diff --git a/apps/attachments/base/kustomization.yaml b/apps/attachments/base/kustomization.yaml index c9ccb75..9cb4143 100644 --- a/apps/attachments/base/kustomization.yaml +++ b/apps/attachments/base/kustomization.yaml @@ -3,4 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: attachments resources: + - namespace.yaml - helmrelease.yaml diff --git a/apps/attachments/base/namespace.yaml b/apps/attachments/base/namespace.yaml new file mode 100644 index 0000000..f58896f --- /dev/null +++ b/apps/attachments/base/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: attachments + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/documentations/base/hasher.yaml b/apps/documentations/base/hasher.yaml new file mode 100644 index 0000000..dff8e51 --- /dev/null +++ b/apps/documentations/base/hasher.yaml @@ -0,0 +1,163 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-hasher + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: documentations-vault + deployment: + enabled: true + name: + _default: hasher + replicaCount: + _default: 1 + port: + _default: 8080 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/documentations-hasher-rabbitmq ] && . /vault/secrets/documentations-hasher-rabbitmq + [ -f /vault/secrets/documentations-hasher-s3 ] && . /vault/secrets/documentations-hasher-s3 + set +a + exec ./server + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: hasher-service + type: + _default: ClusterIP + port: + _default: 8080 + targetPort: + _default: 8080 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: HASHER_APP__LOG_LEVEL + value: + _default: INFO + + - name: HASHER_APP__NUM_WORKERS + value: + _default: "4" + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE + value: + _default: hash.compute.normal.tasks + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE + value: + _default: hash.compute + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE + value: + _default: direct + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY + value: + _default: hash.compute.normal + + - name: HASHER_S3__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: HASHER_S3__CONNECT_TIMEOUT + value: + _default: "10" + + - name: HASHER_S3__READ_TIMEOUT + value: + _default: "30" + + - name: HASHER_S3__REGION_NAME + value: + _default: ru-central1 + + - name: HASHER_S3__USE_SSL + value: + _default: "true" + + - name: HASHER_S3__VERIFY + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "4317,4318,9411,8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-documentations-hasher-rabbitmq: secrets/data/apps/documentations/hasher/rabbitmq + vault.hashicorp.com/agent-inject-template-documentations-hasher-rabbitmq: |- + {{- with secret "secrets/data/apps/documentations/hasher/rabbitmq" -}} + HASHER_AMQP__HOST={{ index .Data.data "host" }} + HASHER_AMQP__PORT={{ index .Data.data "port" }} + HASHER_AMQP__USERNAME={{ index .Data.data "username" }} + HASHER_AMQP__PASSWORD={{ index .Data.data "password" }} + HASHER_AMQP__VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-hasher-s3: secrets/data/apps/documentations/hasher/s3 + vault.hashicorp.com/agent-inject-template-documentations-hasher-s3: |- + {{- with secret "secrets/data/apps/documentations/hasher/s3" -}} + HASHER_S3__ENDPOINT={{ index .Data.data "endpoint" }} + HASHER_S3__ACCESS_KEY={{ index .Data.data "access_key" }} + HASHER_S3__SECRET_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/base/kustomization.yaml b/apps/documentations/base/kustomization.yaml index d15ef61..a9e034f 100644 --- a/apps/documentations/base/kustomization.yaml +++ b/apps/documentations/base/kustomization.yaml @@ -8,5 +8,7 @@ resources: - filestream.yaml - frontend.yaml - pdm.yaml + - pdf-markings-amqp.yaml + - hasher.yaml - redis-deployment.yaml - redis-service.yaml diff --git a/apps/documentations/base/pdf-markings-amqp.yaml b/apps/documentations/base/pdf-markings-amqp.yaml new file mode 100644 index 0000000..772dee2 --- /dev/null +++ b/apps/documentations/base/pdf-markings-amqp.yaml @@ -0,0 +1,172 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-pdf-markings-amqp + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: documentations-vault + deployment: + enabled: true + name: + _default: pdf-markings-amqp + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/documentations-marks-db ] && . /vault/secrets/documentations-marks-db + [ -f /vault/secrets/documentations-marks-rabbitmq ] && . /vault/secrets/documentations-marks-rabbitmq + [ -f /vault/secrets/documentations-marks-s3 ] && . /vault/secrets/documentations-marks-s3 + set +a + exec ./server + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: marks-service + type: + _default: ClusterIP + port: + _default: 8000 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: MARKS_APP__LOG_LEVEL + value: + _default: INFO + + - name: MARKS_CRYPTO__HASHING_ALGO + value: + _default: md_gost12_256 + + - name: MARKS_QR__REDIRECT_URL + value: + _default: "https://stamp-verification.srx.wb.ru/" + + - name: MARKS_QR__BASE_DOCUMENT_URL + value: + _default: "https://srx.wb.ru" + + - name: MARKS_S3__REGION + value: + _default: ru-central1 + + - name: MARKS_S3__USE_SSL + value: + _default: "true" + + - name: MARKS_S3__SSL_VERIFY + value: + _default: "true" + + - name: MARKS_S3__DEFAULT_BUCKET + value: + _default: documentations-marks + + - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE + value: + _default: pdf_markings_input + + - name: MARKS_RABBITMQ__HOST + value: + _default: rabbitmq.rabbitmq.svc.cluster.local + + - name: MARKS_RABBITMQ__PORT + value: + _default: "5672" + + - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS + value: + _default: "60" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "4317,4318,9411,8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-documentations-marks-db: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-documentations-marks-db: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + MARKS_DOCUMENTS_DB__HOST={{ index .Data.data "host" }} + MARKS_DOCUMENTS_DB__PORT={{ index .Data.data "port" }} + MARKS_DOCUMENTS_DB__DATABASE={{ index .Data.data "database" }} + MARKS_DOCUMENTS_DB__USERNAME={{ index .Data.data "username" }} + MARKS_DOCUMENTS_DB__PASSWORD={{ index .Data.data "password" }} + MARKS_DOCUMENTS_DB__SSLMODE=disable + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-marks-rabbitmq: secrets/data/rabbitmq/apps/documentations + vault.hashicorp.com/agent-inject-template-documentations-marks-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/documentations" -}} + MARKS_RABBITMQ__USERNAME={{ index .Data.data "username" }} + MARKS_RABBITMQ__PASSWORD={{ index .Data.data "password" }} + MARKS_RABBITMQ__VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-marks-s3: secrets/data/apps/documentations/marks-s3 + vault.hashicorp.com/agent-inject-template-documentations-marks-s3: |- + {{- with secret "secrets/data/apps/documentations/marks-s3" -}} + MARKS_S3__URL={{ index .Data.data "endpoint_url" }} + MARKS_S3__ACCESS_KEY={{ index .Data.data "access_key" }} + MARKS_S3__SECRET_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: ""