diff --git a/.gitignore b/.gitignore index 39128b2..3f8bd36 100644 --- a/.gitignore +++ b/.gitignore @@ -4,10 +4,5 @@ CLAUDE.md .env tmp +.tmp/ snapshots/* -k3s/* -k3s-master/* - -# самоподписанные TLS-сертификаты -nginx/certs/*.crt -nginx/certs/*.key \ No newline at end of file diff --git a/apps/checklists/base/backend-deployment.yaml b/apps/checklists/base/backend-deployment.yaml deleted file mode 100644 index ec0dfa9..0000000 --- a/apps/checklists/base/backend-deployment.yaml +++ /dev/null @@ -1,80 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: checklists-backend - namespace: checklists - labels: - app: checklists-backend - service: api -spec: - replicas: 1 - selector: - matchLabels: - app: checklists-backend - template: - metadata: - labels: - app: checklists-backend - service: checklists-backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: checklists - vault.hashicorp.com/agent-inject-secret-checklists-db: secrets/data/postgresql/apps/checklists - vault.hashicorp.com/agent-inject-template-checklists-db: |- - {{- with secret "secrets/data/postgresql/apps/checklists" -}} - DATABASE_HOST=postgresql.checklists.svc.cluster.local - DATABASE_PORT=5432 - DATABASE_NAME=checklists_db - DATABASE_USER={{ index .Data.data "username" }} - DATABASE_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-checklists-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-checklists-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: checklists-vault - containers: - - name: api - image: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/checklists-db ] && . /vault/secrets/checklists-db - [ -f /vault/secrets/checklists-jwt-public ] && export JWT_AUTH_PUBLIC_KEY="$(cat /vault/secrets/checklists-jwt-public)" - set +a - exec ./entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: HTTP_APP_HOST - value: 0.0.0.0 - - name: HTTP_APP_PORT - value: "8000" - - name: HTTP_APP_ROOT_PATH - value: /checklists - - name: HTTP_APP_WORKERS - value: "1" - - name: HTTP_APP_ADMIN_ENABLE - value: "true" - - name: JWT_AUTH_ENABLE - value: "true" - - name: DEBUG - value: "false" - - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/checklists/base/backend-service.yaml b/apps/checklists/base/backend-service.yaml deleted file mode 100644 index fe681ef..0000000 --- a/apps/checklists/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: rfi-backend-api-svc - namespace: checklists -spec: - type: ClusterIP - selector: - app: checklists-backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/checklists/base/helmrelease.yaml b/apps/checklists/base/helmrelease.yaml new file mode 100644 index 0000000..f4fb2cd --- /dev/null +++ b/apps/checklists/base/helmrelease.yaml @@ -0,0 +1,124 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: checklists + namespace: checklists +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + checklists: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: checklists-vault + deployment: + enabled: true + name: + _default: checklists-backend + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/checklists-db ] && . /vault/secrets/checklists-db + [ -f /vault/secrets/checklists-jwt-public ] && export JWT_AUTH_PUBLIC_KEY="$(cat /vault/secrets/checklists-jwt-public)" + set +a + exec ./entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: rfi-backend-api-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: HTTP_APP_HOST + value: + _default: "0.0.0.0" + - name: HTTP_APP_PORT + value: + _default: "8000" + - name: HTTP_APP_ROOT_PATH + value: + _default: /checklists + - name: HTTP_APP_WORKERS + value: + _default: "1" + - name: HTTP_APP_ADMIN_ENABLE + value: + _default: "true" + - name: JWT_AUTH_ENABLE + value: + _default: "true" + - name: DEBUG + value: + _default: "false" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: checklists + vault.hashicorp.com/agent-inject-secret-checklists-db: secrets/data/apps/checklists/postgres + vault.hashicorp.com/agent-inject-template-checklists-db: |- + {{- with secret "secrets/data/apps/checklists/postgres" -}} + DATABASE_HOST={{ index .Data.data "host" }} + DATABASE_PORT={{ index .Data.data "port" }} + DATABASE_NAME={{ index .Data.data "database" }} + DATABASE_USER={{ index .Data.data "username" }} + DATABASE_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-checklists-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-checklists-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} diff --git a/apps/checklists/base/kustomization.yaml b/apps/checklists/base/kustomization.yaml index c3f2f24..a88ddc2 100644 --- a/apps/checklists/base/kustomization.yaml +++ b/apps/checklists/base/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization namespace: checklists resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml + - helmrelease.yaml diff --git a/apps/checklists/base/namespace.yaml b/apps/checklists/base/namespace.yaml index 0ec7137..ec18309 100644 --- a/apps/checklists/base/namespace.yaml +++ b/apps/checklists/base/namespace.yaml @@ -5,3 +5,4 @@ metadata: name: checklists labels: istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/checklists/base/serviceaccount.yaml b/apps/checklists/base/serviceaccount.yaml deleted file mode 100644 index b9b74e1..0000000 --- a/apps/checklists/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: checklists-vault - namespace: checklists diff --git a/apps/checklists/d8-ugmk-prod/kustomization.yaml b/apps/checklists/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..2833d77 --- /dev/null +++ b/apps/checklists/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: checklists +resources: + - ../base \ No newline at end of file diff --git a/apps/contracts/base/deployment.yaml b/apps/contracts/base/deployment.yaml deleted file mode 100644 index d536b18..0000000 --- a/apps/contracts/base/deployment.yaml +++ /dev/null @@ -1,89 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: contracts - labels: - app: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: contracts - vault.hashicorp.com/agent-inject-secret-contracts-db: secrets/data/postgresql/apps/contracts - vault.hashicorp.com/agent-inject-template-contracts-db: |- - {{- with secret "secrets/data/postgresql/apps/contracts" -}} - DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@postgresql.contracts.svc.cluster.local:5432/contracts_db?sslmode=disable - {{- end -}} - vault.hashicorp.com/agent-inject-secret-contracts-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-contracts-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-contracts-rabbitmq: secrets/data/rabbitmq/apps/contracts - vault.hashicorp.com/agent-inject-template-contracts-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/contracts" -}} - CONTRACTS_RABBITMQ_VHOST={{ index .Data.data "vhost" }} - CONTRACTS_RABBITMQ_USERNAME={{ index .Data.data "username" }} - CONTRACTS_RABBITMQ_PASSWORD={{ index .Data.data "password" }} - CONTRACTS_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - CONTRACTS_RABBITMQ_PORT=5672 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-contracts-s3: secrets/data/minio/apps/contracts - vault.hashicorp.com/agent-inject-template-contracts-s3: |- - {{- with secret "secrets/data/minio/apps/contracts" -}} - CONTRACTS_S3_ENDPOINT={{ index .Data.data.client "endpoint" }} - CONTRACTS_S3_REGION={{ index .Data.data.client "region" }} - CONTRACTS_S3_BUCKET=contracts - CONTRACTS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - CONTRACTS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-contracts-kafka: secrets/data/kafka/apps/contracts - vault.hashicorp.com/agent-inject-template-contracts-kafka: |- - {{- with secret "secrets/data/kafka/apps/contracts" -}} - CONTRACTS_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }} - CONTRACTS_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} - CONTRACTS_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} - CONTRACTS_KAFKA_USERNAME={{ index .Data.data "username" }} - CONTRACTS_KAFKA_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - spec: - serviceAccountName: contracts-vault - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/contracts-db ] && . /vault/secrets/contracts-db - [ -f /vault/secrets/contracts-jwt-public ] && export PUBLIC_KEY="$(cat /vault/secrets/contracts-jwt-public)" - [ -f /vault/secrets/contracts-rabbitmq ] && . /vault/secrets/contracts-rabbitmq - [ -f /vault/secrets/contracts-s3 ] && . /vault/secrets/contracts-s3 - [ -f /vault/secrets/contracts-kafka ] && . /vault/secrets/contracts-kafka - set +a - exec /usr/local/bin/http - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: ADDRESS - value: ":8000" - - name: ENABLE_SSL - value: "false" - imagePullSecrets: - - name: regcred diff --git a/apps/contracts/base/helmrelease.yaml b/apps/contracts/base/helmrelease.yaml new file mode 100644 index 0000000..4cb4942 --- /dev/null +++ b/apps/contracts/base/helmrelease.yaml @@ -0,0 +1,129 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: contracts + namespace: contracts +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + contracts: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: contracts-vault + deployment: + enabled: true + name: + _default: backend + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/contracts-db ] && . /vault/secrets/contracts-db + [ -f /vault/secrets/contracts-jwt-public ] && export PUBLIC_KEY="$(cat /vault/secrets/contracts-jwt-public)" + [ -f /vault/secrets/contracts-rabbitmq ] && . /vault/secrets/contracts-rabbitmq + [ -f /vault/secrets/contracts-s3 ] && . /vault/secrets/contracts-s3 + [ -f /vault/secrets/contracts-kafka ] && . /vault/secrets/contracts-kafka + set +a + exec /usr/local/bin/http + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-service + type: + _default: ClusterIP + port: + _default: 8000 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: ADDRESS + value: + _default: ":8000" + - name: ENABLE_SSL + value: + _default: "false" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: contracts + vault.hashicorp.com/agent-inject-secret-contracts-db: secrets/data/postgresql/apps/contracts + vault.hashicorp.com/agent-inject-template-contracts-db: |- + {{- with secret "secrets/data/postgresql/apps/contracts" -}} + DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@postgresql.contracts.svc.cluster.local:5432/contracts_db?sslmode=disable + {{- end -}} + vault.hashicorp.com/agent-inject-secret-contracts-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-contracts-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-contracts-rabbitmq: secrets/data/rabbitmq/apps/contracts + vault.hashicorp.com/agent-inject-template-contracts-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/contracts" -}} + CONTRACTS_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + CONTRACTS_RABBITMQ_USERNAME={{ index .Data.data "username" }} + CONTRACTS_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + CONTRACTS_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + CONTRACTS_RABBITMQ_PORT=5672 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-contracts-s3: secrets/data/minio/apps/contracts + vault.hashicorp.com/agent-inject-template-contracts-s3: |- + {{- with secret "secrets/data/minio/apps/contracts" -}} + CONTRACTS_S3_ENDPOINT={{ index .Data.data.client "endpoint" }} + CONTRACTS_S3_REGION={{ index .Data.data.client "region" }} + CONTRACTS_S3_BUCKET=contracts + CONTRACTS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + CONTRACTS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-contracts-kafka: secrets/data/kafka/apps/contracts + vault.hashicorp.com/agent-inject-template-contracts-kafka: |- + {{- with secret "secrets/data/kafka/apps/contracts" -}} + CONTRACTS_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }} + CONTRACTS_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + CONTRACTS_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + CONTRACTS_KAFKA_USERNAME={{ index .Data.data "username" }} + CONTRACTS_KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/contracts/base/kustomization.yaml b/apps/contracts/base/kustomization.yaml index b7edf4a..b3cd342 100644 --- a/apps/contracts/base/kustomization.yaml +++ b/apps/contracts/base/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization namespace: contracts resources: - namespace.yaml - - serviceaccount.yaml - - deployment.yaml - - service.yaml + - helmrelease.yaml diff --git a/apps/contracts/base/namespace.yaml b/apps/contracts/base/namespace.yaml index 816bf00..142ae3a 100644 --- a/apps/contracts/base/namespace.yaml +++ b/apps/contracts/base/namespace.yaml @@ -5,3 +5,4 @@ metadata: name: contracts labels: istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/contracts/base/service.yaml b/apps/contracts/base/service.yaml deleted file mode 100644 index d378151..0000000 --- a/apps/contracts/base/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-service - namespace: contracts -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 8000 - targetPort: 8000 - protocol: TCP diff --git a/apps/contracts/base/serviceaccount.yaml b/apps/contracts/base/serviceaccount.yaml deleted file mode 100644 index a38e7c3..0000000 --- a/apps/contracts/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: contracts-vault - namespace: contracts diff --git a/apps/contracts/d8-ugmk-prod/kustomization.yaml b/apps/contracts/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..4aee37a --- /dev/null +++ b/apps/contracts/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: contracts +resources: + - ../base \ No newline at end of file diff --git a/apps/control-interface/base/helmrelease.yaml b/apps/control-interface/base/helmrelease.yaml index e6b778f..ced15fa 100644 --- a/apps/control-interface/base/helmrelease.yaml +++ b/apps/control-interface/base/helmrelease.yaml @@ -35,7 +35,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_feb59026 + _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_638c3442 pullPolicy: _default: IfNotPresent diff --git a/apps/control-interface/base/kustomization.yaml b/apps/control-interface/base/kustomization.yaml index 64ff6c5..b60836b 100644 --- a/apps/control-interface/base/kustomization.yaml +++ b/apps/control-interface/base/kustomization.yaml @@ -1,6 +1,7 @@ --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -namespace: django +namespace: control-interface resources: - helmrelease.yaml + diff --git a/apps/control-interface/d8-ugmk-prod/kustomization.yaml b/apps/control-interface/d8-ugmk-prod/kustomization.yaml index 6b283c2..3dcc41b 100644 --- a/apps/control-interface/d8-ugmk-prod/kustomization.yaml +++ b/apps/control-interface/d8-ugmk-prod/kustomization.yaml @@ -1,7 +1,7 @@ --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -namespace: django +namespace: control-interface resources: - ../base - namespace.yaml diff --git a/apps/django/base/backend-deployment.yaml b/apps/django/base/backend-deployment.yaml deleted file mode 100644 index fe3dd44..0000000 --- a/apps/django/base/backend-deployment.yaml +++ /dev/null @@ -1,222 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: django - labels: - app: backend - service: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - service: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: django - vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/postgresql/apps/django - vault.hashicorp.com/agent-inject-template-django-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/django" -}} - DJANGO_POSTGRES_HOST=postgresql.django.svc.cluster.local - DJANGO_POSTGRES_PORTS=5432 - DJANGO_POSTGRES_DATABASE=sarex_db - DJANGO_POSTGRES_USER={{ index .Data.data "username" }} - DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django - vault.hashicorp.com/agent-inject-template-django-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/django" -}} - CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - CELERY_RABBITMQ_USER={{ index .Data.data "username" }} - CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} - CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} - DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local - DJANGO_RABBIT_USER={{ index .Data.data "username" }} - DJANGO_RABBIT_PASS={{ index .Data.data "password" }} - DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django - vault.hashicorp.com/agent-inject-template-django-s3: |- - {{- with secret "secrets/data/minio/apps/django" }} - AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech - S3_HOST=https://minio.contour.infra.sarex.tech - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - {{- end }} - vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django - vault.hashicorp.com/agent-inject-template-django-kafka: |- - {{- with secret "secrets/data/kafka/apps/django" -}} - KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]" - KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} - KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} - KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} - KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-django-jwt-private: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "private_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-django-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-django-common: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }} - {{- end -}} - spec: - serviceAccountName: django-vault - volumes: - - name: django-configmap - configMap: - name: django-configmap - items: - - key: production.py - path: production.py - defaultMode: 420 - - name: uwsgi-configmap - configMap: - name: uwsgi-configmap - items: - - key: uwsgi.ini - path: uwsgi.ini - defaultMode: 420 - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql - [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq - [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3 - [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka - [ -f /vault/secrets/django-common ] && . /vault/secrets/django-common - [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)" - [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)" - set +a - exec /opt/sarex/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: ALLOWED_HOSTS - value: '*' - - name: SERVER_USE_CHANGELOG - value: "0" - - name: SERVER_ZITADEL_ENABLED - value: "True" - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: CELERY_REDIS_HOST - value: redis - - name: CELERY_REDIS_PORT - value: "6379" - - name: DJANGO_REDIS_HOST - value: redis - - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED - value: "True" - - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED - value: "True" - - name: DJANGO_REDIS_PORT - value: "6379" - - name: BIMV2_INTERNAL_HOST - value: http://bim-backend-v2-service.bim-api - - name: BIMV2_TIMEOUT - value: "60" - - name: JWT_KID - value: "1" - - name: PDM_SYNC - value: "1" - - name: KC_SYNC_ENABLE - value: "0" - - name: MEASUREMENTS_HOST - value: http://measurements-service.measurements.svc.cluster.local:8000/api - - name: MEASUREMENTS_USE_MEASUREMENTS - value: "1" - - name: SERVER_API_HOST - value: https://sarex.contour.infra.sarex.tech - - name: SERVER_HOST - value: https://sarex.contour.infra.sarex.tech - - name: WORKFLOWS_HOST - value: http://backend-svc.processing.svc.cluster.local:80 - - name: WORKFLOWS_BASE_HOST - value: http://backend-svc.django.svc.cluster.local:80 - - name: WORKFLOWS_PREFIX - value: /internal/v1 - - name: WORKFLOWS_USE - value: "1" - - name: SERVER_S3_STREAM_IMPORT - value: "1" - - name: SERVER_SAVE_DIFF_DEM - value: "1" - - name: SERVER_USE_CLICKHOUSE - value: "0" - - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK - value: "0" - - name: SERVER_USE_DJANGO_STORAGE - value: "1" - - name: SERVER_USE_METASHAPE - value: "0" - - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG - value: "1" - - name: SERVER_CHANGELOG_MODE - value: "0" - - name: SERVER_DJANGO_URLS - value: "1" - - name: CHECK_IMPORT_HASH - value: "1" - - name: EAV_ENABLE - value: "1" - - name: SERVER_CHECK_IMPORT_HASH - value: "1" - - name: SERVER_CHUNKED_PATH - value: /tmp/chunked_uploads/%Y/%m/%d - - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS - value: "0" - - name: SERVER_USE_WRORKFLOW_STATUS - value: "1" - - name: ZITADEL_HOST - value: https://zitadel.contour.infra.sarex.tech - - name: SERVER_KAFKA_ENABLED - value: "False" - - name: KAFKA_TOPICS - value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' - - name: KAFKA_SSL_CAFILE - value: /usr/local/share/ca-certificates/kafka.crt - - name: KC_USE_REDIRECT_LOGOUT - value: "False" - - - - resources: - requests: - cpu: "25m" - memory: 128Mi - volumeMounts: - - name: django-configmap - mountPath: /opt/sarex/config/settings/production.py - subPath: production.py - - name: uwsgi-configmap - mountPath: /opt/sarex/uwsgi.ini - subPath: uwsgi.ini - imagePullSecrets: - - name: regcred diff --git a/apps/django/base/backend-service.yaml b/apps/django/base/backend-service.yaml deleted file mode 100644 index f46fcaf..0000000 --- a/apps/django/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: django -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/django/base/backend.yaml b/apps/django/base/backend.yaml new file mode 100644 index 0000000..217177c --- /dev/null +++ b/apps/django/base/backend.yaml @@ -0,0 +1,312 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: django +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: django-vault + deployment: + enabled: true + name: + _default: backend + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql + [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq + [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3 + [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka + [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)" + [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)" + set +a + exec /opt/sarex/entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_f813140d + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: + _default: + - name: django-configmap + mountPath: + _default: /opt/sarex/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + - name: uwsgi-configmap + mountPath: + _default: /opt/sarex/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: uwsgi-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + envs: + - name: ALLOWED_HOSTS + value: + _default: "*" + - name: SERVER_USE_CHANGELOG + value: + _default: "0" + - name: SERVER_ZITADEL_ENABLED + value: + _default: "True" + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: CELERY_REDIS_HOST + value: + _default: redis + - name: CELERY_REDIS_PORT + value: + _default: "6379" + - name: DJANGO_REDIS_HOST + value: + _default: redis + - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED + value: + _default: "True" + - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED + value: + _default: "True" + - name: DJANGO_REDIS_PORT + value: + _default: "6379" + - name: BIMV2_INTERNAL_HOST + value: + _default: http://bim-backend-v2-service.bim-api + - name: BIMV2_TIMEOUT + value: + _default: "60" + - name: JWT_KID + value: + _default: "1" + - name: PDM_SYNC + value: + _default: "1" + - name: KC_SYNC_ENABLE + value: + _default: "0" + - name: MEASUREMENTS_HOST + value: + _default: http://measurements-service.measurements.svc.cluster.local:8000/api + - name: MEASUREMENTS_USE_MEASUREMENTS + value: + _default: "1" + - name: SERVER_API_HOST + value: + _default: https://sarex.contour.infra.sarex.tech + - name: SERVER_HOST + value: + _default: https://sarex.contour.infra.sarex.tech + - name: WORKFLOWS_HOST + value: + _default: http://backend-svc.processing.svc.cluster.local:80 + - name: WORKFLOWS_BASE_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: WORKFLOWS_PREFIX + value: + _default: /internal/v1 + - name: WORKFLOWS_USE + value: + _default: "1" + - name: SERVER_S3_STREAM_IMPORT + value: + _default: "1" + - name: SERVER_SAVE_DIFF_DEM + value: + _default: "1" + - name: SERVER_USE_CLICKHOUSE + value: + _default: "0" + - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK + value: + _default: "0" + - name: SERVER_USE_DJANGO_STORAGE + value: + _default: "1" + - name: SERVER_USE_METASHAPE + value: + _default: "0" + - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG + value: + _default: "1" + - name: SERVER_CHANGELOG_MODE + value: + _default: "0" + - name: SERVER_DJANGO_URLS + value: + _default: "1" + - name: CHECK_IMPORT_HASH + value: + _default: "1" + - name: EAV_ENABLE + value: + _default: "1" + - name: SERVER_CHECK_IMPORT_HASH + value: + _default: "1" + - name: SERVER_CHUNKED_PATH + value: + _default: /tmp/chunked_uploads/%Y/%m/%d + - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS + value: + _default: "0" + - name: SERVER_USE_WRORKFLOW_STATUS + value: + _default: "1" + - name: ZITADEL_HOST + value: + _default: https://zitadel.contour.infra.sarex.tech + - name: SERVER_KAFKA_ENABLED + value: + _default: "False" + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + - name: KAFKA_SSL_CAFILE + value: + _default: /usr/local/share/ca-certificates/kafka.crt + - name: KC_USE_REDIRECT_LOGOUT + value: + _default: "False" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: django + vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres + vault.hashicorp.com/agent-inject-template-django-postgresql: |- + {{- with secret "secrets/data/apps/django/postgres" -}} + DJANGO_POSTGRES_HOST={{ index .Data.data "host" }} + DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }} + DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }} + DJANGO_POSTGRES_USER={{ index .Data.data "username" }} + DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django + vault.hashicorp.com/agent-inject-template-django-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/django" -}} + CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + CELERY_RABBITMQ_USER={{ index .Data.data "username" }} + CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local + DJANGO_RABBIT_USER={{ index .Data.data "username" }} + DJANGO_RABBIT_PASS={{ index .Data.data "password" }} + DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django + vault.hashicorp.com/agent-inject-template-django-s3: |- + {{- with secret "secrets/data/minio/apps/django" }} + AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech + S3_HOST=https://minio.contour.infra.sarex.tech + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + {{- end }} + vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django + vault.hashicorp.com/agent-inject-template-django-kafka: |- + {{- with secret "secrets/data/kafka/apps/django" -}} + KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]" + KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} + KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-django-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-django-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-django-common: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }} + {{- end -}} diff --git a/apps/django/base/celery-deployment.yaml b/apps/django/base/celery-deployment.yaml deleted file mode 100644 index b95c2da..0000000 --- a/apps/django/base/celery-deployment.yaml +++ /dev/null @@ -1,204 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: celery - namespace: django - labels: - app: celery - service: celery -spec: - replicas: 1 - selector: - matchLabels: - app: celery - template: - metadata: - labels: - app: celery - service: celery - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: django - vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/postgresql/apps/django - vault.hashicorp.com/agent-inject-template-django-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/django" -}} - DJANGO_POSTGRES_HOST=postgresql.django.svc.cluster.local - DJANGO_POSTGRES_PORTS=5432 - DJANGO_POSTGRES_DATABASE=sarex_db - DJANGO_POSTGRES_USER={{ index .Data.data "username" }} - DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django - vault.hashicorp.com/agent-inject-template-django-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/django" -}} - CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - CELERY_RABBITMQ_USER={{ index .Data.data "username" }} - CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} - CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} - DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local - DJANGO_RABBIT_USER={{ index .Data.data "username" }} - DJANGO_RABBIT_PASS={{ index .Data.data "password" }} - DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django - vault.hashicorp.com/agent-inject-template-django-s3: |- - {{- with secret "secrets/data/minio/apps/django" -}} - AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech - S3_HOST=https://minio.contour.infra.sarex.tech - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}django{{- end -}} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django - vault.hashicorp.com/agent-inject-template-django-kafka: |- - {{- with secret "secrets/data/kafka/apps/django" -}} - KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]" - KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} - KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} - KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} - KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-django-jwt-private: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "private_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-django-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-django-common: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }} - {{- end -}} - spec: - serviceAccountName: django-vault - volumes: - - name: django-configmap - configMap: - name: django-configmap - items: - - key: production.py - path: production.py - defaultMode: 420 - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql - [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq - [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3 - [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka - [ -f /vault/secrets/django-common ] && . /vault/secrets/django-common - [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)" - [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)" - set +a - exec celery -A config worker -B -l info -E -Q default -n default_worker.%h --concurrency=2 - - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: ALLOWED_HOSTS - value: '*' - - name: SERVER_USE_CHANGELOG - value: "0" - - name: SERVER_ZITADEL_ENABLED - value: "False" - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: CELERY_REDIS_HOST - value: redis - - name: CELERY_REDIS_PORT - value: "6379" - - name: DJANGO_REDIS_HOST - value: redis - - name: DJANGO_REDIS_PORT - value: "6379" - - name: BIMV2_INTERNAL_HOST - value: http://bim-backend-v2-service.bim-api - - name: BIMV2_TIMEOUT - value: "60" - - name: JWT_KID - value: "1" - - name: PDM_SYNC - value: "1" - - name: KC_SYNC_ENABLE - value: "0" - - name: MEASUREMENTS_HOST - value: http://measurements-service.measurements.svc.cluster.local:8000/api - - name: MEASUREMENTS_USE_MEASUREMENTS - value: "1" - - name: SERVER_API_HOST - value: https://wb.sarex.io - - name: SERVER_HOST - value: https://wb.sarex.io - - name: WORKFLOWS_HOST - value: https://wb.sarex.io - - name: WORKFLOWS_BASE_HOST - value: https://wb.sarex.io - - name: WORKFLOWS_USE - value: "1" - - name: SERVER_S3_STREAM_IMPORT - value: "1" - - name: SERVER_SAVE_DIFF_DEM - value: "1" - - name: SERVER_USE_CLICKHOUSE - value: "0" - - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK - value: "0" - - name: SERVER_USE_DJANGO_STORAGE - value: "1" - - name: SERVER_USE_METASHAPE - value: "0" - - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG - value: "1" - - name: SERVER_CHANGELOG_MODE - value: "0" - - name: SERVER_DJANGO_URLS - value: "1" - - name: CHECK_IMPORT_HASH - value: "1" - - name: EAV_ENABLE - value: "1" - - name: SERVER_CHECK_IMPORT_HASH - value: "1" - - name: SERVER_CHUNKED_PATH - value: /tmp/chunked_uploads/%Y/%m/%d - - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS - value: "0" - - name: SERVER_USE_WRORKFLOW_STATUS - value: "1" - - name: ZITADEL_HOST - value: https://zitadel-srx.wb.ru - - name: SERVER_KAFKA_ENABLED - value: "False" - - name: KAFKA_TOPICS - value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' - - name: KAFKA_SSL_CAFILE - value: /usr/local/share/ca-certificates/kafka.crt - - name: KC_USE_REDIRECT_LOGOUT - value: "False" - resources: - requests: - cpu: "25m" - memory: 128Mi - volumeMounts: - - name: django-configmap - mountPath: /opt/sarex/config/settings/production.py - subPath: production.py - imagePullSecrets: - - name: regcred diff --git a/apps/django/base/celery.yaml b/apps/django/base/celery.yaml new file mode 100644 index 0000000..2d83de5 --- /dev/null +++ b/apps/django/base/celery.yaml @@ -0,0 +1,279 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: django +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + celery: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: django-vault + deployment: + enabled: true + name: + _default: celery + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql + [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq + [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3 + [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka + [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)" + [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)" + set +a + exec celery -A config worker -B -l info -E -Q default -n default_worker.%h --concurrency=2 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0 + pullPolicy: + _default: IfNotPresent + service: + enabled: false + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: + _default: + - name: django-configmap + mountPath: + _default: /opt/sarex/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + envs: + - name: ALLOWED_HOSTS + value: + _default: "*" + - name: SERVER_USE_CHANGELOG + value: + _default: "0" + - name: SERVER_ZITADEL_ENABLED + value: + _default: "False" + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: CELERY_REDIS_HOST + value: + _default: redis + - name: CELERY_REDIS_PORT + value: + _default: "6379" + - name: DJANGO_REDIS_HOST + value: + _default: redis + - name: DJANGO_REDIS_PORT + value: + _default: "6379" + - name: BIMV2_INTERNAL_HOST + value: + _default: http://bim-backend-v2-service.bim-api + - name: BIMV2_TIMEOUT + value: + _default: "60" + - name: JWT_KID + value: + _default: "1" + - name: PDM_SYNC + value: + _default: "1" + - name: KC_SYNC_ENABLE + value: + _default: "0" + - name: MEASUREMENTS_HOST + value: + _default: http://measurements-service.measurements.svc.cluster.local:8000/api + - name: MEASUREMENTS_USE_MEASUREMENTS + value: + _default: "1" + - name: SERVER_API_HOST + value: + _default: https://wb.sarex.io + - name: SERVER_HOST + value: + _default: https://wb.sarex.io + - name: WORKFLOWS_HOST + value: + _default: https://wb.sarex.io + - name: WORKFLOWS_BASE_HOST + value: + _default: https://wb.sarex.io + - name: WORKFLOWS_USE + value: + _default: "1" + - name: SERVER_S3_STREAM_IMPORT + value: + _default: "1" + - name: SERVER_SAVE_DIFF_DEM + value: + _default: "1" + - name: SERVER_USE_CLICKHOUSE + value: + _default: "0" + - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK + value: + _default: "0" + - name: SERVER_USE_DJANGO_STORAGE + value: + _default: "1" + - name: SERVER_USE_METASHAPE + value: + _default: "0" + - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG + value: + _default: "1" + - name: SERVER_CHANGELOG_MODE + value: + _default: "0" + - name: SERVER_DJANGO_URLS + value: + _default: "1" + - name: CHECK_IMPORT_HASH + value: + _default: "1" + - name: EAV_ENABLE + value: + _default: "1" + - name: SERVER_CHECK_IMPORT_HASH + value: + _default: "1" + - name: SERVER_CHUNKED_PATH + value: + _default: /tmp/chunked_uploads/%Y/%m/%d + - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS + value: + _default: "0" + - name: SERVER_USE_WRORKFLOW_STATUS + value: + _default: "1" + - name: ZITADEL_HOST + value: + _default: https://zitadel-srx.wb.ru + - name: SERVER_KAFKA_ENABLED + value: + _default: "False" + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + - name: KAFKA_SSL_CAFILE + value: + _default: /usr/local/share/ca-certificates/kafka.crt + - name: KC_USE_REDIRECT_LOGOUT + value: + _default: "False" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: django + vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres + vault.hashicorp.com/agent-inject-template-django-postgresql: |- + {{- with secret "secrets/data/apps/django/postgres" -}} + DJANGO_POSTGRES_HOST={{ index .Data.data "host" }} + DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }} + DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }} + DJANGO_POSTGRES_USER={{ index .Data.data "username" }} + DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django + vault.hashicorp.com/agent-inject-template-django-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/django" -}} + CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + CELERY_RABBITMQ_USER={{ index .Data.data "username" }} + CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local + DJANGO_RABBIT_USER={{ index .Data.data "username" }} + DJANGO_RABBIT_PASS={{ index .Data.data "password" }} + DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django + vault.hashicorp.com/agent-inject-template-django-s3: |- + {{- with secret "secrets/data/minio/apps/django" -}} + AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech + S3_HOST=https://minio.contour.infra.sarex.tech + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}django{{- end -}} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django + vault.hashicorp.com/agent-inject-template-django-kafka: |- + {{- with secret "secrets/data/kafka/apps/django" -}} + KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]" + KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} + KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-django-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-django-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-django-common: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }} + {{- end -}} diff --git a/apps/django/base/frontend-deployment.yaml b/apps/django/base/frontend-deployment.yaml deleted file mode 100644 index 1504114..0000000 --- a/apps/django/base/frontend-deployment.yaml +++ /dev/null @@ -1,55 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: django - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - volumes: - - name: nginx-configmap - configMap: - name: nginx-configmap - items: - - key: nginx.conf - path: nginx.conf - defaultMode: 420 - - name: zitadel-configmap - configMap: - name: zitadel-configmap - items: - - key: config.json - path: config.json - defaultMode: 420 - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.0 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - volumeMounts: - - name: nginx-configmap - mountPath: /etc/nginx/nginx.conf - subPath: nginx.conf - - name: zitadel-configmap - readOnly: true - mountPath: /opt/react_client/static/config.json - subPath: config.json - imagePullSecrets: - - name: regcred diff --git a/apps/django/base/frontend-service.yaml b/apps/django/base/frontend-service.yaml deleted file mode 100644 index f2c3ba6..0000000 --- a/apps/django/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: django -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/django/base/frontend.yaml b/apps/django/base/frontend.yaml new file mode 100644 index 0000000..1059d1e --- /dev/null +++ b/apps/django/base/frontend.yaml @@ -0,0 +1,101 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: django +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + frontend: + enabled: true + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.0 + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + name: + _default: frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + service: + enabled: true + name: + _default: frontend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: + _default: + - name: nginx-configmap + mountPath: + _default: /etc/nginx/nginx.conf + subPath: + _default: nginx.conf + readOnly: + _default: true + configMap: + name: + _default: nginx-configmap + items: + - key: nginx.conf + path: + _default: nginx.conf + + - name: zitadel-configmap + mountPath: + _default: /opt/react_client/static/config.json + subPath: + _default: config.json + readOnly: + _default: true + configMap: + name: + _default: zitadel-configmap + items: + - key: config.json + path: + _default: config.json diff --git a/apps/django/base/kustomization.yaml b/apps/django/base/kustomization.yaml index 5507f04..5577e10 100644 --- a/apps/django/base/kustomization.yaml +++ b/apps/django/base/kustomization.yaml @@ -4,17 +4,14 @@ kind: Kustomization namespace: django resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - celery-deployment.yaml - - frontend-deployment.yaml - - backend-service.yaml - - frontend-service.yaml - django-configmap.yaml - - srx-admin-deployment.yaml - - srx-admin-service.yaml - nginx-configmap.yaml - uwsgi-configmap.yaml - zitadel-configmap.yaml - - s3-proxy-service.yaml + - backend.yaml + - celery.yaml + - frontend.yaml + - srx-admin.yaml - s3-proxy.yaml + - redis-deployment.yaml + - redis-service.yaml diff --git a/apps/django/base/namespace.yaml b/apps/django/base/namespace.yaml index 33478ea..524ef17 100644 --- a/apps/django/base/namespace.yaml +++ b/apps/django/base/namespace.yaml @@ -5,3 +5,4 @@ metadata: name: django labels: istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/django/base/nginx-configmap.yaml b/apps/django/base/nginx-configmap.yaml index 2b70b85..cfe04eb 100644 --- a/apps/django/base/nginx-configmap.yaml +++ b/apps/django/base/nginx-configmap.yaml @@ -62,36 +62,37 @@ data: if_modified_since off; expires off; } - location ~^/api/pm/ { - #rewrite /api/(.+) /$1 break; - proxy_set_header Host $host; - proxy_pass http://backend-svc.pm.svc.cluster.local:8000; - } + # location ~^/api/pm/ { + # #rewrite /api/(.+) /$1 break; + # proxy_set_header Host $host; + # proxy_pass http://backend-svc.pm.svc.cluster.local:8000; + # } - location ~^/api/v1/documents/ { - #rewrite /api/(.+) /$1 break; - proxy_set_header Host $host; - proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80; - } + # location ~^/api/v1/documents/ { + # #rewrite /api/(.+) /$1 break; + # proxy_set_header Host $host; + # proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80; + # } # location ~^/(api|admin)/ { # proxy_set_header Host $host; # proxy_pass http://backend-svc.django.svc.cluster.local:80; # } - location ~^/workspaces-v2/(.+).js { - proxy_http_version 1.1; - proxy_set_header Connection ""; - rewrite /workspaces-v2/(.+) /$1 break; - proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; - } + # location ~^/workspaces-v2/(.+).js { + # proxy_http_version 1.1; + # proxy_set_header Connection ""; + # rewrite /workspaces-v2/(.+) /$1 break; + # proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; + # } + - location ~^/workspaces-v2/(.+)\.wasm$ { - proxy_http_version 1.1; - proxy_set_header Connection ""; - rewrite ^/workspaces-v2/(.+) /$1 break; - proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; - } + # location ~^/workspaces-v2/(.+)\.wasm$ { + # proxy_http_version 1.1; + # proxy_set_header Connection ""; + # rewrite ^/workspaces-v2/(.+) /$1 break; + # proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; + # } location @index { add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0'; diff --git a/apps/django/yc-k8s-test/redis-deployment.yaml b/apps/django/base/redis-deployment.yaml similarity index 100% rename from apps/django/yc-k8s-test/redis-deployment.yaml rename to apps/django/base/redis-deployment.yaml diff --git a/apps/django/yc-k8s-test/redis-service.yaml b/apps/django/base/redis-service.yaml similarity index 100% rename from apps/django/yc-k8s-test/redis-service.yaml rename to apps/django/base/redis-service.yaml diff --git a/apps/django/base/s3-proxy-service.yaml b/apps/django/base/s3-proxy-service.yaml deleted file mode 100644 index cc2290c..0000000 --- a/apps/django/base/s3-proxy-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: s3-proxy-svc - namespace: django -spec: - type: ClusterIP - selector: - app: s3-proxy - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/django/base/s3-proxy.yaml b/apps/django/base/s3-proxy.yaml index 044ebcc..b03508d 100644 --- a/apps/django/base/s3-proxy.yaml +++ b/apps/django/base/s3-proxy.yaml @@ -1,69 +1,97 @@ -apiVersion: apps/v1 -kind: Deployment +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: s3-proxy namespace: django - labels: - app: s3-proxy - spec: - replicas: 1 - - selector: - matchLabels: - app: s3-proxy - - template: - metadata: - labels: - app: s3-proxy - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: django - - vault.hashicorp.com/agent-inject-secret-s3: secrets/data/minio/apps/django - - vault.hashicorp.com/agent-inject-template-s3: | - {{- with secret "secrets/data/minio/apps/django" }} - AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech - {{- $buckets := index .Data.data "buckets" }} - AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} - AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end }} - + interval: 10m + chart: spec: - serviceAccountName: django-vault - - containers: - - name: s3-proxy - image: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:vault_6e586217 - imagePullPolicy: Always - + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + s3-proxy: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: django-vault + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:vault_6e586217 + pullPolicy: + _default: Always + deployment: + enabled: true + name: + _default: s3-proxy + replicaCount: + _default: 1 + port: + _default: 80 command: - - /bin/sh - - -ec - + _default: ["/bin/sh", "-ec"] args: - - | - set -a - [ -f /vault/secrets/s3 ] && . /vault/secrets/s3 - set +a - - exec /s3-proxy - - ports: - - name: http - containerPort: 80 - - env: - - name: ACCESS_LOG - value: "true" - - - name: CORS_ALLOW_HEADERS - value: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding" \ No newline at end of file + _default: + - | + set -a + [ -f /vault/secrets/s3 ] && . /vault/secrets/s3 + set +a + exec /s3-proxy + probes: + liveness: + enabled: false + readiness: + enabled: false + service: + enabled: true + name: + _default: s3-proxy-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + envs: + - name: ACCESS_LOG + value: + _default: "true" + - name: CORS_ALLOW_HEADERS + value: + _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: django + vault.hashicorp.com/agent-inject-secret-s3: secrets/data/minio/apps/django + vault.hashicorp.com/agent-inject-template-s3: | + {{- with secret "secrets/data/minio/apps/django" }} + AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech + {{- $buckets := index .Data.data "buckets" }} + AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} + AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end }} diff --git a/apps/django/base/serviceaccount.yaml b/apps/django/base/serviceaccount.yaml deleted file mode 100644 index 5222954..0000000 --- a/apps/django/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: django-vault - namespace: django diff --git a/apps/django/base/srx-admin-deployment.yaml b/apps/django/base/srx-admin-deployment.yaml deleted file mode 100644 index a6f93ae..0000000 --- a/apps/django/base/srx-admin-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: srx-admin-frontend - namespace: django - labels: - app: srx-admin-frontend -spec: - replicas: 1 - selector: - matchLabels: - app: srx-admin-frontend - template: - metadata: - labels: - app: srx-admin-frontend - spec: - containers: - - name: srx-admin-frontend - image: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_3b9cb250 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/django/base/srx-admin-service.yaml b/apps/django/base/srx-admin-service.yaml deleted file mode 100644 index 0d1b912..0000000 --- a/apps/django/base/srx-admin-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: srx-admin-svc - namespace: django -spec: - type: ClusterIP - selector: - app: srx-admin - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/django/base/srx-admin.yaml b/apps/django/base/srx-admin.yaml new file mode 100644 index 0000000..d8ec105 --- /dev/null +++ b/apps/django/base/srx-admin.yaml @@ -0,0 +1,70 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: srx-admin-frontend + namespace: django +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + srx-admin: + enabled: true + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_3b9cb250 + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + name: + _default: srx-admin-frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + service: + enabled: true + name: + _default: srx-admin-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/django/base/zitadel-configmap.yaml b/apps/django/base/zitadel-configmap.yaml index 8b71cec..8398f6a 100644 --- a/apps/django/base/zitadel-configmap.yaml +++ b/apps/django/base/zitadel-configmap.yaml @@ -8,8 +8,8 @@ data: { "auth_type": "zitadel", "zitadel": { - "client_id": "379557107642492501", - "host": "https://zitadel.contour.infra.sarex.tech" + "client_id": "383923818340615274", + "host": "https://sarex-login.uralmine.com" } } diff --git a/apps/django/d8-ugmk-prod/kustomization.yaml b/apps/django/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..4956ad3 --- /dev/null +++ b/apps/django/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: django +resources: + - ../base \ No newline at end of file diff --git a/apps/django/dsinv/backend.yaml b/apps/django/dsinv/backend.yaml index 074397e..acb04f7 100644 --- a/apps/django/dsinv/backend.yaml +++ b/apps/django/dsinv/backend.yaml @@ -1,110 +1,161 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: django spec: - replicas: 2 - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1 - env: - - name: GK_ENCRYPTION_KEY - value: zfDjuszywHSbAhY8KJQbESbpUYN74XTs - - name: SERVER_DONSTROI_STYLE - value: 'True' - - name: SERVER_API_HOST - value: https://sarex.dsinv.ru - - name: SERVER_VERIFY_SSL - value: 'False' - - name: SERVER_SUPERSET_HOST - value: https://bi.sarex.dsinv.ru - - name: GATEWAY_HOST - value: http://pdm-api.documentations.svc.cluster.local:8080 - - name: KC_DEFAULT_COMPANY_NAME - value: Донстрой - - name: KC_SYNC_USER_GROUPS - value: '0' - - name: SERVER_ZITADEL_ENABLED - value: 'False' - - name: KC_SYNC_USER_POSITIONS - value: '0' - - name: KC_SYNC_USER_DEPARTMENTS - value: '0' - - name: SERVER_CHANGELOG_MODE_CELERY - value: 'True' - - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG - value: 'True' - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: CC_PATH - value: /usr/local/bin/CloudCompare - - name: CC_COMPARISONS_BASE_DIR - value: /tmp - - name: PCVT_PATH - value: /usr/local/bin/PotreeConverter - - name: POTREE_CONVERTER_PATH - value: /usr/local/bin/PotreeConverter - - name: WORKFLOWS_BASE_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: WORKFLOWS_HOST - value: http://workflows-service.workflow.svc.cluster.local:8000 - - name: WORKFLOWS_PREFIX - value: /api/v1 - - name: SERVER_HOST - value: https://sarex.dsinv.ru - - name: S3_HOST - value: http://minio-service.minio.svc.cluster.local:9000 - - name: AWS_S3_ENDPOINT_URL - value: http://minio-service.minio.svc.cluster.local:9000 - - name: MEASUREMENTS_USE_MEASUREMENTS - value: '1' - - name: MEASUREMENTS_HOST - value: http://measurement-service.measurements.svc.cluster.local:8000/api - - name: SERVER_USE_DJANGO_STORAGE - value: '1' - - name: SERVER_DJANGO_URLS - value: '1' - - name: SERVER_S3_STREAM_IMPORT - value: '1' - - name: WORKFLOWS_USE - value: '1' - - name: SERVER_KAFKA_ENABLED - value: 'True' - - name: KAFKA_TOPICS - value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' - - name: KAFKA_BOOTSTRAP_SERVERS - value: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]' - - name: KAFKA_SECURITY_PROTOCOL - value: SSL - - name: KAFKA_SASL_MECHANISM - value: SCRAM-SHA-512 - - name: KAFKA_SSL_CAFILE - value: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt - - name: WORKFLOWS_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: DJANGO_REDIS_HOST - value: redis-service.django.svc.cluster.local - - name: DJANGO_RABBIT_HOSTNAME - value: rabbitmq-service.django.svc.cluster.local - - name: CELERY_RABBITMQ_HOST - value: rabbitmq-service.django.svc.cluster.local - - name: DJANGO_POSTGRES_HOST - value: postgres-service - - name: DJANGO_POSTGRES_PORTS - value: '5432' - - name: ALLOWED_HOSTS - value: '*' - - name: USE_SSL_FOR_URL_SERIALIZATION - value: '0' - - name: SERVER_REPLACE_HOST - value: '1' - - name: SERVER_JWT_PROXY - value: '0' - - name: PDM_SYNC - value: '1' - - name: CELERY_REDIS_HOST - value: redis-service + values: + services: + backend: + deployment: + replicaCount: + _default: 2 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1 + envs: + - name: GK_ENCRYPTION_KEY + value: + _default: zfDjuszywHSbAhY8KJQbESbpUYN74XTs + - name: SERVER_DONSTROI_STYLE + value: + _default: "True" + - name: SERVER_API_HOST + value: + _default: https://sarex.dsinv.ru + - name: SERVER_VERIFY_SSL + value: + _default: "False" + - name: SERVER_SUPERSET_HOST + value: + _default: https://bi.sarex.dsinv.ru + - name: GATEWAY_HOST + value: + _default: http://pdm-api.documentations.svc.cluster.local:8080 + - name: KC_DEFAULT_COMPANY_NAME + value: + _default: Донстрой + - name: KC_SYNC_USER_GROUPS + value: + _default: "0" + - name: SERVER_ZITADEL_ENABLED + value: + _default: "False" + - name: KC_SYNC_USER_POSITIONS + value: + _default: "0" + - name: KC_SYNC_USER_DEPARTMENTS + value: + _default: "0" + - name: SERVER_CHANGELOG_MODE_CELERY + value: + _default: "True" + - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG + value: + _default: "True" + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: CC_PATH + value: + _default: /usr/local/bin/CloudCompare + - name: CC_COMPARISONS_BASE_DIR + value: + _default: /tmp + - name: PCVT_PATH + value: + _default: /usr/local/bin/PotreeConverter + - name: POTREE_CONVERTER_PATH + value: + _default: /usr/local/bin/PotreeConverter + - name: WORKFLOWS_BASE_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: WORKFLOWS_HOST + value: + _default: http://workflows-service.workflow.svc.cluster.local:8000 + - name: WORKFLOWS_PREFIX + value: + _default: /api/v1 + - name: SERVER_HOST + value: + _default: https://sarex.dsinv.ru + - name: S3_HOST + value: + _default: http://minio-service.minio.svc.cluster.local:9000 + - name: AWS_S3_ENDPOINT_URL + value: + _default: http://minio-service.minio.svc.cluster.local:9000 + - name: MEASUREMENTS_USE_MEASUREMENTS + value: + _default: "1" + - name: MEASUREMENTS_HOST + value: + _default: http://measurement-service.measurements.svc.cluster.local:8000/api + - name: SERVER_USE_DJANGO_STORAGE + value: + _default: "1" + - name: SERVER_DJANGO_URLS + value: + _default: "1" + - name: SERVER_S3_STREAM_IMPORT + value: + _default: "1" + - name: WORKFLOWS_USE + value: + _default: "1" + - name: SERVER_KAFKA_ENABLED + value: + _default: "True" + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]' + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: SSL + - name: KAFKA_SASL_MECHANISM + value: + _default: SCRAM-SHA-512 + - name: KAFKA_SSL_CAFILE + value: + _default: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt + - name: WORKFLOWS_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: DJANGO_REDIS_HOST + value: + _default: redis-service.django.svc.cluster.local + - name: DJANGO_RABBIT_HOSTNAME + value: + _default: rabbitmq-service.django.svc.cluster.local + - name: CELERY_RABBITMQ_HOST + value: + _default: rabbitmq-service.django.svc.cluster.local + - name: DJANGO_POSTGRES_HOST + value: + _default: postgres-service + - name: DJANGO_POSTGRES_PORTS + value: + _default: "5432" + - name: ALLOWED_HOSTS + value: + _default: "*" + - name: USE_SSL_FOR_URL_SERIALIZATION + value: + _default: "0" + - name: SERVER_REPLACE_HOST + value: + _default: "1" + - name: SERVER_JWT_PROXY + value: + _default: "0" + - name: PDM_SYNC + value: + _default: "1" + - name: CELERY_REDIS_HOST + value: + _default: redis-service diff --git a/apps/django/dsinv/celery.yaml b/apps/django/dsinv/celery.yaml index 2a8b34a..948511e 100644 --- a/apps/django/dsinv/celery.yaml +++ b/apps/django/dsinv/celery.yaml @@ -1,87 +1,125 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: celery namespace: django spec: - template: - spec: - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1 - env: - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: CC_PATH - value: /usr/local/bin/CloudCompare - - name: CC_COMPARISONS_BASE_DIR - value: /tmp - - name: AWS_S3_ENDPOINT_URL - value: http://minio-service.minio.svc.cluster.local:9000 - - name: PCVT_PATH - value: /usr/local/bin/PotreeConverter - - name: POTREE_CONVERTER_PATH - value: /usr/local/bin/PotreeConverter - - name: WORKFLOWS_BASE_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: WORKFLOWS_HOST - value: https://sarex.dsinv.ru - - name: SERVER_CACHE_ENABLED - value: 'True' - - name: SERVER_API_HOST - value: https://sarex.dsinv.ru - - name: SERVER_VERIFY_SSL - value: 'False' - - name: SERVER_HOST - value: https://sarex.dsinv.ru - - name: S3_HOST - value: http://minio-service.minio.svc.cluster.local:9000 - - name: MEASUREMENTS_USE_MEASUREMENTS - value: '1' - - name: MEASUREMENTS_HOST - value: http://measurements-service.measurements.svc.cluster.local:8000/api - - name: SERVER_USE_DJANGO_STORAGE - value: '1' - - name: SERVER_DJANGO_URLS - value: '1' - - name: CACHE_HOST - value: redis.pm.svc.cluster.local - - name: SERVER_DONSTROI_STYLE - value: 'True' - - name: SERVER_S3_STREAM_IMPORT - value: '1' - - name: WORKFLOWS_USE - value: '1' - - name: WORKFLOWS_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: CELERY_REDIS_HOST - value: redis-service - - name: CELERY_RABBITMQ_HOST - value: rabbitmq-service.django.svc.cluster.local - - name: DJANGO_POSTGRES_HOST - value: postgres-service - - name: SERVER_KAFKA_ENABLED - value: 'True' - - name: KAFKA_TOPICS - value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' - - name: KAFKA_BOOTSTRAP_SERVERS - value: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]' - - name: KAFKA_SECURITY_PROTOCOL - value: SSL - - name: KAFKA_SASL_MECHANISM - value: SCRAM-SHA-512 - - name: KAFKA_SSL_CAFILE - value: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt - - name: DJANGO_POSTGRES_PORTS - value: '5432' - - name: ALLOWED_HOSTS - value: '*' - - name: USE_SSL_FOR_URL_SERIALIZATION - value: '0' - - name: SERVER_REPLACE_HOST - value: '1' - - name: SERVER_JWT_PROXY - value: '1' - - name: PDM_SYNC - value: '1' + values: + services: + celery: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1 + envs: + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: CC_PATH + value: + _default: /usr/local/bin/CloudCompare + - name: CC_COMPARISONS_BASE_DIR + value: + _default: /tmp + - name: AWS_S3_ENDPOINT_URL + value: + _default: http://minio-service.minio.svc.cluster.local:9000 + - name: PCVT_PATH + value: + _default: /usr/local/bin/PotreeConverter + - name: POTREE_CONVERTER_PATH + value: + _default: /usr/local/bin/PotreeConverter + - name: WORKFLOWS_BASE_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: WORKFLOWS_HOST + value: + _default: https://sarex.dsinv.ru + - name: SERVER_CACHE_ENABLED + value: + _default: "True" + - name: SERVER_API_HOST + value: + _default: https://sarex.dsinv.ru + - name: SERVER_VERIFY_SSL + value: + _default: "False" + - name: SERVER_HOST + value: + _default: https://sarex.dsinv.ru + - name: S3_HOST + value: + _default: http://minio-service.minio.svc.cluster.local:9000 + - name: MEASUREMENTS_USE_MEASUREMENTS + value: + _default: "1" + - name: MEASUREMENTS_HOST + value: + _default: http://measurements-service.measurements.svc.cluster.local:8000/api + - name: SERVER_USE_DJANGO_STORAGE + value: + _default: "1" + - name: SERVER_DJANGO_URLS + value: + _default: "1" + - name: CACHE_HOST + value: + _default: redis.pm.svc.cluster.local + - name: SERVER_DONSTROI_STYLE + value: + _default: "True" + - name: SERVER_S3_STREAM_IMPORT + value: + _default: "1" + - name: WORKFLOWS_USE + value: + _default: "1" + - name: WORKFLOWS_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: CELERY_REDIS_HOST + value: + _default: redis-service + - name: CELERY_RABBITMQ_HOST + value: + _default: rabbitmq-service.django.svc.cluster.local + - name: DJANGO_POSTGRES_HOST + value: + _default: postgres-service + - name: SERVER_KAFKA_ENABLED + value: + _default: "True" + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]' + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: SSL + - name: KAFKA_SASL_MECHANISM + value: + _default: SCRAM-SHA-512 + - name: KAFKA_SSL_CAFILE + value: + _default: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt + - name: DJANGO_POSTGRES_PORTS + value: + _default: "5432" + - name: ALLOWED_HOSTS + value: + _default: "*" + - name: USE_SSL_FOR_URL_SERIALIZATION + value: + _default: "0" + - name: SERVER_REPLACE_HOST + value: + _default: "1" + - name: SERVER_JWT_PROXY + value: + _default: "1" + - name: PDM_SYNC + value: + _default: "1" diff --git a/apps/django/dsinv/frontend.yaml b/apps/django/dsinv/frontend.yaml index 7010cc6..87764b6 100644 --- a/apps/django/dsinv/frontend.yaml +++ b/apps/django/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: django spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.15.7 + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.15.7 diff --git a/apps/django/dsinv/kustomization.yaml b/apps/django/dsinv/kustomization.yaml index cc8d355..02448fb 100644 --- a/apps/django/dsinv/kustomization.yaml +++ b/apps/django/dsinv/kustomization.yaml @@ -8,13 +8,13 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend - path: celery.yaml target: - kind: Deployment + kind: HelmRelease name: celery - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend diff --git a/apps/django/yc-k8s-test/kustomization.yaml b/apps/django/yc-k8s-test/kustomization.yaml index c4a2c03..e601931 100644 --- a/apps/django/yc-k8s-test/kustomization.yaml +++ b/apps/django/yc-k8s-test/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization resources: - ../base - postgresql.yaml - - redis-deployment.yaml - - redis-service.yaml patches: [] diff --git a/apps/documentations/base/api-deployment.yaml b/apps/documentations/base/api-deployment.yaml deleted file mode 100644 index 6936e09..0000000 --- a/apps/documentations/base/api-deployment.yaml +++ /dev/null @@ -1,173 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: documentations-api - namespace: documentations - labels: - app: documentations-api - service: documentations-api -spec: - replicas: 1 - selector: - matchLabels: - app: documentations-api - template: - metadata: - labels: - app: documentations-api - service: documentations-api - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: documentations - vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/postgresql/apps/documentations - vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/documentations" -}} - POSTGRES_ADDRESS=postgresql.documentations.svc.cluster.local - POSTGRES_PORT=5432 - POSTGRES_DB=documentations_db - POSTGRES_USER={{ index .Data.data "username" }} - POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-common: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_BASIC_AUTH={{ index .Data.data "key" }} - DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }} - DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - {{ index .Data.data "documentations_s3_service_account_json" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - {{ index .Data.data "documentations_zitadel_account_json" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: documentations-vault - containers: - - name: documentations-api - image: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql - [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common - [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" - set +a - exec /app/entrypoint.sh - ports: - - name: http - containerPort: 8080 - protocol: TCP - env: - - name: POSTGRES_POOL_SIZE - value: "20" - - name: ZITADEL_ACCOUNT - value: /vault/secrets/documentations-zitadel-account-json - - name: ZITADEL_DOMAIN - value: zitadel-srx.wb.ru - - name: USE_ZITADEL - value: "0" - - name: FLOWS_URL - value: http://backend-svc.flows.svc.cluster.local:80 - - name: LAST_MASTER_BIM - value: "36311" - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES - value: "5" - - name: ENABLE_SQL_QUERY - value: "0" - - name: ENABLE_SSL - value: "0" - - name: WORKSPACE_V2_EXTERNAL_URL - value: https://sarex.contour.infra.sarex.tech/workspaces-v2/ - - name: ENABLE_S3 - value: "1" - - name: CONTAINER_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: ENVIRONMENT - value: production - - name: LAST_SLAVE_1_BIM - value: "1000000" - - name: HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80 - - name: FILE_STREAM_HOST - value: sarex.contour.infra.sarex.tech - - name: DOCUMENTATION_URL - value: http://documentations-api.documentations.svc.cluster.local:80/ - - name: WORKFLOW_URL - value: http://backend-svc.processing.svc.cluster.local:80/ - - name: WORKSPACE_URL - value: http://backend-svc.workspaces.svc.cluster.local:80/ - - name: BIM_API_URL - value: http://bim-api-service.bim.svc.cluster.local:8080/ - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: SYSTEM_LOG_URL - value: http://backend-svc.system-log.svc.cluster.local:80 - - name: DJANGO_HOST - value: http://backend-svc.django.svc.cluster.local:80 - - name: MARKS_PROCESSING_URL - value: http://marks-service:8000 - - name: PUBLIC_LINK_HOST - value: https://document-link-srx.wb.ru - - name: NAMESPACE - value: documentations - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: S3_SERVICE_ACCOUNT - value: /vault/secrets/documentations-s3-account-json - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: ENABLE_SMTP - value: "True" - - name: ENABLE_MAILGUN - value: "False" - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: ENABLE_AUTH_JWT_IN_URL - value: "true" - - name: ENABLE_SIGNATURE_IN_URL - value: "false" - - name: USE_CACHE_IN_FILE_STREAMER - value: "0" - - name: VALKEY_ADDR - value: redis:6379 - - name: VALKEY_HOST - value: redis - - name: VALKEY_PORT - value: "6379" - - resources: - requests: - cpu: "25m" - memory: 128Mi - - imagePullSecrets: - - name: regcred diff --git a/apps/documentations/base/api-service.yaml b/apps/documentations/base/api-service.yaml deleted file mode 100644 index de58aea..0000000 --- a/apps/documentations/base/api-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-api-svc - namespace: documentations -spec: - type: ClusterIP - selector: - app: documentations-api - ports: - - name: http - port: 80 - targetPort: 8080 - protocol: TCP diff --git a/apps/documentations/base/api.yaml b/apps/documentations/base/api.yaml new file mode 100644 index 0000000..c0470f8 --- /dev/null +++ b/apps/documentations/base/api.yaml @@ -0,0 +1,260 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-api + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: documentations-vault + deployment: + enabled: true + name: + _default: documentations-api + replicaCount: + _default: 1 + port: + _default: 8080 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql + [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common + [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" + set +a + exec /app/entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-api-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8080 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: ZITADEL_ACCOUNT + value: + _default: /vault/secrets/documentations-zitadel-account-json + - name: ZITADEL_DOMAIN + value: + _default: zitadel-srx.wb.ru + - name: USE_ZITADEL + value: + _default: "0" + - name: FLOWS_URL + value: + _default: http://backend-svc.flows.svc.cluster.local:80 + - name: LAST_MASTER_BIM + value: + _default: "36311" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: WORKSPACE_V2_EXTERNAL_URL + value: + _default: https://sarex.contour.infra.sarex.tech/workspaces-v2/ + - name: ENABLE_S3 + value: + _default: "1" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: LAST_SLAVE_1_BIM + value: + _default: "1000000" + - name: HOST + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80 + - name: FILE_STREAM_HOST + value: + _default: sarex.contour.infra.sarex.tech + - name: DOCUMENTATION_URL + value: + _default: http://documentations-api.documentations.svc.cluster.local:80/ + - name: WORKFLOW_URL + value: + _default: http://backend-svc.processing.svc.cluster.local:80/ + - name: WORKSPACE_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + - name: BIM_API_URL + value: + _default: http://bim-api-service.bim.svc.cluster.local:8080/ + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: SYSTEM_LOG_URL + value: + _default: http://backend-svc.system-log.svc.cluster.local:80 + - name: DJANGO_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: MARKS_PROCESSING_URL + value: + _default: http://marks-service:8000 + - name: PUBLIC_LINK_HOST + value: + _default: https://document-link-srx.wb.ru + - name: NAMESPACE + value: + _default: documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: S3_SERVICE_ACCOUNT + value: + _default: /vault/secrets/documentations-s3-account-json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: ENABLE_SMTP + value: + _default: "True" + - name: ENABLE_MAILGUN + value: + _default: "False" + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET + value: + _default: "mock" + - name: ENABLE_AUTH_JWT_IN_URL + value: + _default: "true" + - name: ENABLE_SIGNATURE_IN_URL + value: + _default: "false" + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "0" + - name: VALKEY_ADDR + value: + _default: redis:6379 + - name: VALKEY_HOST + value: + _default: redis + - name: VALKEY_PORT + value: + _default: "6379" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} + POSTGRES_USER={{ index .Data.data "username" }} + POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-common: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_BASIC_AUTH={{ index .Data.data "key" }} + DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + {{ index .Data.data "documentations_s3_service_account_json" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + {{ index .Data.data "documentations_zitadel_account_json" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} diff --git a/apps/documentations/base/filestream-deployment.yaml b/apps/documentations/base/filestream-deployment.yaml deleted file mode 100644 index 7111545..0000000 --- a/apps/documentations/base/filestream-deployment.yaml +++ /dev/null @@ -1,173 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: documentations-filestream - namespace: documentations - labels: - app: documentations-filestream - service: documentations-filestream -spec: - replicas: 1 - selector: - matchLabels: - app: documentations-filestream - template: - metadata: - labels: - app: documentations-filestream - service: documentations-filestream - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: documentations - vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/postgresql/apps/documentations - vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/documentations" -}} - POSTGRES_ADDRESS=postgresql.documentations.svc.cluster.local - POSTGRES_PORT=5432 - POSTGRES_DB=documentations_db - POSTGRES_USER={{ index .Data.data "username" }} - POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-common: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_BASIC_AUTH={{ index .Data.data "key" }} - DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }} - DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - {{ index .Data.data "documentations_s3_service_account_json" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - {{ index .Data.data "documentations_zitadel_account_json" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: documentations-vault - containers: - - name: documentations-filestream - image: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql - [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common - [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" - set +a - exec /app/file_entrypoint.sh - ports: - - name: http - containerPort: 8080 - protocol: TCP - env: - - name: POSTGRES_POOL_SIZE - value: "20" - - name: ZITADEL_ACCOUNT - value: /vault/secrets/documentations-zitadel-account-json - - name: ZITADEL_DOMAIN - value: zitadel-srx.wb.ru - - name: USE_ZITADEL - value: "0" - - name: FLOWS_URL - value: http://backend-svc.flows.svc.cluster.local:80 - - name: LAST_MASTER_BIM - value: "36311" - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES - value: "5" - - name: ENABLE_SQL_QUERY - value: "0" - - name: ENABLE_SSL - value: "0" - - name: WORKSPACE_V2_EXTERNAL_URL - value: https://srx.wb.ru/workspaces-v2/ - - name: ENABLE_S3 - value: "1" - - name: CONTAINER_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: ENVIRONMENT - value: production - - name: LAST_SLAVE_1_BIM - value: "1000000" - - name: HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80 - - name: FILE_STREAM_HOST - value: srx.wb.ru - - name: DOCUMENTATION_URL - value: http://backend-api-svc.documentations.svc.cluster.local:80/ - - name: WORKFLOW_URL - value: http://workflows-api-service.workflow.svc.cluster.local:8000/ - - name: WORKSPACE_URL - value: http://backend-svc.workspaces.svc.cluster.local:80/ - - name: BIM_API_URL - value: http://bim-api-service.bim.svc.cluster.local:8080/ - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: SYSTEM_LOG_URL - value: http://api-service.system-log.svc.cluster.local:80 - - name: DJANGO_HOST - value: http://backend-svc.django.svc.cluster.local:80 - - name: MARKS_PROCESSING_URL - value: http://marks-service:8000 - - name: PUBLIC_LINK_HOST - value: https://document-link-srx.wb.ru - - name: NAMESPACE - value: documentations - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: S3_SERVICE_ACCOUNT - value: /vault/secrets/documentations-s3-account-json - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: ENABLE_SMTP - value: "True" - - name: ENABLE_MAILGUN - value: "False" - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: ENABLE_AUTH_JWT_IN_URL - value: "false" - - name: ENABLE_SIGNATURE_IN_URL - value: "true" - - name: USE_CACHE_IN_FILE_STREAMER - value: "0" - - name: VALKEY_ADDR - value: redis:6379 - - name: VALKEY_HOST - value: redis - - name: VALKEY_PORT - value: "6379" - - resources: - requests: - cpu: "25m" - memory: 128Mi - - imagePullSecrets: - - name: regcred diff --git a/apps/documentations/base/filestream-service.yaml b/apps/documentations/base/filestream-service.yaml deleted file mode 100644 index 5d16767..0000000 --- a/apps/documentations/base/filestream-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-filestream-svc - namespace: documentations -spec: - type: ClusterIP - selector: - app: documentations-filestream - ports: - - name: http - port: 80 - targetPort: 8080 - protocol: TCP diff --git a/apps/documentations/base/filestream.yaml b/apps/documentations/base/filestream.yaml new file mode 100644 index 0000000..c72314d --- /dev/null +++ b/apps/documentations/base/filestream.yaml @@ -0,0 +1,260 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-filestream + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: documentations-vault + deployment: + enabled: true + name: + _default: documentations-filestream + replicaCount: + _default: 1 + port: + _default: 8080 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql + [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common + [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" + set +a + exec /app/file_entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-filestream-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8080 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: ZITADEL_ACCOUNT + value: + _default: /vault/secrets/documentations-zitadel-account-json + - name: ZITADEL_DOMAIN + value: + _default: zitadel-srx.wb.ru + - name: USE_ZITADEL + value: + _default: "0" + - name: FLOWS_URL + value: + _default: http://backend-svc.flows.svc.cluster.local:80 + - name: LAST_MASTER_BIM + value: + _default: "36311" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: WORKSPACE_V2_EXTERNAL_URL + value: + _default: https://srx.wb.ru/workspaces-v2/ + - name: ENABLE_S3 + value: + _default: "1" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: LAST_SLAVE_1_BIM + value: + _default: "1000000" + - name: HOST + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80 + - name: FILE_STREAM_HOST + value: + _default: srx.wb.ru + - name: DOCUMENTATION_URL + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80/ + - name: WORKFLOW_URL + value: + _default: http://workflows-api-service.workflow.svc.cluster.local:8000/ + - name: WORKSPACE_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + - name: BIM_API_URL + value: + _default: http://bim-api-service.bim.svc.cluster.local:8080/ + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: SYSTEM_LOG_URL + value: + _default: http://api-service.system-log.svc.cluster.local:80 + - name: DJANGO_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: MARKS_PROCESSING_URL + value: + _default: http://marks-service:8000 + - name: PUBLIC_LINK_HOST + value: + _default: https://document-link-srx.wb.ru + - name: NAMESPACE + value: + _default: documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: S3_SERVICE_ACCOUNT + value: + _default: /vault/secrets/documentations-s3-account-json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: ENABLE_SMTP + value: + _default: "True" + - name: ENABLE_MAILGUN + value: + _default: "False" + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: ENABLE_AUTH_JWT_IN_URL + value: + _default: "false" + - name: ENABLE_SIGNATURE_IN_URL + value: + _default: "true" + - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET + value: + _default: "mock" + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "0" + - name: VALKEY_ADDR + value: + _default: redis:6379 + - name: VALKEY_HOST + value: + _default: redis + - name: VALKEY_PORT + value: + _default: "6379" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} + POSTGRES_USER={{ index .Data.data "username" }} + POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-common: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_BASIC_AUTH={{ index .Data.data "key" }} + DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + {{ index .Data.data "documentations_s3_service_account_json" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + {{ index .Data.data "documentations_zitadel_account_json" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} diff --git a/apps/documentations/base/frontend-deployment.yaml b/apps/documentations/base/frontend-deployment.yaml deleted file mode 100644 index 182ab5c..0000000 --- a/apps/documentations/base/frontend-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: documentations - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ae1bb076 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/documentations/base/frontend-service.yaml b/apps/documentations/base/frontend-service.yaml deleted file mode 100644 index 3b8eb8d..0000000 --- a/apps/documentations/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: documentations -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/documentations/base/frontend.yaml b/apps/documentations/base/frontend.yaml new file mode 100644 index 0000000..2698745 --- /dev/null +++ b/apps/documentations/base/frontend.yaml @@ -0,0 +1,70 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + frontend: + enabled: true + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ae1bb076 + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + name: + _default: frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + service: + enabled: true + name: + _default: frontend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/documentations/base/kustomization.yaml b/apps/documentations/base/kustomization.yaml index 2f212c2..d15ef61 100644 --- a/apps/documentations/base/kustomization.yaml +++ b/apps/documentations/base/kustomization.yaml @@ -4,12 +4,9 @@ kind: Kustomization namespace: documentations resources: - namespace.yaml - - serviceaccount.yaml - - api-deployment.yaml - - pdm-deployment.yaml - - filestream-deployment.yaml - - frontend-deployment.yaml - - api-service.yaml - - pdm-service.yaml - - filestream-service.yaml - - frontend-service.yaml + - api.yaml + - filestream.yaml + - frontend.yaml + - pdm.yaml + - redis-deployment.yaml + - redis-service.yaml diff --git a/apps/documentations/base/namespace.yaml b/apps/documentations/base/namespace.yaml index 1f0a0fd..5dff44f 100644 --- a/apps/documentations/base/namespace.yaml +++ b/apps/documentations/base/namespace.yaml @@ -5,3 +5,4 @@ metadata: name: documentations labels: istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/documentations/base/pdm-deployment.yaml b/apps/documentations/base/pdm-deployment.yaml deleted file mode 100644 index 3266161..0000000 --- a/apps/documentations/base/pdm-deployment.yaml +++ /dev/null @@ -1,181 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: pdm-api - namespace: documentations - labels: - app: pdm-api - service: pdm-api -spec: - replicas: 1 - selector: - matchLabels: - app: pdm-api - template: - metadata: - labels: - app: pdm-api - service: pdm-api - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: documentations - vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/postgresql/apps/documentations - vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/documentations" -}} - POSTGRES_ADDRESS=postgresql.documentations.svc.cluster.local - POSTGRES_PORT=5432 - POSTGRES_DB=documentations_db - POSTGRES_USER={{ index .Data.data "username" }} - POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-common: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_BASIC_AUTH={{ index .Data.data "key" }} - RELEASES_TOKEN={{ index .Data.data "documentations_releases_token" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - {{ index .Data.data "documentations_s3_service_account_json" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: documentations-vault - containers: - - name: pdm-api - image: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql - [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common - [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" - set +a - exec ./httpserver - ports: - - name: http - containerPort: 8080 - protocol: TCP - env: - - name: USE_EXPERIMENTAL - value: "true" - - name: POSTGRES_POOL_SIZE - value: "20" - - name: TRANSMITTALS_BASE_URL - value: mock - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: BUCKET_NAME - value: attachments-storage - - name: API_HOST_PREFIX - value: / - - name: APP_NAME - value: pdm_v2 - - name: APP_VERSION - value: 0.0.1 - - name: ENABLE_PERMISSIONS_FILTER - value: "1" - - name: PERMISSIONS_FILTER_COMPANIES - value: '[1]' - - name: TRANSMITTALS_ENABLE - value: "false" - - name: DRAWINGS_INTERNAL_URL - value: http://drawings-api-service.drawings.svc.cluster.local:80 - - name: ATTACHMENTS_URL - value: http://attachments-service.attachments.svc.cluster.local:8000 - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: BIM_V2_HOST - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: DJANGO_HOST - value: http://backend-svc.django.svc.cluster.local:80 - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: DOCUMENTATION_URL - value: http://backend-api-svc.documentations.svc.cluster.local:80/ - - name: EAV_URL - value: http://backend-svc.eav.svc.cluster.local:80 - - name: ENABLE_OBSERVABILITY - value: "false" - - name: ENABLE_S3 - value: "1" - - name: ENABLE_SSL - value: "0" - - name: ENVIRONMENT - value: prod - - name: FLOWS_URL - value: http://backend-svc.flows.svc.cluster.local:80 - - name: HEIGHT_THUMB_ATTACHMENTS - value: "300" - - name: HEIGHT_THUMB_STATES - value: "73" - - name: HTTP_PORT - value: "8080" - - name: INSPECTIONS_URL - value: http://inspections-service.inspections.svc.cluster.local:80 - - name: LOG_LEVEL - value: INFO - - name: NOTES_URL - - name: OBSERVABILITY_COLLECTOR_ENDPOINT - value: temp - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: RELEASES_URL - value: https://gitlab.com - - name: REMARKS_URL - value: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks - - name: RESOURCES_URL - value: http://backend-svc.resources.svc.cluster.local:80 - - name: S3_SERVICE_ACCOUNT - value: /vault/secrets/documentations-s3-account-json - - name: STATES_URL - value: http://backend-svc.workspaces.svc.cluster.local:80/ - - name: SUBSCRIPTIONS_URL - value: http://backend-svc.subscriptions.svc.cluster.local:80 - - name: SYSTEM_LOG_URL - value: http://api-service.system-log.svc.cluster.local:80 - - name: TARGET_URL - value: http://backend-svc.django.svc.cluster.local:80 - - name: USE_CACHE_IN_FILE_STREAMER - value: "1" - - name: USE_SUBSCRIPTIONS - value: "false" - - name: WIDTH_THUMB_ATTACHMENTS - value: "300" - - name: WIDTH_THUMB_STATES - value: "120" - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKFLOW_URL - value: http://backend-svc.processing.svc.cluster.local:80/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: WORKSPACE_URL - value: http://backend-svc.workspaces.svc.cluster.local:80/ - resources: - requests: - cpu: "25m" - memory: 128Mi - - imagePullSecrets: - - name: regcred diff --git a/apps/documentations/base/pdm-service.yaml b/apps/documentations/base/pdm-service.yaml deleted file mode 100644 index b978673..0000000 --- a/apps/documentations/base/pdm-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: pdm-svc - namespace: documentations -spec: - type: ClusterIP - selector: - app: pdm-api - ports: - - name: http - port: 80 - targetPort: 8080 - protocol: TCP diff --git a/apps/documentations/base/pdm.yaml b/apps/documentations/base/pdm.yaml new file mode 100644 index 0000000..b86f0ba --- /dev/null +++ b/apps/documentations/base/pdm.yaml @@ -0,0 +1,278 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: pdm-api + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: documentations-vault + deployment: + enabled: true + name: + _default: pdm-api + replicaCount: + _default: 1 + port: + _default: 8080 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql + [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common + [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" + set +a + exec ./httpserver + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: pdm-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8080 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: USE_EXPERIMENTAL + value: + _default: "true" + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: TRANSMITTALS_BASE_URL + value: + _default: mock + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: BUCKET_NAME + value: + _default: attachments-storage + - name: API_HOST_PREFIX + value: + _default: / + - name: APP_NAME + value: + _default: pdm_v2 + - name: APP_VERSION + value: + _default: "0.0.1" + - name: ENABLE_PERMISSIONS_FILTER + value: + _default: "1" + - name: PERMISSIONS_FILTER_COMPANIES + value: + _default: "[1]" + - name: TRANSMITTALS_ENABLE + value: + _default: "false" + - name: DRAWINGS_INTERNAL_URL + value: + _default: http://drawings-api-service.drawings.svc.cluster.local:80 + - name: ATTACHMENTS_URL + value: + _default: http://attachments-service.attachments.svc.cluster.local:8000 + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: BIM_V2_HOST + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: DJANGO_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: DOCUMENTATION_URL + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80/ + - name: EAV_URL + value: + _default: http://backend-svc.eav.svc.cluster.local:80 + - name: ENABLE_OBSERVABILITY + value: + _default: "false" + - name: ENABLE_S3 + value: + _default: "1" + - name: ENABLE_SSL + value: + _default: "0" + - name: ENVIRONMENT + value: + _default: prod + - name: FLOWS_URL + value: + _default: http://backend-svc.flows.svc.cluster.local:80 + - name: HEIGHT_THUMB_ATTACHMENTS + value: + _default: "300" + - name: HEIGHT_THUMB_STATES + value: + _default: "73" + - name: HTTP_PORT + value: + _default: "8080" + - name: INSPECTIONS_URL + value: + _default: http://inspections-service.inspections.svc.cluster.local:80 + - name: LOG_LEVEL + value: + _default: INFO + - name: NOTES_URL + value: + _default: "" + - name: OBSERVABILITY_COLLECTOR_ENDPOINT + value: + _default: temp + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: RELEASES_URL + value: + _default: https://gitlab.com + - name: REMARKS_URL + value: + _default: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks + - name: RESOURCES_URL + value: + _default: http://iam-backend.iam.svc.cluster.local:8000 + - name: S3_SERVICE_ACCOUNT + value: + _default: /vault/secrets/documentations-s3-account-json + - name: STATES_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + - name: SUBSCRIPTIONS_URL + value: + _default: http://backend-svc.subscriptions.svc.cluster.local:80 + - name: SYSTEM_LOG_URL + value: + _default: http://api-service.system-log.svc.cluster.local:80 + - name: TARGET_URL + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "1" + - name: USE_SUBSCRIPTIONS + value: + _default: "false" + - name: WIDTH_THUMB_ATTACHMENTS + value: + _default: "300" + - name: WIDTH_THUMB_STATES + value: + _default: "120" + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: RELEASES_TOKEN + value: + _default: "mock" + - name: WORKFLOW_URL + value: + _default: http://backend-svc.processing.svc.cluster.local:80/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: WORKSPACE_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} + POSTGRES_USER={{ index .Data.data "username" }} + POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-common: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_BASIC_AUTH={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + {{ index .Data.data "documentations_s3_service_account_json" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} diff --git a/apps/documentations/yc-k8s-test/redis-deployment.yaml b/apps/documentations/base/redis-deployment.yaml similarity index 100% rename from apps/documentations/yc-k8s-test/redis-deployment.yaml rename to apps/documentations/base/redis-deployment.yaml diff --git a/apps/documentations/yc-k8s-test/redis-service.yaml b/apps/documentations/base/redis-service.yaml similarity index 100% rename from apps/documentations/yc-k8s-test/redis-service.yaml rename to apps/documentations/base/redis-service.yaml diff --git a/apps/documentations/base/serviceaccount.yaml b/apps/documentations/base/serviceaccount.yaml deleted file mode 100644 index ba21e50..0000000 --- a/apps/documentations/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: documentations-vault - namespace: documentations diff --git a/apps/documentations/d8-ugmk-prod/kustomization.yaml b/apps/documentations/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..87e17f7 --- /dev/null +++ b/apps/documentations/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: documentations +resources: + - ../base \ No newline at end of file diff --git a/apps/documentations/dsinv/documentations-api.yaml b/apps/documentations/dsinv/documentations-api.yaml index 6e6b760..5e73f0d 100644 --- a/apps/documentations/dsinv/documentations-api.yaml +++ b/apps/documentations/dsinv/documentations-api.yaml @@ -1,110 +1,161 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: documentations-api namespace: documentations spec: - replicas: 4 - template: - spec: - containers: - - name: documentations-api - image: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_54880e92 - env: - - name: PUBLIC_LINK_HOST - value: https://document-link.sarex.dsinv.ru - - name: POSTGRES_ADDRESS - value: postgres-service - - name: POSTGRES_PORT - value: '5432' - - name: POSTGRES_DB - value: documentations - - name: POSTGRES_POOL_SIZE - value: '20' - - name: LAST_MASTER_BIM - value: '36311' - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: ENABLE_SQL_QUERY - value: '0' - - name: ENABLE_SSL - value: '0' - - name: ENABLE_MAILGUN - value: 'false' - - name: ENABLE_SMTP - value: 'true' - - name: ENABLE_S3 - value: '1' - - name: USE_BIM_INSERTER - value: '0' - - name: CONTAINER_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: ENVIRONMENT - value: production - - name: HOST - value: http://documentations-service.documentations.svc.cluster.local:8080 - - name: FILE_STREAM_HOST - value: sarex.dsinv.ru - - name: DOCUMENTATION_URL - value: http://documentations-service.documentations.svc.cluster.local:8080/ - - name: WORKFLOW_URL - value: http://workflows-service.workflow.svc.cluster.local:8000/ - - name: WORKSPACE_URL - value: http://workspaces-service.workspaces.svc.cluster.local:8000/ - - name: BIM_API_URL - value: http://bim-api-service.bim.svc.cluster.local:8080/ - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: SYSTEM_LOG_URL - value: http://api-service.system-log.svc.cluster.local:8000 - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: MARKS_PROCESSING_URL - value: http://marks-service.documentations.svc.cluster.local:8000 - - name: NAMESPACE - value: documentations - - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES - value: '5' - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKSPACE_V2_EXTERNAL_URL - value: https://sarex.dsinv.ru/workspaces-v2/ - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: FLOWS_URL - value: http://backend-service.flows.svc.cluster.local:8000 - - name: S3_SERVICE_ACCOUNT - value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: USE_CACHE_IN_FILE_STREAMER - value: '1' - - name: IS_CONVERTED_PDF_UPLOADING_TO_S3 - value: 'false' - - name: TRACER_USE - value: '0' - - name: TRACER_HOST - value: signoz-otel-collector-external.signoz.svc.cluster.local:4317 - - name: SERVICE_NAME - value: documentations-api.documentations-prod - - name: SERVICE_NAME_FILESTREAM - value: filestream-api.documentations-prod - - name: TRACER_USE_INSECURE - value: '1' - - name: DELETE_S3D_AFTER_MESHOPT - value: 'true' - - name: CONVERT_DWG_TO_GEOJSON - value: 'false' - - name: CONVERT_DXF_TO_GEOJSON - value: 'false' + values: + services: + backend: + deployment: + replicaCount: + _default: 4 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_54880e92 + envs: + - name: PUBLIC_LINK_HOST + value: + _default: https://document-link.sarex.dsinv.ru + - name: POSTGRES_ADDRESS + value: + _default: postgres-service + - name: POSTGRES_PORT + value: + _default: "5432" + - name: POSTGRES_DB + value: + _default: documentations + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: LAST_MASTER_BIM + value: + _default: "36311" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: ENABLE_MAILGUN + value: + _default: "false" + - name: ENABLE_SMTP + value: + _default: "true" + - name: ENABLE_S3 + value: + _default: "1" + - name: USE_BIM_INSERTER + value: + _default: "0" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: HOST + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080 + - name: FILE_STREAM_HOST + value: + _default: sarex.dsinv.ru + - name: DOCUMENTATION_URL + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080/ + - name: WORKFLOW_URL + value: + _default: http://workflows-service.workflow.svc.cluster.local:8000/ + - name: WORKSPACE_URL + value: + _default: http://workspaces-service.workspaces.svc.cluster.local:8000/ + - name: BIM_API_URL + value: + _default: http://bim-api-service.bim.svc.cluster.local:8080/ + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: SYSTEM_LOG_URL + value: + _default: http://api-service.system-log.svc.cluster.local:8000 + - name: DJANGO_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: MARKS_PROCESSING_URL + value: + _default: http://marks-service.documentations.svc.cluster.local:8000 + - name: NAMESPACE + value: + _default: documentations + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKSPACE_V2_EXTERNAL_URL + value: + _default: https://sarex.dsinv.ru/workspaces-v2/ + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: FLOWS_URL + value: + _default: http://backend-service.flows.svc.cluster.local:8000 + - name: S3_SERVICE_ACCOUNT + value: + _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "1" + - name: IS_CONVERTED_PDF_UPLOADING_TO_S3 + value: + _default: "false" + - name: TRACER_USE + value: + _default: "0" + - name: TRACER_HOST + value: + _default: signoz-otel-collector-external.signoz.svc.cluster.local:4317 + - name: SERVICE_NAME + value: + _default: documentations-api.documentations-prod + - name: SERVICE_NAME_FILESTREAM + value: + _default: filestream-api.documentations-prod + - name: TRACER_USE_INSECURE + value: + _default: "1" + - name: DELETE_S3D_AFTER_MESHOPT + value: + _default: "true" + - name: CONVERT_DWG_TO_GEOJSON + value: + _default: "false" + - name: CONVERT_DXF_TO_GEOJSON + value: + _default: "false" diff --git a/apps/documentations/dsinv/documentations-filestream.yaml b/apps/documentations/dsinv/documentations-filestream.yaml index d919e17..1dc68e5 100644 --- a/apps/documentations/dsinv/documentations-filestream.yaml +++ b/apps/documentations/dsinv/documentations-filestream.yaml @@ -1,74 +1,107 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: documentations-filestream namespace: documentations spec: - replicas: 3 - template: - spec: - containers: - - name: documentations-filestream - image: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_54880e92 - env: - - name: POSTGRES_ADDRESS - value: postgres-service - - name: POSTGRES_PORT - value: '5432' - - name: POSTGRES_DB - value: documentations - - name: POSTGRES_POOL_SIZE - value: '20' - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: ENABLE_SQL_QUERY - value: '1' - - name: ENABLE_SSL - value: '0' - - name: ENABLE_S3 - value: '1' - - name: CONTAINER_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: ENVIRONMENT - value: production - - name: HOST - value: http://documentations-service.documentations.svc.cluster.local:8080 - - name: FILE_STREAM_HOST - value: sarex.dsinv.ru - - name: DOCUMENTATION_URL - value: http://documentations-service.documentations.svc.cluster.local:8080/ - - name: WORKFLOW_URL - value: http://workflows-service.workflow.svc.cluster.local:8000/ - - name: WORKSPACE_URL - value: http://workspaces-service.workspaces.svc.cluster.local:8000/ - - name: BIM_API_URL - value: http://bim-api-service.bim.svc.cluster.local:8080/ - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: NAMESPACE - value: sarex-documentations - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES - value: '5' - - name: S3_SERVICE_ACCOUNT - value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: USE_CACHE_IN_FILE_STREAMER - value: '1' + values: + services: + backend: + deployment: + replicaCount: + _default: 3 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_54880e92 + envs: + - name: POSTGRES_ADDRESS + value: + _default: postgres-service + - name: POSTGRES_PORT + value: + _default: "5432" + - name: POSTGRES_DB + value: + _default: documentations + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: ENABLE_SQL_QUERY + value: + _default: "1" + - name: ENABLE_SSL + value: + _default: "0" + - name: ENABLE_S3 + value: + _default: "1" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: HOST + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080 + - name: FILE_STREAM_HOST + value: + _default: sarex.dsinv.ru + - name: DOCUMENTATION_URL + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080/ + - name: WORKFLOW_URL + value: + _default: http://workflows-service.workflow.svc.cluster.local:8000/ + - name: WORKSPACE_URL + value: + _default: http://workspaces-service.workspaces.svc.cluster.local:8000/ + - name: BIM_API_URL + value: + _default: http://bim-api-service.bim.svc.cluster.local:8080/ + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: DJANGO_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: NAMESPACE + value: + _default: sarex-documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: S3_SERVICE_ACCOUNT + value: + _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "1" diff --git a/apps/documentations/dsinv/frontend.yaml b/apps/documentations/dsinv/frontend.yaml index c23d8eb..e93463e 100644 --- a/apps/documentations/dsinv/frontend.yaml +++ b/apps/documentations/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: documentations spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_b80d28d4 + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_b80d28d4 diff --git a/apps/documentations/dsinv/kustomization.yaml b/apps/documentations/dsinv/kustomization.yaml index d2562b9..29ec458 100644 --- a/apps/documentations/dsinv/kustomization.yaml +++ b/apps/documentations/dsinv/kustomization.yaml @@ -10,17 +10,17 @@ resources: patches: - path: documentations-api.yaml target: - kind: Deployment + kind: HelmRelease name: documentations-api - path: documentations-filestream.yaml target: - kind: Deployment + kind: HelmRelease name: documentations-filestream - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend - path: pdm-api.yaml target: - kind: Deployment + kind: HelmRelease name: pdm-api diff --git a/apps/documentations/dsinv/pdm-api.yaml b/apps/documentations/dsinv/pdm-api.yaml index 6fdfc30..643f4b3 100644 --- a/apps/documentations/dsinv/pdm-api.yaml +++ b/apps/documentations/dsinv/pdm-api.yaml @@ -1,120 +1,173 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: pdm-api namespace: documentations spec: - replicas: 3 - template: - spec: - containers: - - name: pdm-api - image: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_542e5343 - env: - - name: OBSERVABILITY_COLLECTOR_ENDPOINT - value: temp - - name: USE_SUBSCRIPTIONS - value: 'false' - - name: RELEASES_URL - value: https://gitlab.com - - name: APP_NAME - value: pdm_v2 - - name: APP_VERSION - value: 0.0.1 - - name: LOG_LEVEL - value: INFO - - name: HTTP_PORT - value: '8080' - - name: POSTGRES_ADDRESS - value: postgres-service.documentations.svc.cluster.local - - name: POSTGRES_PORT - value: '5432' - - name: POSTGRES_DB - value: documentations - - name: POSTGRES_POOL_SIZE - value: '20' - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: ENABLE_OBSERVABILITY - value: 'false' - - name: ENABLE_SSL - value: '0' - - name: ENABLE_S3 - value: '1' - - name: DOCUMENTATION_URL - value: http://documentations-service.documentations.svc.cluster.local:8080/ - - name: WORKFLOW_URL - value: http://workflows-service.workflow.svc.cluster.local:8000/ - - name: WORKSPACE_URL - value: http://workspaces-service.workspaces.svc.cluster.local:8000 - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: BIM_V2_HOST - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: NAMESPACE - value: documentations - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: FLOWS_URL - value: http://backend-service.flows.svc.cluster.local:8000 - - name: RESOURCES_URL - value: http://resources-service.resources.svc.cluster.local:8000 - - name: REMARKS_URL - value: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks - - name: ATTACHMENTS_URL - value: http://attachments-service.attachments.svc.cluster.local:80 - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: INSPECTIONS_URL - value: http://inspections-service.inspections - - name: STATES_URL - value: http://workspaces-service.workspaces.svc.cluster.local:8000/ - - name: WIDTH_THUMB_STATES - value: '120' - - name: HEIGHT_THUMB_STATES - value: '73' - - name: WIDTH_THUMB_ATTACHMENTS - value: '300' - - name: HEIGHT_THUMB_ATTACHMENTS - value: '300' - - name: ENABLE_PERMISSIONS_FILTER - value: '1' - - name: PERMISSIONS_FILTER_COMPANIES - value: '[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]' - - name: SUBSCRIPTIONS_URL - value: http://sarex-subscriptions-service.subscriptions - - name: SYSTEM_LOG_URL - value: http://api-service.system-log.svc.cluster.local:8000 - - name: API_HOST_PREFIX - value: /gateway - - name: TARGET_URL - value: http://backend.django.svc.cluster.local:8000 - - name: EAV_URL - value: http://eav-service.eav.svc.cluster.local:8000 - - name: NOTES_URL - value: http://backend-service.notes.svc.cluster.local:8000 - - name: S3_SERVICE_ACCOUNT - value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: USE_CACHE_IN_FILE_STREAMER - value: '1' - - name: ENVIRONMENT - value: prod - - name: TRANSMITTALS_BASE_URL - value: http://transmittal-service.transmittals.svc.cluster.local:80 + values: + services: + backend: + deployment: + replicaCount: + _default: 3 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_542e5343 + envs: + - name: OBSERVABILITY_COLLECTOR_ENDPOINT + value: + _default: temp + - name: USE_SUBSCRIPTIONS + value: + _default: "false" + - name: RELEASES_URL + value: + _default: https://gitlab.com + - name: APP_NAME + value: + _default: pdm_v2 + - name: APP_VERSION + value: + _default: "0.0.1" + - name: LOG_LEVEL + value: + _default: INFO + - name: HTTP_PORT + value: + _default: "8080" + - name: POSTGRES_ADDRESS + value: + _default: postgres-service.documentations.svc.cluster.local + - name: POSTGRES_PORT + value: + _default: "5432" + - name: POSTGRES_DB + value: + _default: documentations + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: ENABLE_OBSERVABILITY + value: + _default: "false" + - name: ENABLE_SSL + value: + _default: "0" + - name: ENABLE_S3 + value: + _default: "1" + - name: DOCUMENTATION_URL + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080/ + - name: WORKFLOW_URL + value: + _default: http://workflows-service.workflow.svc.cluster.local:8000/ + - name: WORKSPACE_URL + value: + _default: http://workspaces-service.workspaces.svc.cluster.local:8000 + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: BIM_V2_HOST + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: DJANGO_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: NAMESPACE + value: + _default: documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: FLOWS_URL + value: + _default: http://backend-service.flows.svc.cluster.local:8000 + - name: RESOURCES_URL + value: + _default: http://resources-service.resources.svc.cluster.local:8000 + - name: REMARKS_URL + value: + _default: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks + - name: ATTACHMENTS_URL + value: + _default: http://attachments-service.attachments.svc.cluster.local:80 + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: INSPECTIONS_URL + value: + _default: http://inspections-service.inspections + - name: STATES_URL + value: + _default: http://workspaces-service.workspaces.svc.cluster.local:8000/ + - name: WIDTH_THUMB_STATES + value: + _default: "120" + - name: HEIGHT_THUMB_STATES + value: + _default: "73" + - name: WIDTH_THUMB_ATTACHMENTS + value: + _default: "300" + - name: HEIGHT_THUMB_ATTACHMENTS + value: + _default: "300" + - name: ENABLE_PERMISSIONS_FILTER + value: + _default: "1" + - name: PERMISSIONS_FILTER_COMPANIES + value: + _default: "[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]" + - name: SUBSCRIPTIONS_URL + value: + _default: http://sarex-subscriptions-service.subscriptions + - name: SYSTEM_LOG_URL + value: + _default: http://api-service.system-log.svc.cluster.local:8000 + - name: API_HOST_PREFIX + value: + _default: /gateway + - name: TARGET_URL + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: EAV_URL + value: + _default: http://eav-service.eav.svc.cluster.local:8000 + - name: NOTES_URL + value: + _default: http://backend-service.notes.svc.cluster.local:8000 + - name: S3_SERVICE_ACCOUNT + value: + _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "1" + - name: ENVIRONMENT + value: + _default: prod + - name: TRANSMITTALS_BASE_URL + value: + _default: http://transmittal-service.transmittals.svc.cluster.local:80 diff --git a/apps/documentations/yc-k8s-test/kustomization.yaml b/apps/documentations/yc-k8s-test/kustomization.yaml index c4a2c03..e601931 100644 --- a/apps/documentations/yc-k8s-test/kustomization.yaml +++ b/apps/documentations/yc-k8s-test/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization resources: - ../base - postgresql.yaml - - redis-deployment.yaml - - redis-service.yaml patches: [] diff --git a/apps/eav/CONFIGURATION.md b/apps/eav/CONFIGURATION.md index 804ee9b..852bdc6 100644 --- a/apps/eav/CONFIGURATION.md +++ b/apps/eav/CONFIGURATION.md @@ -22,7 +22,7 @@ | Локально (manage.py / uWSGI) | Переменные окружения процесса (`.env` нужно экспортировать вручную) | | Локально (docker-compose) | `docker-compose.yml`: блок `environment` сервиса `backend` + образ `postgres` (timescaledb-postgis) | | Kubernetes (Helm, репозиторий приложения) | `.helm/values-.yaml`: блоки `backend.deployment.envs` (обычные значения) и `backend.deployment.secrets` (из k8s-секретов через `secretKeyRef`); шаблон `templates/server.yaml`, роутинг — `templates/mesh-config.yaml` (Istio VirtualService) | -| Kubernetes (infra, Flux/Kustomize) | `infra/iac/apps/eav/base/backend-deployment.yaml`: секреты инъектируются Vault-агентом (`vault.hashicorp.com/agent-inject-*`) и экспортируются в окружение в `args`; настройки `production.py` монтируются из `django-configmap` | +| Kubernetes (infra, Flux/Kustomize) | `infra/iac/apps/eav/base/helmrelease.yaml` (universal-chart): секреты инъектируются Vault-агентом (`vault.hashicorp.com/agent-inject-*`) и экспортируются в окружение в `args`; настройки `production.py` монтируются из `django-configmap` | | CI/CD (GitLab) | `.gitlab-ci.yml`: общие шаблоны `generic/common-ci`, переменные пайплайна в `workflow.rules` | Способы запуска процессов: @@ -153,7 +153,7 @@ ## Переменные в infra-манифесте (Flux/Kustomize, `infra/iac/apps/eav`) -В отличие от Helm-чарта приложения, боевой деплой Sarex использует Vault-инъекцию (`base/backend-deployment.yaml`). Секреты рендерятся Vault-агентом в файлы `/vault/secrets/*` и экспортируются в окружение в `args` контейнера перед запуском `entrypoint.sh`: +В отличие от Helm-чарта приложения, боевой деплой Sarex использует Vault-инъекцию (`base/helmrelease.yaml`, чарт `universal-chart`). Секреты рендерятся Vault-агентом в файлы `/vault/secrets/*` и экспортируются в окружение в `args` контейнера перед запуском `entrypoint.sh`: | Переменная(ые) | Источник (Vault path) | | --- | --- | diff --git a/apps/eav/base/backend-deployment.yaml b/apps/eav/base/backend-deployment.yaml deleted file mode 100644 index 892bfa7..0000000 --- a/apps/eav/base/backend-deployment.yaml +++ /dev/null @@ -1,117 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: eav - labels: - app: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: eav - vault.hashicorp.com/agent-inject-secret-eav-db: secrets/data/postgresql/apps/eav - vault.hashicorp.com/agent-inject-template-eav-db: |- - {{- with secret "secrets/data/postgresql/apps/eav" -}} - DJANGO_POSTGRES_HOST=postgresql.eav.svc.cluster.local - DJANGO_POSTGRES_PORT=5432 - DJANGO_POSTGRES_DATABASE=eav_db - DJANGO_POSTGRES_USER={{ index .Data.data "username" }} - DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-eav-s3: secrets/data/minio/apps/eav - vault.hashicorp.com/agent-inject-template-eav-s3: |- - {{- with secret "secrets/data/minio/apps/eav" -}} - YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} - YC_S3_BUCKET_NAME=eav - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-eav-jwt-private: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-eav-jwt-private: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "private_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-eav-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-eav-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: eav-vault - volumes: - - name: django-configmap - configMap: - name: django-configmap - items: - - key: production.py - path: production.py - defaultMode: 420 - - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/eav-db ] && . /vault/secrets/eav-db - [ -f /vault/secrets/eav-s3 ] && . /vault/secrets/eav-s3 - [ -f /vault/secrets/eav-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/eav-jwt-private)" - [ -f /vault/secrets/eav-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/eav-jwt-public)" - set +a - exec /server/entrypoint.sh - - ports: - - name: http - containerPort: 8000 - protocol: TCP - - env: - - name: KAFKA_ENABLED - value: "False" - - name: ASSETS_TOPIC - value: sarex - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - resources: - requests: - cpu: 25m - memory: 100Mi - - volumeMounts: - - name: django-configmap - mountPath: /server/config/settings/production.py - subPath: production.py - - livenessProbe: - tcpSocket: - port: 8000 - initialDelaySeconds: 20 - periodSeconds: 30 - timeoutSeconds: 3 - failureThreshold: 5 - - readinessProbe: - tcpSocket: - port: 8000 - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 3 - failureThreshold: 6 - - imagePullSecrets: - - name: regcred diff --git a/apps/eav/base/backend-service.yaml b/apps/eav/base/backend-service.yaml deleted file mode 100644 index d5f5ec3..0000000 --- a/apps/eav/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: eav -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/eav/base/helmrelease.yaml b/apps/eav/base/helmrelease.yaml new file mode 100644 index 0000000..229a21c --- /dev/null +++ b/apps/eav/base/helmrelease.yaml @@ -0,0 +1,176 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: eav +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: eav-vault + deployment: + enabled: true + name: + _default: backend + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/eav-db ] && . /vault/secrets/eav-db + [ -f /vault/secrets/eav-s3 ] && . /vault/secrets/eav-s3 + [ -f /vault/secrets/eav-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/eav-jwt-private)" + [ -f /vault/secrets/eav-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/eav-jwt-public)" + set +a + exec /server/entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: + _default: true + type: + _default: tcpSocket + tcpSocket: + port: + _default: 8000 + initialDelaySeconds: + _default: 20 + periodSeconds: + _default: 30 + timeoutSeconds: + _default: 3 + failureThreshold: + _default: 5 + readiness: + enabled: + _default: true + type: + _default: tcpSocket + tcpSocket: + port: + _default: 8000 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 10 + timeoutSeconds: + _default: 3 + failureThreshold: + _default: 6 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: + _default: + - name: django-configmap + mountPath: + _default: /server/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + envs: + - name: KAFKA_ENABLED + value: + _default: "False" + - name: ASSETS_TOPIC + value: + _default: sarex + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: eav + vault.hashicorp.com/agent-inject-secret-eav-db: secrets/data/apps/eav/postgres + vault.hashicorp.com/agent-inject-template-eav-db: |- + {{- with secret "secrets/data/apps/eav/postgres" -}} + DJANGO_POSTGRES_HOST={{ index .Data.data "host" }} + DJANGO_POSTGRES_PORT={{ index .Data.data "port" }} + DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }} + DJANGO_POSTGRES_USER={{ index .Data.data "username" }} + DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-eav-s3: secrets/data/minio/apps/eav + vault.hashicorp.com/agent-inject-template-eav-s3: |- + {{- with secret "secrets/data/minio/apps/eav" -}} + YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} + YC_S3_BUCKET_NAME=eav + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-eav-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-eav-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-eav-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-eav-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} diff --git a/apps/eav/base/kustomization.yaml b/apps/eav/base/kustomization.yaml index ad9cf5d..4d46352 100644 --- a/apps/eav/base/kustomization.yaml +++ b/apps/eav/base/kustomization.yaml @@ -4,7 +4,5 @@ kind: Kustomization namespace: eav resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml + - helmrelease.yaml - django-configmap.yaml diff --git a/apps/eav/base/namespace.yaml b/apps/eav/base/namespace.yaml index 0587374..2b1ff7b 100644 --- a/apps/eav/base/namespace.yaml +++ b/apps/eav/base/namespace.yaml @@ -5,3 +5,4 @@ metadata: name: eav labels: istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/eav/base/serviceaccount.yaml b/apps/eav/base/serviceaccount.yaml deleted file mode 100644 index c2d7154..0000000 --- a/apps/eav/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: eav-vault - namespace: eav diff --git a/apps/eav/d8-ugmk-prod/kustomization.yaml b/apps/eav/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..c837f1f --- /dev/null +++ b/apps/eav/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: eav +resources: + - ../base \ No newline at end of file diff --git a/apps/eav/dsinv/backend.yaml b/apps/eav/dsinv/backend.yaml index ea240c3..3ab9d92 100644 --- a/apps/eav/dsinv/backend.yaml +++ b/apps/eav/dsinv/backend.yaml @@ -1,27 +1,35 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: eav spec: - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_ddce2b51 - env: - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: ASSETS_TOPIC - value: sarex - - name: KAFKA_SSL_CAFILE - value: /usr/local/share/ca-certificates/ca.crt - - name: DJANGO_POSTGRES_HOST - value: postgres-service - - name: DJANGO_POSTGRES_DATABASE - value: eav_db - - name: YC_S3_ENDPOINT_URL - value: http://minio-service.minio.svc.cluster.local:9000 - - name: YC_S3_BUCKET_NAME - value: eav + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_ddce2b51 + envs: + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: ASSETS_TOPIC + value: + _default: sarex + - name: KAFKA_SSL_CAFILE + value: + _default: /usr/local/share/ca-certificates/ca.crt + - name: DJANGO_POSTGRES_HOST + value: + _default: postgres-service + - name: DJANGO_POSTGRES_DATABASE + value: + _default: eav_db + - name: YC_S3_ENDPOINT_URL + value: + _default: http://minio-service.minio.svc.cluster.local:9000 + - name: YC_S3_BUCKET_NAME + value: + _default: eav diff --git a/apps/eav/dsinv/kustomization.yaml b/apps/eav/dsinv/kustomization.yaml index 0733885..7aa19ef 100644 --- a/apps/eav/dsinv/kustomization.yaml +++ b/apps/eav/dsinv/kustomization.yaml @@ -7,5 +7,5 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend diff --git a/apps/eav/yc-k8s-test/kustomization.yaml b/apps/eav/yc-k8s-test/kustomization.yaml index 050d882..c8f7064 100644 --- a/apps/eav/yc-k8s-test/kustomization.yaml +++ b/apps/eav/yc-k8s-test/kustomization.yaml @@ -7,5 +7,5 @@ resources: patches: - path: replicas.yaml target: - kind: Deployment + kind: HelmRelease name: backend diff --git a/apps/eav/yc-k8s-test/replicas.yaml b/apps/eav/yc-k8s-test/replicas.yaml index bc22003..bd0603a 100644 --- a/apps/eav/yc-k8s-test/replicas.yaml +++ b/apps/eav/yc-k8s-test/replicas.yaml @@ -1,8 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: eav spec: - replicas: 1 + values: + services: + backend: + deployment: + replicaCount: + _default: 1 diff --git a/apps/iam/base/backend.yaml b/apps/iam/base/backend.yaml new file mode 100644 index 0000000..df0feef --- /dev/null +++ b/apps/iam/base/backend.yaml @@ -0,0 +1,214 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: iam-backend + namespace: iam + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: iam-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: iam-backend + + replicaCount: + _default: 1 + production: 4 + + port: + _default: 8080 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/iam-db ] && . /vault/secrets/iam-db + [ -f /vault/secrets/iam-zitadel ] && . /vault/secrets/iam-zitadel + [ -f /vault/secrets/iam-kafka ] && . /vault/secrets/iam-kafka + [ -f /vault/secrets/iam-s3 ] && . /vault/secrets/iam-s3 + set +a + exec ./server + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: iam-backend + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + labels: + monitoring: prometheus + + envs: + - name: ENVIRONMENT + value: + _default: "prod" + + - name: LOG_LEVEL + value: + _default: "debug" + + - name: AUTH_ENABLED + value: + _default: "true" + + - name: HTTP_PORT + value: + _default: "8080" + + - name: HTTP_READ_BUFFER_SIZE + value: + _default: "131072" + + - name: DB_MIGRATIONS_PATH + value: + _default: "migrations" + + - name: ZITADEL_ENABLED + value: + _default: "false" + + - name: ZITADEL_HOST + value: + _default: "https://login.sarex.io" + + - name: ZITADEL_ORG_RULES_FILE + value: + _default: "config/zitadel/org-rules-prod.json" + + - name: S3_ENABLED + value: + _default: "true" + + - name: S3_ENDPOINT_URL + value: + _default: "https://storage.yandexcloud.net" + + - name: S3_BUCKET_NAME + value: + _default: "sarex-media-storage" + + - name: S3_REGION + value: + _default: "ru-central1" + + - name: S3_PRESIGN_EXPIRES + value: + _default: "1h" + + - name: KAFKA_ENABLED + value: + _default: "false" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/etc/ca-certificates/Yandex/ca-cert" + + - name: KAFKA_TOPIC_LEGACY_AMS_SYNC + value: + _default: "ams-sync" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "4317,4318,9411,8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: iam + vault.hashicorp.com/agent-inject-secret-iam-db: secrets/data/apps/iam/postgres + vault.hashicorp.com/agent-inject-template-iam-db: |- + {{- with secret "secrets/data/apps/iam/postgres" -}} + DB_DSN=postgres://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@{{ index .Data.data "host" }}:{{ index .Data.data "port" }}/{{ index .Data.data "database" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-iam-zitadel: secrets/data/apps/iam/zitadel + vault.hashicorp.com/agent-inject-template-iam-zitadel: |- + {{- with secret "secrets/data/apps/iam/zitadel" -}} + ZITADEL_ACCESS_TOKEN={{ index .Data.data "access_token" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-iam-kafka: secrets/data/kafka/apps/iam + vault.hashicorp.com/agent-inject-template-iam-kafka: |- + {{- with secret "secrets/data/kafka/apps/iam" -}} + KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + KAFKA_BROKERS={{ index .Data.data.auth "bootstrap_servers" }} + KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} + KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-iam-s3: secrets/data/minio/apps/iam + vault.hashicorp.com/agent-inject-template-iam-s3: |- + {{- with secret "secrets/data/minio/apps/iam" -}} + S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/iam/base/kustomization.yaml b/apps/iam/base/kustomization.yaml new file mode 100644 index 0000000..d99dded --- /dev/null +++ b/apps/iam/base/kustomization.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: iam +resources: + - namespace.yaml + - backend.yaml diff --git a/apps/notes/d8-ugmk-prod/namespace.yaml b/apps/iam/base/namespace.yaml similarity index 68% rename from apps/notes/d8-ugmk-prod/namespace.yaml rename to apps/iam/base/namespace.yaml index e04787f..f4201b3 100644 --- a/apps/notes/d8-ugmk-prod/namespace.yaml +++ b/apps/iam/base/namespace.yaml @@ -1,7 +1,8 @@ +--- apiVersion: v1 kind: Namespace metadata: - name: notes + name: iam labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/iam/d8-ugmk-prod/kustomization.yaml b/apps/iam/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..d412d5c --- /dev/null +++ b/apps/iam/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: iam +resources: + - ../base \ No newline at end of file diff --git a/apps/notes/base/backend-deployment.yaml b/apps/notes/base/backend-deployment.yaml deleted file mode 100644 index 9812cce..0000000 --- a/apps/notes/base/backend-deployment.yaml +++ /dev/null @@ -1,120 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: notes - labels: - app: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - service: main - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: notes - vault.hashicorp.com/agent-inject-secret-notes-db: secrets/data/postgresql/apps/notes - vault.hashicorp.com/agent-inject-template-notes-db: |- - {{- with secret "secrets/data/postgresql/apps/notes" -}} - PG_HOST=postgresql.notes.svc.cluster.local - PG_PORT=5432 - PG_DB=notes_db - PG_LOGIN={{ index .Data.data "username" }} - PG_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-notes-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-notes-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_TOKEN={{ index .Data.data "key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-notes-rabbitmq: secrets/data/rabbitmq/apps/notes - vault.hashicorp.com/agent-inject-template-notes-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/notes" -}} - NOTES_RABBITMQ_VHOST={{ index .Data.data "vhost" }} - NOTES_RABBITMQ_USERNAME={{ index .Data.data "username" }} - NOTES_RABBITMQ_PASSWORD={{ index .Data.data "password" }} - NOTES_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - NOTES_RABBITMQ_PORT=5672 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-notes-s3: secrets/data/minio/apps/notes - vault.hashicorp.com/agent-inject-template-notes-s3: |- - {{- with secret "secrets/data/minio/apps/notes" -}} - NOTES_S3_ENDPOINT={{ index .Data.data.client "endpoint" }} - NOTES_S3_REGION={{ index .Data.data.client "region" }} - NOTES_S3_BUCKET=notes - NOTES_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - NOTES_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-notes-kafka: secrets/data/kafka/apps/notes - vault.hashicorp.com/agent-inject-template-notes-kafka: |- - {{- with secret "secrets/data/kafka/apps/notes" -}} - NOTES_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }} - NOTES_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} - NOTES_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} - NOTES_KAFKA_USERNAME={{ index .Data.data "username" }} - NOTES_KAFKA_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - spec: - serviceAccountName: notes-vault - containers: - - name: main - image: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854 - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/notes-db ] && . /vault/secrets/notes-db - [ -f /vault/secrets/notes-django-auth ] && . /vault/secrets/notes-django-auth - [ -f /vault/secrets/notes-rabbitmq ] && . /vault/secrets/notes-rabbitmq - [ -f /vault/secrets/notes-s3 ] && . /vault/secrets/notes-s3 - [ -f /vault/secrets/notes-kafka ] && . /vault/secrets/notes-kafka - set +a - exec /bin/bash /opt/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: PG_SSL_MODE - value: verify-full - - name: DJANGO_HOST - value: https://lk.sarex.io - - name: BASE_HOST - value: https://api.sarex.io/notes - - name: TIMEOUT - value: "120" - - name: FAAS_SERVICE - value: https://api.sarex.io/lambdas - - name: WORKSPACE_URL - value: https://api.sarex.io/workspaces/api/v1 - - name: WORKFLOW_HOST - value: https://api.sarex.io/workflows/api/v1 - - name: WORKFLOW_TAG - value: stable - - name: RESOURCE_URL - value: https://api.sarex.io/resources/api/v1 - - name: SYNC_RESOURCE_ID - value: "0" - - name: ENABLE_ND - value: "0" - - name: ATTACHMENT_HOST - value: http://attachments-service.attachments.svc.cluster.local:80/api/v1 - - name: PG_PORT - value: "5432" - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/notes/base/backend-service.yaml b/apps/notes/base/backend-service.yaml deleted file mode 100644 index 7a70542..0000000 --- a/apps/notes/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-service - namespace: notes -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 8000 - targetPort: 8000 - protocol: TCP diff --git a/apps/notes/base/backend.yaml b/apps/notes/base/backend.yaml new file mode 100644 index 0000000..e6f4de4 --- /dev/null +++ b/apps/notes/base/backend.yaml @@ -0,0 +1,177 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: notes +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: notes-vault + deployment: + enabled: true + name: + _default: backend + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/bash", "-c"] + args: + _default: + - | + set -a + [ -f /vault/secrets/notes-db ] && source /vault/secrets/notes-db + [ -f /vault/secrets/notes-django-auth ] && source /vault/secrets/notes-django-auth + [ -f /vault/secrets/notes-rabbitmq ] && source /vault/secrets/notes-rabbitmq + [ -f /vault/secrets/notes-s3 ] && source /vault/secrets/notes-s3 + [ -f /vault/secrets/notes-kafka ] && source /vault/secrets/notes-kafka + set +a + /bin/bash /opt/entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-service + type: + _default: ClusterIP + port: + _default: 8000 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: PG_SSL_MODE + value: + _default: verify-full + - name: DJANGO_HOST + value: + _default: https://lk.sarex.io + - name: BASE_HOST + value: + _default: https://api.sarex.io/notes + - name: TIMEOUT + value: + _default: "120" + - name: FAAS_SERVICE + value: + _default: https://api.sarex.io/lambdas + - name: WORKSPACE_URL + value: + _default: https://api.sarex.io/workspaces/api/v1 + - name: WORKFLOW_HOST + value: + _default: https://api.sarex.io/workflows/api/v1 + - name: WORKFLOW_TAG + value: + _default: stable + - name: RESOURCE_URL + value: + _default: https://api.sarex.io/resources/api/v1 + - name: SYNC_RESOURCE_ID + value: + _default: "0" + - name: ENABLE_ND + value: + _default: "0" + - name: ATTACHMENT_HOST + value: + _default: http://attachments-service.attachments.svc.cluster.local:80/api/v1 + - name: PG_PORT + value: + _default: "5432" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: notes + vault.hashicorp.com/agent-inject-secret-notes-db: secrets/data/apps/notes/postgres + vault.hashicorp.com/agent-inject-template-notes-db: |- + {{- with secret "secrets/data/apps/notes/postgres" -}} + PG_HOST={{ index .Data.data "host" }} + PG_PORT={{ index .Data.data "port" }} + PG_DB={{ index .Data.data "database" }} + PG_LOGIN={{ index .Data.data "username" }} + PG_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-notes-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-notes-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-notes-rabbitmq: secrets/data/rabbitmq/apps/notes + vault.hashicorp.com/agent-inject-template-notes-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/notes" -}} + NOTES_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + NOTES_RABBITMQ_USERNAME={{ index .Data.data "username" }} + NOTES_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + NOTES_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + NOTES_RABBITMQ_PORT=5672 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-notes-s3: secrets/data/minio/apps/notes + vault.hashicorp.com/agent-inject-template-notes-s3: |- + {{- with secret "secrets/data/minio/apps/notes" -}} + NOTES_S3_ENDPOINT={{ index .Data.data.client "endpoint" }} + NOTES_S3_REGION={{ index .Data.data.client "region" }} + NOTES_S3_BUCKET=notes + NOTES_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + NOTES_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-notes-kafka: secrets/data/kafka/apps/notes + vault.hashicorp.com/agent-inject-template-notes-kafka: |- + {{- with secret "secrets/data/kafka/apps/notes" -}} + NOTES_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }} + NOTES_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + NOTES_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + NOTES_KAFKA_USERNAME={{ index .Data.data "username" }} + NOTES_KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/notes/base/frontend-deployment.yaml b/apps/notes/base/frontend-deployment.yaml deleted file mode 100644 index 2fafb0b..0000000 --- a/apps/notes/base/frontend-deployment.yaml +++ /dev/null @@ -1,58 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: notes - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - service: frontend - spec: - volumes: - - name: nginx-configmap - configMap: - name: nginx-configmap - items: - - key: nginx.conf - path: nginx.conf - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - volumeMounts: - - name: nginx-configmap - mountPath: /etc/nginx/nginx.conf - subPath: nginx.conf - livenessProbe: - httpGet: - path: /ping - port: 80 - initialDelaySeconds: 10 - periodSeconds: 10 - failureThreshold: 10 - readinessProbe: - httpGet: - path: /ping - port: 80 - initialDelaySeconds: 10 - periodSeconds: 10 - failureThreshold: 20 - imagePullSecrets: - - name: regcred diff --git a/apps/notes/base/frontend-service.yaml b/apps/notes/base/frontend-service.yaml deleted file mode 100644 index 4e12102..0000000 --- a/apps/notes/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-service - namespace: notes -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/notes/base/frontend.yaml b/apps/notes/base/frontend.yaml new file mode 100644 index 0000000..67ea103 --- /dev/null +++ b/apps/notes/base/frontend.yaml @@ -0,0 +1,86 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: notes +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + frontend: + enabled: true + deployment: + enabled: true + name: + _default: frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: frontend-service + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: + _default: + - name: nginx-configmap + mountPath: + _default: /etc/nginx/nginx.conf + subPath: + _default: nginx.conf + readOnly: + _default: true + configMap: + name: + _default: nginx-configmap + items: + - key: nginx.conf + path: nginx.conf + defaultMode: 420 diff --git a/apps/notes/base/kustomization.yaml b/apps/notes/base/kustomization.yaml index 2ff8124..05865d4 100644 --- a/apps/notes/base/kustomization.yaml +++ b/apps/notes/base/kustomization.yaml @@ -3,10 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: notes resources: - - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml - - frontend-deployment.yaml - - frontend-service.yaml - nginx-configmap.yaml + - backend.yaml + - frontend.yaml + - namespace.yaml diff --git a/apps/notes/base/namespace.yaml b/apps/notes/base/namespace.yaml index 72085ff..1ae00a7 100644 --- a/apps/notes/base/namespace.yaml +++ b/apps/notes/base/namespace.yaml @@ -5,3 +5,6 @@ metadata: name: notes labels: istio-injection: enabled + security.deckhouse.io/pod-policy: privileged + + diff --git a/apps/notes/base/serviceaccount.yaml b/apps/notes/base/serviceaccount.yaml deleted file mode 100644 index 5f43a53..0000000 --- a/apps/notes/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: notes-vault - namespace: notes diff --git a/apps/notes/d8-ugmk-prod/kustomization.yaml b/apps/notes/d8-ugmk-prod/kustomization.yaml index 297cd98..e9b0fc6 100644 --- a/apps/notes/d8-ugmk-prod/kustomization.yaml +++ b/apps/notes/d8-ugmk-prod/kustomization.yaml @@ -1,11 +1,11 @@ --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: notes resources: - ../base patches: - - path: namespace.yaml + - path: patch.yaml target: - kind: Namespace - name: notes - - path: patch.yaml \ No newline at end of file + kind: HelmRelease + name: frontend diff --git a/apps/rfi/base/backend-deployment.yaml b/apps/rfi/base/backend-deployment.yaml deleted file mode 100644 index 41beb2a..0000000 --- a/apps/rfi/base/backend-deployment.yaml +++ /dev/null @@ -1,99 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: rfi-backend-api - namespace: rfi - labels: - app: rfi-backend-api - service: api -spec: - replicas: 1 - selector: - matchLabels: - app: rfi-backend-api - template: - metadata: - labels: - app: rfi-backend-api - service: api - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: rfi - vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/postgresql/apps/rfi - vault.hashicorp.com/agent-inject-template-rfi-db: |- - {{- with secret "secrets/data/postgresql/apps/rfi" -}} - DB_HOST=postgresql.rfi.svc.cluster.local - DB_PORT=5432 - DB_NAME=rfi_db - DB_USER={{ index .Data.data "username" }} - DB_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi - vault.hashicorp.com/agent-inject-template-rfi-s3: |- - {{- with secret "secrets/data/minio/apps/rfi" -}} - YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} - YC_S3_BUCKET_NAME=rfi - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi - vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/rfi" -}} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - RABBITMQ_PORT=5672 - RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-rfi-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_SECRET_KEY={{ index .Data.data "key" }} - SAREX_BACKEND_AUTH={{ index .Data.data "key" }} - {{- end -}} - spec: - serviceAccountName: rfi-vault - containers: - - name: api - image: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db - [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3 - [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq - [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth - set +a - exec ./entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: JWT_AUTH_ENABLE - value: "True" - - name: NOTIFICATIONS_ENABLE - value: "false" - - name: NOTIFICATIONS_EMAIL_FROM - value: hello@sarex.io - - name: NOTIFICATIONS_SERVICE_URL - value: https://sarex.contour.infra.sarex.tech/rfi - - name: SAREX_BACKEND_URL - value: http://backend-svc.django.svc.cluster.local - - name: EAV_URL - value: http://backend-svc.eav.svc.cluster.local:80 - - name: GATEWAY_URL - value: http://pdm-svc.documentations.svc.cluster.local:80 - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred \ No newline at end of file diff --git a/apps/rfi/base/backend-service.yaml b/apps/rfi/base/backend-service.yaml deleted file mode 100644 index a033244..0000000 --- a/apps/rfi/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: rfi -spec: - type: ClusterIP - selector: - app: rfi-backend-api - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/rfi/base/backend.yaml b/apps/rfi/base/backend.yaml new file mode 100644 index 0000000..bc9f10e --- /dev/null +++ b/apps/rfi/base/backend.yaml @@ -0,0 +1,149 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: rfi +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: rfi-vault + deployment: + enabled: true + name: + _default: rfi-backend-api + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db + [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3 + [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq + [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth + set +a + exec ./entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: JWT_AUTH_ENABLE + value: + _default: "True" + - name: NOTIFICATIONS_ENABLE + value: + _default: "false" + - name: NOTIFICATIONS_EMAIL_FROM + value: + _default: hello@sarex.io + - name: NOTIFICATIONS_SERVICE_URL + value: + _default: https://sarex.contour.infra.sarex.tech/rfi + - name: SAREX_BACKEND_URL + value: + _default: http://backend-svc.django.svc.cluster.local + - name: EAV_URL + value: + _default: http://backend-svc.eav.svc.cluster.local:80 + - name: GATEWAY_URL + value: + _default: http://pdm-svc.documentations.svc.cluster.local:80 + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: rfi + vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres + vault.hashicorp.com/agent-inject-template-rfi-db: |- + {{- with secret "secrets/data/apps/rfi/postgres" -}} + DB_HOST={{ index .Data.data "host" }} + DB_PORT={{ index .Data.data "port" }} + DB_NAME={{ index .Data.data "database" }} + DB_USER={{ index .Data.data "username" }} + DB_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi + vault.hashicorp.com/agent-inject-template-rfi-s3: |- + {{- with secret "secrets/data/minio/apps/rfi" -}} + YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} + YC_S3_BUCKET_NAME=rfi + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi + vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/rfi" -}} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + RABBITMQ_PORT=5672 + RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-rfi-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_SECRET_KEY={{ index .Data.data "key" }} + SAREX_BACKEND_AUTH={{ index .Data.data "key" }} + {{- end -}} diff --git a/apps/rfi/base/celery-deployment.yaml b/apps/rfi/base/celery-deployment.yaml deleted file mode 100644 index ff7f3a7..0000000 --- a/apps/rfi/base/celery-deployment.yaml +++ /dev/null @@ -1,99 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: celery - namespace: rfi - labels: - app: celery - service: celery -spec: - replicas: 1 - selector: - matchLabels: - app: celery - template: - metadata: - labels: - app: celery - service: celery - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: rfi - vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/postgresql/apps/rfi - vault.hashicorp.com/agent-inject-template-rfi-db: |- - {{- with secret "secrets/data/postgresql/apps/rfi" -}} - DB_HOST=postgresql.rfi.svc.cluster.local - DB_PORT=5432 - DB_NAME=rfi_db - DB_USER={{ index .Data.data "username" }} - DB_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi - vault.hashicorp.com/agent-inject-template-rfi-s3: |- - {{- with secret "secrets/data/minio/apps/rfi" -}} - YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} - YC_S3_BUCKET_NAME=rfi - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi - vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/rfi" -}} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - RABBITMQ_PORT=5672 - RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-rfi-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_SECRET_KEY={{ index .Data.data "key" }} - SAREX_BACKEND_AUTH={{ index .Data.data "key" }} - {{- end -}} - spec: - serviceAccountName: rfi-vault - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:dev4 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db - [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3 - [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq - [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth - set +a - exec uv run celery -A config worker -l info - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: JWT_AUTH_ENABLE - value: "True" - - name: NOTIFICATIONS_ENABLE - value: "false" - - name: NOTIFICATIONS_EMAIL_FROM - value: hello@sarex.io - - name: NOTIFICATIONS_SERVICE_URL - value: https://lk.srx.wb.ru:30443/rfi - - name: SAREX_BACKEND_URL - value: http://backend-svc.django.svc.cluster.local - - name: EAV_URL - value: http://backend-svc.eav.svc.cluster.local:80 - - name: GATEWAY_URL - value: http://pdm-api.documentations.svc.cluster.local:8080 - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/rfi/base/celery.yaml b/apps/rfi/base/celery.yaml new file mode 100644 index 0000000..fae9018 --- /dev/null +++ b/apps/rfi/base/celery.yaml @@ -0,0 +1,139 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: rfi +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + celery: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: rfi-vault + deployment: + enabled: true + name: + _default: celery + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db + [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3 + [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq + [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth + set +a + exec uv run celery -A config worker -l info + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:dev4 + pullPolicy: + _default: IfNotPresent + service: + enabled: false + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: JWT_AUTH_ENABLE + value: + _default: "True" + - name: NOTIFICATIONS_ENABLE + value: + _default: "false" + - name: NOTIFICATIONS_EMAIL_FROM + value: + _default: hello@sarex.io + - name: NOTIFICATIONS_SERVICE_URL + value: + _default: https://lk.srx.wb.ru:30443/rfi + - name: SAREX_BACKEND_URL + value: + _default: http://backend-svc.django.svc.cluster.local + - name: EAV_URL + value: + _default: http://backend-svc.eav.svc.cluster.local:80 + - name: GATEWAY_URL + value: + _default: http://pdm-api.documentations.svc.cluster.local:8080 + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: rfi + vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres + vault.hashicorp.com/agent-inject-template-rfi-db: |- + {{- with secret "secrets/data/apps/rfi/postgres" -}} + DB_HOST={{ index .Data.data "host" }} + DB_PORT={{ index .Data.data "port" }} + DB_NAME={{ index .Data.data "database" }} + DB_USER={{ index .Data.data "username" }} + DB_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi + vault.hashicorp.com/agent-inject-template-rfi-s3: |- + {{- with secret "secrets/data/minio/apps/rfi" -}} + YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} + YC_S3_BUCKET_NAME=rfi + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi + vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/rfi" -}} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + RABBITMQ_PORT=5672 + RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-rfi-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_SECRET_KEY={{ index .Data.data "key" }} + SAREX_BACKEND_AUTH={{ index .Data.data "key" }} + {{- end -}} diff --git a/apps/rfi/base/frontend-deployment.yaml b/apps/rfi/base/frontend-deployment.yaml deleted file mode 100644 index 6bbd8dd..0000000 --- a/apps/rfi/base/frontend-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: rfi - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/rfi-frontend:production_b827756f_wb - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/rfi/base/frontend-service.yaml b/apps/rfi/base/frontend-service.yaml deleted file mode 100644 index deaf506..0000000 --- a/apps/rfi/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: rfi -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/rfi/base/frontend.yaml b/apps/rfi/base/frontend.yaml new file mode 100644 index 0000000..92d6d2b --- /dev/null +++ b/apps/rfi/base/frontend.yaml @@ -0,0 +1,70 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: rfi +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + frontend: + enabled: true + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-frontend:production_b827756f_wb + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + name: + _default: frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + service: + enabled: true + name: + _default: frontend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/rfi/base/kustomization.yaml b/apps/rfi/base/kustomization.yaml index 5da1ac4..4c9e98e 100644 --- a/apps/rfi/base/kustomization.yaml +++ b/apps/rfi/base/kustomization.yaml @@ -4,9 +4,6 @@ kind: Kustomization namespace: rfi resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - celery-deployment.yaml - - frontend-deployment.yaml - - backend-service.yaml - - frontend-service.yaml + - backend.yaml + - celery.yaml + - frontend.yaml diff --git a/apps/rfi/base/namespace.yaml b/apps/rfi/base/namespace.yaml index b9c1047..0e80d68 100644 --- a/apps/rfi/base/namespace.yaml +++ b/apps/rfi/base/namespace.yaml @@ -5,3 +5,4 @@ metadata: name: rfi labels: istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/rfi/base/serviceaccount.yaml b/apps/rfi/base/serviceaccount.yaml deleted file mode 100644 index f598354..0000000 --- a/apps/rfi/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: rfi-vault - namespace: rfi diff --git a/apps/rfi/d8-ugmk-prod/kustomization.yaml b/apps/rfi/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..51bc006 --- /dev/null +++ b/apps/rfi/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: rfi +resources: + - ../base +patches: + - path: patch.yaml + target: + kind: HelmRelease + name: frontend diff --git a/apps/rfi/d8-ugmk-prod/patch.yaml b/apps/rfi/d8-ugmk-prod/patch.yaml new file mode 100644 index 0000000..7acaa37 --- /dev/null +++ b/apps/rfi/d8-ugmk-prod/patch.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: rfi +spec: + values: + services: + frontend: + deployment: + replicaCount: + _default: 1 \ No newline at end of file diff --git a/apps/subscriptions/base/namespace.yaml b/apps/subscriptions/base/namespace.yaml index 59eb52d..d230b58 100644 --- a/apps/subscriptions/base/namespace.yaml +++ b/apps/subscriptions/base/namespace.yaml @@ -5,3 +5,4 @@ metadata: name: subscriptions labels: istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/subscriptions/d8-ugmk-prod/kustomization.yaml b/apps/subscriptions/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..1e7f5f3 --- /dev/null +++ b/apps/subscriptions/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: subscriptions +resources: + - ../base \ No newline at end of file diff --git a/apps/workspaces/base/backend-deployment.yaml b/apps/workspaces/base/backend-deployment.yaml deleted file mode 100644 index 5e979b9..0000000 --- a/apps/workspaces/base/backend-deployment.yaml +++ /dev/null @@ -1,104 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: workspaces-api - namespace: workspaces - labels: - app: workspaces-api -spec: - replicas: 1 - selector: - matchLabels: - app: workspaces-api - template: - metadata: - labels: - app: workspaces-api - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: workspaces - vault.hashicorp.com/agent-inject-secret-workspaces-db: secrets/data/postgresql/apps/workspaces - vault.hashicorp.com/agent-inject-template-workspaces-db: |- - {{- with secret "secrets/data/postgresql/apps/workspaces" -}} - POSTGRES_ADDRESS=postgresql.workspaces.svc.cluster.local - POSTGRES_PORT=5432 - POSTGRES_DB=workspaces_db - POSTGRES_USER={{ index .Data.data "username" }} - POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-workspaces-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-workspaces-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_BASIC_AUTH={{ index .Data.data "key" }} - {{- end -}} - spec: - serviceAccountName: workspaces-vault - containers: - - name: workspaces-api - image: cr.yandex/crp3ccidau046kdj8g9q/workspaces:prod_4961b1f1 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/workspaces-db ] && . /vault/secrets/workspaces-db - [ -f /vault/secrets/workspaces-django-auth ] && . /vault/secrets/workspaces-django-auth - set +a - exec /api - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: POSTGRES_POOL_SIZE - value: "3" - - name: BUNDLES_RETRY_COUNT - value: "5" - - name: BUNDLES_NJOBS - value: "5" - - name: API_ADDRESS - value: 0.0.0.0:8000 - - name: NAMESPACE - value: workspaces - - name: ENABLE_SQL_QUERY - value: "0" - - name: ENABLE_SSL - value: "0" - - name: DOCUMENTATION_HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80 - - name: DOCUMENTATION_LOGGER_FEATURE - value: "0" - - name: DOCUMENTATION_ORIGINATOR - value: prod_ws - - name: ENVIRONMENT - value: prod - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: DJANGO_ORIGINATOR - value: docs_prod - - resources: - requests: - cpu: 25m - memory: 100Mi - livenessProbe: - httpGet: - path: /ping - port: 8000 - initialDelaySeconds: 10 - periodSeconds: 60 - failureThreshold: 10 - readinessProbe: - httpGet: - path: /ping - port: 8000 - initialDelaySeconds: 5 - periodSeconds: 5 - failureThreshold: 20 - imagePullSecrets: - - name: regcred diff --git a/apps/workspaces/base/backend-service.yaml b/apps/workspaces/base/backend-service.yaml deleted file mode 100644 index 9a06028..0000000 --- a/apps/workspaces/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: workspaces -spec: - type: ClusterIP - selector: - app: workspaces-api - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/workspaces/base/backend.yaml b/apps/workspaces/base/backend.yaml new file mode 100644 index 0000000..5728f7a --- /dev/null +++ b/apps/workspaces/base/backend.yaml @@ -0,0 +1,175 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: workspaces +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: workspaces-vault + deployment: + enabled: true + name: + _default: workspaces-api + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/workspaces-db ] && . /vault/secrets/workspaces-db + [ -f /vault/secrets/workspaces-django-auth ] && . /vault/secrets/workspaces-django-auth + set +a + exec /api + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 60 + failureThreshold: + _default: 10 + readiness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 5 + periodSeconds: + _default: 5 + failureThreshold: + _default: 20 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces:prod_4961b1f1 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "3" + - name: BUNDLES_RETRY_COUNT + value: + _default: "5" + - name: BUNDLES_NJOBS + value: + _default: "5" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8000 + - name: NAMESPACE + value: + _default: workspaces + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: DOCUMENTATION_HOST + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80 + - name: DOCUMENTATION_LOGGER_FEATURE + value: + _default: "0" + - name: DOCUMENTATION_ORIGINATOR + value: + _default: prod_ws + - name: ENVIRONMENT + value: + _default: prod + - name: DJANGO_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: workspaces + vault.hashicorp.com/agent-inject-secret-workspaces-db: secrets/data/apps/workspaces/postgres + vault.hashicorp.com/agent-inject-template-workspaces-db: |- + {{- with secret "secrets/data/apps/workspaces/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} + POSTGRES_USER={{ index .Data.data "username" }} + POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-workspaces-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-workspaces-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_BASIC_AUTH={{ index .Data.data "key" }} + {{- end -}} diff --git a/apps/workspaces/base/frontend-deployment.yaml b/apps/workspaces/base/frontend-deployment.yaml deleted file mode 100644 index 94799b3..0000000 --- a/apps/workspaces/base/frontend-deployment.yaml +++ /dev/null @@ -1,46 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: workspaces - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_7f95769f - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - livenessProbe: - httpGet: - path: /ping - port: 80 - initialDelaySeconds: 10 - periodSeconds: 10 - failureThreshold: 10 - readinessProbe: - httpGet: - path: /ping - port: 80 - initialDelaySeconds: 10 - periodSeconds: 10 - failureThreshold: 20 - imagePullSecrets: - - name: regcred diff --git a/apps/workspaces/base/frontend-service.yaml b/apps/workspaces/base/frontend-service.yaml deleted file mode 100644 index 9d8cfdd..0000000 --- a/apps/workspaces/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: workspaces -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/workspaces/base/frontend.yaml b/apps/workspaces/base/frontend.yaml new file mode 100644 index 0000000..84bb622 --- /dev/null +++ b/apps/workspaces/base/frontend.yaml @@ -0,0 +1,98 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: workspaces +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + frontend: + enabled: true + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_7f95769f + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + name: + _default: frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 80 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 10 + failureThreshold: + _default: 10 + readiness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 80 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 10 + failureThreshold: + _default: 20 + service: + enabled: true + name: + _default: frontend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/workspaces/base/kustomization.yaml b/apps/workspaces/base/kustomization.yaml index 6ebeaba..61b307a 100644 --- a/apps/workspaces/base/kustomization.yaml +++ b/apps/workspaces/base/kustomization.yaml @@ -4,8 +4,5 @@ kind: Kustomization namespace: workspaces resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml - - frontend-deployment.yaml - - frontend-service.yaml + - backend.yaml + - frontend.yaml diff --git a/apps/workspaces/base/namespace.yaml b/apps/workspaces/base/namespace.yaml index 7790980..784e946 100644 --- a/apps/workspaces/base/namespace.yaml +++ b/apps/workspaces/base/namespace.yaml @@ -5,3 +5,4 @@ metadata: name: workspaces labels: istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/workspaces/base/serviceaccount.yaml b/apps/workspaces/base/serviceaccount.yaml deleted file mode 100644 index 8855786..0000000 --- a/apps/workspaces/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: workspaces-vault - namespace: workspaces diff --git a/apps/workspaces/d8-ugmk-prod/kustomization.yaml b/apps/workspaces/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..6c18396 --- /dev/null +++ b/apps/workspaces/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: workspaces +resources: + - ../base +patches: + - path: patch.yaml + target: + kind: HelmRelease + name: frontend diff --git a/apps/workspaces/d8-ugmk-prod/patch.yaml b/apps/workspaces/d8-ugmk-prod/patch.yaml new file mode 100644 index 0000000..88e24f6 --- /dev/null +++ b/apps/workspaces/d8-ugmk-prod/patch.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: workspaces +spec: + values: + services: + frontend: + deployment: + replicaCount: + _default: 1 \ No newline at end of file diff --git a/apps/workspaces/dsinv/frontend.yaml b/apps/workspaces/dsinv/frontend.yaml index 68aa040..0fdd9e8 100644 --- a/apps/workspaces/dsinv/frontend.yaml +++ b/apps/workspaces/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: workspaces spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_c4cc968d + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_c4cc968d diff --git a/apps/workspaces/dsinv/kustomization.yaml b/apps/workspaces/dsinv/kustomization.yaml index 973e139..7d9ed22 100644 --- a/apps/workspaces/dsinv/kustomization.yaml +++ b/apps/workspaces/dsinv/kustomization.yaml @@ -8,9 +8,9 @@ resources: patches: - path: workspaces-api.yaml target: - kind: Deployment - name: workspaces-api + kind: HelmRelease + name: backend - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend diff --git a/apps/workspaces/dsinv/workspaces-api.yaml b/apps/workspaces/dsinv/workspaces-api.yaml index 0c068d8..9496162 100644 --- a/apps/workspaces/dsinv/workspaces-api.yaml +++ b/apps/workspaces/dsinv/workspaces-api.yaml @@ -1,45 +1,62 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: - name: workspaces-api + name: backend namespace: workspaces spec: - template: - spec: - containers: - - name: workspaces-api - image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-backend:production_fef43835 - env: - - name: POSTGRES_ADDRESS - value: postgres-service - - name: POSTGRES_PORT - value: '5432' - - name: POSTGRES_DB - value: workspaces_db - - name: POSTGRES_POOL_SIZE - value: '3' - - name: BUNDLES_RETRY_COUNT - value: '5' - - name: BUNDLES_NJOBS - value: '5' - - name: API_ADDRESS - value: 0.0.0.0:8000 - - name: NAMESPACE - value: sarex-workspaces - - name: ENABLE_SQL_QUERY - value: '0' - - name: ENABLE_SSL - value: '0' - - name: DOCUMENTATION_HOST - value: http://documentations-service.documentations.svc.cluster.local:8080 - - name: DOCUMENTATION_LOGGER_FEATURE - value: '0' - - name: DOCUMENTATION_ORIGINATOR - value: prod_ws - - name: ENVIRONMENT - value: prod - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: DJANGO_ORIGINATOR - value: docs_prod + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-backend:production_fef43835 + envs: + - name: POSTGRES_ADDRESS + value: + _default: postgres-service + - name: POSTGRES_PORT + value: + _default: "5432" + - name: POSTGRES_DB + value: + _default: workspaces_db + - name: POSTGRES_POOL_SIZE + value: + _default: "3" + - name: BUNDLES_RETRY_COUNT + value: + _default: "5" + - name: BUNDLES_NJOBS + value: + _default: "5" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8000 + - name: NAMESPACE + value: + _default: sarex-workspaces + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: DOCUMENTATION_HOST + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080 + - name: DOCUMENTATION_LOGGER_FEATURE + value: + _default: "0" + - name: DOCUMENTATION_ORIGINATOR + value: + _default: prod_ws + - name: ENVIRONMENT + value: + _default: prod + - name: DJANGO_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod diff --git a/apps/workspaces/yc-k8s-test/kustomization.yaml b/apps/workspaces/yc-k8s-test/kustomization.yaml index 00b5299..c8f7064 100644 --- a/apps/workspaces/yc-k8s-test/kustomization.yaml +++ b/apps/workspaces/yc-k8s-test/kustomization.yaml @@ -7,5 +7,5 @@ resources: patches: - path: replicas.yaml target: - kind: Deployment - name: workspaces-api + kind: HelmRelease + name: backend diff --git a/apps/workspaces/yc-k8s-test/replicas.yaml b/apps/workspaces/yc-k8s-test/replicas.yaml index cc9af30..ad71cb6 100644 --- a/apps/workspaces/yc-k8s-test/replicas.yaml +++ b/apps/workspaces/yc-k8s-test/replicas.yaml @@ -1,8 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: workspaces spec: - replicas: 1 + values: + services: + backend: + deployment: + replicaCount: + _default: 1 diff --git a/clusters/d8-ugmk-prod/kustomization.yaml b/clusters/d8-ugmk-prod/kustomization.yaml index d0a9342..56d2e79 100644 --- a/clusters/d8-ugmk-prod/kustomization.yaml +++ b/clusters/d8-ugmk-prod/kustomization.yaml @@ -22,4 +22,13 @@ resources: - ../../apps/reviews/d8-ugmk-prod - ../../apps/remarks/d8-ugmk-prod - ../../apps/auth-flow/d8-ugmk-prod - - ../../apps/notes/d8-ugmk-prod \ No newline at end of file + - ../../apps/notes/d8-ugmk-prod + - ../../apps/workspaces/d8-ugmk-prod + - ../../apps/rfi/d8-ugmk-prod + - ../../apps/eav/d8-ugmk-prod + - ../../apps/django/d8-ugmk-prod + - ../../apps/documentations/d8-ugmk-prod + - ../../apps/checklists/d8-ugmk-prod + - ../../apps/contracts/d8-ugmk-prod + - ../../apps/iam/d8-ugmk-prod + - ../../apps/subscriptions/d8-ugmk-prod \ No newline at end of file diff --git a/clusters/wb/infrastructure/kustomization.yaml b/clusters/wb/infrastructure/kustomization.yaml index 6cc40fa..0266a4f 100644 --- a/clusters/wb/infrastructure/kustomization.yaml +++ b/clusters/wb/infrastructure/kustomization.yaml @@ -10,6 +10,8 @@ resources: - ../../../infrastructure/goalert - ../../../infrastructure/kafka-exporter - ../../../infrastructure/postgres-exporter + - ../../../infrastructure/superset + - ../../../infrastructure/trino - ./node-exporter-vmnodescrape.yaml patches: - path: ./patches/istio-config.yaml @@ -75,3 +77,17 @@ patches: kind: HelmRelease name: postgres-exporter namespace: postgres-exporter + - path: ./patches/superset.yaml + target: + group: helm.toolkit.fluxcd.io + version: v2 + kind: HelmRelease + name: superset + namespace: superset + - path: ./patches/trino.yaml + target: + group: helm.toolkit.fluxcd.io + version: v2 + kind: HelmRelease + name: trino + namespace: trino diff --git a/clusters/wb/infrastructure/patches/istio-config.yaml b/clusters/wb/infrastructure/patches/istio-config.yaml index 2cd2460..67452de 100644 --- a/clusters/wb/infrastructure/patches/istio-config.yaml +++ b/clusters/wb/infrastructure/patches/istio-config.yaml @@ -51,6 +51,16 @@ spec: - openobserve-srx.wb.ru tls: credentialName: istio-gateway-wildcard-cert + superset: + name: superset-gw + namespace: gateway + selector: + istio: ingressgateway + servers: + - hosts: + - superset-srx.wb.ru + tls: + credentialName: istio-gateway-wildcard-cert vmalert: name: vmalert-gw namespace: gateway @@ -95,6 +105,17 @@ spec: prefix: / service: openobserve-web.openobserve.svc.cluster.local port: 5080 + superset-vs: + namespace: superset + hosts: + - superset-srx.wb.ru + gateways: + - gateway/superset-gw + routes: + - path: + prefix: / + service: superset.superset.svc.cluster.local + port: 8088 vmalert-vs: namespace: goalert hosts: diff --git a/clusters/wb/infrastructure/patches/superset.yaml b/clusters/wb/infrastructure/patches/superset.yaml new file mode 100644 index 0000000..07d24dd --- /dev/null +++ b/clusters/wb/infrastructure/patches/superset.yaml @@ -0,0 +1,96 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: superset + namespace: superset +spec: + interval: 5m + timeout: 20m + values: + fullnameOverride: superset + vault: + enabled: false + stronghold: + enabled: false + extraEnv: + GUNICORN_TIMEOUT: "300" + SERVER_WORKER_AMOUNT: "4" + BABEL_DEFAULT_LOCALE: ru + extraEnvRaw: + - name: ENABLE_PROXY_FIX + value: "true" + - name: JWT_SECRET + valueFrom: + secretKeyRef: + name: jwt-secret + key: jwt_secret + supersetNode: + connections: + redis_host: superset-redis-headless + redis_port: "6379" + redis_user: "" + redis_cache_db: "1" + redis_celery_db: "0" + db_host: sarex-vpsql-01.xc.wb.ru + db_port: "5432" + db_user: superset + db_name: ss + resources: + requests: + cpu: 500m + memory: 1Gi + limits: + memory: 2Gi + supersetWorker: + resources: + requests: + cpu: 500m + memory: 1Gi + limits: + memory: 2Gi + init: + loadExamples: false + postgresql: + enabled: false + redis: + enabled: true + image: + registry: docker.io + repository: bitnamilegacy/redis + tag: 7.0.10-debian-11-r4 + architecture: standalone + auth: + enabled: false + existingSecret: "" + existingSecretKey: "" + password: "" + master: + persistence: + enabled: false + configOverrides: + feature_flags: | + FEATURE_FLAGS = { + "EMBEDDED_SUPERSET": True, + "ENABLE_TEMPLATE_PROCESSING": True, + } + iframe_config: | + X_FRAME_OPTIONS = None + HTTP_HEADERS = { + "Content-Security-Policy": "frame-ancestors https://*.wb.ru", + } + extend_timeout: | + SQLLAB_ASYNC_TIME_LIMIT_SEC = 300 + SUPERSET_WEBSERVER_TIMEOUT = 300 + SQLLAB_TIMEOUT = 600 + set_locale: | + BABEL_DEFAULT_LOCALE = "ru" + enable_oauth: "" + extraConfigs: + import_datasources.yaml: | + databases: + - database_name: trino + sqlalchemy_uri: trino://superset@trino.trino.svc.cluster.local:8080 + expose_in_sqllab: true + allow_ctas: true + allow_cvas: true + allow_dml: false diff --git a/clusters/wb/infrastructure/patches/trino.yaml b/clusters/wb/infrastructure/patches/trino.yaml new file mode 100644 index 0000000..afd3460 --- /dev/null +++ b/clusters/wb/infrastructure/patches/trino.yaml @@ -0,0 +1,112 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: trino + namespace: trino +spec: + interval: 5m + timeout: 20m + values: + nameOverride: trino + coordinatorNameOverride: trino-coordinator + workerNameOverride: trino-worker + gateway: + enabled: false + virtualService: + enabled: false + server: + workers: 1 + config: + authenticationType: "" + autoscaling: + enabled: false + auth: + passwordAuthSecret: "" + env: + - name: PROD_PG_RO_PASSWORD + valueFrom: + secretKeyRef: + name: postgres-secret + key: postgres_ro_password + catalogs: + sarex_db: | + connector.name=postgresql + connection-url=jdbc:postgresql://sarex-vpsql-01.xc.wb.ru:5432/sarex_db?sslmode=disable + connection-user=readonly + connection-password=${ENV:PROD_PG_RO_PASSWORD} + postgresql.array-mapping=AS_JSON + flows_db: | + connector.name=postgresql + connection-url=jdbc:postgresql://sarex-vpsql-01.xc.wb.ru:5432/flows_db?sslmode=disable + connection-user=readonly + connection-password=${ENV:PROD_PG_RO_PASSWORD} + postgresql.array-mapping=AS_JSON + issues_db: | + connector.name=postgresql + connection-url=jdbc:postgresql://sarex-vpsql-01.xc.wb.ru:5432/issues_db?sslmode=disable + connection-user=readonly + connection-password=${ENV:PROD_PG_RO_PASSWORD} + postgresql.array-mapping=AS_JSON + workspaces_db: | + connector.name=postgresql + connection-url=jdbc:postgresql://sarex-vpsql-01.xc.wb.ru:5432/workspaces_db?sslmode=disable + connection-user=readonly + connection-password=${ENV:PROD_PG_RO_PASSWORD} + postgresql.array-mapping=AS_JSON + resources_db: | + connector.name=postgresql + connection-url=jdbc:postgresql://sarex-vpsql-01.xc.wb.ru:5432/resources_db?sslmode=disable + connection-user=readonly + connection-password=${ENV:PROD_PG_RO_PASSWORD} + postgresql.array-mapping=AS_JSON + pm_db: | + connector.name=postgresql + connection-url=jdbc:postgresql://sarex-vpsql-01.xc.wb.ru:5432/pm_db?sslmode=disable + connection-user=readonly + connection-password=${ENV:PROD_PG_RO_PASSWORD} + postgresql.array-mapping=AS_JSON + eav_db: | + connector.name=postgresql + connection-url=jdbc:postgresql://sarex-vpsql-01.xc.wb.ru:5432/eav_db?sslmode=disable + connection-user=readonly + connection-password=${ENV:PROD_PG_RO_PASSWORD} + postgresql.array-mapping=AS_JSON + inspections_db: | + connector.name=postgresql + connection-url=jdbc:postgresql://sarex-vpsql-01.xc.wb.ru:5432/inspections_db?sslmode=disable + connection-user=readonly + connection-password=${ENV:PROD_PG_RO_PASSWORD} + postgresql.array-mapping=AS_JSON + documentations_db: | + connector.name=postgresql + connection-url=jdbc:postgresql://sarex-vpsql-01.xc.wb.ru:5432/documentations_db?sslmode=disable + connection-user=readonly + connection-password=${ENV:PROD_PG_RO_PASSWORD} + postgresql.array-mapping=AS_JSON + clickhouse_db: | + connector.name=tpch + tpch.splits-per-node=4 + hive: | + connector.name=tpch + tpch.splits-per-node=4 + coordinator: + resources: + requests: + cpu: 500m + memory: 2Gi + limits: + memory: 4Gi + worker: + resources: + requests: + cpu: 500m + memory: 2Gi + limits: + memory: 4Gi + nodeSelector: + dedicated: processing-light + tolerations: + - key: dedicated + operator: Equal + value: processing-light + effect: NoSchedule diff --git a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml index 04b9e06..0d01b9d 100644 --- a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml +++ b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml @@ -60,7 +60,117 @@ spec: - sarex-login.uralmine.com tls: credentialName: istio-ingress-tls + platform: + name: platform-gateway + namespace: default + selector: + istio.deckhouse.io/ingress-gateway-class: istio + servers: + - hosts: + - sarex.uralmine.com + tls: + credentialName: istio-ingress-tls virtualServices: + platform: + name: sarex-frontend-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /admin/ + service: backend-svc.django.svc.cluster.local + port: 80 + + - path: + prefix: /api/ + service: backend-svc.django.svc.cluster.local + port: 80 + + - path: + prefix: / + service: frontend-svc.django.svc.cluster.local + port: 80 + filestream-api: + name: documentations-filestream-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /files/api/ + rewrite: /api/ + service: backend-filestream-svc.documentations.svc.cluster.local + port: 80 + iam-api: + name: iam-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /iam/api/ + rewrite: /external/api/ + service: iam-backend.iam.svc.cluster.local + port: 8000 + documentations-frontend: + name: documentations-frontend-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /documentations/static/ + rewrite: / + service: frontend-svc.documentations.svc.cluster.local + port: 80 + documentations-api: + name: documentations-api-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /documentations/api/ + rewrite: /api/ + service: backend-api-svc.documentations.svc.cluster.local + port: 80 + gateway-platform: + name: pdm-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /gateway/ + rewrite: / + service: pdm-svc.documentations.svc.cluster.local + port: 80 + srx-admin-frontend: + name: srx-admin-frontend-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /control-interface/ + rewrite: / + service: frontend-svc.control-interface.svc.cluster.local + port: 8080 camunda-keycloak: namespace: default hosts: diff --git a/infrastructure/superset/base/helmrelease.yaml b/infrastructure/superset/base/helmrelease.yaml new file mode 100644 index 0000000..3069128 --- /dev/null +++ b/infrastructure/superset/base/helmrelease.yaml @@ -0,0 +1,23 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: superset + namespace: superset +spec: + interval: 10m + chart: + spec: + chart: superset-prod + version: "0.13.3" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + strategy: uninstall diff --git a/infrastructure/superset/base/kustomization.yaml b/infrastructure/superset/base/kustomization.yaml new file mode 100644 index 0000000..ab0ff4d --- /dev/null +++ b/infrastructure/superset/base/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: superset +resources: + - namespace.yaml + - helmrelease.yaml diff --git a/infrastructure/superset/base/namespace.yaml b/infrastructure/superset/base/namespace.yaml new file mode 100644 index 0000000..646529a --- /dev/null +++ b/infrastructure/superset/base/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: superset diff --git a/infrastructure/superset/kustomization.yaml b/infrastructure/superset/kustomization.yaml new file mode 100644 index 0000000..3c2f51f --- /dev/null +++ b/infrastructure/superset/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./base diff --git a/infrastructure/trino/base/helmrelease.yaml b/infrastructure/trino/base/helmrelease.yaml new file mode 100644 index 0000000..10fa3d4 --- /dev/null +++ b/infrastructure/trino/base/helmrelease.yaml @@ -0,0 +1,22 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: trino + namespace: trino +spec: + interval: 10m + chart: + spec: + chart: trino-prod + version: "0.33.0" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 diff --git a/infrastructure/trino/base/kustomization.yaml b/infrastructure/trino/base/kustomization.yaml new file mode 100644 index 0000000..0a1a7da --- /dev/null +++ b/infrastructure/trino/base/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: trino +resources: + - namespace.yaml + - helmrelease.yaml diff --git a/infrastructure/trino/base/namespace.yaml b/infrastructure/trino/base/namespace.yaml new file mode 100644 index 0000000..32162bc --- /dev/null +++ b/infrastructure/trino/base/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: trino diff --git a/infrastructure/trino/kustomization.yaml b/infrastructure/trino/kustomization.yaml new file mode 100644 index 0000000..3c2f51f --- /dev/null +++ b/infrastructure/trino/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./base