uralkal: replicate the vad business-app footprint (36 apps) with uralkal domains
apps/<app>/uralkal mirrors apps/<app>/vad for all 36 apps from clusters/vad/kustomization.yaml, with domains remapped (not a suffix swap — vad's sarex-login.vadroad.ru etc. use a different host scheme than uralkal's login.sarex.local.uralkali.com). Two things are left as explicit placeholders pending real infra: the Zitadel client_id/org_id (TBD_URALKAL_ZITADEL_CLIENT_ID, since uralkal's Zitadel has no application registered yet) and the Kafka CA cert in pm/issues/message-hub/flows (copied from vad, will need swapping once uralkal's Kafka actually generates its own CA, same as vad's history). infrastructure/s3-proxy/uralkal: new component, nginx upstream points at the single uralkal minio endpoint (10.133.0.245:9000) from terraform, unlike vad's 4-node list. clusters/uralkal/kustomization.yaml: wires in s3-proxy + all 36 apps. infrastructure/istio-config/uralkal/istio-config.yaml: adds the 28 path-routed virtualServices under sarex.local.uralkali.com (mirroring vad's sarex.vadroad.ru routing, incl. the documentations-api CORS policy) plus stamp-verification/document-link/s3 on their already-declared hosts. Pre-existing zitadel/superset/camunda-operate blocks are untouched. apps/django/vad/backend.yaml: drop a stale explanatory comment (also removed from the uralkal copy before this commit). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
ivan
parent
e23783997e
commit
9ec172c0f4
10
apps/attachments/uralkal/kustomization.yaml
Normal file
10
apps/attachments/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,10 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: attachments
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: attachments
|
||||
34
apps/attachments/uralkal/patch.yaml
Normal file
34
apps/attachments/uralkal/patch.yaml
Normal file
@ -0,0 +1,34 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: attachments
|
||||
namespace: attachments
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
attachments:
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/auth-path: auth/kubernetes
|
||||
vault.hashicorp.com/role: attachments
|
||||
vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/apps/attachments/postgres
|
||||
vault.hashicorp.com/agent-inject-template-attachments-db: |-
|
||||
{{- with secret "secrets/data/apps/attachments/postgres" -}}
|
||||
DATABASE_HOST={{ index .Data.data "host" }}
|
||||
DATABASE_PORT={{ index .Data.data "port" }}
|
||||
DATABASE_NAME={{ index .Data.data "database" }}
|
||||
DATABASE_USER={{ index .Data.data "username" }}
|
||||
DATABASE_PASSWORD={{ index .Data.data "password" }}
|
||||
DATABASE_SSL_MODE=disable
|
||||
{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments
|
||||
vault.hashicorp.com/agent-inject-template-attachments-s3: |-
|
||||
{{- with secret "secrets/data/minio/apps/attachments" -}}
|
||||
YANDEX_S3_ENDPOINT_URL=s3-proxy.s3-proxy.svc.cluster.local
|
||||
YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
|
||||
YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
|
||||
YANDEX_S3_USE_SSL=false
|
||||
YANDEX_S3_REGION=ru-central
|
||||
YANDEX_S3_VERIFY=false
|
||||
BUCKET_NAME=attachments
|
||||
{{- end -}}
|
||||
4
apps/auth-flow/uralkal/kustomization.yaml
Normal file
4
apps/auth-flow/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
74
apps/bi/uralkal/backend.yaml
Normal file
74
apps/bi/uralkal/backend.yaml
Normal file
@ -0,0 +1,74 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: bi-backend
|
||||
namespace: bi
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
main:
|
||||
envs:
|
||||
- name: SETTINGS_DEBUG
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: SETTINGS_VERIFY_SSL
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: SETTINGS_API_V1_PREFIX
|
||||
value:
|
||||
_default: "/api/v1"
|
||||
|
||||
- name: AUTH_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com"
|
||||
|
||||
- name: WORKER_TIMEOUT
|
||||
value:
|
||||
_default: "120"
|
||||
|
||||
- name: SUPERSET_HOST
|
||||
value:
|
||||
_default: "https://sarex-bi.sarex.local.uralkali.com/"
|
||||
|
||||
- name: PYTHONPATH
|
||||
value:
|
||||
_default: "src"
|
||||
|
||||
- name: ISSUES_SERVICE_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.issues.svc.cluster.local"
|
||||
|
||||
- name: EAV_SERVICE_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local"
|
||||
|
||||
- name: PM_SERVICE_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.pm.svc.cluster.local:8000"
|
||||
|
||||
- name: SUPERSET_SYSTEM_WIDGETS
|
||||
value:
|
||||
_default: '{"MDR": {"id": "e7343f21-1ee0-4a87-b712-e8cfd413cc49","name": "MDR"},"SC": {"id": "d63d25e4-eab6-452f-8b31-065094bc2cb6","name": "Стройконтроль"}}'
|
||||
|
||||
- name: SUPERSET_DOCUMENTATION_URL
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com/documentations/"
|
||||
|
||||
- name: SUPERSET_JWT_SECRET
|
||||
value:
|
||||
_default: "6TosZjqxxZ3kAPiht4miaGICRV5AbfvuenWnYfOUnxfbYJJXUNWedOS0QeJQaryr"
|
||||
|
||||
- name: KAFKA_BOOTSTRAP_SERVERS
|
||||
value:
|
||||
_default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]'
|
||||
|
||||
- name: KAFKA_TOPICS
|
||||
value:
|
||||
_default: '{"planning": "message-hub-prod"}'
|
||||
|
||||
- name: KAFKA_ENABLE
|
||||
value:
|
||||
_default: "0"
|
||||
9
apps/bi/uralkal/kustomization.yaml
Normal file
9
apps/bi/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: bi-backend
|
||||
4
apps/bim/uralkal/kustomization.yaml
Normal file
4
apps/bim/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/cde/uralkal/kustomization.yaml
Normal file
4
apps/cde/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/checklists/uralkal/kustomization.yaml
Normal file
4
apps/checklists/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/comparisons/uralkal/kustomization.yaml
Normal file
4
apps/comparisons/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
16
apps/contracts/uralkal/backend.yaml
Normal file
16
apps/contracts/uralkal/backend.yaml
Normal file
@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: contracts
|
||||
namespace: contracts
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
contracts:
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-template-contracts-db: |-
|
||||
{{- with secret "secrets/data/apps/contracts/postgres" -}}
|
||||
DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@{{ index .Data.data "host" }}:{{ index .Data.data "port" }}/{{ index .Data.data "database" }}?sslmode=disable
|
||||
{{- end -}}
|
||||
9
apps/contracts/uralkal/kustomization.yaml
Normal file
9
apps/contracts/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: contracts
|
||||
5
apps/control-interface/uralkal/kustomization.yaml
Normal file
5
apps/control-interface/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,5 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
- namespace.yaml
|
||||
6
apps/control-interface/uralkal/namespace.yaml
Normal file
6
apps/control-interface/uralkal/namespace.yaml
Normal file
@ -0,0 +1,6 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: control-interface
|
||||
labels:
|
||||
istio-injection: enabled
|
||||
4
apps/cross-section/uralkal/kustomization.yaml
Normal file
4
apps/cross-section/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
154
apps/django/uralkal/backend.yaml
Normal file
154
apps/django/uralkal/backend.yaml
Normal file
@ -0,0 +1,154 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: django
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
envs:
|
||||
- name: ALLOWED_HOSTS
|
||||
value:
|
||||
_default: "*"
|
||||
- name: SERVER_USE_CHANGELOG
|
||||
value:
|
||||
_default: "0"
|
||||
- name: SERVER_ZITADEL_ENABLED
|
||||
value:
|
||||
_default: "True"
|
||||
- name: DJANGO_SETTINGS_MODULE
|
||||
value:
|
||||
_default: config.settings.production
|
||||
- name: CELERY_REDIS_HOST
|
||||
value:
|
||||
_default: redis
|
||||
- name: CELERY_REDIS_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
- name: DJANGO_REDIS_HOST
|
||||
value:
|
||||
_default: redis
|
||||
- name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
|
||||
value:
|
||||
_default: "True"
|
||||
- name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
|
||||
value:
|
||||
_default: "True"
|
||||
- name: DJANGO_REDIS_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
- name: BIMV2_INTERNAL_HOST
|
||||
value:
|
||||
_default: http://bim-backend-v2-service.bim-api
|
||||
- name: BIMV2_TIMEOUT
|
||||
value:
|
||||
_default: "60"
|
||||
- name: JWT_KID
|
||||
value:
|
||||
_default: "1"
|
||||
- name: PDM_SYNC
|
||||
value:
|
||||
_default: "1"
|
||||
- name: KC_SYNC_ENABLE
|
||||
value:
|
||||
_default: "0"
|
||||
- name: MEASUREMENTS_HOST
|
||||
value:
|
||||
_default: http://measurements-service.measurements.svc.cluster.local:8000/api
|
||||
- name: MEASUREMENTS_USE_MEASUREMENTS
|
||||
value:
|
||||
_default: "1"
|
||||
- name: SERVER_API_HOST
|
||||
value:
|
||||
_default: https://sarex.local.uralkali.com
|
||||
- name: SERVER_HOST
|
||||
value:
|
||||
_default: https://sarex.local.uralkali.com
|
||||
- name: WORKFLOWS_HOST
|
||||
value:
|
||||
_default: http://backend-svc.processing.svc.cluster.local:80
|
||||
- name: WORKFLOWS_BASE_HOST
|
||||
value:
|
||||
_default: http://backend-svc.django.svc.cluster.local:80
|
||||
- name: WORKFLOWS_PREFIX
|
||||
value:
|
||||
_default: /internal/v1
|
||||
- name: WORKFLOWS_USE
|
||||
value:
|
||||
_default: "1"
|
||||
- name: SERVER_S3_STREAM_IMPORT
|
||||
value:
|
||||
_default: "1"
|
||||
- name: SERVER_SAVE_DIFF_DEM
|
||||
value:
|
||||
_default: "1"
|
||||
- name: SERVER_USE_CLICKHOUSE
|
||||
value:
|
||||
_default: "0"
|
||||
- name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
|
||||
value:
|
||||
_default: "0"
|
||||
- name: SERVER_USE_DJANGO_STORAGE
|
||||
value:
|
||||
_default: "1"
|
||||
- name: SERVER_USE_METASHAPE
|
||||
value:
|
||||
_default: "0"
|
||||
- name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
|
||||
value:
|
||||
_default: "1"
|
||||
- name: SERVER_CHANGELOG_MODE
|
||||
value:
|
||||
_default: "0"
|
||||
- name: SERVER_DJANGO_URLS
|
||||
value:
|
||||
_default: "1"
|
||||
- name: CHECK_IMPORT_HASH
|
||||
value:
|
||||
_default: "1"
|
||||
- name: EAV_ENABLE
|
||||
value:
|
||||
_default: "1"
|
||||
- name: SERVER_CHECK_IMPORT_HASH
|
||||
value:
|
||||
_default: "1"
|
||||
- name: SERVER_CHUNKED_PATH
|
||||
value:
|
||||
_default: /tmp/chunked_uploads/%Y/%m/%d
|
||||
- name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
|
||||
value:
|
||||
_default: "0"
|
||||
- name: SERVER_USE_WRORKFLOW_STATUS
|
||||
value:
|
||||
_default: "1"
|
||||
- name: ZITADEL_HOST
|
||||
value:
|
||||
_default: https://login.sarex.local.uralkali.com
|
||||
- name: SERVER_KAFKA_ENABLED
|
||||
value:
|
||||
_default: "True"
|
||||
- name: KAFKA_TOPICS
|
||||
value:
|
||||
_default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
- name: KC_USE_REDIRECT_LOGOUT
|
||||
value:
|
||||
_default: "False"
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-template-django-s3: |-
|
||||
{{- with secret "secrets/data/minio/apps/django" }}
|
||||
AWS_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
|
||||
S3_HOST=http://s3-proxy.s3-proxy.svc.cluster.local
|
||||
{{- $buckets := index .Data.data "buckets" }}
|
||||
S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
|
||||
S3_LOGIN={{ index .Data.data "access_key" }}
|
||||
S3_PASSWORD={{ index .Data.data "secret_key" }}
|
||||
AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
|
||||
AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
|
||||
AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
|
||||
{{- end }}
|
||||
21
apps/django/uralkal/kustomization.yaml
Normal file
21
apps/django/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,21 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: nginx-configmap.yaml
|
||||
target:
|
||||
kind: ConfigMap
|
||||
name: nginx-configmap
|
||||
- path: backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: zitadel-configmap.yaml
|
||||
target:
|
||||
kind: ConfigMap
|
||||
name: zitadel-configmap
|
||||
- path: s3-proxy.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: s3-proxy
|
||||
160
apps/django/uralkal/nginx-configmap.yaml
Normal file
160
apps/django/uralkal/nginx-configmap.yaml
Normal file
@ -0,0 +1,160 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nginx-configmap
|
||||
namespace: django
|
||||
data:
|
||||
nginx.conf: |
|
||||
worker_processes auto;
|
||||
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
events {
|
||||
use epoll;
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
|
||||
# Basic Settings
|
||||
large_client_header_buffers 8 128k;
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 300;
|
||||
types_hash_max_size 2048;
|
||||
client_max_body_size 5000M;
|
||||
client_header_buffer_size 5M;
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
# Logging Settings
|
||||
access_log /var/log/nginx/access.log;
|
||||
error_log /var/log/nginx/error.log;
|
||||
|
||||
# GZIP Settings
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_buffers 16 8k;
|
||||
gzip_http_version 1.1;
|
||||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
root /opt/react_client/;
|
||||
|
||||
add_header 'Access-Control-Allow-Origin' '*' always;
|
||||
add_header 'Access-Control-Allow-Methods' '*' always;
|
||||
add_header 'Access-Control-Allow-Headers' '*' always;
|
||||
|
||||
location = /static/index.bundle.js {
|
||||
add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
|
||||
if_modified_since off;
|
||||
expires off;
|
||||
}
|
||||
|
||||
# location ~^/api/pm/ {
|
||||
# proxy_http_version 1.1;
|
||||
# proxy_set_header Connection "";
|
||||
# proxy_set_header Host $host;
|
||||
# proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
|
||||
# }
|
||||
|
||||
location ~^/api/v1/documents/ {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80;
|
||||
}
|
||||
|
||||
location ~^/(api|admin)/ {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
proxy_set_header Host $host;
|
||||
proxy_pass http://backend-svc.django.svc.cluster.local:80;
|
||||
}
|
||||
|
||||
location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
|
||||
alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
|
||||
add_header Content-Type application/wasm always;
|
||||
add_header Cache-Control "public, max-age=31536000, immutable" always;
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
|
||||
add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
|
||||
}
|
||||
|
||||
location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
|
||||
alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
|
||||
add_header Content-Type application/javascript always;
|
||||
add_header Cache-Control "public, max-age=31536000, immutable" always;
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
|
||||
add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
|
||||
}
|
||||
|
||||
location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
|
||||
alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
|
||||
add_header Content-Type application/javascript always;
|
||||
add_header Cache-Control "public, max-age=31536000, immutable" always;
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
|
||||
add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
|
||||
}
|
||||
|
||||
location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
|
||||
alias /opt/react_client/static/viewer-pdf/mupdf.js;
|
||||
add_header Content-Type application/javascript always;
|
||||
add_header Cache-Control "public, max-age=31536000, immutable" always;
|
||||
add_header Access-Control-Allow-Origin "*" always;
|
||||
add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
|
||||
add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
|
||||
}
|
||||
|
||||
location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
|
||||
add_header Content-Type application/wasm always;
|
||||
alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
|
||||
}
|
||||
|
||||
location ~^/workspaces-v2/(.+).js {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
rewrite /workspaces-v2/(.+) /$1 break;
|
||||
proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
|
||||
}
|
||||
|
||||
location ~^/workspaces-v2/(.+)\.wasm$ {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
rewrite ^/workspaces-v2/(.+) /$1 break;
|
||||
proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
|
||||
}
|
||||
|
||||
location @index {
|
||||
add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';
|
||||
if_modified_since off;
|
||||
expires off;
|
||||
try_files /static/index.html =404;
|
||||
}
|
||||
|
||||
location ~^/workflows/(.+).js {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection "";
|
||||
rewrite /workflows/(.+) /$1 break;
|
||||
proxy_pass http://frontend-svc.processing.svc.cluster.local:80;
|
||||
}
|
||||
|
||||
location /service-worker.js {
|
||||
try_files /static/$uri @index;
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri @index;
|
||||
}
|
||||
}
|
||||
}
|
||||
31
apps/django/uralkal/s3-proxy.yaml
Normal file
31
apps/django/uralkal/s3-proxy.yaml
Normal file
@ -0,0 +1,31 @@
|
||||
---
|
||||
# Патч s3-proxy для vad.
|
||||
#
|
||||
# В base зашит AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech —
|
||||
# в закрытом контуре этот хост недоступен, прокси не достучится до MinIO
|
||||
# и маршрут /media/ (s3-proxy-virt-service в istio-config) вернёт ошибку.
|
||||
#
|
||||
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||||
# agent-inject-template-s3; остальные vault-аннотации берутся из base.
|
||||
# Эндпоинт задан литералом, а не через .Data.data.client.endpoint: так же
|
||||
# сделано в apps/django/vad/backend.yaml для того же секрета
|
||||
# secrets/data/minio/apps/django — держим один способ на весь ns.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: s3-proxy
|
||||
namespace: django
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
s3-proxy:
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-template-s3: |
|
||||
{{- with secret "secrets/data/minio/apps/django" }}
|
||||
AWS_API_ENDPOINT=http://s3-proxy.s3-proxy.svc.cluster.local
|
||||
{{- $buckets := index .Data.data "buckets" }}
|
||||
AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
|
||||
AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
|
||||
AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
|
||||
{{- end }}
|
||||
14
apps/django/uralkal/zitadel-configmap.yaml
Normal file
14
apps/django/uralkal/zitadel-configmap.yaml
Normal file
@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: zitadel-configmap
|
||||
namespace: django
|
||||
data:
|
||||
config.json: |
|
||||
{
|
||||
"auth_type": "zitadel",
|
||||
"zitadel": {
|
||||
"client_id": "392748423989716183",
|
||||
"host": "https://login.sarex.local.uralkali.com"
|
||||
}
|
||||
}
|
||||
@ -126,10 +126,6 @@ spec:
|
||||
- name: ZITADEL_HOST
|
||||
value:
|
||||
_default: https://sarex-login.vadroad.ru
|
||||
# Включено вместе с message-hub: он консьюмер топика message-hub-stage
|
||||
# (SETTINGS_TOPICS в apps/message-hub/d8-ugmk-prod/message-hub.yaml),
|
||||
# а писать в этот топик должен django. Vault-шаблон django-kafka
|
||||
# и KAFKA_SSL_CAFILE уже есть в base — здесь только флаг.
|
||||
- name: SERVER_KAFKA_ENABLED
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
13
apps/document-link/uralkal/frontend.yaml
Normal file
13
apps/document-link/uralkal/frontend.yaml
Normal file
@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: document-link
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:vad_60487abb
|
||||
9
apps/document-link/uralkal/kustomization.yaml
Normal file
9
apps/document-link/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: frontend
|
||||
158
apps/documentations/uralkal/api.yaml
Normal file
158
apps/documentations/uralkal/api.yaml
Normal file
@ -0,0 +1,158 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: documentations-api
|
||||
namespace: documentations
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
envs:
|
||||
- name: POSTGRES_POOL_SIZE
|
||||
value:
|
||||
_default: "20"
|
||||
- name: ZITADEL_ACCOUNT
|
||||
value:
|
||||
_default: /vault/secrets/documentations-zitadel-account-json
|
||||
- name: ZITADEL_DOMAIN
|
||||
value:
|
||||
_default: login.sarex.local.uralkali.com
|
||||
- name: USE_ZITADEL
|
||||
value:
|
||||
_default: "1"
|
||||
- name: FLOWS_URL
|
||||
value:
|
||||
_default: http://backend-svc.flows.svc.cluster.local:80
|
||||
- name: LAST_MASTER_BIM
|
||||
value:
|
||||
_default: "36311"
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: 0.0.0.0:8080
|
||||
- name: USE_LEGACY_BIM_FLOW
|
||||
value:
|
||||
_default: "true"
|
||||
- name: API_ADDRESS_FILE
|
||||
value:
|
||||
_default: 0.0.0.0:8080
|
||||
- name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
|
||||
value:
|
||||
_default: "5"
|
||||
- name: ENABLE_SQL_QUERY
|
||||
value:
|
||||
_default: "0"
|
||||
- name: ENABLE_SSL
|
||||
value:
|
||||
_default: "0"
|
||||
- name: WORKSPACE_V2_EXTERNAL_URL
|
||||
value:
|
||||
_default: https://sarex.local.uralkali.com/workspaces-v2/
|
||||
- name: ENABLE_S3
|
||||
value:
|
||||
_default: "1"
|
||||
- name: CONTAINER_REGISTRY
|
||||
value:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
_default: production
|
||||
- name: LAST_SLAVE_1_BIM
|
||||
value:
|
||||
_default: "1000000"
|
||||
- name: HOST
|
||||
value:
|
||||
_default: http://backend-api-svc.documentations.svc.cluster.local:80
|
||||
- name: FILE_STREAM_HOST
|
||||
value:
|
||||
_default: sarex.local.uralkali.com
|
||||
- name: DOCUMENTATION_URL
|
||||
value:
|
||||
_default: http://backend-api-svc.documentations.svc.cluster.local:80/
|
||||
- name: WORKFLOW_URL
|
||||
value:
|
||||
_default: http://backend-svc.processing.svc.cluster.local:80/
|
||||
- name: WORKSPACE_URL
|
||||
value:
|
||||
_default: http://backend-svc.workspaces.svc.cluster.local:80/
|
||||
- name: BIM_API_URL
|
||||
value:
|
||||
_default: http://backend-svc.bim.svc.cluster.local:80/
|
||||
- name: BIM_API_V2_URL
|
||||
value:
|
||||
_default: http://backend-svc.bim.svc.cluster.local:80/
|
||||
- name: WORKSPACE_BUNDLE_VERSION
|
||||
value:
|
||||
_default: v1
|
||||
- name: SYSTEM_LOG_URL
|
||||
value:
|
||||
_default: http://backend-svc.system-log.svc.cluster.local:80
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: http://backend-svc.django.svc.cluster.local:80
|
||||
- name: MARKS_PROCESSING_URL
|
||||
value:
|
||||
_default: http://marks-service:8000
|
||||
- name: USE_MARKS_RABBITMQ
|
||||
value:
|
||||
_default: "true"
|
||||
- name: MARKS_RABBITMQ_HOST
|
||||
value:
|
||||
_default: rabbitmq.rabbitmq.svc.cluster.local
|
||||
- name: MARKS_RABBITMQ_PORT
|
||||
value:
|
||||
_default: "5672"
|
||||
- name: PUBLIC_LINK_HOST
|
||||
value:
|
||||
_default: https://document-link.sarex.local.uralkali.com
|
||||
- name: NAMESPACE
|
||||
value:
|
||||
_default: documentations
|
||||
- name: DJANGO_ORIGINATOR
|
||||
value:
|
||||
_default: docs_prod
|
||||
- name: WORKFLOW_IMAGES_VERSION
|
||||
value:
|
||||
_default: master
|
||||
- name: WORKFLOWS_IMAGES_VERSION
|
||||
value:
|
||||
_default: master
|
||||
- name: S3_SERVICE_ACCOUNT
|
||||
value:
|
||||
_default: /vault/secrets/documentations-s3-account-json
|
||||
- name: READ_WRITE_TIMEOUT_FILE_STREAM
|
||||
value:
|
||||
_default: 6h
|
||||
- name: CACHE_DEFAULT_EXPIRATION
|
||||
value:
|
||||
_default: 60s
|
||||
- name: ENABLE_SMTP
|
||||
value:
|
||||
_default: "True"
|
||||
- name: ENABLE_MAILGUN
|
||||
value:
|
||||
_default: "False"
|
||||
- name: CACHE_CLEANUP_INTERVAL
|
||||
value:
|
||||
_default: 60s
|
||||
- name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
|
||||
value:
|
||||
_default: "mock"
|
||||
- name: ENABLE_AUTH_JWT_IN_URL
|
||||
value:
|
||||
_default: "true"
|
||||
- name: ENABLE_SIGNATURE_IN_URL
|
||||
value:
|
||||
_default: "false"
|
||||
- name: USE_CACHE_IN_FILE_STREAMER
|
||||
value:
|
||||
_default: "0"
|
||||
- name: VALKEY_ADDR
|
||||
value:
|
||||
_default: redis:6379
|
||||
- name: VALKEY_HOST
|
||||
value:
|
||||
_default: redis
|
||||
- name: VALKEY_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
146
apps/documentations/uralkal/filestream.yaml
Normal file
146
apps/documentations/uralkal/filestream.yaml
Normal file
@ -0,0 +1,146 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: documentations-filestream
|
||||
namespace: documentations
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
envs:
|
||||
- name: POSTGRES_POOL_SIZE
|
||||
value:
|
||||
_default: "20"
|
||||
- name: ZITADEL_ACCOUNT
|
||||
value:
|
||||
_default: /vault/secrets/documentations-zitadel-account-json
|
||||
- name: ZITADEL_DOMAIN
|
||||
value:
|
||||
_default: login.sarex.local.uralkali.com
|
||||
- name: USE_ZITADEL
|
||||
value:
|
||||
_default: "1"
|
||||
- name: FLOWS_URL
|
||||
value:
|
||||
_default: http://backend-svc.flows.svc.cluster.local:80
|
||||
- name: LAST_MASTER_BIM
|
||||
value:
|
||||
_default: "36311"
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: 0.0.0.0:8080
|
||||
- name: API_ADDRESS_FILE
|
||||
value:
|
||||
_default: 0.0.0.0:8080
|
||||
- name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
|
||||
value:
|
||||
_default: "5"
|
||||
- name: ENABLE_SQL_QUERY
|
||||
value:
|
||||
_default: "0"
|
||||
- name: ENABLE_SSL
|
||||
value:
|
||||
_default: "0"
|
||||
- name: WORKSPACE_V2_EXTERNAL_URL
|
||||
value:
|
||||
_default: https://sarex.local.uralkali.com/workspaces-v2/
|
||||
- name: ENABLE_S3
|
||||
value:
|
||||
_default: "1"
|
||||
- name: CONTAINER_REGISTRY
|
||||
value:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
_default: production
|
||||
- name: LAST_SLAVE_1_BIM
|
||||
value:
|
||||
_default: "1000000"
|
||||
- name: HOST
|
||||
value:
|
||||
_default: http://backend-api-svc.documentations.svc.cluster.local:80
|
||||
- name: FILE_STREAM_HOST
|
||||
value:
|
||||
_default: sarex.local.uralkali.com
|
||||
- name: DOCUMENTATION_URL
|
||||
value:
|
||||
_default: http://backend-api-svc.documentations.svc.cluster.local:80/
|
||||
- name: WORKFLOW_URL
|
||||
value:
|
||||
_default: http://workflows-api-service.workflow.svc.cluster.local:8000/
|
||||
- name: WORKSPACE_URL
|
||||
value:
|
||||
_default: http://backend-svc.workspaces.svc.cluster.local:80/
|
||||
- name: BIM_API_URL
|
||||
value:
|
||||
_default: http://backend-svc.bim.svc.cluster.local:80/
|
||||
- name: BIM_API_V2_URL
|
||||
value:
|
||||
_default: http://backend-svc.bim.svc.cluster.local:80/
|
||||
- name: WORKSPACE_BUNDLE_VERSION
|
||||
value:
|
||||
_default: v1
|
||||
- name: SYSTEM_LOG_URL
|
||||
value:
|
||||
_default: http://api-service.system-log.svc.cluster.local:80
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: http://backend-svc.django.svc.cluster.local:80
|
||||
- name: MARKS_PROCESSING_URL
|
||||
value:
|
||||
_default: http://marks-service:8000
|
||||
- name: PUBLIC_LINK_HOST
|
||||
value:
|
||||
_default: https://document-link.sarex.local.uralkali.com
|
||||
- name: NAMESPACE
|
||||
value:
|
||||
_default: documentations
|
||||
- name: DJANGO_ORIGINATOR
|
||||
value:
|
||||
_default: docs_prod
|
||||
- name: WORKFLOW_IMAGES_VERSION
|
||||
value:
|
||||
_default: master
|
||||
- name: WORKFLOWS_IMAGES_VERSION
|
||||
value:
|
||||
_default: master
|
||||
- name: S3_SERVICE_ACCOUNT
|
||||
value:
|
||||
_default: /vault/secrets/documentations-s3-account-json
|
||||
- name: READ_WRITE_TIMEOUT_FILE_STREAM
|
||||
value:
|
||||
_default: 6h
|
||||
- name: CACHE_DEFAULT_EXPIRATION
|
||||
value:
|
||||
_default: 60s
|
||||
- name: ENABLE_SMTP
|
||||
value:
|
||||
_default: "True"
|
||||
- name: ENABLE_MAILGUN
|
||||
value:
|
||||
_default: "False"
|
||||
- name: CACHE_CLEANUP_INTERVAL
|
||||
value:
|
||||
_default: 60s
|
||||
- name: ENABLE_AUTH_JWT_IN_URL
|
||||
value:
|
||||
_default: "false"
|
||||
- name: ENABLE_SIGNATURE_IN_URL
|
||||
value:
|
||||
_default: "true"
|
||||
- name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
|
||||
value:
|
||||
_default: "mock"
|
||||
- name: USE_CACHE_IN_FILE_STREAMER
|
||||
value:
|
||||
_default: "0"
|
||||
- name: VALKEY_ADDR
|
||||
value:
|
||||
_default: redis:6379
|
||||
- name: VALKEY_HOST
|
||||
value:
|
||||
_default: redis
|
||||
- name: VALKEY_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
17
apps/documentations/uralkal/kustomization.yaml
Normal file
17
apps/documentations/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,17 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: api.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: documentations-api
|
||||
- path: filestream.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: documentations-filestream
|
||||
- path: pdf-markings-amqp.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: documentations-pdf-markings-amqp
|
||||
58
apps/documentations/uralkal/pdf-markings-amqp.yaml
Normal file
58
apps/documentations/uralkal/pdf-markings-amqp.yaml
Normal file
@ -0,0 +1,58 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: documentations-pdf-markings-amqp
|
||||
namespace: documentations
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
envs:
|
||||
- name: MARKS_APP__LOG_LEVEL
|
||||
value:
|
||||
_default: INFO
|
||||
|
||||
- name: MARKS_CRYPTO__HASHING_ALGO
|
||||
value:
|
||||
_default: md_gost12_256
|
||||
|
||||
- name: MARKS_QR__REDIRECT_URL
|
||||
value:
|
||||
_default: "https://sarex-stamp-verification.sarex.local.uralkali.com/"
|
||||
|
||||
- name: MARKS_QR__BASE_DOCUMENT_URL
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com"
|
||||
|
||||
- name: MARKS_S3__REGION
|
||||
value:
|
||||
_default: ru-central1
|
||||
|
||||
- name: MARKS_S3__USE_SSL
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: MARKS_S3__SSL_VERIFY
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: MARKS_S3__DEFAULT_BUCKET
|
||||
value:
|
||||
_default: documentations
|
||||
|
||||
- name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
|
||||
value:
|
||||
_default: pdf_markings_input
|
||||
|
||||
- name: MARKS_RABBITMQ__HOST
|
||||
value:
|
||||
_default: rabbitmq.rabbitmq.svc.cluster.local
|
||||
|
||||
- name: MARKS_RABBITMQ__PORT
|
||||
value:
|
||||
_default: "5672"
|
||||
|
||||
- name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
|
||||
value:
|
||||
_default: "60"
|
||||
4
apps/drawings/uralkal/kustomization.yaml
Normal file
4
apps/drawings/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/eav/uralkal/kustomization.yaml
Normal file
4
apps/eav/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/faas/uralkal/kustomization.yaml
Normal file
4
apps/faas/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
167
apps/flows/uralkal/backend.yaml
Normal file
167
apps/flows/uralkal/backend.yaml
Normal file
@ -0,0 +1,167 @@
|
||||
---
|
||||
# Патч backend для контура УГМК — подключение к Kafka.
|
||||
#
|
||||
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
|
||||
# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
|
||||
# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
|
||||
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||||
# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: flows
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
deployment:
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
set -a
|
||||
[ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
|
||||
[ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
|
||||
[ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
|
||||
[ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
|
||||
[ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
|
||||
[ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
|
||||
set +a
|
||||
exec /opt/entrypoint.sh
|
||||
|
||||
envs:
|
||||
- name: LOG_LEVEL
|
||||
value:
|
||||
_default: "DEBUG"
|
||||
|
||||
- name: BASE_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com"
|
||||
|
||||
- name: CELERY_QUEUE
|
||||
value:
|
||||
_default: "flow"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80/api"
|
||||
|
||||
- name: PLANNING_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp"
|
||||
|
||||
- name: PLANNING_USE
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
- name: DOCUMENTATION_HOST
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
|
||||
|
||||
- name: DOCUMENTATION_EXTERNAL_HOST
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
|
||||
|
||||
- name: ENABLE_ANALYTICS
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: ENABLE_CELERY
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: ENABLE_MAILGUN
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: ENABLE_METRICS
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: FROM_EMAIL
|
||||
value:
|
||||
_default: "sarex@sarex.local.uralkali.com"
|
||||
|
||||
- name: GATEWAY_URL
|
||||
value:
|
||||
_default: "http://pdm-svc.documentations.svc.cluster.local:80"
|
||||
|
||||
- name: RESOURCE_URL
|
||||
value:
|
||||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||||
|
||||
- name: SERVICE_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com/flows/api/v1"
|
||||
|
||||
- name: SMTP_HOST
|
||||
value:
|
||||
_default: "post.sarex.local.uralkali.com"
|
||||
|
||||
- name: CHECKLIST_HOST
|
||||
value:
|
||||
_default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
|
||||
|
||||
- name: SMTP_PORT
|
||||
value:
|
||||
_default: "587"
|
||||
|
||||
- name: SYNC_RESOURCE_ID
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: TIMEOUT
|
||||
value:
|
||||
_default: "120"
|
||||
|
||||
- name: WORKFLOWS_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.processing.svc.cluster.local:80/api/v1"
|
||||
|
||||
- name: WORKFLOWS_TIMEOUT
|
||||
value:
|
||||
_default: "60"
|
||||
|
||||
- name: DOCUMENTATION_TIMEOUT
|
||||
value:
|
||||
_default: "60"
|
||||
|
||||
- name: KAFKA_HOST
|
||||
value:
|
||||
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||||
|
||||
- name: KAFKA_SSL_CERT
|
||||
value:
|
||||
_default: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
|
||||
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
|
||||
MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
|
||||
MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
|
||||
tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
|
||||
h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
|
||||
k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
|
||||
GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
|
||||
zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
|
||||
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
|
||||
Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
|
||||
A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
|
||||
vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
|
||||
OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
|
||||
fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
|
||||
ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
|
||||
0FC16VuidLG0HUCCawFjRiAg9rIA
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
|
||||
vault.hashicorp.com/agent-inject-template-flows-kafka: |-
|
||||
{{- with secret "secrets/data/kafka/apps/flows" -}}
|
||||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||||
{{- end -}}
|
||||
168
apps/flows/uralkal/celery.yaml
Normal file
168
apps/flows/uralkal/celery.yaml
Normal file
@ -0,0 +1,168 @@
|
||||
---
|
||||
# Патч celery для контура УГМК — подключение к Kafka.
|
||||
#
|
||||
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
|
||||
# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml.
|
||||
# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
|
||||
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||||
# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: celery
|
||||
namespace: flows
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
celery:
|
||||
deployment:
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
set -a
|
||||
[ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
|
||||
[ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
|
||||
[ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
|
||||
[ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
|
||||
[ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
|
||||
[ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
|
||||
set +a
|
||||
exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow
|
||||
|
||||
envs:
|
||||
- name: LOG_LEVEL
|
||||
value:
|
||||
_default: "DEBUG"
|
||||
|
||||
- name: BASE_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com"
|
||||
|
||||
- name: CELERY_QUEUE
|
||||
value:
|
||||
_default: "flow"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80/api"
|
||||
|
||||
- name: PLANNING_HOST
|
||||
value:
|
||||
_default: "http://backend-service.pm.svc.cluster.local:80/api/pm/msp"
|
||||
|
||||
- name: PLANNING_USE
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
- name: DOCUMENTATION_HOST
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
|
||||
|
||||
- name: DOCUMENTATION_EXTERNAL_HOST
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
|
||||
|
||||
- name: ENABLE_ANALYTICS
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: ENABLE_CELERY
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: ENABLE_MAILGUN
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: ENABLE_METRICS
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: FROM_EMAIL
|
||||
value:
|
||||
_default: "sarex@sarex.local.uralkali.com"
|
||||
|
||||
- name: GATEWAY_URL
|
||||
value:
|
||||
_default: "http://pdm-api.documentations.svc.cluster.local:8080"
|
||||
|
||||
- name: RESOURCE_URL
|
||||
value:
|
||||
_default: "http://resources-service.resources.svc.cluster.local:8000"
|
||||
|
||||
- name: SERVICE_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com/flows/api/v1"
|
||||
|
||||
- name: SMTP_HOST
|
||||
value:
|
||||
_default: "post.sarex.local.uralkali.com"
|
||||
|
||||
- name: CHECKLIST_HOST
|
||||
value:
|
||||
_default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
|
||||
|
||||
- name: SMTP_PORT
|
||||
value:
|
||||
_default: "587"
|
||||
|
||||
- name: SYNC_RESOURCE_ID
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: TIMEOUT
|
||||
value:
|
||||
_default: "120"
|
||||
|
||||
- name: WORKFLOWS_HOST
|
||||
value:
|
||||
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
|
||||
|
||||
- name: WORKFLOWS_TIMEOUT
|
||||
value:
|
||||
_default: "60"
|
||||
|
||||
- name: DOCUMENTATION_TIMEOUT
|
||||
value:
|
||||
_default: "60"
|
||||
|
||||
# См. подробные комментарии в apps/flows/d8-ugmk-prod/backend.yaml.
|
||||
- name: KAFKA_HOST
|
||||
value:
|
||||
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||||
|
||||
- name: KAFKA_SSL_CERT
|
||||
value:
|
||||
_default: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
|
||||
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
|
||||
MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
|
||||
MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
|
||||
tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
|
||||
h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
|
||||
k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
|
||||
GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
|
||||
zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
|
||||
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
|
||||
Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
|
||||
A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
|
||||
vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
|
||||
OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
|
||||
fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
|
||||
ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
|
||||
0FC16VuidLG0HUCCawFjRiAg9rIA
|
||||
-----END CERTIFICATE-----
|
||||
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
|
||||
vault.hashicorp.com/agent-inject-template-flows-kafka: |-
|
||||
{{- with secret "secrets/data/kafka/apps/flows" -}}
|
||||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||||
{{- end -}}
|
||||
13
apps/flows/uralkal/kustomization.yaml
Normal file
13
apps/flows/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,13 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: celery.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: celery
|
||||
78
apps/iam/uralkal/backend-s3.yaml
Normal file
78
apps/iam/uralkal/backend-s3.yaml
Normal file
@ -0,0 +1,78 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: iam-backend
|
||||
namespace: iam
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
envs:
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
_default: "prod"
|
||||
|
||||
- name: LOG_LEVEL
|
||||
value:
|
||||
_default: "debug"
|
||||
|
||||
- name: AUTH_ENABLED
|
||||
value:
|
||||
_default: "true"
|
||||
|
||||
- name: HTTP_PORT
|
||||
value:
|
||||
_default: "8080"
|
||||
|
||||
- name: HTTP_READ_BUFFER_SIZE
|
||||
value:
|
||||
_default: "131072"
|
||||
|
||||
- name: DB_MIGRATIONS_PATH
|
||||
value:
|
||||
_default: "migrations"
|
||||
|
||||
- name: ZITADEL_ENABLED
|
||||
value:
|
||||
_default: "true"
|
||||
|
||||
- name: ZITADEL_HOST
|
||||
value:
|
||||
_default: "https://login.sarex.local.uralkali.com"
|
||||
|
||||
- name: ZITADEL_ORG_RULES_FILE
|
||||
value:
|
||||
_default: "config/zitadel/org-rules-prod.json"
|
||||
|
||||
- name: S3_ENABLED
|
||||
value:
|
||||
_default: "true"
|
||||
|
||||
- name: S3_ENDPOINT_URL
|
||||
value:
|
||||
_default: "http://s3-proxy.s3-proxy.svc.cluster.local"
|
||||
|
||||
- name: S3_BUCKET_NAME
|
||||
value:
|
||||
_default: "iam"
|
||||
|
||||
- name: S3_REGION
|
||||
value:
|
||||
_default: "ru-central1"
|
||||
|
||||
- name: S3_PRESIGN_EXPIRES
|
||||
value:
|
||||
_default: "1h"
|
||||
|
||||
- name: KAFKA_ENABLED
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/etc/ca-certificates/Yandex/ca-cert"
|
||||
|
||||
- name: KAFKA_TOPIC_LEGACY_AMS_SYNC
|
||||
value:
|
||||
_default: "ams-sync"
|
||||
14
apps/iam/uralkal/kustomization.yaml
Normal file
14
apps/iam/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,14 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: iam
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: backend-s3.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: iam-backend
|
||||
- path: zitadel-org-rules-configmap.yaml
|
||||
target:
|
||||
kind: ConfigMap
|
||||
name: iam-zitadel-org-rules
|
||||
11
apps/iam/uralkal/zitadel-org-rules-configmap.yaml
Normal file
11
apps/iam/uralkal/zitadel-org-rules-configmap.yaml
Normal file
@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: iam-zitadel-org-rules
|
||||
namespace: iam
|
||||
data:
|
||||
org-rules-prod.json: |
|
||||
{
|
||||
"default_org_id": "392748423989716183",
|
||||
"rules": []
|
||||
}
|
||||
4
apps/inspections/uralkal/kustomization.yaml
Normal file
4
apps/inspections/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
149
apps/issues/uralkal/backend-s3.yaml
Normal file
149
apps/issues/uralkal/backend-s3.yaml
Normal file
@ -0,0 +1,149 @@
|
||||
---
|
||||
# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
|
||||
# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml.
|
||||
# podAnnotations — map, мержится по ключам.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: issues
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
deployment:
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
set -a
|
||||
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
|
||||
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
|
||||
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
|
||||
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
|
||||
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
|
||||
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
|
||||
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
|
||||
set +a
|
||||
exec /src/entrypoint.sh
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: production-configmap
|
||||
mountPath:
|
||||
_default: /src/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: production-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
- name: kafka-ca-cert
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
subPath:
|
||||
_default: kafka.crt
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-ca-cert
|
||||
items:
|
||||
- key: kafka.crt
|
||||
path:
|
||||
_default: kafka.crt
|
||||
|
||||
envs:
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
_default: "production"
|
||||
|
||||
- name: AERO_PUBLIC_HOST
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: AERO_HOST
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: BASE_AERO_URL
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: BASE_AUTH_URL
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: WORKFLOWS_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.workflow.svc.cluster.local:80"
|
||||
|
||||
- name: WORKFLOWS_URL
|
||||
value:
|
||||
_default: "http://backend-svc.workflow.svc.cluster.local:80"
|
||||
|
||||
- name: RESOURCES_API_HOST
|
||||
value:
|
||||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_API
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: DOCUMENTATIONS_URL
|
||||
value:
|
||||
_default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
|
||||
|
||||
- name: DJANGO_SETTINGS_MODULE
|
||||
value:
|
||||
_default: "config.settings.production"
|
||||
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: "8000"
|
||||
|
||||
# Kafka — код (kafka_app/app.py) ждёт KAFKA_HOST единой строкой "host:port",
|
||||
# KAFKA_SSL_CAFILE — путь к файлу (не PEM-текст, в отличие от flows-backend).
|
||||
# Хост/порт/CA — те же проверенные значения, что у message-hub/pm/flows.
|
||||
- name: KAFKA_HOST
|
||||
value:
|
||||
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||||
|
||||
# Топики совпадают с тем, что уже провижено на брокере (см. topics
|
||||
# в секрете kafka/apps/pm) и с SETTINGS_TOPICS у message-hub.
|
||||
- name: KAFKA_ISSUES_TOPIC
|
||||
value:
|
||||
_default: "issues_broadcast_prod"
|
||||
|
||||
- name: KAFKA_EAV_ASSETS_TOPIC
|
||||
value:
|
||||
_default: "assets_broadcast"
|
||||
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-s3: |-
|
||||
{{- with secret "secrets/data/minio/apps/issues" -}}
|
||||
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
|
||||
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
|
||||
YC_S3_BUCKET_NAME=issues
|
||||
YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
|
||||
{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
|
||||
{{- with secret "secrets/data/kafka/apps/issues" -}}
|
||||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||||
{{- end -}}
|
||||
145
apps/issues/uralkal/celery-s3.yaml
Normal file
145
apps/issues/uralkal/celery-s3.yaml
Normal file
@ -0,0 +1,145 @@
|
||||
---
|
||||
# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
|
||||
# поэтому здесь продублирован весь набор из apps/issues/base/celery.yaml.
|
||||
# podAnnotations — map, мержится по ключам.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: celery
|
||||
namespace: issues
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
celery:
|
||||
deployment:
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
set -a
|
||||
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
|
||||
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
|
||||
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
|
||||
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
|
||||
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
|
||||
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
|
||||
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
|
||||
set +a
|
||||
exec celery -A config worker -l info -E
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: production-configmap
|
||||
mountPath:
|
||||
_default: /src/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: production-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
- name: kafka-ca-cert
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
subPath:
|
||||
_default: kafka.crt
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-ca-cert
|
||||
items:
|
||||
- key: kafka.crt
|
||||
path:
|
||||
_default: kafka.crt
|
||||
|
||||
envs:
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
_default: "production"
|
||||
|
||||
- name: AERO_PUBLIC_HOST
|
||||
value:
|
||||
_default: "https://srx.wb.ru"
|
||||
|
||||
- name: AERO_HOST
|
||||
value:
|
||||
_default: "https://srx.wb.ru"
|
||||
|
||||
- name: BASE_AERO_URL
|
||||
value:
|
||||
_default: "https://srx.wb.ru"
|
||||
|
||||
- name: BASE_AUTH_URL
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: WORKFLOWS_HOST
|
||||
value:
|
||||
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
|
||||
|
||||
- name: WORKFLOWS_URL
|
||||
value:
|
||||
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
|
||||
|
||||
- name: RESOURCES_API_HOST
|
||||
value:
|
||||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_API
|
||||
value:
|
||||
_default: "https://srx.wb.ru"
|
||||
|
||||
- name: DOCUMENTATIONS_URL
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80"
|
||||
|
||||
- name: DJANGO_SETTINGS_MODULE
|
||||
value:
|
||||
_default: "config.settings.production"
|
||||
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: "8000"
|
||||
|
||||
# См. подробные комментарии в apps/issues/d8-ugmk-prod/backend-s3.yaml.
|
||||
- name: KAFKA_HOST
|
||||
value:
|
||||
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||||
|
||||
- name: KAFKA_ISSUES_TOPIC
|
||||
value:
|
||||
_default: "issues_broadcast_prod"
|
||||
|
||||
- name: KAFKA_EAV_ASSETS_TOPIC
|
||||
value:
|
||||
_default: "assets_broadcast"
|
||||
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-s3: |-
|
||||
{{- with secret "secrets/data/minio/apps/issues" -}}
|
||||
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
|
||||
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
|
||||
YC_S3_BUCKET_NAME=issues
|
||||
YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
|
||||
{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
|
||||
{{- with secret "secrets/data/kafka/apps/issues" -}}
|
||||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||||
{{- end -}}
|
||||
27
apps/issues/uralkal/kafka-ca-configmap.yaml
Normal file
27
apps/issues/uralkal/kafka-ca-configmap.yaml
Normal file
@ -0,0 +1,27 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kafka-ca-cert
|
||||
namespace: issues
|
||||
data:
|
||||
kafka.crt: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
|
||||
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
|
||||
MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
|
||||
MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
|
||||
tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
|
||||
h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
|
||||
k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
|
||||
GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
|
||||
zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
|
||||
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
|
||||
Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
|
||||
A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
|
||||
vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
|
||||
OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
|
||||
fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
|
||||
ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
|
||||
0FC16VuidLG0HUCCawFjRiAg9rIA
|
||||
-----END CERTIFICATE-----
|
||||
14
apps/issues/uralkal/kustomization.yaml
Normal file
14
apps/issues/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,14 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
- kafka-ca-configmap.yaml
|
||||
patches:
|
||||
- path: backend-s3.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: celery-s3.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: celery
|
||||
4
apps/mapper/uralkal/kustomization.yaml
Normal file
4
apps/mapper/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/measurements/uralkal/kustomization.yaml
Normal file
4
apps/measurements/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
27
apps/message-hub/uralkal/kafka-ca-configmap.yaml
Normal file
27
apps/message-hub/uralkal/kafka-ca-configmap.yaml
Normal file
@ -0,0 +1,27 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kafka-ca-cert
|
||||
namespace: message-hub
|
||||
data:
|
||||
kafka.crt: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
|
||||
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
|
||||
MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
|
||||
MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
|
||||
tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
|
||||
h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
|
||||
k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
|
||||
GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
|
||||
zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
|
||||
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
|
||||
Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
|
||||
A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
|
||||
vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
|
||||
OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
|
||||
fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
|
||||
ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
|
||||
0FC16VuidLG0HUCCawFjRiAg9rIA
|
||||
-----END CERTIFICATE-----
|
||||
10
apps/message-hub/uralkal/kustomization.yaml
Normal file
10
apps/message-hub/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,10 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
- kafka-ca-configmap.yaml
|
||||
patches:
|
||||
- path: message-hub.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: message-hub
|
||||
105
apps/message-hub/uralkal/message-hub.yaml
Normal file
105
apps/message-hub/uralkal/message-hub.yaml
Normal file
@ -0,0 +1,105 @@
|
||||
---
|
||||
# Патч message-hub для vad.
|
||||
#
|
||||
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
|
||||
# поэтому здесь продублирован весь набор из apps/message-hub/base/message-hub.yaml.
|
||||
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||||
# agent-inject-template-message-hub-kafka; остальные берутся из base.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: message-hub
|
||||
namespace: message-hub
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
envs:
|
||||
- name: WORKER_TIMEOUT
|
||||
value:
|
||||
_default: "60"
|
||||
|
||||
- name: PYTHONPATH
|
||||
value:
|
||||
_default: "src"
|
||||
|
||||
- name: SETTINGS_MAX_RETRIES
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: SETTINGS_TOPICS
|
||||
value:
|
||||
_default: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod", "resources_updated": "iam.resource.updated.v2", "resources_deleted": "iam.resource.deleted.v2"}'
|
||||
- name: SETTINGS_VERIFY_SSL
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: SAREX_BASE_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.pm.svc.cluster.local:8000"
|
||||
|
||||
- name: PM_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.pm.svc.cluster.local:8000"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||
|
||||
- name: ISSUES_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.issues.svc.cluster.local:80"
|
||||
|
||||
- name: CACHE_HOST
|
||||
value:
|
||||
_default: "redis.pm.svc.cluster.local"
|
||||
|
||||
- name: CACHE_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
|
||||
- name: CACHE_SSL
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: KAFKA_HOST
|
||||
value:
|
||||
_default: "kafka-kafka-contour.kafka.svc.cluster.local"
|
||||
|
||||
- name: KAFKA_PORT
|
||||
value:
|
||||
_default: "9092"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||||
- name: KAFKA_SECURITY_PROTOCOL
|
||||
value:
|
||||
_default: "SASL_SSL"
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: kafka-ca-cert
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
subPath:
|
||||
_default: kafka.crt
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-ca-cert
|
||||
items:
|
||||
- key: kafka.crt
|
||||
path:
|
||||
_default: kafka.crt
|
||||
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/pm
|
||||
vault.hashicorp.com/agent-inject-template-message-hub-kafka: |-
|
||||
{{- with secret "secrets/data/kafka/apps/pm" -}}
|
||||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||||
KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
|
||||
{{- end -}}
|
||||
4
apps/notes/uralkal/kustomization.yaml
Normal file
4
apps/notes/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
205
apps/pm/uralkal/backend.yaml
Normal file
205
apps/pm/uralkal/backend.yaml
Normal file
@ -0,0 +1,205 @@
|
||||
---
|
||||
# Патч backend для vad.
|
||||
#
|
||||
# ВНИМАНИЕ: args — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
|
||||
# поэтому здесь продублирован весь скрипт из apps/pm/base/backend.yaml.
|
||||
# При правке args в base их нужно продублировать и сюда.
|
||||
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||||
# один ключ agent-inject-template-pm-s3; остальные vault-аннотации берутся из base.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: pm
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551
|
||||
|
||||
deployment:
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
set -a
|
||||
[ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db
|
||||
[ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq
|
||||
[ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3
|
||||
[ -f /vault/secrets/pm-kafka ] && . /vault/secrets/pm-kafka
|
||||
set +a
|
||||
python manage.py makemigrations pm --noinput
|
||||
python manage.py migrate
|
||||
exec /opt/sarex/entrypoint.sh
|
||||
envs:
|
||||
- name: USERS_INTERNAL_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: CELERY_REDIS_HOST
|
||||
value:
|
||||
_default: "redis.pm.svc.cluster.local"
|
||||
|
||||
- name: RESOURCES_INTERNAL_HOST
|
||||
value:
|
||||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||
|
||||
- name: EAV_API_PREFIX
|
||||
value:
|
||||
_default: "/api/v0"
|
||||
|
||||
- name: EAV_API_PREFIX_V1
|
||||
value:
|
||||
_default: "/api/v1"
|
||||
|
||||
- name: TRACING_INSECURE
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: SERVER_ENABLE_SYNC_RESOURCES
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
- name: SERVER_DELETED_TASK_MAX_AGE_DAYS
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR
|
||||
value:
|
||||
_default: "17"
|
||||
|
||||
- name: LANG
|
||||
value:
|
||||
_default: "C.UTF-8"
|
||||
|
||||
- name: LC_ALL
|
||||
value:
|
||||
_default: "C.UTF-8"
|
||||
|
||||
- name: PYTHONUTF8
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: CACHE_SSL
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: CACHE_SSL_CA_CERTS
|
||||
value:
|
||||
_default: ""
|
||||
|
||||
# base: "False". При False CACHE_CLIENT = None (config/settings/base.py:190),
|
||||
# и GET /api/pm/msp/external-task-info/ падает с
|
||||
# AttributeError: 'NoneType' object has no attribute 'get' —
|
||||
# sarex/pm/utils/broker_producer.py:38 дёргает .get() без проверки на None.
|
||||
- name: CACHE_ENABLE
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
# Новые: в base их нет. Дефолт CacheSettings.host — localhost,
|
||||
# т.е. без них включённый кэш стучится в собственный под.
|
||||
# Redis разворачивается тут же — apps/pm/vad/redis.yaml.
|
||||
- name: CACHE_HOST
|
||||
value:
|
||||
_default: "redis.pm.svc.cluster.local"
|
||||
|
||||
- name: CACHE_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
|
||||
- name: CLICKHOUSE_ENABLE
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: KAFKA_ENABLE
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
- name: KAFKA_BOOTSTRAP_SERVERS
|
||||
value:
|
||||
_default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]'
|
||||
|
||||
- name: KAFKA_SECURITY_PROTOCOL
|
||||
value:
|
||||
_default: "SASL_SSL"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||||
|
||||
- name: KAFKA_TOPICS
|
||||
value:
|
||||
_default: '{"planning": "message-hub-prod"}'
|
||||
|
||||
- name: AUTH_PUBLIC_TOKEN_URL
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com/api/token/public/"
|
||||
|
||||
- name: SERVER_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com"
|
||||
|
||||
- name: SERVER_API_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com"
|
||||
|
||||
- name: SERVER_DEBUG
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: SERVER_ALLOWED_HOSTS
|
||||
value:
|
||||
_default: '["*"]'
|
||||
|
||||
- name: SERVER_USE_OTEL
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: SERVER_VERIFY_SSL
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: SERVER_LOG_LEVEL
|
||||
value:
|
||||
_default: "INFO"
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: kafka-ca-cert
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
subPath:
|
||||
_default: kafka.crt
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-ca-cert
|
||||
items:
|
||||
- key: kafka.crt
|
||||
path:
|
||||
_default: kafka.crt
|
||||
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-template-pm-s3: |-
|
||||
{{- with secret "secrets/data/minio/apps/pm" -}}
|
||||
S3_HOST={{ index .Data.data.client "endpoint" }}
|
||||
S3_LOGIN={{ index .Data.data "access_key" }}
|
||||
S3_PASSWORD={{ index .Data.data "secret_key" }}
|
||||
S3_VERIFY=False
|
||||
{{- $buckets := index .Data.data "buckets" }}
|
||||
S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}sarex-media-storage{{ end }}
|
||||
{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm
|
||||
vault.hashicorp.com/agent-inject-template-pm-kafka: |-
|
||||
{{- with secret "secrets/data/kafka/apps/pm" -}}
|
||||
KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
|
||||
KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
|
||||
KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
|
||||
{{- end -}}
|
||||
216
apps/pm/uralkal/celery.yaml
Normal file
216
apps/pm/uralkal/celery.yaml
Normal file
@ -0,0 +1,216 @@
|
||||
---
|
||||
# Патч celery для vad.
|
||||
#
|
||||
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
|
||||
# поэтому здесь продублирован весь набор из apps/pm/base/celery.yaml.
|
||||
# При добавлении переменной в base её нужно продублировать и сюда.
|
||||
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||||
# один ключ agent-inject-template-pm-s3; остальные vault-аннотации берутся из base.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: celery
|
||||
namespace: pm
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
celery:
|
||||
# Образ общий с backend — держать в одной версии обязательно,
|
||||
# иначе воркер разъедется с API по схеме задач и моделям.
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551
|
||||
|
||||
# base не переопределяет args, а нам нужно добавить sourcing pm-kafka —
|
||||
# дублируем скрипт целиком (то же самое, что и в backend.yaml).
|
||||
deployment:
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
set -a
|
||||
[ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db
|
||||
[ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq
|
||||
[ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3
|
||||
[ -f /vault/secrets/pm-kafka ] && . /vault/secrets/pm-kafka
|
||||
set +a
|
||||
exec celery -A config worker -B -l info -E -Q pm -n default_worker.%h --concurrency=2
|
||||
|
||||
envs:
|
||||
# base: http://backend-service.sarex.svc.cluster.local:8000 — ns sarex не существует
|
||||
- name: USERS_INTERNAL_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: CELERY_REDIS_HOST
|
||||
value:
|
||||
_default: "redis.pm.svc.cluster.local"
|
||||
|
||||
# base: http://sarex-resources-service.resources — ns resources не развёрнут в контуре
|
||||
- name: RESOURCES_INTERNAL_HOST
|
||||
value:
|
||||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||||
|
||||
# base: http://eav-service.eav — сервис называется backend-svc и слушает 80
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||
|
||||
- name: EAV_API_PREFIX
|
||||
value:
|
||||
_default: "/api/v0"
|
||||
|
||||
- name: EAV_API_PREFIX_V1
|
||||
value:
|
||||
_default: "/api/v1"
|
||||
|
||||
- name: TRACING_INSECURE
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: SERVER_ENABLE_SYNC_RESOURCES
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
- name: SERVER_DELETED_TASK_MAX_AGE_DAYS
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR
|
||||
value:
|
||||
_default: "17"
|
||||
|
||||
- name: LANG
|
||||
value:
|
||||
_default: "C.UTF-8"
|
||||
|
||||
- name: LC_ALL
|
||||
value:
|
||||
_default: "C.UTF-8"
|
||||
|
||||
- name: PYTHONUTF8
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: CACHE_SSL
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: CACHE_SSL_CA_CERTS
|
||||
value:
|
||||
_default: ""
|
||||
|
||||
# base: "False". Держим в одном значении с backend: при enable
|
||||
# config/celery.py включает периодическую синхронизацию ресурсов,
|
||||
# которая пишет ключи service_accounts / resources:* — их читает
|
||||
# backend в sarex/pm/utils/resources.py.
|
||||
- name: CACHE_ENABLE
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
# Новые: в base их нет, дефолт CacheSettings.host — localhost.
|
||||
- name: CACHE_HOST
|
||||
value:
|
||||
_default: "redis.pm.svc.cluster.local"
|
||||
|
||||
- name: CACHE_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
|
||||
- name: CLICKHOUSE_ENABLE
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: KAFKA_ENABLE
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
# См. подробные комментарии в apps/pm/vad/backend.yaml —
|
||||
# то же самое, воркер должен уметь публиковать в Kafka так же, как API.
|
||||
- name: KAFKA_BOOTSTRAP_SERVERS
|
||||
value:
|
||||
_default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]'
|
||||
|
||||
- name: KAFKA_SECURITY_PROTOCOL
|
||||
value:
|
||||
_default: "SASL_SSL"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||||
|
||||
- name: KAFKA_TOPICS
|
||||
value:
|
||||
_default: '{"planning": "message-hub-prod"}'
|
||||
|
||||
# base: https://lk.sarex.io/api/token/public/
|
||||
- name: AUTH_PUBLIC_TOKEN_URL
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com/api/token/public/"
|
||||
|
||||
# base: https://lk.sarex.io
|
||||
- name: SERVER_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com"
|
||||
|
||||
# base: https://api.sarex.io
|
||||
- name: SERVER_API_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com"
|
||||
|
||||
- name: SERVER_DEBUG
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: SERVER_ALLOWED_HOSTS
|
||||
value:
|
||||
_default: '["*"]'
|
||||
|
||||
- name: SERVER_USE_OTEL
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: SERVER_VERIFY_SSL
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
- name: SERVER_LOG_LEVEL
|
||||
value:
|
||||
_default: "INFO"
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: kafka-ca-cert
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
subPath:
|
||||
_default: kafka.crt
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-ca-cert
|
||||
items:
|
||||
- key: kafka.crt
|
||||
path:
|
||||
_default: kafka.crt
|
||||
|
||||
podAnnotations:
|
||||
_default:
|
||||
# base склеивал S3_BUCKET с S3_VERIFY: {{- end -}} съедал перевод строки.
|
||||
# S3_VERIFY поднят выше блока if, у {{ end }} убран хвостовой дефис.
|
||||
vault.hashicorp.com/agent-inject-template-pm-s3: |-
|
||||
{{- with secret "secrets/data/minio/apps/pm" -}}
|
||||
S3_HOST={{ index .Data.data.client "endpoint" }}
|
||||
S3_LOGIN={{ index .Data.data "access_key" }}
|
||||
S3_PASSWORD={{ index .Data.data "secret_key" }}
|
||||
S3_VERIFY=False
|
||||
{{- $buckets := index .Data.data "buckets" }}
|
||||
S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}sarex-media-storage{{ end }}
|
||||
{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm
|
||||
vault.hashicorp.com/agent-inject-template-pm-kafka: |-
|
||||
{{- with secret "secrets/data/kafka/apps/pm" -}}
|
||||
KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
|
||||
KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
|
||||
KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
|
||||
{{- end -}}
|
||||
27
apps/pm/uralkal/kafka-ca-configmap.yaml
Normal file
27
apps/pm/uralkal/kafka-ca-configmap.yaml
Normal file
@ -0,0 +1,27 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kafka-ca-cert
|
||||
namespace: pm
|
||||
data:
|
||||
kafka.crt: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
|
||||
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
|
||||
MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
|
||||
MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
|
||||
tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
|
||||
h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
|
||||
k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
|
||||
GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
|
||||
zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
|
||||
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
|
||||
Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
|
||||
A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
|
||||
vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
|
||||
OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
|
||||
fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
|
||||
ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
|
||||
0FC16VuidLG0HUCCawFjRiAg9rIA
|
||||
-----END CERTIFICATE-----
|
||||
15
apps/pm/uralkal/kustomization.yaml
Normal file
15
apps/pm/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,15 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
- redis.yaml
|
||||
- kafka-ca-configmap.yaml
|
||||
patches:
|
||||
- path: backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: celery.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: celery
|
||||
98
apps/pm/uralkal/redis.yaml
Normal file
98
apps/pm/uralkal/redis.yaml
Normal file
@ -0,0 +1,98 @@
|
||||
---
|
||||
# Redis для celery в ns pm. В base его нет — там CELERY_REDIS_HOST указывает
|
||||
# на redis.pm.svc.cluster.local, но сам сервис не разворачивается.
|
||||
#
|
||||
# Имя Service обязано быть ровно "redis" (не redis-svc, как принято в остальных
|
||||
# релизах), иначе не сойдётся с CELERY_REDIS_HOST в backend.yaml и celery.yaml.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: pm
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
redis:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
|
||||
pullPolicy:
|
||||
_default: Always
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: redis
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 6379
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 64Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: redis
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 6379
|
||||
|
||||
targetPort:
|
||||
_default: 6379
|
||||
|
||||
# НЕ http: чарт по умолчанию подставляет "http", и тогда Istio навесит
|
||||
# на 6379 HTTP-фильтры и сломает RESP. Префикс tcp- переводит порт
|
||||
# в режим обычного TCP-проксирования.
|
||||
portName:
|
||||
_default: tcp-redis
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
4
apps/prescriptions/uralkal/kustomization.yaml
Normal file
4
apps/prescriptions/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/processing/uralkal/kustomization.yaml
Normal file
4
apps/processing/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/projects/uralkal/kustomization.yaml
Normal file
4
apps/projects/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/remarks/uralkal/kustomization.yaml
Normal file
4
apps/remarks/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/reviews/uralkal/kustomization.yaml
Normal file
4
apps/reviews/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/rfi/uralkal/kustomization.yaml
Normal file
4
apps/rfi/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
13
apps/stamp-verification/uralkal/frontend.yaml
Normal file
13
apps/stamp-verification/uralkal/frontend.yaml
Normal file
@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: stamp-verification
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/stamp-verification-frontend:vad-prod_801af373
|
||||
9
apps/stamp-verification/uralkal/kustomization.yaml
Normal file
9
apps/stamp-verification/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: frontend
|
||||
4
apps/subscriptions/uralkal/kustomization.yaml
Normal file
4
apps/subscriptions/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
4
apps/system-log/uralkal/kustomization.yaml
Normal file
4
apps/system-log/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
247
apps/transmittal/uralkal/backend.yaml
Normal file
247
apps/transmittal/uralkal/backend.yaml
Normal file
@ -0,0 +1,247 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: transmittal
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
envs:
|
||||
- name: TRANSMITTAL_SERVICE_APP__NAME
|
||||
value:
|
||||
_default: "Transmittal Service"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL
|
||||
value:
|
||||
_default: "ERROR"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL
|
||||
value:
|
||||
_default: "http://backend-svc.flows.svc.cluster.local:80"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT
|
||||
value:
|
||||
_default: "30"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_APP__HOST
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech/transmittal"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT
|
||||
value:
|
||||
_default: "prod"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS
|
||||
value:
|
||||
_default: '["*"]'
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS
|
||||
value:
|
||||
_default: '["*"]'
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS
|
||||
value:
|
||||
_default: '["*"]'
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS
|
||||
value:
|
||||
_default: "true"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__HOST
|
||||
value:
|
||||
_default: "0.0.0.0"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__PORT
|
||||
value:
|
||||
_default: "8000"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_OTEL__ENABLE
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_OTEL__HOST
|
||||
value:
|
||||
_default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME
|
||||
value:
|
||||
_default: "backend.transmittals-prod"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_OTEL__INSECURE
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE
|
||||
value:
|
||||
_default: "verify-full"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH
|
||||
value:
|
||||
_default: "/opt/.postgresql/root.crt"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL
|
||||
value:
|
||||
_default: "info"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS
|
||||
value:
|
||||
_default: "2"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH
|
||||
value:
|
||||
_default: ""
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RABBITMQ__HOST
|
||||
value:
|
||||
_default: "rabbitmq.rabbitmq.svc.cluster.local"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RABBITMQ__PORT
|
||||
value:
|
||||
_default: "5672"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT
|
||||
value:
|
||||
_default: "15"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL
|
||||
value:
|
||||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT
|
||||
value:
|
||||
_default: "15"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT
|
||||
value:
|
||||
_default: "15"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT
|
||||
value:
|
||||
_default: "50"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME
|
||||
value:
|
||||
_default: "ru-central1"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY
|
||||
value:
|
||||
_default: "true"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
|
||||
value:
|
||||
_default: "s3-proxy.s3-proxy.svc.cluster.local"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
|
||||
value:
|
||||
_default: "http://export-project-service.django.svc.cluster.local:8000"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT
|
||||
value:
|
||||
_default: "50"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL
|
||||
value:
|
||||
_default: "http://marks-service.documentations.svc.cluster.local:8000"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT
|
||||
value:
|
||||
_default: "50"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL
|
||||
value:
|
||||
_default: "https://api.mailgun.net/v3/mg.sarex.io"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT
|
||||
value:
|
||||
_default: "15"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
|
||||
value:
|
||||
_default: "hello@wb.io"
|
||||
|
||||
13
apps/transmittal/uralkal/kustomization.yaml
Normal file
13
apps/transmittal/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,13 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: worker.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: worker
|
||||
247
apps/transmittal/uralkal/worker.yaml
Normal file
247
apps/transmittal/uralkal/worker.yaml
Normal file
@ -0,0 +1,247 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: worker
|
||||
namespace: transmittal
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
worker:
|
||||
envs:
|
||||
- name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL
|
||||
value:
|
||||
_default: "http://backend-svc.flows.svc.cluster.local:8000"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT
|
||||
value:
|
||||
_default: "30"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_APP__NAME
|
||||
value:
|
||||
_default: "Transmittal Service"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL
|
||||
value:
|
||||
_default: "ERROR"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_APP__HOST
|
||||
value:
|
||||
_default: "https://lk.srx.wb.ru:30443/transmittal"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT
|
||||
value:
|
||||
_default: "prod"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS
|
||||
value:
|
||||
_default: '["*"]'
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS
|
||||
value:
|
||||
_default: '["*"]'
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS
|
||||
value:
|
||||
_default: '["*"]'
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS
|
||||
value:
|
||||
_default: "true"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__HOST
|
||||
value:
|
||||
_default: "0.0.0.0"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__PORT
|
||||
value:
|
||||
_default: "8000"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_OTEL__ENABLE
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_OTEL__HOST
|
||||
value:
|
||||
_default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME
|
||||
value:
|
||||
_default: "backend.transmittals-prod"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_OTEL__INSECURE
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE
|
||||
value:
|
||||
_default: "verify-full"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH
|
||||
value:
|
||||
_default: "/opt/.postgresql/root.crt"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL
|
||||
value:
|
||||
_default: "info"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS
|
||||
value:
|
||||
_default: "2"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH
|
||||
value:
|
||||
_default: ""
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RABBITMQ__HOST
|
||||
value:
|
||||
_default: "rabbitmq.rabbitmq.svc.cluster.local"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RABBITMQ__PORT
|
||||
value:
|
||||
_default: "5672"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL
|
||||
value:
|
||||
_default: "http://backend.django.svc.cluster.local:8000"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT
|
||||
value:
|
||||
_default: "15"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL
|
||||
value:
|
||||
_default: "http://resources-service.resources.svc.cluster.local:8000"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT
|
||||
value:
|
||||
_default: "15"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT
|
||||
value:
|
||||
_default: "15"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT
|
||||
value:
|
||||
_default: "50"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME
|
||||
value:
|
||||
_default: "ru-central1"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY
|
||||
value:
|
||||
_default: "true"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
|
||||
value:
|
||||
_default: "s3-proxy.s3-proxy.svc.cluster.local"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL
|
||||
value:
|
||||
_default: "http://export-project-service.django.svc.cluster.local:8000"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT
|
||||
value:
|
||||
_default: "50"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL
|
||||
value:
|
||||
_default: "http://marks-service.documentations.svc.cluster.local:8000"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT
|
||||
value:
|
||||
_default: "50"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL
|
||||
value:
|
||||
_default: "https://api.mailgun.net/v3/mg.sarex.io"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS
|
||||
value:
|
||||
_default: "10"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS
|
||||
value:
|
||||
_default: "5"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT
|
||||
value:
|
||||
_default: "15"
|
||||
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
|
||||
value:
|
||||
_default: "hello@wb.io"
|
||||
|
||||
4
apps/workspaces/uralkal/kustomization.yaml
Normal file
4
apps/workspaces/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
@ -16,3 +16,41 @@ resources:
|
||||
- ../../infrastructure/superset/uralkal
|
||||
- ../../infrastructure/trino/uralkal
|
||||
- ../../infrastructure/istio-config/uralkal
|
||||
- ../../infrastructure/s3-proxy/uralkal
|
||||
|
||||
- ../../apps/reviews/uralkal
|
||||
- ../../apps/remarks/uralkal
|
||||
- ../../apps/auth-flow/uralkal
|
||||
- ../../apps/control-interface/uralkal
|
||||
- ../../apps/workspaces/uralkal
|
||||
- ../../apps/eav/uralkal
|
||||
- ../../apps/notes/uralkal
|
||||
- ../../apps/rfi/uralkal
|
||||
- ../../apps/checklists/uralkal
|
||||
- ../../apps/contracts/uralkal
|
||||
- ../../apps/django/uralkal
|
||||
- ../../apps/documentations/uralkal
|
||||
- ../../apps/processing/uralkal
|
||||
- ../../apps/flows/uralkal
|
||||
- ../../apps/issues/uralkal
|
||||
- ../../apps/bim/uralkal
|
||||
- ../../apps/attachments/uralkal
|
||||
- ../../apps/bi/uralkal
|
||||
- ../../apps/comparisons/uralkal
|
||||
- ../../apps/drawings/uralkal
|
||||
- ../../apps/inspections/uralkal
|
||||
- ../../apps/mapper/uralkal
|
||||
- ../../apps/measurements/uralkal
|
||||
- ../../apps/subscriptions/uralkal
|
||||
- ../../apps/system-log/uralkal
|
||||
- ../../apps/transmittal/uralkal
|
||||
- ../../apps/cross-section/uralkal
|
||||
- ../../apps/document-link/uralkal
|
||||
- ../../apps/prescriptions/uralkal
|
||||
- ../../apps/projects/uralkal
|
||||
- ../../apps/stamp-verification/uralkal
|
||||
- ../../apps/faas/uralkal
|
||||
- ../../apps/iam/uralkal
|
||||
- ../../apps/pm/uralkal
|
||||
- ../../apps/message-hub/uralkal
|
||||
- ../../apps/cde/uralkal
|
||||
|
||||
@ -34,6 +34,413 @@ spec:
|
||||
tls:
|
||||
credentialName: uralkal-camunda-operate-tls
|
||||
virtualServices:
|
||||
platform:
|
||||
name: sarex-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: frontend-svc.django.svc.cluster.local
|
||||
port: 80
|
||||
filestream-api:
|
||||
name: documentations-filestream-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /files/api/
|
||||
rewrite: /api/
|
||||
service: backend-filestream-svc.documentations.svc.cluster.local
|
||||
port: 80
|
||||
iam-api:
|
||||
name: iam-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /iam/api/
|
||||
rewrite: /external/api/
|
||||
service: iam-backend.iam.svc.cluster.local
|
||||
port: 8000
|
||||
documentations-frontend:
|
||||
name: documentations-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /documentations/static/
|
||||
rewrite: /
|
||||
service: frontend-svc.documentations.svc.cluster.local
|
||||
port: 80
|
||||
rfi-frontend:
|
||||
name: rfi-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /rfi/static/
|
||||
rewrite: /
|
||||
service: frontend-svc.rfi.svc.cluster.local
|
||||
port: 80
|
||||
rfi-api:
|
||||
name: rfi-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /rfi/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.rfi.svc.cluster.local
|
||||
port: 80
|
||||
pm:
|
||||
name: pm-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /pm/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.pm.svc.cluster.local
|
||||
port: 8000
|
||||
- path:
|
||||
prefix: /pm/
|
||||
rewrite: /
|
||||
service: frontend-svc.pm.svc.cluster.local
|
||||
port: 80
|
||||
documentations-api:
|
||||
name: documentations-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
cors:
|
||||
allowOrigins:
|
||||
- exact: "*"
|
||||
extraAllowMethods:
|
||||
- HEAD
|
||||
extraAllowHeaders:
|
||||
- Range
|
||||
- Cache-control
|
||||
allowCredentials: true
|
||||
routes:
|
||||
- path:
|
||||
prefix: /documentations/api/
|
||||
rewrite: /api/
|
||||
service: backend-api-svc.documentations.svc.cluster.local
|
||||
port: 80
|
||||
workspaces-api:
|
||||
name: workspaces-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /workspaces/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.workspaces.svc.cluster.local
|
||||
port: 80
|
||||
gateway-platform:
|
||||
name: pdm-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /gateway/
|
||||
rewrite: /
|
||||
service: pdm-svc.documentations.svc.cluster.local
|
||||
port: 80
|
||||
issues-api:
|
||||
name: issues-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /issues/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.issues.svc.cluster.local
|
||||
port: 80
|
||||
checklists-api:
|
||||
name: checklists-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /checklists/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.checklists.svc.cluster.local
|
||||
port: 80
|
||||
bim-api:
|
||||
name: bim-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /bimv2/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.bim.svc.cluster.local
|
||||
port: 80
|
||||
flows-api:
|
||||
name: flows-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /flows/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.flows.svc.cluster.local
|
||||
port: 80
|
||||
issues-frontend:
|
||||
name: issues-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /issues/static/
|
||||
rewrite: /
|
||||
service: frontend-svc.issues.svc.cluster.local
|
||||
port: 80
|
||||
remarks-frontend:
|
||||
name: remarks-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /remarks/static/
|
||||
rewrite: /
|
||||
service: frontend-service.remarks.svc.cluster.local
|
||||
port: 80
|
||||
auth-frontend:
|
||||
name: auth-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /auth/callback
|
||||
rewrite: /
|
||||
service: frontend-svc.auth-flow.svc.cluster.local
|
||||
port: 80
|
||||
flows-frontend:
|
||||
name: flows-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /flows/static/
|
||||
rewrite: /
|
||||
service: frontend-svc.flows.svc.cluster.local
|
||||
port: 80
|
||||
transmittal-frontend:
|
||||
name: transmittal-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /transmittal/static/
|
||||
rewrite: /
|
||||
service: frontend-svc.transmittal.svc.cluster.local
|
||||
port: 80
|
||||
workflows-api:
|
||||
name: workflows-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /workflows/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.processing.svc.cluster.local
|
||||
port: 80
|
||||
transmittals-api:
|
||||
name: transmittals-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /transmittals/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.transmittal.svc.cluster.local
|
||||
port: 80
|
||||
inspections-api:
|
||||
name: flows-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /inspections/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.inspections.svc.cluster.local
|
||||
port: 80
|
||||
reviews-frontend:
|
||||
name: reviews-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /reviews/static/
|
||||
rewrite: /
|
||||
service: frontend-svc.reviews.svc.cluster.local
|
||||
port: 80
|
||||
eav-api:
|
||||
name: eav-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /eav/api/v0
|
||||
rewrite: /api/v4
|
||||
service: backend-svc.eav.svc.cluster.local
|
||||
port: 80
|
||||
- path:
|
||||
prefix: /eav/api/v2
|
||||
rewrite: /api/v5
|
||||
service: backend-svc.eav.svc.cluster.local
|
||||
port: 80
|
||||
- path:
|
||||
prefix: /eav/api/v3
|
||||
rewrite: /api/v3
|
||||
service: backend-svc.eav.svc.cluster.local
|
||||
port: 80
|
||||
- path:
|
||||
prefix: /eav/api/v4
|
||||
rewrite: /api/v4
|
||||
service: backend-svc.eav.svc.cluster.local
|
||||
port: 80
|
||||
- path:
|
||||
prefix: /eav/api/v1
|
||||
rewrite: /api/v6
|
||||
service: backend-svc.eav.svc.cluster.local
|
||||
port: 80
|
||||
- path:
|
||||
prefix: /eav/admin/
|
||||
rewrite: /eav/admin/
|
||||
service: backend-svc.eav.svc.cluster.local
|
||||
port: 80
|
||||
srx-admin-frontend:
|
||||
name: srx-admin-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /control-interface/
|
||||
rewrite: /
|
||||
service: frontend-svc.control-interface.svc.cluster.local
|
||||
port: 8080
|
||||
s3-proxy-media:
|
||||
name: s3-proxy-media-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /media/
|
||||
rewrite: /
|
||||
service: s3-proxy-svc.django.svc.cluster.local
|
||||
port: 80
|
||||
bi-api:
|
||||
name: bi-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /analytics-v2/api/
|
||||
rewrite: /api/
|
||||
service: bi-backend-service.bi.svc.cluster.local
|
||||
port: 80
|
||||
bi-frontend:
|
||||
name: bi-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /analytics-v2/static/
|
||||
rewrite: /
|
||||
service: bi-frontend-frontend-svc.bi.svc.cluster.local
|
||||
port: 80
|
||||
- path:
|
||||
prefix: /analytics-v2/
|
||||
rewrite: /
|
||||
service: bi-frontend-frontend-svc.bi.svc.cluster.local
|
||||
port: 80
|
||||
zitadel:
|
||||
namespace: default
|
||||
hosts:
|
||||
@ -67,3 +474,36 @@ spec:
|
||||
prefix: /
|
||||
service: camunda-operate.camunda.svc.cluster.local
|
||||
port: 80
|
||||
stamp-verification:
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex-stamp-verification.sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: frontend-service.stamp-verification.svc.cluster.local
|
||||
port: 80
|
||||
document-link:
|
||||
namespace: default
|
||||
hosts:
|
||||
- document-link.sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: frontend-service.document-link.svc.cluster.local
|
||||
port: 80
|
||||
s3:
|
||||
namespace: default
|
||||
hosts:
|
||||
- s3.sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: s3-proxy.s3-proxy.svc.cluster.local
|
||||
port: 80
|
||||
|
||||
49
infrastructure/s3-proxy/uralkal/configmap.yaml
Normal file
49
infrastructure/s3-proxy/uralkal/configmap.yaml
Normal file
@ -0,0 +1,49 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: s3-proxy-nginx-conf
|
||||
namespace: s3-proxy
|
||||
data:
|
||||
nginx.conf: |
|
||||
worker_processes auto;
|
||||
error_log /dev/stderr info;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
access_log off;
|
||||
|
||||
upstream minio_backend {
|
||||
least_conn;
|
||||
server 10.133.0.245:9000 max_fails=3 fail_timeout=10s;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 8080;
|
||||
server_name _;
|
||||
|
||||
ignore_invalid_headers off;
|
||||
client_max_body_size 0;
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
|
||||
location /healthz {
|
||||
return 200 "ok\n";
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 5s;
|
||||
proxy_read_timeout 300s;
|
||||
proxy_send_timeout 300s;
|
||||
chunked_transfer_encoding off;
|
||||
proxy_pass http://minio_backend;
|
||||
}
|
||||
}
|
||||
}
|
||||
51
infrastructure/s3-proxy/uralkal/deployment.yaml
Normal file
51
infrastructure/s3-proxy/uralkal/deployment.yaml
Normal file
@ -0,0 +1,51 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: s3-proxy
|
||||
namespace: s3-proxy
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: s3-proxy
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: s3-proxy
|
||||
spec:
|
||||
nodeSelector:
|
||||
dedicated: generic
|
||||
tolerations: []
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:1.25-alpine
|
||||
volumeMounts:
|
||||
- name: nginx-conf
|
||||
mountPath: /etc/nginx/nginx.conf
|
||||
subPath: nginx.conf
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
volumes:
|
||||
- name: nginx-conf
|
||||
configMap:
|
||||
name: s3-proxy-nginx-conf
|
||||
7
infrastructure/s3-proxy/uralkal/kustomization.yaml
Normal file
7
infrastructure/s3-proxy/uralkal/kustomization.yaml
Normal file
@ -0,0 +1,7 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- configmap.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
6
infrastructure/s3-proxy/uralkal/namespace.yaml
Normal file
6
infrastructure/s3-proxy/uralkal/namespace.yaml
Normal file
@ -0,0 +1,6 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: s3-proxy
|
||||
labels:
|
||||
istio-injection: disabled
|
||||
14
infrastructure/s3-proxy/uralkal/service.yaml
Normal file
14
infrastructure/s3-proxy/uralkal/service.yaml
Normal file
@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: s3-proxy
|
||||
namespace: s3-proxy
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: s3-proxy
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
Loading…
Reference in New Issue
Block a user