diff --git a/apps/documentations/base/api-deployment.yaml b/apps/documentations/base/api-deployment.yaml deleted file mode 100644 index d73a8b8..0000000 --- a/apps/documentations/base/api-deployment.yaml +++ /dev/null @@ -1,173 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: documentations-api - namespace: documentations - labels: - app: documentations-api - service: documentations-api -spec: - replicas: 1 - selector: - matchLabels: - app: documentations-api - template: - metadata: - labels: - app: documentations-api - service: documentations-api - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: documentations - vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres - vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- - {{- with secret "secrets/data/apps/documentations/postgres" -}} - POSTGRES_ADDRESS={{ index .Data.data "host" }} - POSTGRES_PORT={{ index .Data.data "port" }} - POSTGRES_DB={{ index .Data.data "database" }} - POSTGRES_USER={{ index .Data.data "username" }} - POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-common: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_BASIC_AUTH={{ index .Data.data "key" }} - DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }} - DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - {{ index .Data.data "documentations_s3_service_account_json" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - {{ index .Data.data "documentations_zitadel_account_json" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: documentations-vault - containers: - - name: documentations-api - image: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql - [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common - [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" - set +a - exec /app/entrypoint.sh - ports: - - name: http - containerPort: 8080 - protocol: TCP - env: - - name: POSTGRES_POOL_SIZE - value: "20" - - name: ZITADEL_ACCOUNT - value: /vault/secrets/documentations-zitadel-account-json - - name: ZITADEL_DOMAIN - value: zitadel-srx.wb.ru - - name: USE_ZITADEL - value: "0" - - name: FLOWS_URL - value: http://backend-svc.flows.svc.cluster.local:80 - - name: LAST_MASTER_BIM - value: "36311" - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES - value: "5" - - name: ENABLE_SQL_QUERY - value: "0" - - name: ENABLE_SSL - value: "0" - - name: WORKSPACE_V2_EXTERNAL_URL - value: https://sarex.contour.infra.sarex.tech/workspaces-v2/ - - name: ENABLE_S3 - value: "1" - - name: CONTAINER_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: ENVIRONMENT - value: production - - name: LAST_SLAVE_1_BIM - value: "1000000" - - name: HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80 - - name: FILE_STREAM_HOST - value: sarex.contour.infra.sarex.tech - - name: DOCUMENTATION_URL - value: http://documentations-api.documentations.svc.cluster.local:80/ - - name: WORKFLOW_URL - value: http://backend-svc.processing.svc.cluster.local:80/ - - name: WORKSPACE_URL - value: http://backend-svc.workspaces.svc.cluster.local:80/ - - name: BIM_API_URL - value: http://bim-api-service.bim.svc.cluster.local:8080/ - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: SYSTEM_LOG_URL - value: http://backend-svc.system-log.svc.cluster.local:80 - - name: DJANGO_HOST - value: http://backend-svc.django.svc.cluster.local:80 - - name: MARKS_PROCESSING_URL - value: http://marks-service:8000 - - name: PUBLIC_LINK_HOST - value: https://document-link-srx.wb.ru - - name: NAMESPACE - value: documentations - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: S3_SERVICE_ACCOUNT - value: /vault/secrets/documentations-s3-account-json - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: ENABLE_SMTP - value: "True" - - name: ENABLE_MAILGUN - value: "False" - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: ENABLE_AUTH_JWT_IN_URL - value: "true" - - name: ENABLE_SIGNATURE_IN_URL - value: "false" - - name: USE_CACHE_IN_FILE_STREAMER - value: "0" - - name: VALKEY_ADDR - value: redis:6379 - - name: VALKEY_HOST - value: redis - - name: VALKEY_PORT - value: "6379" - - resources: - requests: - cpu: "25m" - memory: 128Mi - - imagePullSecrets: - - name: regcred diff --git a/apps/documentations/base/api-service.yaml b/apps/documentations/base/api-service.yaml deleted file mode 100644 index de58aea..0000000 --- a/apps/documentations/base/api-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-api-svc - namespace: documentations -spec: - type: ClusterIP - selector: - app: documentations-api - ports: - - name: http - port: 80 - targetPort: 8080 - protocol: TCP diff --git a/apps/documentations/base/api.yaml b/apps/documentations/base/api.yaml new file mode 100644 index 0000000..1b4f85d --- /dev/null +++ b/apps/documentations/base/api.yaml @@ -0,0 +1,258 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-api + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: documentations-vault + deployment: + enabled: true + name: + _default: documentations-api + replicaCount: + _default: 1 + port: + _default: 8080 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql + [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common + [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" + set +a + exec /app/entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-api-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8080 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: ZITADEL_ACCOUNT + value: + _default: /vault/secrets/documentations-zitadel-account-json + - name: ZITADEL_DOMAIN + value: + _default: zitadel-srx.wb.ru + - name: USE_ZITADEL + value: + _default: "0" + - name: FLOWS_URL + value: + _default: http://backend-svc.flows.svc.cluster.local:80 + - name: LAST_MASTER_BIM + value: + _default: "36311" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: WORKSPACE_V2_EXTERNAL_URL + value: + _default: https://sarex.contour.infra.sarex.tech/workspaces-v2/ + - name: ENABLE_S3 + value: + _default: "1" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: LAST_SLAVE_1_BIM + value: + _default: "1000000" + - name: HOST + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80 + - name: FILE_STREAM_HOST + value: + _default: sarex.contour.infra.sarex.tech + - name: DOCUMENTATION_URL + value: + _default: http://documentations-api.documentations.svc.cluster.local:80/ + - name: WORKFLOW_URL + value: + _default: http://backend-svc.processing.svc.cluster.local:80/ + - name: WORKSPACE_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + - name: BIM_API_URL + value: + _default: http://bim-api-service.bim.svc.cluster.local:8080/ + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: SYSTEM_LOG_URL + value: + _default: http://backend-svc.system-log.svc.cluster.local:80 + - name: DJANGO_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: MARKS_PROCESSING_URL + value: + _default: http://marks-service:8000 + - name: PUBLIC_LINK_HOST + value: + _default: https://document-link-srx.wb.ru + - name: NAMESPACE + value: + _default: documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: S3_SERVICE_ACCOUNT + value: + _default: /vault/secrets/documentations-s3-account-json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: ENABLE_SMTP + value: + _default: "True" + - name: ENABLE_MAILGUN + value: + _default: "False" + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: ENABLE_AUTH_JWT_IN_URL + value: + _default: "true" + - name: ENABLE_SIGNATURE_IN_URL + value: + _default: "false" + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "0" + - name: VALKEY_ADDR + value: + _default: redis:6379 + - name: VALKEY_HOST + value: + _default: redis + - name: VALKEY_PORT + value: + _default: "6379" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} + POSTGRES_USER={{ index .Data.data "username" }} + POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-common: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_BASIC_AUTH={{ index .Data.data "key" }} + DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }} + DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + {{ index .Data.data "documentations_s3_service_account_json" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + {{ index .Data.data "documentations_zitadel_account_json" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} diff --git a/apps/documentations/base/filestream-deployment.yaml b/apps/documentations/base/filestream-deployment.yaml deleted file mode 100644 index 6eb1ad7..0000000 --- a/apps/documentations/base/filestream-deployment.yaml +++ /dev/null @@ -1,173 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: documentations-filestream - namespace: documentations - labels: - app: documentations-filestream - service: documentations-filestream -spec: - replicas: 1 - selector: - matchLabels: - app: documentations-filestream - template: - metadata: - labels: - app: documentations-filestream - service: documentations-filestream - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: documentations - vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres - vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- - {{- with secret "secrets/data/apps/documentations/postgres" -}} - POSTGRES_ADDRESS={{ index .Data.data "host" }} - POSTGRES_PORT={{ index .Data.data "port" }} - POSTGRES_DB={{ index .Data.data "database" }} - POSTGRES_USER={{ index .Data.data "username" }} - POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-common: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_BASIC_AUTH={{ index .Data.data "key" }} - DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }} - DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - {{ index .Data.data "documentations_s3_service_account_json" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - {{ index .Data.data "documentations_zitadel_account_json" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: documentations-vault - containers: - - name: documentations-filestream - image: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql - [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common - [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" - set +a - exec /app/file_entrypoint.sh - ports: - - name: http - containerPort: 8080 - protocol: TCP - env: - - name: POSTGRES_POOL_SIZE - value: "20" - - name: ZITADEL_ACCOUNT - value: /vault/secrets/documentations-zitadel-account-json - - name: ZITADEL_DOMAIN - value: zitadel-srx.wb.ru - - name: USE_ZITADEL - value: "0" - - name: FLOWS_URL - value: http://backend-svc.flows.svc.cluster.local:80 - - name: LAST_MASTER_BIM - value: "36311" - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES - value: "5" - - name: ENABLE_SQL_QUERY - value: "0" - - name: ENABLE_SSL - value: "0" - - name: WORKSPACE_V2_EXTERNAL_URL - value: https://srx.wb.ru/workspaces-v2/ - - name: ENABLE_S3 - value: "1" - - name: CONTAINER_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: ENVIRONMENT - value: production - - name: LAST_SLAVE_1_BIM - value: "1000000" - - name: HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80 - - name: FILE_STREAM_HOST - value: srx.wb.ru - - name: DOCUMENTATION_URL - value: http://backend-api-svc.documentations.svc.cluster.local:80/ - - name: WORKFLOW_URL - value: http://workflows-api-service.workflow.svc.cluster.local:8000/ - - name: WORKSPACE_URL - value: http://backend-svc.workspaces.svc.cluster.local:80/ - - name: BIM_API_URL - value: http://bim-api-service.bim.svc.cluster.local:8080/ - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: SYSTEM_LOG_URL - value: http://api-service.system-log.svc.cluster.local:80 - - name: DJANGO_HOST - value: http://backend-svc.django.svc.cluster.local:80 - - name: MARKS_PROCESSING_URL - value: http://marks-service:8000 - - name: PUBLIC_LINK_HOST - value: https://document-link-srx.wb.ru - - name: NAMESPACE - value: documentations - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: S3_SERVICE_ACCOUNT - value: /vault/secrets/documentations-s3-account-json - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: ENABLE_SMTP - value: "True" - - name: ENABLE_MAILGUN - value: "False" - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: ENABLE_AUTH_JWT_IN_URL - value: "false" - - name: ENABLE_SIGNATURE_IN_URL - value: "true" - - name: USE_CACHE_IN_FILE_STREAMER - value: "0" - - name: VALKEY_ADDR - value: redis:6379 - - name: VALKEY_HOST - value: redis - - name: VALKEY_PORT - value: "6379" - - resources: - requests: - cpu: "25m" - memory: 128Mi - - imagePullSecrets: - - name: regcred diff --git a/apps/documentations/base/filestream-service.yaml b/apps/documentations/base/filestream-service.yaml deleted file mode 100644 index 5d16767..0000000 --- a/apps/documentations/base/filestream-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-filestream-svc - namespace: documentations -spec: - type: ClusterIP - selector: - app: documentations-filestream - ports: - - name: http - port: 80 - targetPort: 8080 - protocol: TCP diff --git a/apps/documentations/base/filestream.yaml b/apps/documentations/base/filestream.yaml new file mode 100644 index 0000000..da261ed --- /dev/null +++ b/apps/documentations/base/filestream.yaml @@ -0,0 +1,258 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-filestream + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: documentations-vault + deployment: + enabled: true + name: + _default: documentations-filestream + replicaCount: + _default: 1 + port: + _default: 8080 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql + [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common + [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" + set +a + exec /app/file_entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-filestream-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8080 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: ZITADEL_ACCOUNT + value: + _default: /vault/secrets/documentations-zitadel-account-json + - name: ZITADEL_DOMAIN + value: + _default: zitadel-srx.wb.ru + - name: USE_ZITADEL + value: + _default: "0" + - name: FLOWS_URL + value: + _default: http://backend-svc.flows.svc.cluster.local:80 + - name: LAST_MASTER_BIM + value: + _default: "36311" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: WORKSPACE_V2_EXTERNAL_URL + value: + _default: https://srx.wb.ru/workspaces-v2/ + - name: ENABLE_S3 + value: + _default: "1" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: LAST_SLAVE_1_BIM + value: + _default: "1000000" + - name: HOST + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80 + - name: FILE_STREAM_HOST + value: + _default: srx.wb.ru + - name: DOCUMENTATION_URL + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80/ + - name: WORKFLOW_URL + value: + _default: http://workflows-api-service.workflow.svc.cluster.local:8000/ + - name: WORKSPACE_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + - name: BIM_API_URL + value: + _default: http://bim-api-service.bim.svc.cluster.local:8080/ + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: SYSTEM_LOG_URL + value: + _default: http://api-service.system-log.svc.cluster.local:80 + - name: DJANGO_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: MARKS_PROCESSING_URL + value: + _default: http://marks-service:8000 + - name: PUBLIC_LINK_HOST + value: + _default: https://document-link-srx.wb.ru + - name: NAMESPACE + value: + _default: documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: S3_SERVICE_ACCOUNT + value: + _default: /vault/secrets/documentations-s3-account-json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: ENABLE_SMTP + value: + _default: "True" + - name: ENABLE_MAILGUN + value: + _default: "False" + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: ENABLE_AUTH_JWT_IN_URL + value: + _default: "false" + - name: ENABLE_SIGNATURE_IN_URL + value: + _default: "true" + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "0" + - name: VALKEY_ADDR + value: + _default: redis:6379 + - name: VALKEY_HOST + value: + _default: redis + - name: VALKEY_PORT + value: + _default: "6379" + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} + POSTGRES_USER={{ index .Data.data "username" }} + POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-common: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_BASIC_AUTH={{ index .Data.data "key" }} + DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }} + DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + {{ index .Data.data "documentations_s3_service_account_json" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + {{ index .Data.data "documentations_zitadel_account_json" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} diff --git a/apps/documentations/base/frontend-deployment.yaml b/apps/documentations/base/frontend-deployment.yaml deleted file mode 100644 index 182ab5c..0000000 --- a/apps/documentations/base/frontend-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: documentations - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ae1bb076 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/documentations/base/frontend-service.yaml b/apps/documentations/base/frontend-service.yaml deleted file mode 100644 index 3b8eb8d..0000000 --- a/apps/documentations/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: documentations -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/documentations/base/frontend.yaml b/apps/documentations/base/frontend.yaml new file mode 100644 index 0000000..2698745 --- /dev/null +++ b/apps/documentations/base/frontend.yaml @@ -0,0 +1,70 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + frontend: + enabled: true + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ae1bb076 + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + name: + _default: frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + service: + enabled: true + name: + _default: frontend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/documentations/base/kustomization.yaml b/apps/documentations/base/kustomization.yaml index 2f212c2..bfc0086 100644 --- a/apps/documentations/base/kustomization.yaml +++ b/apps/documentations/base/kustomization.yaml @@ -4,12 +4,7 @@ kind: Kustomization namespace: documentations resources: - namespace.yaml - - serviceaccount.yaml - - api-deployment.yaml - - pdm-deployment.yaml - - filestream-deployment.yaml - - frontend-deployment.yaml - - api-service.yaml - - pdm-service.yaml - - filestream-service.yaml - - frontend-service.yaml + - api.yaml + - filestream.yaml + - frontend.yaml + - pdm.yaml diff --git a/apps/documentations/base/pdm-deployment.yaml b/apps/documentations/base/pdm-deployment.yaml deleted file mode 100644 index 4f42858..0000000 --- a/apps/documentations/base/pdm-deployment.yaml +++ /dev/null @@ -1,181 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: pdm-api - namespace: documentations - labels: - app: pdm-api - service: pdm-api -spec: - replicas: 1 - selector: - matchLabels: - app: pdm-api - template: - metadata: - labels: - app: pdm-api - service: pdm-api - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: documentations - vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres - vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- - {{- with secret "secrets/data/apps/documentations/postgres" -}} - POSTGRES_ADDRESS={{ index .Data.data "host" }} - POSTGRES_PORT={{ index .Data.data "port" }} - POSTGRES_DB={{ index .Data.data "database" }} - POSTGRES_USER={{ index .Data.data "username" }} - POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-common: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_BASIC_AUTH={{ index .Data.data "key" }} - RELEASES_TOKEN={{ index .Data.data "documentations_releases_token" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - {{ index .Data.data "documentations_s3_service_account_json" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: documentations-vault - containers: - - name: pdm-api - image: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql - [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common - [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" - set +a - exec ./httpserver - ports: - - name: http - containerPort: 8080 - protocol: TCP - env: - - name: USE_EXPERIMENTAL - value: "true" - - name: POSTGRES_POOL_SIZE - value: "20" - - name: TRANSMITTALS_BASE_URL - value: mock - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: BUCKET_NAME - value: attachments-storage - - name: API_HOST_PREFIX - value: / - - name: APP_NAME - value: pdm_v2 - - name: APP_VERSION - value: 0.0.1 - - name: ENABLE_PERMISSIONS_FILTER - value: "1" - - name: PERMISSIONS_FILTER_COMPANIES - value: '[1]' - - name: TRANSMITTALS_ENABLE - value: "false" - - name: DRAWINGS_INTERNAL_URL - value: http://drawings-api-service.drawings.svc.cluster.local:80 - - name: ATTACHMENTS_URL - value: http://attachments-service.attachments.svc.cluster.local:8000 - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: BIM_V2_HOST - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: DJANGO_HOST - value: http://backend-svc.django.svc.cluster.local:80 - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: DOCUMENTATION_URL - value: http://backend-api-svc.documentations.svc.cluster.local:80/ - - name: EAV_URL - value: http://backend-svc.eav.svc.cluster.local:80 - - name: ENABLE_OBSERVABILITY - value: "false" - - name: ENABLE_S3 - value: "1" - - name: ENABLE_SSL - value: "0" - - name: ENVIRONMENT - value: prod - - name: FLOWS_URL - value: http://backend-svc.flows.svc.cluster.local:80 - - name: HEIGHT_THUMB_ATTACHMENTS - value: "300" - - name: HEIGHT_THUMB_STATES - value: "73" - - name: HTTP_PORT - value: "8080" - - name: INSPECTIONS_URL - value: http://inspections-service.inspections.svc.cluster.local:80 - - name: LOG_LEVEL - value: INFO - - name: NOTES_URL - - name: OBSERVABILITY_COLLECTOR_ENDPOINT - value: temp - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: RELEASES_URL - value: https://gitlab.com - - name: REMARKS_URL - value: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks - - name: RESOURCES_URL - value: http://backend-svc.resources.svc.cluster.local:80 - - name: S3_SERVICE_ACCOUNT - value: /vault/secrets/documentations-s3-account-json - - name: STATES_URL - value: http://backend-svc.workspaces.svc.cluster.local:80/ - - name: SUBSCRIPTIONS_URL - value: http://backend-svc.subscriptions.svc.cluster.local:80 - - name: SYSTEM_LOG_URL - value: http://api-service.system-log.svc.cluster.local:80 - - name: TARGET_URL - value: http://backend-svc.django.svc.cluster.local:80 - - name: USE_CACHE_IN_FILE_STREAMER - value: "1" - - name: USE_SUBSCRIPTIONS - value: "false" - - name: WIDTH_THUMB_ATTACHMENTS - value: "300" - - name: WIDTH_THUMB_STATES - value: "120" - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKFLOW_URL - value: http://backend-svc.processing.svc.cluster.local:80/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: WORKSPACE_URL - value: http://backend-svc.workspaces.svc.cluster.local:80/ - resources: - requests: - cpu: "25m" - memory: 128Mi - - imagePullSecrets: - - name: regcred diff --git a/apps/documentations/base/pdm-service.yaml b/apps/documentations/base/pdm-service.yaml deleted file mode 100644 index b978673..0000000 --- a/apps/documentations/base/pdm-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: pdm-svc - namespace: documentations -spec: - type: ClusterIP - selector: - app: pdm-api - ports: - - name: http - port: 80 - targetPort: 8080 - protocol: TCP diff --git a/apps/documentations/base/pdm.yaml b/apps/documentations/base/pdm.yaml new file mode 100644 index 0000000..d1ffa00 --- /dev/null +++ b/apps/documentations/base/pdm.yaml @@ -0,0 +1,276 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: pdm-api + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: documentations-vault + deployment: + enabled: true + name: + _default: pdm-api + replicaCount: + _default: 1 + port: + _default: 8080 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql + [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common + [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)" + set +a + exec ./httpserver + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: pdm-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8080 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: USE_EXPERIMENTAL + value: + _default: "true" + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: TRANSMITTALS_BASE_URL + value: + _default: mock + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: BUCKET_NAME + value: + _default: attachments-storage + - name: API_HOST_PREFIX + value: + _default: / + - name: APP_NAME + value: + _default: pdm_v2 + - name: APP_VERSION + value: + _default: "0.0.1" + - name: ENABLE_PERMISSIONS_FILTER + value: + _default: "1" + - name: PERMISSIONS_FILTER_COMPANIES + value: + _default: "[1]" + - name: TRANSMITTALS_ENABLE + value: + _default: "false" + - name: DRAWINGS_INTERNAL_URL + value: + _default: http://drawings-api-service.drawings.svc.cluster.local:80 + - name: ATTACHMENTS_URL + value: + _default: http://attachments-service.attachments.svc.cluster.local:8000 + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: BIM_V2_HOST + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: DJANGO_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: DOCUMENTATION_URL + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80/ + - name: EAV_URL + value: + _default: http://backend-svc.eav.svc.cluster.local:80 + - name: ENABLE_OBSERVABILITY + value: + _default: "false" + - name: ENABLE_S3 + value: + _default: "1" + - name: ENABLE_SSL + value: + _default: "0" + - name: ENVIRONMENT + value: + _default: prod + - name: FLOWS_URL + value: + _default: http://backend-svc.flows.svc.cluster.local:80 + - name: HEIGHT_THUMB_ATTACHMENTS + value: + _default: "300" + - name: HEIGHT_THUMB_STATES + value: + _default: "73" + - name: HTTP_PORT + value: + _default: "8080" + - name: INSPECTIONS_URL + value: + _default: http://inspections-service.inspections.svc.cluster.local:80 + - name: LOG_LEVEL + value: + _default: INFO + - name: NOTES_URL + value: + _default: "" + - name: OBSERVABILITY_COLLECTOR_ENDPOINT + value: + _default: temp + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: RELEASES_URL + value: + _default: https://gitlab.com + - name: REMARKS_URL + value: + _default: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks + - name: RESOURCES_URL + value: + _default: http://backend-svc.resources.svc.cluster.local:80 + - name: S3_SERVICE_ACCOUNT + value: + _default: /vault/secrets/documentations-s3-account-json + - name: STATES_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + - name: SUBSCRIPTIONS_URL + value: + _default: http://backend-svc.subscriptions.svc.cluster.local:80 + - name: SYSTEM_LOG_URL + value: + _default: http://api-service.system-log.svc.cluster.local:80 + - name: TARGET_URL + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "1" + - name: USE_SUBSCRIPTIONS + value: + _default: "false" + - name: WIDTH_THUMB_ATTACHMENTS + value: + _default: "300" + - name: WIDTH_THUMB_STATES + value: + _default: "120" + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOW_URL + value: + _default: http://backend-svc.processing.svc.cluster.local:80/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: WORKSPACE_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-documentations-postgresql: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} + POSTGRES_USER={{ index .Data.data "username" }} + POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-common: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_BASIC_AUTH={{ index .Data.data "key" }} + RELEASES_TOKEN={{ index .Data.data "documentations_releases_token" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + {{ index .Data.data "documentations_s3_service_account_json" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} diff --git a/apps/documentations/base/serviceaccount.yaml b/apps/documentations/base/serviceaccount.yaml deleted file mode 100644 index ba21e50..0000000 --- a/apps/documentations/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: documentations-vault - namespace: documentations diff --git a/apps/documentations/dsinv/documentations-api.yaml b/apps/documentations/dsinv/documentations-api.yaml index 6e6b760..5e73f0d 100644 --- a/apps/documentations/dsinv/documentations-api.yaml +++ b/apps/documentations/dsinv/documentations-api.yaml @@ -1,110 +1,161 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: documentations-api namespace: documentations spec: - replicas: 4 - template: - spec: - containers: - - name: documentations-api - image: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_54880e92 - env: - - name: PUBLIC_LINK_HOST - value: https://document-link.sarex.dsinv.ru - - name: POSTGRES_ADDRESS - value: postgres-service - - name: POSTGRES_PORT - value: '5432' - - name: POSTGRES_DB - value: documentations - - name: POSTGRES_POOL_SIZE - value: '20' - - name: LAST_MASTER_BIM - value: '36311' - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: ENABLE_SQL_QUERY - value: '0' - - name: ENABLE_SSL - value: '0' - - name: ENABLE_MAILGUN - value: 'false' - - name: ENABLE_SMTP - value: 'true' - - name: ENABLE_S3 - value: '1' - - name: USE_BIM_INSERTER - value: '0' - - name: CONTAINER_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: ENVIRONMENT - value: production - - name: HOST - value: http://documentations-service.documentations.svc.cluster.local:8080 - - name: FILE_STREAM_HOST - value: sarex.dsinv.ru - - name: DOCUMENTATION_URL - value: http://documentations-service.documentations.svc.cluster.local:8080/ - - name: WORKFLOW_URL - value: http://workflows-service.workflow.svc.cluster.local:8000/ - - name: WORKSPACE_URL - value: http://workspaces-service.workspaces.svc.cluster.local:8000/ - - name: BIM_API_URL - value: http://bim-api-service.bim.svc.cluster.local:8080/ - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: SYSTEM_LOG_URL - value: http://api-service.system-log.svc.cluster.local:8000 - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: MARKS_PROCESSING_URL - value: http://marks-service.documentations.svc.cluster.local:8000 - - name: NAMESPACE - value: documentations - - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES - value: '5' - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKSPACE_V2_EXTERNAL_URL - value: https://sarex.dsinv.ru/workspaces-v2/ - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: FLOWS_URL - value: http://backend-service.flows.svc.cluster.local:8000 - - name: S3_SERVICE_ACCOUNT - value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: USE_CACHE_IN_FILE_STREAMER - value: '1' - - name: IS_CONVERTED_PDF_UPLOADING_TO_S3 - value: 'false' - - name: TRACER_USE - value: '0' - - name: TRACER_HOST - value: signoz-otel-collector-external.signoz.svc.cluster.local:4317 - - name: SERVICE_NAME - value: documentations-api.documentations-prod - - name: SERVICE_NAME_FILESTREAM - value: filestream-api.documentations-prod - - name: TRACER_USE_INSECURE - value: '1' - - name: DELETE_S3D_AFTER_MESHOPT - value: 'true' - - name: CONVERT_DWG_TO_GEOJSON - value: 'false' - - name: CONVERT_DXF_TO_GEOJSON - value: 'false' + values: + services: + backend: + deployment: + replicaCount: + _default: 4 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_54880e92 + envs: + - name: PUBLIC_LINK_HOST + value: + _default: https://document-link.sarex.dsinv.ru + - name: POSTGRES_ADDRESS + value: + _default: postgres-service + - name: POSTGRES_PORT + value: + _default: "5432" + - name: POSTGRES_DB + value: + _default: documentations + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: LAST_MASTER_BIM + value: + _default: "36311" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: ENABLE_MAILGUN + value: + _default: "false" + - name: ENABLE_SMTP + value: + _default: "true" + - name: ENABLE_S3 + value: + _default: "1" + - name: USE_BIM_INSERTER + value: + _default: "0" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: HOST + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080 + - name: FILE_STREAM_HOST + value: + _default: sarex.dsinv.ru + - name: DOCUMENTATION_URL + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080/ + - name: WORKFLOW_URL + value: + _default: http://workflows-service.workflow.svc.cluster.local:8000/ + - name: WORKSPACE_URL + value: + _default: http://workspaces-service.workspaces.svc.cluster.local:8000/ + - name: BIM_API_URL + value: + _default: http://bim-api-service.bim.svc.cluster.local:8080/ + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: SYSTEM_LOG_URL + value: + _default: http://api-service.system-log.svc.cluster.local:8000 + - name: DJANGO_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: MARKS_PROCESSING_URL + value: + _default: http://marks-service.documentations.svc.cluster.local:8000 + - name: NAMESPACE + value: + _default: documentations + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKSPACE_V2_EXTERNAL_URL + value: + _default: https://sarex.dsinv.ru/workspaces-v2/ + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: FLOWS_URL + value: + _default: http://backend-service.flows.svc.cluster.local:8000 + - name: S3_SERVICE_ACCOUNT + value: + _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "1" + - name: IS_CONVERTED_PDF_UPLOADING_TO_S3 + value: + _default: "false" + - name: TRACER_USE + value: + _default: "0" + - name: TRACER_HOST + value: + _default: signoz-otel-collector-external.signoz.svc.cluster.local:4317 + - name: SERVICE_NAME + value: + _default: documentations-api.documentations-prod + - name: SERVICE_NAME_FILESTREAM + value: + _default: filestream-api.documentations-prod + - name: TRACER_USE_INSECURE + value: + _default: "1" + - name: DELETE_S3D_AFTER_MESHOPT + value: + _default: "true" + - name: CONVERT_DWG_TO_GEOJSON + value: + _default: "false" + - name: CONVERT_DXF_TO_GEOJSON + value: + _default: "false" diff --git a/apps/documentations/dsinv/documentations-filestream.yaml b/apps/documentations/dsinv/documentations-filestream.yaml index d919e17..1dc68e5 100644 --- a/apps/documentations/dsinv/documentations-filestream.yaml +++ b/apps/documentations/dsinv/documentations-filestream.yaml @@ -1,74 +1,107 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: documentations-filestream namespace: documentations spec: - replicas: 3 - template: - spec: - containers: - - name: documentations-filestream - image: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_54880e92 - env: - - name: POSTGRES_ADDRESS - value: postgres-service - - name: POSTGRES_PORT - value: '5432' - - name: POSTGRES_DB - value: documentations - - name: POSTGRES_POOL_SIZE - value: '20' - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: ENABLE_SQL_QUERY - value: '1' - - name: ENABLE_SSL - value: '0' - - name: ENABLE_S3 - value: '1' - - name: CONTAINER_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: ENVIRONMENT - value: production - - name: HOST - value: http://documentations-service.documentations.svc.cluster.local:8080 - - name: FILE_STREAM_HOST - value: sarex.dsinv.ru - - name: DOCUMENTATION_URL - value: http://documentations-service.documentations.svc.cluster.local:8080/ - - name: WORKFLOW_URL - value: http://workflows-service.workflow.svc.cluster.local:8000/ - - name: WORKSPACE_URL - value: http://workspaces-service.workspaces.svc.cluster.local:8000/ - - name: BIM_API_URL - value: http://bim-api-service.bim.svc.cluster.local:8080/ - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: NAMESPACE - value: sarex-documentations - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES - value: '5' - - name: S3_SERVICE_ACCOUNT - value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: USE_CACHE_IN_FILE_STREAMER - value: '1' + values: + services: + backend: + deployment: + replicaCount: + _default: 3 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_54880e92 + envs: + - name: POSTGRES_ADDRESS + value: + _default: postgres-service + - name: POSTGRES_PORT + value: + _default: "5432" + - name: POSTGRES_DB + value: + _default: documentations + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: ENABLE_SQL_QUERY + value: + _default: "1" + - name: ENABLE_SSL + value: + _default: "0" + - name: ENABLE_S3 + value: + _default: "1" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: HOST + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080 + - name: FILE_STREAM_HOST + value: + _default: sarex.dsinv.ru + - name: DOCUMENTATION_URL + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080/ + - name: WORKFLOW_URL + value: + _default: http://workflows-service.workflow.svc.cluster.local:8000/ + - name: WORKSPACE_URL + value: + _default: http://workspaces-service.workspaces.svc.cluster.local:8000/ + - name: BIM_API_URL + value: + _default: http://bim-api-service.bim.svc.cluster.local:8080/ + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: DJANGO_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: NAMESPACE + value: + _default: sarex-documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: S3_SERVICE_ACCOUNT + value: + _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "1" diff --git a/apps/documentations/dsinv/frontend.yaml b/apps/documentations/dsinv/frontend.yaml index c23d8eb..e93463e 100644 --- a/apps/documentations/dsinv/frontend.yaml +++ b/apps/documentations/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: documentations spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_b80d28d4 + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_b80d28d4 diff --git a/apps/documentations/dsinv/kustomization.yaml b/apps/documentations/dsinv/kustomization.yaml index d2562b9..29ec458 100644 --- a/apps/documentations/dsinv/kustomization.yaml +++ b/apps/documentations/dsinv/kustomization.yaml @@ -10,17 +10,17 @@ resources: patches: - path: documentations-api.yaml target: - kind: Deployment + kind: HelmRelease name: documentations-api - path: documentations-filestream.yaml target: - kind: Deployment + kind: HelmRelease name: documentations-filestream - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend - path: pdm-api.yaml target: - kind: Deployment + kind: HelmRelease name: pdm-api diff --git a/apps/documentations/dsinv/pdm-api.yaml b/apps/documentations/dsinv/pdm-api.yaml index 6fdfc30..643f4b3 100644 --- a/apps/documentations/dsinv/pdm-api.yaml +++ b/apps/documentations/dsinv/pdm-api.yaml @@ -1,120 +1,173 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: pdm-api namespace: documentations spec: - replicas: 3 - template: - spec: - containers: - - name: pdm-api - image: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_542e5343 - env: - - name: OBSERVABILITY_COLLECTOR_ENDPOINT - value: temp - - name: USE_SUBSCRIPTIONS - value: 'false' - - name: RELEASES_URL - value: https://gitlab.com - - name: APP_NAME - value: pdm_v2 - - name: APP_VERSION - value: 0.0.1 - - name: LOG_LEVEL - value: INFO - - name: HTTP_PORT - value: '8080' - - name: POSTGRES_ADDRESS - value: postgres-service.documentations.svc.cluster.local - - name: POSTGRES_PORT - value: '5432' - - name: POSTGRES_DB - value: documentations - - name: POSTGRES_POOL_SIZE - value: '20' - - name: API_ADDRESS - value: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: 0.0.0.0:8080 - - name: ENABLE_OBSERVABILITY - value: 'false' - - name: ENABLE_SSL - value: '0' - - name: ENABLE_S3 - value: '1' - - name: DOCUMENTATION_URL - value: http://documentations-service.documentations.svc.cluster.local:8080/ - - name: WORKFLOW_URL - value: http://workflows-service.workflow.svc.cluster.local:8000/ - - name: WORKSPACE_URL - value: http://workspaces-service.workspaces.svc.cluster.local:8000 - - name: BIM_API_V2_URL - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: BIM_V2_HOST - value: http://backend-service.bim.svc.cluster.local:8000/ - - name: WORKSPACE_BUNDLE_VERSION - value: v1 - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: NAMESPACE - value: documentations - - name: DJANGO_ORIGINATOR - value: docs_prod - - name: FLOWS_URL - value: http://backend-service.flows.svc.cluster.local:8000 - - name: RESOURCES_URL - value: http://resources-service.resources.svc.cluster.local:8000 - - name: REMARKS_URL - value: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks - - name: ATTACHMENTS_URL - value: http://attachments-service.attachments.svc.cluster.local:80 - - name: WORKFLOW_IMAGES_VERSION - value: master - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: WORKFLOWS_IMAGES_VERSION - value: master - - name: INSPECTIONS_URL - value: http://inspections-service.inspections - - name: STATES_URL - value: http://workspaces-service.workspaces.svc.cluster.local:8000/ - - name: WIDTH_THUMB_STATES - value: '120' - - name: HEIGHT_THUMB_STATES - value: '73' - - name: WIDTH_THUMB_ATTACHMENTS - value: '300' - - name: HEIGHT_THUMB_ATTACHMENTS - value: '300' - - name: ENABLE_PERMISSIONS_FILTER - value: '1' - - name: PERMISSIONS_FILTER_COMPANIES - value: '[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]' - - name: SUBSCRIPTIONS_URL - value: http://sarex-subscriptions-service.subscriptions - - name: SYSTEM_LOG_URL - value: http://api-service.system-log.svc.cluster.local:8000 - - name: API_HOST_PREFIX - value: /gateway - - name: TARGET_URL - value: http://backend.django.svc.cluster.local:8000 - - name: EAV_URL - value: http://eav-service.eav.svc.cluster.local:8000 - - name: NOTES_URL - value: http://backend-service.notes.svc.cluster.local:8000 - - name: S3_SERVICE_ACCOUNT - value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: 6h - - name: CACHE_DEFAULT_EXPIRATION - value: 60s - - name: CACHE_CLEANUP_INTERVAL - value: 60s - - name: USE_CACHE_IN_FILE_STREAMER - value: '1' - - name: ENVIRONMENT - value: prod - - name: TRANSMITTALS_BASE_URL - value: http://transmittal-service.transmittals.svc.cluster.local:80 + values: + services: + backend: + deployment: + replicaCount: + _default: 3 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_542e5343 + envs: + - name: OBSERVABILITY_COLLECTOR_ENDPOINT + value: + _default: temp + - name: USE_SUBSCRIPTIONS + value: + _default: "false" + - name: RELEASES_URL + value: + _default: https://gitlab.com + - name: APP_NAME + value: + _default: pdm_v2 + - name: APP_VERSION + value: + _default: "0.0.1" + - name: LOG_LEVEL + value: + _default: INFO + - name: HTTP_PORT + value: + _default: "8080" + - name: POSTGRES_ADDRESS + value: + _default: postgres-service.documentations.svc.cluster.local + - name: POSTGRES_PORT + value: + _default: "5432" + - name: POSTGRES_DB + value: + _default: documentations + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: ENABLE_OBSERVABILITY + value: + _default: "false" + - name: ENABLE_SSL + value: + _default: "0" + - name: ENABLE_S3 + value: + _default: "1" + - name: DOCUMENTATION_URL + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080/ + - name: WORKFLOW_URL + value: + _default: http://workflows-service.workflow.svc.cluster.local:8000/ + - name: WORKSPACE_URL + value: + _default: http://workspaces-service.workspaces.svc.cluster.local:8000 + - name: BIM_API_V2_URL + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: BIM_V2_HOST + value: + _default: http://backend-service.bim.svc.cluster.local:8000/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: DJANGO_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: NAMESPACE + value: + _default: documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: FLOWS_URL + value: + _default: http://backend-service.flows.svc.cluster.local:8000 + - name: RESOURCES_URL + value: + _default: http://resources-service.resources.svc.cluster.local:8000 + - name: REMARKS_URL + value: + _default: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks + - name: ATTACHMENTS_URL + value: + _default: http://attachments-service.attachments.svc.cluster.local:80 + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: INSPECTIONS_URL + value: + _default: http://inspections-service.inspections + - name: STATES_URL + value: + _default: http://workspaces-service.workspaces.svc.cluster.local:8000/ + - name: WIDTH_THUMB_STATES + value: + _default: "120" + - name: HEIGHT_THUMB_STATES + value: + _default: "73" + - name: WIDTH_THUMB_ATTACHMENTS + value: + _default: "300" + - name: HEIGHT_THUMB_ATTACHMENTS + value: + _default: "300" + - name: ENABLE_PERMISSIONS_FILTER + value: + _default: "1" + - name: PERMISSIONS_FILTER_COMPANIES + value: + _default: "[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]" + - name: SUBSCRIPTIONS_URL + value: + _default: http://sarex-subscriptions-service.subscriptions + - name: SYSTEM_LOG_URL + value: + _default: http://api-service.system-log.svc.cluster.local:8000 + - name: API_HOST_PREFIX + value: + _default: /gateway + - name: TARGET_URL + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: EAV_URL + value: + _default: http://eav-service.eav.svc.cluster.local:8000 + - name: NOTES_URL + value: + _default: http://backend-service.notes.svc.cluster.local:8000 + - name: S3_SERVICE_ACCOUNT + value: + _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "1" + - name: ENVIRONMENT + value: + _default: prod + - name: TRANSMITTALS_BASE_URL + value: + _default: http://transmittal-service.transmittals.svc.cluster.local:80 diff --git a/apps/rfi/base/backend-deployment.yaml b/apps/rfi/base/backend-deployment.yaml deleted file mode 100644 index 3d5454b..0000000 --- a/apps/rfi/base/backend-deployment.yaml +++ /dev/null @@ -1,99 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: rfi-backend-api - namespace: rfi - labels: - app: rfi-backend-api - service: api -spec: - replicas: 1 - selector: - matchLabels: - app: rfi-backend-api - template: - metadata: - labels: - app: rfi-backend-api - service: api - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: rfi - vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres - vault.hashicorp.com/agent-inject-template-rfi-db: |- - {{- with secret "secrets/data/apps/rfi/postgres" -}} - DB_HOST={{ index .Data.data "host" }} - DB_PORT={{ index .Data.data "port" }} - DB_NAME={{ index .Data.data "database" }} - DB_USER={{ index .Data.data "username" }} - DB_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi - vault.hashicorp.com/agent-inject-template-rfi-s3: |- - {{- with secret "secrets/data/minio/apps/rfi" -}} - YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} - YC_S3_BUCKET_NAME=rfi - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi - vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/rfi" -}} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - RABBITMQ_PORT=5672 - RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-rfi-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_SECRET_KEY={{ index .Data.data "key" }} - SAREX_BACKEND_AUTH={{ index .Data.data "key" }} - {{- end -}} - spec: - serviceAccountName: rfi-vault - containers: - - name: api - image: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db - [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3 - [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq - [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth - set +a - exec ./entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: JWT_AUTH_ENABLE - value: "True" - - name: NOTIFICATIONS_ENABLE - value: "false" - - name: NOTIFICATIONS_EMAIL_FROM - value: hello@sarex.io - - name: NOTIFICATIONS_SERVICE_URL - value: https://sarex.contour.infra.sarex.tech/rfi - - name: SAREX_BACKEND_URL - value: http://backend-svc.django.svc.cluster.local - - name: EAV_URL - value: http://backend-svc.eav.svc.cluster.local:80 - - name: GATEWAY_URL - value: http://pdm-svc.documentations.svc.cluster.local:80 - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred \ No newline at end of file diff --git a/apps/rfi/base/backend-service.yaml b/apps/rfi/base/backend-service.yaml deleted file mode 100644 index a033244..0000000 --- a/apps/rfi/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: rfi -spec: - type: ClusterIP - selector: - app: rfi-backend-api - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/rfi/base/backend.yaml b/apps/rfi/base/backend.yaml new file mode 100644 index 0000000..bc9f10e --- /dev/null +++ b/apps/rfi/base/backend.yaml @@ -0,0 +1,149 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: rfi +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: rfi-vault + deployment: + enabled: true + name: + _default: rfi-backend-api + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db + [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3 + [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq + [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth + set +a + exec ./entrypoint.sh + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: JWT_AUTH_ENABLE + value: + _default: "True" + - name: NOTIFICATIONS_ENABLE + value: + _default: "false" + - name: NOTIFICATIONS_EMAIL_FROM + value: + _default: hello@sarex.io + - name: NOTIFICATIONS_SERVICE_URL + value: + _default: https://sarex.contour.infra.sarex.tech/rfi + - name: SAREX_BACKEND_URL + value: + _default: http://backend-svc.django.svc.cluster.local + - name: EAV_URL + value: + _default: http://backend-svc.eav.svc.cluster.local:80 + - name: GATEWAY_URL + value: + _default: http://pdm-svc.documentations.svc.cluster.local:80 + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: rfi + vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres + vault.hashicorp.com/agent-inject-template-rfi-db: |- + {{- with secret "secrets/data/apps/rfi/postgres" -}} + DB_HOST={{ index .Data.data "host" }} + DB_PORT={{ index .Data.data "port" }} + DB_NAME={{ index .Data.data "database" }} + DB_USER={{ index .Data.data "username" }} + DB_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi + vault.hashicorp.com/agent-inject-template-rfi-s3: |- + {{- with secret "secrets/data/minio/apps/rfi" -}} + YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} + YC_S3_BUCKET_NAME=rfi + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi + vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/rfi" -}} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + RABBITMQ_PORT=5672 + RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-rfi-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_SECRET_KEY={{ index .Data.data "key" }} + SAREX_BACKEND_AUTH={{ index .Data.data "key" }} + {{- end -}} diff --git a/apps/rfi/base/celery-deployment.yaml b/apps/rfi/base/celery-deployment.yaml deleted file mode 100644 index 4b8b58d..0000000 --- a/apps/rfi/base/celery-deployment.yaml +++ /dev/null @@ -1,99 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: celery - namespace: rfi - labels: - app: celery - service: celery -spec: - replicas: 1 - selector: - matchLabels: - app: celery - template: - metadata: - labels: - app: celery - service: celery - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: rfi - vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres - vault.hashicorp.com/agent-inject-template-rfi-db: |- - {{- with secret "secrets/data/apps/rfi/postgres" -}} - DB_HOST={{ index .Data.data "host" }} - DB_PORT={{ index .Data.data "port" }} - DB_NAME={{ index .Data.data "database" }} - DB_USER={{ index .Data.data "username" }} - DB_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi - vault.hashicorp.com/agent-inject-template-rfi-s3: |- - {{- with secret "secrets/data/minio/apps/rfi" -}} - YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} - YC_S3_BUCKET_NAME=rfi - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi - vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/rfi" -}} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - RABBITMQ_PORT=5672 - RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - {{- end -}} - vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-rfi-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_SECRET_KEY={{ index .Data.data "key" }} - SAREX_BACKEND_AUTH={{ index .Data.data "key" }} - {{- end -}} - spec: - serviceAccountName: rfi-vault - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:dev4 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db - [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3 - [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq - [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth - set +a - exec uv run celery -A config worker -l info - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: JWT_AUTH_ENABLE - value: "True" - - name: NOTIFICATIONS_ENABLE - value: "false" - - name: NOTIFICATIONS_EMAIL_FROM - value: hello@sarex.io - - name: NOTIFICATIONS_SERVICE_URL - value: https://lk.srx.wb.ru:30443/rfi - - name: SAREX_BACKEND_URL - value: http://backend-svc.django.svc.cluster.local - - name: EAV_URL - value: http://backend-svc.eav.svc.cluster.local:80 - - name: GATEWAY_URL - value: http://pdm-api.documentations.svc.cluster.local:8080 - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/rfi/base/celery.yaml b/apps/rfi/base/celery.yaml new file mode 100644 index 0000000..fae9018 --- /dev/null +++ b/apps/rfi/base/celery.yaml @@ -0,0 +1,139 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: rfi +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + celery: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: rfi-vault + deployment: + enabled: true + name: + _default: celery + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db + [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3 + [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq + [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth + set +a + exec uv run celery -A config worker -l info + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:dev4 + pullPolicy: + _default: IfNotPresent + service: + enabled: false + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: JWT_AUTH_ENABLE + value: + _default: "True" + - name: NOTIFICATIONS_ENABLE + value: + _default: "false" + - name: NOTIFICATIONS_EMAIL_FROM + value: + _default: hello@sarex.io + - name: NOTIFICATIONS_SERVICE_URL + value: + _default: https://lk.srx.wb.ru:30443/rfi + - name: SAREX_BACKEND_URL + value: + _default: http://backend-svc.django.svc.cluster.local + - name: EAV_URL + value: + _default: http://backend-svc.eav.svc.cluster.local:80 + - name: GATEWAY_URL + value: + _default: http://pdm-api.documentations.svc.cluster.local:8080 + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: rfi + vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres + vault.hashicorp.com/agent-inject-template-rfi-db: |- + {{- with secret "secrets/data/apps/rfi/postgres" -}} + DB_HOST={{ index .Data.data "host" }} + DB_PORT={{ index .Data.data "port" }} + DB_NAME={{ index .Data.data "database" }} + DB_USER={{ index .Data.data "username" }} + DB_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi + vault.hashicorp.com/agent-inject-template-rfi-s3: |- + {{- with secret "secrets/data/minio/apps/rfi" -}} + YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }} + YC_S3_BUCKET_NAME=rfi + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi + vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/rfi" -}} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + RABBITMQ_PORT=5672 + RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + {{- end -}} + vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-rfi-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_SECRET_KEY={{ index .Data.data "key" }} + SAREX_BACKEND_AUTH={{ index .Data.data "key" }} + {{- end -}} diff --git a/apps/rfi/base/frontend-deployment.yaml b/apps/rfi/base/frontend-deployment.yaml deleted file mode 100644 index 6bbd8dd..0000000 --- a/apps/rfi/base/frontend-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: rfi - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/rfi-frontend:production_b827756f_wb - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/rfi/base/frontend-service.yaml b/apps/rfi/base/frontend-service.yaml deleted file mode 100644 index deaf506..0000000 --- a/apps/rfi/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: rfi -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/rfi/base/frontend.yaml b/apps/rfi/base/frontend.yaml new file mode 100644 index 0000000..92d6d2b --- /dev/null +++ b/apps/rfi/base/frontend.yaml @@ -0,0 +1,70 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: rfi +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + frontend: + enabled: true + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-frontend:production_b827756f_wb + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + name: + _default: frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + service: + enabled: true + name: + _default: frontend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/rfi/base/kustomization.yaml b/apps/rfi/base/kustomization.yaml index 5da1ac4..4c9e98e 100644 --- a/apps/rfi/base/kustomization.yaml +++ b/apps/rfi/base/kustomization.yaml @@ -4,9 +4,6 @@ kind: Kustomization namespace: rfi resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - celery-deployment.yaml - - frontend-deployment.yaml - - backend-service.yaml - - frontend-service.yaml + - backend.yaml + - celery.yaml + - frontend.yaml diff --git a/apps/rfi/base/serviceaccount.yaml b/apps/rfi/base/serviceaccount.yaml deleted file mode 100644 index f598354..0000000 --- a/apps/rfi/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: rfi-vault - namespace: rfi diff --git a/apps/workspaces/base/backend-deployment.yaml b/apps/workspaces/base/backend-deployment.yaml deleted file mode 100644 index 7c7d4fa..0000000 --- a/apps/workspaces/base/backend-deployment.yaml +++ /dev/null @@ -1,104 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: workspaces-api - namespace: workspaces - labels: - app: workspaces-api -spec: - replicas: 1 - selector: - matchLabels: - app: workspaces-api - template: - metadata: - labels: - app: workspaces-api - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: workspaces - vault.hashicorp.com/agent-inject-secret-workspaces-db: secrets/data/apps/workspaces/postgres - vault.hashicorp.com/agent-inject-template-workspaces-db: |- - {{- with secret "secrets/data/apps/workspaces/postgres" -}} - POSTGRES_ADDRESS={{ index .Data.data "host" }} - POSTGRES_PORT={{ index .Data.data "port" }} - POSTGRES_DB={{ index .Data.data "database" }} - POSTGRES_USER={{ index .Data.data "username" }} - POSTGRES_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-workspaces-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-workspaces-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_BASIC_AUTH={{ index .Data.data "key" }} - {{- end -}} - spec: - serviceAccountName: workspaces-vault - containers: - - name: workspaces-api - image: cr.yandex/crp3ccidau046kdj8g9q/workspaces:prod_4961b1f1 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/workspaces-db ] && . /vault/secrets/workspaces-db - [ -f /vault/secrets/workspaces-django-auth ] && . /vault/secrets/workspaces-django-auth - set +a - exec /api - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: POSTGRES_POOL_SIZE - value: "3" - - name: BUNDLES_RETRY_COUNT - value: "5" - - name: BUNDLES_NJOBS - value: "5" - - name: API_ADDRESS - value: 0.0.0.0:8000 - - name: NAMESPACE - value: workspaces - - name: ENABLE_SQL_QUERY - value: "0" - - name: ENABLE_SSL - value: "0" - - name: DOCUMENTATION_HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80 - - name: DOCUMENTATION_LOGGER_FEATURE - value: "0" - - name: DOCUMENTATION_ORIGINATOR - value: prod_ws - - name: ENVIRONMENT - value: prod - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: DJANGO_ORIGINATOR - value: docs_prod - - resources: - requests: - cpu: 25m - memory: 100Mi - livenessProbe: - httpGet: - path: /ping - port: 8000 - initialDelaySeconds: 10 - periodSeconds: 60 - failureThreshold: 10 - readinessProbe: - httpGet: - path: /ping - port: 8000 - initialDelaySeconds: 5 - periodSeconds: 5 - failureThreshold: 20 - imagePullSecrets: - - name: regcred diff --git a/apps/workspaces/base/backend-service.yaml b/apps/workspaces/base/backend-service.yaml deleted file mode 100644 index 9a06028..0000000 --- a/apps/workspaces/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: workspaces -spec: - type: ClusterIP - selector: - app: workspaces-api - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/workspaces/base/backend.yaml b/apps/workspaces/base/backend.yaml new file mode 100644 index 0000000..5728f7a --- /dev/null +++ b/apps/workspaces/base/backend.yaml @@ -0,0 +1,175 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: workspaces +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: workspaces-vault + deployment: + enabled: true + name: + _default: workspaces-api + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/workspaces-db ] && . /vault/secrets/workspaces-db + [ -f /vault/secrets/workspaces-django-auth ] && . /vault/secrets/workspaces-django-auth + set +a + exec /api + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 60 + failureThreshold: + _default: 10 + readiness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 5 + periodSeconds: + _default: 5 + failureThreshold: + _default: 20 + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces:prod_4961b1f1 + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: backend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "3" + - name: BUNDLES_RETRY_COUNT + value: + _default: "5" + - name: BUNDLES_NJOBS + value: + _default: "5" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8000 + - name: NAMESPACE + value: + _default: workspaces + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: DOCUMENTATION_HOST + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80 + - name: DOCUMENTATION_LOGGER_FEATURE + value: + _default: "0" + - name: DOCUMENTATION_ORIGINATOR + value: + _default: prod_ws + - name: ENVIRONMENT + value: + _default: prod + - name: DJANGO_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: workspaces + vault.hashicorp.com/agent-inject-secret-workspaces-db: secrets/data/apps/workspaces/postgres + vault.hashicorp.com/agent-inject-template-workspaces-db: |- + {{- with secret "secrets/data/apps/workspaces/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} + POSTGRES_USER={{ index .Data.data "username" }} + POSTGRES_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-workspaces-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-workspaces-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_BASIC_AUTH={{ index .Data.data "key" }} + {{- end -}} diff --git a/apps/workspaces/base/frontend-deployment.yaml b/apps/workspaces/base/frontend-deployment.yaml deleted file mode 100644 index 94799b3..0000000 --- a/apps/workspaces/base/frontend-deployment.yaml +++ /dev/null @@ -1,46 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: workspaces - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_7f95769f - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - livenessProbe: - httpGet: - path: /ping - port: 80 - initialDelaySeconds: 10 - periodSeconds: 10 - failureThreshold: 10 - readinessProbe: - httpGet: - path: /ping - port: 80 - initialDelaySeconds: 10 - periodSeconds: 10 - failureThreshold: 20 - imagePullSecrets: - - name: regcred diff --git a/apps/workspaces/base/frontend-service.yaml b/apps/workspaces/base/frontend-service.yaml deleted file mode 100644 index 9d8cfdd..0000000 --- a/apps/workspaces/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: workspaces -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/workspaces/base/frontend.yaml b/apps/workspaces/base/frontend.yaml new file mode 100644 index 0000000..84bb622 --- /dev/null +++ b/apps/workspaces/base/frontend.yaml @@ -0,0 +1,98 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: workspaces +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + frontend: + enabled: true + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_7f95769f + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + name: + _default: frontend + replicaCount: + _default: 1 + port: + _default: 80 + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + probes: + liveness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 80 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 10 + failureThreshold: + _default: 10 + readiness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 80 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 10 + failureThreshold: + _default: 20 + service: + enabled: true + name: + _default: frontend-svc + type: + _default: ClusterIP + port: + _default: 80 + targetPort: + _default: 80 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/workspaces/base/kustomization.yaml b/apps/workspaces/base/kustomization.yaml index 6ebeaba..61b307a 100644 --- a/apps/workspaces/base/kustomization.yaml +++ b/apps/workspaces/base/kustomization.yaml @@ -4,8 +4,5 @@ kind: Kustomization namespace: workspaces resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml - - frontend-deployment.yaml - - frontend-service.yaml + - backend.yaml + - frontend.yaml diff --git a/apps/workspaces/base/serviceaccount.yaml b/apps/workspaces/base/serviceaccount.yaml deleted file mode 100644 index 8855786..0000000 --- a/apps/workspaces/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: workspaces-vault - namespace: workspaces diff --git a/apps/workspaces/dsinv/frontend.yaml b/apps/workspaces/dsinv/frontend.yaml index 68aa040..0fdd9e8 100644 --- a/apps/workspaces/dsinv/frontend.yaml +++ b/apps/workspaces/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: workspaces spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_c4cc968d + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_c4cc968d diff --git a/apps/workspaces/dsinv/kustomization.yaml b/apps/workspaces/dsinv/kustomization.yaml index 973e139..7d9ed22 100644 --- a/apps/workspaces/dsinv/kustomization.yaml +++ b/apps/workspaces/dsinv/kustomization.yaml @@ -8,9 +8,9 @@ resources: patches: - path: workspaces-api.yaml target: - kind: Deployment - name: workspaces-api + kind: HelmRelease + name: backend - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend diff --git a/apps/workspaces/dsinv/workspaces-api.yaml b/apps/workspaces/dsinv/workspaces-api.yaml index 0c068d8..9496162 100644 --- a/apps/workspaces/dsinv/workspaces-api.yaml +++ b/apps/workspaces/dsinv/workspaces-api.yaml @@ -1,45 +1,62 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: - name: workspaces-api + name: backend namespace: workspaces spec: - template: - spec: - containers: - - name: workspaces-api - image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-backend:production_fef43835 - env: - - name: POSTGRES_ADDRESS - value: postgres-service - - name: POSTGRES_PORT - value: '5432' - - name: POSTGRES_DB - value: workspaces_db - - name: POSTGRES_POOL_SIZE - value: '3' - - name: BUNDLES_RETRY_COUNT - value: '5' - - name: BUNDLES_NJOBS - value: '5' - - name: API_ADDRESS - value: 0.0.0.0:8000 - - name: NAMESPACE - value: sarex-workspaces - - name: ENABLE_SQL_QUERY - value: '0' - - name: ENABLE_SSL - value: '0' - - name: DOCUMENTATION_HOST - value: http://documentations-service.documentations.svc.cluster.local:8080 - - name: DOCUMENTATION_LOGGER_FEATURE - value: '0' - - name: DOCUMENTATION_ORIGINATOR - value: prod_ws - - name: ENVIRONMENT - value: prod - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: DJANGO_ORIGINATOR - value: docs_prod + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-backend:production_fef43835 + envs: + - name: POSTGRES_ADDRESS + value: + _default: postgres-service + - name: POSTGRES_PORT + value: + _default: "5432" + - name: POSTGRES_DB + value: + _default: workspaces_db + - name: POSTGRES_POOL_SIZE + value: + _default: "3" + - name: BUNDLES_RETRY_COUNT + value: + _default: "5" + - name: BUNDLES_NJOBS + value: + _default: "5" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8000 + - name: NAMESPACE + value: + _default: sarex-workspaces + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: DOCUMENTATION_HOST + value: + _default: http://documentations-service.documentations.svc.cluster.local:8080 + - name: DOCUMENTATION_LOGGER_FEATURE + value: + _default: "0" + - name: DOCUMENTATION_ORIGINATOR + value: + _default: prod_ws + - name: ENVIRONMENT + value: + _default: prod + - name: DJANGO_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod diff --git a/apps/workspaces/yc-k8s-test/kustomization.yaml b/apps/workspaces/yc-k8s-test/kustomization.yaml index 00b5299..c8f7064 100644 --- a/apps/workspaces/yc-k8s-test/kustomization.yaml +++ b/apps/workspaces/yc-k8s-test/kustomization.yaml @@ -7,5 +7,5 @@ resources: patches: - path: replicas.yaml target: - kind: Deployment - name: workspaces-api + kind: HelmRelease + name: backend diff --git a/apps/workspaces/yc-k8s-test/replicas.yaml b/apps/workspaces/yc-k8s-test/replicas.yaml index cc9af30..ad71cb6 100644 --- a/apps/workspaces/yc-k8s-test/replicas.yaml +++ b/apps/workspaces/yc-k8s-test/replicas.yaml @@ -1,8 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: workspaces spec: - replicas: 1 + values: + services: + backend: + deployment: + replicaCount: + _default: 1