diff --git a/apps/auth-flow/d8-ugmk-prod/namespace.yaml b/apps/auth-flow/d8-ugmk-prod/namespace.yaml index fc05086..7c70f41 100644 --- a/apps/auth-flow/d8-ugmk-prod/namespace.yaml +++ b/apps/auth-flow/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: auth-flow labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/bim/base/backend-deployment.yaml b/apps/bim/base/backend-deployment.yaml deleted file mode 100644 index 9457626..0000000 --- a/apps/bim/base/backend-deployment.yaml +++ /dev/null @@ -1,108 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: bim - labels: - app: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: bim - vault.hashicorp.com/agent-inject-secret-bim-postgresql: secrets/data/postgresql/apps/bim - vault.hashicorp.com/agent-inject-template-bim-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/bim" -}} - POSTGRES_ADDRESS=postgresql.bim.svc.cluster.local - POSTGRES_ADDRESS_2=postgresql.bim.svc.cluster.local - POSTGRES_ADDRESS_3=postgresql.bim.svc.cluster.local - POSTGRES_ADDRESS_4=postgresql.bim.svc.cluster.local - POSTGRES_PORT=5432 - POSTGRES_PORT_2=5432 - POSTGRES_PORT_3=5432 - POSTGRES_PORT_4=5432 - POSTGRES_DB=bim_db - POSTGRES_DB_2=bim_db - POSTGRES_DB_3=bim_db - POSTGRES_DB_4=bim_db - POSTGRES_USER={{ index .Data.data "username" }} - POSTGRES_USER_2={{ index .Data.data "username" }} - POSTGRES_USER_3={{ index .Data.data "username" }} - POSTGRES_USER_4={{ index .Data.data "username" }} - POSTGRES_PASSWORD={{ index .Data.data "password" }} - POSTGRES_PASSWORD_2={{ index .Data.data "password" }} - POSTGRES_PASSWORD_3={{ index .Data.data "password" }} - POSTGRES_PASSWORD_4={{ index .Data.data "password" }} - {{- end -}} - spec: - serviceAccountName: bim-vault - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/bim-api:contour_3d704fef - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/bim-postgresql ] && . /vault/secrets/bim-postgresql - set +a - exec ./httpserver - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: LAST_MASTER_BIM - value: "100000" - - name: LAST_MASTER_BIM_V3 - value: "100000" - - name: DB_CERT_PATH_4 - value: /root/yandex_pg.pem - - name: DB_CERT_PATH_3 - value: /root/yandex_pg.pem - - name: DB_CERT_PATH_2 - value: /root/yandex_pg.pem - - name: LAST_SLAVE_1_BIM - value: "1000000" - - name: POSTGRES_POOL_SIZE - value: "30" - - name: API_ADDRESS - value: 0.0.0.0:8000 - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: ENABLE_SQL_QUERY - value: "0" - - name: ENABLE_SSL - value: "0" - resources: - requests: - cpu: 25m - memory: 100Mi - livenessProbe: - httpGet: - path: /ping - port: 8000 - initialDelaySeconds: 10 - periodSeconds: 60 - failureThreshold: 10 - readinessProbe: - httpGet: - path: /ping - port: 8000 - initialDelaySeconds: 5 - periodSeconds: 5 - failureThreshold: 20 - imagePullSecrets: - - name: regcred diff --git a/apps/bim/base/backend-service.yaml b/apps/bim/base/backend-service.yaml deleted file mode 100644 index 0f62368..0000000 --- a/apps/bim/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: bim -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/bim/base/backend.yaml b/apps/bim/base/backend.yaml new file mode 100644 index 0000000..b424252 --- /dev/null +++ b/apps/bim/base/backend.yaml @@ -0,0 +1,217 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: bim + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: bim-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/bim-api:contour_3d704fef + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/bim-postgresql ] && . /vault/secrets/bim-postgresql + set +a + exec ./httpserver + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 60 + failureThreshold: + _default: 10 + readiness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 5 + periodSeconds: + _default: 5 + failureThreshold: + _default: 20 + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: LAST_MASTER_BIM + value: + _default: "100000" + + - name: LAST_MASTER_BIM_V3 + value: + _default: "100000" + + - name: DB_CERT_PATH_4 + value: + _default: "/root/yandex_pg.pem" + + - name: DB_CERT_PATH_3 + value: + _default: "/root/yandex_pg.pem" + + - name: DB_CERT_PATH_2 + value: + _default: "/root/yandex_pg.pem" + + - name: LAST_SLAVE_1_BIM + value: + _default: "1000000" + + - name: POSTGRES_POOL_SIZE + value: + _default: "30" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8000" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: ENABLE_SQL_QUERY + value: + _default: "0" + + - name: ENABLE_SSL + value: + _default: "0" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: bim + vault.hashicorp.com/agent-inject-secret-bim-postgresql: secrets/data/postgresql/apps/bim + vault.hashicorp.com/agent-inject-template-bim-postgresql: |- + {{- with secret "secrets/data/postgresql/apps/bim" -}} + POSTGRES_ADDRESS=postgresql.bim.svc.cluster.local + POSTGRES_ADDRESS_2=postgresql.bim.svc.cluster.local + POSTGRES_ADDRESS_3=postgresql.bim.svc.cluster.local + POSTGRES_ADDRESS_4=postgresql.bim.svc.cluster.local + POSTGRES_PORT=5432 + POSTGRES_PORT_2=5432 + POSTGRES_PORT_3=5432 + POSTGRES_PORT_4=5432 + POSTGRES_DB=bim_db + POSTGRES_DB_2=bim_db + POSTGRES_DB_3=bim_db + POSTGRES_DB_4=bim_db + POSTGRES_USER={{ index .Data.data "username" }} + POSTGRES_USER_2={{ index .Data.data "username" }} + POSTGRES_USER_3={{ index .Data.data "username" }} + POSTGRES_USER_4={{ index .Data.data "username" }} + POSTGRES_PASSWORD={{ index .Data.data "password" }} + POSTGRES_PASSWORD_2={{ index .Data.data "password" }} + POSTGRES_PASSWORD_3={{ index .Data.data "password" }} + POSTGRES_PASSWORD_4={{ index .Data.data "password" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/bim/base/kustomization.yaml b/apps/bim/base/kustomization.yaml index f47e36a..4312ba7 100644 --- a/apps/bim/base/kustomization.yaml +++ b/apps/bim/base/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization namespace: bim resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml + - backend.yaml diff --git a/apps/bim/base/serviceaccount.yaml b/apps/bim/base/serviceaccount.yaml deleted file mode 100644 index ae3568c..0000000 --- a/apps/bim/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: bim-vault - namespace: bim diff --git a/apps/bim/d8-ugmk-prod/kustomization.yaml b/apps/bim/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..5dbc44f --- /dev/null +++ b/apps/bim/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: bim diff --git a/apps/bim/d8-ugmk-prod/namespace.yaml b/apps/bim/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..d9a0582 --- /dev/null +++ b/apps/bim/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: bim + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/bim/dsinv/backend.yaml b/apps/bim/dsinv/backend.yaml index 5392c45..02bc032 100644 --- a/apps/bim/dsinv/backend.yaml +++ b/apps/bim/dsinv/backend.yaml @@ -1,53 +1,98 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: bim spec: - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:1d961a7b125ae0e69bd5717658d927091d8c05cc - env: - - name: LAST_MASTER_BIM - value: '100000' - - name: LAST_SLAVE_1_BIM - value: '94015' - - name: LAST_MASTER_BIM_V3 - value: '100000' - - name: LAST_SLAVE_1_BIM_V3 - value: '0' - - name: DB_CERT_PATH_3 - value: /root/yandex_pg.pem - - name: POSTGRES_ADDRESS_3 - value: postgres-service - - name: POSTGRES_PORT_3 - value: '5432' - - name: POSTGRES_DB_3 - value: bimapidb - - name: DB_CERT_PATH_2 - value: /root/yandex_pg.pem - - name: POSTGRES_ADDRESS_2 - value: postgres-service - - name: POSTGRES_PORT_2 - value: '5432' - - name: POSTGRES_DB_2 - value: bimapidb - - name: POSTGRES_ADDRESS - value: postgres-service - - name: POSTGRES_PORT - value: '5432' - - name: POSTGRES_DB - value: bimapidb - - name: POSTGRES_POOL_SIZE - value: '30' - - name: API_ADDRESS - value: 0.0.0.0:8000 - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: ENABLE_SQL_QUERY - value: '0' - - name: ENABLE_SSL - value: '0' + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:1d961a7b125ae0e69bd5717658d927091d8c05cc + + envs: + - name: LAST_MASTER_BIM + value: + _default: "100000" + + - name: LAST_SLAVE_1_BIM + value: + _default: "94015" + + - name: LAST_MASTER_BIM_V3 + value: + _default: "100000" + + - name: LAST_SLAVE_1_BIM_V3 + value: + _default: "0" + + - name: DB_CERT_PATH_3 + value: + _default: "/root/yandex_pg.pem" + + - name: POSTGRES_ADDRESS_3 + value: + _default: "postgres-service" + + - name: POSTGRES_PORT_3 + value: + _default: "5432" + + - name: POSTGRES_DB_3 + value: + _default: "bimapidb" + + - name: DB_CERT_PATH_2 + value: + _default: "/root/yandex_pg.pem" + + - name: POSTGRES_ADDRESS_2 + value: + _default: "postgres-service" + + - name: POSTGRES_PORT_2 + value: + _default: "5432" + + - name: POSTGRES_DB_2 + value: + _default: "bimapidb" + + - name: POSTGRES_ADDRESS + value: + _default: "postgres-service" + + - name: POSTGRES_PORT + value: + _default: "5432" + + - name: POSTGRES_DB + value: + _default: "bimapidb" + + - name: POSTGRES_POOL_SIZE + value: + _default: "30" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8000" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: ENABLE_SQL_QUERY + value: + _default: "0" + + - name: ENABLE_SSL + value: + _default: "0" + + - name: DB_CERT_PATH_4 + value: + _default: "/root/yandex_pg.pem" diff --git a/apps/bim/dsinv/kustomization.yaml b/apps/bim/dsinv/kustomization.yaml index 71179d1..c9109fb 100644 --- a/apps/bim/dsinv/kustomization.yaml +++ b/apps/bim/dsinv/kustomization.yaml @@ -9,5 +9,5 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend diff --git a/apps/bim/yc-k8s-test/kustomization.yaml b/apps/bim/yc-k8s-test/kustomization.yaml index 050d882..c8f7064 100644 --- a/apps/bim/yc-k8s-test/kustomization.yaml +++ b/apps/bim/yc-k8s-test/kustomization.yaml @@ -7,5 +7,5 @@ resources: patches: - path: replicas.yaml target: - kind: Deployment + kind: HelmRelease name: backend diff --git a/apps/bim/yc-k8s-test/replicas.yaml b/apps/bim/yc-k8s-test/replicas.yaml index 6ae8686..b620579 100644 --- a/apps/bim/yc-k8s-test/replicas.yaml +++ b/apps/bim/yc-k8s-test/replicas.yaml @@ -1,8 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: bim spec: - replicas: 1 + values: + services: + backend: + deployment: + replicaCount: + _default: 1 diff --git a/apps/cde/base/backend-service.yaml b/apps/cde/base/backend-service.yaml deleted file mode 100644 index 6a3f366..0000000 --- a/apps/cde/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: cde-svc - namespace: faas -spec: - type: ClusterIP - selector: - app: cde - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/cde/base/cde-flowscallback.yaml b/apps/cde/base/cde-flowscallback.yaml index 15e14c0..406212e 100644 --- a/apps/cde/base/cde-flowscallback.yaml +++ b/apps/cde/base/cde-flowscallback.yaml @@ -1,60 +1,116 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-flowscallback namespace: cde - labels: - app: cde-flowscallback - service: cde-flowscallback + spec: - replicas: 1 - selector: - matchLabels: - app: cde-flowscallback - template: - metadata: - labels: - app: cde-flowscallback - service: cde-flowscallback - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-flowscallback - image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-flowscallback: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:prod_9f3c1d2a + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-flowscallback + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-splitpdf.yaml b/apps/cde/base/cde-splitpdf.yaml index 1c5ca83..a50615f 100644 --- a/apps/cde/base/cde-splitpdf.yaml +++ b/apps/cde/base/cde-splitpdf.yaml @@ -1,60 +1,116 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-splitpdf namespace: cde - labels: - app: cde-splitpdf - service: cde-splitpdf + spec: - replicas: 1 - selector: - matchLabels: - app: cde-splitpdf - template: - metadata: - labels: - app: cde-splitpdf - service: cde-splitpdf - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-splitpdf - image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-splitpdf: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_9f3c1d2a + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-splitpdf + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-copy.yaml b/apps/cde/base/cde-worker-copy.yaml index 6f27510..622243f 100644 --- a/apps/cde/base/cde-worker-copy.yaml +++ b/apps/cde/base/cde-worker-copy.yaml @@ -1,60 +1,116 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-worker-copy namespace: cde - labels: - app: cde-worker-copy - service: cde-worker-copy + spec: - replicas: 1 - selector: - matchLabels: - app: cde-worker-copy - template: - metadata: - labels: - app: cde-worker-copy - service: cde-worker-copy - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-worker-copy - image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-copy: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:prod_9f3c1d2a + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-copy + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-create-versions.yaml b/apps/cde/base/cde-worker-create-versions.yaml index d49dd1a..36b788d 100644 --- a/apps/cde/base/cde-worker-create-versions.yaml +++ b/apps/cde/base/cde-worker-create-versions.yaml @@ -1,60 +1,116 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-worker-create-versions namespace: cde - labels: - app: cde-worker-create-versions - service: cde-worker-create-versions + spec: - replicas: 1 - selector: - matchLabels: - app: cde-worker-create-versions - template: - metadata: - labels: - app: cde-worker-create-versions - service: cde-worker-create-versions - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-worker-create-versions - image: cr.yandex/crp3ccidau046kdj8g9q/createversions-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-create-versions: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/createversions-worker:prod_9f3c1d2a + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-create-versions + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-markings.yaml b/apps/cde/base/cde-worker-markings.yaml index 5601e96..018bd6a 100644 --- a/apps/cde/base/cde-worker-markings.yaml +++ b/apps/cde/base/cde-worker-markings.yaml @@ -1,60 +1,116 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-worker-markings namespace: cde - labels: - app: cde-worker-markings - service: cde-worker-markings + spec: - replicas: 1 - selector: - matchLabels: - app: cde-worker-markings - template: - metadata: - labels: - app: cde-worker-markings - service: cde-worker-markings - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-worker-markings - image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-markings: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:prod_9f3c1d2a + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-markings + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-sign.yaml b/apps/cde/base/cde-worker-sign.yaml index ae7fa82..153caab 100644 --- a/apps/cde/base/cde-worker-sign.yaml +++ b/apps/cde/base/cde-worker-sign.yaml @@ -1,60 +1,116 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-worker-sign namespace: cde - labels: - app: cde-worker-sign - service: cde-worker-sign + spec: - replicas: 1 - selector: - matchLabels: - app: cde-worker-sign - template: - metadata: - labels: - app: cde-worker-sign - service: cde-worker-sign - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-worker-sign - image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-sign: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:prod_9f3c1d2a + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-sign + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-update-bundles.yaml b/apps/cde/base/cde-worker-update-bundles.yaml index 5af1db5..0edcf5b 100644 --- a/apps/cde/base/cde-worker-update-bundles.yaml +++ b/apps/cde/base/cde-worker-update-bundles.yaml @@ -1,60 +1,116 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-worker-update-bundles namespace: cde - labels: - app: cde-worker-update-bundles - service: cde-worker-update-bundles + spec: - replicas: 1 - selector: - matchLabels: - app: cde-worker-update-bundles - template: - metadata: - labels: - app: cde-worker-update-bundles - service: cde-worker-update-bundles - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-worker-update-bundles - image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-update-bundles: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:prod_9f3c1d2a + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-update-bundles + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde.yaml b/apps/cde/base/cde.yaml index de4bc69..1cade42 100644 --- a/apps/cde/base/cde.yaml +++ b/apps/cde/base/cde.yaml @@ -1,60 +1,131 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde namespace: cde - labels: - app: cde - service: cde + spec: - replicas: 1 - selector: - matchLabels: - app: cde - template: - metadata: - labels: - app: cde - service: cde - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: api - image: cr.yandex/crp3ccidau046kdj8g9q/cde:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/cde:prod_9f3c1d2a + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /http - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /http + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: cde-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/kustomization.yaml b/apps/cde/base/kustomization.yaml index 9c18fbf..66da886 100644 --- a/apps/cde/base/kustomization.yaml +++ b/apps/cde/base/kustomization.yaml @@ -4,10 +4,8 @@ kind: Kustomization namespace: cde resources: - namespace.yaml - - serviceaccount.yaml - cde.yaml - cde-splitpdf.yaml - - backend-service.yaml - cde-flowscallback.yaml - cde-worker-copy.yaml - cde-worker-create-versions.yaml diff --git a/apps/cde/base/serviceaccount.yaml b/apps/cde/base/serviceaccount.yaml deleted file mode 100644 index ebb471d..0000000 --- a/apps/cde/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: cde-vault - namespace: cde diff --git a/apps/cde/d8-ugmk-prod/kustomization.yaml b/apps/cde/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..0fee837 --- /dev/null +++ b/apps/cde/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: cde diff --git a/apps/cde/d8-ugmk-prod/namespace.yaml b/apps/cde/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..453a53c --- /dev/null +++ b/apps/cde/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: cde + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/comparisons/d8-ugmk-prod/namespace.yaml b/apps/comparisons/d8-ugmk-prod/namespace.yaml index 9c83f6a..cc54650 100644 --- a/apps/comparisons/d8-ugmk-prod/namespace.yaml +++ b/apps/comparisons/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: comparisons labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/control-interface/d8-ugmk-prod/namespace.yaml b/apps/control-interface/d8-ugmk-prod/namespace.yaml index e773ad1..f4c67bb 100644 --- a/apps/control-interface/d8-ugmk-prod/namespace.yaml +++ b/apps/control-interface/d8-ugmk-prod/namespace.yaml @@ -3,5 +3,5 @@ kind: Namespace metadata: name: control-interface labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/cross-section/d8-ugmk-prod/namespace.yaml b/apps/cross-section/d8-ugmk-prod/namespace.yaml index 10b2d97..5b8d5e4 100644 --- a/apps/cross-section/d8-ugmk-prod/namespace.yaml +++ b/apps/cross-section/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: cross-section labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/document-link/d8-ugmk-prod/namespace.yaml b/apps/document-link/d8-ugmk-prod/namespace.yaml index dd4f6ec..4a9e663 100644 --- a/apps/document-link/d8-ugmk-prod/namespace.yaml +++ b/apps/document-link/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: document-link labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/drawings/d8-ugmk-prod/namespace.yaml b/apps/drawings/d8-ugmk-prod/namespace.yaml index 5d45457..468680a 100644 --- a/apps/drawings/d8-ugmk-prod/namespace.yaml +++ b/apps/drawings/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: drawings labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/eav/base/django-configmap.yaml b/apps/eav/base/django-configmap.yaml index b610500..6f03ee7 100644 --- a/apps/eav/base/django-configmap.yaml +++ b/apps/eav/base/django-configmap.yaml @@ -103,10 +103,11 @@ data: "django_filters.rest_framework.DjangoFilterBackend" ], "DEFAULT_AUTHENTICATION_CLASSES": [ - "core.auth.ZitadelJWTAuthentication", - "rest_framework_simplejwt.authentication.JWTAuthentication", - "rest_framework.authentication.SessionAuthentication", - "rest_framework.authentication.BasicAuthentication", + #"core.auth.ZitadelJWTAuthentication", + "rest_framework_simplejwt.authentication.JWTStatelessUserAuthentication", + #"rest_framework_simplejwt.authentication.JWTAuthentication", + #"rest_framework.authentication.SessionAuthentication", + #"rest_framework.authentication.BasicAuthentication", ], "DEFAULT_PERMISSION_CLASSES": [ "rest_framework.permissions.AllowAny", diff --git a/apps/faas/d8-ugmk-prod/namespace.yaml b/apps/faas/d8-ugmk-prod/namespace.yaml index 3058a54..332fe39 100644 --- a/apps/faas/d8-ugmk-prod/namespace.yaml +++ b/apps/faas/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: faas labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/flows/base/backend-deployment.yaml b/apps/flows/base/backend-deployment.yaml deleted file mode 100644 index baf18f3..0000000 --- a/apps/flows/base/backend-deployment.yaml +++ /dev/null @@ -1,137 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: flows - labels: - app: backend - service: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - service: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: flows - vault.hashicorp.com/agent-inject-secret-flows-postgresql: secrets/data/postgresql/apps/flows - vault.hashicorp.com/agent-inject-template-flows-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/flows" -}} - PG_DB=flows_db - PG_LOGIN={{ index .Data.data "username" }} - PG_HOST=postgresql.flows.svc.cluster.local - PG_PORT=5432 - PG_PASSWORD={{ index .Data.data "password" }} - DOCUMENTATION_PG_HOST=postgresql.flows.svc.cluster.local - DOCUMENTATION_PG_PORT=5432 - DOCUMENTATION_PG_DATABASE=flows_db - DOCUMENTATION_PG_USERNAME={{ index .Data.data "username" }} - DOCUMENTATION_PG_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-rabbitmq: secrets/data/rabbitmq/apps/flows - vault.hashicorp.com/agent-inject-template-flows-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/flows" -}} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - RABBITMQ_PORT=5672 - ADMIN_PANEL_SECRET_KEY=rabbitmq.rabbitmq:5672 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-flows-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_TOKEN={{ index .Data.data "key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-flows-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: flows-vault - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_2a439111 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql - [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq - [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth - [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" - set +a - exec /opt/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: LOG_LEVEL - value: DEBUG - - name: BASE_HOST - value: https://srx.wb.ru - - name: CELERY_QUEUE - value: flow - - name: EAV_HOST - value: http://backend-svc.eav.svc.cluster.local:80 - - name: DJANGO_HOST - value: http://backend-svc.django.svc.cluster.local:80/api - - name: PLANNING_HOST - value: http://backend-svc.pm.svc.cluster.local:80/api/pm/msp - - name: PLANNING_USE - value: "True" - - name: DOCUMENTATION_HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1 - - name: DOCUMENTATION_EXTERNAL_HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80/api/v1 - - name: ENABLE_ANALYTICS - value: "1" - - name: ENABLE_CELERY - value: "1" - - name: ENABLE_MAILGUN - value: "0" - - name: ENABLE_METRICS - value: "0" - - name: FROM_EMAIL - value: sarex@rwb.ru - - name: GATEWAY_URL - value: http://pdm-api.documentations.svc.cluster.local:8080 - - name: RESOURCE_URL - value: http://resources-service.resources.svc.cluster.local:8000 - - name: SERVICE_HOST - value: https://srx.wb.ru/flows/api/v1 - - name: SMTP_HOST - value: mail.rwb.ru - - name: CHECKLIST_HOST - value: http://checklists-backend-service.checklists.svc.cluster.local:80 - - name: SMTP_PORT - value: "465" - - name: SYNC_RESOURCE_ID - value: "1" - - name: TIMEOUT - value: "120" - - name: WORKFLOWS_HOST - value: http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1 - - name: WORKFLOWS_TIMEOUT - value: "60" - - name: DOCUMENTATION_TIMEOUT - value: "60" - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/flows/base/backend-service.yaml b/apps/flows/base/backend-service.yaml deleted file mode 100644 index 7a8d196..0000000 --- a/apps/flows/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: flows -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/flows/base/backend.yaml b/apps/flows/base/backend.yaml new file mode 100644 index 0000000..225527a --- /dev/null +++ b/apps/flows/base/backend.yaml @@ -0,0 +1,258 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: flows + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: flows-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_2a439111 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql + [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq + [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth + [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" + set +a + exec /opt/entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://srx.wb.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:80/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@rwb.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: SERVICE_HOST + value: + _default: "https://srx.wb.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "mail.rwb.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "465" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: flows + vault.hashicorp.com/agent-inject-secret-flows-postgresql: secrets/data/postgresql/apps/flows + vault.hashicorp.com/agent-inject-template-flows-postgresql: |- + {{- with secret "secrets/data/postgresql/apps/flows" -}} + PG_DB=flows_db + PG_LOGIN={{ index .Data.data "username" }} + PG_HOST=postgresql.flows.svc.cluster.local + PG_PORT=5432 + PG_PASSWORD={{ index .Data.data "password" }} + DOCUMENTATION_PG_HOST=postgresql.flows.svc.cluster.local + DOCUMENTATION_PG_PORT=5432 + DOCUMENTATION_PG_DATABASE=flows_db + DOCUMENTATION_PG_USERNAME={{ index .Data.data "username" }} + DOCUMENTATION_PG_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-rabbitmq: secrets/data/rabbitmq/apps/flows + vault.hashicorp.com/agent-inject-template-flows-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/flows" -}} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + RABBITMQ_PORT=5672 + ADMIN_PANEL_SECRET_KEY=rabbitmq.rabbitmq:5672 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-flows-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-flows-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/flows/base/celery-deployment.yaml b/apps/flows/base/celery-deployment.yaml deleted file mode 100644 index 78e1d72..0000000 --- a/apps/flows/base/celery-deployment.yaml +++ /dev/null @@ -1,137 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: celery - namespace: flows - labels: - app: celery - service: celery -spec: - replicas: 1 - selector: - matchLabels: - app: celery - template: - metadata: - labels: - app: celery - service: celery - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: flows - vault.hashicorp.com/agent-inject-secret-flows-postgresql: secrets/data/postgresql/apps/flows - vault.hashicorp.com/agent-inject-template-flows-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/flows" -}} - PG_DB=flows_db - PG_LOGIN={{ index .Data.data "username" }} - PG_HOST=postgresql.flows.svc.cluster.local - PG_PORT=5432 - PG_PASSWORD={{ index .Data.data "password" }} - DOCUMENTATION_PG_HOST=postgresql.flows.svc.cluster.local - DOCUMENTATION_PG_PORT=5432 - DOCUMENTATION_PG_DATABASE=flows_db - DOCUMENTATION_PG_USERNAME={{ index .Data.data "username" }} - DOCUMENTATION_PG_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-rabbitmq: secrets/data/rabbitmq/apps/flows - vault.hashicorp.com/agent-inject-template-flows-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/flows" -}} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - RABBITMQ_PORT=5672 - ADMIN_PANEL_SECRET_KEY=rabbitmq.rabbitmq:5672 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-flows-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_TOKEN={{ index .Data.data "key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-flows-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: flows-vault - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_2a439111 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql - [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq - [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth - [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" - set +a - exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: LOG_LEVEL - value: DEBUG - - name: BASE_HOST - value: https://srx.wb.ru - - name: CELERY_QUEUE - value: flow - - name: EAV_HOST - value: http://backend-svc.eav.svc.cluster.local:80 - - name: DJANGO_HOST - value: http://backend-svc.django.svc.cluster.local:80/api - - name: PLANNING_HOST - value: http://backend-service.pm.svc.cluster.local:80/api/pm/msp - - name: PLANNING_USE - value: "True" - - name: DOCUMENTATION_HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1 - - name: DOCUMENTATION_EXTERNAL_HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80/api/v1 - - name: ENABLE_ANALYTICS - value: "1" - - name: ENABLE_CELERY - value: "1" - - name: ENABLE_MAILGUN - value: "0" - - name: ENABLE_METRICS - value: "0" - - name: FROM_EMAIL - value: sarex@rwb.ru - - name: GATEWAY_URL - value: http://pdm-api.documentations.svc.cluster.local:8080 - - name: RESOURCE_URL - value: http://resources-service.resources.svc.cluster.local:8000 - - name: SERVICE_HOST - value: https://srx.wb.ru/flows/api/v1 - - name: SMTP_HOST - value: mail.rwb.ru - - name: CHECKLIST_HOST - value: http://checklists-backend-service.checklists.svc.cluster.local:80 - - name: SMTP_PORT - value: "465" - - name: SYNC_RESOURCE_ID - value: "1" - - name: TIMEOUT - value: "120" - - name: WORKFLOWS_HOST - value: http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1 - - name: WORKFLOWS_TIMEOUT - value: "60" - - name: DOCUMENTATION_TIMEOUT - value: "60" - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/flows/base/celery.yaml b/apps/flows/base/celery.yaml new file mode 100644 index 0000000..b7893bd --- /dev/null +++ b/apps/flows/base/celery.yaml @@ -0,0 +1,243 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: flows + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + celery: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: flows-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_2a439111 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql + [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq + [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth + [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" + set +a + exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://srx.wb.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:80/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@rwb.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: SERVICE_HOST + value: + _default: "https://srx.wb.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "mail.rwb.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "465" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: flows + vault.hashicorp.com/agent-inject-secret-flows-postgresql: secrets/data/postgresql/apps/flows + vault.hashicorp.com/agent-inject-template-flows-postgresql: |- + {{- with secret "secrets/data/postgresql/apps/flows" -}} + PG_DB=flows_db + PG_LOGIN={{ index .Data.data "username" }} + PG_HOST=postgresql.flows.svc.cluster.local + PG_PORT=5432 + PG_PASSWORD={{ index .Data.data "password" }} + DOCUMENTATION_PG_HOST=postgresql.flows.svc.cluster.local + DOCUMENTATION_PG_PORT=5432 + DOCUMENTATION_PG_DATABASE=flows_db + DOCUMENTATION_PG_USERNAME={{ index .Data.data "username" }} + DOCUMENTATION_PG_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-rabbitmq: secrets/data/rabbitmq/apps/flows + vault.hashicorp.com/agent-inject-template-flows-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/flows" -}} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + RABBITMQ_PORT=5672 + ADMIN_PANEL_SECRET_KEY=rabbitmq.rabbitmq:5672 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-flows-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-flows-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/flows/base/frontend-deployment.yaml b/apps/flows/base/frontend-deployment.yaml deleted file mode 100644 index d22c44a..0000000 --- a/apps/flows/base/frontend-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: flows - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_5b2bd144 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/flows/base/frontend-service.yaml b/apps/flows/base/frontend-service.yaml deleted file mode 100644 index 560deee..0000000 --- a/apps/flows/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: flows -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/flows/base/frontend.yaml b/apps/flows/base/frontend.yaml new file mode 100644 index 0000000..2864ef0 --- /dev/null +++ b/apps/flows/base/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: flows + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_5b2bd144 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/flows/base/kustomization.yaml b/apps/flows/base/kustomization.yaml index 2f070b6..7986c03 100644 --- a/apps/flows/base/kustomization.yaml +++ b/apps/flows/base/kustomization.yaml @@ -4,9 +4,6 @@ kind: Kustomization namespace: flows resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - celery-deployment.yaml - - frontend-deployment.yaml - - backend-service.yaml - - frontend-service.yaml + - backend.yaml + - celery.yaml + - frontend.yaml diff --git a/apps/flows/base/serviceaccount.yaml b/apps/flows/base/serviceaccount.yaml deleted file mode 100644 index 90ea5b2..0000000 --- a/apps/flows/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: flows-vault - namespace: flows diff --git a/apps/flows/d8-ugmk-prod/kustomization.yaml b/apps/flows/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..d399533 --- /dev/null +++ b/apps/flows/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: flows diff --git a/apps/flows/d8-ugmk-prod/namespace.yaml b/apps/flows/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..c02e305 --- /dev/null +++ b/apps/flows/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: flows + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/flows/dsinv/backend.yaml b/apps/flows/dsinv/backend.yaml index 1daaea0..2cd9861 100644 --- a/apps/flows/dsinv/backend.yaml +++ b/apps/flows/dsinv/backend.yaml @@ -1,92 +1,182 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: flows spec: - replicas: 2 - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a5d748f0 - env: - - name: DEBUG - value: 'false' - - name: PLANNING_HOST - value: http://backend-service.pm.svc.cluster.local:8000/api/pm/msp - - name: PLANNING_USE - value: 'True' - - name: PG_PORT - value: '5432' - - name: EAV_HOST - value: http://eav-service.eav.svc.cluster.local:8000 - - name: PROXY_PATH_PREFIX - value: /flows - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000/api - - name: DOCUMENTATION_TIMEOUT - value: '240' - - name: DOCUMENTATION_HOST - value: http://documentations-service.documentations.svc.cluster.local:8080/internal/v1 - - name: DOCUMENTATION_EXTERNAL_HOST - value: http://documentations-service.documentations.svc.cluster.local:8080/api/v1 - - name: BASE_HOST - value: https://sarex.dsinv.ru - - name: DOCUMENTATION_PG_PORT - value: '5432' - - name: DOCUMENTATION_PG_DATABASE - value: documentations - - name: DOCUMENTATION_PG_HOST - value: postgres-service.documentations.svc.cluster.local - - name: WORKFLOWS_HOST - value: http://workflows-service.workflow.svc.cluster.local:8000/api/v1 - - name: WORKFLOWS_NOTIFICATIONS_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: WORKFLOWS_NOTIFICATIONS_SMTP_HOST - value: relay.dsinv.ru - - name: WORKFLOWS_NOTIFICATIONS_SMTP_PORT - value: '25' - - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAI - value: sarex@dsinv.ru - - name: NOTIFICATION_SETTINGS_USE_MAILGUN - value: '0' - - name: RESOURCES_HOST - value: http://resources-service.resources.svc.cluster.local:8000 - - name: ENABLE_METRICS - value: '0' - - name: ENABLE_MAILGUN - value: '0' - - name: SMTP_HOST - value: relay.dsinv.ru - - name: SMTP_PORT - value: '25' - - name: FROM_EMAIL - value: sarex@dsinv.ru - - name: TIMEOUT - value: '240' - - name: WORKFLOWS_TIMEOUT - value: '20' - - name: RESOURCE_URL - value: http://resources-service.resources.svc.cluster.local:8000/ - - name: GATEWAY_URL - value: http://pdm-api.documentations.svc.cluster.local:8080/ - - name: SYNC_RESOURCE_ID - value: '1' - - name: SERVICE_HOST - value: https://sarex.dsinv.ru/flows/api/v1 - - name: ENABLE_ANALYTICS - value: '1' - - name: ENABLE_CELERY - value: '1' - - name: CELERY_QUEUE - value: flow - - name: RABBITMQ_HOST - value: rabbitmq-service.flows.svc - - name: RABBITMQ_PORT - value: '5672' - - name: RABBITMQ_VHOST - value: flow - - name: PG_HOST - value: postgres-service.flows.svc.cluster.local + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a5d748f0 + + deployment: + replicaCount: + _default: 2 + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://documentations-service.documentations.svc.cluster.local:8080/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://documentations-service.documentations.svc.cluster.local:8080/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@dsinv.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080/" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000/" + + - name: SERVICE_HOST + value: + _default: "https://sarex.dsinv.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "25" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "240" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "20" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "240" + + - name: DEBUG + value: + _default: "false" + + - name: PG_PORT + value: + _default: "5432" + + - name: PROXY_PATH_PREFIX + value: + _default: "/flows" + + - name: DOCUMENTATION_PG_PORT + value: + _default: "5432" + + - name: DOCUMENTATION_PG_DATABASE + value: + _default: "documentations" + + - name: DOCUMENTATION_PG_HOST + value: + _default: "postgres-service.documentations.svc.cluster.local" + + - name: WORKFLOWS_NOTIFICATIONS_REGISTRY + value: + _default: "cr.yandex/crp3ccidau046kdj8g9q" + + - name: WORKFLOWS_NOTIFICATIONS_SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: WORKFLOWS_NOTIFICATIONS_SMTP_PORT + value: + _default: "25" + + - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAI + value: + _default: "sarex@dsinv.ru" + + - name: NOTIFICATION_SETTINGS_USE_MAILGUN + value: + _default: "0" + + - name: RESOURCES_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: RABBITMQ_HOST + value: + _default: "rabbitmq-service.flows.svc" + + - name: RABBITMQ_PORT + value: + _default: "5672" + + - name: RABBITMQ_VHOST + value: + _default: "flow" + + - name: PG_HOST + value: + _default: "postgres-service.flows.svc.cluster.local" diff --git a/apps/flows/dsinv/celery.yaml b/apps/flows/dsinv/celery.yaml index c77e992..a3e146b 100644 --- a/apps/flows/dsinv/celery.yaml +++ b/apps/flows/dsinv/celery.yaml @@ -1,93 +1,198 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: celery namespace: flows spec: - template: - spec: - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a5d748f0 - env: - - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAIL - value: sarex@dsinv.ru - - name: ENABLE_METRICS - value: '0' - - name: ENABLE_MAILGUN - value: '0' - - name: SMTP_HOST - value: relay.dsinv.ru - - name: SMTP_PORT - value: '25' - - name: FROM_EMAIL - value: sarex@dsinv.ru - - name: MAILGUN_HOST - value: http:localhost:8000 - - name: MAILGUN_API_KEY - value: empty - - name: NOTIFICATION_SETTINGS_USE_MAILGUN - value: '0' - - name: WORKFLOWS_HOST - value: http://workflows-service.workflow.svc.cluster.local:8000/api/v1 - - name: FLOWS_HOST - value: http://backend-service.flows.svc.cluster.local:8000 - - name: WORKFLOWS_NOTIFICATIONS_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: WORKFLOWS_NOTIFICATIONS_SMTP_HOST - value: relay.dsinv.ru - - name: WORKFLOWS_NOTIFICATIONS_SMTP_PORT - value: '25' - - name: PLANNING_HOST - value: http://backend-service.pm.svc.cluster.local:8000/api/pm/msp - - name: PLANNING_USE - value: 'True' - - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAI - value: sarex@dsinv.ru - - name: FLOWS_DB_HOST - value: postgres-service.flows.svc.cluster.local - - name: ISSUES_DB_HOST - value: postgres-service.issues.svc.cluster.local - - name: DEBUG - value: '0' - - name: PG_PORT - value: '5432' - - name: FLOWS_DB_PORT - value: '5432' - - name: ISSUES_DB_PORT - value: '5432' - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000/api - - name: DJANGO_BASE_HOST - value: https://sarex.dsinv.ru - - name: DOCUMENTATION_HOST - value: http://documentations-service.documentations.svc.cluster.local:8080/internal/v1 - - name: BASE_HOST - value: https://sarex.dsinv.ru - - name: RESOURCES_HOST - value: http://resources-service.resources.svc.cluster.local:8000/ - - name: TIMEOUT - value: '120' - - name: RESOURCE_URL - value: http://resources-service.resources/api/v1 - - name: GATEWAY_URL - value: http://pdm-api.documentations.svc.cluster.local:8080/api/v1 - - name: SYNC_RESOURCE_ID - value: '1' - - name: SERVICE_HOST - value: https://sarex.dsinv.ru/flows/api/v1 - - name: ENABLE_ANALYTICS - value: '1' - - name: ENABLE_CELERY - value: '1' - - name: CELERY_QUEUE - value: flow - - name: RABBITMQ_HOST - value: rabbitmq-service.flows.svc - - name: RABBITMQ_PORT - value: '5672' - - name: RABBITMQ_VHOST - value: flow - - name: PG_HOST - value: postgres-service.flows.svc.cluster.local + values: + services: + celery: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a5d748f0 + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://documentations-service.documentations.svc.cluster.local:8080/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@dsinv.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080/api/v1" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources/api/v1" + + - name: SERVICE_HOST + value: + _default: "https://sarex.dsinv.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "25" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAIL + value: + _default: "sarex@dsinv.ru" + + - name: MAILGUN_HOST + value: + _default: "http:localhost:8000" + + - name: MAILGUN_API_KEY + value: + _default: "empty" + + - name: NOTIFICATION_SETTINGS_USE_MAILGUN + value: + _default: "0" + + - name: FLOWS_HOST + value: + _default: "http://backend-service.flows.svc.cluster.local:8000" + + - name: WORKFLOWS_NOTIFICATIONS_REGISTRY + value: + _default: "cr.yandex/crp3ccidau046kdj8g9q" + + - name: WORKFLOWS_NOTIFICATIONS_SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: WORKFLOWS_NOTIFICATIONS_SMTP_PORT + value: + _default: "25" + + - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAI + value: + _default: "sarex@dsinv.ru" + + - name: FLOWS_DB_HOST + value: + _default: "postgres-service.flows.svc.cluster.local" + + - name: ISSUES_DB_HOST + value: + _default: "postgres-service.issues.svc.cluster.local" + + - name: DEBUG + value: + _default: "0" + + - name: PG_PORT + value: + _default: "5432" + + - name: FLOWS_DB_PORT + value: + _default: "5432" + + - name: ISSUES_DB_PORT + value: + _default: "5432" + + - name: DJANGO_BASE_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: RESOURCES_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000/" + + - name: RABBITMQ_HOST + value: + _default: "rabbitmq-service.flows.svc" + + - name: RABBITMQ_PORT + value: + _default: "5672" + + - name: RABBITMQ_VHOST + value: + _default: "flow" + + - name: PG_HOST + value: + _default: "postgres-service.flows.svc.cluster.local" diff --git a/apps/flows/dsinv/frontend.yaml b/apps/flows/dsinv/frontend.yaml index 2665046..a7938ed 100644 --- a/apps/flows/dsinv/frontend.yaml +++ b/apps/flows/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: flows spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_bad7aeb2 + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_bad7aeb2 diff --git a/apps/flows/dsinv/kustomization.yaml b/apps/flows/dsinv/kustomization.yaml index 0f1f7e1..77a3b6e 100644 --- a/apps/flows/dsinv/kustomization.yaml +++ b/apps/flows/dsinv/kustomization.yaml @@ -10,13 +10,13 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend - path: celery.yaml target: - kind: Deployment + kind: HelmRelease name: celery - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend diff --git a/apps/inspections/base/backend-service.yaml b/apps/inspections/base/backend-service.yaml deleted file mode 100644 index f938e6d..0000000 --- a/apps/inspections/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: rfi-backend-api-svc - namespace: rfi -spec: - type: ClusterIP - selector: - app: rfi-backend-api - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/inspections/base/backend.yaml b/apps/inspections/base/backend.yaml new file mode 100644 index 0000000..b8f1da9 --- /dev/null +++ b/apps/inspections/base/backend.yaml @@ -0,0 +1,240 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: inspections + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: inspections-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: inspections-backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/inspections-db ] && . /vault/secrets/inspections-db + [ -f /vault/secrets/inspections-kafka ] && . /vault/secrets/inspections-kafka + [ -f /vault/secrets/inspections-django-auth ] && . /vault/secrets/inspections-django-auth + set +a + exec ./entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: DEBUG + value: + _default: "false" + + - name: SERVICE_URL + value: + _default: "https://srx.wb.ru" + + - name: HTTP_APP_HOST + value: + _default: "0.0.0.0" + + - name: HTTP_APP_PORT + value: + _default: "8000" + + - name: HTTP_APP_ROOT_PATH + value: + _default: "/inspections" + + - name: HTTP_APP_WORKERS + value: + _default: "3" + + - name: HTTP_APP_ADMIN_ENABLE + value: + _default: "true" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + + - name: JWT_AUTH_ENABLE + value: + _default: "true" + + - name: NOTIFICATIONS_ENABLE + value: + _default: "true" + + - name: NOTIFICATIONS_EMAIL_FROM + value: + _default: "hello@sarex.io" + + - name: SAREX_BACKEND_URL + value: + _default: "https://srx.wb.ru" + + - name: SAREX_BACKEND_TIMEOUT + value: + _default: "30" + + - name: EAV_URL + value: + _default: "http://eav-service.eav" + + - name: EAV_TIMEOUT + value: + _default: "30" + + - name: WORKFLOWS_URL + value: + _default: "http://workflows-service.processing-prod" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "30" + + - name: WORKFLOWS_EMAIL_DOCKER_IMAGE + value: + _default: "cr.yandex/crp3ccidau046kdj8g9q/notification:email" + + - name: MOBILE_APP_CURRENT_VERSION + value: + _default: "1.0.0" + + - name: MOBILE_APP_RECOMMENDED_VERSION + value: + _default: "1.0.0" + + - name: MOBILE_APP_REQUIRED_VERSION + value: + _default: "1.0.0" + + - name: MAILER_URL + value: + _default: "http://mailer-service.mailer:8000" + + - name: MAILER_TIMEOUT + value: + _default: "30" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: inspections + vault.hashicorp.com/agent-inject-secret-inspections-db: secrets/data/postgresql/apps/inspections + vault.hashicorp.com/agent-inject-template-inspections-db: |- + {{- with secret "secrets/data/postgresql/apps/inspections" -}} + DATABASE_HOST=postgresql.inspections.svc.cluster.local + DATABASE_PORT=5432 + DATABASE_NAME=inspections_db + DATABASE_USER={{ index .Data.data "username" }} + DATABASE_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-inspections-kafka: secrets/data/kafka/apps/inspections + vault.hashicorp.com/agent-inject-template-inspections-kafka: |- + {{- with secret "secrets/data/kafka/apps/inspections" -}} + KAFKA_HOST={{ index .Data.data.auth "bootstrap_servers" }} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-inspections-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-inspections-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + SAREX_BACKEND_AUTH={{ index .Data.data "key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/inspections/base/kustomization.yaml b/apps/inspections/base/kustomization.yaml index 2b4238a..53d2b37 100644 --- a/apps/inspections/base/kustomization.yaml +++ b/apps/inspections/base/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization namespace: inspections resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml + - backend.yaml diff --git a/apps/inspections/base/serviceaccount.yaml b/apps/inspections/base/serviceaccount.yaml deleted file mode 100644 index b9f482d..0000000 --- a/apps/inspections/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: inspections-vault - namespace: inspections diff --git a/apps/inspections/d8-ugmk-prod/kustomization.yaml b/apps/inspections/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..025bf58 --- /dev/null +++ b/apps/inspections/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: inspections diff --git a/apps/inspections/d8-ugmk-prod/namespace.yaml b/apps/inspections/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..983b433 --- /dev/null +++ b/apps/inspections/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: inspections + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/inspections/dsinv/inspections-backend.yaml b/apps/inspections/dsinv/inspections-backend.yaml index b35cd4d..ce1c50f 100644 --- a/apps/inspections/dsinv/inspections-backend.yaml +++ b/apps/inspections/dsinv/inspections-backend.yaml @@ -1,61 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: - name: inspections-backend + name: backend namespace: inspections spec: - template: - spec: - containers: - - name: inspections-backend - image: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d - env: - - name: DEBUG - value: 'false' - - name: SERVICE_URL - value: https://srx.wb.ru - - name: HTTP_APP_HOST - value: 0.0.0.0 - - name: HTTP_APP_PORT - value: '8000' - - name: HTTP_APP_ROOT_PATH - value: /inspections - - name: HTTP_APP_WORKERS - value: '3' - - name: HTTP_APP_ADMIN_ENABLE - value: 'true' - - name: KAFKA_SSL_CAFILE - value: /usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt - - name: KAFKA_EAV_ASSETS_TOPIC - value: assets_broadcast - - name: JWT_AUTH_ENABLE - value: 'true' - - name: NOTIFICATIONS_ENABLE - value: 'true' - - name: NOTIFICATIONS_EMAIL_FROM - value: hello@sarex.io - - name: SAREX_BACKEND_URL - value: https://srx.wb.ru - - name: SAREX_BACKEND_TIMEOUT - value: '30' - - name: EAV_URL - value: http://eav-service.eav - - name: EAV_TIMEOUT - value: '30' - - name: WORKFLOWS_URL - value: http://workflows-service.processing-prod - - name: WORKFLOWS_TIMEOUT - value: '30' - - name: WORKFLOWS_EMAIL_DOCKER_IMAGE - value: cr.yandex/crp3ccidau046kdj8g9q/notification:email - - name: MOBILE_APP_CURRENT_VERSION - value: 1.0.0 - - name: MOBILE_APP_RECOMMENDED_VERSION - value: 1.0.0 - - name: MOBILE_APP_REQUIRED_VERSION - value: 1.0.0 - - name: MAILER_URL - value: http://mailer-service.mailer:8000 - - name: MAILER_TIMEOUT - value: '30' + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d diff --git a/apps/inspections/dsinv/kustomization.yaml b/apps/inspections/dsinv/kustomization.yaml index afe1f3d..d7a1bd2 100644 --- a/apps/inspections/dsinv/kustomization.yaml +++ b/apps/inspections/dsinv/kustomization.yaml @@ -9,5 +9,5 @@ resources: patches: - path: inspections-backend.yaml target: - kind: Deployment - name: inspections-backend + kind: HelmRelease + name: backend diff --git a/apps/issues/base/backend-deployment.yaml b/apps/issues/base/backend-deployment.yaml deleted file mode 100644 index 24c69ab..0000000 --- a/apps/issues/base/backend-deployment.yaml +++ /dev/null @@ -1,135 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: issues - labels: - app: backend - service: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - service: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: issues - vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/postgresql/apps/issues - vault.hashicorp.com/agent-inject-template-issues-db: |- - {{- with secret "secrets/data/postgresql/apps/issues" -}} - DATABASE_PORT=5432 - DATABASE_HOST=postgresql.issues.svc.cluster.local - DATABASE_USER={{ index .Data.data "username" }} - DATABASE_PASSWORD={{ index .Data.data "password" }} - DATABASE_NAME=issues_db - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues - vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/issues" -}} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues - vault.hashicorp.com/agent-inject-template-issues-s3: |- - {{- with secret "secrets/data/minio/apps/issues" -}} - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - YC_S3_BUCKET_NAME=rfi - YC_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-issues-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_TOKEN={{ index .Data.data "key" }} - SAREX_USERNAME={{ index .Data.data "username" }} - SAREX_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-issues-jwt-private: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "private_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-issues-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: issues-vault - volumes: - - name: production-configmap - configMap: - name: production-configmap - items: - - key: production.py - path: production.py - defaultMode: 420 - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db - [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq - [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 - [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth - [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" - [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" - set +a - exec /src/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: ENVIRONMENT - value: production - - name: AERO_PUBLIC_HOST - value: https://sarex.contour.infra.sarex.tech - - name: AERO_HOST - value: https://sarex.contour.infra.sarex.tech - - name: BASE_AERO_URL - value: https://sarex.contour.infra.sarex.tech - - name: BASE_AUTH_URL - value: http://backend-svc.django.svc.cluster.local:80 - - name: WORKFLOWS_HOST - value: http://backend-svc.workflow.svc.cluster.local:80 - - name: WORKFLOWS_URL - value: http://backend-svc.workflow.svc.cluster.local:80 - - name: RESOURCES_API_HOST - value: http://backend-svc.resources.svc.cluster.local:80 - - name: EAV_HOST - value: http://backend-svc.eav.svc.cluster.local:80 - - name: SAREX_API - value: https://sarex.contour.infra.sarex.tech - - name: DOCUMENTATIONS_URL - value: http://documentations-api-svc.documentations.svc.cluster.local:80 - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: API_ADDRESS - value: "8000" - resources: - requests: - cpu: "25m" - memory: 128Mi - volumeMounts: - - name: production-configmap - mountPath: /src/config/settings/production.py - subPath: production.py - imagePullSecrets: - - name: regcred diff --git a/apps/issues/base/backend-service.yaml b/apps/issues/base/backend-service.yaml deleted file mode 100644 index d5d299e..0000000 --- a/apps/issues/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: issues -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/issues/base/backend.yaml b/apps/issues/base/backend.yaml new file mode 100644 index 0000000..9644a58 --- /dev/null +++ b/apps/issues/base/backend.yaml @@ -0,0 +1,237 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: issues + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: issues-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + set +a + exec /src/entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: AERO_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AERO_URL + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: WORKFLOWS_URL + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: RESOURCES_API_HOST + value: + _default: "http://backend-svc.resources.svc.cluster.local:80" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: issues + vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/postgresql/apps/issues + vault.hashicorp.com/agent-inject-template-issues-db: |- + {{- with secret "secrets/data/postgresql/apps/issues" -}} + DATABASE_PORT=5432 + DATABASE_HOST=postgresql.issues.svc.cluster.local + DATABASE_USER={{ index .Data.data "username" }} + DATABASE_PASSWORD={{ index .Data.data "password" }} + DATABASE_NAME=issues_db + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues + vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/issues" -}} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=rfi + YC_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-issues-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + SAREX_USERNAME={{ index .Data.data "username" }} + SAREX_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/base/celery-deployment.yaml b/apps/issues/base/celery-deployment.yaml deleted file mode 100644 index c5fd887..0000000 --- a/apps/issues/base/celery-deployment.yaml +++ /dev/null @@ -1,135 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: celery - namespace: issues - labels: - app: celery - service: celery -spec: - replicas: 1 - selector: - matchLabels: - app: celery - template: - metadata: - labels: - app: celery - service: celery - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: issues - vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/postgresql/apps/issues - vault.hashicorp.com/agent-inject-template-issues-db: |- - {{- with secret "secrets/data/postgresql/apps/issues" -}} - DATABASE_PORT=5432 - DATABASE_HOST=postgresql.issues.svc.cluster.local - DATABASE_USER={{ index .Data.data "username" }} - DATABASE_PASSWORD={{ index .Data.data "password" }} - DATABASE_NAME=issues_db - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues - vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/issues" -}} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues - vault.hashicorp.com/agent-inject-template-issues-s3: |- - {{- with secret "secrets/data/minio/apps/issues" -}} - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - YC_S3_BUCKET_NAME=rfi - YC_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-issues-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_TOKEN={{ index .Data.data "key" }} - SAREX_USERNAME={{ index .Data.data "username" }} - SAREX_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-issues-jwt-private: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "private_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-issues-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: issues-vault - volumes: - - name: production-configmap - configMap: - name: production-configmap - items: - - key: production.py - path: production.py - defaultMode: 420 - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db - [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq - [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 - [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth - [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" - [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" - set +a - exec celery -A config worker -l info -E - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: ENVIRONMENT - value: production - - name: AERO_PUBLIC_HOST - value: https://srx.wb.ru - - name: AERO_HOST - value: https://srx.wb.ru - - name: BASE_AERO_URL - value: https://srx.wb.ru - - name: BASE_AUTH_URL - value: http://backend-svc.django.svc.cluster.local:80 - - name: WORKFLOWS_HOST - value: http://workflows-api-service.workflow.svc.cluster.local:8000 - - name: WORKFLOWS_URL - value: http://workflows-api-service.workflow.svc.cluster.local:8000 - - name: RESOURCES_API_HOST - value: http://backend-svc.resources.svc.cluster.local:80 - - name: EAV_HOST - value: http://backend-svc.eav.svc.cluster.local:80 - - name: SAREX_API - value: https://srx.wb.ru - - name: DOCUMENTATIONS_URL - value: http://backend-api-svc.documentations.svc.cluster.local:80 - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: API_ADDRESS - value: "8000" - resources: - requests: - cpu: "25m" - memory: 128Mi - volumeMounts: - - name: production-configmap - mountPath: /src/config/settings/production.py - subPath: production.py - imagePullSecrets: - - name: regcred diff --git a/apps/issues/base/celery.yaml b/apps/issues/base/celery.yaml new file mode 100644 index 0000000..c8eeefe --- /dev/null +++ b/apps/issues/base/celery.yaml @@ -0,0 +1,222 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: issues + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + celery: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: issues-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + set +a + exec celery -A config worker -l info -E + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://srx.wb.ru" + + - name: AERO_HOST + value: + _default: "https://srx.wb.ru" + + - name: BASE_AERO_URL + value: + _default: "https://srx.wb.ru" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: RESOURCES_API_HOST + value: + _default: "http://backend-svc.resources.svc.cluster.local:80" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://srx.wb.ru" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: issues + vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/postgresql/apps/issues + vault.hashicorp.com/agent-inject-template-issues-db: |- + {{- with secret "secrets/data/postgresql/apps/issues" -}} + DATABASE_PORT=5432 + DATABASE_HOST=postgresql.issues.svc.cluster.local + DATABASE_USER={{ index .Data.data "username" }} + DATABASE_PASSWORD={{ index .Data.data "password" }} + DATABASE_NAME=issues_db + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues + vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/issues" -}} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=rfi + YC_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-issues-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + SAREX_USERNAME={{ index .Data.data "username" }} + SAREX_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/base/frontend-deployment.yaml b/apps/issues/base/frontend-deployment.yaml deleted file mode 100644 index f34f03e..0000000 --- a/apps/issues/base/frontend-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: issues - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:716a2b73 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/issues/base/frontend-service.yaml b/apps/issues/base/frontend-service.yaml deleted file mode 100644 index fdb438b..0000000 --- a/apps/issues/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: issues -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/issues/base/frontend.yaml b/apps/issues/base/frontend.yaml new file mode 100644 index 0000000..d01827e --- /dev/null +++ b/apps/issues/base/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: issues + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:716a2b73 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/issues/base/kustomization.yaml b/apps/issues/base/kustomization.yaml index 2b1272a..36da654 100644 --- a/apps/issues/base/kustomization.yaml +++ b/apps/issues/base/kustomization.yaml @@ -4,10 +4,7 @@ kind: Kustomization namespace: issues resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - celery-deployment.yaml - - frontend-deployment.yaml - - backend-service.yaml - - frontend-service.yaml + - backend.yaml + - celery.yaml + - frontend.yaml - production-configmap.yaml diff --git a/apps/issues/base/serviceaccount.yaml b/apps/issues/base/serviceaccount.yaml deleted file mode 100644 index 30a477e..0000000 --- a/apps/issues/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: issues-vault - namespace: issues diff --git a/apps/issues/d8-ugmk-prod/kustomization.yaml b/apps/issues/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..b64e558 --- /dev/null +++ b/apps/issues/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: issues diff --git a/apps/issues/d8-ugmk-prod/namespace.yaml b/apps/issues/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..10ec0c1 --- /dev/null +++ b/apps/issues/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: issues + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/issues/dsinv/backend.yaml b/apps/issues/dsinv/backend.yaml index d168bfd..05c5595 100644 --- a/apps/issues/dsinv/backend.yaml +++ b/apps/issues/dsinv/backend.yaml @@ -1,53 +1,102 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: issues spec: - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/issues:production_31aef17b - env: - - name: ENABLE_MAILGUN - value: 'False' - - name: SMTP_HOST - value: relay.dsinv.ru - - name: SMTP_PORT - value: '25' - - name: EMAIL_FROM - value: sarex@dsinv.ru - - name: USE_NOTIFICATIONS - value: 'True' - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: REDIS_HOST - value: redis-service.issues.svc.cluster.local - - name: DATABASE_HOST - value: postgres-service.issues.svc.cluster.local - - name: DATABASE_PORT - value: '5432' - - name: DATABASE_NAME - value: issues - - name: API_ADDRESS - value: '8000' - - name: ENVIRONMENT - value: production - - name: AERO_PUBLIC_HOST - value: https://sarex.dsinv.ru - - name: BASE_AERO_URL - value: http://backend.django.svc.cluster.local:8000 - - name: BASE_AUTH_URL - value: http://backend.django.svc.cluster.local:8000 - - name: WORKFLOWS_HOST - value: http://workflows-service.workflow.svc.cluster.local:8000 - - name: WORKFLOWS_URL - value: https://sarex.dsinv.ru - - name: RESOURCES_API_HOST - value: http://resources-service.resources.svc.cluster.local:8000 - - name: EAV_HOST - value: http://eav-service.eav.svc.cluster.local:8000 - - name: SAREX_API - value: http://backend.django.svc.cluster.local:8000 + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_31aef17b + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: AERO_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AERO_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: BASE_AUTH_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "https://sarex.dsinv.ru" + + - name: RESOURCES_API_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: SAREX_API + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + - name: ENABLE_MAILGUN + value: + _default: "False" + + - name: SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: SMTP_PORT + value: + _default: "25" + + - name: EMAIL_FROM + value: + _default: "sarex@dsinv.ru" + + - name: USE_NOTIFICATIONS + value: + _default: "True" + + - name: REDIS_HOST + value: + _default: "redis-service.issues.svc.cluster.local" + + - name: DATABASE_HOST + value: + _default: "postgres-service.issues.svc.cluster.local" + + - name: DATABASE_PORT + value: + _default: "5432" + + - name: DATABASE_NAME + value: + _default: "issues" diff --git a/apps/issues/dsinv/celery.yaml b/apps/issues/dsinv/celery.yaml index 53618ac..8c6a8e7 100644 --- a/apps/issues/dsinv/celery.yaml +++ b/apps/issues/dsinv/celery.yaml @@ -1,57 +1,110 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: celery namespace: issues spec: - template: - spec: - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/issues:production_31aef17b - env: - - name: KAFKA_EAV_ASSETS_TOPIC - value: sarex - - name: AERO_PUBLIC_HOST - value: https://sarex.dsinv.ru - - name: ENABLE_MAILGUN - value: 'False' - - name: SMTP_HOST - value: relay.dsinv.ru - - name: SMTP_PORT - value: '25' - - name: EMAIL_FROM - value: sarex@dsinv.ru - - name: REDIS_HOST - value: redis-service.issues.svc.cluster.local - - name: DATABASE_HOST - value: postgres-service.issues.svc.cluster.local - - name: DATABASE_PORT - value: '5432' - - name: DATABASE_NAME - value: issues - - name: USE_NOTIFICATIONS - value: 'True' - - name: API_ADDRESS - value: '8000' - - name: YC_S3_VERIFY - value: 'False' - - name: ENVIRONMENT - value: production - - name: AERO_HOST - value: https://sarex.dsinv.ru - - name: BASE_AERO_URL - value: http://backend.django.svc.cluster.local:8000 - - name: BASE_AUTH_URL - value: https://sarex.dsinv.ru - - name: WORKFLOWS_HOST - value: http://workflows-service.workflow.svc.cluster.local:8000 - - name: WORKFLOWS_URL - value: https://sarex.dsinv.ru - - name: RESOURCES_API_HOST - value: http://resources-service.resources.svc.cluster.local:8000 - - name: EAV_HOST - value: http://eav-service.eav.svc.cluster.local:8000 - - name: SAREX_API - value: http://backend.django.svc.cluster.local:8000 + values: + services: + celery: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_31aef17b + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: AERO_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: BASE_AERO_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: BASE_AUTH_URL + value: + _default: "https://sarex.dsinv.ru" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "https://sarex.dsinv.ru" + + - name: RESOURCES_API_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: SAREX_API + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "sarex" + + - name: ENABLE_MAILGUN + value: + _default: "False" + + - name: SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: SMTP_PORT + value: + _default: "25" + + - name: EMAIL_FROM + value: + _default: "sarex@dsinv.ru" + + - name: REDIS_HOST + value: + _default: "redis-service.issues.svc.cluster.local" + + - name: DATABASE_HOST + value: + _default: "postgres-service.issues.svc.cluster.local" + + - name: DATABASE_PORT + value: + _default: "5432" + + - name: DATABASE_NAME + value: + _default: "issues" + + - name: USE_NOTIFICATIONS + value: + _default: "True" + + - name: YC_S3_VERIFY + value: + _default: "False" diff --git a/apps/issues/dsinv/frontend.yaml b/apps/issues/dsinv/frontend.yaml index c255a44..5fa4785 100644 --- a/apps/issues/dsinv/frontend.yaml +++ b/apps/issues/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: issues spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:24ab8d2b + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:24ab8d2b diff --git a/apps/issues/dsinv/kustomization.yaml b/apps/issues/dsinv/kustomization.yaml index 951dc84..ec32d79 100644 --- a/apps/issues/dsinv/kustomization.yaml +++ b/apps/issues/dsinv/kustomization.yaml @@ -7,13 +7,13 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend - path: celery.yaml target: - kind: Deployment + kind: HelmRelease name: celery - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend diff --git a/apps/mapper/d8-ugmk-prod/namespace.yaml b/apps/mapper/d8-ugmk-prod/namespace.yaml index 3e969b0..ce8019c 100644 --- a/apps/mapper/d8-ugmk-prod/namespace.yaml +++ b/apps/mapper/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: mapper labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/measurements/d8-ugmk-prod/namespace.yaml b/apps/measurements/d8-ugmk-prod/namespace.yaml index c05d4e2..3067c9b 100644 --- a/apps/measurements/d8-ugmk-prod/namespace.yaml +++ b/apps/measurements/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: measurements labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/message-hub/base/deployment.yaml b/apps/message-hub/base/deployment.yaml deleted file mode 100644 index 90b3cce..0000000 --- a/apps/message-hub/base/deployment.yaml +++ /dev/null @@ -1,96 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: message-hub - namespace: message-hub - labels: - app: message-hub - service: message-hub -spec: - replicas: 1 - selector: - matchLabels: - app: message-hub - template: - metadata: - labels: - app: message-hub - service: message-hub - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: message-hub - vault.hashicorp.com/agent-inject-secret-message-hub-db: secrets/data/postgresql/apps/message-hub - vault.hashicorp.com/agent-inject-template-message-hub-db: |- - {{- with secret "secrets/data/postgresql/apps/message-hub" -}} - DB_USERNAME={{ index .Data.data "username" }} - DB_PASSWORD={{ index .Data.data "password" }} - DB_DATABASE=pm_db - DB_HOST=postgresql.pm.svc.cluster.local - DB_PORT=5432 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-message-hub-s3: secrets/data/minio/apps/message-hub - vault.hashicorp.com/agent-inject-template-message-hub-s3: |- - {{- with secret "secrets/data/minio/apps/message-hub" -}} - S3_HOST={{ index .Data.data.client "endpoint" }} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}rfi{{- end -}} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/message-hub - vault.hashicorp.com/agent-inject-template-message-hub-kafka: |- - {{- with secret "secrets/data/kafka/apps/message-hub" -}} - KAFKA_USERNAME={{ index .Data.data "username" }} - KAFKA_PASSWORD={{ index .Data.data "password" }} - KAFKA_HOST=kafka-kafka-contour-controller-headless.kafka.svc.cluster.local - KAFKA_PORT=9094 - KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} - KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} - {{- end -}} - spec: - serviceAccountName: message-hub-vault - containers: - - name: message-hub - image: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_24425472 - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/message-hub-db ] && . /vault/secrets/message-hub-db - [ -f /vault/secrets/message-hub-s3 ] && . /vault/secrets/message-hub-s3 - [ -f /vault/secrets/message-hub-kafka ] && . /vault/secrets/message-hub-kafka - set +a - exec /opt/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: WORKER_TIMEOUT - value: "60" - - name: PYTHONPATH - value: src - - name: SETTINGS_MAX_RETRIES - value: "1" - - name: SETTINGS_TOPICS - value: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}' - - name: SETTINGS_PDF_CONVERTER_HOST - value: http://export-project-service.django.svc.cluster.local:8000 - - name: SAREX_BASE_HOST - value: http://backend-service.pm.svc.cluster.local:8000 - - name: CACHE_HOST - value: redis.pm.svc.cluster.local - - name: CACHE_PORT - value: "6379" - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/message-hub/base/kustomization.yaml b/apps/message-hub/base/kustomization.yaml index 8ae7d0c..30e0638 100644 --- a/apps/message-hub/base/kustomization.yaml +++ b/apps/message-hub/base/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization namespace: message-hub resources: - namespace.yaml - - serviceaccount.yaml - - deployment.yaml - - service.yaml + - message-hub.yaml diff --git a/apps/message-hub/base/message-hub.yaml b/apps/message-hub/base/message-hub.yaml new file mode 100644 index 0000000..f9e0241 --- /dev/null +++ b/apps/message-hub/base/message-hub.yaml @@ -0,0 +1,183 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: message-hub + namespace: message-hub + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: message-hub-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_24425472 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: message-hub + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/message-hub-db ] && . /vault/secrets/message-hub-db + [ -f /vault/secrets/message-hub-s3 ] && . /vault/secrets/message-hub-s3 + [ -f /vault/secrets/message-hub-kafka ] && . /vault/secrets/message-hub-kafka + set +a + exec /opt/entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: message-hub-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: WORKER_TIMEOUT + value: + _default: "60" + + - name: PYTHONPATH + value: + _default: "src" + + - name: SETTINGS_MAX_RETRIES + value: + _default: "1" + + - name: SETTINGS_TOPICS + value: + _default: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}' + + - name: SETTINGS_PDF_CONVERTER_HOST + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: SAREX_BASE_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000" + + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: message-hub + vault.hashicorp.com/agent-inject-secret-message-hub-db: secrets/data/postgresql/apps/message-hub + vault.hashicorp.com/agent-inject-template-message-hub-db: |- + {{- with secret "secrets/data/postgresql/apps/message-hub" -}} + DB_USERNAME={{ index .Data.data "username" }} + DB_PASSWORD={{ index .Data.data "password" }} + DB_DATABASE=pm_db + DB_HOST=postgresql.pm.svc.cluster.local + DB_PORT=5432 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-message-hub-s3: secrets/data/minio/apps/message-hub + vault.hashicorp.com/agent-inject-template-message-hub-s3: |- + {{- with secret "secrets/data/minio/apps/message-hub" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}rfi{{- end -}} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/message-hub + vault.hashicorp.com/agent-inject-template-message-hub-kafka: |- + {{- with secret "secrets/data/kafka/apps/message-hub" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + KAFKA_HOST=kafka-kafka-contour-controller-headless.kafka.svc.cluster.local + KAFKA_PORT=9094 + KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/message-hub/base/service.yaml b/apps/message-hub/base/service.yaml deleted file mode 100644 index 087538d..0000000 --- a/apps/message-hub/base/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: message-hub-svc - namespace: message-hub -spec: - type: ClusterIP - selector: - app: message-hub - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/message-hub/base/serviceaccount.yaml b/apps/message-hub/base/serviceaccount.yaml deleted file mode 100644 index c5f9269..0000000 --- a/apps/message-hub/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: message-hub-vault - namespace: message-hub diff --git a/apps/message-hub/d8-ugmk-prod/kustomization.yaml b/apps/message-hub/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..fed75be --- /dev/null +++ b/apps/message-hub/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: message-hub diff --git a/apps/message-hub/d8-ugmk-prod/namespace.yaml b/apps/message-hub/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..8a7c4da --- /dev/null +++ b/apps/message-hub/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: message-hub + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/message-hub/dsinv/kustomization.yaml b/apps/message-hub/dsinv/kustomization.yaml index eea88a2..5c6ba46 100644 --- a/apps/message-hub/dsinv/kustomization.yaml +++ b/apps/message-hub/dsinv/kustomization.yaml @@ -7,5 +7,5 @@ resources: patches: - path: message-hub.yaml target: - kind: Deployment + kind: HelmRelease name: message-hub diff --git a/apps/message-hub/dsinv/message-hub.yaml b/apps/message-hub/dsinv/message-hub.yaml index 85723db..a7dd8e9 100644 --- a/apps/message-hub/dsinv/message-hub.yaml +++ b/apps/message-hub/dsinv/message-hub.yaml @@ -1,49 +1,90 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: message-hub namespace: message-hub spec: - template: - spec: - containers: - - name: message-hub - image: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_d11aa910 - env: - - name: WORKER_TIMEOUT - value: '60' - - name: PYTHONPATH - value: src - - name: SETTINGS_MAX_RETRIES - value: '1' - - name: SETTINGS_TOPICS - value: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod"}' - - name: PDF_CONVERTER_HOST - value: http://export-project-service.django.svc.cluster.local:8000 - - name: SAREX_BASE_HOST - value: http://backend-service.pm.svc.cluster.local:8000 - - name: PM_HOST - value: http://backend-service.pm.svc.cluster.local:8000 - - name: DB_HOST - value: postgres-service.pm.svc.cluster.local - - name: DB_PORT - value: '5432' - - name: DB_DATABASE - value: pm - - name: CACHE_HOST - value: redis.pm.svc.cluster.local - - name: CACHE_PORT - value: '6379' - - name: CACHE_SSL - value: '0' - - name: KAFKA_HOST - value: donstroi-kafka-bootstrap.kafka.svc.cluster.local - - name: KAFKA_PORT - value: '9093' - - name: KAFKA_SECURITY_PROTOCOL - value: SSL - - name: KAFKA_SASL_MECHANISM - value: PLAIN - - name: KAFKA_SSL_CAFILE - value: /usr/local/share/ca-certificates/kafka.crt + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_d11aa910 + + envs: + - name: WORKER_TIMEOUT + value: + _default: "60" + + - name: PYTHONPATH + value: + _default: "src" + + - name: SETTINGS_MAX_RETRIES + value: + _default: "1" + + - name: SETTINGS_TOPICS + value: + _default: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod"}' + + - name: SETTINGS_PDF_CONVERTER_HOST + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: SAREX_BASE_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000" + + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + - name: PDF_CONVERTER_HOST + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: PM_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000" + + - name: DB_HOST + value: + _default: "postgres-service.pm.svc.cluster.local" + + - name: DB_PORT + value: + _default: "5432" + + - name: DB_DATABASE + value: + _default: "pm" + + - name: CACHE_SSL + value: + _default: "0" + + - name: KAFKA_HOST + value: + _default: "donstroi-kafka-bootstrap.kafka.svc.cluster.local" + + - name: KAFKA_PORT + value: + _default: "9093" + + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SSL" + + - name: KAFKA_SASL_MECHANISM + value: + _default: "PLAIN" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" diff --git a/apps/pm/base/backend-deployment.yaml b/apps/pm/base/backend-deployment.yaml deleted file mode 100644 index 6c2ea97..0000000 --- a/apps/pm/base/backend-deployment.yaml +++ /dev/null @@ -1,132 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: pm - labels: - app: backend - service: api -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - service: api - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: pm - vault.hashicorp.com/agent-inject-secret-pm-db: secrets/data/postgresql/apps/pm - vault.hashicorp.com/agent-inject-template-pm-db: |- - {{- with secret "secrets/data/postgresql/apps/pm" -}} - DB_USERNAME={{ index .Data.data "username" }} - DB_PASSWORD={{ index .Data.data "password" }} - DB_DATABASE=pm_db - DB_HOST=postgresql.pm.svc.cluster.local - DB_PORT=5432 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-pm-rabbitmq: secrets/data/rabbitmq/apps/pm - vault.hashicorp.com/agent-inject-template-pm-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/pm" -}} - CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - CELERY_RABBITMQ_PORT=5672 - CELERY_RABBITMQ_USER={{ index .Data.data "username" }} - CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} - CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-pm-s3: secrets/data/minio/apps/pm - vault.hashicorp.com/agent-inject-template-pm-s3: |- - {{- with secret "secrets/data/minio/apps/pm" -}} - S3_HOST={{ index .Data.data.client "endpoint" }} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}pm-bucket{{- end -}} - S3_VERIFY=False - {{- end -}} - spec: - serviceAccountName: pm-vault - containers: - - name: api - image: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_0843a55d - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db - [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq - [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 - set +a - exec /opt/sarex/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: USERS_INTERNAL_HOST - value: http://backend-service.sarex.svc.cluster.local:8000 - - name: CELERY_REDIS_HOST - value: redis.pm.svc.cluster.local - - name: RESOURCES_INTERNAL_HOST - value: http://sarex-resources-service.resources - - name: EAV_HOST - value: http://eav-service.eav - - name: EAV_API_PREFIX - value: /api/v0 - - name: EAV_API_PREFIX_V1 - value: /api/v1 - - name: TRACING_INSECURE - value: "False" - - name: SERVER_ENABLE_SYNC_RESOURCES - value: "True" - - name: SERVER_DELETED_TASK_MAX_AGE_DAYS - value: "1" - - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR - value: "17" - - name: LANG - value: C.UTF-8 - - name: LC_ALL - value: C.UTF-8 - - name: PYTHONUTF8 - value: "1" - - name: CACHE_SSL - value: "False" - - name: CACHE_SSL_CA_CERTS - value: "" - - name: CACHE_ENABLE - value: "False" - - name: CLICKHOUSE_ENABLE - value: "False" - - name: KAFKA_ENABLE - value: "False" - - name: AUTH_PUBLIC_TOKEN_URL - value: "https://lk.sarex.io/api/token/public/" - - name: SERVER_HOST - value: "https://lk.sarex.io" - - name: SERVER_API_HOST - value: "https://api.sarex.io" - - name: SERVER_DEBUG - value: "False" - - name: SERVER_ALLOWED_HOSTS - value: '["*"]' - - name: SERVER_USE_OTEL - value: "False" - - name: SERVER_VERIFY_SSL - value: "False" - - name: SERVER_LOG_LEVEL - value: "INFO" - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/pm/base/backend-service.yaml b/apps/pm/base/backend-service.yaml deleted file mode 100644 index 55abdc2..0000000 --- a/apps/pm/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: pm -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 8000 - targetPort: 8000 - protocol: TCP diff --git a/apps/pm/base/backend.yaml b/apps/pm/base/backend.yaml new file mode 100644 index 0000000..c103c6e --- /dev/null +++ b/apps/pm/base/backend.yaml @@ -0,0 +1,255 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: pm-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_0843a55d + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db + [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq + [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 + set +a + exec /opt/sarex/entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend-service.sarex.svc.cluster.local:8000" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://sarex-resources-service.resources" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + - name: CACHE_ENABLE + value: + _default: "False" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "False" + + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://lk.sarex.io/api/token/public/" + + - name: SERVER_HOST + value: + _default: "https://lk.sarex.io" + + - name: SERVER_API_HOST + value: + _default: "https://api.sarex.io" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: pm + vault.hashicorp.com/agent-inject-secret-pm-db: secrets/data/postgresql/apps/pm + vault.hashicorp.com/agent-inject-template-pm-db: |- + {{- with secret "secrets/data/postgresql/apps/pm" -}} + DB_USERNAME={{ index .Data.data "username" }} + DB_PASSWORD={{ index .Data.data "password" }} + DB_DATABASE=pm_db + DB_HOST=postgresql.pm.svc.cluster.local + DB_PORT=5432 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-rabbitmq: secrets/data/rabbitmq/apps/pm + vault.hashicorp.com/agent-inject-template-pm-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/pm" -}} + CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + CELERY_RABBITMQ_PORT=5672 + CELERY_RABBITMQ_USER={{ index .Data.data "username" }} + CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-s3: secrets/data/minio/apps/pm + vault.hashicorp.com/agent-inject-template-pm-s3: |- + {{- with secret "secrets/data/minio/apps/pm" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}pm-bucket{{- end -}} + S3_VERIFY=False + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/pm/base/celery-deployment.yaml b/apps/pm/base/celery-deployment.yaml deleted file mode 100644 index e063065..0000000 --- a/apps/pm/base/celery-deployment.yaml +++ /dev/null @@ -1,131 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: celery - namespace: pm - labels: - app: celery - service: celery -spec: - replicas: 1 - selector: - matchLabels: - app: celery - template: - metadata: - labels: - app: celery - service: celery - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: pm - vault.hashicorp.com/agent-inject-secret-pm-db: secrets/data/postgresql/apps/pm - vault.hashicorp.com/agent-inject-template-pm-db: |- - {{- with secret "secrets/data/postgresql/apps/pm" -}} - DB_USERNAME={{ index .Data.data "username" }} - DB_PASSWORD={{ index .Data.data "password" }} - DB_DATABASE=pm_db - DB_HOST=postgresql.pm.svc.cluster.local - DB_PORT=5432 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-pm-rabbitmq: secrets/data/rabbitmq/apps/pm - vault.hashicorp.com/agent-inject-template-pm-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/pm" -}} - CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - CELERY_RABBITMQ_PORT=5672 - CELERY_RABBITMQ_USER={{ index .Data.data "username" }} - CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} - CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-pm-s3: secrets/data/minio/apps/pm - vault.hashicorp.com/agent-inject-template-pm-s3: |- - {{- with secret "secrets/data/minio/apps/pm" -}} - S3_HOST={{ index .Data.data.client "endpoint" }} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}pm-bucket{{- end -}} - S3_VERIFY=False - {{- end -}} - spec: - serviceAccountName: pm-vault - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_0843a55d - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db - [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq - [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 - set +a - exec celery -A config worker -B -l info -E -Q pm -n default_worker.%h --concurrency=2 - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: USERS_INTERNAL_HOST - value: http://backend-service.sarex.svc.cluster.local:8000 - - name: CELERY_REDIS_HOST - value: redis.pm.svc.cluster.local - - name: RESOURCES_INTERNAL_HOST - value: http://sarex-resources-service.resources - - name: EAV_HOST - value: http://eav-service.eav - - name: EAV_API_PREFIX - value: /api/v0 - - name: EAV_API_PREFIX_V1 - value: /api/v1 - - name: TRACING_INSECURE - value: "False" - - name: SERVER_ENABLE_SYNC_RESOURCES - value: "True" - - name: SERVER_DELETED_TASK_MAX_AGE_DAYS - value: "1" - - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR - value: "17" - - name: LANG - value: C.UTF-8 - - name: LC_ALL - value: C.UTF-8 - - name: PYTHONUTF8 - value: "1" - - name: CACHE_SSL - value: "False" - - name: CACHE_SSL_CA_CERTS - value: "" - - name: CACHE_ENABLE - value: "False" - - name: CLICKHOUSE_ENABLE - value: "False" - - name: KAFKA_ENABLE - value: "False" - - name: AUTH_PUBLIC_TOKEN_URL - value: "https://lk.sarex.io/api/token/public/" - - name: SERVER_HOST - value: "https://lk.sarex.io" - - name: SERVER_API_HOST - value: "https://api.sarex.io" - - name: SERVER_DEBUG - value: "False" - - name: SERVER_ALLOWED_HOSTS - value: '["*"]' - - name: SERVER_USE_OTEL - value: "False" - - name: SERVER_VERIFY_SSL - value: "False" - - name: SERVER_LOG_LEVEL - value: "INFO" - resources: - requests: - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/pm/base/celery.yaml b/apps/pm/base/celery.yaml new file mode 100644 index 0000000..cb171f6 --- /dev/null +++ b/apps/pm/base/celery.yaml @@ -0,0 +1,238 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + celery: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: pm-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_0843a55d + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db + [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq + [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 + set +a + exec celery -A config worker -B -l info -E -Q pm -n default_worker.%h --concurrency=2 + + resources: + requests: + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend-service.sarex.svc.cluster.local:8000" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://sarex-resources-service.resources" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + - name: CACHE_ENABLE + value: + _default: "False" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "False" + + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://lk.sarex.io/api/token/public/" + + - name: SERVER_HOST + value: + _default: "https://lk.sarex.io" + + - name: SERVER_API_HOST + value: + _default: "https://api.sarex.io" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: pm + vault.hashicorp.com/agent-inject-secret-pm-db: secrets/data/postgresql/apps/pm + vault.hashicorp.com/agent-inject-template-pm-db: |- + {{- with secret "secrets/data/postgresql/apps/pm" -}} + DB_USERNAME={{ index .Data.data "username" }} + DB_PASSWORD={{ index .Data.data "password" }} + DB_DATABASE=pm_db + DB_HOST=postgresql.pm.svc.cluster.local + DB_PORT=5432 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-rabbitmq: secrets/data/rabbitmq/apps/pm + vault.hashicorp.com/agent-inject-template-pm-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/pm" -}} + CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + CELERY_RABBITMQ_PORT=5672 + CELERY_RABBITMQ_USER={{ index .Data.data "username" }} + CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-s3: secrets/data/minio/apps/pm + vault.hashicorp.com/agent-inject-template-pm-s3: |- + {{- with secret "secrets/data/minio/apps/pm" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}pm-bucket{{- end -}} + S3_VERIFY=False + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/pm/base/kustomization.yaml b/apps/pm/base/kustomization.yaml index d742c1d..f16efbf 100644 --- a/apps/pm/base/kustomization.yaml +++ b/apps/pm/base/kustomization.yaml @@ -4,8 +4,6 @@ kind: Kustomization namespace: pm resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml - - celery-deployment.yaml + - backend.yaml + - celery.yaml - backend-configmap.yaml diff --git a/apps/pm/base/serviceaccount.yaml b/apps/pm/base/serviceaccount.yaml deleted file mode 100644 index e6e28dc..0000000 --- a/apps/pm/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: pm-vault - namespace: pm diff --git a/apps/pm/d8-ugmk-prod/kustomization.yaml b/apps/pm/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..8c72385 --- /dev/null +++ b/apps/pm/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: pm diff --git a/apps/pm/d8-ugmk-prod/namespace.yaml b/apps/pm/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..4c42f10 --- /dev/null +++ b/apps/pm/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: pm + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/pm/dsinv/backend.yaml b/apps/pm/dsinv/backend.yaml index fa93fa6..d96d44e 100644 --- a/apps/pm/dsinv/backend.yaml +++ b/apps/pm/dsinv/backend.yaml @@ -1,29 +1,118 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: pm spec: - template: - spec: - containers: - - name: api - image: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_3d7e8ea6 - env: - - name: LANG - value: C.UTF-8 - - name: LC_ALL - value: C.UTF-8 - - name: PYTHONUTF8 - value: '1' - - name: USERS_INTERNAL_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: RESOURCES_INTERNAL_HOST - value: http://resources-service.resources.svc.cluster.local:8000 - - name: EAV_HOST - value: http://eav-service.eav.svc.cluster.local:8000 - - name: EAV_API_PREFIX - value: /api/v0 - - name: EAV_API_PREFIX_V1 - value: /api/v1 + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_3d7e8ea6 + + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + - name: CACHE_ENABLE + value: + _default: "False" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "False" + + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://lk.sarex.io/api/token/public/" + + - name: SERVER_HOST + value: + _default: "https://lk.sarex.io" + + - name: SERVER_API_HOST + value: + _default: "https://api.sarex.io" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" diff --git a/apps/pm/dsinv/celery.yaml b/apps/pm/dsinv/celery.yaml index 1f50c91..c4a3b17 100644 --- a/apps/pm/dsinv/celery.yaml +++ b/apps/pm/dsinv/celery.yaml @@ -1,29 +1,118 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: celery namespace: pm spec: - template: - spec: - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_2becf38c - env: - - name: USERS_INTERNAL_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: RESOURCES_INTERNAL_HOST - value: http://resources-service.resources.svc.cluster.local:8000 - - name: EAV_HOST - value: http://eav-service.eav.svc.cluster.local:8000 - - name: EAV_API_PREFIX - value: /api/v0 - - name: EAV_API_PREFIX_V1 - value: /api/v1 - - name: LANG - value: C.UTF-8 - - name: LC_ALL - value: C.UTF-8 - - name: PYTHONUTF8 - value: '1' + values: + services: + celery: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_2becf38c + + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + - name: CACHE_ENABLE + value: + _default: "False" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "False" + + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://lk.sarex.io/api/token/public/" + + - name: SERVER_HOST + value: + _default: "https://lk.sarex.io" + + - name: SERVER_API_HOST + value: + _default: "https://api.sarex.io" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" diff --git a/apps/pm/dsinv/kustomization.yaml b/apps/pm/dsinv/kustomization.yaml index 65dd5ff..825915b 100644 --- a/apps/pm/dsinv/kustomization.yaml +++ b/apps/pm/dsinv/kustomization.yaml @@ -8,9 +8,9 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend - path: celery.yaml target: - kind: Deployment + kind: HelmRelease name: celery diff --git a/apps/prescriptions/d8-ugmk-prod/namespace.yaml b/apps/prescriptions/d8-ugmk-prod/namespace.yaml index b591ad0..1ecd7b1 100644 --- a/apps/prescriptions/d8-ugmk-prod/namespace.yaml +++ b/apps/prescriptions/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: prescriptions labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/processing/d8-ugmk-prod/namespace.yaml b/apps/processing/d8-ugmk-prod/namespace.yaml index f2b167e..85f81c0 100644 --- a/apps/processing/d8-ugmk-prod/namespace.yaml +++ b/apps/processing/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: processing labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/projects/d8-ugmk-prod/namespace.yaml b/apps/projects/d8-ugmk-prod/namespace.yaml index 8765f8f..2d9d84c 100644 --- a/apps/projects/d8-ugmk-prod/namespace.yaml +++ b/apps/projects/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: projects labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/remarks/d8-ugmk-prod/namespace.yaml b/apps/remarks/d8-ugmk-prod/namespace.yaml index 8060131..a978585 100644 --- a/apps/remarks/d8-ugmk-prod/namespace.yaml +++ b/apps/remarks/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: remarks labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/reviews/d8-ugmk-prod/namespace.yaml b/apps/reviews/d8-ugmk-prod/namespace.yaml index 721a28c..469b77a 100644 --- a/apps/reviews/d8-ugmk-prod/namespace.yaml +++ b/apps/reviews/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: reviews labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/stamp-verification/d8-ugmk-prod/namespace.yaml b/apps/stamp-verification/d8-ugmk-prod/namespace.yaml index c6c157d..cd1142d 100644 --- a/apps/stamp-verification/d8-ugmk-prod/namespace.yaml +++ b/apps/stamp-verification/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: stamp-verification labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/system-log/d8-ugmk-prod/namespace.yaml b/apps/system-log/d8-ugmk-prod/namespace.yaml index 58875f5..4d234bb 100644 --- a/apps/system-log/d8-ugmk-prod/namespace.yaml +++ b/apps/system-log/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: system-log labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/transmittal/base/backend-deployment.yaml b/apps/transmittal/base/backend-deployment.yaml deleted file mode 100644 index f03dec5..0000000 --- a/apps/transmittal/base/backend-deployment.yaml +++ /dev/null @@ -1,211 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: transmittal - labels: - app: backend - service: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - service: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: transmittal - vault.hashicorp.com/agent-inject-secret-transmittal-db: secrets/data/postgresql/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-db: |- - {{- with secret "secrets/data/postgresql/apps/transmittal" -}} - TRANSMITTAL_SERVICE_DATABASE__USER={{ index .Data.data "username" }} - TRANSMITTAL_SERVICE_DATABASE__PASSWORD={{ index .Data.data "password" }} - TRANSMITTAL_SERVICE_DATABASE__HOST=postgresql.transmittal.svc.cluster.local - TRANSMITTAL_SERVICE_DATABASE__PORT=5432 - TRANSMITTAL_SERVICE_DATABASE__NAME=transmittal_db - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-rabbitmq: secrets/data/rabbitmq/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/transmittal" -}} - TRANSMITTAL_SERVICE_RABBITMQ__USER={{ index .Data.data "username" }} - TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD={{ index .Data.data "password" }} - TRANSMITTAL_SERVICE_RABBITMQ__VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-s3: secrets/data/minio/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-s3: |- - {{- with secret "secrets/data/minio/apps/transmittal" -}} - TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY={{ index .Data.data "access_key" }} - TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY={{ index .Data.data "secret_key" }} - {{- $buckets := index .Data.data "buckets" }} - TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}transmittal-storage{{- end -}} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-transmittal-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED={{ index .Data.data "key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-public-key: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-transmittal-public-key: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY={{ printf "%q" (index .Data.data "public_key") }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-mailgun: secrets/data/vault/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-mailgun: |- - {{- with secret "secrets/data/vault/apps/transmittal" -}} - TRANSMITTAL_SERVICE_MAILGUN__API_KEY={{ index .Data.data "TRANSMITTAL_SERVICE_MAILGUN__API_KEY" }} - {{- end -}} - spec: - serviceAccountName: transmittal-vault - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/transmittal-db ] && . /vault/secrets/transmittal-db - [ -f /vault/secrets/transmittal-rabbitmq ] && . /vault/secrets/transmittal-rabbitmq - [ -f /vault/secrets/transmittal-s3 ] && . /vault/secrets/transmittal-s3 - [ -f /vault/secrets/transmittal-django-auth ] && . /vault/secrets/transmittal-django-auth - [ -f /vault/secrets/transmittal-public-key ] && . /vault/secrets/transmittal-public-key - [ -f /vault/secrets/transmittal-mailgun ] && . /vault/secrets/transmittal-mailgun - set +a - exec scripts/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: TRANSMITTAL_SERVICE_APP__NAME - value: Transmittal Service - - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL - value: ERROR - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL - value: http://backend-svc.flows.svc.cluster.local:80 - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT - value: "30" - - name: TRANSMITTAL_SERVICE_APP__HOST - value: https://sarex.contour.infra.sarex.tech/transmittal - - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT - value: prod - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS - value: "true" - - name: TRANSMITTAL_SERVICE_UVICORN__HOST - value: 0.0.0.0 - - name: TRANSMITTAL_SERVICE_UVICORN__PORT - value: "8000" - - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD - value: "false" - - name: TRANSMITTAL_SERVICE_OTEL__ENABLE - value: "false" - - name: TRANSMITTAL_SERVICE_OTEL__HOST - value: http://signoz-otel-collector-external.signoz.svc.cluster.local:4317 - - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME - value: backend.transmittals-prod - - name: TRANSMITTAL_SERVICE_OTEL__INSECURE - value: "false" - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE - value: verify-full - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH - value: /opt/.postgresql/root.crt - - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL - value: info - - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS - value: "2" - - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH - - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL - value: "false" - - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST - value: rabbitmq.rabbitmq.svc.cluster.local - - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT - value: "5672" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL - value: http://backend-svc.django.svc.cluster.local:80 - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL - value: http://backend-svc.resources.svc.cluster.local:80 - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL - value: http://documentations-api.documentations.svc.cluster.local:8080 - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT - value: "10" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME - value: ru-central1 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY - value: "true" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT - value: minio.minio.svc.cluster.local:9000 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL - value: "false" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL - value: http://export-project-service.django.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL - value: http://marks-service.documentations.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL - value: https://api.mailgun.net/v3/mg.sarex.io - - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL - value: hello@wb.io - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/transmittal/base/backend-service.yaml b/apps/transmittal/base/backend-service.yaml deleted file mode 100644 index 47f7a8d..0000000 --- a/apps/transmittal/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: transmittal -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/transmittal/base/backend.yaml b/apps/transmittal/base/backend.yaml new file mode 100644 index 0000000..84ab267 --- /dev/null +++ b/apps/transmittal/base/backend.yaml @@ -0,0 +1,401 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: transmittal + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: transmittal-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/transmittal-db ] && . /vault/secrets/transmittal-db + [ -f /vault/secrets/transmittal-rabbitmq ] && . /vault/secrets/transmittal-rabbitmq + [ -f /vault/secrets/transmittal-s3 ] && . /vault/secrets/transmittal-s3 + [ -f /vault/secrets/transmittal-django-auth ] && . /vault/secrets/transmittal-django-auth + [ -f /vault/secrets/transmittal-public-key ] && . /vault/secrets/transmittal-public-key + [ -f /vault/secrets/transmittal-mailgun ] && . /vault/secrets/transmittal-mailgun + set +a + exec scripts/entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://sarex.contour.infra.sarex.tech/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.resources.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "minio.minio.svc.cluster.local:9000" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.documentations.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: transmittal + vault.hashicorp.com/agent-inject-secret-transmittal-db: secrets/data/postgresql/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-db: |- + {{- with secret "secrets/data/postgresql/apps/transmittal" -}} + TRANSMITTAL_SERVICE_DATABASE__USER={{ index .Data.data "username" }} + TRANSMITTAL_SERVICE_DATABASE__PASSWORD={{ index .Data.data "password" }} + TRANSMITTAL_SERVICE_DATABASE__HOST=postgresql.transmittal.svc.cluster.local + TRANSMITTAL_SERVICE_DATABASE__PORT=5432 + TRANSMITTAL_SERVICE_DATABASE__NAME=transmittal_db + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-rabbitmq: secrets/data/rabbitmq/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/transmittal" -}} + TRANSMITTAL_SERVICE_RABBITMQ__USER={{ index .Data.data "username" }} + TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD={{ index .Data.data "password" }} + TRANSMITTAL_SERVICE_RABBITMQ__VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-s3: secrets/data/minio/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-s3: |- + {{- with secret "secrets/data/minio/apps/transmittal" -}} + TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY={{ index .Data.data "access_key" }} + TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY={{ index .Data.data "secret_key" }} + {{- $buckets := index .Data.data "buckets" }} + TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}transmittal-storage{{- end -}} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-transmittal-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-public-key: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-transmittal-public-key: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY={{ printf "%q" (index .Data.data "public_key") }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-mailgun: secrets/data/vault/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-mailgun: |- + {{- with secret "secrets/data/vault/apps/transmittal" -}} + TRANSMITTAL_SERVICE_MAILGUN__API_KEY={{ index .Data.data "TRANSMITTAL_SERVICE_MAILGUN__API_KEY" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/transmittal/base/frontend-deployment.yaml b/apps/transmittal/base/frontend-deployment.yaml deleted file mode 100644 index cd346e5..0000000 --- a/apps/transmittal/base/frontend-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: transmittal - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:wb1_dbf61443 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/transmittal/base/frontend-service.yaml b/apps/transmittal/base/frontend-service.yaml deleted file mode 100644 index 9bdeadb..0000000 --- a/apps/transmittal/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: transmittal -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/transmittal/base/frontend.yaml b/apps/transmittal/base/frontend.yaml new file mode 100644 index 0000000..b886bf1 --- /dev/null +++ b/apps/transmittal/base/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: transmittal + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:wb1_dbf61443 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/transmittal/base/kustomization.yaml b/apps/transmittal/base/kustomization.yaml index 0356b25..b2993ef 100644 --- a/apps/transmittal/base/kustomization.yaml +++ b/apps/transmittal/base/kustomization.yaml @@ -4,9 +4,6 @@ kind: Kustomization namespace: transmittal resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - worker-deployment.yaml - - frontend-deployment.yaml - - backend-service.yaml - - frontend-service.yaml + - backend.yaml + - worker.yaml + - frontend.yaml diff --git a/apps/transmittal/base/serviceaccount.yaml b/apps/transmittal/base/serviceaccount.yaml deleted file mode 100644 index cb9d042..0000000 --- a/apps/transmittal/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: transmittal-vault - namespace: transmittal diff --git a/apps/transmittal/base/worker-deployment.yaml b/apps/transmittal/base/worker-deployment.yaml deleted file mode 100644 index ea01603..0000000 --- a/apps/transmittal/base/worker-deployment.yaml +++ /dev/null @@ -1,211 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: worker - namespace: transmittal - labels: - app: worker - service: worker -spec: - replicas: 1 - selector: - matchLabels: - app: worker - template: - metadata: - labels: - app: worker - service: worker - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: transmittal - vault.hashicorp.com/agent-inject-secret-transmittal-db: secrets/data/postgresql/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-db: |- - {{- with secret "secrets/data/postgresql/apps/transmittal" -}} - TRANSMITTAL_SERVICE_DATABASE__USER={{ index .Data.data "username" }} - TRANSMITTAL_SERVICE_DATABASE__PASSWORD={{ index .Data.data "password" }} - TRANSMITTAL_SERVICE_DATABASE__HOST=postgresql.transmittal.svc.cluster.local - TRANSMITTAL_SERVICE_DATABASE__PORT=5432 - TRANSMITTAL_SERVICE_DATABASE__NAME=transmittal_db - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-rabbitmq: secrets/data/rabbitmq/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/transmittal" -}} - TRANSMITTAL_SERVICE_RABBITMQ__USER={{ index .Data.data "username" }} - TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD={{ index .Data.data "password" }} - TRANSMITTAL_SERVICE_RABBITMQ__VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-s3: secrets/data/minio/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-s3: |- - {{- with secret "secrets/data/minio/apps/transmittal" -}} - TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY={{ index .Data.data "access_key" }} - TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY={{ index .Data.data "secret_key" }} - {{- $buckets := index .Data.data "buckets" }} - TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}transmittal-storage{{- end -}} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-transmittal-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED={{ index .Data.data "key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-public-key: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-transmittal-public-key: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY={{ printf "%q" (index .Data.data "public_key") }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-mailgun: secrets/data/vault/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-mailgun: |- - {{- with secret "secrets/data/vault/apps/transmittal" -}} - TRANSMITTAL_SERVICE_MAILGUN__API_KEY={{ index .Data.data "TRANSMITTAL_SERVICE_MAILGUN__API_KEY" }} - {{- end -}} - spec: - serviceAccountName: transmittal-vault - containers: - - name: worker - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/transmittal-db ] && . /vault/secrets/transmittal-db - [ -f /vault/secrets/transmittal-rabbitmq ] && . /vault/secrets/transmittal-rabbitmq - [ -f /vault/secrets/transmittal-s3 ] && . /vault/secrets/transmittal-s3 - [ -f /vault/secrets/transmittal-django-auth ] && . /vault/secrets/transmittal-django-auth - [ -f /vault/secrets/transmittal-public-key ] && . /vault/secrets/transmittal-public-key - [ -f /vault/secrets/transmittal-mailgun ] && . /vault/secrets/transmittal-mailgun - set +a - exec taskiq worker --no-parse transmittal_service.tasks.broker:broker transmittal_service.tasks.transmittal.tasks transmittal_service.tasks.email.tasks - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL - value: http://backend-svc.flows.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT - value: "30" - - name: TRANSMITTAL_SERVICE_APP__NAME - value: Transmittal Service - - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL - value: ERROR - - name: TRANSMITTAL_SERVICE_APP__HOST - value: https://lk.srx.wb.ru:30443/transmittal - - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT - value: prod - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS - value: "true" - - name: TRANSMITTAL_SERVICE_UVICORN__HOST - value: 0.0.0.0 - - name: TRANSMITTAL_SERVICE_UVICORN__PORT - value: "8000" - - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD - value: "false" - - name: TRANSMITTAL_SERVICE_OTEL__ENABLE - value: "false" - - name: TRANSMITTAL_SERVICE_OTEL__HOST - value: http://signoz-otel-collector-external.signoz.svc.cluster.local:4317 - - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME - value: backend.transmittals-prod - - name: TRANSMITTAL_SERVICE_OTEL__INSECURE - value: "false" - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE - value: verify-full - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH - value: /opt/.postgresql/root.crt - - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL - value: info - - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS - value: "2" - - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH - - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL - value: "false" - - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST - value: rabbitmq.rabbitmq.svc.cluster.local - - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT - value: "5672" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL - value: http://backend.django.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL - value: http://resources-service.resources.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL - value: http://documentations-api.documentations.svc.cluster.local:8080 - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT - value: "10" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME - value: ru-central1 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY - value: "true" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT - value: minio.minio.svc.cluster.local:9000 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL - value: "false" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL - value: http://export-project-service.django.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL - value: http://marks-service.documentations.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL - value: https://api.mailgun.net/v3/mg.sarex.io - - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL - value: hello@wb.io - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/transmittal/base/worker.yaml b/apps/transmittal/base/worker.yaml new file mode 100644 index 0000000..53efb7a --- /dev/null +++ b/apps/transmittal/base/worker.yaml @@ -0,0 +1,386 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: worker + namespace: transmittal + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + worker: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: transmittal-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: worker + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/transmittal-db ] && . /vault/secrets/transmittal-db + [ -f /vault/secrets/transmittal-rabbitmq ] && . /vault/secrets/transmittal-rabbitmq + [ -f /vault/secrets/transmittal-s3 ] && . /vault/secrets/transmittal-s3 + [ -f /vault/secrets/transmittal-django-auth ] && . /vault/secrets/transmittal-django-auth + [ -f /vault/secrets/transmittal-public-key ] && . /vault/secrets/transmittal-public-key + [ -f /vault/secrets/transmittal-mailgun ] && . /vault/secrets/transmittal-mailgun + set +a + exec taskiq worker --no-parse transmittal_service.tasks.broker:broker transmittal_service.tasks.transmittal.tasks transmittal_service.tasks.email.tasks + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://lk.srx.wb.ru:30443/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "minio.minio.svc.cluster.local:9000" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.documentations.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: transmittal + vault.hashicorp.com/agent-inject-secret-transmittal-db: secrets/data/postgresql/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-db: |- + {{- with secret "secrets/data/postgresql/apps/transmittal" -}} + TRANSMITTAL_SERVICE_DATABASE__USER={{ index .Data.data "username" }} + TRANSMITTAL_SERVICE_DATABASE__PASSWORD={{ index .Data.data "password" }} + TRANSMITTAL_SERVICE_DATABASE__HOST=postgresql.transmittal.svc.cluster.local + TRANSMITTAL_SERVICE_DATABASE__PORT=5432 + TRANSMITTAL_SERVICE_DATABASE__NAME=transmittal_db + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-rabbitmq: secrets/data/rabbitmq/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/transmittal" -}} + TRANSMITTAL_SERVICE_RABBITMQ__USER={{ index .Data.data "username" }} + TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD={{ index .Data.data "password" }} + TRANSMITTAL_SERVICE_RABBITMQ__VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-s3: secrets/data/minio/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-s3: |- + {{- with secret "secrets/data/minio/apps/transmittal" -}} + TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY={{ index .Data.data "access_key" }} + TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY={{ index .Data.data "secret_key" }} + {{- $buckets := index .Data.data "buckets" }} + TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}transmittal-storage{{- end -}} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-transmittal-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-public-key: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-transmittal-public-key: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY={{ printf "%q" (index .Data.data "public_key") }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-mailgun: secrets/data/vault/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-mailgun: |- + {{- with secret "secrets/data/vault/apps/transmittal" -}} + TRANSMITTAL_SERVICE_MAILGUN__API_KEY={{ index .Data.data "TRANSMITTAL_SERVICE_MAILGUN__API_KEY" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/transmittal/d8-ugmk-prod/kustomization.yaml b/apps/transmittal/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..eed0fa0 --- /dev/null +++ b/apps/transmittal/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: transmittal diff --git a/apps/transmittal/d8-ugmk-prod/namespace.yaml b/apps/transmittal/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..0d819a0 --- /dev/null +++ b/apps/transmittal/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: transmittal + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/transmittal/dsinv/backend.yaml b/apps/transmittal/dsinv/backend.yaml index 586d271..5e272f0 100644 --- a/apps/transmittal/dsinv/backend.yaml +++ b/apps/transmittal/dsinv/backend.yaml @@ -1,129 +1,286 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: transmittal spec: - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4de0b503 - env: - - name: TRANSMITTAL_SERVICE_SMTP__ENABLE_TLS - value: 'false' - - name: TRANSMITTAL_SERVICE_SMTP__HOST - value: relay.dsinv.ru - - name: TRANSMITTAL_SERVICE_SMTP__PORT - value: '25' - - name: TRANSMITTAL_SERVICE_SMTP__EMAIL - value: sarex@dsinv.ru - - name: TRANSMITTAL_SERVICE_APP__NAME - value: Transmittal Service - - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL - value: ERROR - - name: TRANSMITTAL_SERVICE_APP__HOST - value: https://sarex.dsinv.ru/transmittal - - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT - value: prod - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS - value: '["https://lk.sarex.io", "lk.sarex.io"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS - value: 'true' - - name: TRANSMITTAL_SERVICE_UVICORN__HOST - value: 0.0.0.0 - - name: TRANSMITTAL_SERVICE_UVICORN__PORT - value: '8000' - - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD - value: 'false' - - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL - value: info - - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS - value: '2' - - name: TRANSMITTAL_SERVICE_DATABASE__HOST - value: postgres-service - - name: TRANSMITTAL_SERVICE_DATABASE__PORT - value: '5432' - - name: TRANSMITTAL_SERVICE_DATABASE__NAME - value: transmittals - - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL - value: 'false' - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE - value: verify-full - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH - value: /opt/.postgresql/root.crt - - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST - value: api - - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST - value: rabbitmq-service - - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT - value: '5672' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL - value: https://sarex.dsinv.ru - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL - value: http://sarex-resources-service.resources-prod - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL - value: http://documentations-service.documentations-prod - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT - value: '10' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME - value: ru-central1 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY - value: 'false' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET - value: transmittal-storage - - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT - value: minio-service.minio.svc.cluster.local:9000 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL - value: 'false' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL - value: http://export-project-service.django.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL - value: http://marks-service.workflow.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_OTEL__ENABLE - value: 'false' - - name: TRANSMITTAL_SERVICE_OTEL__HOST - value: http://signoz-otel-collector-external.signoz.svc.cluster.local:4317 - - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME - value: backend.transmittals-prod - - name: TRANSMITTAL_SERVICE_OTEL__INSECURE - value: 'false' + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4de0b503 + + envs: + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://sarex.dsinv.ru/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["https://lk.sarex.io", "lk.sarex.io"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq-service" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "https://sarex.dsinv.ru" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://sarex-resources-service.resources-prod" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://documentations-service.documentations-prod" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "minio-service.minio.svc.cluster.local:9000" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.workflow.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + + - name: TRANSMITTAL_SERVICE_SMTP__ENABLE_TLS + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_SMTP__HOST + value: + _default: "relay.dsinv.ru" + + - name: TRANSMITTAL_SERVICE_SMTP__PORT + value: + _default: "25" + + - name: TRANSMITTAL_SERVICE_SMTP__EMAIL + value: + _default: "sarex@dsinv.ru" + + - name: TRANSMITTAL_SERVICE_DATABASE__HOST + value: + _default: "postgres-service" + + - name: TRANSMITTAL_SERVICE_DATABASE__PORT + value: + _default: "5432" + + - name: TRANSMITTAL_SERVICE_DATABASE__NAME + value: + _default: "transmittals" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST + value: + _default: "api" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET + value: + _default: "transmittal-storage" diff --git a/apps/transmittal/dsinv/frontend.yaml b/apps/transmittal/dsinv/frontend.yaml index 2095754..bb3a1fe 100644 --- a/apps/transmittal/dsinv/frontend.yaml +++ b/apps/transmittal/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: transmittal spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:4c915d45 + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:4c915d45 diff --git a/apps/transmittal/dsinv/kustomization.yaml b/apps/transmittal/dsinv/kustomization.yaml index 2553b7b..a6599fa 100644 --- a/apps/transmittal/dsinv/kustomization.yaml +++ b/apps/transmittal/dsinv/kustomization.yaml @@ -7,13 +7,13 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend - path: worker.yaml target: - kind: Deployment + kind: HelmRelease name: worker diff --git a/apps/transmittal/dsinv/worker.yaml b/apps/transmittal/dsinv/worker.yaml index 90a0130..467d2e2 100644 --- a/apps/transmittal/dsinv/worker.yaml +++ b/apps/transmittal/dsinv/worker.yaml @@ -1,129 +1,286 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: worker namespace: transmittal spec: - template: - spec: - containers: - - name: worker - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4de0b503 - env: - - name: TRANSMITTAL_SERVICE_SMTP__ENABLE_TLS - value: 'false' - - name: TRANSMITTAL_SERVICE_SMTP__HOST - value: relay.dsinv.ru - - name: TRANSMITTAL_SERVICE_SMTP__PORT - value: '25' - - name: TRANSMITTAL_SERVICE_SMTP__EMAIL - value: sarex@dsinv.ru - - name: TRANSMITTAL_SERVICE_APP__NAME - value: Transmittal Service - - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL - value: ERROR - - name: TRANSMITTAL_SERVICE_APP__HOST - value: https://sarex.dsinv.ru/transmittal - - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT - value: prod - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS - value: '["https://lk.sarex.io", "lk.sarex.io"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS - value: 'true' - - name: TRANSMITTAL_SERVICE_UVICORN__HOST - value: 0.0.0.0 - - name: TRANSMITTAL_SERVICE_UVICORN__PORT - value: '8000' - - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD - value: 'false' - - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL - value: info - - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS - value: '2' - - name: TRANSMITTAL_SERVICE_DATABASE__HOST - value: postgres-service - - name: TRANSMITTAL_SERVICE_DATABASE__PORT - value: '5432' - - name: TRANSMITTAL_SERVICE_DATABASE__NAME - value: transmittals - - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL - value: 'false' - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE - value: verify-full - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH - value: /opt/.postgresql/root.crt - - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST - value: api - - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST - value: rabbitmq-service - - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT - value: '5672' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL - value: https://sarex.dsinv.ru - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL - value: http://sarex-resources-service.resources-prod - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL - value: http://documentations-service.documentations-prod - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT - value: '10' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME - value: ru-central1 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY - value: 'false' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET - value: transmittal-storage - - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT - value: minio-service.minio.svc.cluster.local:9000 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL - value: 'false' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL - value: http://export-project-service.django.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL - value: http://marks-service.workflow.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_OTEL__ENABLE - value: 'false' - - name: TRANSMITTAL_SERVICE_OTEL__HOST - value: http://signoz-otel-collector-external.signoz.svc.cluster.local:4317 - - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME - value: backend.transmittals-prod - - name: TRANSMITTAL_SERVICE_OTEL__INSECURE - value: 'false' + values: + services: + worker: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4de0b503 + + envs: + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://sarex.dsinv.ru/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["https://lk.sarex.io", "lk.sarex.io"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq-service" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "https://sarex.dsinv.ru" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://sarex-resources-service.resources-prod" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://documentations-service.documentations-prod" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "minio-service.minio.svc.cluster.local:9000" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.workflow.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + + - name: TRANSMITTAL_SERVICE_SMTP__ENABLE_TLS + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_SMTP__HOST + value: + _default: "relay.dsinv.ru" + + - name: TRANSMITTAL_SERVICE_SMTP__PORT + value: + _default: "25" + + - name: TRANSMITTAL_SERVICE_SMTP__EMAIL + value: + _default: "sarex@dsinv.ru" + + - name: TRANSMITTAL_SERVICE_DATABASE__HOST + value: + _default: "postgres-service" + + - name: TRANSMITTAL_SERVICE_DATABASE__PORT + value: + _default: "5432" + + - name: TRANSMITTAL_SERVICE_DATABASE__NAME + value: + _default: "transmittals" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST + value: + _default: "api" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET + value: + _default: "transmittal-storage" diff --git a/clusters/d8-ugmk-prod/kustomization.yaml b/clusters/d8-ugmk-prod/kustomization.yaml index bede3ef..7294059 100644 --- a/clusters/d8-ugmk-prod/kustomization.yaml +++ b/clusters/d8-ugmk-prod/kustomization.yaml @@ -42,4 +42,12 @@ resources: - ../../apps/prescriptions/d8-ugmk-prod - ../../apps/mapper/d8-ugmk-prod - ../../apps/stamp-verification/d8-ugmk-prod - - ../../apps/document-link/d8-ugmk-prod \ No newline at end of file + - ../../apps/document-link/d8-ugmk-prod + - ../../apps/bim/d8-ugmk-prod + - ../../apps/cde/d8-ugmk-prod + - ../../apps/flows/d8-ugmk-prod + - ../../apps/inspections/d8-ugmk-prod + - ../../apps/issues/d8-ugmk-prod + - ../../apps/pm/d8-ugmk-prod + - ../../apps/message-hub/d8-ugmk-prod + - ../../apps/transmittal/d8-ugmk-prod \ No newline at end of file