diff --git a/apps/attachments/uralkal/kustomization.yaml b/apps/attachments/uralkal/kustomization.yaml new file mode 100644 index 0000000..09b1eed --- /dev/null +++ b/apps/attachments/uralkal/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: attachments +resources: + - ../base +patches: + - path: patch.yaml + target: + kind: HelmRelease + name: attachments diff --git a/apps/attachments/uralkal/patch.yaml b/apps/attachments/uralkal/patch.yaml new file mode 100644 index 0000000..5f8e859 --- /dev/null +++ b/apps/attachments/uralkal/patch.yaml @@ -0,0 +1,34 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: attachments + namespace: attachments +spec: + values: + services: + attachments: + podAnnotations: + _default: + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: attachments + vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/apps/attachments/postgres + vault.hashicorp.com/agent-inject-template-attachments-db: |- + {{- with secret "secrets/data/apps/attachments/postgres" -}} + DATABASE_HOST={{ index .Data.data "host" }} + DATABASE_PORT={{ index .Data.data "port" }} + DATABASE_NAME={{ index .Data.data "database" }} + DATABASE_USER={{ index .Data.data "username" }} + DATABASE_PASSWORD={{ index .Data.data "password" }} + DATABASE_SSL_MODE=disable + {{- end -}} + vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments + vault.hashicorp.com/agent-inject-template-attachments-s3: |- + {{- with secret "secrets/data/minio/apps/attachments" -}} + YANDEX_S3_ENDPOINT_URL=s3-proxy.s3-proxy.svc.cluster.local + YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YANDEX_S3_USE_SSL=false + YANDEX_S3_REGION=ru-central + YANDEX_S3_VERIFY=false + BUCKET_NAME=attachments + {{- end -}} diff --git a/apps/auth-flow/uralkal/kustomization.yaml b/apps/auth-flow/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/auth-flow/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/bi/uralkal/backend.yaml b/apps/bi/uralkal/backend.yaml new file mode 100644 index 0000000..2ba21b6 --- /dev/null +++ b/apps/bi/uralkal/backend.yaml @@ -0,0 +1,74 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: bi-backend + namespace: bi +spec: + values: + services: + main: + envs: + - name: SETTINGS_DEBUG + value: + _default: "0" + + - name: SETTINGS_VERIFY_SSL + value: + _default: "1" + + - name: SETTINGS_API_V1_PREFIX + value: + _default: "/api/v1" + + - name: AUTH_HOST + value: + _default: "https://sarex.local.uralkali.com" + + - name: WORKER_TIMEOUT + value: + _default: "120" + + - name: SUPERSET_HOST + value: + _default: "https://sarex-bi.sarex.local.uralkali.com/" + + - name: PYTHONPATH + value: + _default: "src" + + - name: ISSUES_SERVICE_HOST + value: + _default: "http://backend-svc.issues.svc.cluster.local" + + - name: EAV_SERVICE_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local" + + - name: PM_SERVICE_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:8000" + + - name: SUPERSET_SYSTEM_WIDGETS + value: + _default: '{"MDR": {"id": "e7343f21-1ee0-4a87-b712-e8cfd413cc49","name": "MDR"},"SC": {"id": "d63d25e4-eab6-452f-8b31-065094bc2cb6","name": "Стройконтроль"}}' + + - name: SUPERSET_DOCUMENTATION_URL + value: + _default: "https://sarex.local.uralkali.com/documentations/" + + - name: SUPERSET_JWT_SECRET + value: + _default: "6TosZjqxxZ3kAPiht4miaGICRV5AbfvuenWnYfOUnxfbYJJXUNWedOS0QeJQaryr" + + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]' + + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-prod"}' + + - name: KAFKA_ENABLE + value: + _default: "0" diff --git a/apps/bi/uralkal/kustomization.yaml b/apps/bi/uralkal/kustomization.yaml new file mode 100644 index 0000000..01b4d58 --- /dev/null +++ b/apps/bi/uralkal/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: backend.yaml + target: + kind: HelmRelease + name: bi-backend diff --git a/apps/bim/uralkal/kustomization.yaml b/apps/bim/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/bim/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/cde/uralkal/kustomization.yaml b/apps/cde/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/cde/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/checklists/uralkal/kustomization.yaml b/apps/checklists/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/checklists/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/comparisons/uralkal/kustomization.yaml b/apps/comparisons/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/comparisons/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/contracts/uralkal/backend.yaml b/apps/contracts/uralkal/backend.yaml new file mode 100644 index 0000000..95076cc --- /dev/null +++ b/apps/contracts/uralkal/backend.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: contracts + namespace: contracts +spec: + values: + services: + contracts: + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-template-contracts-db: |- + {{- with secret "secrets/data/apps/contracts/postgres" -}} + DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@{{ index .Data.data "host" }}:{{ index .Data.data "port" }}/{{ index .Data.data "database" }}?sslmode=disable + {{- end -}} diff --git a/apps/contracts/uralkal/kustomization.yaml b/apps/contracts/uralkal/kustomization.yaml new file mode 100644 index 0000000..28a6ccb --- /dev/null +++ b/apps/contracts/uralkal/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: backend.yaml + target: + kind: HelmRelease + name: contracts diff --git a/apps/control-interface/uralkal/kustomization.yaml b/apps/control-interface/uralkal/kustomization.yaml new file mode 100644 index 0000000..11cf137 --- /dev/null +++ b/apps/control-interface/uralkal/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base + - namespace.yaml diff --git a/apps/control-interface/uralkal/namespace.yaml b/apps/control-interface/uralkal/namespace.yaml new file mode 100644 index 0000000..c9b0e54 --- /dev/null +++ b/apps/control-interface/uralkal/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: control-interface + labels: + istio-injection: enabled diff --git a/apps/cross-section/uralkal/kustomization.yaml b/apps/cross-section/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/cross-section/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/django/uralkal/backend.yaml b/apps/django/uralkal/backend.yaml new file mode 100644 index 0000000..98a70a6 --- /dev/null +++ b/apps/django/uralkal/backend.yaml @@ -0,0 +1,154 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: django +spec: + values: + services: + backend: + envs: + - name: ALLOWED_HOSTS + value: + _default: "*" + - name: SERVER_USE_CHANGELOG + value: + _default: "0" + - name: SERVER_ZITADEL_ENABLED + value: + _default: "True" + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: CELERY_REDIS_HOST + value: + _default: redis + - name: CELERY_REDIS_PORT + value: + _default: "6379" + - name: DJANGO_REDIS_HOST + value: + _default: redis + - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED + value: + _default: "True" + - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED + value: + _default: "True" + - name: DJANGO_REDIS_PORT + value: + _default: "6379" + - name: BIMV2_INTERNAL_HOST + value: + _default: http://bim-backend-v2-service.bim-api + - name: BIMV2_TIMEOUT + value: + _default: "60" + - name: JWT_KID + value: + _default: "1" + - name: PDM_SYNC + value: + _default: "1" + - name: KC_SYNC_ENABLE + value: + _default: "0" + - name: MEASUREMENTS_HOST + value: + _default: http://measurements-service.measurements.svc.cluster.local:8000/api + - name: MEASUREMENTS_USE_MEASUREMENTS + value: + _default: "1" + - name: SERVER_API_HOST + value: + _default: https://sarex.local.uralkali.com + - name: SERVER_HOST + value: + _default: https://sarex.local.uralkali.com + - name: WORKFLOWS_HOST + value: + _default: http://backend-svc.processing.svc.cluster.local:80 + - name: WORKFLOWS_BASE_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: WORKFLOWS_PREFIX + value: + _default: /internal/v1 + - name: WORKFLOWS_USE + value: + _default: "1" + - name: SERVER_S3_STREAM_IMPORT + value: + _default: "1" + - name: SERVER_SAVE_DIFF_DEM + value: + _default: "1" + - name: SERVER_USE_CLICKHOUSE + value: + _default: "0" + - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK + value: + _default: "0" + - name: SERVER_USE_DJANGO_STORAGE + value: + _default: "1" + - name: SERVER_USE_METASHAPE + value: + _default: "0" + - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG + value: + _default: "1" + - name: SERVER_CHANGELOG_MODE + value: + _default: "0" + - name: SERVER_DJANGO_URLS + value: + _default: "1" + - name: CHECK_IMPORT_HASH + value: + _default: "1" + - name: EAV_ENABLE + value: + _default: "1" + - name: SERVER_CHECK_IMPORT_HASH + value: + _default: "1" + - name: SERVER_CHUNKED_PATH + value: + _default: /tmp/chunked_uploads/%Y/%m/%d + - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS + value: + _default: "0" + - name: SERVER_USE_WRORKFLOW_STATUS + value: + _default: "1" + - name: ZITADEL_HOST + value: + _default: https://login.sarex.local.uralkali.com + - name: SERVER_KAFKA_ENABLED + value: + _default: "True" + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + - name: KAFKA_SSL_CAFILE + value: + _default: /usr/local/share/ca-certificates/kafka.crt + - name: KC_USE_REDIRECT_LOGOUT + value: + _default: "False" + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-template-django-s3: |- + {{- with secret "secrets/data/minio/apps/django" }} + AWS_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local + S3_HOST=http://s3-proxy.s3-proxy.svc.cluster.local + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} + {{- end }} diff --git a/apps/django/uralkal/kustomization.yaml b/apps/django/uralkal/kustomization.yaml new file mode 100644 index 0000000..aa93fd8 --- /dev/null +++ b/apps/django/uralkal/kustomization.yaml @@ -0,0 +1,21 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: nginx-configmap.yaml + target: + kind: ConfigMap + name: nginx-configmap + - path: backend.yaml + target: + kind: HelmRelease + name: backend + - path: zitadel-configmap.yaml + target: + kind: ConfigMap + name: zitadel-configmap + - path: s3-proxy.yaml + target: + kind: HelmRelease + name: s3-proxy diff --git a/apps/django/uralkal/nginx-configmap.yaml b/apps/django/uralkal/nginx-configmap.yaml new file mode 100644 index 0000000..f7c6a10 --- /dev/null +++ b/apps/django/uralkal/nginx-configmap.yaml @@ -0,0 +1,160 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: nginx-configmap + namespace: django +data: + nginx.conf: | + worker_processes auto; + + pid /var/run/nginx.pid; + + events { + use epoll; + worker_connections 1024; + } + + http { + + # Basic Settings + large_client_header_buffers 8 128k; + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 300; + types_hash_max_size 2048; + client_max_body_size 5000M; + client_header_buffer_size 5M; + include /etc/nginx/mime.types; + default_type application/octet-stream; + + # Logging Settings + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log; + + # GZIP Settings + gzip on; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_buffers 16 8k; + gzip_http_version 1.1; + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + server { + listen 80; + listen [::]:80; + root /opt/react_client/; + + add_header 'Access-Control-Allow-Origin' '*' always; + add_header 'Access-Control-Allow-Methods' '*' always; + add_header 'Access-Control-Allow-Headers' '*' always; + + location = /static/index.bundle.js { + add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0'; + if_modified_since off; + expires off; + } + + # location ~^/api/pm/ { + # proxy_http_version 1.1; + # proxy_set_header Connection ""; + # proxy_set_header Host $host; + # proxy_pass http://backend-svc.pm.svc.cluster.local:8000; + # } + + location ~^/api/v1/documents/ { + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80; + } + + location ~^/(api|admin)/ { + proxy_http_version 1.1; + proxy_set_header Connection ""; + proxy_set_header Host $host; + proxy_pass http://backend-svc.django.svc.cluster.local:80; + } + + location = /static/pdf-runtime/assets/mupdf-wasm.wasm { + alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm; + add_header Content-Type application/wasm always; + add_header Cache-Control "public, max-age=31536000, immutable" always; + add_header Access-Control-Allow-Origin "*" always; + add_header Access-Control-Allow-Methods "GET, OPTIONS" always; + add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; + } + + location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js { + alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js; + add_header Content-Type application/javascript always; + add_header Cache-Control "public, max-age=31536000, immutable" always; + add_header Access-Control-Allow-Origin "*" always; + add_header Access-Control-Allow-Methods "GET, OPTIONS" always; + add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; + } + + location = /workspaces-v2/worker/mupdf.worker-3.3.9.js { + alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js; + add_header Content-Type application/javascript always; + add_header Cache-Control "public, max-age=31536000, immutable" always; + add_header Access-Control-Allow-Origin "*" always; + add_header Access-Control-Allow-Methods "GET, OPTIONS" always; + add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; + } + + location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js { + alias /opt/react_client/static/viewer-pdf/mupdf.js; + add_header Content-Type application/javascript always; + add_header Cache-Control "public, max-age=31536000, immutable" always; + add_header Access-Control-Allow-Origin "*" always; + add_header Access-Control-Allow-Methods "GET, OPTIONS" always; + add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; + } + + location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm { + add_header Content-Type application/wasm always; + alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm; + } + + location ~^/workspaces-v2/(.+).js { + proxy_http_version 1.1; + proxy_set_header Connection ""; + rewrite /workspaces-v2/(.+) /$1 break; + proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; + } + + location ~^/workspaces-v2/(.+)\.wasm$ { + proxy_http_version 1.1; + proxy_set_header Connection ""; + rewrite ^/workspaces-v2/(.+) /$1 break; + proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; + } + + location @index { + add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0'; + if_modified_since off; + expires off; + try_files /static/index.html =404; + } + + location ~^/workflows/(.+).js { + proxy_http_version 1.1; + proxy_set_header Connection ""; + rewrite /workflows/(.+) /$1 break; + proxy_pass http://frontend-svc.processing.svc.cluster.local:80; + } + + location /service-worker.js { + try_files /static/$uri @index; + } + + location / { + try_files $uri @index; + } + } + } diff --git a/apps/django/uralkal/s3-proxy.yaml b/apps/django/uralkal/s3-proxy.yaml new file mode 100644 index 0000000..7d52fba --- /dev/null +++ b/apps/django/uralkal/s3-proxy.yaml @@ -0,0 +1,31 @@ +--- +# Патч s3-proxy для vad. +# +# В base зашит AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech — +# в закрытом контуре этот хост недоступен, прокси не достучится до MinIO +# и маршрут /media/ (s3-proxy-virt-service в istio-config) вернёт ошибку. +# +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# agent-inject-template-s3; остальные vault-аннотации берутся из base. +# Эндпоинт задан литералом, а не через .Data.data.client.endpoint: так же +# сделано в apps/django/vad/backend.yaml для того же секрета +# secrets/data/minio/apps/django — держим один способ на весь ns. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: s3-proxy + namespace: django +spec: + values: + services: + s3-proxy: + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-template-s3: | + {{- with secret "secrets/data/minio/apps/django" }} + AWS_API_ENDPOINT=http://s3-proxy.s3-proxy.svc.cluster.local + {{- $buckets := index .Data.data "buckets" }} + AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} + AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end }} diff --git a/apps/django/uralkal/zitadel-configmap.yaml b/apps/django/uralkal/zitadel-configmap.yaml new file mode 100644 index 0000000..163506b --- /dev/null +++ b/apps/django/uralkal/zitadel-configmap.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: zitadel-configmap + namespace: django +data: + config.json: | + { + "auth_type": "zitadel", + "zitadel": { + "client_id": "392748423989716183", + "host": "https://login.sarex.local.uralkali.com" + } + } diff --git a/apps/django/vad/backend.yaml b/apps/django/vad/backend.yaml index a42b6bb..2b67a5e 100644 --- a/apps/django/vad/backend.yaml +++ b/apps/django/vad/backend.yaml @@ -126,10 +126,6 @@ spec: - name: ZITADEL_HOST value: _default: https://sarex-login.vadroad.ru - # Включено вместе с message-hub: он консьюмер топика message-hub-stage - # (SETTINGS_TOPICS в apps/message-hub/d8-ugmk-prod/message-hub.yaml), - # а писать в этот топик должен django. Vault-шаблон django-kafka - # и KAFKA_SSL_CAFILE уже есть в base — здесь только флаг. - name: SERVER_KAFKA_ENABLED value: _default: "True" diff --git a/apps/document-link/uralkal/frontend.yaml b/apps/document-link/uralkal/frontend.yaml new file mode 100644 index 0000000..5e4d717 --- /dev/null +++ b/apps/document-link/uralkal/frontend.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: document-link +spec: + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:vad_60487abb diff --git a/apps/document-link/uralkal/kustomization.yaml b/apps/document-link/uralkal/kustomization.yaml new file mode 100644 index 0000000..9f5cbb6 --- /dev/null +++ b/apps/document-link/uralkal/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: frontend.yaml + target: + kind: HelmRelease + name: frontend diff --git a/apps/documentations/uralkal/api.yaml b/apps/documentations/uralkal/api.yaml new file mode 100644 index 0000000..903340d --- /dev/null +++ b/apps/documentations/uralkal/api.yaml @@ -0,0 +1,158 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-api + namespace: documentations +spec: + values: + services: + backend: + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: ZITADEL_ACCOUNT + value: + _default: /vault/secrets/documentations-zitadel-account-json + - name: ZITADEL_DOMAIN + value: + _default: login.sarex.local.uralkali.com + - name: USE_ZITADEL + value: + _default: "1" + - name: FLOWS_URL + value: + _default: http://backend-svc.flows.svc.cluster.local:80 + - name: LAST_MASTER_BIM + value: + _default: "36311" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: USE_LEGACY_BIM_FLOW + value: + _default: "true" + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: WORKSPACE_V2_EXTERNAL_URL + value: + _default: https://sarex.local.uralkali.com/workspaces-v2/ + - name: ENABLE_S3 + value: + _default: "1" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: LAST_SLAVE_1_BIM + value: + _default: "1000000" + - name: HOST + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80 + - name: FILE_STREAM_HOST + value: + _default: sarex.local.uralkali.com + - name: DOCUMENTATION_URL + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80/ + - name: WORKFLOW_URL + value: + _default: http://backend-svc.processing.svc.cluster.local:80/ + - name: WORKSPACE_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + - name: BIM_API_URL + value: + _default: http://backend-svc.bim.svc.cluster.local:80/ + - name: BIM_API_V2_URL + value: + _default: http://backend-svc.bim.svc.cluster.local:80/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: SYSTEM_LOG_URL + value: + _default: http://backend-svc.system-log.svc.cluster.local:80 + - name: DJANGO_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: MARKS_PROCESSING_URL + value: + _default: http://marks-service:8000 + - name: USE_MARKS_RABBITMQ + value: + _default: "true" + - name: MARKS_RABBITMQ_HOST + value: + _default: rabbitmq.rabbitmq.svc.cluster.local + - name: MARKS_RABBITMQ_PORT + value: + _default: "5672" + - name: PUBLIC_LINK_HOST + value: + _default: https://document-link.sarex.local.uralkali.com + - name: NAMESPACE + value: + _default: documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: S3_SERVICE_ACCOUNT + value: + _default: /vault/secrets/documentations-s3-account-json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: ENABLE_SMTP + value: + _default: "True" + - name: ENABLE_MAILGUN + value: + _default: "False" + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET + value: + _default: "mock" + - name: ENABLE_AUTH_JWT_IN_URL + value: + _default: "true" + - name: ENABLE_SIGNATURE_IN_URL + value: + _default: "false" + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "0" + - name: VALKEY_ADDR + value: + _default: redis:6379 + - name: VALKEY_HOST + value: + _default: redis + - name: VALKEY_PORT + value: + _default: "6379" diff --git a/apps/documentations/uralkal/filestream.yaml b/apps/documentations/uralkal/filestream.yaml new file mode 100644 index 0000000..2c294dc --- /dev/null +++ b/apps/documentations/uralkal/filestream.yaml @@ -0,0 +1,146 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-filestream + namespace: documentations +spec: + values: + services: + backend: + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: ZITADEL_ACCOUNT + value: + _default: /vault/secrets/documentations-zitadel-account-json + - name: ZITADEL_DOMAIN + value: + _default: login.sarex.local.uralkali.com + - name: USE_ZITADEL + value: + _default: "1" + - name: FLOWS_URL + value: + _default: http://backend-svc.flows.svc.cluster.local:80 + - name: LAST_MASTER_BIM + value: + _default: "36311" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: WORKSPACE_V2_EXTERNAL_URL + value: + _default: https://sarex.local.uralkali.com/workspaces-v2/ + - name: ENABLE_S3 + value: + _default: "1" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: LAST_SLAVE_1_BIM + value: + _default: "1000000" + - name: HOST + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80 + - name: FILE_STREAM_HOST + value: + _default: sarex.local.uralkali.com + - name: DOCUMENTATION_URL + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80/ + - name: WORKFLOW_URL + value: + _default: http://workflows-api-service.workflow.svc.cluster.local:8000/ + - name: WORKSPACE_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + - name: BIM_API_URL + value: + _default: http://backend-svc.bim.svc.cluster.local:80/ + - name: BIM_API_V2_URL + value: + _default: http://backend-svc.bim.svc.cluster.local:80/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: SYSTEM_LOG_URL + value: + _default: http://api-service.system-log.svc.cluster.local:80 + - name: DJANGO_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: MARKS_PROCESSING_URL + value: + _default: http://marks-service:8000 + - name: PUBLIC_LINK_HOST + value: + _default: https://document-link.sarex.local.uralkali.com + - name: NAMESPACE + value: + _default: documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: S3_SERVICE_ACCOUNT + value: + _default: /vault/secrets/documentations-s3-account-json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: ENABLE_SMTP + value: + _default: "True" + - name: ENABLE_MAILGUN + value: + _default: "False" + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: ENABLE_AUTH_JWT_IN_URL + value: + _default: "false" + - name: ENABLE_SIGNATURE_IN_URL + value: + _default: "true" + - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET + value: + _default: "mock" + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "0" + - name: VALKEY_ADDR + value: + _default: redis:6379 + - name: VALKEY_HOST + value: + _default: redis + - name: VALKEY_PORT + value: + _default: "6379" diff --git a/apps/documentations/uralkal/kustomization.yaml b/apps/documentations/uralkal/kustomization.yaml new file mode 100644 index 0000000..093516b --- /dev/null +++ b/apps/documentations/uralkal/kustomization.yaml @@ -0,0 +1,17 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: api.yaml + target: + kind: HelmRelease + name: documentations-api + - path: filestream.yaml + target: + kind: HelmRelease + name: documentations-filestream + - path: pdf-markings-amqp.yaml + target: + kind: HelmRelease + name: documentations-pdf-markings-amqp diff --git a/apps/documentations/uralkal/pdf-markings-amqp.yaml b/apps/documentations/uralkal/pdf-markings-amqp.yaml new file mode 100644 index 0000000..5a806b5 --- /dev/null +++ b/apps/documentations/uralkal/pdf-markings-amqp.yaml @@ -0,0 +1,58 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-pdf-markings-amqp + namespace: documentations +spec: + values: + services: + backend: + envs: + - name: MARKS_APP__LOG_LEVEL + value: + _default: INFO + + - name: MARKS_CRYPTO__HASHING_ALGO + value: + _default: md_gost12_256 + + - name: MARKS_QR__REDIRECT_URL + value: + _default: "https://sarex-stamp-verification.sarex.local.uralkali.com/" + + - name: MARKS_QR__BASE_DOCUMENT_URL + value: + _default: "https://sarex.local.uralkali.com" + + - name: MARKS_S3__REGION + value: + _default: ru-central1 + + - name: MARKS_S3__USE_SSL + value: + _default: "false" + + - name: MARKS_S3__SSL_VERIFY + value: + _default: "false" + + - name: MARKS_S3__DEFAULT_BUCKET + value: + _default: documentations + + - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE + value: + _default: pdf_markings_input + + - name: MARKS_RABBITMQ__HOST + value: + _default: rabbitmq.rabbitmq.svc.cluster.local + + - name: MARKS_RABBITMQ__PORT + value: + _default: "5672" + + - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS + value: + _default: "60" diff --git a/apps/drawings/uralkal/kustomization.yaml b/apps/drawings/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/drawings/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/eav/uralkal/kustomization.yaml b/apps/eav/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/eav/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/faas/uralkal/kustomization.yaml b/apps/faas/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/faas/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/flows/uralkal/backend.yaml b/apps/flows/uralkal/backend.yaml new file mode 100644 index 0000000..1697f2c --- /dev/null +++ b/apps/flows/uralkal/backend.yaml @@ -0,0 +1,167 @@ +--- +# Патч backend для контура УГМК — подключение к Kafka. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml. +# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: flows +spec: + values: + services: + backend: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql + [ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db + [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq + [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth + [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" + [ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka + set +a + exec /opt/entrypoint.sh + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://sarex.local.uralkali.com" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@sarex.local.uralkali.com" + + - name: GATEWAY_URL + value: + _default: "http://pdm-svc.documentations.svc.cluster.local:80" + + - name: RESOURCE_URL + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: SERVICE_HOST + value: + _default: "https://sarex.local.uralkali.com/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "post.sarex.local.uralkali.com" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "587" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://backend-svc.processing.svc.cluster.local:80/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CERT + value: + _default: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 + MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC + tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN + h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 + k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX + GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc + zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA + A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 + vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS + OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU + fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz + ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i + 0FC16VuidLG0HUCCawFjRiAg9rIA + -----END CERTIFICATE----- + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows + vault.hashicorp.com/agent-inject-template-flows-kafka: |- + {{- with secret "secrets/data/kafka/apps/flows" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/flows/uralkal/celery.yaml b/apps/flows/uralkal/celery.yaml new file mode 100644 index 0000000..af7eb2c --- /dev/null +++ b/apps/flows/uralkal/celery.yaml @@ -0,0 +1,168 @@ +--- +# Патч celery для контура УГМК — подключение к Kafka. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml. +# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: flows +spec: + values: + services: + celery: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql + [ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db + [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq + [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth + [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" + [ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka + set +a + exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://sarex.local.uralkali.com" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:80/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@sarex.local.uralkali.com" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: SERVICE_HOST + value: + _default: "https://sarex.local.uralkali.com/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "post.sarex.local.uralkali.com" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "587" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + # См. подробные комментарии в apps/flows/d8-ugmk-prod/backend.yaml. + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CERT + value: + _default: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 + MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC + tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN + h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 + k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX + GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc + zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA + A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 + vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS + OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU + fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz + ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i + 0FC16VuidLG0HUCCawFjRiAg9rIA + -----END CERTIFICATE----- + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows + vault.hashicorp.com/agent-inject-template-flows-kafka: |- + {{- with secret "secrets/data/kafka/apps/flows" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/flows/uralkal/kustomization.yaml b/apps/flows/uralkal/kustomization.yaml new file mode 100644 index 0000000..db56240 --- /dev/null +++ b/apps/flows/uralkal/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: backend.yaml + target: + kind: HelmRelease + name: backend + - path: celery.yaml + target: + kind: HelmRelease + name: celery diff --git a/apps/iam/uralkal/backend-s3.yaml b/apps/iam/uralkal/backend-s3.yaml new file mode 100644 index 0000000..7e6c02a --- /dev/null +++ b/apps/iam/uralkal/backend-s3.yaml @@ -0,0 +1,78 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: iam-backend + namespace: iam +spec: + values: + services: + backend: + envs: + - name: ENVIRONMENT + value: + _default: "prod" + + - name: LOG_LEVEL + value: + _default: "debug" + + - name: AUTH_ENABLED + value: + _default: "true" + + - name: HTTP_PORT + value: + _default: "8080" + + - name: HTTP_READ_BUFFER_SIZE + value: + _default: "131072" + + - name: DB_MIGRATIONS_PATH + value: + _default: "migrations" + + - name: ZITADEL_ENABLED + value: + _default: "true" + + - name: ZITADEL_HOST + value: + _default: "https://login.sarex.local.uralkali.com" + + - name: ZITADEL_ORG_RULES_FILE + value: + _default: "config/zitadel/org-rules-prod.json" + + - name: S3_ENABLED + value: + _default: "true" + + - name: S3_ENDPOINT_URL + value: + _default: "http://s3-proxy.s3-proxy.svc.cluster.local" + + - name: S3_BUCKET_NAME + value: + _default: "iam" + + - name: S3_REGION + value: + _default: "ru-central1" + + - name: S3_PRESIGN_EXPIRES + value: + _default: "1h" + + - name: KAFKA_ENABLED + value: + _default: "false" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/etc/ca-certificates/Yandex/ca-cert" + + - name: KAFKA_TOPIC_LEGACY_AMS_SYNC + value: + _default: "ams-sync" diff --git a/apps/iam/uralkal/kustomization.yaml b/apps/iam/uralkal/kustomization.yaml new file mode 100644 index 0000000..4fbd9f4 --- /dev/null +++ b/apps/iam/uralkal/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: iam +resources: + - ../base +patches: + - path: backend-s3.yaml + target: + kind: HelmRelease + name: iam-backend + - path: zitadel-org-rules-configmap.yaml + target: + kind: ConfigMap + name: iam-zitadel-org-rules diff --git a/apps/iam/uralkal/zitadel-org-rules-configmap.yaml b/apps/iam/uralkal/zitadel-org-rules-configmap.yaml new file mode 100644 index 0000000..7ea19ad --- /dev/null +++ b/apps/iam/uralkal/zitadel-org-rules-configmap.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: iam-zitadel-org-rules + namespace: iam +data: + org-rules-prod.json: | + { + "default_org_id": "392748423989716183", + "rules": [] + } diff --git a/apps/inspections/uralkal/kustomization.yaml b/apps/inspections/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/inspections/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/issues/uralkal/backend-s3.yaml b/apps/issues/uralkal/backend-s3.yaml new file mode 100644 index 0000000..a84b217 --- /dev/null +++ b/apps/issues/uralkal/backend-s3.yaml @@ -0,0 +1,149 @@ +--- +# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml. +# podAnnotations — map, мержится по ключам. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: issues +spec: + values: + services: + backend: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka + set +a + exec /src/entrypoint.sh + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: AERO_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AERO_URL + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: WORKFLOWS_URL + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + # Kafka — код (kafka_app/app.py) ждёт KAFKA_HOST единой строкой "host:port", + # KAFKA_SSL_CAFILE — путь к файлу (не PEM-текст, в отличие от flows-backend). + # Хост/порт/CA — те же проверенные значения, что у message-hub/pm/flows. + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + # Топики совпадают с тем, что уже провижено на брокере (см. topics + # в секрете kafka/apps/pm) и с SETTINGS_TOPICS у message-hub. + - name: KAFKA_ISSUES_TOPIC + value: + _default: "issues_broadcast_prod" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=issues + YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-kafka: |- + {{- with secret "secrets/data/kafka/apps/issues" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/issues/uralkal/celery-s3.yaml b/apps/issues/uralkal/celery-s3.yaml new file mode 100644 index 0000000..57dd8c2 --- /dev/null +++ b/apps/issues/uralkal/celery-s3.yaml @@ -0,0 +1,145 @@ +--- +# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/issues/base/celery.yaml. +# podAnnotations — map, мержится по ключам. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: issues +spec: + values: + services: + celery: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka + set +a + exec celery -A config worker -l info -E + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://srx.wb.ru" + + - name: AERO_HOST + value: + _default: "https://srx.wb.ru" + + - name: BASE_AERO_URL + value: + _default: "https://srx.wb.ru" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://srx.wb.ru" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + # См. подробные комментарии в apps/issues/d8-ugmk-prod/backend-s3.yaml. + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_ISSUES_TOPIC + value: + _default: "issues_broadcast_prod" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=issues + YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-kafka: |- + {{- with secret "secrets/data/kafka/apps/issues" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/issues/uralkal/kafka-ca-configmap.yaml b/apps/issues/uralkal/kafka-ca-configmap.yaml new file mode 100644 index 0000000..dc16987 --- /dev/null +++ b/apps/issues/uralkal/kafka-ca-configmap.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-ca-cert + namespace: issues +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 + MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC + tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN + h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 + k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX + GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc + zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA + A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 + vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS + OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU + fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz + ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i + 0FC16VuidLG0HUCCawFjRiAg9rIA + -----END CERTIFICATE----- diff --git a/apps/issues/uralkal/kustomization.yaml b/apps/issues/uralkal/kustomization.yaml new file mode 100644 index 0000000..efeb88f --- /dev/null +++ b/apps/issues/uralkal/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base + - kafka-ca-configmap.yaml +patches: + - path: backend-s3.yaml + target: + kind: HelmRelease + name: backend + - path: celery-s3.yaml + target: + kind: HelmRelease + name: celery diff --git a/apps/mapper/uralkal/kustomization.yaml b/apps/mapper/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/mapper/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/measurements/uralkal/kustomization.yaml b/apps/measurements/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/measurements/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/message-hub/uralkal/kafka-ca-configmap.yaml b/apps/message-hub/uralkal/kafka-ca-configmap.yaml new file mode 100644 index 0000000..9d0f768 --- /dev/null +++ b/apps/message-hub/uralkal/kafka-ca-configmap.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-ca-cert + namespace: message-hub +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 + MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC + tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN + h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 + k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX + GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc + zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA + A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 + vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS + OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU + fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz + ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i + 0FC16VuidLG0HUCCawFjRiAg9rIA + -----END CERTIFICATE----- diff --git a/apps/message-hub/uralkal/kustomization.yaml b/apps/message-hub/uralkal/kustomization.yaml new file mode 100644 index 0000000..9bbf73e --- /dev/null +++ b/apps/message-hub/uralkal/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base + - kafka-ca-configmap.yaml +patches: + - path: message-hub.yaml + target: + kind: HelmRelease + name: message-hub diff --git a/apps/message-hub/uralkal/message-hub.yaml b/apps/message-hub/uralkal/message-hub.yaml new file mode 100644 index 0000000..cf48432 --- /dev/null +++ b/apps/message-hub/uralkal/message-hub.yaml @@ -0,0 +1,105 @@ +--- +# Патч message-hub для vad. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/message-hub/base/message-hub.yaml. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# agent-inject-template-message-hub-kafka; остальные берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: message-hub + namespace: message-hub +spec: + values: + services: + backend: + envs: + - name: WORKER_TIMEOUT + value: + _default: "60" + + - name: PYTHONPATH + value: + _default: "src" + + - name: SETTINGS_MAX_RETRIES + value: + _default: "1" + + - name: SETTINGS_TOPICS + value: + _default: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod", "resources_updated": "iam.resource.updated.v2", "resources_deleted": "iam.resource.deleted.v2"}' + - name: SETTINGS_VERIFY_SSL + value: + _default: "0" + + - name: SAREX_BASE_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:8000" + + - name: PM_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: ISSUES_HOST + value: + _default: "http://backend-svc.issues.svc.cluster.local:80" + + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + - name: CACHE_SSL + value: + _default: "0" + + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local" + + - name: KAFKA_PORT + value: + _default: "9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SASL_SSL" + + volumes: + _default: + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/pm + vault.hashicorp.com/agent-inject-template-message-hub-kafka: |- + {{- with secret "secrets/data/kafka/apps/pm" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + {{- end -}} diff --git a/apps/notes/uralkal/kustomization.yaml b/apps/notes/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/notes/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/pm/uralkal/backend.yaml b/apps/pm/uralkal/backend.yaml new file mode 100644 index 0000000..9b02faa --- /dev/null +++ b/apps/pm/uralkal/backend.yaml @@ -0,0 +1,205 @@ +--- +# Патч backend для vad. +# +# ВНИМАНИЕ: args — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь скрипт из apps/pm/base/backend.yaml. +# При правке args в base их нужно продублировать и сюда. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-pm-s3; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: pm +spec: + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551 + + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db + [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq + [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 + [ -f /vault/secrets/pm-kafka ] && . /vault/secrets/pm-kafka + set +a + python manage.py makemigrations pm --noinput + python manage.py migrate + exec /opt/sarex/entrypoint.sh + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + # base: "False". При False CACHE_CLIENT = None (config/settings/base.py:190), + # и GET /api/pm/msp/external-task-info/ падает с + # AttributeError: 'NoneType' object has no attribute 'get' — + # sarex/pm/utils/broker_producer.py:38 дёргает .get() без проверки на None. + - name: CACHE_ENABLE + value: + _default: "True" + + # Новые: в base их нет. Дефолт CacheSettings.host — localhost, + # т.е. без них включённый кэш стучится в собственный под. + # Redis разворачивается тут же — apps/pm/vad/redis.yaml. + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "True" + + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]' + + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SASL_SSL" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-prod"}' + + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://sarex.local.uralkali.com/api/token/public/" + + - name: SERVER_HOST + value: + _default: "https://sarex.local.uralkali.com" + + - name: SERVER_API_HOST + value: + _default: "https://sarex.local.uralkali.com" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" + + volumes: + _default: + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-template-pm-s3: |- + {{- with secret "secrets/data/minio/apps/pm" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + S3_VERIFY=False + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}sarex-media-storage{{ end }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm + vault.hashicorp.com/agent-inject-template-pm-kafka: |- + {{- with secret "secrets/data/kafka/apps/pm" -}} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} + KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/pm/uralkal/celery.yaml b/apps/pm/uralkal/celery.yaml new file mode 100644 index 0000000..c44e069 --- /dev/null +++ b/apps/pm/uralkal/celery.yaml @@ -0,0 +1,216 @@ +--- +# Патч celery для vad. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/pm/base/celery.yaml. +# При добавлении переменной в base её нужно продублировать и сюда. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-pm-s3; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: pm +spec: + values: + services: + celery: + # Образ общий с backend — держать в одной версии обязательно, + # иначе воркер разъедется с API по схеме задач и моделям. + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551 + + # base не переопределяет args, а нам нужно добавить sourcing pm-kafka — + # дублируем скрипт целиком (то же самое, что и в backend.yaml). + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db + [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq + [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 + [ -f /vault/secrets/pm-kafka ] && . /vault/secrets/pm-kafka + set +a + exec celery -A config worker -B -l info -E -Q pm -n default_worker.%h --concurrency=2 + + envs: + # base: http://backend-service.sarex.svc.cluster.local:8000 — ns sarex не существует + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + # base: http://sarex-resources-service.resources — ns resources не развёрнут в контуре + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + # base: http://eav-service.eav — сервис называется backend-svc и слушает 80 + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + # base: "False". Держим в одном значении с backend: при enable + # config/celery.py включает периодическую синхронизацию ресурсов, + # которая пишет ключи service_accounts / resources:* — их читает + # backend в sarex/pm/utils/resources.py. + - name: CACHE_ENABLE + value: + _default: "True" + + # Новые: в base их нет, дефолт CacheSettings.host — localhost. + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "True" + + # См. подробные комментарии в apps/pm/vad/backend.yaml — + # то же самое, воркер должен уметь публиковать в Kafka так же, как API. + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]' + + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SASL_SSL" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-prod"}' + + # base: https://lk.sarex.io/api/token/public/ + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://sarex.local.uralkali.com/api/token/public/" + + # base: https://lk.sarex.io + - name: SERVER_HOST + value: + _default: "https://sarex.local.uralkali.com" + + # base: https://api.sarex.io + - name: SERVER_API_HOST + value: + _default: "https://sarex.local.uralkali.com" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" + + volumes: + _default: + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + podAnnotations: + _default: + # base склеивал S3_BUCKET с S3_VERIFY: {{- end -}} съедал перевод строки. + # S3_VERIFY поднят выше блока if, у {{ end }} убран хвостовой дефис. + vault.hashicorp.com/agent-inject-template-pm-s3: |- + {{- with secret "secrets/data/minio/apps/pm" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + S3_VERIFY=False + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}sarex-media-storage{{ end }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm + vault.hashicorp.com/agent-inject-template-pm-kafka: |- + {{- with secret "secrets/data/kafka/apps/pm" -}} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} + KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/pm/uralkal/kafka-ca-configmap.yaml b/apps/pm/uralkal/kafka-ca-configmap.yaml new file mode 100644 index 0000000..8b919b1 --- /dev/null +++ b/apps/pm/uralkal/kafka-ca-configmap.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-ca-cert + namespace: pm +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4 + MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC + tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN + h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9 + k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX + GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc + zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA + A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2 + vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS + OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU + fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz + ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i + 0FC16VuidLG0HUCCawFjRiAg9rIA + -----END CERTIFICATE----- diff --git a/apps/pm/uralkal/kustomization.yaml b/apps/pm/uralkal/kustomization.yaml new file mode 100644 index 0000000..503cfe2 --- /dev/null +++ b/apps/pm/uralkal/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base + - redis.yaml + - kafka-ca-configmap.yaml +patches: + - path: backend.yaml + target: + kind: HelmRelease + name: backend + - path: celery.yaml + target: + kind: HelmRelease + name: celery diff --git a/apps/pm/uralkal/redis.yaml b/apps/pm/uralkal/redis.yaml new file mode 100644 index 0000000..46a4787 --- /dev/null +++ b/apps/pm/uralkal/redis.yaml @@ -0,0 +1,98 @@ +--- +# Redis для celery в ns pm. В base его нет — там CELERY_REDIS_HOST указывает +# на redis.pm.svc.cluster.local, но сам сервис не разворачивается. +# +# Имя Service обязано быть ровно "redis" (не redis-svc, как принято в остальных +# релизах), иначе не сойдётся с CELERY_REDIS_HOST в backend.yaml и celery.yaml. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: redis + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + redis: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest + pullPolicy: + _default: Always + + deployment: + enabled: true + + name: + _default: redis + + replicaCount: + _default: 1 + + port: + _default: 6379 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 64Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: redis + + type: + _default: ClusterIP + + port: + _default: 6379 + + targetPort: + _default: 6379 + + # НЕ http: чарт по умолчанию подставляет "http", и тогда Istio навесит + # на 6379 HTTP-фильтры и сломает RESP. Префикс tcp- переводит порт + # в режим обычного TCP-проксирования. + portName: + _default: tcp-redis + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/prescriptions/uralkal/kustomization.yaml b/apps/prescriptions/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/prescriptions/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/processing/uralkal/kustomization.yaml b/apps/processing/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/processing/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/projects/uralkal/kustomization.yaml b/apps/projects/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/projects/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/remarks/uralkal/kustomization.yaml b/apps/remarks/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/remarks/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/reviews/uralkal/kustomization.yaml b/apps/reviews/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/reviews/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/rfi/uralkal/kustomization.yaml b/apps/rfi/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/rfi/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/stamp-verification/uralkal/frontend.yaml b/apps/stamp-verification/uralkal/frontend.yaml new file mode 100644 index 0000000..e4cae58 --- /dev/null +++ b/apps/stamp-verification/uralkal/frontend.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: stamp-verification +spec: + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/stamp-verification-frontend:vad-prod_801af373 diff --git a/apps/stamp-verification/uralkal/kustomization.yaml b/apps/stamp-verification/uralkal/kustomization.yaml new file mode 100644 index 0000000..9f5cbb6 --- /dev/null +++ b/apps/stamp-verification/uralkal/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: frontend.yaml + target: + kind: HelmRelease + name: frontend diff --git a/apps/subscriptions/uralkal/kustomization.yaml b/apps/subscriptions/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/subscriptions/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/system-log/uralkal/kustomization.yaml b/apps/system-log/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/system-log/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/transmittal/uralkal/backend.yaml b/apps/transmittal/uralkal/backend.yaml new file mode 100644 index 0000000..1ce3dcd --- /dev/null +++ b/apps/transmittal/uralkal/backend.yaml @@ -0,0 +1,247 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: transmittal +spec: + values: + services: + backend: + envs: + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://sarex.contour.infra.sarex.tech/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "s3-proxy.s3-proxy.svc.cluster.local" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.documentations.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + diff --git a/apps/transmittal/uralkal/kustomization.yaml b/apps/transmittal/uralkal/kustomization.yaml new file mode 100644 index 0000000..db8bbe1 --- /dev/null +++ b/apps/transmittal/uralkal/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: backend.yaml + target: + kind: HelmRelease + name: backend + - path: worker.yaml + target: + kind: HelmRelease + name: worker diff --git a/apps/transmittal/uralkal/worker.yaml b/apps/transmittal/uralkal/worker.yaml new file mode 100644 index 0000000..c09e03b --- /dev/null +++ b/apps/transmittal/uralkal/worker.yaml @@ -0,0 +1,247 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: worker + namespace: transmittal +spec: + values: + services: + worker: + envs: + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://lk.srx.wb.ru:30443/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "s3-proxy.s3-proxy.svc.cluster.local" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.documentations.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + diff --git a/apps/workspaces/uralkal/kustomization.yaml b/apps/workspaces/uralkal/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/workspaces/uralkal/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/clusters/uralkal/kustomization.yaml b/clusters/uralkal/kustomization.yaml index 24bab3e..9c546ce 100644 --- a/clusters/uralkal/kustomization.yaml +++ b/clusters/uralkal/kustomization.yaml @@ -16,3 +16,41 @@ resources: - ../../infrastructure/superset/uralkal - ../../infrastructure/trino/uralkal - ../../infrastructure/istio-config/uralkal + - ../../infrastructure/s3-proxy/uralkal + + - ../../apps/reviews/uralkal + - ../../apps/remarks/uralkal + - ../../apps/auth-flow/uralkal + - ../../apps/control-interface/uralkal + - ../../apps/workspaces/uralkal + - ../../apps/eav/uralkal + - ../../apps/notes/uralkal + - ../../apps/rfi/uralkal + - ../../apps/checklists/uralkal + - ../../apps/contracts/uralkal + - ../../apps/django/uralkal + - ../../apps/documentations/uralkal + - ../../apps/processing/uralkal + - ../../apps/flows/uralkal + - ../../apps/issues/uralkal + - ../../apps/bim/uralkal + - ../../apps/attachments/uralkal + - ../../apps/bi/uralkal + - ../../apps/comparisons/uralkal + - ../../apps/drawings/uralkal + - ../../apps/inspections/uralkal + - ../../apps/mapper/uralkal + - ../../apps/measurements/uralkal + - ../../apps/subscriptions/uralkal + - ../../apps/system-log/uralkal + - ../../apps/transmittal/uralkal + - ../../apps/cross-section/uralkal + - ../../apps/document-link/uralkal + - ../../apps/prescriptions/uralkal + - ../../apps/projects/uralkal + - ../../apps/stamp-verification/uralkal + - ../../apps/faas/uralkal + - ../../apps/iam/uralkal + - ../../apps/pm/uralkal + - ../../apps/message-hub/uralkal + - ../../apps/cde/uralkal diff --git a/infrastructure/istio-config/uralkal/istio-config.yaml b/infrastructure/istio-config/uralkal/istio-config.yaml index baf1009..dfc44f3 100644 --- a/infrastructure/istio-config/uralkal/istio-config.yaml +++ b/infrastructure/istio-config/uralkal/istio-config.yaml @@ -34,6 +34,413 @@ spec: tls: credentialName: uralkal-camunda-operate-tls virtualServices: + platform: + name: sarex-frontend-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: / + service: frontend-svc.django.svc.cluster.local + port: 80 + filestream-api: + name: documentations-filestream-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /files/api/ + rewrite: /api/ + service: backend-filestream-svc.documentations.svc.cluster.local + port: 80 + iam-api: + name: iam-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /iam/api/ + rewrite: /external/api/ + service: iam-backend.iam.svc.cluster.local + port: 8000 + documentations-frontend: + name: documentations-frontend-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /documentations/static/ + rewrite: / + service: frontend-svc.documentations.svc.cluster.local + port: 80 + rfi-frontend: + name: rfi-frontend-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /rfi/static/ + rewrite: / + service: frontend-svc.rfi.svc.cluster.local + port: 80 + rfi-api: + name: rfi-api-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /rfi/api/ + rewrite: /api/ + service: backend-svc.rfi.svc.cluster.local + port: 80 + pm: + name: pm-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /pm/api/ + rewrite: /api/ + service: backend-svc.pm.svc.cluster.local + port: 8000 + - path: + prefix: /pm/ + rewrite: / + service: frontend-svc.pm.svc.cluster.local + port: 80 + documentations-api: + name: documentations-api-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + cors: + allowOrigins: + - exact: "*" + extraAllowMethods: + - HEAD + extraAllowHeaders: + - Range + - Cache-control + allowCredentials: true + routes: + - path: + prefix: /documentations/api/ + rewrite: /api/ + service: backend-api-svc.documentations.svc.cluster.local + port: 80 + workspaces-api: + name: workspaces-api-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /workspaces/api/ + rewrite: /api/ + service: backend-svc.workspaces.svc.cluster.local + port: 80 + gateway-platform: + name: pdm-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /gateway/ + rewrite: / + service: pdm-svc.documentations.svc.cluster.local + port: 80 + issues-api: + name: issues-api-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /issues/api/ + rewrite: /api/ + service: backend-svc.issues.svc.cluster.local + port: 80 + checklists-api: + name: checklists-api-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /checklists/api/ + rewrite: /api/ + service: backend-svc.checklists.svc.cluster.local + port: 80 + bim-api: + name: bim-api-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /bimv2/api/ + rewrite: /api/ + service: backend-svc.bim.svc.cluster.local + port: 80 + flows-api: + name: flows-api-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /flows/api/ + rewrite: /api/ + service: backend-svc.flows.svc.cluster.local + port: 80 + issues-frontend: + name: issues-frontend-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /issues/static/ + rewrite: / + service: frontend-svc.issues.svc.cluster.local + port: 80 + remarks-frontend: + name: remarks-frontend-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /remarks/static/ + rewrite: / + service: frontend-service.remarks.svc.cluster.local + port: 80 + auth-frontend: + name: auth-frontend-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /auth/callback + rewrite: / + service: frontend-svc.auth-flow.svc.cluster.local + port: 80 + flows-frontend: + name: flows-frontend-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /flows/static/ + rewrite: / + service: frontend-svc.flows.svc.cluster.local + port: 80 + transmittal-frontend: + name: transmittal-frontend-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /transmittal/static/ + rewrite: / + service: frontend-svc.transmittal.svc.cluster.local + port: 80 + workflows-api: + name: workflows-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /workflows/api/ + rewrite: /api/ + service: backend-svc.processing.svc.cluster.local + port: 80 + transmittals-api: + name: transmittals-api-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /transmittals/api/ + rewrite: /api/ + service: backend-svc.transmittal.svc.cluster.local + port: 80 + inspections-api: + name: flows-api-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /inspections/api/ + rewrite: /api/ + service: backend-svc.inspections.svc.cluster.local + port: 80 + reviews-frontend: + name: reviews-frontend-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /reviews/static/ + rewrite: / + service: frontend-svc.reviews.svc.cluster.local + port: 80 + eav-api: + name: eav-api-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /eav/api/v0 + rewrite: /api/v4 + service: backend-svc.eav.svc.cluster.local + port: 80 + - path: + prefix: /eav/api/v2 + rewrite: /api/v5 + service: backend-svc.eav.svc.cluster.local + port: 80 + - path: + prefix: /eav/api/v3 + rewrite: /api/v3 + service: backend-svc.eav.svc.cluster.local + port: 80 + - path: + prefix: /eav/api/v4 + rewrite: /api/v4 + service: backend-svc.eav.svc.cluster.local + port: 80 + - path: + prefix: /eav/api/v1 + rewrite: /api/v6 + service: backend-svc.eav.svc.cluster.local + port: 80 + - path: + prefix: /eav/admin/ + rewrite: /eav/admin/ + service: backend-svc.eav.svc.cluster.local + port: 80 + srx-admin-frontend: + name: srx-admin-frontend-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /control-interface/ + rewrite: / + service: frontend-svc.control-interface.svc.cluster.local + port: 8080 + s3-proxy-media: + name: s3-proxy-media-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /media/ + rewrite: / + service: s3-proxy-svc.django.svc.cluster.local + port: 80 + bi-api: + name: bi-api-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /analytics-v2/api/ + rewrite: /api/ + service: bi-backend-service.bi.svc.cluster.local + port: 80 + bi-frontend: + name: bi-frontend-virt-service + namespace: default + hosts: + - sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /analytics-v2/static/ + rewrite: / + service: bi-frontend-frontend-svc.bi.svc.cluster.local + port: 80 + - path: + prefix: /analytics-v2/ + rewrite: / + service: bi-frontend-frontend-svc.bi.svc.cluster.local + port: 80 zitadel: namespace: default hosts: @@ -67,3 +474,36 @@ spec: prefix: / service: camunda-operate.camunda.svc.cluster.local port: 80 + stamp-verification: + namespace: default + hosts: + - sarex-stamp-verification.sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: / + service: frontend-service.stamp-verification.svc.cluster.local + port: 80 + document-link: + namespace: default + hosts: + - document-link.sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: / + service: frontend-service.document-link.svc.cluster.local + port: 80 + s3: + namespace: default + hosts: + - s3.sarex.local.uralkali.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: / + service: s3-proxy.s3-proxy.svc.cluster.local + port: 80 diff --git a/infrastructure/s3-proxy/uralkal/configmap.yaml b/infrastructure/s3-proxy/uralkal/configmap.yaml new file mode 100644 index 0000000..b493aaa --- /dev/null +++ b/infrastructure/s3-proxy/uralkal/configmap.yaml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: s3-proxy-nginx-conf + namespace: s3-proxy +data: + nginx.conf: | + worker_processes auto; + error_log /dev/stderr info; + + events { + worker_connections 1024; + } + + http { + access_log off; + + upstream minio_backend { + least_conn; + server 10.133.0.245:9000 max_fails=3 fail_timeout=10s; + } + + server { + listen 8080; + server_name _; + + ignore_invalid_headers off; + client_max_body_size 0; + proxy_buffering off; + proxy_request_buffering off; + + location /healthz { + return 200 "ok\n"; + } + + location / { + proxy_http_version 1.1; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_connect_timeout 5s; + proxy_read_timeout 300s; + proxy_send_timeout 300s; + chunked_transfer_encoding off; + proxy_pass http://minio_backend; + } + } + } diff --git a/infrastructure/s3-proxy/uralkal/deployment.yaml b/infrastructure/s3-proxy/uralkal/deployment.yaml new file mode 100644 index 0000000..e0ffb4f --- /dev/null +++ b/infrastructure/s3-proxy/uralkal/deployment.yaml @@ -0,0 +1,51 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: s3-proxy + namespace: s3-proxy +spec: + replicas: 2 + selector: + matchLabels: + app: s3-proxy + template: + metadata: + labels: + app: s3-proxy + spec: + nodeSelector: + dedicated: generic + tolerations: [] + containers: + - name: nginx + image: nginx:1.25-alpine + volumeMounts: + - name: nginx-conf + mountPath: /etc/nginx/nginx.conf + subPath: nginx.conf + ports: + - name: http + containerPort: 8080 + readinessProbe: + httpGet: + path: /healthz + port: http + initialDelaySeconds: 5 + periodSeconds: 10 + livenessProbe: + httpGet: + path: /healthz + port: http + initialDelaySeconds: 15 + periodSeconds: 20 + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 500m + memory: 256Mi + volumes: + - name: nginx-conf + configMap: + name: s3-proxy-nginx-conf diff --git a/infrastructure/s3-proxy/uralkal/kustomization.yaml b/infrastructure/s3-proxy/uralkal/kustomization.yaml new file mode 100644 index 0000000..9c2da25 --- /dev/null +++ b/infrastructure/s3-proxy/uralkal/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - configmap.yaml + - deployment.yaml + - service.yaml diff --git a/infrastructure/s3-proxy/uralkal/namespace.yaml b/infrastructure/s3-proxy/uralkal/namespace.yaml new file mode 100644 index 0000000..ffcb6a1 --- /dev/null +++ b/infrastructure/s3-proxy/uralkal/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: s3-proxy + labels: + istio-injection: disabled diff --git a/infrastructure/s3-proxy/uralkal/service.yaml b/infrastructure/s3-proxy/uralkal/service.yaml new file mode 100644 index 0000000..05b2e2e --- /dev/null +++ b/infrastructure/s3-proxy/uralkal/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: s3-proxy + namespace: s3-proxy +spec: + type: ClusterIP + selector: + app: s3-proxy + ports: + - name: http + port: 80 + targetPort: http + protocol: TCP