Migrate various applications to manifest definitions and HelmRelease. Add them to the appropriate namespaces and update related configurations.

apps/ams-sync/dsinv/backend.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ams-sync
+  namespace: ams-sync
+spec:
+  values:
+    services:
+      backend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/ams-sync:ugok
+        envs:
+        - name: AMS_SYNC_TOPIC
+          value:
+            _default: ams-sync
+        - name: ENVIRONMENT
+          value:
+            _default: PRODUCTION
+        - name: HOST_ORGANIZATION_ID
+          value:
+            _default: '377835910403719938'
+        - name: ALERT_ENABLED
+          value:
+            _default: 'False'
+        - name: USER_SERVER_HOST
+          value:
+            _default: http://backend.django.svc.cluster.local:8000
+        - name: AUTH_HOST
+          value:
+            _default: http://backend.django.svc.cluster.local:8000
+        - name: VERIFY_USERS
+          value:
+            _default: 'True'
+        - name: KAFKA_SECURITY_PROTOCOL
+          value:
+            _default: SSL
+        - name: KAFKA_SASL_MECHANISM
+          value:
+            _default: SCRAM-SHA-512

apps/ams-sync/dsinv/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: ams-sync
+resources:
+- ../base
+patches:
+- path: backend.yaml
+  target:
+    kind: HelmRelease
+    name: ams-sync

apps/attachments/dsinv/attachments.yaml

@@ -0,0 +1,44 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: attachments
+  namespace: attachments
+spec:
+  values:
+    services:
+      attachments:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:0.0.9
+        envs:
+        - name: DATABASE_HOST
+          value:
+            _default: postgres-service.attachments.svc.cluster.local
+        - name: DATABASE_PORT
+          value:
+            _default: '5432'
+        - name: DATABASE_NAME
+          value:
+            _default: attachments
+        - name: POSTGRES_POOL_SIZE
+          value:
+            _default: '10'
+        - name: API_ADDRESS
+          value:
+            _default: 0.0.0.0:8000
+        - name: DATABASE_SSL_MODE
+          value:
+            _default: disable
+        - name: YANDEX_S3_VERIFY
+          value:
+            _default: 'False'
+        - name: YANDEX_S3_USE_SSL
+          value:
+            _default: 'False'
+        - name: YANDEX_S3_ACCOUNT_PATH
+          value:
+            _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+        - name: BUCKET_NAME
+          value:
+            _default: attachments

apps/attachments/dsinv/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: attachments
+resources:
+- ../base
+patches:
+- path: attachments.yaml
+  target:
+    kind: HelmRelease
+    name: attachments

apps/bim/dsinv/backend.yaml

@@ -0,0 +1,53 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: bim
+spec:
+  template:
+    spec:
+      containers:
+      - name: backend
+        image: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:1d961a7b125ae0e69bd5717658d927091d8c05cc
+        env:
+        - name: LAST_MASTER_BIM
+          value: '100000'
+        - name: LAST_SLAVE_1_BIM
+          value: '94015'
+        - name: LAST_MASTER_BIM_V3
+          value: '100000'
+        - name: LAST_SLAVE_1_BIM_V3
+          value: '0'
+        - name: DB_CERT_PATH_3
+          value: /root/yandex_pg.pem
+        - name: POSTGRES_ADDRESS_3
+          value: postgres-service
+        - name: POSTGRES_PORT_3
+          value: '5432'
+        - name: POSTGRES_DB_3
+          value: bimapidb
+        - name: DB_CERT_PATH_2
+          value: /root/yandex_pg.pem
+        - name: POSTGRES_ADDRESS_2
+          value: postgres-service
+        - name: POSTGRES_PORT_2
+          value: '5432'
+        - name: POSTGRES_DB_2
+          value: bimapidb
+        - name: POSTGRES_ADDRESS
+          value: postgres-service
+        - name: POSTGRES_PORT
+          value: '5432'
+        - name: POSTGRES_DB
+          value: bimapidb
+        - name: POSTGRES_POOL_SIZE
+          value: '30'
+        - name: API_ADDRESS
+          value: 0.0.0.0:8000
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: ENABLE_SQL_QUERY
+          value: '0'
+        - name: ENABLE_SSL
+          value: '0'

apps/bim/dsinv/bim-api.yaml

@@ -0,0 +1,172 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bim-api
+  namespace: bim
+  labels:
+    app: bim-api
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: bim-api
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: bim-api
+    spec:
+      containers:
+      - command:
+        - ./entrypoint_api.sh
+        env:
+        - name: JWT_PUBLIC_KEY_PATH
+          value: /etc/sarex/keys/prod.rsa.pub
+        - name: FEATURE_ENABLE_JWT_AUTH
+          value: 'false'
+        - name: FEATURE_ENABLE_SAREX_AUTH
+          value: 'false'
+        - name: FEATURE_ENABLE_WORKSPACES
+          value: 'true'
+        - name: FEATURE_ENABLE_GCLOUD
+          value: 'false'
+        - name: FEATURE_ENABLE_S3
+          value: 'true'
+        - name: S3_BUCKET
+          value: sarex-bim-storage
+        - name: BIM_CURRENT_STORAGE
+          value: s3
+        - name: AWS_DEFAULT_REGION
+          value: ru-central1
+        - name: FEATURE_ENABLE_PROCESSING
+          value: '1'
+        - name: PROCESSING_API_URL
+          value: http://workflows-service.processing.svc.cluster.local:8000/internal
+        - name: PROCESSING_C2M_VERSION
+          value: stable
+        - name: prometheus_multiproc_dir
+          value: /tmp
+        - name: GOOGLE_APPLICATION_CREDENTIALS
+          value: /etc/sarex/google-storage/service_account.json
+        - name: BUNDLE_VERSION
+          value: v1
+        - name: WORKSPACES_API_URL
+          value: http://workspaces-service.workspaces.svc.cluster.local:8000/internal
+        - name: BIM_API_EXTERNAL_HOST_SCHEMA
+          value: https
+        - name: BIM_API_EXTERNAL_HOST
+          value: sarex.uralchem.com
+        - name: BIM_API_INTERNAL_HOST_SCHEMA
+          value: http
+        - name: BIM_API_INTERNAL_HOST
+          value: bim-api-service.bim.svc.cluster.local:5555
+        - name: DB_HOST
+          value: postgres-service-bim-v1
+        - name: DB_PORT
+          value: '5432'
+        - name: MESH_OPTIMIZER_PATH
+          value: gltfpack
+        - name: DEBUG
+          value: '0'
+        - name: STORAGE_SEGMENT
+          value: sarex-production-storage
+        - name: STORAGE_PROJECT
+          value: sarex-production
+        - name: TMP_DIR
+          value: /tmp
+        - name: WEBHOOK_URL
+          value: http://bim-api-service.bim.svc.cluster.local:5555
+        - name: COMPARATOR_API_URL
+          value: http://comparator-api-service.comparator-prod/internal
+        - name: RABBIT_VHOST
+          value: api
+        - name: RABBIT_HOST
+          value: rabbitmq-service.rabbitmq:5672
+        - name: DISABLE_INSTANCING
+          value: '0'
+        - name: DB_USER
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: postgres-secret-bim-v1
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret-bim-v1
+        - name: RABBIT_USER
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: rabbitmq-secret
+        - name: RABBIT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: rabbitmq-secret
+        - name: AWS_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef:
+              key: key-id
+              name: s3-cred
+        - name: AWS_SECRET_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access-key
+              name: s3-cred
+        image: cr.yandex/crp3ccidau046kdj8g9q/bim-api:870965d1967cd761965029b0480884ab7fa7c951
+        imagePullPolicy: IfNotPresent
+        name: bim-api
+        ports:
+        - containerPort: 5555
+          name: http
+          protocol: TCP
+        - containerPort: 9000
+          name: prom
+          protocol: TCP
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /tmp
+          name: tmp-volume
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: bim-api-sa
+      serviceAccountName: bim-api-sa
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - emptyDir: {}
+        name: tmp-volume
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: bim-api-service
+  namespace: bim
+  labels: {}
+spec:
+  externalTrafficPolicy: Cluster
+  ports:
+  - name: http
+    nodePort: 31352
+    port: 5555
+    protocol: TCP
+    targetPort: 5555
+  selector:
+    app: bim-api
+  sessionAffinity: None
+  type: NodePort

apps/bim/dsinv/bim-worker.yaml

@@ -0,0 +1,146 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bim-worker
+  namespace: bim
+  labels:
+    app: bim-worker
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: bim-worker
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: bim-worker
+    spec:
+      containers:
+      - command:
+        - ./entrypoint_worker.sh
+        env:
+        - name: JWT_PUBLIC_KEY_PATH
+          value: /etc/sarex/keys/prod.rsa.pub
+        - name: FEATURE_ENABLE_JWT_AUTH
+          value: 'false'
+        - name: FEATURE_ENABLE_SAREX_AUTH
+          value: 'false'
+        - name: FEATURE_ENABLE_WORKSPACES
+          value: 'true'
+        - name: FEATURE_ENABLE_GCLOUD
+          value: 'false'
+        - name: FEATURE_ENABLE_S3
+          value: 'true'
+        - name: S3_BUCKET
+          value: sarex-bim-storage
+        - name: BIM_CURRENT_STORAGE
+          value: s3
+        - name: AWS_DEFAULT_REGION
+          value: ru-central1
+        - name: FEATURE_ENABLE_PROCESSING
+          value: '1'
+        - name: PROCESSING_API_URL
+          value: http://workflows-service.processing.svc.cluster.local:8000/internal
+        - name: PROCESSING_C2M_VERSION
+          value: stable
+        - name: prometheus_multiproc_dir
+          value: /tmp
+        - name: GOOGLE_APPLICATION_CREDENTIALS
+          value: /etc/sarex/google-storage/service_account.json
+        - name: BUNDLE_VERSION
+          value: v1
+        - name: WORKSPACES_API_URL
+          value: http://workspaces-service.workspaces.svc.cluster.local:8000/internal
+        - name: BIM_API_EXTERNAL_HOST_SCHEMA
+          value: https
+        - name: BIM_API_EXTERNAL_HOST
+          value: sarex.dsinv.ru
+        - name: BIM_API_INTERNAL_HOST_SCHEMA
+          value: http
+        - name: BIM_API_INTERNAL_HOST
+          value: bim-api-service.bim.svc.cluster.local:5555
+        - name: DB_HOST
+          value: postgres-service-bim-v1
+        - name: DB_PORT
+          value: '5432'
+        - name: MESH_OPTIMIZER_PATH
+          value: gltfpack
+        - name: DEBUG
+          value: '0'
+        - name: STORAGE_SEGMENT
+          value: sarex-production-storage
+        - name: STORAGE_PROJECT
+          value: sarex-production
+        - name: TMP_DIR
+          value: /tmp
+        - name: WEBHOOK_URL
+          value: http://bim-api-service.bim.svc.cluster.local:5555
+        - name: COMPARATOR_API_URL
+          value: http://comparator-api-service.comparator-prod/internal
+        - name: RABBIT_VHOST
+          value: api
+        - name: RABBIT_HOST
+          value: rabbitmq-service.bim:5672
+        - name: DISABLE_INSTANCING
+          value: '0'
+        - name: DB_USER
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: postgres-secret-bim-v1
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret-bim-v1
+        - name: RABBIT_USER
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: rabbitmq-secret
+        - name: RABBIT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: rabbitmq-secret
+        - name: AWS_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef:
+              key: key-id
+              name: s3-cred
+        - name: AWS_SECRET_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access-key
+              name: s3-cred
+        image: cr.yandex/crp3ccidau046kdj8g9q/bim-api:870965d1967cd761965029b0480884ab7fa7c951
+        imagePullPolicy: IfNotPresent
+        name: bim-worker
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /tmp
+          name: tmp-volume
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: bim-worker-sa
+      serviceAccountName: bim-worker-sa
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - emptyDir: {}
+        name: tmp-volume

apps/bim/dsinv/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: bim
+resources:
+- ../base
+- bim-api.yaml
+- bim-worker.yaml
+patches:
+- path: backend.yaml
+  target:
+    kind: Deployment
+    name: backend

apps/checklists/dsinv/checklists-backend.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: checklists-backend
+  namespace: checklists
+spec:
+  template:
+    spec:
+      containers:
+      - name: api
+        image: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd
+        env:
+        - name: HTTP_APP_HOST
+          value: 0.0.0.0
+        - name: HTTP_APP_PORT
+          value: '8000'
+        - name: HTTP_APP_ROOT_PATH
+          value: /checklists
+        - name: HTTP_APP_WORKERS
+          value: '8'
+        - name: HTTP_APP_ADMIN_ENABLE
+          value: 'true'
+        - name: DATABASE_HOST
+          value: postgres-service
+        - name: DATABASE_PORT
+          value: '5432'
+        - name: DATABASE_NAME
+          value: checklists_db
+        - name: JWT_AUTH_ENABLE
+          value: 'true'
+        - name: DEBUG
+          value: 'false'

apps/checklists/dsinv/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: checklists
+resources:
+- ../base
+patches:
+- path: checklists-backend.yaml
+  target:
+    kind: Deployment
+    name: checklists-backend

apps/comparisons/dsinv/backend.yaml

@@ -0,0 +1,63 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: comparisons
+spec:
+  template:
+    spec:
+      containers:
+      - name: backend
+        image: cr.yandex/crp3ccidau046kdj8g9q/comparisons-backend:8df50db379f53c35a20fdffd4803883564a11844
+        env:
+        - name: HTTP_PORT
+          value: '8080'
+        - name: LAST_MASTER_BIM
+          value: '100_000'
+        - name: APP_NAME
+          value: comparisons-api-v2
+        - name: APP_VERSION
+          value: 0.0.1
+        - name: LOGGER_LOG_LEVEL
+          value: info
+        - name: DATABASE_HOST
+          value: postgres-service
+        - name: DATABASE_PORT
+          value: '5432'
+        - name: DATABASE_NAME
+          value: postgres
+        - name: DATABASE_DB
+          value: comparisons
+        - name: API_ADDRESS
+          value: 0.0.0.0:8080
+        - name: API_ADDRESS_FILE
+          value: 0.0.0.0:8080
+        - name: ENABLE_SQL_QUERY
+          value: '0'
+        - name: DOCUMENTATIONS_INTERNAL_HOST
+          value: http://documentations-service.documentations.svc.cluster.local:8080
+        - name: DOCUMENTATIONS_EXTERNAL_HOST
+          value: http://documentations-service.documentations.svc.cluster.local:8080/
+        - name: DOCUMENTATION_URL
+          value: http://documentations-service.documentations.svc.cluster.local:8080/
+        - name: DOCUMENTATION_FILESTREAM_URL
+          value: http://documentations-filestream-service.documentations.svc.cluster.local:8080/
+        - name: WORKFLOWS_HOST
+          value: http://workflows-service.workflow.svc.cluster.local:8000/
+        - name: EAV_HOST
+          value: http://eav-service.eav.svc.cluster.local:8000
+        - name: WORKSPACES_HOST
+          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
+        - name: COMPARISON_URL
+          value: http://backend-service.comparisons.svc.cluster.local:8080/
+        - name: WORKFLOWS_IMAGE_VERSION
+          value: master
+        - name: EXTERNAL_DOCUMENTATION_URL
+          value: http://documentations-service.documentations.svc.cluster.local:8080/
+        - name: WORKFLOWS_BIMV2_INTERNAL_HOST
+          value: http://backend-service.bim.svc.cluster.local:8000/
+        - name: ENABLE_SSL
+          value: '0'
+        - name: WORKFLOWS_DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000

apps/comparisons/dsinv/frontend.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: comparisons
+spec:
+  template:
+    spec:
+      containers:
+      - name: frontend
+        image: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend-static:9c422e6cd514603ea4092ed2430634cf4995039d

apps/comparisons/dsinv/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: comparisons
+resources:
+- ../base
+patches:
+- path: backend.yaml
+  target:
+    kind: Deployment
+    name: backend
+- path: frontend.yaml
+  target:
+    kind: Deployment
+    name: frontend

apps/control-interface/dsinv/frontend.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: control-interface
+spec:
+  values:
+    services:
+      frontend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_8ef5bb19

apps/control-interface/dsinv/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: control-interface
+resources:
+- ../base
+patches:
+- path: frontend.yaml
+  target:
+    kind: HelmRelease
+    name: frontend

apps/django/dsinv/backend.yaml

@@ -0,0 +1,110 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: django
+spec:
+  replicas: 2
+  template:
+    spec:
+      containers:
+      - name: backend
+        image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1
+        env:
+        - name: GK_ENCRYPTION_KEY
+          value: zfDjuszywHSbAhY8KJQbESbpUYN74XTs
+        - name: SERVER_DONSTROI_STYLE
+          value: 'True'
+        - name: SERVER_API_HOST
+          value: https://sarex.dsinv.ru
+        - name: SERVER_VERIFY_SSL
+          value: 'False'
+        - name: SERVER_SUPERSET_HOST
+          value: https://bi.sarex.dsinv.ru
+        - name: GATEWAY_HOST
+          value: http://pdm-api.documentations.svc.cluster.local:8080
+        - name: KC_DEFAULT_COMPANY_NAME
+          value: Донстрой
+        - name: KC_SYNC_USER_GROUPS
+          value: '0'
+        - name: SERVER_ZITADEL_ENABLED
+          value: 'False'
+        - name: KC_SYNC_USER_POSITIONS
+          value: '0'
+        - name: KC_SYNC_USER_DEPARTMENTS
+          value: '0'
+        - name: SERVER_CHANGELOG_MODE_CELERY
+          value: 'True'
+        - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+          value: 'True'
+        - name: DJANGO_SETTINGS_MODULE
+          value: config.settings.production
+        - name: CC_PATH
+          value: /usr/local/bin/CloudCompare
+        - name: CC_COMPARISONS_BASE_DIR
+          value: /tmp
+        - name: PCVT_PATH
+          value: /usr/local/bin/PotreeConverter
+        - name: POTREE_CONVERTER_PATH
+          value: /usr/local/bin/PotreeConverter
+        - name: WORKFLOWS_BASE_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: WORKFLOWS_HOST
+          value: http://workflows-service.workflow.svc.cluster.local:8000
+        - name: WORKFLOWS_PREFIX
+          value: /api/v1
+        - name: SERVER_HOST
+          value: https://sarex.dsinv.ru
+        - name: S3_HOST
+          value: http://minio-service.minio.svc.cluster.local:9000
+        - name: AWS_S3_ENDPOINT_URL
+          value: http://minio-service.minio.svc.cluster.local:9000
+        - name: MEASUREMENTS_USE_MEASUREMENTS
+          value: '1'
+        - name: MEASUREMENTS_HOST
+          value: http://measurement-service.measurements.svc.cluster.local:8000/api
+        - name: SERVER_USE_DJANGO_STORAGE
+          value: '1'
+        - name: SERVER_DJANGO_URLS
+          value: '1'
+        - name: SERVER_S3_STREAM_IMPORT
+          value: '1'
+        - name: WORKFLOWS_USE
+          value: '1'
+        - name: SERVER_KAFKA_ENABLED
+          value: 'True'
+        - name: KAFKA_TOPICS
+          value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+        - name: KAFKA_BOOTSTRAP_SERVERS
+          value: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+        - name: KAFKA_SECURITY_PROTOCOL
+          value: SSL
+        - name: KAFKA_SASL_MECHANISM
+          value: SCRAM-SHA-512
+        - name: KAFKA_SSL_CAFILE
+          value: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt
+        - name: WORKFLOWS_REGISTRY
+          value: cr.yandex/crp3ccidau046kdj8g9q
+        - name: DJANGO_REDIS_HOST
+          value: redis-service.django.svc.cluster.local
+        - name: DJANGO_RABBIT_HOSTNAME
+          value: rabbitmq-service.django.svc.cluster.local
+        - name: CELERY_RABBITMQ_HOST
+          value: rabbitmq-service.django.svc.cluster.local
+        - name: DJANGO_POSTGRES_HOST
+          value: postgres-service
+        - name: DJANGO_POSTGRES_PORTS
+          value: '5432'
+        - name: ALLOWED_HOSTS
+          value: '*'
+        - name: USE_SSL_FOR_URL_SERIALIZATION
+          value: '0'
+        - name: SERVER_REPLACE_HOST
+          value: '1'
+        - name: SERVER_JWT_PROXY
+          value: '0'
+        - name: PDM_SYNC
+          value: '1'
+        - name: CELERY_REDIS_HOST
+          value: redis-service

apps/django/dsinv/celery.yaml

@@ -0,0 +1,87 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: celery
+  namespace: django
+spec:
+  template:
+    spec:
+      containers:
+      - name: celery
+        image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1
+        env:
+        - name: DJANGO_SETTINGS_MODULE
+          value: config.settings.production
+        - name: CC_PATH
+          value: /usr/local/bin/CloudCompare
+        - name: CC_COMPARISONS_BASE_DIR
+          value: /tmp
+        - name: AWS_S3_ENDPOINT_URL
+          value: http://minio-service.minio.svc.cluster.local:9000
+        - name: PCVT_PATH
+          value: /usr/local/bin/PotreeConverter
+        - name: POTREE_CONVERTER_PATH
+          value: /usr/local/bin/PotreeConverter
+        - name: WORKFLOWS_BASE_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: WORKFLOWS_HOST
+          value: https://sarex.dsinv.ru
+        - name: SERVER_CACHE_ENABLED
+          value: 'True'
+        - name: SERVER_API_HOST
+          value: https://sarex.dsinv.ru
+        - name: SERVER_VERIFY_SSL
+          value: 'False'
+        - name: SERVER_HOST
+          value: https://sarex.dsinv.ru
+        - name: S3_HOST
+          value: http://minio-service.minio.svc.cluster.local:9000
+        - name: MEASUREMENTS_USE_MEASUREMENTS
+          value: '1'
+        - name: MEASUREMENTS_HOST
+          value: http://measurements-service.measurements.svc.cluster.local:8000/api
+        - name: SERVER_USE_DJANGO_STORAGE
+          value: '1'
+        - name: SERVER_DJANGO_URLS
+          value: '1'
+        - name: CACHE_HOST
+          value: redis.pm.svc.cluster.local
+        - name: SERVER_DONSTROI_STYLE
+          value: 'True'
+        - name: SERVER_S3_STREAM_IMPORT
+          value: '1'
+        - name: WORKFLOWS_USE
+          value: '1'
+        - name: WORKFLOWS_REGISTRY
+          value: cr.yandex/crp3ccidau046kdj8g9q
+        - name: CELERY_REDIS_HOST
+          value: redis-service
+        - name: CELERY_RABBITMQ_HOST
+          value: rabbitmq-service.django.svc.cluster.local
+        - name: DJANGO_POSTGRES_HOST
+          value: postgres-service
+        - name: SERVER_KAFKA_ENABLED
+          value: 'True'
+        - name: KAFKA_TOPICS
+          value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+        - name: KAFKA_BOOTSTRAP_SERVERS
+          value: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+        - name: KAFKA_SECURITY_PROTOCOL
+          value: SSL
+        - name: KAFKA_SASL_MECHANISM
+          value: SCRAM-SHA-512
+        - name: KAFKA_SSL_CAFILE
+          value: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt
+        - name: DJANGO_POSTGRES_PORTS
+          value: '5432'
+        - name: ALLOWED_HOSTS
+          value: '*'
+        - name: USE_SSL_FOR_URL_SERIALIZATION
+          value: '0'
+        - name: SERVER_REPLACE_HOST
+          value: '1'
+        - name: SERVER_JWT_PROXY
+          value: '1'
+        - name: PDM_SYNC
+          value: '1'

apps/django/dsinv/export-project.yaml

@@ -0,0 +1,69 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: export-project
+  namespace: django
+  labels:
+    app: export-project
+    k8slens-edit-resource-version: v1
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: export-project
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: export-project
+    spec:
+      containers:
+      - env:
+        - name: TIMEOUT
+          value: '180'
+        image: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_37a48176
+        imagePullPolicy: IfNotPresent
+        name: export-project
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        resources:
+          limits:
+            cpu: '2'
+            memory: 8Gi
+          requests:
+            cpu: '1'
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: export-project-service
+  namespace: django
+  labels: {}
+spec:
+  ports:
+  - port: 8000
+    protocol: TCP
+    targetPort: 8000
+  selector:
+    app: export-project
+  sessionAffinity: None
+  type: ClusterIP

apps/django/dsinv/frontend.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: django
+spec:
+  template:
+    spec:
+      containers:
+      - name: frontend
+        image: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.15.7

apps/django/dsinv/kustomization.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: django
+resources:
+- ../base
+- export-project.yaml
+patches:
+- path: backend.yaml
+  target:
+    kind: Deployment
+    name: backend
+- path: celery.yaml
+  target:
+    kind: Deployment
+    name: celery
+- path: frontend.yaml
+  target:
+    kind: Deployment
+    name: frontend

apps/document-link/dsinv/frontend.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: document-link
+spec:
+  template:
+    spec:
+      containers:
+      - name: frontend
+        image: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:21f0ef3d66575901d554ba675ba677708e4635c7

apps/document-link/dsinv/gatekeeper-public-link.yaml

@@ -0,0 +1,81 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gatekeeper-public-link
+  namespace: document-link
+  labels:
+    app: gatekeeper-public-link
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: gatekeeper-public-link
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: gatekeeper-public-link
+    spec:
+      containers:
+      - args:
+        - --discovery-url=https://keycloak.sarex.dsinv.ru/realms/sarex/.well-known/openid-configuration
+        - --listen=0.0.0.0:8080
+        - --enable-logging=true
+        - --upstream-url=http://frontend-service:80/
+        - --enable-refresh-tokens=true
+        - --enable-session-cookies=true
+        - --verbose
+        - --resources=uri=/*
+        - --encryption-key=zfDjuszywHSbAhY8KJQbESbpUYN74XTs
+        - --secure-cookie=false
+        - --skip-openid-provider-tls-verify=true
+        env:
+        - name: PROXY_REDIRECTION_URL
+          value: https://document-link.sarex.dsinv.ru
+        - name: PROXY_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              key: client_id
+              name: gatekeeper-secret
+        - name: PROXY_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: client_secret
+              name: gatekeeper-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/gatekeeper:1.4.2
+        imagePullPolicy: IfNotPresent
+        name: gatekeeper
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: gatekeeper-service-link
+  namespace: document-link
+spec:
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: gatekeeper-public-link
+  sessionAffinity: None
+  type: ClusterIP

apps/document-link/dsinv/kustomization.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: document-link
+resources:
+- ../base
+- gatekeeper-public-link.yaml
+patches:
+- path: frontend.yaml
+  target:
+    kind: Deployment
+    name: frontend

apps/documentations/dsinv/documentations-api.yaml

@@ -0,0 +1,110 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: documentations-api
+  namespace: documentations
+spec:
+  replicas: 4
+  template:
+    spec:
+      containers:
+      - name: documentations-api
+        image: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_54880e92
+        env:
+        - name: PUBLIC_LINK_HOST
+          value: https://document-link.sarex.dsinv.ru
+        - name: POSTGRES_ADDRESS
+          value: postgres-service
+        - name: POSTGRES_PORT
+          value: '5432'
+        - name: POSTGRES_DB
+          value: documentations
+        - name: POSTGRES_POOL_SIZE
+          value: '20'
+        - name: LAST_MASTER_BIM
+          value: '36311'
+        - name: API_ADDRESS
+          value: 0.0.0.0:8080
+        - name: API_ADDRESS_FILE
+          value: 0.0.0.0:8080
+        - name: ENABLE_SQL_QUERY
+          value: '0'
+        - name: ENABLE_SSL
+          value: '0'
+        - name: ENABLE_MAILGUN
+          value: 'false'
+        - name: ENABLE_SMTP
+          value: 'true'
+        - name: ENABLE_S3
+          value: '1'
+        - name: USE_BIM_INSERTER
+          value: '0'
+        - name: CONTAINER_REGISTRY
+          value: cr.yandex/crp3ccidau046kdj8g9q
+        - name: ENVIRONMENT
+          value: production
+        - name: HOST
+          value: http://documentations-service.documentations.svc.cluster.local:8080
+        - name: FILE_STREAM_HOST
+          value: sarex.dsinv.ru
+        - name: DOCUMENTATION_URL
+          value: http://documentations-service.documentations.svc.cluster.local:8080/
+        - name: WORKFLOW_URL
+          value: http://workflows-service.workflow.svc.cluster.local:8000/
+        - name: WORKSPACE_URL
+          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
+        - name: BIM_API_URL
+          value: http://bim-api-service.bim.svc.cluster.local:8080/
+        - name: BIM_API_V2_URL
+          value: http://backend-service.bim.svc.cluster.local:8000/
+        - name: WORKSPACE_BUNDLE_VERSION
+          value: v1
+        - name: SYSTEM_LOG_URL
+          value: http://api-service.system-log.svc.cluster.local:8000
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: MARKS_PROCESSING_URL
+          value: http://marks-service.documentations.svc.cluster.local:8000
+        - name: NAMESPACE
+          value: documentations
+        - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+          value: '5'
+        - name: DJANGO_ORIGINATOR
+          value: docs_prod
+        - name: WORKFLOW_IMAGES_VERSION
+          value: master
+        - name: WORKSPACE_V2_EXTERNAL_URL
+          value: https://sarex.dsinv.ru/workspaces-v2/
+        - name: WORKFLOWS_IMAGES_VERSION
+          value: master
+        - name: FLOWS_URL
+          value: http://backend-service.flows.svc.cluster.local:8000
+        - name: S3_SERVICE_ACCOUNT
+          value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+        - name: READ_WRITE_TIMEOUT_FILE_STREAM
+          value: 6h
+        - name: CACHE_DEFAULT_EXPIRATION
+          value: 60s
+        - name: CACHE_CLEANUP_INTERVAL
+          value: 60s
+        - name: USE_CACHE_IN_FILE_STREAMER
+          value: '1'
+        - name: IS_CONVERTED_PDF_UPLOADING_TO_S3
+          value: 'false'
+        - name: TRACER_USE
+          value: '0'
+        - name: TRACER_HOST
+          value: signoz-otel-collector-external.signoz.svc.cluster.local:4317
+        - name: SERVICE_NAME
+          value: documentations-api.documentations-prod
+        - name: SERVICE_NAME_FILESTREAM
+          value: filestream-api.documentations-prod
+        - name: TRACER_USE_INSECURE
+          value: '1'
+        - name: DELETE_S3D_AFTER_MESHOPT
+          value: 'true'
+        - name: CONVERT_DWG_TO_GEOJSON
+          value: 'false'
+        - name: CONVERT_DXF_TO_GEOJSON
+          value: 'false'

apps/documentations/dsinv/documentations-filestream.yaml

@@ -0,0 +1,74 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: documentations-filestream
+  namespace: documentations
+spec:
+  replicas: 3
+  template:
+    spec:
+      containers:
+      - name: documentations-filestream
+        image: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_54880e92
+        env:
+        - name: POSTGRES_ADDRESS
+          value: postgres-service
+        - name: POSTGRES_PORT
+          value: '5432'
+        - name: POSTGRES_DB
+          value: documentations
+        - name: POSTGRES_POOL_SIZE
+          value: '20'
+        - name: API_ADDRESS
+          value: 0.0.0.0:8080
+        - name: API_ADDRESS_FILE
+          value: 0.0.0.0:8080
+        - name: ENABLE_SQL_QUERY
+          value: '1'
+        - name: ENABLE_SSL
+          value: '0'
+        - name: ENABLE_S3
+          value: '1'
+        - name: CONTAINER_REGISTRY
+          value: cr.yandex/crp3ccidau046kdj8g9q
+        - name: ENVIRONMENT
+          value: production
+        - name: HOST
+          value: http://documentations-service.documentations.svc.cluster.local:8080
+        - name: FILE_STREAM_HOST
+          value: sarex.dsinv.ru
+        - name: DOCUMENTATION_URL
+          value: http://documentations-service.documentations.svc.cluster.local:8080/
+        - name: WORKFLOW_URL
+          value: http://workflows-service.workflow.svc.cluster.local:8000/
+        - name: WORKSPACE_URL
+          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
+        - name: BIM_API_URL
+          value: http://bim-api-service.bim.svc.cluster.local:8080/
+        - name: BIM_API_V2_URL
+          value: http://backend-service.bim.svc.cluster.local:8000/
+        - name: WORKSPACE_BUNDLE_VERSION
+          value: v1
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: NAMESPACE
+          value: sarex-documentations
+        - name: DJANGO_ORIGINATOR
+          value: docs_prod
+        - name: WORKFLOW_IMAGES_VERSION
+          value: master
+        - name: WORKFLOWS_IMAGES_VERSION
+          value: master
+        - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+          value: '5'
+        - name: S3_SERVICE_ACCOUNT
+          value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+        - name: READ_WRITE_TIMEOUT_FILE_STREAM
+          value: 6h
+        - name: CACHE_DEFAULT_EXPIRATION
+          value: 60s
+        - name: CACHE_CLEANUP_INTERVAL
+          value: 60s
+        - name: USE_CACHE_IN_FILE_STREAMER
+          value: '1'

apps/documentations/dsinv/frontend.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: documentations
+spec:
+  template:
+    spec:
+      containers:
+      - name: frontend
+        image: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_b80d28d4

apps/documentations/dsinv/kustomization.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: documentations
+resources:
+- ../base
+- pdf-markings-amqp.yaml
+- pdf-markings.yaml
+- stamp-verification.yaml
+patches:
+- path: documentations-api.yaml
+  target:
+    kind: Deployment
+    name: documentations-api
+- path: documentations-filestream.yaml
+  target:
+    kind: Deployment
+    name: documentations-filestream
+- path: frontend.yaml
+  target:
+    kind: Deployment
+    name: frontend
+- path: pdm-api.yaml
+  target:
+    kind: Deployment
+    name: pdm-api

apps/documentations/dsinv/pdf-markings-amqp.yaml

@@ -0,0 +1,149 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pdf-markings-amqp
+  namespace: documentations
+  labels:
+    app: pdf-markings-amqp
+    k8slens-edit-resource-version: v1
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: pdf-markings-amqp
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: pdf-markings-amqp
+    spec:
+      containers:
+      - env:
+        - name: VERIFY
+          value: 'False'
+        - name: MARKS_APP__LOG_LEVEL
+          value: INFO
+        - name: HTTP_PORT
+          value: '8000'
+        - name: MARKS_DOCUMENTS_DB__HOST
+          value: postgres-service
+        - name: MARKS_DOCUMENTS_DB__PORT
+          value: '5432'
+        - name: MARKS_DOCUMENTS_DB__DATABASE
+          value: documentations
+        - name: DOC_POSTGRES_POOL_SIZE
+          value: '10'
+        - name: MARKS_DOCUMENTS_DB__SSLMODE
+          value: disable
+        - name: API_ADDRESS
+          value: 0.0.0.0:8000
+        - name: DATABASE_SSL_MODE
+          value: disable
+        - name: MARKS_S3__USE_SSL
+          value: 'false'
+        - name: MARKS_S3__SSL_VERIFY
+          value: 'false'
+        - name: MARKS_S3__DEFAULT_BUCKET
+          value: documentations-2-donstroi
+        - name: ENVIRONMENT
+          value: production
+        - name: YANDEX_S3_ACCOUNT_PATH
+          value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+        - name: MARKS_QR__REDIRECT_URL
+          value: https://stamp-verification.sarex.dsinv.ru/
+        - name: MARKS_QR__BASE_DOCUMENT_URL
+          value: https://sarex.dsinv.ru
+        - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
+          value: pdf_markings_input
+        - name: MARKS_S3__REGION
+          value: ru-central1
+        - name: MARKS_CRYPTO__HASHING_ALGO
+          value: md_gost12_256
+        - name: MARKS_DOCUMENTS_DB__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: postgres-secret
+        - name: MARKS_DOCUMENTS_DB__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret
+        - name: MARKS_S3__URL
+          valueFrom:
+            secretKeyRef:
+              key: endpoint_url
+              name: yc-s3
+        - name: MARKS_S3__ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: key_id
+              name: yc-s3
+        - name: MARKS_S3__SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access_key
+              name: yc-s3
+        - name: MARKS_RABBITMQ__HOST
+          valueFrom:
+            secretKeyRef:
+              key: host
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__PORT
+          valueFrom:
+            secretKeyRef:
+              key: port
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__VHOST
+          valueFrom:
+            secretKeyRef:
+              key: vhost
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
+          valueFrom:
+            secretKeyRef:
+              key: heartbeat
+              name: rabbitmq
+        image: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_84d12e68
+        imagePullPolicy: IfNotPresent
+        name: pdf-markings-amqp
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/sarex/yc-s3-storage
+          name: yc-s3
+          readOnly: true
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - name: yc-s3
+        secret:
+          defaultMode: 420
+          secretName: documentations-yc-s3

apps/documentations/dsinv/pdf-markings.yaml

@@ -0,0 +1,138 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pdf-markings
+  namespace: documentations
+  labels:
+    app: pdf-markings
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: pdf-markings
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: pdf-markings
+    spec:
+      containers:
+      - env:
+        - name: RABBITMQ_HOST
+          value: rabbitmq-service.insert-db-documentation.svc.cluster.local:5672
+        - name: RABBITMQ_USERNAME
+          value: sarex
+        - name: RABBITMQ_PASSWORD
+          value: QvGBXtzHCjNVAmJq4v6tKBvk76mXy6RP
+        - name: RABBITMQ_VHOST
+          value: api
+        - name: APP_NAME
+          value: pdm_v2
+        - name: VERIFY
+          value: 'False'
+        - name: APP_VERSION
+          value: 0.0.1
+        - name: LOG_LEVEL
+          value: INFO
+        - name: HTTP_PORT
+          value: '8000'
+        - name: DOC_POSTGRES_HOST
+          value: postgres-service
+        - name: DOC_POSTGRES_PORT
+          value: '5432'
+        - name: DOC_POSTGRES_DB
+          value: documentations
+        - name: DOC_POSTGRES_POOL_SIZE
+          value: '10'
+        - name: DOC_POSTGRES_SSL_MODE
+          value: disable
+        - name: API_ADDRESS
+          value: 0.0.0.0:8000
+        - name: DATABASE_SSL_MODE
+          value: disable
+        - name: YANDEX_S3_USE_SSL
+          value: '0'
+        - name: ENVIRONMENT
+          value: production
+        - name: YANDEX_S3_ACCOUNT_PATH
+          value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+        - name: REDIRECT_URL_QR
+          value: https://stamp-verification.sarex.dsinv.ru/
+        - name: BASE_DOCUMENT_URL
+          value: https://sarex.dsinv.ru
+        - name: SENTRY_DSN
+        - name: DOC_POSTGRES_USER
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: postgres-secret
+        - name: DOC_POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret
+        - name: YANDEX_S3_ENDPOINT_URL
+          valueFrom:
+            secretKeyRef:
+              key: endpoint_url
+              name: yc-s3
+        - name: YANDEX_S3_SECRET_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access_key
+              name: yc-s3
+        - name: YANDEX_S3_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef:
+              key: key_id
+              name: yc-s3
+        image: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings:prod_67df7ec7
+        imagePullPolicy: IfNotPresent
+        name: pdf-markings
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/sarex/yc-s3-storage
+          name: yc-s3
+          readOnly: true
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - name: yc-s3
+        secret:
+          defaultMode: 420
+          secretName: documentations-yc-s3
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: marks-service
+  namespace: documentations
+spec:
+  ports:
+  - port: 8000
+    protocol: TCP
+    targetPort: 8000
+  selector:
+    app: pdf-markings
+  sessionAffinity: None
+  type: ClusterIP

apps/documentations/dsinv/pdm-api.yaml

@@ -0,0 +1,120 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pdm-api
+  namespace: documentations
+spec:
+  replicas: 3
+  template:
+    spec:
+      containers:
+      - name: pdm-api
+        image: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_542e5343
+        env:
+        - name: OBSERVABILITY_COLLECTOR_ENDPOINT
+          value: temp
+        - name: USE_SUBSCRIPTIONS
+          value: 'false'
+        - name: RELEASES_URL
+          value: https://gitlab.com
+        - name: APP_NAME
+          value: pdm_v2
+        - name: APP_VERSION
+          value: 0.0.1
+        - name: LOG_LEVEL
+          value: INFO
+        - name: HTTP_PORT
+          value: '8080'
+        - name: POSTGRES_ADDRESS
+          value: postgres-service.documentations.svc.cluster.local
+        - name: POSTGRES_PORT
+          value: '5432'
+        - name: POSTGRES_DB
+          value: documentations
+        - name: POSTGRES_POOL_SIZE
+          value: '20'
+        - name: API_ADDRESS
+          value: 0.0.0.0:8080
+        - name: API_ADDRESS_FILE
+          value: 0.0.0.0:8080
+        - name: ENABLE_OBSERVABILITY
+          value: 'false'
+        - name: ENABLE_SSL
+          value: '0'
+        - name: ENABLE_S3
+          value: '1'
+        - name: DOCUMENTATION_URL
+          value: http://documentations-service.documentations.svc.cluster.local:8080/
+        - name: WORKFLOW_URL
+          value: http://workflows-service.workflow.svc.cluster.local:8000/
+        - name: WORKSPACE_URL
+          value: http://workspaces-service.workspaces.svc.cluster.local:8000
+        - name: BIM_API_V2_URL
+          value: http://backend-service.bim.svc.cluster.local:8000/
+        - name: BIM_V2_HOST
+          value: http://backend-service.bim.svc.cluster.local:8000/
+        - name: WORKSPACE_BUNDLE_VERSION
+          value: v1
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: NAMESPACE
+          value: documentations
+        - name: DJANGO_ORIGINATOR
+          value: docs_prod
+        - name: FLOWS_URL
+          value: http://backend-service.flows.svc.cluster.local:8000
+        - name: RESOURCES_URL
+          value: http://resources-service.resources.svc.cluster.local:8000
+        - name: REMARKS_URL
+          value: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks
+        - name: ATTACHMENTS_URL
+          value: http://attachments-service.attachments.svc.cluster.local:80
+        - name: WORKFLOW_IMAGES_VERSION
+          value: master
+        - name: WORKFLOWS_IMAGES_VERSION
+          value: master
+        - name: WORKFLOWS_IMAGES_VERSION
+          value: master
+        - name: INSPECTIONS_URL
+          value: http://inspections-service.inspections
+        - name: STATES_URL
+          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
+        - name: WIDTH_THUMB_STATES
+          value: '120'
+        - name: HEIGHT_THUMB_STATES
+          value: '73'
+        - name: WIDTH_THUMB_ATTACHMENTS
+          value: '300'
+        - name: HEIGHT_THUMB_ATTACHMENTS
+          value: '300'
+        - name: ENABLE_PERMISSIONS_FILTER
+          value: '1'
+        - name: PERMISSIONS_FILTER_COMPANIES
+          value: '[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]'
+        - name: SUBSCRIPTIONS_URL
+          value: http://sarex-subscriptions-service.subscriptions
+        - name: SYSTEM_LOG_URL
+          value: http://api-service.system-log.svc.cluster.local:8000
+        - name: API_HOST_PREFIX
+          value: /gateway
+        - name: TARGET_URL
+          value: http://backend.django.svc.cluster.local:8000
+        - name: EAV_URL
+          value: http://eav-service.eav.svc.cluster.local:8000
+        - name: NOTES_URL
+          value: http://backend-service.notes.svc.cluster.local:8000
+        - name: S3_SERVICE_ACCOUNT
+          value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+        - name: READ_WRITE_TIMEOUT_FILE_STREAM
+          value: 6h
+        - name: CACHE_DEFAULT_EXPIRATION
+          value: 60s
+        - name: CACHE_CLEANUP_INTERVAL
+          value: 60s
+        - name: USE_CACHE_IN_FILE_STREAMER
+          value: '1'
+        - name: ENVIRONMENT
+          value: prod
+        - name: TRANSMITTALS_BASE_URL
+          value: http://transmittal-service.transmittals.svc.cluster.local:80

apps/documentations/dsinv/stamp-verification.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stamp-verification
+  namespace: documentations
+  labels:
+    app: stamp-verification
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: stamp-verification
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: stamp-verification
+    spec:
+      containers:
+      - image: cr.yandex/crp3ccidau046kdj8g9q/stamp-verification-frontend:df166f698f2812f1db1e989305db936df88da09e
+        imagePullPolicy: Always
+        name: stamp-verification-frontend
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: stamp-verification-frontend-service
+  namespace: documentations
+spec:
+  ports:
+  - port: 8080
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: stamp-verification
+  sessionAffinity: None
+  type: ClusterIP

apps/eav/dsinv/backend.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: eav
+spec:
+  template:
+    spec:
+      containers:
+      - name: backend
+        image: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_ddce2b51
+        env:
+        - name: DJANGO_SETTINGS_MODULE
+          value: config.settings.production
+        - name: ASSETS_TOPIC
+          value: sarex
+        - name: KAFKA_SSL_CAFILE
+          value: /usr/local/share/ca-certificates/ca.crt
+        - name: DJANGO_POSTGRES_HOST
+          value: postgres-service
+        - name: DJANGO_POSTGRES_DATABASE
+          value: eav_db
+        - name: YC_S3_ENDPOINT_URL
+          value: http://minio-service.minio.svc.cluster.local:9000
+        - name: YC_S3_BUCKET_NAME
+          value: eav

apps/eav/dsinv/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: eav
+resources:
+- ../base
+patches:
+- path: backend.yaml
+  target:
+    kind: Deployment
+    name: backend

apps/flows/dsinv/backend.yaml

@@ -0,0 +1,92 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: flows
+spec:
+  replicas: 2
+  template:
+    spec:
+      containers:
+      - name: backend
+        image: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a5d748f0
+        env:
+        - name: DEBUG
+          value: 'false'
+        - name: PLANNING_HOST
+          value: http://backend-service.pm.svc.cluster.local:8000/api/pm/msp
+        - name: PLANNING_USE
+          value: 'True'
+        - name: PG_PORT
+          value: '5432'
+        - name: EAV_HOST
+          value: http://eav-service.eav.svc.cluster.local:8000
+        - name: PROXY_PATH_PREFIX
+          value: /flows
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000/api
+        - name: DOCUMENTATION_TIMEOUT
+          value: '240'
+        - name: DOCUMENTATION_HOST
+          value: http://documentations-service.documentations.svc.cluster.local:8080/internal/v1
+        - name: DOCUMENTATION_EXTERNAL_HOST
+          value: http://documentations-service.documentations.svc.cluster.local:8080/api/v1
+        - name: BASE_HOST
+          value: https://sarex.dsinv.ru
+        - name: DOCUMENTATION_PG_PORT
+          value: '5432'
+        - name: DOCUMENTATION_PG_DATABASE
+          value: documentations
+        - name: DOCUMENTATION_PG_HOST
+          value: postgres-service.documentations.svc.cluster.local
+        - name: WORKFLOWS_HOST
+          value: http://workflows-service.workflow.svc.cluster.local:8000/api/v1
+        - name: WORKFLOWS_NOTIFICATIONS_REGISTRY
+          value: cr.yandex/crp3ccidau046kdj8g9q
+        - name: WORKFLOWS_NOTIFICATIONS_SMTP_HOST
+          value: relay.dsinv.ru
+        - name: WORKFLOWS_NOTIFICATIONS_SMTP_PORT
+          value: '25'
+        - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAI
+          value: sarex@dsinv.ru
+        - name: NOTIFICATION_SETTINGS_USE_MAILGUN
+          value: '0'
+        - name: RESOURCES_HOST
+          value: http://resources-service.resources.svc.cluster.local:8000
+        - name: ENABLE_METRICS
+          value: '0'
+        - name: ENABLE_MAILGUN
+          value: '0'
+        - name: SMTP_HOST
+          value: relay.dsinv.ru
+        - name: SMTP_PORT
+          value: '25'
+        - name: FROM_EMAIL
+          value: sarex@dsinv.ru
+        - name: TIMEOUT
+          value: '240'
+        - name: WORKFLOWS_TIMEOUT
+          value: '20'
+        - name: RESOURCE_URL
+          value: http://resources-service.resources.svc.cluster.local:8000/
+        - name: GATEWAY_URL
+          value: http://pdm-api.documentations.svc.cluster.local:8080/
+        - name: SYNC_RESOURCE_ID
+          value: '1'
+        - name: SERVICE_HOST
+          value: https://sarex.dsinv.ru/flows/api/v1
+        - name: ENABLE_ANALYTICS
+          value: '1'
+        - name: ENABLE_CELERY
+          value: '1'
+        - name: CELERY_QUEUE
+          value: flow
+        - name: RABBITMQ_HOST
+          value: rabbitmq-service.flows.svc
+        - name: RABBITMQ_PORT
+          value: '5672'
+        - name: RABBITMQ_VHOST
+          value: flow
+        - name: PG_HOST
+          value: postgres-service.flows.svc.cluster.local

apps/flows/dsinv/celery.yaml

@@ -0,0 +1,93 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: celery
+  namespace: flows
+spec:
+  template:
+    spec:
+      containers:
+      - name: celery
+        image: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a5d748f0
+        env:
+        - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAIL
+          value: sarex@dsinv.ru
+        - name: ENABLE_METRICS
+          value: '0'
+        - name: ENABLE_MAILGUN
+          value: '0'
+        - name: SMTP_HOST
+          value: relay.dsinv.ru
+        - name: SMTP_PORT
+          value: '25'
+        - name: FROM_EMAIL
+          value: sarex@dsinv.ru
+        - name: MAILGUN_HOST
+          value: http:localhost:8000
+        - name: MAILGUN_API_KEY
+          value: empty
+        - name: NOTIFICATION_SETTINGS_USE_MAILGUN
+          value: '0'
+        - name: WORKFLOWS_HOST
+          value: http://workflows-service.workflow.svc.cluster.local:8000/api/v1
+        - name: FLOWS_HOST
+          value: http://backend-service.flows.svc.cluster.local:8000
+        - name: WORKFLOWS_NOTIFICATIONS_REGISTRY
+          value: cr.yandex/crp3ccidau046kdj8g9q
+        - name: WORKFLOWS_NOTIFICATIONS_SMTP_HOST
+          value: relay.dsinv.ru
+        - name: WORKFLOWS_NOTIFICATIONS_SMTP_PORT
+          value: '25'
+        - name: PLANNING_HOST
+          value: http://backend-service.pm.svc.cluster.local:8000/api/pm/msp
+        - name: PLANNING_USE
+          value: 'True'
+        - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAI
+          value: sarex@dsinv.ru
+        - name: FLOWS_DB_HOST
+          value: postgres-service.flows.svc.cluster.local
+        - name: ISSUES_DB_HOST
+          value: postgres-service.issues.svc.cluster.local
+        - name: DEBUG
+          value: '0'
+        - name: PG_PORT
+          value: '5432'
+        - name: FLOWS_DB_PORT
+          value: '5432'
+        - name: ISSUES_DB_PORT
+          value: '5432'
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000/api
+        - name: DJANGO_BASE_HOST
+          value: https://sarex.dsinv.ru
+        - name: DOCUMENTATION_HOST
+          value: http://documentations-service.documentations.svc.cluster.local:8080/internal/v1
+        - name: BASE_HOST
+          value: https://sarex.dsinv.ru
+        - name: RESOURCES_HOST
+          value: http://resources-service.resources.svc.cluster.local:8000/
+        - name: TIMEOUT
+          value: '120'
+        - name: RESOURCE_URL
+          value: http://resources-service.resources/api/v1
+        - name: GATEWAY_URL
+          value: http://pdm-api.documentations.svc.cluster.local:8080/api/v1
+        - name: SYNC_RESOURCE_ID
+          value: '1'
+        - name: SERVICE_HOST
+          value: https://sarex.dsinv.ru/flows/api/v1
+        - name: ENABLE_ANALYTICS
+          value: '1'
+        - name: ENABLE_CELERY
+          value: '1'
+        - name: CELERY_QUEUE
+          value: flow
+        - name: RABBITMQ_HOST
+          value: rabbitmq-service.flows.svc
+        - name: RABBITMQ_PORT
+          value: '5672'
+        - name: RABBITMQ_VHOST
+          value: flow
+        - name: PG_HOST
+          value: postgres-service.flows.svc.cluster.local

apps/flows/dsinv/export-reviews.yaml

@@ -0,0 +1,81 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: export-reviews
+  namespace: flows
+  labels:
+    app: export-reviews
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: export-reviews
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: export-reviews
+    spec:
+      containers:
+      - env:
+        - name: BASE_HOST
+          value: https://sarex.dsinv.ru
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: REVIEWS_HOST
+          value: http://backend-service.flows.svc.cluster.local:8000
+        - name: GATEWAY_HOST
+          value: http://pdm-api.documentations.svc.cluster.local:8080
+        - name: DJANGO_TIMEOUT
+          value: '180'
+        - name: REVIEWS_TIMEOUT
+          value: '180'
+        - name: GATEWAY_TIMEOUT
+          value: '180'
+        - name: DOCUMENTATIONS_HOST
+          value: http://documentations-service.documentations.svc.cluster.local:8080
+        - name: DOCUMENTATIONS_TIMEOUT
+          value: '180'
+        - name: TIMEOUT
+          value: '180'
+        - name: VERIFY_HTTPS
+          value: 'false'
+        image: cr.yandex/crp3ccidau046kdj8g9q/export-reviews:preprod_1ba89807
+        imagePullPolicy: IfNotPresent
+        name: export-reviews
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: export-reviews
+  namespace: flows
+spec:
+  ports:
+  - port: 8000
+    protocol: TCP
+    targetPort: 8000
+  selector:
+    app: export-reviews
+  sessionAffinity: None
+  type: ClusterIP

apps/flows/dsinv/frontend.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: flows
+spec:
+  template:
+    spec:
+      containers:
+      - name: frontend
+        image: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_bad7aeb2

apps/flows/dsinv/kustomization.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flows
+resources:
+- ../base
+- export-reviews.yaml
+- reviews-frontend.yaml
+- worker-celery-beat.yaml
+patches:
+- path: backend.yaml
+  target:
+    kind: Deployment
+    name: backend
+- path: celery.yaml
+  target:
+    kind: Deployment
+    name: celery
+- path: frontend.yaml
+  target:
+    kind: Deployment
+    name: frontend

apps/flows/dsinv/reviews-frontend.yaml

@@ -0,0 +1,85 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: reviews-frontend
+  namespace: flows
+  labels:
+    app: reviews-frontend
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: reviews-frontend
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: reviews-frontend
+        version: stable
+    spec:
+      containers:
+      - image: cr.yandex/crp3ccidau046kdj8g9q/reviews-frontend:contour_71b77f8d
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 10
+          httpGet:
+            path: /ping
+            port: 80
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 60
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: reviews-frontend
+        ports:
+        - containerPort: 80
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /ping
+            port: 80
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 30
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 100Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: reviews-frontend-service
+  namespace: flows
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: reviews-frontend
+  sessionAffinity: None
+  type: ClusterIP

apps/flows/dsinv/worker-celery-beat.yaml

@@ -0,0 +1,251 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: worker-celery-beat
+  namespace: flows
+  labels:
+    app: worker-celery-beat
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: worker-celery-beat
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: worker-celery-beat
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - worker-celery-beat
+            topologyKey: kubernetes.io/hostname
+      containers:
+      - command:
+        - celery
+        - -A
+        - src.worker
+        - beat
+        - -l
+        - DEBUG
+        env:
+        - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAIL
+          value: sarex@dsinv.ru
+        - name: ENABLE_METRICS
+          value: '0'
+        - name: ENABLE_MAILGUN
+          value: '0'
+        - name: SMTP_HOST
+          value: relay.dsinv.ru
+        - name: SMTP_PORT
+          value: '25'
+        - name: FROM_EMAIL
+          value: sarex@dsinv.ru
+        - name: MAILGUN_HOST
+          value: http:localhost:8000
+        - name: MAILGUN_API_KEY
+          value: empty
+        - name: NOTIFICATION_SETTINGS_USE_MAILGUN
+          value: '0'
+        - name: WORKFLOWS_HOST
+          value: http://workflows-service.workflow.svc.cluster.local:8000/api/v1
+        - name: FLOWS_HOST
+          value: http://backend-service.flows.svc.cluster.local:8000
+        - name: WORKFLOWS_NOTIFICATIONS_REGISTRY
+          value: cr.yandex/crp3ccidau046kdj8g9q
+        - name: WORKFLOWS_NOTIFICATIONS_SMTP_HOST
+          value: relay.dsinv.ru
+        - name: WORKFLOWS_NOTIFICATIONS_SMTP_PORT
+          value: '25'
+        - name: PLANNING_HOST
+          value: http://backend-service.pm.svc.cluster.local:8000/api/pm/msp
+        - name: PLANNING_USE
+          value: 'True'
+        - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAI
+          value: sarex@dsinv.ru
+        - name: FLOWS_DB_HOST
+          value: postgres-service.flows.svc.cluster.local
+        - name: FLOWS_DB_DB
+          valueFrom:
+            secretKeyRef:
+              key: database
+              name: postgres-secret
+        - name: FLOWS_DB_USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: postgres-secret
+        - name: FLOWS_DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret
+        - name: ISSUES_DB_HOST
+          value: postgres-service.issues.svc.cluster.local
+        - name: ISSUES_DB_DB
+          valueFrom:
+            secretKeyRef:
+              key: database
+              name: postgres-secret-issues
+        - name: ISSUES_DB_USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: postgres-secret-issues
+        - name: ISSUES_DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret-issues
+        - name: DEBUG
+          value: '0'
+        - name: PG_PORT
+          value: '5432'
+        - name: FLOWS_DB_PORT
+          value: '5432'
+        - name: ISSUES_DB_PORT
+          value: '5432'
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000/api
+        - name: DJANGO_BASE_HOST
+          value: https://sarex.dsinv.ru
+        - name: DJANGO_AUTH
+          valueFrom:
+            secretKeyRef:
+              key: token
+              name: django-secret
+        - name: DOCUMENTATION_HOST
+          value: http://documentations-service.documentations.svc.cluster.local:8080/internal/v1
+        - name: BASE_HOST
+          value: https://sarex.dsinv.ru
+        - name: RESOURCES_HOST
+          value: http://resources-service.resources.svc.cluster.local:8000/
+        - name: TIMEOUT
+          value: '120'
+        - name: RESOURCE_URL
+          value: http://resources-service.resources/api/v1
+        - name: GATEWAY_URL
+          value: http://pdm-api.documentations.svc.cluster.local:8080/api/v1
+        - name: SYNC_RESOURCE_ID
+          value: '1'
+        - name: SERVICE_HOST
+          value: https://sarex.dsinv.ru/flows/api/v1
+        - name: ENABLE_ANALYTICS
+          value: '1'
+        - name: ENABLE_CELERY
+          value: '1'
+        - name: CELERY_QUEUE
+          value: flow
+        - name: RABBITMQ_HOST
+          value: rabbitmq-service.flows.svc
+        - name: RABBITMQ_PORT
+          value: '5672'
+        - name: RABBITMQ_VHOST
+          value: flow
+        - name: PG_HOST
+          value: postgres-service.flows.svc.cluster.local
+        - name: PG_DB
+          valueFrom:
+            secretKeyRef:
+              key: database
+              name: postgres-secret
+        - name: PG_LOGIN
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: postgres-secret
+        - name: PG_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret
+        - name: DJANGO_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: token
+              name: django-secret
+        - name: RABBITMQ_USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: rabbitmq-secret
+        - name: RABBITMQ_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: rabbitmq-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worke:dsinv_700a79e5
+        imagePullPolicy: IfNotPresent
+        name: worker-celery-beat
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        resources:
+          requests:
+            cpu: '1'
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /opt/src/worker/notifications_task.py
+          name: notifications-task
+          subPath: notifications_task.py
+        - mountPath: /opt/src/worker/templates/daily_digest.html
+          name: daily-digest
+          subPath: daily_digest.html
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: notifications_task.py
+            path: notifications_task.py
+          name: notifications-task
+        name: notifications-task
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: daily_digest.html
+            path: daily_digest.html
+          name: daily-digest
+        name: daily-digest
+---
+apiVersion: v1
+data:
+  daily_digest.html: "{% extends \"base_email.html\" %}\n\n{%- macro expiration_date(date, today) -%}\n{%- if date -%}\n<span class=\"expiration {{ 'expired' if date.date() < today else ('critical' if date.date() == today else 'normal') }}\">{{\n    date.strftime('%d.%m.%Y')\n}}</span>\n{%- else -%}\nБез срока\n{%- endif -%}\n{%- endmacro %}\n\n{%- macro review_link(review, base_host) -%}\n<a href=\"{{ base_host }}/reviews/{{ review['review_id'] }}\">{{ review['review_name'] | e }}</a>\n{%- endmacro %}\n\n{%- block content %}\n<p>На сегодня в Sarex вашей реакции ждут следующие согласования:</p>\n\n{% if force_headers or len(expired_reviews) + len(ongoing_reviews) > 0 -%}\n<p>Согласования ({{ ongoing_reviews | length + expired_reviews | length }}):</p>\n{%- endif %}\n\n{% if force_headers or len(expired_reviews) > 0 -%}\n<p class=\"subitem\">Просроченные задачи ({{ expired_reviews | length }}):</p>\n<ol>\n    {% for review in expired_reviews -%}\n    <li><p>\n        Проект: {{ review['resource_name'] | e }}, Согласование: {{ review_link(review, base_host) }},<br>\n        Шаг: {{ review['step_name'] | e }}, Срок задачи: {{ expiration_date(review['expires_at'], today) }}, ID: (# {{ review['review_id'] }} )\n    </p></li>\n    {%- endfor %}\n</ol>\n{%- endif %}\n\n{% if force_headers or len(ongoing_reviews) > 0 -%}\n<p class=\"subitem\">Активные задачи ({{ ongoing_reviews | length }}):</p>\n<ol>\n    {% for review in ongoing_reviews -%}\n    <li><p>\n        Проект: {{ review['resource_name'] | e }}, Согласование: {{ review_link(review, base_host) }},<br>\n        Шаг: {{ review['step_name'] | e }}, Срок задачи: {{ expiration_date(review['expires_at'], today) }}, ID: (# {{ review['review_id'] }} )\n    </p></li>\n    {%- endfor %}\n</ol>\n{%- endif %}\n\n<p>С уважением, <br>команда Sarex</p>\n{% endblock %}\n"
+kind: ConfigMap
+metadata:
+  name: daily-digest
+  namespace: flows
+---
+apiVersion: v1
+data:
+  notifications_task.py: "from collections import defaultdict\nfrom datetime import datetime\nfrom pathlib import Path\nfrom zoneinfo import ZoneInfo\n\nfrom jinja2 import Environment, FileSystemLoader\n\nfrom src.worker.celery import celery_app\nfrom src.worker.notifications_config import (\n    DjangoClient,\n    FlowsDatabase,\n    ResourcesClient,\n    IssuesDatabase,\n    MailgunClient,\n    NotificationGlobalSettings,\n    WorkflowsNotificationsClient,\n)\n\n\n@celery_app.task(name=\"notify_users\")\ndef notify_users():\n    django_client = DjangoClient()\n    resources_client = ResourcesClient()\n    flows_db = FlowsDatabase()\n    flows_db_connection = flows_db.get_connection()\n    issues_db = IssuesDatabase()\n    issues_db_connection = issues_db.get_connection()\n\n    users = django_client.get_users_with_enabled_notifications()\n    users = {user[\"id\"]: user for user in users}\n    if not users:\n        flows_db_connection.close()\n        issues_db_connection.close()\n        return\n    resources = resources_client.get_resources()\n    resources = {resource[\"id\"]: resource[\"name\"] for resource in resources}\n\n    with flows_db_connection.cursor() as cursor:\n        cursor.execute(\n            f\"\"\"\n            SELECT\n                r.id AS review_id,\n                tq.reviewer_id AS user_id,\n                r.resource_id AS resource_id,\n                r.name AS review_name,\n                s.name AS step_name,\n                tq.end_date AS expires_at\n            FROM task_queue tq\n            JOIN review r\n                ON r.id = tq.review_id\n            JOIN step s\n                ON s.id = r.current_step_id\n            WHERE tq.reviewer_id IN ({\",\".join(str(x) for x in users.keys())})\n            AND tq.is_active\n            \"\"\"\n        )\n        result = cursor.fetchall()\n    flows_db_connection.close()\n\n    reviews_tasks = defaultdict(list)\n    for review_task in result:\n        review_task[\"resource_name\"] = resources.get(str(review_task[\"resource_id\"]), \"Без проекта\")\n        reviews_tasks[review_task[\"user_id\"]].append(review_task)\n\n    with issues_db_connection.cursor() as cursor:\n        cursor.execute(\n            f\"\"\"\n            SELECT\n                i.public_id AS issue_id,\n                i.author_id AS user_id,\n                i.resource_id AS resource_id,\n                i.title AS name,\n                i.completion_date AS expires_at\n            FROM issues_issue i\n            JOIN issues_issuestatus s\n                ON s.id = i.status_id\n            WHERE author_id IN ({\",\".join(str(x) for x in users.keys())})\n                AND s.name NOT IN ('created', 'done')\n                AND i.deleted_at IS NULL\n            \"\"\"\n        )\n        authors_result = cursor.fetchall()\n        cursor.execute(\n            f\"\"\"\n            SELECT\n                i.public_id AS issue_id,\n                ru.responsible_id AS user_id,\n                i.resource_id AS resource_id,\n                i.title AS name,\n                i.completion_date AS expires_at\n            FROM issues_issue i\n            JOIN issues_responsibleuser ru\n                ON ru.issue_id_id = i.public_id\n            JOIN issues_issuestatus s\n                ON s.id = i.status_id\n            WHERE ru.responsible_id IN ({\",\".join(str(x) for x in users.keys())})\n                AND s.name = 'created'\n                AND i.deleted_at IS NULL\n            \"\"\"\n        )\n        responsibles_result = cursor.fetchall()\n        cursor.execute(\n            \"\"\"\n            SELECT\n                i.public_id AS issue_id,\n                i.responsible_entities AS responsible_entities,\n                i.resource_id AS resource_id,\n                i.title AS name,\n                i.completion_date AS expires_at\n            FROM issues_issue i\n            JOIN issues_issuestatus s\n                ON s.id = i.status_id\n            WHERE i.responsible_entities IS NOT NULL\n                AND s.name = 'created'\n                AND\
+    \ i.deleted_at IS NULL\n            \"\"\"\n        )\n        responsibles_sa_result = cursor.fetchall()\n    issues_db_connection.close()\n\n    issues_tasks = defaultdict(list)\n    for issue_task in authors_result + responsibles_result:\n        issue_task[\"resource_name\"] = resources.get(str(issue_task[\"resource_id\"]), \"Без проекта\")\n        issues_tasks[issue_task[\"user_id\"]].append(issue_task)\n\n    for issue in responsibles_sa_result:\n        responsible_entities = issue[\"responsible_entities\"]\n        positions = set()\n        departments = set()\n        for entity in responsible_entities[\"entities_list\"]:\n            if entity[\"model_name\"] == \"position\":\n                positions.add(str(entity[\"service_account_id\"]))\n            elif entity[\"model_name\"] == \"department\":\n                departments.add(str(entity[\"service_account_id\"]))\n        if responsible_entities[\"operation\"] == \"AND\":\n            if positions and departments:\n                condition = lambda user_positions, user_departments: \\\n                    positions & user_positions and departments & user_departments\n            elif positions:\n                condition = lambda user_positions, _: \\\n                    positions & user_positions\n            else:\n                condition = lambda _, user_departments: \\\n                    departments & user_departments\n        elif responsible_entities[\"operation\"] == \"OR\":\n            condition = lambda user_positions, user_departments: \\\n                positions & user_positions or departments & user_departments\n        else:\n            condition = lambda *_: False\n\n        for user in users.values():\n            user_positions, user_departments = set([p[\"service_account_id\"] for p in user[\"positions\"]]), \\\n                set([d[\"service_account_id\"] for d in user[\"departments\"]])\n            if condition(user_positions, user_departments):\n                issue[\"resource_name\"] = resources.get(str(issue[\"resource_id\"]), \"Без проекта\")\n                issues_tasks[user[\"id\"]].append(issue)\n\n    jinja_env = Environment(loader=FileSystemLoader(Path(__file__).parent / \"templates\"))\n    digest_template = jinja_env.get_template(\"daily_digest.html\")\n    today = datetime.now(tz=ZoneInfo('UTC')).date()\n\n    if NotificationGlobalSettings().use_mailgun:\n        mailer = MailgunClient()\n    else:\n        mailer = WorkflowsNotificationsClient(job_name=\"Рассылка уведомлений: ежедневный дайджест\")\n\n    for user_id, user in users.items():\n        if not user[\"email\"]:\n            continue\n        reviews = reviews_tasks.get(user_id, [])\n        issues = issues_tasks.get(user_id, [])\n        if not (reviews or issues):\n            continue\n\n        expired_reviews = []\n        ongoing_reviews = []\n        for review in reviews:\n            if bool(review[\"expires_at\"]) and review[\"expires_at\"].date() < today:\n                expired_reviews.append(review)\n            else:\n                ongoing_reviews.append(review)\n\n        # приклеиваем таймзону, чтобы все даты были offset-aware\n        sorting_placeholder = datetime.max.replace(tzinfo=ZoneInfo('UTC'))\n        expired_reviews.sort(key=lambda review: review[\"expires_at\"] or sorting_placeholder)\n        ongoing_reviews.sort(key=lambda review: review[\"expires_at\"] or sorting_placeholder)\n        issues.sort(key=lambda issue: issue[\"expires_at\"] or sorting_placeholder)\n\n        html = digest_template.render(\n            ongoing_reviews=ongoing_reviews,\n            expired_reviews=expired_reviews,\n            issues=issues,\n            base_host=django_client.base_host,\n            today=today,\n            force_headers=True,  # выводить ли хедеры, если сущностей ноль\n        )\n\n        mailer.send_email(\n            send_to=user[\"email\"],\n            subject=f\"Статус согласований в Sarex — {datetime.now(ZoneInfo('Europe/Moscow')):%d.%m.%Y}\",\n            html=html,\n            company_id=user[\"companies\"\
+    ][0],\n            triggerer_user_id=user_id,\n        )\n\n\n@celery_app.task(name=\"notify_admins_about_empty_steps\")\ndef notify_admins_about_empty_steps():\n    django_client = DjangoClient()\n    resources_client = ResourcesClient()\n    flows_db = FlowsDatabase()\n    flows_db_connection = flows_db.get_connection()\n    \n    if NotificationGlobalSettings().use_mailgun:\n        mailer = MailgunClient()\n    else:\n        mailer = WorkflowsNotificationsClient(job_name=\"Рассылка уведомлений: отсутствуют согласующие\")\n\n\n    admins = django_client.get_flow_admins()\n    admins = {user[\"id\"]: user for user in admins}\n\n    if not admins:\n        flows_db_connection.close()\n        return\n\n    resources = resources_client.get_resources()\n    resources = {resource[\"id\"]: resource[\"name\"] for resource in resources}\n\n    resource2users = resources_client.get_users_by_resources()\n    resource2admins: dict[str, list[dict]] = defaultdict(list)\n    for resource, user_ids in resource2users.items():\n        for user_id in user_ids:\n            if user_id in admins:\n                resource2admins[resource].append(admins[user_id])\n\n    with flows_db_connection.cursor() as cursor:\n        cursor.execute(\n            \"\"\"\n            SELECT\n                r.id AS review_id,\n                r.resource_id AS resource_id,\n                r.name AS review_name,\n                f.company_id AS company_id,\n                s.name AS step_name\n            FROM review r\n            JOIN flow f\n                ON f.id = r.flow_id\n            JOIN step s\n                ON s.id = r.current_step_id\n            WHERE r.status = 'open'\n            AND r.current_reviewers = '{}'\n            AND f.is_active\n            \"\"\"\n        )\n        result = cursor.fetchall()\n    flows_db_connection.close()\n\n    jinja_env = Environment(loader=FileSystemLoader(Path(__file__).parent / \"templates\"))\n    email_template = jinja_env.get_template(\"daily_empty_step.html\")\n\n    for review in result:\n        render_values = {\n            'review_name': review['review_name'],\n            'resource_name': resources.get(str(review[\"resource_id\"]), \"Без проекта\"),\n            'review_id': review['review_id'],\n            'current_step': review['step_name'],\n            'link': f'{django_client.base_host}/reviews/{review[\"review_id\"]}'\n        }\n\n        body = email_template.render(render_values)\n        to = [user['email'] for user in resource2admins[str(review['resource_id'])]]\n        subject = (\n            f\"Напоминание: Отсутствуют согласующие — {render_values['resource_name']}\"\n            f\" — {render_values['review_id']}\"\n            f\" — {render_values['current_step']}\"\n            f\" — {render_values['review_name']}\"\n        )\n\n        if len(to) > 0:\n            user_id = resource2admins[str(review['resource_id'])][0]['id']\n\n            mailer.send_email(\n                send_to=','.join(to),\n                subject=subject,\n                html=body,\n                company_id=review['company_id'],\n                triggerer_user_id=user_id,\n            )\n"
+kind: ConfigMap
+metadata:
+  name: notifications-task
+  namespace: flows

apps/inspections/dsinv/frontend.yaml

@@ -0,0 +1,86 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: inspections
+  labels:
+    app: frontend
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: frontend
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: frontend
+        version: stable
+    spec:
+      containers:
+      - image: cr.yandex/crp3ccidau046kdj8g9q/inspections-frontend:new_donsroi
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 10
+          httpGet:
+            path: /ping
+            port: 80
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 60
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: frontend
+        ports:
+        - containerPort: 80
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /ping
+            port: 80
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 30
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 100Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontend-service
+  namespace: inspections
+  labels: {}
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: frontend
+  sessionAffinity: None
+  type: ClusterIP

apps/inspections/dsinv/inspections-backend.yaml

@@ -0,0 +1,61 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: inspections-backend
+  namespace: inspections
+spec:
+  template:
+    spec:
+      containers:
+      - name: inspections-backend
+        image: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
+        env:
+        - name: DEBUG
+          value: 'false'
+        - name: SERVICE_URL
+          value: https://srx.wb.ru
+        - name: HTTP_APP_HOST
+          value: 0.0.0.0
+        - name: HTTP_APP_PORT
+          value: '8000'
+        - name: HTTP_APP_ROOT_PATH
+          value: /inspections
+        - name: HTTP_APP_WORKERS
+          value: '3'
+        - name: HTTP_APP_ADMIN_ENABLE
+          value: 'true'
+        - name: KAFKA_SSL_CAFILE
+          value: /usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt
+        - name: KAFKA_EAV_ASSETS_TOPIC
+          value: assets_broadcast
+        - name: JWT_AUTH_ENABLE
+          value: 'true'
+        - name: NOTIFICATIONS_ENABLE
+          value: 'true'
+        - name: NOTIFICATIONS_EMAIL_FROM
+          value: hello@sarex.io
+        - name: SAREX_BACKEND_URL
+          value: https://srx.wb.ru
+        - name: SAREX_BACKEND_TIMEOUT
+          value: '30'
+        - name: EAV_URL
+          value: http://eav-service.eav
+        - name: EAV_TIMEOUT
+          value: '30'
+        - name: WORKFLOWS_URL
+          value: http://workflows-service.processing-prod
+        - name: WORKFLOWS_TIMEOUT
+          value: '30'
+        - name: WORKFLOWS_EMAIL_DOCKER_IMAGE
+          value: cr.yandex/crp3ccidau046kdj8g9q/notification:email
+        - name: MOBILE_APP_CURRENT_VERSION
+          value: 1.0.0
+        - name: MOBILE_APP_RECOMMENDED_VERSION
+          value: 1.0.0
+        - name: MOBILE_APP_REQUIRED_VERSION
+          value: 1.0.0
+        - name: MAILER_URL
+          value: http://mailer-service.mailer:8000
+        - name: MAILER_TIMEOUT
+          value: '30'

apps/inspections/dsinv/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: inspections
+resources:
+- ../base
+- frontend.yaml
+- sarex-inspections.yaml
+patches:
+- path: inspections-backend.yaml
+  target:
+    kind: Deployment
+    name: inspections-backend

apps/inspections/dsinv/sarex-inspections.yaml

@@ -0,0 +1,176 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sarex-inspections
+  namespace: inspections
+  labels:
+    app: sarex-inspections
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 0
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: sarex-inspections
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: sarex-inspections
+    spec:
+      containers:
+      - env:
+        - name: POSTGRES_HOST
+          value: postgres-service.inspections.svc.cluster.local
+        - name: POSTGRES_PORT
+          value: '5432'
+        - name: DATABASE_NAME
+          value: inspections_db
+        - name: API_ADDRESS
+          value: '8000'
+        - name: ENVIRONMENT
+          value: production
+        - name: DJANGO_BASIC_AUTH
+          valueFrom:
+            secretKeyRef:
+              key: key
+              name: django-auth
+        - name: POSTGRES_USER
+          valueFrom:
+            secretKeyRef:
+              key: user
+              name: postgres-secret
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret
+        - name: YC_S3_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef:
+              key: key_id
+              name: yc-s3-secret
+        - name: YC_S3_SECRET_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access_key
+              name: yc-s3-secret
+        - name: YC_S3_BUCKET_NAME
+          valueFrom:
+            secretKeyRef:
+              key: storage_bucket_name
+              name: yc-s3-secret
+        - name: YC_S3_ENDPOINT_URL
+          valueFrom:
+            secretKeyRef:
+              key: endpoint_url
+              name: yc-s3-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:2a5866e77fd42d62735401ae8301d492c65ef383
+        imagePullPolicy: IfNotPresent
+        name: sarex-inspections
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        resources:
+          requests:
+            cpu: '1'
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /opt/server/uwsgi.ini
+          name: uwsgi-configmap
+          subPath: uwsgi.ini
+        - mountPath: /server/config/settings/production.py
+          name: django-configmap
+          subPath: production.py
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: uwsgi.ini
+            path: uwsgi.ini
+          name: uwsgi-configmap
+        name: uwsgi-configmap
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: production.py
+            path: production.py
+          name: django-configmap
+        name: django-configmap
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: inspections-service
+  namespace: inspections
+  labels: {}
+spec:
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 8000
+  selector:
+    app: sarex-inspections
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+data:
+  production.py: "import os\n\nfrom .base import *  # noqa: F401, F403\n\n# Base settings\nDEBUG = True\nALLOWED_HOSTS = [\n    \"localhost\",\n    \"sarex.dsinv.ru\",\n    \"inspections-service.inspections\",\n    \"sarex-inspections-service.inspections-prod\",\n]\n\n\n# REST framework settings\nREST_FRAMEWORK = {\n    \"DEFAULT_FILTER_BACKENDS\": [\n        \"django_filters.rest_framework.DjangoFilterBackend\",\n    ],\n    \"DEFAULT_RENDERER_CLASSES\": [\n        \"rest_framework.renderers.JSONRenderer\",\n    ],\n    \"DEFAULT_PAGINATION_CLASS\": \"rest_framework.pagination.LimitOffsetPagination\",\n    \"PAGE_SIZE\": 100,\n}\n\n\n# Database settings\nDATABASES = {\n    \"default\": {\n        \"ENGINE\": \"core.db.backends.postgis\",\n        \"NAME\": os.getenv(\"POSTGRES_DB\") or \"postgres\",\n        \"HOST\": os.getenv(\"POSTGRES_HOST\") or \"postgres\",\n        \"PORT\": os.getenv(\"POSTGRES_PORT\") or \"5432\",\n        \"USER\": os.getenv(\"POSTGRES_USER\") or \"postgres\",\n        \"PASSWORD\": os.getenv(\"POSTGRES_PASSWORD\") or \"postgres\",\n    }\n}\n\n\n# CORS settings\nCORS_ALLOWED_ORIGINS = [\n    \"https://localhost.8000\",\n    \"https://localhost.8080\",\n    \"https://stage.sarex.io\",\n    \"https://sarex.dsinv.ru\",\n    \"https://api.sarex.io\",\n    \"https://lk.sarex.io\",\n]\nCORS_ALLOW_ALL_ORIGINS = True\nCORS_ALLOW_METHODS = [\n    \"GET\",\n    \"OPTIONS\",\n    \"POST\",\n    \"PUT\",\n    \"PATCH\",\n    \"DELETE\",\n]\n\n\n# S3 settings\nAWS_S3_ENDPOINT_URL = os.getenv(\"YC_S3_ENDPOINT_URL\")\nAWS_STORAGE_BUCKET_NAME = os.getenv(\"YC_S3_BUCKET_NAME\")\nAWS_ACCESS_KEY_ID = os.getenv(\"YC_S3_ACCESS_KEY_ID\")\nAWS_SECRET_ACCESS_KEY = os.getenv(\"YC_S3_SECRET_ACCESS_KEY\")\nAWS_DEFAULT_ACL = \"public-read\"\n\nif AWS_S3_ENDPOINT_URL and AWS_STORAGE_BUCKET_NAME and AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY:\n    STATICFILES_STORAGE = \"storages.backends.s3boto3.S3Boto3Storage\"\n    DEFAULT_FILE_STORAGE = \"storages.backends.s3boto3.S3Boto3Storage\"\n"
+kind: ConfigMap
+metadata:
+  name: django-configmap
+  namespace: inspections
+---
+apiVersion: v1
+data:
+  uwsgi.ini: '[uwsgi]
+
+
+    chdir           = /server
+
+    module          = config.wsgi:application
+
+    master          = true
+
+    master-fifo      = /opt/server/uwsgi-backend-server.fifo
+
+    processes       = 8
+
+    http            = 0.0.0.0:8000
+
+    chmod-socket    = 666
+
+    vacuum          = true
+
+    harakiri        = 6000
+
+    buffer-size     = 32768
+
+
+    static-map = /static=/opt/server/static/
+
+    static-map = /media=/opt/server/media/
+
+    '
+kind: ConfigMap
+metadata:
+  name: uwsgi-configmap
+  namespace: inspections

apps/issues/dsinv/backend.yaml

@@ -0,0 +1,53 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: issues
+spec:
+  template:
+    spec:
+      containers:
+      - name: backend
+        image: cr.yandex/crp3ccidau046kdj8g9q/issues:production_31aef17b
+        env:
+        - name: ENABLE_MAILGUN
+          value: 'False'
+        - name: SMTP_HOST
+          value: relay.dsinv.ru
+        - name: SMTP_PORT
+          value: '25'
+        - name: EMAIL_FROM
+          value: sarex@dsinv.ru
+        - name: USE_NOTIFICATIONS
+          value: 'True'
+        - name: DJANGO_SETTINGS_MODULE
+          value: config.settings.production
+        - name: REDIS_HOST
+          value: redis-service.issues.svc.cluster.local
+        - name: DATABASE_HOST
+          value: postgres-service.issues.svc.cluster.local
+        - name: DATABASE_PORT
+          value: '5432'
+        - name: DATABASE_NAME
+          value: issues
+        - name: API_ADDRESS
+          value: '8000'
+        - name: ENVIRONMENT
+          value: production
+        - name: AERO_PUBLIC_HOST
+          value: https://sarex.dsinv.ru
+        - name: BASE_AERO_URL
+          value: http://backend.django.svc.cluster.local:8000
+        - name: BASE_AUTH_URL
+          value: http://backend.django.svc.cluster.local:8000
+        - name: WORKFLOWS_HOST
+          value: http://workflows-service.workflow.svc.cluster.local:8000
+        - name: WORKFLOWS_URL
+          value: https://sarex.dsinv.ru
+        - name: RESOURCES_API_HOST
+          value: http://resources-service.resources.svc.cluster.local:8000
+        - name: EAV_HOST
+          value: http://eav-service.eav.svc.cluster.local:8000
+        - name: SAREX_API
+          value: http://backend.django.svc.cluster.local:8000

apps/issues/dsinv/celery.yaml

@@ -0,0 +1,57 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: celery
+  namespace: issues
+spec:
+  template:
+    spec:
+      containers:
+      - name: celery
+        image: cr.yandex/crp3ccidau046kdj8g9q/issues:production_31aef17b
+        env:
+        - name: KAFKA_EAV_ASSETS_TOPIC
+          value: sarex
+        - name: AERO_PUBLIC_HOST
+          value: https://sarex.dsinv.ru
+        - name: ENABLE_MAILGUN
+          value: 'False'
+        - name: SMTP_HOST
+          value: relay.dsinv.ru
+        - name: SMTP_PORT
+          value: '25'
+        - name: EMAIL_FROM
+          value: sarex@dsinv.ru
+        - name: REDIS_HOST
+          value: redis-service.issues.svc.cluster.local
+        - name: DATABASE_HOST
+          value: postgres-service.issues.svc.cluster.local
+        - name: DATABASE_PORT
+          value: '5432'
+        - name: DATABASE_NAME
+          value: issues
+        - name: USE_NOTIFICATIONS
+          value: 'True'
+        - name: API_ADDRESS
+          value: '8000'
+        - name: YC_S3_VERIFY
+          value: 'False'
+        - name: ENVIRONMENT
+          value: production
+        - name: AERO_HOST
+          value: https://sarex.dsinv.ru
+        - name: BASE_AERO_URL
+          value: http://backend.django.svc.cluster.local:8000
+        - name: BASE_AUTH_URL
+          value: https://sarex.dsinv.ru
+        - name: WORKFLOWS_HOST
+          value: http://workflows-service.workflow.svc.cluster.local:8000
+        - name: WORKFLOWS_URL
+          value: https://sarex.dsinv.ru
+        - name: RESOURCES_API_HOST
+          value: http://resources-service.resources.svc.cluster.local:8000
+        - name: EAV_HOST
+          value: http://eav-service.eav.svc.cluster.local:8000
+        - name: SAREX_API
+          value: http://backend.django.svc.cluster.local:8000

apps/issues/dsinv/frontend.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: issues
+spec:
+  template:
+    spec:
+      containers:
+      - name: frontend
+        image: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:24ab8d2b

apps/issues/dsinv/kustomization.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: issues
+resources:
+- ../base
+patches:
+- path: backend.yaml
+  target:
+    kind: Deployment
+    name: backend
+- path: celery.yaml
+  target:
+    kind: Deployment
+    name: celery
+- path: frontend.yaml
+  target:
+    kind: Deployment
+    name: frontend

apps/mapper/dsinv/backend.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: mapper
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+      - name: backend
+        image: cr.yandex/crp3ccidau046kdj8g9q/mapper:0.0.8
+        env:
+        - name: DOCUMENTATION_HOST
+          value: http://backend-service.flows.svc.cluster.local:8000/api/v1
+        - name: FLOW_HOST
+          value: http://backend-service.flows.svc.cluster.local:8000/api/v1
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000/api
+        - name: NOTE_HOST
+          value: http://backend-service.notes.svc.cluster.local:8000/api/v1
+        - name: REDIS_USE
+          value: '0'

apps/mapper/dsinv/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: mapper
+resources:
+- ../base
+patches:
+- path: backend.yaml
+  target:
+    kind: Deployment
+    name: backend

apps/measurements/dsinv/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: measurements
+resources:
+- ../base
+patches:
+- path: measurements.yaml
+  target:
+    kind: Deployment
+    name: measurements

apps/measurements/dsinv/measurements.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: measurements
+  namespace: measurements
+spec:
+  template:
+    spec:
+      containers:
+      - name: measurements
+        image: cr.yandex/crp3ccidau046kdj8g9q/measurements:0.4.3
+        env:
+        - name: DJANGO_HOST
+          value: https://sarex.dsinv.ru

apps/message-hub/dsinv/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: message-hub
+resources:
+- ../base
+patches:
+- path: message-hub.yaml
+  target:
+    kind: Deployment
+    name: message-hub

apps/message-hub/dsinv/message-hub.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: message-hub
+  namespace: message-hub
+spec:
+  template:
+    spec:
+      containers:
+      - name: message-hub
+        image: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_d11aa910
+        env:
+        - name: WORKER_TIMEOUT
+          value: '60'
+        - name: PYTHONPATH
+          value: src
+        - name: SETTINGS_MAX_RETRIES
+          value: '1'
+        - name: SETTINGS_TOPICS
+          value: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod"}'
+        - name: PDF_CONVERTER_HOST
+          value: http://export-project-service.django.svc.cluster.local:8000
+        - name: SAREX_BASE_HOST
+          value: http://backend-service.pm.svc.cluster.local:8000
+        - name: PM_HOST
+          value: http://backend-service.pm.svc.cluster.local:8000
+        - name: DB_HOST
+          value: postgres-service.pm.svc.cluster.local
+        - name: DB_PORT
+          value: '5432'
+        - name: DB_DATABASE
+          value: pm
+        - name: CACHE_HOST
+          value: redis.pm.svc.cluster.local
+        - name: CACHE_PORT
+          value: '6379'
+        - name: CACHE_SSL
+          value: '0'
+        - name: KAFKA_HOST
+          value: donstroi-kafka-bootstrap.kafka.svc.cluster.local
+        - name: KAFKA_PORT
+          value: '9093'
+        - name: KAFKA_SECURITY_PROTOCOL
+          value: SSL
+        - name: KAFKA_SASL_MECHANISM
+          value: PLAIN
+        - name: KAFKA_SSL_CAFILE
+          value: /usr/local/share/ca-certificates/kafka.crt

apps/notes/dsinv/backend.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: notes
+spec:
+  template:
+    spec:
+      containers:
+      - name: main
+        image: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:0.3.6
+        env:
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: BASE_HOST
+          value: https://sarex.dsinv.ru/notes
+        - name: TIMEOUT
+          value: '120'
+        - name: FAAS_SERVICE
+          value: https://sarex.dsinv.ru/lambdas
+        - name: WORKSPACE_URL
+          value: https://sarex.dsinv.ru/workspaces/api/v1
+        - name: WORKFLOW_HOST
+          value: https://sarex.dsinv.ru/workflows/api/v1
+        - name: WORKFLOW_TAG
+          value: stable
+        - name: RESOURCE_URL
+          value: https://sarex.dsinv.ru/resources/api/v1
+        - name: SYNC_RESOURCE_ID
+          value: '0'
+        - name: ATTACHMENT_HOST
+          value: http://attachments-service.attachments.svc.cluster.local:80/api/v1
+        - name: PG_HOST
+          value: postgres-service.notes.svc.cluster.local

apps/notes/dsinv/frontend.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: notes
+spec:
+  template:
+    spec:
+      containers:
+      - name: frontend
+        image: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:donstoi

apps/notes/dsinv/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: notes
+resources:
+- ../base
+patches:
+- path: backend.yaml
+  target:
+    kind: Deployment
+    name: backend
+- path: frontend.yaml
+  target:
+    kind: Deployment
+    name: frontend

apps/pm/dsinv/backend.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: pm
+spec:
+  template:
+    spec:
+      containers:
+      - name: api
+        image: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_3d7e8ea6
+        env:
+        - name: LANG
+          value: C.UTF-8
+        - name: LC_ALL
+          value: C.UTF-8
+        - name: PYTHONUTF8
+          value: '1'
+        - name: USERS_INTERNAL_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: RESOURCES_INTERNAL_HOST
+          value: http://resources-service.resources.svc.cluster.local:8000
+        - name: EAV_HOST
+          value: http://eav-service.eav.svc.cluster.local:8000
+        - name: EAV_API_PREFIX
+          value: /api/v0
+        - name: EAV_API_PREFIX_V1
+          value: /api/v1

apps/pm/dsinv/celery.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: celery
+  namespace: pm
+spec:
+  template:
+    spec:
+      containers:
+      - name: celery
+        image: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_2becf38c
+        env:
+        - name: USERS_INTERNAL_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: RESOURCES_INTERNAL_HOST
+          value: http://resources-service.resources.svc.cluster.local:8000
+        - name: EAV_HOST
+          value: http://eav-service.eav.svc.cluster.local:8000
+        - name: EAV_API_PREFIX
+          value: /api/v0
+        - name: EAV_API_PREFIX_V1
+          value: /api/v1
+        - name: LANG
+          value: C.UTF-8
+        - name: LC_ALL
+          value: C.UTF-8
+        - name: PYTHONUTF8
+          value: '1'

apps/pm/dsinv/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: pm
+resources:
+- ../base
+- static.yaml
+patches:
+- path: backend.yaml
+  target:
+    kind: Deployment
+    name: backend
+- path: celery.yaml
+  target:
+    kind: Deployment
+    name: celery

apps/pm/dsinv/static.yaml

@@ -0,0 +1,62 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: static
+  namespace: pm
+  labels:
+    app: static
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: static
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: static
+        version: stable
+    spec:
+      containers:
+      - image: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_abfaba7c
+        imagePullPolicy: Always
+        name: static
+        ports:
+        - containerPort: 80
+          name: http
+          protocol: TCP
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: static-service
+  namespace: pm
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: static
+  sessionAffinity: None
+  type: ClusterIP

apps/projects/dsinv/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: projects
+resources:
+- ../base
+patches:
+- path: projects-frontend-static.yaml
+  target:
+    kind: Deployment
+    name: projects-frontend-static

apps/projects/dsinv/projects-frontend-static.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: projects-frontend-static
+  namespace: projects
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+      - name: projects-frontend-static
+        image: cr.yandex/crp3ccidau046kdj8g9q/projects-frontend-static:donstroi_front

apps/remarks/dsinv/frontend.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: remarks
+spec:
+  values:
+    services:
+      frontend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/remarks-frontend:donstroi_f6672a63

apps/remarks/dsinv/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: remarks
+resources:
+- ../base
+- remarks-api.yaml
+- remarks-report.yaml
+patches:
+- path: frontend.yaml
+  target:
+    kind: HelmRelease
+    name: frontend

apps/remarks/dsinv/remarks-api.yaml

@@ -0,0 +1,166 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: remarks-api
+  namespace: remarks
+  labels:
+    app: remarks-api
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: remarks-api
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: remarks-api
+    spec:
+      containers:
+      - env:
+        - name: POSTGRES_ADDRESS
+          value: postgres-service
+        - name: POSTGRES_PORT
+          value: '5432'
+        - name: POSTGRES_DB
+          value: remarks_db
+        - name: POSTGRES_POOL_SIZE
+          value: '3'
+        - name: API_ADDRESS
+          value: 0.0.0.0:8000
+        - name: ENABLE_S3_STORAGE
+          value: 'true'
+        - name: S3_SERVICE_ACCOUNT
+          value: /etc/sarex/yc-s3-storage/remarks-yc-s3.json
+        - name: DEFAULT_MEDIA_STORAGE
+          value: s3
+        - name: DEFAULT_MEDIA_PATH
+          value: remark-media
+        - name: MAX_MEDIA_SIZE_MB
+          value: '200'
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: NAMESPACE
+          value: remarks
+        - name: DJANGO_LOGGER_FEATURE
+          value: '0'
+        - name: DJANGO_ORIGINATOR
+          value: rm_prod
+        - name: WORKSPACE_URL
+          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
+        - name: MG_DOMAIN
+          value: mg.sarex.io
+        - name: MG_SENDER
+          value: hello@sarex.io
+        - name: WORKER_ADDRESS
+          value: 0.0.0.0:8000
+        - name: RABBIT_HOST
+          value: rabbitmq-service
+        - name: RABBIT_PORT
+          value: '5672'
+        - name: RABBIT_VHOST
+          value: remarks-prod
+        - name: RABBIT_PING_RETRY_SEC
+          value: '10000'
+        - name: RABBIT_PING_TIMEOUT_SEC
+          value: '10000'
+        - name: RABBIT_PING_CTX_TIMEOUT_SEC
+          value: '10000'
+        - name: TASK_RETRY_COUNT
+          value: '3'
+        - name: ENABLE_SQL_LOGGING
+          value: '0'
+        - name: ENABLE_SSL
+          value: '0'
+        - name: ENVIRONMENT
+          value: prod
+        - name: POSTGRES_USER
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: postgres-secret
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret
+        - name: DJANGO_BASIC_AUTH
+          valueFrom:
+            secretKeyRef:
+              key: key
+              name: django-auth
+        image: cr.yandex/crp3ccidau046kdj8g9q/remarks-api:6cf9a4aded9fd2711c78f1e5eb28e4a4f823364e
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 10
+          httpGet:
+            path: /ping
+            port: 8000
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 60
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: remarks-api
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /ping
+            port: 8000
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 30
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/sarex/yc-s3-storage
+          name: remarks-yc-s3-secret
+          readOnly: true
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: remarks-api-sa
+      serviceAccountName: remarks-api-sa
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - name: remarks-yc-s3-secret
+        secret:
+          defaultMode: 420
+          secretName: remarks-yc-s3
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: remarks-service
+  namespace: remarks
+  labels:
+    app: remarks-api
+spec:
+  ports:
+  - name: http
+    port: 8000
+    protocol: TCP
+    targetPort: 8000
+  selector:
+    app: remarks-api
+  sessionAffinity: None
+  type: ClusterIP

apps/remarks/dsinv/remarks-report.yaml

@@ -0,0 +1,68 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: remarks-report
+  namespace: remarks
+  labels:
+    app: remarks-report
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: remarks-report
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: remarks-report
+    spec:
+      containers:
+      - env:
+        - name: REMARKS_HOST
+          value: http://remarks-service:8000/
+        - name: REMARKS_FRONT_HOST
+          value: https://sarex.dsinv.ru/remarks?uuid=
+        image: cr.yandex/crp3ccidau046kdj8g9q/export-remarks:1.0.0
+        imagePullPolicy: IfNotPresent
+        name: remarks-report
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: remarks-report-service
+  namespace: remarks
+  labels:
+    app: remarks-report
+spec:
+  ports:
+  - name: http
+    port: 8000
+    protocol: TCP
+    targetPort: 8000
+  selector:
+    app: remarks-report
+  sessionAffinity: None
+  type: ClusterIP

apps/resources/dsinv/backend.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: resources
+spec:
+  template:
+    spec:
+      containers:
+      - name: backend
+        image: cr.yandex/crp3ccidau046kdj8g9q/sarex-resources:prod_266c031f
+        env:
+        - name: SAREX_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: DATABASE_HOST
+          value: postgres-service
+        - name: DATABASE_PORT
+          value: '5432'
+        - name: DATABASE_NAME
+          value: resources
+        - name: API_ADDRESS
+          value: '8000'
+        - name: YC_S3_ENDPOINT_URL
+          value: http://minio-service.minio.svc.cluster.local:9000
+        - name: YC_S3_BUCKET_NAME
+          value: eav-service-static

apps/resources/dsinv/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: resources
+resources:
+- ../base
+patches:
+- path: backend.yaml
+  target:
+    kind: Deployment
+    name: backend

apps/subscriptions/dsinv/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: subscriptions
+resources:
+- ../base
+patches:
+- path: sarex-subscriptions.yaml
+  target:
+    kind: Deployment
+    name: sarex-subscriptions

apps/subscriptions/dsinv/sarex-subscriptions.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sarex-subscriptions
+  namespace: subscriptions
+spec:
+  template:
+    spec:
+      containers:
+      - name: subscriptions
+        image: cr.yandex/crp3ccidau046kdj8g9q/sarex-subscriptions:a1262949f39aba31c708488628b6d9bebafbc5ff
+        env:
+        - name: DATABASE_HOST
+          value: postgres-service.subscriptions.svc.cluster.local
+        - name: DATABASE_PORT
+          value: '5432'
+        - name: DATABASE_NAME
+          value: subscriptions
+        - name: API_ADDRESS
+          value: '8000'
+        - name: SYSTEM_LOG_HOST
+          value: http://api-service.system-log.svc.cluster.local:8000
+        - name: USER_SERVICE_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: SMTP_EMAIL_HOST
+          value: relay.dsinv.ru
+        - name: SMTP_EMAIL_PORT
+          value: '25'
+        - name: SMTP_EMAIL_FROM
+          value: sarex@dsinv.ru

apps/system-log/dsinv/api.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: api
+  namespace: system-log
+spec:
+  template:
+    spec:
+      containers:
+      - name: api
+        image: cr.yandex/crp3ccidau046kdj8g9q/system-log:prod_6ed1b27e
+        env:
+        - name: KAFKA_PEM_CERT
+          value: mock
+        - name: KAFKA_PEM_PATH
+          value: local
+        - name: KAFKA_ENABLE_LOGGING
+          value: '0'
+        - name: KAFKA_USE_SSL
+          value: '0'
+        - name: KAFKA_TOPIC
+          value: mock
+        - name: KAFKA_PASSWORD
+          value: mock
+        - name: KAFKA_USERNAME
+          value: mock
+        - name: KAFKA_CLIENT_ID
+          value: system-log-prod
+        - name: KAFKA_GROUP
+          value: system-log-prod
+        - name: KAFKA_ENABLE
+          value: '0'
+        - name: KAFKA_BROKERS
+          value: mock
+        - name: APP_NAME
+          value: system_log
+        - name: APP_VERSION
+          value: 0.0.1
+        - name: LOG_LEVEL
+          value: INFO
+        - name: HTTP_HOST
+          value: 0.0.0.0
+        - name: HTTP_PORT
+          value: '8000'
+        - name: NAMESPACE
+          value: system-log
+        - name: POSTGRES_ADDRESS
+          value: postgres-service
+        - name: POSTGRES_PORT
+          value: '5432'
+        - name: POSTGRES_DB
+          value: system_log
+        - name: POSTGRES_POOL_SIZE
+          value: '3'
+        - name: ENABLE_SSL
+          value: '0'
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000

apps/system-log/dsinv/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: system-log
+resources:
+- ../base
+patches:
+- path: api.yaml
+  target:
+    kind: Deployment
+    name: api
+- path: worker.yaml
+  target:
+    kind: Deployment
+    name: worker

apps/system-log/dsinv/worker.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: worker
+  namespace: system-log
+spec:
+  template:
+    spec:
+      containers:
+      - name: worker
+        image: cr.yandex/crp3ccidau046kdj8g9q/system_log_worker:c32c2f279673d1b5baa872b9d27872b0f3cc71cf
+        env:
+        - name: APP_NAME
+          value: system_log
+        - name: APP_VERSION
+          value: 0.0.1
+        - name: LOG_LEVEL
+          value: INFO
+        - name: HTTP_HOST
+          value: 0.0.0.0
+        - name: HTTP_PORT
+          value: '8000'
+        - name: NAMESPACE
+          value: sarex-system-log
+        - name: DOCUMENTATIONS_URL
+          value: http://documentations-service.documentations.svc.cluster.local:8080
+        - name: POSTGRES_ADDRESS
+          value: postgres-service
+        - name: POSTGRES_PORT
+          value: '5432'
+        - name: POSTGRES_DB
+          value: system_log
+        - name: POSTGRES_POOL_SIZE
+          value: '3'
+        - name: ENABLE_SSL
+          value: '0'
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000

apps/transmittal/dsinv/backend.yaml

@@ -0,0 +1,129 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: transmittal
+spec:
+  template:
+    spec:
+      containers:
+      - name: backend
+        image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4de0b503
+        env:
+        - name: TRANSMITTAL_SERVICE_SMTP__ENABLE_TLS
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_SMTP__HOST
+          value: relay.dsinv.ru
+        - name: TRANSMITTAL_SERVICE_SMTP__PORT
+          value: '25'
+        - name: TRANSMITTAL_SERVICE_SMTP__EMAIL
+          value: sarex@dsinv.ru
+        - name: TRANSMITTAL_SERVICE_APP__NAME
+          value: Transmittal Service
+        - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL
+          value: ERROR
+        - name: TRANSMITTAL_SERVICE_APP__HOST
+          value: https://sarex.dsinv.ru/transmittal
+        - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT
+          value: prod
+        - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS
+          value: '["https://lk.sarex.io", "lk.sarex.io"]'
+        - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS
+          value: '["*"]'
+        - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS
+          value: '["*"]'
+        - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS
+          value: 'true'
+        - name: TRANSMITTAL_SERVICE_UVICORN__HOST
+          value: 0.0.0.0
+        - name: TRANSMITTAL_SERVICE_UVICORN__PORT
+          value: '8000'
+        - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL
+          value: info
+        - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS
+          value: '2'
+        - name: TRANSMITTAL_SERVICE_DATABASE__HOST
+          value: postgres-service
+        - name: TRANSMITTAL_SERVICE_DATABASE__PORT
+          value: '5432'
+        - name: TRANSMITTAL_SERVICE_DATABASE__NAME
+          value: transmittals
+        - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE
+          value: verify-full
+        - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH
+          value: /opt/.postgresql/root.crt
+        - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST
+          value: api
+        - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST
+          value: rabbitmq-service
+        - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT
+          value: '5672'
+        - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL
+          value: https://sarex.dsinv.ru
+        - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+          value: '5'
+        - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL
+          value: http://sarex-resources-service.resources-prod
+        - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+          value: '5'
+        - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL
+          value: http://documentations-service.documentations-prod
+        - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+          value: '5'
+        - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME
+          value: ru-central1
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET
+          value: transmittal-storage
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
+          value: minio-service.minio.svc.cluster.local:9000
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
+          value: http://export-project-service.django.svc.cluster.local:8000
+        - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS
+          value: '5'
+        - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL
+          value: http://marks-service.workflow.svc.cluster.local:8000
+        - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS
+          value: '5'
+        - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_OTEL__ENABLE
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_OTEL__HOST
+          value: http://signoz-otel-collector-external.signoz.svc.cluster.local:4317
+        - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME
+          value: backend.transmittals-prod
+        - name: TRANSMITTAL_SERVICE_OTEL__INSECURE
+          value: 'false'

apps/transmittal/dsinv/frontend.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: transmittal
+spec:
+  template:
+    spec:
+      containers:
+      - name: frontend
+        image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:4c915d45

apps/transmittal/dsinv/kustomization.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: transmittal
+resources:
+- ../base
+patches:
+- path: backend.yaml
+  target:
+    kind: Deployment
+    name: backend
+- path: frontend.yaml
+  target:
+    kind: Deployment
+    name: frontend
+- path: worker.yaml
+  target:
+    kind: Deployment
+    name: worker

apps/transmittal/dsinv/worker.yaml

@@ -0,0 +1,129 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: worker
+  namespace: transmittal
+spec:
+  template:
+    spec:
+      containers:
+      - name: worker
+        image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4de0b503
+        env:
+        - name: TRANSMITTAL_SERVICE_SMTP__ENABLE_TLS
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_SMTP__HOST
+          value: relay.dsinv.ru
+        - name: TRANSMITTAL_SERVICE_SMTP__PORT
+          value: '25'
+        - name: TRANSMITTAL_SERVICE_SMTP__EMAIL
+          value: sarex@dsinv.ru
+        - name: TRANSMITTAL_SERVICE_APP__NAME
+          value: Transmittal Service
+        - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL
+          value: ERROR
+        - name: TRANSMITTAL_SERVICE_APP__HOST
+          value: https://sarex.dsinv.ru/transmittal
+        - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT
+          value: prod
+        - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS
+          value: '["https://lk.sarex.io", "lk.sarex.io"]'
+        - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS
+          value: '["*"]'
+        - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS
+          value: '["*"]'
+        - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS
+          value: 'true'
+        - name: TRANSMITTAL_SERVICE_UVICORN__HOST
+          value: 0.0.0.0
+        - name: TRANSMITTAL_SERVICE_UVICORN__PORT
+          value: '8000'
+        - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL
+          value: info
+        - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS
+          value: '2'
+        - name: TRANSMITTAL_SERVICE_DATABASE__HOST
+          value: postgres-service
+        - name: TRANSMITTAL_SERVICE_DATABASE__PORT
+          value: '5432'
+        - name: TRANSMITTAL_SERVICE_DATABASE__NAME
+          value: transmittals
+        - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE
+          value: verify-full
+        - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH
+          value: /opt/.postgresql/root.crt
+        - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST
+          value: api
+        - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST
+          value: rabbitmq-service
+        - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT
+          value: '5672'
+        - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL
+          value: https://sarex.dsinv.ru
+        - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+          value: '5'
+        - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL
+          value: http://sarex-resources-service.resources-prod
+        - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+          value: '5'
+        - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL
+          value: http://documentations-service.documentations-prod
+        - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+          value: '5'
+        - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME
+          value: ru-central1
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET
+          value: transmittal-storage
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
+          value: minio-service.minio.svc.cluster.local:9000
+        - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
+          value: http://export-project-service.django.svc.cluster.local:8000
+        - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS
+          value: '5'
+        - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL
+          value: http://marks-service.workflow.svc.cluster.local:8000
+        - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS
+          value: '10'
+        - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS
+          value: '5'
+        - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT
+          value: '30'
+        - name: TRANSMITTAL_SERVICE_OTEL__ENABLE
+          value: 'false'
+        - name: TRANSMITTAL_SERVICE_OTEL__HOST
+          value: http://signoz-otel-collector-external.signoz.svc.cluster.local:4317
+        - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME
+          value: backend.transmittals-prod
+        - name: TRANSMITTAL_SERVICE_OTEL__INSECURE
+          value: 'false'

apps/workspaces/dsinv/frontend.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: workspaces
+spec:
+  template:
+    spec:
+      containers:
+      - name: frontend
+        image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_c4cc968d

apps/workspaces/dsinv/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: workspaces
+resources:
+- ../base
+- workspaces-frontend-static.yaml
+patches:
+- path: workspaces-api.yaml
+  target:
+    kind: Deployment
+    name: workspaces-api
+- path: frontend.yaml
+  target:
+    kind: Deployment
+    name: frontend

apps/workspaces/dsinv/workspaces-api.yaml

@@ -0,0 +1,45 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: workspaces-api
+  namespace: workspaces
+spec:
+  template:
+    spec:
+      containers:
+      - name: workspaces-api
+        image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-backend:production_fef43835
+        env:
+        - name: POSTGRES_ADDRESS
+          value: postgres-service
+        - name: POSTGRES_PORT
+          value: '5432'
+        - name: POSTGRES_DB
+          value: workspaces_db
+        - name: POSTGRES_POOL_SIZE
+          value: '3'
+        - name: BUNDLES_RETRY_COUNT
+          value: '5'
+        - name: BUNDLES_NJOBS
+          value: '5'
+        - name: API_ADDRESS
+          value: 0.0.0.0:8000
+        - name: NAMESPACE
+          value: sarex-workspaces
+        - name: ENABLE_SQL_QUERY
+          value: '0'
+        - name: ENABLE_SSL
+          value: '0'
+        - name: DOCUMENTATION_HOST
+          value: http://documentations-service.documentations.svc.cluster.local:8080
+        - name: DOCUMENTATION_LOGGER_FEATURE
+          value: '0'
+        - name: DOCUMENTATION_ORIGINATOR
+          value: prod_ws
+        - name: ENVIRONMENT
+          value: prod
+        - name: DJANGO_HOST
+          value: http://backend.django.svc.cluster.local:8000
+        - name: DJANGO_ORIGINATOR
+          value: docs_prod

apps/workspaces/dsinv/workspaces-frontend-static.yaml

@@ -0,0 +1,83 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: workspaces-frontend-static
+  namespace: workspaces
+  labels:
+    app: workspaces-frontend-static
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: workspaces-frontend-static
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: workspaces-frontend-static
+    spec:
+      containers:
+      - image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-frontend-static:severstal2
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 10
+          httpGet:
+            path: /ping
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 60
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: workspaces-frontend-static
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 20
+          httpGet:
+            path: /ping
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 30
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: dockerhub
+      nodeSelector:
+        name: generic
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: workspaces-frontend-static-service
+  namespace: workspaces
+  labels:
+    app: workspaces-frontend-static
+spec:
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: workspaces-frontend-static
+  sessionAffinity: None
+  type: ClusterIP