bin/CloudCompare
- name: CC_COMPARISONS_BASE_DIR
value: /tmp
value:
_default: /tmp
- name: PCVT_PATH
value: /usr/local/bin/PotreeConverter
value:
_default: /usr/local/bin/PotreeConverter
- name: POTREE_CONVERTER_PATH
value: /usr/local/bin/PotreeConverter
value:
_default: /usr/local/bin/PotreeConverter
- name: WORKFLOWS_BASE_HOST
value: http://backend.django.svc.cluster.local:8000
value:
_default: http://backend.django.svc.cluster.local:8000
- name: WORKFLOWS_HOST
value: http://workflows-service.workflow.svc.cluster.local:8000
value:
_default: http://workflows-service.workflow.svc.cluster.local:8000
- name: WORKFLOWS_PREFIX
value: /api/v1
value:
_default: /api/v1
- name: SERVER_HOST
value: https://sarex.dsinv.ru
value:
_default: https://sarex.dsinv.ru
- name: S3_HOST
value: http://minio-service.minio.svc.cluster.local:9000
value:
_default: http://minio-service.minio.svc.cluster.local:9000
- name: AWS_S3_ENDPOINT_URL
value: http://minio-service.minio.svc.cluster.local:9000
value:
_default: http://minio-service.minio.svc.cluster.local:9000
- name: MEASUREMENTS_USE_MEASUREMENTS
value: '1'
value:
_default: "1"
- name: MEASUREMENTS_HOST
value: http://measurement-service.measurements.svc.cluster.local:8000/api
value:
_default: http://measurement-service.measurements.svc.cluster.local:8000/api
- name: SERVER_USE_DJANGO_STORAGE
value: '1'
value:
_default: "1"
- name: SERVER_DJANGO_URLS
value: '1'
value:
_default: "1"
- name: SERVER_S3_STREAM_IMPORT
value: '1'
value:
_default: "1"
- name: WORKFLOWS_USE
value: '1'
value:
_default: "1"
- name: SERVER_KAFKA_ENABLED
value: 'True'
value:
_default: "True"
- name: KAFKA_TOPICS
value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
value:
_default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
- name: KAFKA_BOOTSTRAP_SERVERS
value: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
value:
_default: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
- name: KAFKA_SECURITY_PROTOCOL
value: SSL
value:
_default: SSL
- name: KAFKA_SASL_MECHANISM
value: SCRAM-SHA-512
value:
_default: SCRAM-SHA-512
- name: KAFKA_SSL_CAFILE
value: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt
value:
_default: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt
- name: WORKFLOWS_REGISTRY
value: cr.yandex/crp3ccidau046kdj8g9q
value:
_default: cr.yandex/crp3ccidau046kdj8g9q
- name: DJANGO_REDIS_HOST
value: redis-service.django.svc.cluster.local
value:
_default: redis-service.django.svc.cluster.local
- name: DJANGO_RABBIT_HOSTNAME
value: rabbitmq-service.django.svc.cluster.local
value:
_default: rabbitmq-service.django.svc.cluster.local
- name: CELERY_RABBITMQ_HOST
value: rabbitmq-service.django.svc.cluster.local
value:
_default: rabbitmq-service.django.svc.cluster.local
- name: DJANGO_POSTGRES_HOST
value: postgres-service
value:
_default: postgres-service
- name: DJANGO_POSTGRES_PORTS
value: '5432'
value:
_default: "5432"
- name: ALLOWED_HOSTS
value: '*'
value:
_default: "*"
- name: USE_SSL_FOR_URL_SERIALIZATION
value: '0'
value:
_default: "0"
- name: SERVER_REPLACE_HOST
value: '1'
value:
_default: "1"
- name: SERVER_JWT_PROXY
value: '0'
value:
_default: "0"
- name: PDM_SYNC
value: '1'
value:
_default: "1"
- name: CELERY_REDIS_HOST
value: redis-service
value:
_default: redis-service

128
apps/django/dsinv/celery.yaml
View File

@ -1,87 +1,125 @@
---
apiVersion: apps/v1
kind: Deployment
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: celery
namespace: django
spec:
template:
spec:
containers:
- name: celery
image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1
env:
values:
services:
celery:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1
envs:
- name: DJANGO_SETTINGS_MODULE
value: config.settings.production
value:
_default: config.settings.production
- name: CC_PATH
value: /usr/local/bin/CloudCompare
value:
_default: /usr/local/bin/CloudCompare
- name: CC_COMPARISONS_BASE_DIR
value: /tmp
value:
_default: /tmp
- name: AWS_S3_ENDPOINT_URL
value: http://minio-service.minio.svc.cluster.local:9000
value:
_default: http://minio-service.minio.svc.cluster.local:9000
- name: PCVT_PATH
value: /usr/local/bin/PotreeConverter
value:
_default: /usr/local/bin/PotreeConverter
- name: POTREE_CONVERTER_PATH
value: /usr/local/bin/PotreeConverter
value:
_default: /usr/local/bin/PotreeConverter
- name: WORKFLOWS_BASE_HOST
value: http://backend.django.svc.cluster.local:8000
value:
_default: http://backend.django.svc.cluster.local:8000
- name: WORKFLOWS_HOST
value: https://sarex.dsinv.ru
value:
_default: https://sarex.dsinv.ru
- name: SERVER_CACHE_ENABLED
value: 'True'
value:
_default: "True"
- name: SERVER_API_HOST
value: https://sarex.dsinv.ru
value:
_default: https://sarex.dsinv.ru
- name: SERVER_VERIFY_SSL
value: 'False'
value:
_default: "False"
- name: SERVER_HOST
value: https://sarex.dsinv.ru
value:
_default: https://sarex.dsinv.ru
- name: S3_HOST
value: http://minio-service.minio.svc.cluster.local:9000
value:
_default: http://minio-service.minio.svc.cluster.local:9000
- name: MEASUREMENTS_USE_MEASUREMENTS
value: '1'
value:
_default: "1"
- name: MEASUREMENTS_HOST
value: http://measurements-service.measurements.svc.cluster.local:8000/api
value:
_default: http://measurements-service.measurements.svc.cluster.local:8000/api
- name: SERVER_USE_DJANGO_STORAGE
value: '1'
value:
_default: "1"
- name: SERVER_DJANGO_URLS
value: '1'
value:
_default: "1"
- name: CACHE_HOST
value: redis.pm.svc.cluster.local
value:
_default: redis.pm.svc.cluster.local
- name: SERVER_DONSTROI_STYLE
value: 'True'
value:
_default: "True"
- name: SERVER_S3_STREAM_IMPORT
value: '1'
value:
_default: "1"
- name: WORKFLOWS_USE
value: '1'
value:
_default: "1"
- name: WORKFLOWS_REGISTRY
value: cr.yandex/crp3ccidau046kdj8g9q
value:
_default: cr.yandex/crp3ccidau046kdj8g9q
- name: CELERY_REDIS_HOST
value: redis-service
value:
_default: redis-service
- name: CELERY_RABBITMQ_HOST
value: rabbitmq-service.django.svc.cluster.local
value:
_default: rabbitmq-service.django.svc.cluster.local
- name: DJANGO_POSTGRES_HOST
value: postgres-service
value:
_default: postgres-service
- name: SERVER_KAFKA_ENABLED
value: 'True'
value:
_default: "True"
- name: KAFKA_TOPICS
value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
value:
_default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
- name: KAFKA_BOOTSTRAP_SERVERS
value: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
value:
_default: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
- name: KAFKA_SECURITY_PROTOCOL
value: SSL
value:
_default: SSL
- name: KAFKA_SASL_MECHANISM
value: SCRAM-SHA-512
value:
_default: SCRAM-SHA-512
- name: KAFKA_SSL_CAFILE
value: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt
value:
_default: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt
- name: DJANGO_POSTGRES_PORTS
value: '5432'
value:
_default: "5432"
- name: ALLOWED_HOSTS
value: '*'
value:
_default: "*"
- name: USE_SSL_FOR_URL_SERIALIZATION
value: '0'
value:
_default: "0"
- name: SERVER_REPLACE_HOST
value: '1'
value:
_default: "1"
- name: SERVER_JWT_PROXY
value: '1'
value:
_default: "1"
- name: PDM_SYNC
value: '1'
value:
_default: "1"

15
apps/django/dsinv/frontend.yaml
View File

@ -1,12 +1,13 @@
---
apiVersion: apps/v1
kind: Deployment
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: frontend
namespace: django
spec:
template:
spec:
containers:
- name: frontend
image: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.15.7
values:
services:
frontend:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.15.7

6
apps/django/dsinv/kustomization.yaml
View File

@ -8,13 +8,13 @@ resources:
patches:
- path: backend.yaml
target:
kind: Deployment
kind: HelmRelease
name: backend
- path: celery.yaml
target:
kind: Deployment
kind: HelmRelease
name: celery
- path: frontend.yaml
target:
kind: Deployment
kind: HelmRelease
name: frontend

4
apps/eav/CONFIGURATION.md
View File

@ -22,7 +22,7 @@
| Локально (manage.py / uWSGI) | Переменные окружения процесса (`.env` нужно экспортировать вручную) |
| Локально (docker-compose) | `docker-compose.yml`: блок `environment` сервиса `backend` + образ `postgres` (timescaledb-postgis) |
| Kubernetes (Helm, репозиторий приложения) | `.helm/values-<env>.yaml`: блоки `backend.deployment.envs` (обычные значения) и `backend.deployment.secrets` (из k8s-секретов через `secretKeyRef`); шаблон `templates/server.yaml`, роутинг — `templates/mesh-config.yaml` (Istio VirtualService) |
| Kubernetes (infra, Flux/Kustomize) | `infra/iac/apps/eav/base/backend-deployment.yaml`: секреты инъектируются Vault-агентом (`vault.hashicorp.com/agent-inject-*`) и экспортируются в окружение в `args`; настройки `production.py` монтируются из `django-configmap` |
| Kubernetes (infra, Flux/Kustomize) | `infra/iac/apps/eav/base/helmrelease.yaml` (universal-chart): секреты инъектируются Vault-агентом (`vault.hashicorp.com/agent-inject-*`) и экспортируются в окружение в `args`; настройки `production.py` монтируются из `django-configmap` |
| CI/CD (GitLab) | `.gitlab-ci.yml`: общие шаблоны `generic/common-ci`, переменные пайплайна в `workflow.rules` |
Способы запуска процессов:
@ -153,7 +153,7 @@
## Переменные в infra-манифесте (Flux/Kustomize, `infra/iac/apps/eav`)
В отличие от Helm-чарта приложения, боевой деплой Sarex использует Vault-инъекцию (`base/backend-deployment.yaml`). Секреты рендерятся Vault-агентом в файлы `/vault/secrets/*` и экспортируются в окружение в `args` контейнера перед запуском `entrypoint.sh`:
В отличие от Helm-чарта приложения, боевой деплой Sarex использует Vault-инъекцию (`base/helmrelease.yaml`, чарт `universal-chart`). Секреты рендерятся Vault-агентом в файлы `/vault/secrets/*` и экспортируются в окружение в `args` контейнера перед запуском `entrypoint.sh`:
| Переменная(ые) | Источник (Vault path) |
| --- | --- |

117
apps/eav/base/backend-deployment.yaml
View File

@ -1,117 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: backend
namespace: eav
labels:
app: backend
spec:
replicas: 1
selector:
matchLabels:
app: backend
template:
metadata:
labels:
app: backend
annotations:
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/auth-path: auth/kubernetes
vault.hashicorp.com/role: eav
vault.hashicorp.com/agent-inject-secret-eav-db: secrets/data/apps/eav/postgres
vault.hashicorp.com/agent-inject-template-eav-db: |-
{{- with secret "secrets/data/apps/eav/postgres" -}}
DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
DJANGO_POSTGRES_PORT={{ index .Data.data "port" }}
DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-eav-s3: secrets/data/minio/apps/eav
vault.hashicorp.com/agent-inject-template-eav-s3: |-
{{- with secret "secrets/data/minio/apps/eav" -}}
YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
YC_S3_BUCKET_NAME=eav
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-eav-jwt-private: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-eav-jwt-private: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "private_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-eav-jwt-public: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-eav-jwt-public: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "public_key" }}
{{- end -}}
spec:
serviceAccountName: eav-vault
volumes:
- name: django-configmap
configMap:
name: django-configmap
items:
- key: production.py
path: production.py
defaultMode: 420
containers:
- name: backend
image: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247
imagePullPolicy: IfNotPresent
command: ["/bin/sh", "-ec"]
args:
- |
set -a
[ -f /vault/secrets/eav-db ] && . /vault/secrets/eav-db
[ -f /vault/secrets/eav-s3 ] && . /vault/secrets/eav-s3
[ -f /vault/secrets/eav-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/eav-jwt-private)"
[ -f /vault/secrets/eav-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/eav-jwt-public)"
set +a
exec /server/entrypoint.sh
ports:
- name: http
containerPort: 8000
protocol: TCP
env:
- name: KAFKA_ENABLED
value: "False"
- name: ASSETS_TOPIC
value: sarex
- name: DJANGO_SETTINGS_MODULE
value: config.settings.production
resources:
requests:
cpu: 25m
memory: 100Mi
volumeMounts:
- name: django-configmap
mountPath: /server/config/settings/production.py
subPath: production.py
livenessProbe:
tcpSocket:
port: 8000
initialDelaySeconds: 20
periodSeconds: 30
timeoutSeconds: 3
failureThreshold: 5
readinessProbe:
tcpSocket:
port: 8000
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 3
failureThreshold: 6
imagePullSecrets:
- name: regcred

15
apps/eav/base/backend-service.yaml
View File

@ -1,15 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: backend-svc
namespace: eav
spec:
type: ClusterIP
selector:
app: backend
ports:
- name: http
port: 80
targetPort: 8000
protocol: TCP

176
apps/eav/base/helmrelease.yaml Normal file
View File

@ -0,0 +1,176 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: backend
namespace: eav
spec:
interval: 10m
chart:
spec:
chart: universal-chart
version: "0.1.9"
sourceRef:
kind: HelmRepository
name: yc-oci-charts
namespace: flux-system
interval: 10m
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
global:
env: _default
services:
backend:
enabled: true
serviceAccount:
enabled:
_default: true
name:
_default: eav-vault
deployment:
enabled: true
name:
_default: backend
replicaCount:
_default: 1
port:
_default: 8000
command:
_default: ["/bin/sh", "-ec"]
args:
_default:
- |
set -a
[ -f /vault/secrets/eav-db ] && . /vault/secrets/eav-db
[ -f /vault/secrets/eav-s3 ] && . /vault/secrets/eav-s3
[ -f /vault/secrets/eav-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/eav-jwt-private)"
[ -f /vault/secrets/eav-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/eav-jwt-public)"
set +a
exec /server/entrypoint.sh
resources:
requests:
cpu:
_default: 25m
memory:
_default: 100Mi
probes:
liveness:
enabled:
_default: true
type:
_default: tcpSocket
tcpSocket:
port:
_default: 8000
initialDelaySeconds:
_default: 20
periodSeconds:
_default: 30
timeoutSeconds:
_default: 3
failureThreshold:
_default: 5
readiness:
enabled:
_default: true
type:
_default: tcpSocket
tcpSocket:
port:
_default: 8000
initialDelaySeconds:
_default: 10
periodSeconds:
_default: 10
timeoutSeconds:
_default: 3
failureThreshold:
_default: 6
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247
pullPolicy:
_default: IfNotPresent
service:
enabled: true
name:
_default: backend-svc
type:
_default: ClusterIP
port:
_default: 80
targetPort:
_default: 8000
portName:
_default: http
imagePullSecrets:
enabled:
_default: true
name:
_default: regcred
volumes:
_default:
- name: django-configmap
mountPath:
_default: /server/config/settings/production.py
subPath:
_default: production.py
readOnly:
_default: true
configMap:
name:
_default: django-configmap
items:
- key: production.py
path:
_default: production.py
envs:
- name: KAFKA_ENABLED
value:
_default: "False"
- name: ASSETS_TOPIC
value:
_default: sarex
- name: DJANGO_SETTINGS_MODULE
value:
_default: config.settings.production
podAnnotations:
_default:
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/auth-path: auth/kubernetes
vault.hashicorp.com/role: eav
vault.hashicorp.com/agent-inject-secret-eav-db: secrets/data/apps/eav/postgres
vault.hashicorp.com/agent-inject-template-eav-db: |-
{{- with secret "secrets/data/apps/eav/postgres" -}}
DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
DJANGO_POSTGRES_PORT={{ index .Data.data "port" }}
DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-eav-s3: secrets/data/minio/apps/eav
vault.hashicorp.com/agent-inject-template-eav-s3: |-
{{- with secret "secrets/data/minio/apps/eav" -}}
YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
YC_S3_BUCKET_NAME=eav
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-eav-jwt-private: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-eav-jwt-private: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "private_key" }}
{{- end -}}
vault.hashicorp.com/agent-inject-secret-eav-jwt-public: secrets/data/vault/common/rsa_keys
vault.hashicorp.com/agent-inject-template-eav-jwt-public: |-
{{- with secret "secrets/data/vault/common/rsa_keys" -}}
{{ index .Data.data "public_key" }}
{{- end -}}

4
apps/eav/base/kustomization.yaml
View File

@ -4,7 +4,5 @@ kind: Kustomization
namespace: eav
resources:
- namespace.yaml
- serviceaccount.yaml
- backend-deployment.yaml
- backend-service.yaml
- helmrelease.yaml
- django-configmap.yaml

5
apps/eav/base/serviceaccount.yaml
View File

@ -1,5 +0,0 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: eav-vault
namespace: eav

38
apps/eav/dsinv/backend.yaml
View File

@ -1,27 +1,35 @@
---
apiVersion: apps/v1
kind: Deployment
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: backend
namespace: eav
spec:
template:
spec:
containers:
- name: backend
image: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_ddce2b51
env:
values:
services:
backend:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_ddce2b51
envs:
- name: DJANGO_SETTINGS_MODULE
value: config.settings.production
value:
_default: config.settings.production
- name: ASSETS_TOPIC
value: sarex
value:
_default: sarex
- name: KAFKA_SSL_CAFILE
value: /usr/local/share/ca-certificates/ca.crt
value:
_default: /usr/local/share/ca-certificates/ca.crt
- name: DJANGO_POSTGRES_HOST
value: postgres-service
value:
_default: postgres-service
- name: DJANGO_POSTGRES_DATABASE
value: eav_db
value:
_default: eav_db
- name: YC_S3_ENDPOINT_URL
value: http://minio-service.minio.svc.cluster.local:9000
value:
_default: http://minio-service.minio.svc.cluster.local:9000
- name: YC_S3_BUCKET_NAME
value: eav
value:
_default: eav

2
apps/eav/dsinv/kustomization.yaml
View File

@ -7,5 +7,5 @@ resources:
patches:
- path: backend.yaml
target:
kind: Deployment
kind: HelmRelease
name: backend

2
apps/eav/yc-k8s-test/kustomization.yaml
View File

@ -7,5 +7,5 @@ resources:
patches:
- path: replicas.yaml
target:
kind: Deployment
kind: HelmRelease
name: backend

11
apps/eav/yc-k8s-test/replicas.yaml
View File

@ -1,8 +1,13 @@
---
apiVersion: apps/v1
kind: Deployment
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: backend
namespace: eav
spec:
replicas: 1
values:
services:
backend:
deployment:
replicaCount:
_default: 1