diff --git a/apps/checklists/d8-ugmk-prod/kustomization.yaml b/apps/checklists/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..2833d77 --- /dev/null +++ b/apps/checklists/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: checklists +resources: + - ../base \ No newline at end of file diff --git a/apps/contracts/base/deployment.yaml b/apps/contracts/base/deployment.yaml deleted file mode 100644 index d536b18..0000000 --- a/apps/contracts/base/deployment.yaml +++ /dev/null @@ -1,89 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: contracts - labels: - app: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: contracts - vault.hashicorp.com/agent-inject-secret-contracts-db: secrets/data/postgresql/apps/contracts - vault.hashicorp.com/agent-inject-template-contracts-db: |- - {{- with secret "secrets/data/postgresql/apps/contracts" -}} - DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@postgresql.contracts.svc.cluster.local:5432/contracts_db?sslmode=disable - {{- end -}} - vault.hashicorp.com/agent-inject-secret-contracts-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-contracts-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-contracts-rabbitmq: secrets/data/rabbitmq/apps/contracts - vault.hashicorp.com/agent-inject-template-contracts-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/contracts" -}} - CONTRACTS_RABBITMQ_VHOST={{ index .Data.data "vhost" }} - CONTRACTS_RABBITMQ_USERNAME={{ index .Data.data "username" }} - CONTRACTS_RABBITMQ_PASSWORD={{ index .Data.data "password" }} - CONTRACTS_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - CONTRACTS_RABBITMQ_PORT=5672 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-contracts-s3: secrets/data/minio/apps/contracts - vault.hashicorp.com/agent-inject-template-contracts-s3: |- - {{- with secret "secrets/data/minio/apps/contracts" -}} - CONTRACTS_S3_ENDPOINT={{ index .Data.data.client "endpoint" }} - CONTRACTS_S3_REGION={{ index .Data.data.client "region" }} - CONTRACTS_S3_BUCKET=contracts - CONTRACTS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - CONTRACTS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-contracts-kafka: secrets/data/kafka/apps/contracts - vault.hashicorp.com/agent-inject-template-contracts-kafka: |- - {{- with secret "secrets/data/kafka/apps/contracts" -}} - CONTRACTS_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }} - CONTRACTS_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} - CONTRACTS_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} - CONTRACTS_KAFKA_USERNAME={{ index .Data.data "username" }} - CONTRACTS_KAFKA_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - spec: - serviceAccountName: contracts-vault - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/contracts-db ] && . /vault/secrets/contracts-db - [ -f /vault/secrets/contracts-jwt-public ] && export PUBLIC_KEY="$(cat /vault/secrets/contracts-jwt-public)" - [ -f /vault/secrets/contracts-rabbitmq ] && . /vault/secrets/contracts-rabbitmq - [ -f /vault/secrets/contracts-s3 ] && . /vault/secrets/contracts-s3 - [ -f /vault/secrets/contracts-kafka ] && . /vault/secrets/contracts-kafka - set +a - exec /usr/local/bin/http - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: ADDRESS - value: ":8000" - - name: ENABLE_SSL - value: "false" - imagePullSecrets: - - name: regcred diff --git a/apps/contracts/base/helmrelease.yaml b/apps/contracts/base/helmrelease.yaml new file mode 100644 index 0000000..4cb4942 --- /dev/null +++ b/apps/contracts/base/helmrelease.yaml @@ -0,0 +1,129 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: contracts + namespace: contracts +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + contracts: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: contracts-vault + deployment: + enabled: true + name: + _default: backend + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/contracts-db ] && . /vault/secrets/contracts-db + [ -f /vault/secrets/contracts-jwt-public ] && export PUBLIC_KEY="$(cat /vault/secrets/contracts-jwt-public)" + [ -f /vault/secrets/contracts-rabbitmq ] && . /vault/secrets/contracts-rabbitmq + [ -f /vault/secrets/contracts-s3 ] && . /vault/secrets/contracts-s3 + [ -f /vault/secrets/contracts-kafka ] && . /vault/secrets/contracts-kafka + set +a + exec /usr/local/bin/http + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-service + type: + _default: ClusterIP + port: + _default: 8000 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: ADDRESS + value: + _default: ":8000" + - name: ENABLE_SSL + value: + _default: "false" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: contracts + vault.hashicorp.com/agent-inject-secret-contracts-db: secrets/data/postgresql/apps/contracts + vault.hashicorp.com/agent-inject-template-contracts-db: |- + {{- with secret "secrets/data/postgresql/apps/contracts" -}} + DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@postgresql.contracts.svc.cluster.local:5432/contracts_db?sslmode=disable + {{- end -}} + vault.hashicorp.com/agent-inject-secret-contracts-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-contracts-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-contracts-rabbitmq: secrets/data/rabbitmq/apps/contracts + vault.hashicorp.com/agent-inject-template-contracts-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/contracts" -}} + CONTRACTS_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + CONTRACTS_RABBITMQ_USERNAME={{ index .Data.data "username" }} + CONTRACTS_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + CONTRACTS_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + CONTRACTS_RABBITMQ_PORT=5672 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-contracts-s3: secrets/data/minio/apps/contracts + vault.hashicorp.com/agent-inject-template-contracts-s3: |- + {{- with secret "secrets/data/minio/apps/contracts" -}} + CONTRACTS_S3_ENDPOINT={{ index .Data.data.client "endpoint" }} + CONTRACTS_S3_REGION={{ index .Data.data.client "region" }} + CONTRACTS_S3_BUCKET=contracts + CONTRACTS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + CONTRACTS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-contracts-kafka: secrets/data/kafka/apps/contracts + vault.hashicorp.com/agent-inject-template-contracts-kafka: |- + {{- with secret "secrets/data/kafka/apps/contracts" -}} + CONTRACTS_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }} + CONTRACTS_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + CONTRACTS_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + CONTRACTS_KAFKA_USERNAME={{ index .Data.data "username" }} + CONTRACTS_KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/contracts/base/kustomization.yaml b/apps/contracts/base/kustomization.yaml index b7edf4a..b3cd342 100644 --- a/apps/contracts/base/kustomization.yaml +++ b/apps/contracts/base/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization namespace: contracts resources: - namespace.yaml - - serviceaccount.yaml - - deployment.yaml - - service.yaml + - helmrelease.yaml diff --git a/apps/contracts/base/service.yaml b/apps/contracts/base/service.yaml deleted file mode 100644 index d378151..0000000 --- a/apps/contracts/base/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-service - namespace: contracts -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 8000 - targetPort: 8000 - protocol: TCP diff --git a/apps/contracts/base/serviceaccount.yaml b/apps/contracts/base/serviceaccount.yaml deleted file mode 100644 index a38e7c3..0000000 --- a/apps/contracts/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: contracts-vault - namespace: contracts diff --git a/apps/contracts/d8-ugmk-prod/kustomization.yaml b/apps/contracts/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..4aee37a --- /dev/null +++ b/apps/contracts/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: contracts +resources: + - ../base \ No newline at end of file diff --git a/clusters/d8-ugmk-prod/kustomization.yaml b/clusters/d8-ugmk-prod/kustomization.yaml index 7b32f50..6163b0c 100644 --- a/clusters/d8-ugmk-prod/kustomization.yaml +++ b/clusters/d8-ugmk-prod/kustomization.yaml @@ -28,4 +28,5 @@ resources: - ../../apps/eav/d8-ugmk-prod - ../../apps/django/d8-ugmk-prod - ../../apps/documentations/d8-ugmk-prod - - ../../apps/checklists/d8-ugmk-prod \ No newline at end of file + - ../../apps/checklists/d8-ugmk-prod + - ../../apps/contracts/d8-ugmk-prod \ No newline at end of file