From 90e684d0a9bbc4f4b7cafb453c79177477f8a77f Mon Sep 17 00:00:00 2001 From: ivan Date: Tue, 6 Oct 2026 21:59:43 +0500 Subject: [PATCH] uralkal: take Kafka CA from the kafka-kafka-contour-tls secret flows, issues, pm and message-hub read ca.crt from a copy of the Kafka TLS secret in their own namespace instead of an inline PEM (flows) or a per-namespace kafka-ca-cert ConfigMap (issues, pm, message-hub). Mount paths and env names are unchanged. The secret must exist in each namespace before the pods restart. --- apps/flows/uralkal/backend.yaml | 25 +++------------ apps/flows/uralkal/celery.yaml | 32 +++---------------- apps/issues/uralkal/backend-s3.yaml | 8 ++--- apps/issues/uralkal/celery-s3.yaml | 8 ++--- apps/issues/uralkal/kafka-ca-configmap.yaml | 27 ---------------- apps/issues/uralkal/kustomization.yaml | 1 - .../uralkal/kafka-ca-configmap.yaml | 27 ---------------- apps/message-hub/uralkal/kustomization.yaml | 1 - apps/message-hub/uralkal/message-hub.yaml | 8 ++--- apps/pm/uralkal/backend.yaml | 8 ++--- apps/pm/uralkal/celery.yaml | 8 ++--- apps/pm/uralkal/kafka-ca-configmap.yaml | 27 ---------------- apps/pm/uralkal/kustomization.yaml | 1 - 13 files changed, 28 insertions(+), 153 deletions(-) delete mode 100644 apps/issues/uralkal/kafka-ca-configmap.yaml delete mode 100644 apps/message-hub/uralkal/kafka-ca-configmap.yaml delete mode 100644 apps/pm/uralkal/kafka-ca-configmap.yaml diff --git a/apps/flows/uralkal/backend.yaml b/apps/flows/uralkal/backend.yaml index f959017..35f0313 100644 --- a/apps/flows/uralkal/backend.yaml +++ b/apps/flows/uralkal/backend.yaml @@ -139,28 +139,11 @@ spec: value: _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + secretEnvs: - name: KAFKA_SSL_CERT - value: - _default: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- + secretName: + _default: kafka-kafka-contour-tls + secretKey: "ca.crt" podAnnotations: _default: diff --git a/apps/flows/uralkal/celery.yaml b/apps/flows/uralkal/celery.yaml index 99300df..3cca934 100644 --- a/apps/flows/uralkal/celery.yaml +++ b/apps/flows/uralkal/celery.yaml @@ -1,11 +1,4 @@ --- -# Патч celery для контура УГМК — подключение к Kafka. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml. -# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka. -# podAnnotations — map, мержится по ключам, поэтому переопределён только -# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -140,28 +133,11 @@ spec: value: _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + secretEnvs: - name: KAFKA_SSL_CERT - value: - _default: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- + secretName: + _default: kafka-kafka-contour-tls + secretKey: "ca.crt" podAnnotations: _default: diff --git a/apps/issues/uralkal/backend-s3.yaml b/apps/issues/uralkal/backend-s3.yaml index a84b217..0bf8a3c 100644 --- a/apps/issues/uralkal/backend-s3.yaml +++ b/apps/issues/uralkal/backend-s3.yaml @@ -49,11 +49,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/issues/uralkal/celery-s3.yaml b/apps/issues/uralkal/celery-s3.yaml index 57dd8c2..5c0e3f8 100644 --- a/apps/issues/uralkal/celery-s3.yaml +++ b/apps/issues/uralkal/celery-s3.yaml @@ -49,11 +49,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/issues/uralkal/kafka-ca-configmap.yaml b/apps/issues/uralkal/kafka-ca-configmap.yaml deleted file mode 100644 index dc16987..0000000 --- a/apps/issues/uralkal/kafka-ca-configmap.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: kafka-ca-cert - namespace: issues -data: - kafka.crt: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- diff --git a/apps/issues/uralkal/kustomization.yaml b/apps/issues/uralkal/kustomization.yaml index 88e7b00..0e24432 100644 --- a/apps/issues/uralkal/kustomization.yaml +++ b/apps/issues/uralkal/kustomization.yaml @@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base - - kafka-ca-configmap.yaml patches: - path: backend-s3.yaml target: diff --git a/apps/message-hub/uralkal/kafka-ca-configmap.yaml b/apps/message-hub/uralkal/kafka-ca-configmap.yaml deleted file mode 100644 index 9d0f768..0000000 --- a/apps/message-hub/uralkal/kafka-ca-configmap.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: kafka-ca-cert - namespace: message-hub -data: - kafka.crt: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- diff --git a/apps/message-hub/uralkal/kustomization.yaml b/apps/message-hub/uralkal/kustomization.yaml index 9bbf73e..aee71ac 100644 --- a/apps/message-hub/uralkal/kustomization.yaml +++ b/apps/message-hub/uralkal/kustomization.yaml @@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base - - kafka-ca-configmap.yaml patches: - path: message-hub.yaml target: diff --git a/apps/message-hub/uralkal/message-hub.yaml b/apps/message-hub/uralkal/message-hub.yaml index 32432e0..8087a85 100644 --- a/apps/message-hub/uralkal/message-hub.yaml +++ b/apps/message-hub/uralkal/message-hub.yaml @@ -91,11 +91,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/pm/uralkal/backend.yaml b/apps/pm/uralkal/backend.yaml index acf6698..22c108f 100644 --- a/apps/pm/uralkal/backend.yaml +++ b/apps/pm/uralkal/backend.yaml @@ -182,11 +182,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/pm/uralkal/celery.yaml b/apps/pm/uralkal/celery.yaml index 664fb17..17df2cf 100644 --- a/apps/pm/uralkal/celery.yaml +++ b/apps/pm/uralkal/celery.yaml @@ -191,11 +191,11 @@ spec: _default: kafka.crt readOnly: _default: true - configMap: - name: - _default: kafka-ca-cert + secret: + secretName: + _default: kafka-kafka-contour-tls items: - - key: kafka.crt + - key: ca.crt path: _default: kafka.crt diff --git a/apps/pm/uralkal/kafka-ca-configmap.yaml b/apps/pm/uralkal/kafka-ca-configmap.yaml deleted file mode 100644 index 8b919b1..0000000 --- a/apps/pm/uralkal/kafka-ca-configmap.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: kafka-ca-cert - namespace: pm -data: - kafka.crt: | - -----BEGIN CERTIFICATE----- - MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT - MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 - MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A - MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC - tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN - h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 - k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX - GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc - zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC - AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB - Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA - A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 - vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS - OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU - fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz - ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i - 0FC16VuidLG0HUCCawFjRiAg9rIA - -----END CERTIFICATE----- diff --git a/apps/pm/uralkal/kustomization.yaml b/apps/pm/uralkal/kustomization.yaml index cc8d769..392a5ce 100644 --- a/apps/pm/uralkal/kustomization.yaml +++ b/apps/pm/uralkal/kustomization.yaml @@ -3,7 +3,6 @@ kind: Kustomization resources: - ../base - redis.yaml - - kafka-ca-configmap.yaml patches: - path: backend.yaml target: