++

apps/attachments/base/kustomization.yaml

@@ -3,4 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: attachments
 resources:
+  - namespace.yaml
   - helmrelease.yaml

apps/attachments/base/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: attachments
+  labels:
+    istio-injection: enabled
+    security.deckhouse.io/pod-policy: privileged

apps/documentations/base/hasher.yaml

@@ -0,0 +1,163 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-hasher
+  namespace: documentations
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: documentations-vault
+        deployment:
+          enabled: true
+          name:
+            _default: hasher
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8080
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/documentations-hasher-rabbitmq ] && . /vault/secrets/documentations-hasher-rabbitmq
+                [ -f /vault/secrets/documentations-hasher-s3 ] && . /vault/secrets/documentations-hasher-s3
+                set +a
+                exec ./server
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: hasher-service
+          type:
+            _default: ClusterIP
+          port:
+            _default: 8080
+          targetPort:
+            _default: 8080
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: HASHER_APP__LOG_LEVEL
+            value:
+              _default: INFO
+
+          - name: HASHER_APP__NUM_WORKERS
+            value:
+              _default: "4"
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
+            value:
+              _default: hash.compute.normal.tasks
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
+            value:
+              _default: hash.compute
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
+            value:
+              _default: direct
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
+            value:
+              _default: hash.compute.normal
+
+          - name: HASHER_S3__MAX_POOL_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: HASHER_S3__CONNECT_TIMEOUT
+            value:
+              _default: "10"
+
+          - name: HASHER_S3__READ_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: HASHER_S3__REGION_NAME
+            value:
+              _default: ru-central1
+
+          - name: HASHER_S3__USE_SSL
+            value:
+              _default: "true"
+
+          - name: HASHER_S3__VERIFY
+            value:
+              _default: "true"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "4317,4318,9411,8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: documentations
+            vault.hashicorp.com/agent-inject-secret-documentations-hasher-rabbitmq: secrets/data/apps/documentations/hasher/rabbitmq
+            vault.hashicorp.com/agent-inject-template-documentations-hasher-rabbitmq: |-
+              {{- with secret "secrets/data/apps/documentations/hasher/rabbitmq" -}}
+              HASHER_AMQP__HOST={{ index .Data.data "host" }}
+              HASHER_AMQP__PORT={{ index .Data.data "port" }}
+              HASHER_AMQP__USERNAME={{ index .Data.data "username" }}
+              HASHER_AMQP__PASSWORD={{ index .Data.data "password" }}
+              HASHER_AMQP__VHOST={{ index .Data.data "vhost" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-hasher-s3: secrets/data/apps/documentations/hasher/s3
+            vault.hashicorp.com/agent-inject-template-documentations-hasher-s3: |-
+              {{- with secret "secrets/data/apps/documentations/hasher/s3" -}}
+              HASHER_S3__ENDPOINT={{ index .Data.data "endpoint" }}
+              HASHER_S3__ACCESS_KEY={{ index .Data.data "access_key" }}
+              HASHER_S3__SECRET_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/base/kustomization.yaml

@@ -8,5 +8,7 @@ resources:
   - filestream.yaml
   - frontend.yaml
   - pdm.yaml
+  - pdf-markings-amqp.yaml
+  - hasher.yaml
   - redis-deployment.yaml
   - redis-service.yaml

apps/documentations/base/pdf-markings-amqp.yaml

@@ -0,0 +1,172 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-pdf-markings-amqp
+  namespace: documentations
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: documentations-vault
+        deployment:
+          enabled: true
+          name:
+            _default: pdf-markings-amqp
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/documentations-marks-db ] && . /vault/secrets/documentations-marks-db
+                [ -f /vault/secrets/documentations-marks-rabbitmq ] && . /vault/secrets/documentations-marks-rabbitmq
+                [ -f /vault/secrets/documentations-marks-s3 ] && . /vault/secrets/documentations-marks-s3
+                set +a
+                exec ./server
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: marks-service
+          type:
+            _default: ClusterIP
+          port:
+            _default: 8000
+          targetPort:
+            _default: 8000
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: MARKS_APP__LOG_LEVEL
+            value:
+              _default: INFO
+
+          - name: MARKS_CRYPTO__HASHING_ALGO
+            value:
+              _default: md_gost12_256
+
+          - name: MARKS_QR__REDIRECT_URL
+            value:
+              _default: "https://stamp-verification.srx.wb.ru/"
+
+          - name: MARKS_QR__BASE_DOCUMENT_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: MARKS_S3__REGION
+            value:
+              _default: ru-central1
+
+          - name: MARKS_S3__USE_SSL
+            value:
+              _default: "true"
+
+          - name: MARKS_S3__SSL_VERIFY
+            value:
+              _default: "true"
+
+          - name: MARKS_S3__DEFAULT_BUCKET
+            value:
+              _default: documentations-marks
+
+          - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
+            value:
+              _default: pdf_markings_input
+
+          - name: MARKS_RABBITMQ__HOST
+            value:
+              _default: rabbitmq.rabbitmq.svc.cluster.local
+
+          - name: MARKS_RABBITMQ__PORT
+            value:
+              _default: "5672"
+
+          - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
+            value:
+              _default: "60"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "4317,4318,9411,8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: documentations
+            vault.hashicorp.com/agent-inject-secret-documentations-marks-db: secrets/data/apps/documentations/postgres
+            vault.hashicorp.com/agent-inject-template-documentations-marks-db: |-
+              {{- with secret "secrets/data/apps/documentations/postgres" -}}
+              MARKS_DOCUMENTS_DB__HOST={{ index .Data.data "host" }}
+              MARKS_DOCUMENTS_DB__PORT={{ index .Data.data "port" }}
+              MARKS_DOCUMENTS_DB__DATABASE={{ index .Data.data "database" }}
+              MARKS_DOCUMENTS_DB__USERNAME={{ index .Data.data "username" }}
+              MARKS_DOCUMENTS_DB__PASSWORD={{ index .Data.data "password" }}
+              MARKS_DOCUMENTS_DB__SSLMODE=disable
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-marks-rabbitmq: secrets/data/rabbitmq/apps/documentations
+            vault.hashicorp.com/agent-inject-template-documentations-marks-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/documentations" -}}
+              MARKS_RABBITMQ__USERNAME={{ index .Data.data "username" }}
+              MARKS_RABBITMQ__PASSWORD={{ index .Data.data "password" }}
+              MARKS_RABBITMQ__VHOST={{ index .Data.data "vhost" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-marks-s3: secrets/data/apps/documentations/marks-s3
+            vault.hashicorp.com/agent-inject-template-documentations-marks-s3: |-
+              {{- with secret "secrets/data/apps/documentations/marks-s3" -}}
+              MARKS_S3__URL={{ index .Data.data "endpoint_url" }}
+              MARKS_S3__ACCESS_KEY={{ index .Data.data "access_key" }}
+              MARKS_S3__SECRET_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""