From 9f7fa82e0d4ccc737e700a0d8935bf0473a74d6f Mon Sep 17 00:00:00 2001 From: emelinda Date: Tue, 21 Jul 2026 18:48:36 +0300 Subject: [PATCH] Migrate `notes` app to HelmRelease. Add `backend` and `frontend` configurations and update related resources. --- apps/notes/base/backend.yaml | 177 ++++++++++++++++++++++++++++++++++ apps/notes/base/frontend.yaml | 86 +++++++++++++++++ 2 files changed, 263 insertions(+) create mode 100644 apps/notes/base/backend.yaml create mode 100644 apps/notes/base/frontend.yaml diff --git a/apps/notes/base/backend.yaml b/apps/notes/base/backend.yaml new file mode 100644 index 0000000..9f5ee03 --- /dev/null +++ b/apps/notes/base/backend.yaml @@ -0,0 +1,177 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: notes +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: notes-vault + deployment: + enabled: true + name: + _default: backend + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/notes-db ] && . /vault/secrets/notes-db + [ -f /vault/secrets/notes-django-auth ] && . /vault/secrets/notes-django-auth + [ -f /vault/secrets/notes-rabbitmq ] && . /vault/secrets/notes-rabbitmq + [ -f /vault/secrets/notes-s3 ] && . /vault/secrets/notes-s3 + [ -f /vault/secrets/notes-kafka ] && . /vault/secrets/notes-kafka + set +a + exec /bin/bash /opt/entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-service + type: + _default: ClusterIP + port: + _default: 8000 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: PG_SSL_MODE + value: + _default: verify-full + - name: DJANGO_HOST + value: + _default: https://lk.sarex.io + - name: BASE_HOST + value: + _default: https://api.sarex.io/notes + - name: TIMEOUT + value: + _default: "120" + - name: FAAS_SERVICE + value: + _default: https://api.sarex.io/lambdas + - name: WORKSPACE_URL + value: + _default: https://api.sarex.io/workspaces/api/v1 + - name: WORKFLOW_HOST + value: + _default: https://api.sarex.io/workflows/api/v1 + - name: WORKFLOW_TAG + value: + _default: stable + - name: RESOURCE_URL + value: + _default: https://api.sarex.io/resources/api/v1 + - name: SYNC_RESOURCE_ID + value: + _default: "0" + - name: ENABLE_ND + value: + _default: "0" + - name: ATTACHMENT_HOST + value: + _default: http://attachments-service.attachments.svc.cluster.local:80/api/v1 + - name: PG_PORT + value: + _default: "5432" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: notes + vault.hashicorp.com/agent-inject-secret-notes-db: secrets/data/postgresql/apps/notes + vault.hashicorp.com/agent-inject-template-notes-db: |- + {{- with secret "secrets/data/postgresql/apps/notes" -}} + PG_HOST=10.222.255.162 + PG_PORT=5432 + PG_DB=notes_db + PG_LOGIN={{ index .Data.data "username" }} + PG_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-notes-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-notes-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-notes-rabbitmq: secrets/data/rabbitmq/apps/notes + vault.hashicorp.com/agent-inject-template-notes-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/notes" -}} + NOTES_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + NOTES_RABBITMQ_USERNAME={{ index .Data.data "username" }} + NOTES_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + NOTES_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + NOTES_RABBITMQ_PORT=5672 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-notes-s3: secrets/data/minio/apps/notes + vault.hashicorp.com/agent-inject-template-notes-s3: |- + {{- with secret "secrets/data/minio/apps/notes" -}} + NOTES_S3_ENDPOINT={{ index .Data.data.client "endpoint" }} + NOTES_S3_REGION={{ index .Data.data.client "region" }} + NOTES_S3_BUCKET=notes + NOTES_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + NOTES_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-notes-kafka: secrets/data/kafka/apps/notes + vault.hashicorp.com/agent-inject-template-notes-kafka: |- + {{- with secret "secrets/data/kafka/apps/notes" -}} + NOTES_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }} + NOTES_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + NOTES_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + NOTES_KAFKA_USERNAME={{ index .Data.data "username" }} + NOTES_KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/notes/base/frontend.yaml b/apps/notes/base/frontend.yaml new file mode 100644 index 0000000..67ea103 --- /dev/null +++ b/apps/notes/base/frontend.yaml @@ -0,0 +1,86 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: notes +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + frontend: + enabled: true + deployment: + enabled: true + name: + _default: frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: frontend-service + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: + _default: + - name: nginx-configmap + mountPath: + _default: /etc/nginx/nginx.conf + subPath: + _default: nginx.conf + readOnly: + _default: true + configMap: + name: + _default: nginx-configmap + items: + - key: nginx.conf + path: nginx.conf + defaultMode: 420