++

apps/documentations/base/api-deployment.yaml

@@ -1,173 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: documentations-api
-  namespace: documentations
-  labels:
-    app: documentations-api
-    service: documentations-api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: documentations-api
-  template:
-    metadata:
-      labels:
-        app: documentations-api
-        service: documentations-api
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: documentations
-        vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres
-        vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
-          {{- with secret "secrets/data/apps/documentations/postgres" -}}
-          POSTGRES_ADDRESS={{ index .Data.data "host" }}
-          POSTGRES_PORT={{ index .Data.data "port" }}
-          POSTGRES_DB={{ index .Data.data "database" }}
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-common: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
-          DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }}
-          DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          {{ index .Data.data "documentations_s3_service_account_json" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          {{ index .Data.data "documentations_zitadel_account_json" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: documentations-vault
-      containers:
-        - name: documentations-api
-          image: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
-              [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
-              [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
-              set +a
-              exec /app/entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: POSTGRES_POOL_SIZE
-              value: "20"
-            - name: ZITADEL_ACCOUNT
-              value: /vault/secrets/documentations-zitadel-account-json
-            - name: ZITADEL_DOMAIN
-              value: zitadel-srx.wb.ru
-            - name: USE_ZITADEL
-              value: "0"
-            - name: FLOWS_URL
-              value: http://backend-svc.flows.svc.cluster.local:80
-            - name: LAST_MASTER_BIM
-              value: "36311"
-            - name: API_ADDRESS
-              value: 0.0.0.0:8080
-            - name: API_ADDRESS_FILE
-              value: 0.0.0.0:8080
-            - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-              value: "5"
-            - name: ENABLE_SQL_QUERY
-              value: "0"
-            - name: ENABLE_SSL
-              value: "0"
-            - name: WORKSPACE_V2_EXTERNAL_URL
-              value: https://sarex.contour.infra.sarex.tech/workspaces-v2/
-            - name: ENABLE_S3
-              value: "1"
-            - name: CONTAINER_REGISTRY
-              value: cr.yandex/crp3ccidau046kdj8g9q
-            - name: ENVIRONMENT
-              value: production
-            - name: LAST_SLAVE_1_BIM
-              value: "1000000"
-            - name: HOST
-              value: http://backend-api-svc.documentations.svc.cluster.local:80
-            - name: FILE_STREAM_HOST
-              value: sarex.contour.infra.sarex.tech
-            - name: DOCUMENTATION_URL
-              value: http://documentations-api.documentations.svc.cluster.local:80/
-            - name: WORKFLOW_URL
-              value: http://backend-svc.processing.svc.cluster.local:80/
-            - name: WORKSPACE_URL
-              value: http://backend-svc.workspaces.svc.cluster.local:80/
-            - name: BIM_API_URL
-              value: http://bim-api-service.bim.svc.cluster.local:8080/
-            - name: BIM_API_V2_URL
-              value: http://backend-service.bim.svc.cluster.local:8000/
-            - name: WORKSPACE_BUNDLE_VERSION
-              value: v1
-            - name: SYSTEM_LOG_URL
-              value: http://backend-svc.system-log.svc.cluster.local:80
-            - name: DJANGO_HOST
-              value: http://backend-svc.django.svc.cluster.local:80
-            - name: MARKS_PROCESSING_URL
-              value: http://marks-service:8000
-            - name: PUBLIC_LINK_HOST
-              value: https://document-link-srx.wb.ru
-            - name: NAMESPACE
-              value: documentations
-            - name: DJANGO_ORIGINATOR
-              value: docs_prod
-            - name: WORKFLOW_IMAGES_VERSION
-              value: master
-            - name: WORKFLOWS_IMAGES_VERSION
-              value: master
-            - name: S3_SERVICE_ACCOUNT
-              value: /vault/secrets/documentations-s3-account-json
-            - name: READ_WRITE_TIMEOUT_FILE_STREAM
-              value: 6h
-            - name: CACHE_DEFAULT_EXPIRATION
-              value: 60s
-            - name: ENABLE_SMTP
-              value: "True"
-            - name: ENABLE_MAILGUN
-              value: "False"
-            - name: CACHE_CLEANUP_INTERVAL
-              value: 60s
-            - name: ENABLE_AUTH_JWT_IN_URL
-              value: "true"
-            - name: ENABLE_SIGNATURE_IN_URL
-              value: "false"
-            - name: USE_CACHE_IN_FILE_STREAMER
-              value: "0"
-            - name: VALKEY_ADDR
-              value: redis:6379
-            - name: VALKEY_HOST
-              value: redis
-            - name: VALKEY_PORT
-              value: "6379"
-      
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-
-      imagePullSecrets:
-        - name: regcred

apps/documentations/base/api-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-api-svc
-  namespace: documentations
-spec:
-  type: ClusterIP
-  selector:
-    app: documentations-api
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP

apps/documentations/base/api.yaml

@@ -0,0 +1,258 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-api
+  namespace: documentations
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: documentations-vault
+        deployment:
+          enabled: true
+          name:
+            _default: documentations-api
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8080
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
+                [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
+                [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
+                set +a
+                exec /app/entrypoint.sh
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: backend-api-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8080
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-zitadel-account-json
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: zitadel-srx.wb.ru
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://sarex.contour.infra.sarex.tech/workspaces-v2/
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+          - name: HOST
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80
+          - name: FILE_STREAM_HOST
+            value:
+              _default: sarex.contour.infra.sarex.tech
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://documentations-api.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://backend-svc.processing.svc.cluster.local:80/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: BIM_API_URL
+            value:
+              _default: http://bim-api-service.bim.svc.cluster.local:8080/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://backend-svc.system-log.svc.cluster.local:80
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service:8000
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://document-link-srx.wb.ru
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "true"
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "false"
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "0"
+          - name: VALKEY_ADDR
+            value:
+              _default: redis:6379
+          - name: VALKEY_HOST
+            value:
+              _default: redis
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: documentations
+            vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres
+            vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
+              {{- with secret "secrets/data/apps/documentations/postgres" -}}
+              POSTGRES_ADDRESS={{ index .Data.data "host" }}
+              POSTGRES_PORT={{ index .Data.data "port" }}
+              POSTGRES_DB={{ index .Data.data "database" }}
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-common: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
+              DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }}
+              DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              {{ index .Data.data "documentations_s3_service_account_json" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              {{ index .Data.data "documentations_zitadel_account_json" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}

apps/documentations/base/filestream-deployment.yaml

@@ -1,173 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: documentations-filestream
-  namespace: documentations
-  labels:
-    app: documentations-filestream
-    service: documentations-filestream
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: documentations-filestream
-  template:
-    metadata:
-      labels:
-        app: documentations-filestream
-        service: documentations-filestream
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: documentations
-        vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres
-        vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
-          {{- with secret "secrets/data/apps/documentations/postgres" -}}
-          POSTGRES_ADDRESS={{ index .Data.data "host" }}
-          POSTGRES_PORT={{ index .Data.data "port" }}
-          POSTGRES_DB={{ index .Data.data "database" }}
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-common: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
-          DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }}
-          DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          {{ index .Data.data "documentations_s3_service_account_json" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          {{ index .Data.data "documentations_zitadel_account_json" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: documentations-vault
-      containers:
-        - name: documentations-filestream
-          image: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
-              [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
-              [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
-              set +a
-              exec /app/file_entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: POSTGRES_POOL_SIZE
-              value: "20"
-            - name: ZITADEL_ACCOUNT
-              value: /vault/secrets/documentations-zitadel-account-json
-            - name: ZITADEL_DOMAIN
-              value: zitadel-srx.wb.ru
-            - name: USE_ZITADEL
-              value: "0"
-            - name: FLOWS_URL
-              value: http://backend-svc.flows.svc.cluster.local:80
-            - name: LAST_MASTER_BIM
-              value: "36311"
-            - name: API_ADDRESS
-              value: 0.0.0.0:8080
-            - name: API_ADDRESS_FILE
-              value: 0.0.0.0:8080
-            - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-              value: "5"
-            - name: ENABLE_SQL_QUERY
-              value: "0"
-            - name: ENABLE_SSL
-              value: "0"
-            - name: WORKSPACE_V2_EXTERNAL_URL
-              value: https://srx.wb.ru/workspaces-v2/
-            - name: ENABLE_S3
-              value: "1"
-            - name: CONTAINER_REGISTRY
-              value: cr.yandex/crp3ccidau046kdj8g9q
-            - name: ENVIRONMENT
-              value: production
-            - name: LAST_SLAVE_1_BIM
-              value: "1000000"
-            - name: HOST
-              value: http://backend-api-svc.documentations.svc.cluster.local:80
-            - name: FILE_STREAM_HOST
-              value: srx.wb.ru
-            - name: DOCUMENTATION_URL
-              value: http://backend-api-svc.documentations.svc.cluster.local:80/
-            - name: WORKFLOW_URL
-              value: http://workflows-api-service.workflow.svc.cluster.local:8000/
-            - name: WORKSPACE_URL
-              value: http://backend-svc.workspaces.svc.cluster.local:80/
-            - name: BIM_API_URL
-              value: http://bim-api-service.bim.svc.cluster.local:8080/
-            - name: BIM_API_V2_URL
-              value: http://backend-service.bim.svc.cluster.local:8000/
-            - name: WORKSPACE_BUNDLE_VERSION
-              value: v1
-            - name: SYSTEM_LOG_URL
-              value: http://api-service.system-log.svc.cluster.local:80
-            - name: DJANGO_HOST
-              value: http://backend-svc.django.svc.cluster.local:80
-            - name: MARKS_PROCESSING_URL
-              value: http://marks-service:8000
-            - name: PUBLIC_LINK_HOST
-              value: https://document-link-srx.wb.ru
-            - name: NAMESPACE
-              value: documentations
-            - name: DJANGO_ORIGINATOR
-              value: docs_prod
-            - name: WORKFLOW_IMAGES_VERSION
-              value: master
-            - name: WORKFLOWS_IMAGES_VERSION
-              value: master
-            - name: S3_SERVICE_ACCOUNT
-              value: /vault/secrets/documentations-s3-account-json
-            - name: READ_WRITE_TIMEOUT_FILE_STREAM
-              value: 6h
-            - name: CACHE_DEFAULT_EXPIRATION
-              value: 60s
-            - name: ENABLE_SMTP
-              value: "True"
-            - name: ENABLE_MAILGUN
-              value: "False"
-            - name: CACHE_CLEANUP_INTERVAL
-              value: 60s
-            - name: ENABLE_AUTH_JWT_IN_URL
-              value: "false"
-            - name: ENABLE_SIGNATURE_IN_URL
-              value: "true"
-            - name: USE_CACHE_IN_FILE_STREAMER
-              value: "0"
-            - name: VALKEY_ADDR
-              value: redis:6379
-            - name: VALKEY_HOST
-              value: redis
-            - name: VALKEY_PORT
-              value: "6379"
-      
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-
-      imagePullSecrets:
-        - name: regcred

apps/documentations/base/filestream-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-filestream-svc
-  namespace: documentations
-spec:
-  type: ClusterIP
-  selector:
-    app: documentations-filestream
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP

apps/documentations/base/filestream.yaml

@@ -0,0 +1,258 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-filestream
+  namespace: documentations
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: documentations-vault
+        deployment:
+          enabled: true
+          name:
+            _default: documentations-filestream
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8080
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
+                [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
+                [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
+                set +a
+                exec /app/file_entrypoint.sh
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: backend-filestream-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8080
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-zitadel-account-json
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: zitadel-srx.wb.ru
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://srx.wb.ru/workspaces-v2/
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+          - name: HOST
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80
+          - name: FILE_STREAM_HOST
+            value:
+              _default: srx.wb.ru
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://workflows-api-service.workflow.svc.cluster.local:8000/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: BIM_API_URL
+            value:
+              _default: http://bim-api-service.bim.svc.cluster.local:8080/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:80
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service:8000
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://document-link-srx.wb.ru
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "0"
+          - name: VALKEY_ADDR
+            value:
+              _default: redis:6379
+          - name: VALKEY_HOST
+            value:
+              _default: redis
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: documentations
+            vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres
+            vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
+              {{- with secret "secrets/data/apps/documentations/postgres" -}}
+              POSTGRES_ADDRESS={{ index .Data.data "host" }}
+              POSTGRES_PORT={{ index .Data.data "port" }}
+              POSTGRES_DB={{ index .Data.data "database" }}
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-common: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
+              DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }}
+              DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              {{ index .Data.data "documentations_s3_service_account_json" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              {{ index .Data.data "documentations_zitadel_account_json" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}

apps/documentations/base/frontend-deployment.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: documentations
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-    spec:
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ae1bb076
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-      imagePullSecrets:
-        - name: regcred

apps/documentations/base/frontend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-svc
-  namespace: documentations
-spec:
-  type: ClusterIP
-  selector:
-    app: frontend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/documentations/base/frontend.yaml

@@ -0,0 +1,70 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: documentations
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      frontend:
+        enabled: true
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ae1bb076
+          pullPolicy:
+            _default: IfNotPresent
+        deployment:
+          enabled: true
+          name:
+            _default: frontend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 80
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        service:
+          enabled: true
+          name:
+            _default: frontend-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 80
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred

apps/documentations/base/kustomization.yaml

@@ -4,12 +4,7 @@ kind: Kustomization
 namespace: documentations
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
+  - api.yaml
-  - api-deployment.yaml
+  - filestream.yaml
-  - pdm-deployment.yaml
+  - frontend.yaml
-  - filestream-deployment.yaml
+  - pdm.yaml
-  - frontend-deployment.yaml
-  - api-service.yaml
-  - pdm-service.yaml
-  - filestream-service.yaml
-  - frontend-service.yaml

apps/documentations/base/pdm-deployment.yaml

@@ -1,181 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pdm-api
-  namespace: documentations
-  labels:
-    app: pdm-api
-    service: pdm-api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pdm-api
-  template:
-    metadata:
-      labels:
-        app: pdm-api
-        service: pdm-api
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: documentations
-        vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres
-        vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
-          {{- with secret "secrets/data/apps/documentations/postgres" -}}
-          POSTGRES_ADDRESS={{ index .Data.data "host" }}
-          POSTGRES_PORT={{ index .Data.data "port" }}
-          POSTGRES_DB={{ index .Data.data "database" }}
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-common: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
-          RELEASES_TOKEN={{ index .Data.data "documentations_releases_token" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          {{ index .Data.data "documentations_s3_service_account_json" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: documentations-vault
-      containers:
-        - name: pdm-api
-          image: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
-              [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
-              [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
-              set +a
-              exec ./httpserver
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: USE_EXPERIMENTAL
-              value: "true"
-            - name: POSTGRES_POOL_SIZE
-              value: "20"
-            - name: TRANSMITTALS_BASE_URL
-              value: mock
-            - name: API_ADDRESS
-              value: 0.0.0.0:8080
-            - name: API_ADDRESS_FILE
-              value: 0.0.0.0:8080
-            - name: BUCKET_NAME
-              value: attachments-storage
-            - name: API_HOST_PREFIX
-              value: /
-            - name: APP_NAME
-              value: pdm_v2
-            - name: APP_VERSION
-              value: 0.0.1
-            - name: ENABLE_PERMISSIONS_FILTER
-              value: "1"
-            - name: PERMISSIONS_FILTER_COMPANIES
-              value: '[1]'
-            - name: TRANSMITTALS_ENABLE
-              value: "false"
-            - name: DRAWINGS_INTERNAL_URL
-              value: http://drawings-api-service.drawings.svc.cluster.local:80
-            - name: ATTACHMENTS_URL
-              value: http://attachments-service.attachments.svc.cluster.local:8000
-            - name: BIM_API_V2_URL
-              value: http://backend-service.bim.svc.cluster.local:8000/
-            - name: BIM_V2_HOST
-              value: http://backend-service.bim.svc.cluster.local:8000/
-            - name: CACHE_CLEANUP_INTERVAL
-              value: 60s
-            - name: CACHE_DEFAULT_EXPIRATION
-              value: 60s
-            - name: DJANGO_HOST
-              value: http://backend-svc.django.svc.cluster.local:80
-            - name: DJANGO_ORIGINATOR
-              value: docs_prod
-            - name: DOCUMENTATION_URL
-              value: http://backend-api-svc.documentations.svc.cluster.local:80/
-            - name: EAV_URL
-              value: http://backend-svc.eav.svc.cluster.local:80
-            - name: ENABLE_OBSERVABILITY
-              value: "false"
-            - name: ENABLE_S3
-              value: "1"
-            - name: ENABLE_SSL
-              value: "0"
-            - name: ENVIRONMENT
-              value: prod
-            - name: FLOWS_URL
-              value: http://backend-svc.flows.svc.cluster.local:80
-            - name: HEIGHT_THUMB_ATTACHMENTS
-              value: "300"
-            - name: HEIGHT_THUMB_STATES
-              value: "73"
-            - name: HTTP_PORT
-              value: "8080"
-            - name: INSPECTIONS_URL
-              value: http://inspections-service.inspections.svc.cluster.local:80
-            - name: LOG_LEVEL
-              value: INFO
-            - name: NOTES_URL
-            - name: OBSERVABILITY_COLLECTOR_ENDPOINT
-              value: temp
-            - name: READ_WRITE_TIMEOUT_FILE_STREAM
-              value: 6h
-            - name: RELEASES_URL
-              value: https://gitlab.com
-            - name: REMARKS_URL
-              value: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks
-            - name: RESOURCES_URL
-              value: http://backend-svc.resources.svc.cluster.local:80
-            - name: S3_SERVICE_ACCOUNT
-              value: /vault/secrets/documentations-s3-account-json
-            - name: STATES_URL
-              value: http://backend-svc.workspaces.svc.cluster.local:80/
-            - name: SUBSCRIPTIONS_URL
-              value: http://backend-svc.subscriptions.svc.cluster.local:80
-            - name: SYSTEM_LOG_URL
-              value: http://api-service.system-log.svc.cluster.local:80
-            - name: TARGET_URL
-              value: http://backend-svc.django.svc.cluster.local:80
-            - name: USE_CACHE_IN_FILE_STREAMER
-              value: "1"
-            - name: USE_SUBSCRIPTIONS
-              value: "false"
-            - name: WIDTH_THUMB_ATTACHMENTS
-              value: "300"
-            - name: WIDTH_THUMB_STATES
-              value: "120"
-            - name: WORKFLOWS_IMAGES_VERSION
-              value: master
-            - name: WORKFLOW_IMAGES_VERSION
-              value: master
-            - name: WORKFLOW_URL
-              value: http://backend-svc.processing.svc.cluster.local:80/
-            - name: WORKSPACE_BUNDLE_VERSION
-              value: v1
-            - name: WORKSPACE_URL
-              value: http://backend-svc.workspaces.svc.cluster.local:80/
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-
-      imagePullSecrets:
-        - name: regcred

apps/documentations/base/pdm-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pdm-svc
-  namespace: documentations
-spec:
-  type: ClusterIP
-  selector:
-    app: pdm-api
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP

apps/documentations/base/pdm.yaml

@@ -0,0 +1,276 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdm-api
+  namespace: documentations
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: documentations-vault
+        deployment:
+          enabled: true
+          name:
+            _default: pdm-api
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8080
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
+                [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
+                [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
+                set +a
+                exec ./httpserver
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: pdm-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8080
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: USE_EXPERIMENTAL
+            value:
+              _default: "true"
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: TRANSMITTALS_BASE_URL
+            value:
+              _default: mock
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: BUCKET_NAME
+            value:
+              _default: attachments-storage
+          - name: API_HOST_PREFIX
+            value:
+              _default: /
+          - name: APP_NAME
+            value:
+              _default: pdm_v2
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+          - name: ENABLE_PERMISSIONS_FILTER
+            value:
+              _default: "1"
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+          - name: TRANSMITTALS_ENABLE
+            value:
+              _default: "false"
+          - name: DRAWINGS_INTERNAL_URL
+            value:
+              _default: http://drawings-api-service.drawings.svc.cluster.local:80
+          - name: ATTACHMENTS_URL
+            value:
+              _default: http://attachments-service.attachments.svc.cluster.local:8000
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: BIM_V2_HOST
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
+          - name: EAV_URL
+            value:
+              _default: http://backend-svc.eav.svc.cluster.local:80
+          - name: ENABLE_OBSERVABILITY
+            value:
+              _default: "false"
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: ENVIRONMENT
+            value:
+              _default: prod
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: HEIGHT_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+          - name: HEIGHT_THUMB_STATES
+            value:
+              _default: "73"
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+          - name: INSPECTIONS_URL
+            value:
+              _default: http://inspections-service.inspections.svc.cluster.local:80
+          - name: LOG_LEVEL
+            value:
+              _default: INFO
+          - name: NOTES_URL
+            value:
+              _default: ""
+          - name: OBSERVABILITY_COLLECTOR_ENDPOINT
+            value:
+              _default: temp
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: RELEASES_URL
+            value:
+              _default: https://gitlab.com
+          - name: REMARKS_URL
+            value:
+              _default: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks
+          - name: RESOURCES_URL
+            value:
+              _default: http://backend-svc.resources.svc.cluster.local:80
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: STATES_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: SUBSCRIPTIONS_URL
+            value:
+              _default: http://backend-svc.subscriptions.svc.cluster.local:80
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:80
+          - name: TARGET_URL
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+          - name: USE_SUBSCRIPTIONS
+            value:
+              _default: "false"
+          - name: WIDTH_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+          - name: WIDTH_THUMB_STATES
+            value:
+              _default: "120"
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOW_URL
+            value:
+              _default: http://backend-svc.processing.svc.cluster.local:80/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: documentations
+            vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres
+            vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
+              {{- with secret "secrets/data/apps/documentations/postgres" -}}
+              POSTGRES_ADDRESS={{ index .Data.data "host" }}
+              POSTGRES_PORT={{ index .Data.data "port" }}
+              POSTGRES_DB={{ index .Data.data "database" }}
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-common: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
+              RELEASES_TOKEN={{ index .Data.data "documentations_releases_token" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              {{ index .Data.data "documentations_s3_service_account_json" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}

apps/documentations/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: documentations-vault
-  namespace: documentations

apps/documentations/dsinv/documentations-api.yaml

@@ -1,110 +1,161 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: documentations-api
   namespace: documentations
 spec:
-  replicas: 4
+  values:
-  template:
+    services:
-    spec:
+      backend:
-      containers:
+        deployment:
-      - name: documentations-api
+          replicaCount:
-        image: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_54880e92
+            _default: 4
-        env:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_54880e92
+        envs:
           - name: PUBLIC_LINK_HOST
-          value: https://document-link.sarex.dsinv.ru
+            value:
+              _default: https://document-link.sarex.dsinv.ru
           - name: POSTGRES_ADDRESS
-          value: postgres-service
+            value:
+              _default: postgres-service
           - name: POSTGRES_PORT
-          value: '5432'
+            value:
+              _default: "5432"
           - name: POSTGRES_DB
-          value: documentations
+            value:
+              _default: documentations
           - name: POSTGRES_POOL_SIZE
-          value: '20'
+            value:
+              _default: "20"
           - name: LAST_MASTER_BIM
-          value: '36311'
+            value:
+              _default: "36311"
           - name: API_ADDRESS
-          value: 0.0.0.0:8080
+            value:
+              _default: 0.0.0.0:8080
           - name: API_ADDRESS_FILE
-          value: 0.0.0.0:8080
+            value:
+              _default: 0.0.0.0:8080
           - name: ENABLE_SQL_QUERY
-          value: '0'
+            value:
+              _default: "0"
           - name: ENABLE_SSL
-          value: '0'
+            value:
+              _default: "0"
           - name: ENABLE_MAILGUN
-          value: 'false'
+            value:
+              _default: "false"
           - name: ENABLE_SMTP
-          value: 'true'
+            value:
+              _default: "true"
           - name: ENABLE_S3
-          value: '1'
+            value:
+              _default: "1"
           - name: USE_BIM_INSERTER
-          value: '0'
+            value:
+              _default: "0"
           - name: CONTAINER_REGISTRY
-          value: cr.yandex/crp3ccidau046kdj8g9q
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
           - name: ENVIRONMENT
-          value: production
+            value:
+              _default: production
           - name: HOST
-          value: http://documentations-service.documentations.svc.cluster.local:8080
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:8080
           - name: FILE_STREAM_HOST
-          value: sarex.dsinv.ru
+            value:
+              _default: sarex.dsinv.ru
           - name: DOCUMENTATION_URL
-          value: http://documentations-service.documentations.svc.cluster.local:8080/
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:8080/
           - name: WORKFLOW_URL
-          value: http://workflows-service.workflow.svc.cluster.local:8000/
+            value:
+              _default: http://workflows-service.workflow.svc.cluster.local:8000/
           - name: WORKSPACE_URL
-          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:8000/
           - name: BIM_API_URL
-          value: http://bim-api-service.bim.svc.cluster.local:8080/
+            value:
+              _default: http://bim-api-service.bim.svc.cluster.local:8080/
           - name: BIM_API_V2_URL
-          value: http://backend-service.bim.svc.cluster.local:8000/
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
           - name: WORKSPACE_BUNDLE_VERSION
-          value: v1
+            value:
+              _default: v1
           - name: SYSTEM_LOG_URL
-          value: http://api-service.system-log.svc.cluster.local:8000
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:8000
           - name: DJANGO_HOST
-          value: http://backend.django.svc.cluster.local:8000
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
           - name: MARKS_PROCESSING_URL
-          value: http://marks-service.documentations.svc.cluster.local:8000
+            value:
+              _default: http://marks-service.documentations.svc.cluster.local:8000
           - name: NAMESPACE
-          value: documentations
+            value:
+              _default: documentations
           - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-          value: '5'
+            value:
+              _default: "5"
           - name: DJANGO_ORIGINATOR
-          value: docs_prod
+            value:
+              _default: docs_prod
           - name: WORKFLOW_IMAGES_VERSION
-          value: master
+            value:
+              _default: master
           - name: WORKSPACE_V2_EXTERNAL_URL
-          value: https://sarex.dsinv.ru/workspaces-v2/
+            value:
+              _default: https://sarex.dsinv.ru/workspaces-v2/
           - name: WORKFLOWS_IMAGES_VERSION
-          value: master
+            value:
+              _default: master
           - name: FLOWS_URL
-          value: http://backend-service.flows.svc.cluster.local:8000
+            value:
+              _default: http://backend-service.flows.svc.cluster.local:8000
           - name: S3_SERVICE_ACCOUNT
-          value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+            value:
+              _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
           - name: READ_WRITE_TIMEOUT_FILE_STREAM
-          value: 6h
+            value:
+              _default: 6h
           - name: CACHE_DEFAULT_EXPIRATION
-          value: 60s
+            value:
+              _default: 60s
           - name: CACHE_CLEANUP_INTERVAL
-          value: 60s
+            value:
+              _default: 60s
           - name: USE_CACHE_IN_FILE_STREAMER
-          value: '1'
+            value:
+              _default: "1"
           - name: IS_CONVERTED_PDF_UPLOADING_TO_S3
-          value: 'false'
+            value:
+              _default: "false"
           - name: TRACER_USE
-          value: '0'
+            value:
+              _default: "0"
           - name: TRACER_HOST
-          value: signoz-otel-collector-external.signoz.svc.cluster.local:4317
+            value:
+              _default: signoz-otel-collector-external.signoz.svc.cluster.local:4317
           - name: SERVICE_NAME
-          value: documentations-api.documentations-prod
+            value:
+              _default: documentations-api.documentations-prod
           - name: SERVICE_NAME_FILESTREAM
-          value: filestream-api.documentations-prod
+            value:
+              _default: filestream-api.documentations-prod
           - name: TRACER_USE_INSECURE
-          value: '1'
+            value:
+              _default: "1"
           - name: DELETE_S3D_AFTER_MESHOPT
-          value: 'true'
+            value:
+              _default: "true"
           - name: CONVERT_DWG_TO_GEOJSON
-          value: 'false'
+            value:
+              _default: "false"
           - name: CONVERT_DXF_TO_GEOJSON
-          value: 'false'
+            value:
+              _default: "false"

apps/documentations/dsinv/documentations-filestream.yaml

@@ -1,74 +1,107 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: documentations-filestream
   namespace: documentations
 spec:
-  replicas: 3
+  values:
-  template:
+    services:
-    spec:
+      backend:
-      containers:
+        deployment:
-      - name: documentations-filestream
+          replicaCount:
-        image: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_54880e92
+            _default: 3
-        env:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_54880e92
+        envs:
           - name: POSTGRES_ADDRESS
-          value: postgres-service
+            value:
+              _default: postgres-service
           - name: POSTGRES_PORT
-          value: '5432'
+            value:
+              _default: "5432"
           - name: POSTGRES_DB
-          value: documentations
+            value:
+              _default: documentations
           - name: POSTGRES_POOL_SIZE
-          value: '20'
+            value:
+              _default: "20"
           - name: API_ADDRESS
-          value: 0.0.0.0:8080
+            value:
+              _default: 0.0.0.0:8080
           - name: API_ADDRESS_FILE
-          value: 0.0.0.0:8080
+            value:
+              _default: 0.0.0.0:8080
           - name: ENABLE_SQL_QUERY
-          value: '1'
+            value:
+              _default: "1"
           - name: ENABLE_SSL
-          value: '0'
+            value:
+              _default: "0"
           - name: ENABLE_S3
-          value: '1'
+            value:
+              _default: "1"
           - name: CONTAINER_REGISTRY
-          value: cr.yandex/crp3ccidau046kdj8g9q
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
           - name: ENVIRONMENT
-          value: production
+            value:
+              _default: production
           - name: HOST
-          value: http://documentations-service.documentations.svc.cluster.local:8080
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:8080
           - name: FILE_STREAM_HOST
-          value: sarex.dsinv.ru
+            value:
+              _default: sarex.dsinv.ru
           - name: DOCUMENTATION_URL
-          value: http://documentations-service.documentations.svc.cluster.local:8080/
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:8080/
           - name: WORKFLOW_URL
-          value: http://workflows-service.workflow.svc.cluster.local:8000/
+            value:
+              _default: http://workflows-service.workflow.svc.cluster.local:8000/
           - name: WORKSPACE_URL
-          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:8000/
           - name: BIM_API_URL
-          value: http://bim-api-service.bim.svc.cluster.local:8080/
+            value:
+              _default: http://bim-api-service.bim.svc.cluster.local:8080/
           - name: BIM_API_V2_URL
-          value: http://backend-service.bim.svc.cluster.local:8000/
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
           - name: WORKSPACE_BUNDLE_VERSION
-          value: v1
+            value:
+              _default: v1
           - name: DJANGO_HOST
-          value: http://backend.django.svc.cluster.local:8000
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
           - name: NAMESPACE
-          value: sarex-documentations
+            value:
+              _default: sarex-documentations
           - name: DJANGO_ORIGINATOR
-          value: docs_prod
+            value:
+              _default: docs_prod
           - name: WORKFLOW_IMAGES_VERSION
-          value: master
+            value:
+              _default: master
           - name: WORKFLOWS_IMAGES_VERSION
-          value: master
+            value:
+              _default: master
           - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-          value: '5'
+            value:
+              _default: "5"
           - name: S3_SERVICE_ACCOUNT
-          value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+            value:
+              _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
           - name: READ_WRITE_TIMEOUT_FILE_STREAM
-          value: 6h
+            value:
+              _default: 6h
           - name: CACHE_DEFAULT_EXPIRATION
-          value: 60s
+            value:
+              _default: 60s
           - name: CACHE_CLEANUP_INTERVAL
-          value: 60s
+            value:
+              _default: 60s
           - name: USE_CACHE_IN_FILE_STREAMER
-          value: '1'
+            value:
+              _default: "1"

apps/documentations/dsinv/frontend.yaml

@@ -1,12 +1,13 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: frontend
   namespace: documentations
 spec:
-  template:
+  values:
-    spec:
+    services:
-      containers:
+      frontend:
-      - name: frontend
+        image:
-        image: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_b80d28d4
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_b80d28d4

apps/documentations/dsinv/kustomization.yaml

@@ -10,17 +10,17 @@ resources:
 patches:
 - path: documentations-api.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: documentations-api
 - path: documentations-filestream.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: documentations-filestream
 - path: frontend.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: frontend
 - path: pdm-api.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: pdm-api

apps/documentations/dsinv/pdm-api.yaml

@@ -1,120 +1,173 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: pdm-api
   namespace: documentations
 spec:
-  replicas: 3
+  values:
-  template:
+    services:
-    spec:
+      backend:
-      containers:
+        deployment:
-      - name: pdm-api
+          replicaCount:
-        image: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_542e5343
+            _default: 3
-        env:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_542e5343
+        envs:
           - name: OBSERVABILITY_COLLECTOR_ENDPOINT
-          value: temp
+            value:
+              _default: temp
           - name: USE_SUBSCRIPTIONS
-          value: 'false'
+            value:
+              _default: "false"
           - name: RELEASES_URL
-          value: https://gitlab.com
+            value:
+              _default: https://gitlab.com
           - name: APP_NAME
-          value: pdm_v2
+            value:
+              _default: pdm_v2
           - name: APP_VERSION
-          value: 0.0.1
+            value:
+              _default: "0.0.1"
           - name: LOG_LEVEL
-          value: INFO
+            value:
+              _default: INFO
           - name: HTTP_PORT
-          value: '8080'
+            value:
+              _default: "8080"
           - name: POSTGRES_ADDRESS
-          value: postgres-service.documentations.svc.cluster.local
+            value:
+              _default: postgres-service.documentations.svc.cluster.local
           - name: POSTGRES_PORT
-          value: '5432'
+            value:
+              _default: "5432"
           - name: POSTGRES_DB
-          value: documentations
+            value:
+              _default: documentations
           - name: POSTGRES_POOL_SIZE
-          value: '20'
+            value:
+              _default: "20"
           - name: API_ADDRESS
-          value: 0.0.0.0:8080
+            value:
+              _default: 0.0.0.0:8080
           - name: API_ADDRESS_FILE
-          value: 0.0.0.0:8080
+            value:
+              _default: 0.0.0.0:8080
           - name: ENABLE_OBSERVABILITY
-          value: 'false'
+            value:
+              _default: "false"
           - name: ENABLE_SSL
-          value: '0'
+            value:
+              _default: "0"
           - name: ENABLE_S3
-          value: '1'
+            value:
+              _default: "1"
           - name: DOCUMENTATION_URL
-          value: http://documentations-service.documentations.svc.cluster.local:8080/
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:8080/
           - name: WORKFLOW_URL
-          value: http://workflows-service.workflow.svc.cluster.local:8000/
+            value:
+              _default: http://workflows-service.workflow.svc.cluster.local:8000/
           - name: WORKSPACE_URL
-          value: http://workspaces-service.workspaces.svc.cluster.local:8000
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:8000
           - name: BIM_API_V2_URL
-          value: http://backend-service.bim.svc.cluster.local:8000/
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
           - name: BIM_V2_HOST
-          value: http://backend-service.bim.svc.cluster.local:8000/
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
           - name: WORKSPACE_BUNDLE_VERSION
-          value: v1
+            value:
+              _default: v1
           - name: DJANGO_HOST
-          value: http://backend.django.svc.cluster.local:8000
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
           - name: NAMESPACE
-          value: documentations
+            value:
+              _default: documentations
           - name: DJANGO_ORIGINATOR
-          value: docs_prod
+            value:
+              _default: docs_prod
           - name: FLOWS_URL
-          value: http://backend-service.flows.svc.cluster.local:8000
+            value:
+              _default: http://backend-service.flows.svc.cluster.local:8000
           - name: RESOURCES_URL
-          value: http://resources-service.resources.svc.cluster.local:8000
+            value:
+              _default: http://resources-service.resources.svc.cluster.local:8000
           - name: REMARKS_URL
-          value: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks
+            value:
+              _default: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks
           - name: ATTACHMENTS_URL
-          value: http://attachments-service.attachments.svc.cluster.local:80
+            value:
+              _default: http://attachments-service.attachments.svc.cluster.local:80
           - name: WORKFLOW_IMAGES_VERSION
-          value: master
+            value:
+              _default: master
           - name: WORKFLOWS_IMAGES_VERSION
-          value: master
+            value:
-        - name: WORKFLOWS_IMAGES_VERSION
+              _default: master
-          value: master
           - name: INSPECTIONS_URL
-          value: http://inspections-service.inspections
+            value:
+              _default: http://inspections-service.inspections
           - name: STATES_URL
-          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:8000/
           - name: WIDTH_THUMB_STATES
-          value: '120'
+            value:
+              _default: "120"
           - name: HEIGHT_THUMB_STATES
-          value: '73'
+            value:
+              _default: "73"
           - name: WIDTH_THUMB_ATTACHMENTS
-          value: '300'
+            value:
+              _default: "300"
           - name: HEIGHT_THUMB_ATTACHMENTS
-          value: '300'
+            value:
+              _default: "300"
           - name: ENABLE_PERMISSIONS_FILTER
-          value: '1'
+            value:
+              _default: "1"
           - name: PERMISSIONS_FILTER_COMPANIES
-          value: '[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]'
+            value:
+              _default: "[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]"
           - name: SUBSCRIPTIONS_URL
-          value: http://sarex-subscriptions-service.subscriptions
+            value:
+              _default: http://sarex-subscriptions-service.subscriptions
           - name: SYSTEM_LOG_URL
-          value: http://api-service.system-log.svc.cluster.local:8000
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:8000
           - name: API_HOST_PREFIX
-          value: /gateway
+            value:
+              _default: /gateway
           - name: TARGET_URL
-          value: http://backend.django.svc.cluster.local:8000
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
           - name: EAV_URL
-          value: http://eav-service.eav.svc.cluster.local:8000
+            value:
+              _default: http://eav-service.eav.svc.cluster.local:8000
           - name: NOTES_URL
-          value: http://backend-service.notes.svc.cluster.local:8000
+            value:
+              _default: http://backend-service.notes.svc.cluster.local:8000
           - name: S3_SERVICE_ACCOUNT
-          value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+            value:
+              _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
           - name: READ_WRITE_TIMEOUT_FILE_STREAM
-          value: 6h
+            value:
+              _default: 6h
           - name: CACHE_DEFAULT_EXPIRATION
-          value: 60s
+            value:
+              _default: 60s
           - name: CACHE_CLEANUP_INTERVAL
-          value: 60s
+            value:
+              _default: 60s
           - name: USE_CACHE_IN_FILE_STREAMER
-          value: '1'
+            value:
+              _default: "1"
           - name: ENVIRONMENT
-          value: prod
+            value:
+              _default: prod
           - name: TRANSMITTALS_BASE_URL
-          value: http://transmittal-service.transmittals.svc.cluster.local:80
+            value:
+              _default: http://transmittal-service.transmittals.svc.cluster.local:80

apps/rfi/base/backend-deployment.yaml

@@ -1,99 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: rfi-backend-api
-  namespace: rfi
-  labels:
-    app: rfi-backend-api
-    service: api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: rfi-backend-api
-  template:
-    metadata:
-      labels:
-        app: rfi-backend-api
-        service: api
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: rfi
-        vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres
-        vault.hashicorp.com/agent-inject-template-rfi-db: |-
-          {{- with secret "secrets/data/apps/rfi/postgres" -}}
-          DB_HOST={{ index .Data.data "host" }}
-          DB_PORT={{ index .Data.data "port" }}
-          DB_NAME={{ index .Data.data "database" }}
-          DB_USER={{ index .Data.data "username" }}
-          DB_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi
-        vault.hashicorp.com/agent-inject-template-rfi-s3: |-
-          {{- with secret "secrets/data/minio/apps/rfi" -}}
-          YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
-          YC_S3_BUCKET_NAME=rfi
-          YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi
-        vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/rfi" -}}
-          RABBITMQ_VHOST={{ index .Data.data "vhost" }}
-          RABBITMQ_USERNAME={{ index .Data.data "username" }}
-          RABBITMQ_PASSWORD={{ index .Data.data "password" }}
-          RABBITMQ_PORT=5672
-          RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-rfi-django-auth: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_SECRET_KEY={{ index .Data.data "key" }}
-          SAREX_BACKEND_AUTH={{ index .Data.data "key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: rfi-vault
-      containers:
-        - name: api
-          image: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db
-              [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3
-              [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq
-              [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth
-              set +a
-              exec ./entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: JWT_AUTH_ENABLE
-              value: "True"
-            - name: NOTIFICATIONS_ENABLE
-              value: "false"
-            - name: NOTIFICATIONS_EMAIL_FROM
-              value: hello@sarex.io
-            - name: NOTIFICATIONS_SERVICE_URL
-              value: https://sarex.contour.infra.sarex.tech/rfi
-            - name: SAREX_BACKEND_URL
-              value: http://backend-svc.django.svc.cluster.local
-            - name: EAV_URL
-              value: http://backend-svc.eav.svc.cluster.local:80
-            - name: GATEWAY_URL
-              value: http://pdm-svc.documentations.svc.cluster.local:80
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/rfi/base/backend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-svc
-  namespace: rfi
-spec:
-  type: ClusterIP
-  selector:
-    app: rfi-backend-api
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8000
-      protocol: TCP

apps/rfi/base/backend.yaml

@@ -0,0 +1,149 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: rfi
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: rfi-vault
+        deployment:
+          enabled: true
+          name:
+            _default: rfi-backend-api
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db
+                [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3
+                [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq
+                [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth
+                set +a
+                exec ./entrypoint.sh
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: backend-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8000
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "True"
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "false"
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: hello@sarex.io
+          - name: NOTIFICATIONS_SERVICE_URL
+            value:
+              _default: https://sarex.contour.infra.sarex.tech/rfi
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: http://backend-svc.django.svc.cluster.local
+          - name: EAV_URL
+            value:
+              _default: http://backend-svc.eav.svc.cluster.local:80
+          - name: GATEWAY_URL
+            value:
+              _default: http://pdm-svc.documentations.svc.cluster.local:80
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: rfi
+            vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres
+            vault.hashicorp.com/agent-inject-template-rfi-db: |-
+              {{- with secret "secrets/data/apps/rfi/postgres" -}}
+              DB_HOST={{ index .Data.data "host" }}
+              DB_PORT={{ index .Data.data "port" }}
+              DB_NAME={{ index .Data.data "database" }}
+              DB_USER={{ index .Data.data "username" }}
+              DB_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi
+            vault.hashicorp.com/agent-inject-template-rfi-s3: |-
+              {{- with secret "secrets/data/minio/apps/rfi" -}}
+              YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
+              YC_S3_BUCKET_NAME=rfi
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi
+            vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/rfi" -}}
+              RABBITMQ_VHOST={{ index .Data.data "vhost" }}
+              RABBITMQ_USERNAME={{ index .Data.data "username" }}
+              RABBITMQ_PASSWORD={{ index .Data.data "password" }}
+              RABBITMQ_PORT=5672
+              RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-rfi-django-auth: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_SECRET_KEY={{ index .Data.data "key" }}
+              SAREX_BACKEND_AUTH={{ index .Data.data "key" }}
+              {{- end -}}

apps/rfi/base/celery-deployment.yaml

@@ -1,99 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: celery
-  namespace: rfi
-  labels:
-    app: celery
-    service: celery
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: celery
-  template:
-    metadata:
-      labels:
-        app: celery
-        service: celery
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: rfi
-        vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres
-        vault.hashicorp.com/agent-inject-template-rfi-db: |-
-          {{- with secret "secrets/data/apps/rfi/postgres" -}}
-          DB_HOST={{ index .Data.data "host" }}
-          DB_PORT={{ index .Data.data "port" }}
-          DB_NAME={{ index .Data.data "database" }}
-          DB_USER={{ index .Data.data "username" }}
-          DB_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi
-        vault.hashicorp.com/agent-inject-template-rfi-s3: |-
-          {{- with secret "secrets/data/minio/apps/rfi" -}}
-          YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
-          YC_S3_BUCKET_NAME=rfi
-          YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi
-        vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/rfi" -}}
-          RABBITMQ_VHOST={{ index .Data.data "vhost" }}
-          RABBITMQ_USERNAME={{ index .Data.data "username" }}
-          RABBITMQ_PASSWORD={{ index .Data.data "password" }}
-          RABBITMQ_PORT=5672
-          RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-rfi-django-auth: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_SECRET_KEY={{ index .Data.data "key" }}
-          SAREX_BACKEND_AUTH={{ index .Data.data "key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: rfi-vault
-      containers:
-        - name: celery
-          image: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:dev4
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db
-              [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3
-              [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq
-              [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth
-              set +a
-              exec uv run celery -A config worker -l info
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: JWT_AUTH_ENABLE
-              value: "True"
-            - name: NOTIFICATIONS_ENABLE
-              value: "false"
-            - name: NOTIFICATIONS_EMAIL_FROM
-              value: hello@sarex.io
-            - name: NOTIFICATIONS_SERVICE_URL
-              value: https://lk.srx.wb.ru:30443/rfi
-            - name: SAREX_BACKEND_URL
-              value: http://backend-svc.django.svc.cluster.local
-            - name: EAV_URL
-              value: http://backend-svc.eav.svc.cluster.local:80
-            - name: GATEWAY_URL
-              value: http://pdm-api.documentations.svc.cluster.local:8080
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/rfi/base/celery.yaml

@@ -0,0 +1,139 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: rfi
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      celery:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: rfi-vault
+        deployment:
+          enabled: true
+          name:
+            _default: celery
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db
+                [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3
+                [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq
+                [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth
+                set +a
+                exec uv run celery -A config worker -l info
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:dev4
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: false
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "True"
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "false"
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: hello@sarex.io
+          - name: NOTIFICATIONS_SERVICE_URL
+            value:
+              _default: https://lk.srx.wb.ru:30443/rfi
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: http://backend-svc.django.svc.cluster.local
+          - name: EAV_URL
+            value:
+              _default: http://backend-svc.eav.svc.cluster.local:80
+          - name: GATEWAY_URL
+            value:
+              _default: http://pdm-api.documentations.svc.cluster.local:8080
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: rfi
+            vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres
+            vault.hashicorp.com/agent-inject-template-rfi-db: |-
+              {{- with secret "secrets/data/apps/rfi/postgres" -}}
+              DB_HOST={{ index .Data.data "host" }}
+              DB_PORT={{ index .Data.data "port" }}
+              DB_NAME={{ index .Data.data "database" }}
+              DB_USER={{ index .Data.data "username" }}
+              DB_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi
+            vault.hashicorp.com/agent-inject-template-rfi-s3: |-
+              {{- with secret "secrets/data/minio/apps/rfi" -}}
+              YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
+              YC_S3_BUCKET_NAME=rfi
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi
+            vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/rfi" -}}
+              RABBITMQ_VHOST={{ index .Data.data "vhost" }}
+              RABBITMQ_USERNAME={{ index .Data.data "username" }}
+              RABBITMQ_PASSWORD={{ index .Data.data "password" }}
+              RABBITMQ_PORT=5672
+              RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-rfi-django-auth: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_SECRET_KEY={{ index .Data.data "key" }}
+              SAREX_BACKEND_AUTH={{ index .Data.data "key" }}
+              {{- end -}}

apps/rfi/base/frontend-deployment.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: rfi
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-    spec:
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/rfi-frontend:production_b827756f_wb
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-      imagePullSecrets:
-        - name: regcred

apps/rfi/base/frontend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-svc
-  namespace: rfi
-spec:
-  type: ClusterIP
-  selector:
-    app: frontend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/rfi/base/frontend.yaml

@@ -0,0 +1,70 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: rfi
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      frontend:
+        enabled: true
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-frontend:production_b827756f_wb
+          pullPolicy:
+            _default: IfNotPresent
+        deployment:
+          enabled: true
+          name:
+            _default: frontend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 80
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        service:
+          enabled: true
+          name:
+            _default: frontend-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 80
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred

apps/rfi/base/kustomization.yaml

@@ -4,9 +4,6 @@ kind: Kustomization
 namespace: rfi
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
+  - backend.yaml
-  - backend-deployment.yaml
+  - celery.yaml
-  - celery-deployment.yaml
+  - frontend.yaml
-  - frontend-deployment.yaml
-  - backend-service.yaml
-  - frontend-service.yaml

apps/rfi/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: rfi-vault
-  namespace: rfi

apps/workspaces/base/backend-deployment.yaml

@@ -1,104 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: workspaces-api
-  namespace: workspaces
-  labels:
-    app: workspaces-api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: workspaces-api
-  template:
-    metadata:
-      labels:
-        app: workspaces-api
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: workspaces
-        vault.hashicorp.com/agent-inject-secret-workspaces-db: secrets/data/apps/workspaces/postgres
-        vault.hashicorp.com/agent-inject-template-workspaces-db: |-
-          {{- with secret "secrets/data/apps/workspaces/postgres" -}}
-          POSTGRES_ADDRESS={{ index .Data.data "host" }}
-          POSTGRES_PORT={{ index .Data.data "port" }}
-          POSTGRES_DB={{ index .Data.data "database" }}
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-workspaces-django-auth: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-workspaces-django-auth: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: workspaces-vault
-      containers:
-        - name: workspaces-api
-          image: cr.yandex/crp3ccidau046kdj8g9q/workspaces:prod_4961b1f1
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/workspaces-db ] && . /vault/secrets/workspaces-db
-              [ -f /vault/secrets/workspaces-django-auth ] && . /vault/secrets/workspaces-django-auth
-              set +a
-              exec /api
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: POSTGRES_POOL_SIZE
-              value: "3"
-            - name: BUNDLES_RETRY_COUNT
-              value: "5"
-            - name: BUNDLES_NJOBS
-              value: "5"
-            - name: API_ADDRESS
-              value: 0.0.0.0:8000
-            - name: NAMESPACE
-              value: workspaces
-            - name: ENABLE_SQL_QUERY
-              value: "0"
-            - name: ENABLE_SSL
-              value: "0"
-            - name: DOCUMENTATION_HOST
-              value: http://backend-api-svc.documentations.svc.cluster.local:80
-            - name: DOCUMENTATION_LOGGER_FEATURE
-              value: "0"
-            - name: DOCUMENTATION_ORIGINATOR
-              value: prod_ws
-            - name: ENVIRONMENT
-              value: prod
-            - name: DJANGO_HOST
-              value: http://backend.django.svc.cluster.local:8000
-            - name: DJANGO_ORIGINATOR
-              value: docs_prod
-
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 8000
-            initialDelaySeconds: 10
-            periodSeconds: 60
-            failureThreshold: 10
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 8000
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            failureThreshold: 20
-      imagePullSecrets:
-        - name: regcred

apps/workspaces/base/backend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-svc
-  namespace: workspaces
-spec:
-  type: ClusterIP
-  selector:
-    app: workspaces-api
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8000
-      protocol: TCP

apps/workspaces/base/backend.yaml

@@ -0,0 +1,175 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: workspaces
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: workspaces-vault
+        deployment:
+          enabled: true
+          name:
+            _default: workspaces-api
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/workspaces-db ] && . /vault/secrets/workspaces-db
+                [ -f /vault/secrets/workspaces-django-auth ] && . /vault/secrets/workspaces-django-auth
+                set +a
+                exec /api
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 8000
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 60
+              failureThreshold:
+                _default: 10
+            readiness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 8000
+              initialDelaySeconds:
+                _default: 5
+              periodSeconds:
+                _default: 5
+              failureThreshold:
+                _default: 20
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces:prod_4961b1f1
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: backend-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8000
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+          - name: BUNDLES_RETRY_COUNT
+            value:
+              _default: "5"
+          - name: BUNDLES_NJOBS
+            value:
+              _default: "5"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8000
+          - name: NAMESPACE
+            value:
+              _default: workspaces
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80
+          - name: DOCUMENTATION_LOGGER_FEATURE
+            value:
+              _default: "0"
+          - name: DOCUMENTATION_ORIGINATOR
+            value:
+              _default: prod_ws
+          - name: ENVIRONMENT
+            value:
+              _default: prod
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: workspaces
+            vault.hashicorp.com/agent-inject-secret-workspaces-db: secrets/data/apps/workspaces/postgres
+            vault.hashicorp.com/agent-inject-template-workspaces-db: |-
+              {{- with secret "secrets/data/apps/workspaces/postgres" -}}
+              POSTGRES_ADDRESS={{ index .Data.data "host" }}
+              POSTGRES_PORT={{ index .Data.data "port" }}
+              POSTGRES_DB={{ index .Data.data "database" }}
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-workspaces-django-auth: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-workspaces-django-auth: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
+              {{- end -}}

apps/workspaces/base/frontend-deployment.yaml

@@ -1,46 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: workspaces
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-    spec:
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_7f95769f
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            failureThreshold: 10
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            failureThreshold: 20
-      imagePullSecrets:
-        - name: regcred

apps/workspaces/base/frontend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-svc
-  namespace: workspaces
-spec:
-  type: ClusterIP
-  selector:
-    app: frontend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/workspaces/base/frontend.yaml

@@ -0,0 +1,98 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: workspaces
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      frontend:
+        enabled: true
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_7f95769f
+          pullPolicy:
+            _default: IfNotPresent
+        deployment:
+          enabled: true
+          name:
+            _default: frontend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 80
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 80
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 10
+              failureThreshold:
+                _default: 10
+            readiness:
+              enabled:
+                _default: true
+              type:
+                _default: httpGet
+              httpGet:
+                path:
+                  _default: /ping
+                port:
+                  _default: 80
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 10
+              failureThreshold:
+                _default: 20
+        service:
+          enabled: true
+          name:
+            _default: frontend-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 80
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred

apps/workspaces/base/kustomization.yaml

@@ -4,8 +4,5 @@ kind: Kustomization
 namespace: workspaces
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
+  - backend.yaml
-  - backend-deployment.yaml
+  - frontend.yaml
-  - backend-service.yaml
-  - frontend-deployment.yaml
-  - frontend-service.yaml

apps/workspaces/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: workspaces-vault
-  namespace: workspaces

apps/workspaces/dsinv/frontend.yaml

@@ -1,12 +1,13 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: frontend
   namespace: workspaces
 spec:
-  template:
+  values:
-    spec:
+    services:
-      containers:
+      frontend:
-      - name: frontend
+        image:
-        image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_c4cc968d
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_c4cc968d

apps/workspaces/dsinv/kustomization.yaml

@@ -8,9 +8,9 @@ resources:
 patches:
 - path: workspaces-api.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
-    name: workspaces-api
+    name: backend
 - path: frontend.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: frontend

apps/workspaces/dsinv/workspaces-api.yaml

@@ -1,45 +1,62 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
-  name: workspaces-api
+  name: backend
   namespace: workspaces
 spec:
-  template:
+  values:
-    spec:
+    services:
-      containers:
+      backend:
-      - name: workspaces-api
+        image:
-        image: cr.yandex/crp3ccidau046kdj8g9q/workspaces-backend:production_fef43835
+          name:
-        env:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-backend:production_fef43835
+        envs:
           - name: POSTGRES_ADDRESS
-          value: postgres-service
+            value:
+              _default: postgres-service
           - name: POSTGRES_PORT
-          value: '5432'
+            value:
+              _default: "5432"
           - name: POSTGRES_DB
-          value: workspaces_db
+            value:
+              _default: workspaces_db
           - name: POSTGRES_POOL_SIZE
-          value: '3'
+            value:
+              _default: "3"
           - name: BUNDLES_RETRY_COUNT
-          value: '5'
+            value:
+              _default: "5"
           - name: BUNDLES_NJOBS
-          value: '5'
+            value:
+              _default: "5"
           - name: API_ADDRESS
-          value: 0.0.0.0:8000
+            value:
+              _default: 0.0.0.0:8000
           - name: NAMESPACE
-          value: sarex-workspaces
+            value:
+              _default: sarex-workspaces
           - name: ENABLE_SQL_QUERY
-          value: '0'
+            value:
+              _default: "0"
           - name: ENABLE_SSL
-          value: '0'
+            value:
+              _default: "0"
           - name: DOCUMENTATION_HOST
-          value: http://documentations-service.documentations.svc.cluster.local:8080
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:8080
           - name: DOCUMENTATION_LOGGER_FEATURE
-          value: '0'
+            value:
+              _default: "0"
           - name: DOCUMENTATION_ORIGINATOR
-          value: prod_ws
+            value:
+              _default: prod_ws
           - name: ENVIRONMENT
-          value: prod
+            value:
+              _default: prod
           - name: DJANGO_HOST
-          value: http://backend.django.svc.cluster.local:8000
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
           - name: DJANGO_ORIGINATOR
-          value: docs_prod
+            value:
+              _default: docs_prod

apps/workspaces/yc-k8s-test/kustomization.yaml

@@ -7,5 +7,5 @@ resources:
 patches:
   - path: replicas.yaml
     target:
-      kind: Deployment
+      kind: HelmRelease
-      name: workspaces-api
+      name: backend

apps/workspaces/yc-k8s-test/replicas.yaml

@@ -1,8 +1,13 @@
 ---
-apiVersion: apps/v1
+apiVersion: helm.toolkit.fluxcd.io/v2
-kind: Deployment
+kind: HelmRelease
 metadata:
   name: backend
   namespace: workspaces
 spec:
-  replicas: 1
+  values:
+    services:
+      backend:
+        deployment:
+          replicaCount:
+            _default: 1