diff --git a/apps/attachments/base/helmrelease.yaml b/apps/attachments/base/helmrelease.yaml index a7a5e46..aee5f94 100644 --- a/apps/attachments/base/helmrelease.yaml +++ b/apps/attachments/base/helmrelease.yaml @@ -87,9 +87,9 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: attachments - vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/postgresql/apps/attachments + vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/apps/attachments/postgres vault.hashicorp.com/agent-inject-template-attachments-db: |- - {{- with secret "secrets/data/postgresql/apps/attachments" -}} + {{- with secret "secrets/data/apps/attachments/postgres" -}} DATABASE_HOST={{ index .Data.data "host" }} DATABASE_PORT={{ index .Data.data "port" }} DATABASE_NAME={{ index .Data.data "database" }} diff --git a/apps/attachments/base/kustomization.yaml b/apps/attachments/base/kustomization.yaml index c9ccb75..9cb4143 100644 --- a/apps/attachments/base/kustomization.yaml +++ b/apps/attachments/base/kustomization.yaml @@ -3,4 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: attachments resources: + - namespace.yaml - helmrelease.yaml diff --git a/apps/attachments/base/namespace.yaml b/apps/attachments/base/namespace.yaml new file mode 100644 index 0000000..f58896f --- /dev/null +++ b/apps/attachments/base/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: attachments + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/attachments/d8-ugmk-prod/patch.yaml b/apps/attachments/d8-ugmk-prod/patch.yaml index 8c185da..ad66013 100644 --- a/apps/attachments/d8-ugmk-prod/patch.yaml +++ b/apps/attachments/d8-ugmk-prod/patch.yaml @@ -11,10 +11,10 @@ spec: podAnnotations: _default: vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: attachments-vault - vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/postgresql/apps/attachments + vault.hashicorp.com/role: attachments + vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/apps/attachments/postgres vault.hashicorp.com/agent-inject-template-attachments-db: |- - {{- with secret "secrets/data/postgresql/apps/attachments" -}} + {{- with secret "secrets/data/apps/attachments/postgres" -}} DATABASE_HOST={{ index .Data.data "host" }} DATABASE_PORT={{ index .Data.data "port" }} DATABASE_NAME={{ index .Data.data "database" }} diff --git a/apps/auth-flow/d8-ugmk-prod/namespace.yaml b/apps/auth-flow/d8-ugmk-prod/namespace.yaml index fc05086..7c70f41 100644 --- a/apps/auth-flow/d8-ugmk-prod/namespace.yaml +++ b/apps/auth-flow/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: auth-flow labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/bim/base/backend-deployment.yaml b/apps/bim/base/backend-deployment.yaml deleted file mode 100644 index 9457626..0000000 --- a/apps/bim/base/backend-deployment.yaml +++ /dev/null @@ -1,108 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: bim - labels: - app: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: bim - vault.hashicorp.com/agent-inject-secret-bim-postgresql: secrets/data/postgresql/apps/bim - vault.hashicorp.com/agent-inject-template-bim-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/bim" -}} - POSTGRES_ADDRESS=postgresql.bim.svc.cluster.local - POSTGRES_ADDRESS_2=postgresql.bim.svc.cluster.local - POSTGRES_ADDRESS_3=postgresql.bim.svc.cluster.local - POSTGRES_ADDRESS_4=postgresql.bim.svc.cluster.local - POSTGRES_PORT=5432 - POSTGRES_PORT_2=5432 - POSTGRES_PORT_3=5432 - POSTGRES_PORT_4=5432 - POSTGRES_DB=bim_db - POSTGRES_DB_2=bim_db - POSTGRES_DB_3=bim_db - POSTGRES_DB_4=bim_db - POSTGRES_USER={{ index .Data.data "username" }} - POSTGRES_USER_2={{ index .Data.data "username" }} - POSTGRES_USER_3={{ index .Data.data "username" }} - POSTGRES_USER_4={{ index .Data.data "username" }} - POSTGRES_PASSWORD={{ index .Data.data "password" }} - POSTGRES_PASSWORD_2={{ index .Data.data "password" }} - POSTGRES_PASSWORD_3={{ index .Data.data "password" }} - POSTGRES_PASSWORD_4={{ index .Data.data "password" }} - {{- end -}} - spec: - serviceAccountName: bim-vault - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/bim-api:contour_3d704fef - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/bim-postgresql ] && . /vault/secrets/bim-postgresql - set +a - exec ./httpserver - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: LAST_MASTER_BIM - value: "100000" - - name: LAST_MASTER_BIM_V3 - value: "100000" - - name: DB_CERT_PATH_4 - value: /root/yandex_pg.pem - - name: DB_CERT_PATH_3 - value: /root/yandex_pg.pem - - name: DB_CERT_PATH_2 - value: /root/yandex_pg.pem - - name: LAST_SLAVE_1_BIM - value: "1000000" - - name: POSTGRES_POOL_SIZE - value: "30" - - name: API_ADDRESS - value: 0.0.0.0:8000 - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: ENABLE_SQL_QUERY - value: "0" - - name: ENABLE_SSL - value: "0" - resources: - requests: - cpu: 25m - memory: 100Mi - livenessProbe: - httpGet: - path: /ping - port: 8000 - initialDelaySeconds: 10 - periodSeconds: 60 - failureThreshold: 10 - readinessProbe: - httpGet: - path: /ping - port: 8000 - initialDelaySeconds: 5 - periodSeconds: 5 - failureThreshold: 20 - imagePullSecrets: - - name: regcred diff --git a/apps/bim/base/backend-service.yaml b/apps/bim/base/backend-service.yaml deleted file mode 100644 index 0f62368..0000000 --- a/apps/bim/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: bim -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/bim/base/backend.yaml b/apps/bim/base/backend.yaml new file mode 100644 index 0000000..dc5c8e0 --- /dev/null +++ b/apps/bim/base/backend.yaml @@ -0,0 +1,222 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: bim + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: bim-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/bim-api:contour_f9f2a39 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/bim-postgresql ] && . /vault/secrets/bim-postgresql + set +a + exec ./httpserver + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 60 + failureThreshold: + _default: 10 + readiness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 5 + periodSeconds: + _default: 5 + failureThreshold: + _default: 20 + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: LAST_MASTER_BIM + value: + _default: "100000" + + - name: LAST_MASTER_BIM_V3 + value: + _default: "100000" + + - name: DB_CERT_PATH_4 + value: + _default: "/root/yandex_pg.pem" + + - name: DB_CERT_PATH_3 + value: + _default: "/root/yandex_pg.pem" + + - name: DB_CERT_PATH_2 + value: + _default: "/root/yandex_pg.pem" + + - name: LAST_SLAVE_1_BIM + value: + _default: "1000000" + + - name: POSTGRES_POOL_SIZE + value: + _default: "30" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8000" + + - name: DJANGO_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: ENABLE_SQL_QUERY + value: + _default: "0" + + - name: ENABLE_SSL + value: + _default: "0" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: bim + vault.hashicorp.com/agent-inject-secret-bim-postgresql: secrets/data/apps/bim/postgres + vault.hashicorp.com/agent-inject-template-bim-postgresql: |- + {{- with secret "secrets/data/apps/bim/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_ADDRESS_2={{ index .Data.data "host" }} + POSTGRES_ADDRESS_3={{ index .Data.data "host" }} + POSTGRES_ADDRESS_4={{ index .Data.data "host" }} + POSTGRES_ADDRESS_5={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_PORT_2={{ index .Data.data "port" }} + POSTGRES_PORT_3={{ index .Data.data "port" }} + POSTGRES_PORT_4={{ index .Data.data "port" }} + POSTGRES_PORT_5={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} + POSTGRES_DB_2={{ index .Data.data "database" }} + POSTGRES_DB_3={{ index .Data.data "database" }} + POSTGRES_DB_4={{ index .Data.data "database" }} + POSTGRES_DB_5={{ index .Data.data "database" }} + POSTGRES_USER={{ index .Data.data "username" }} + POSTGRES_USER_2={{ index .Data.data "username" }} + POSTGRES_USER_3={{ index .Data.data "username" }} + POSTGRES_USER_4={{ index .Data.data "username" }} + POSTGRES_USER_5={{ index .Data.data "username" }} + POSTGRES_PASSWORD={{ index .Data.data "password" }} + POSTGRES_PASSWORD_2={{ index .Data.data "password" }} + POSTGRES_PASSWORD_3={{ index .Data.data "password" }} + POSTGRES_PASSWORD_4={{ index .Data.data "password" }} + POSTGRES_PASSWORD_5={{ index .Data.data "password" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/bim/base/kustomization.yaml b/apps/bim/base/kustomization.yaml index f47e36a..4312ba7 100644 --- a/apps/bim/base/kustomization.yaml +++ b/apps/bim/base/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization namespace: bim resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml + - backend.yaml diff --git a/apps/bim/base/serviceaccount.yaml b/apps/bim/base/serviceaccount.yaml deleted file mode 100644 index ae3568c..0000000 --- a/apps/bim/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: bim-vault - namespace: bim diff --git a/apps/bim/d8-ugmk-prod/kustomization.yaml b/apps/bim/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..5dbc44f --- /dev/null +++ b/apps/bim/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: bim diff --git a/apps/bim/d8-ugmk-prod/namespace.yaml b/apps/bim/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..d9a0582 --- /dev/null +++ b/apps/bim/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: bim + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/bim/dsinv/backend.yaml b/apps/bim/dsinv/backend.yaml index 5392c45..02bc032 100644 --- a/apps/bim/dsinv/backend.yaml +++ b/apps/bim/dsinv/backend.yaml @@ -1,53 +1,98 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: bim spec: - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:1d961a7b125ae0e69bd5717658d927091d8c05cc - env: - - name: LAST_MASTER_BIM - value: '100000' - - name: LAST_SLAVE_1_BIM - value: '94015' - - name: LAST_MASTER_BIM_V3 - value: '100000' - - name: LAST_SLAVE_1_BIM_V3 - value: '0' - - name: DB_CERT_PATH_3 - value: /root/yandex_pg.pem - - name: POSTGRES_ADDRESS_3 - value: postgres-service - - name: POSTGRES_PORT_3 - value: '5432' - - name: POSTGRES_DB_3 - value: bimapidb - - name: DB_CERT_PATH_2 - value: /root/yandex_pg.pem - - name: POSTGRES_ADDRESS_2 - value: postgres-service - - name: POSTGRES_PORT_2 - value: '5432' - - name: POSTGRES_DB_2 - value: bimapidb - - name: POSTGRES_ADDRESS - value: postgres-service - - name: POSTGRES_PORT - value: '5432' - - name: POSTGRES_DB - value: bimapidb - - name: POSTGRES_POOL_SIZE - value: '30' - - name: API_ADDRESS - value: 0.0.0.0:8000 - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: ENABLE_SQL_QUERY - value: '0' - - name: ENABLE_SSL - value: '0' + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:1d961a7b125ae0e69bd5717658d927091d8c05cc + + envs: + - name: LAST_MASTER_BIM + value: + _default: "100000" + + - name: LAST_SLAVE_1_BIM + value: + _default: "94015" + + - name: LAST_MASTER_BIM_V3 + value: + _default: "100000" + + - name: LAST_SLAVE_1_BIM_V3 + value: + _default: "0" + + - name: DB_CERT_PATH_3 + value: + _default: "/root/yandex_pg.pem" + + - name: POSTGRES_ADDRESS_3 + value: + _default: "postgres-service" + + - name: POSTGRES_PORT_3 + value: + _default: "5432" + + - name: POSTGRES_DB_3 + value: + _default: "bimapidb" + + - name: DB_CERT_PATH_2 + value: + _default: "/root/yandex_pg.pem" + + - name: POSTGRES_ADDRESS_2 + value: + _default: "postgres-service" + + - name: POSTGRES_PORT_2 + value: + _default: "5432" + + - name: POSTGRES_DB_2 + value: + _default: "bimapidb" + + - name: POSTGRES_ADDRESS + value: + _default: "postgres-service" + + - name: POSTGRES_PORT + value: + _default: "5432" + + - name: POSTGRES_DB + value: + _default: "bimapidb" + + - name: POSTGRES_POOL_SIZE + value: + _default: "30" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8000" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: ENABLE_SQL_QUERY + value: + _default: "0" + + - name: ENABLE_SSL + value: + _default: "0" + + - name: DB_CERT_PATH_4 + value: + _default: "/root/yandex_pg.pem" diff --git a/apps/bim/dsinv/kustomization.yaml b/apps/bim/dsinv/kustomization.yaml index 71179d1..c9109fb 100644 --- a/apps/bim/dsinv/kustomization.yaml +++ b/apps/bim/dsinv/kustomization.yaml @@ -9,5 +9,5 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend diff --git a/apps/bim/yc-k8s-test/kustomization.yaml b/apps/bim/yc-k8s-test/kustomization.yaml index 050d882..c8f7064 100644 --- a/apps/bim/yc-k8s-test/kustomization.yaml +++ b/apps/bim/yc-k8s-test/kustomization.yaml @@ -7,5 +7,5 @@ resources: patches: - path: replicas.yaml target: - kind: Deployment + kind: HelmRelease name: backend diff --git a/apps/bim/yc-k8s-test/replicas.yaml b/apps/bim/yc-k8s-test/replicas.yaml index 6ae8686..b620579 100644 --- a/apps/bim/yc-k8s-test/replicas.yaml +++ b/apps/bim/yc-k8s-test/replicas.yaml @@ -1,8 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: bim spec: - replicas: 1 + values: + services: + backend: + deployment: + replicaCount: + _default: 1 diff --git a/apps/cde/base/backend-service.yaml b/apps/cde/base/backend-service.yaml deleted file mode 100644 index 6a3f366..0000000 --- a/apps/cde/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: cde-svc - namespace: faas -spec: - type: ClusterIP - selector: - app: cde - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/cde/base/cde-flowscallback.yaml b/apps/cde/base/cde-flowscallback.yaml index 15e14c0..f629edc 100644 --- a/apps/cde/base/cde-flowscallback.yaml +++ b/apps/cde/base/cde-flowscallback.yaml @@ -1,60 +1,120 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-flowscallback namespace: cde - labels: - app: cde-flowscallback - service: cde-flowscallback + spec: - replicas: 1 - selector: - matchLabels: - app: cde-flowscallback - template: - metadata: - labels: - app: cde-flowscallback - service: cde-flowscallback - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-flowscallback - image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-flowscallback: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-flowscallback + + replicaCount: + _default: 1 + + port: + _default: 8080 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 500m + memory: + _default: 1Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-splitpdf.yaml b/apps/cde/base/cde-splitpdf.yaml index 1c5ca83..044e1a3 100644 --- a/apps/cde/base/cde-splitpdf.yaml +++ b/apps/cde/base/cde-splitpdf.yaml @@ -1,60 +1,120 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-splitpdf namespace: cde - labels: - app: cde-splitpdf - service: cde-splitpdf + spec: - replicas: 1 - selector: - matchLabels: - app: cde-splitpdf - template: - metadata: - labels: - app: cde-splitpdf - service: cde-splitpdf - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-splitpdf - image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-splitpdf: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-splitpdf + + replicaCount: + _default: 1 + + port: + _default: 8080 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 500m + memory: + _default: 1Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-alert.yaml b/apps/cde/base/cde-worker-alert.yaml new file mode 100644 index 0000000..6cc5d01 --- /dev/null +++ b/apps/cde/base/cde-worker-alert.yaml @@ -0,0 +1,120 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cde-worker-alert + namespace: cde + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-alert: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/orchestrator:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-alert + + replicaCount: + _default: 1 + + port: + _default: 8080 + + command: + _default: ["/bin/bash", "-lc"] + args: + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + + resources: + requests: + cpu: + _default: 500m + memory: + _default: 1Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-copy.yaml b/apps/cde/base/cde-worker-copy.yaml index 6f27510..e190b28 100644 --- a/apps/cde/base/cde-worker-copy.yaml +++ b/apps/cde/base/cde-worker-copy.yaml @@ -1,60 +1,120 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-worker-copy namespace: cde - labels: - app: cde-worker-copy - service: cde-worker-copy + spec: - replicas: 1 - selector: - matchLabels: - app: cde-worker-copy - template: - metadata: - labels: - app: cde-worker-copy - service: cde-worker-copy - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-worker-copy - image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-copy: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-copy + + replicaCount: + _default: 1 + + port: + _default: 8080 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: "1" + memory: + _default: 1Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-copyv2.yaml b/apps/cde/base/cde-worker-copyv2.yaml new file mode 100644 index 0000000..2961697 --- /dev/null +++ b/apps/cde/base/cde-worker-copyv2.yaml @@ -0,0 +1,120 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cde-worker-copyv2 + namespace: cde + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-copyv2: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/copyv2-worker:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-copyv2 + + replicaCount: + _default: 1 + + port: + _default: 8080 + + command: + _default: ["/bin/bash", "-lc"] + args: + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + + resources: + requests: + cpu: + _default: "1" + memory: + _default: 1Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-create-versions.yaml b/apps/cde/base/cde-worker-create-versions.yaml index d49dd1a..e67eb33 100644 --- a/apps/cde/base/cde-worker-create-versions.yaml +++ b/apps/cde/base/cde-worker-create-versions.yaml @@ -1,60 +1,120 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-worker-create-versions namespace: cde - labels: - app: cde-worker-create-versions - service: cde-worker-create-versions + spec: - replicas: 1 - selector: - matchLabels: - app: cde-worker-create-versions - template: - metadata: - labels: - app: cde-worker-create-versions - service: cde-worker-create-versions - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-worker-create-versions - image: cr.yandex/crp3ccidau046kdj8g9q/createversions-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-create-versions: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/createversions-worker:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-create-versions + + replicaCount: + _default: 1 + + port: + _default: 8080 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 500m + memory: + _default: 512Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-create-versionsv2.yaml b/apps/cde/base/cde-worker-create-versionsv2.yaml new file mode 100644 index 0000000..2a0378a --- /dev/null +++ b/apps/cde/base/cde-worker-create-versionsv2.yaml @@ -0,0 +1,120 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cde-worker-create-versionsv2 + namespace: cde + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-create-versionsv2: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/createversionsv2-worker:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-create-versionsv2 + + replicaCount: + _default: 1 + + port: + _default: 8080 + + command: + _default: ["/bin/bash", "-lc"] + args: + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + + resources: + requests: + cpu: + _default: 500m + memory: + _default: 512Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-markings.yaml b/apps/cde/base/cde-worker-markings.yaml index 5601e96..bf01157 100644 --- a/apps/cde/base/cde-worker-markings.yaml +++ b/apps/cde/base/cde-worker-markings.yaml @@ -1,60 +1,120 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-worker-markings namespace: cde - labels: - app: cde-worker-markings - service: cde-worker-markings + spec: - replicas: 1 - selector: - matchLabels: - app: cde-worker-markings - template: - metadata: - labels: - app: cde-worker-markings - service: cde-worker-markings - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-worker-markings - image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-markings: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-markings + + replicaCount: + _default: 1 + + port: + _default: 8080 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 500m + memory: + _default: 512Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-markingsv2.yaml b/apps/cde/base/cde-worker-markingsv2.yaml new file mode 100644 index 0000000..4aff52e --- /dev/null +++ b/apps/cde/base/cde-worker-markingsv2.yaml @@ -0,0 +1,120 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cde-worker-markingsv2 + namespace: cde + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-markingsv2: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/markingsv2-worker:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-markingsv2 + + replicaCount: + _default: 1 + + port: + _default: 8080 + + command: + _default: ["/bin/bash", "-lc"] + args: + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + + resources: + requests: + cpu: + _default: 500m + memory: + _default: 512Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-sign.yaml b/apps/cde/base/cde-worker-sign.yaml index ae7fa82..eb64503 100644 --- a/apps/cde/base/cde-worker-sign.yaml +++ b/apps/cde/base/cde-worker-sign.yaml @@ -1,60 +1,120 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-worker-sign namespace: cde - labels: - app: cde-worker-sign - service: cde-worker-sign + spec: - replicas: 1 - selector: - matchLabels: - app: cde-worker-sign - template: - metadata: - labels: - app: cde-worker-sign - service: cde-worker-sign - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-worker-sign - image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-sign: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-sign + + replicaCount: + _default: 1 + + port: + _default: 8080 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 500m + memory: + _default: 512Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-signv2.yaml b/apps/cde/base/cde-worker-signv2.yaml new file mode 100644 index 0000000..fbbb009 --- /dev/null +++ b/apps/cde/base/cde-worker-signv2.yaml @@ -0,0 +1,120 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cde-worker-signv2 + namespace: cde + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-signv2: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/signv2-worker:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-signv2 + + replicaCount: + _default: 1 + + port: + _default: 8080 + + command: + _default: ["/bin/bash", "-lc"] + args: + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + + resources: + requests: + cpu: + _default: 500m + memory: + _default: 512Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde-worker-update-bundles.yaml b/apps/cde/base/cde-worker-update-bundles.yaml index 5af1db5..be24a12 100644 --- a/apps/cde/base/cde-worker-update-bundles.yaml +++ b/apps/cde/base/cde-worker-update-bundles.yaml @@ -1,60 +1,120 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde-worker-update-bundles namespace: cde - labels: - app: cde-worker-update-bundles - service: cde-worker-update-bundles + spec: - replicas: 1 - selector: - matchLabels: - app: cde-worker-update-bundles - template: - metadata: - labels: - app: cde-worker-update-bundles - service: cde-worker-update-bundles - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: cde-worker-update-bundles - image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde-worker-update-bundles: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde-worker-update-bundles + + replicaCount: + _default: 1 + + port: + _default: 8080 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /worker - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /worker + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 500m + memory: + _default: 512Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/cde.yaml b/apps/cde/base/cde.yaml index de4bc69..b9e2f4e 100644 --- a/apps/cde/base/cde.yaml +++ b/apps/cde/base/cde.yaml @@ -1,60 +1,139 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: cde namespace: cde - labels: - app: cde - service: cde + spec: - replicas: 1 - selector: - matchLabels: - app: cde - template: - metadata: - labels: - app: cde - service: cde - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: cde - vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde - vault.hashicorp.com/agent-inject-template-cde-env: |- - {{- with secret "secrets/data/vault/apps/cde" -}} - {{- range $k, $v := .Data.data }} - export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) - {{- end }} - {{- end -}} + interval: 10m + + chart: spec: - serviceAccountName: cde-vault - containers: - - name: api - image: cr.yandex/crp3ccidau046kdj8g9q/cde:prod_9f3c1d2a - imagePullPolicy: IfNotPresent + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + cde: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: cde-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/cde:preprod_4302d8f3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: cde + + replicaCount: + _default: 1 + + port: + _default: 8080 + command: - - /bin/bash - - -lc + _default: ["/bin/bash", "-lc"] args: - - | - set -e - source /vault/secrets/cde-env - exec /http - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: S3_IS_CONTOUR - value: "true" + _default: + - | + set -e + source /vault/secrets/cde-env + exec /http + resources: requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred + cpu: + _default: 500m + memory: + _default: 512Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: cde-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: SAREX_BACKEND_BASE_URL + value: + _default: "https://lk.sarex.io" + + - name: S3_IS_CONTOUR + value: + _default: "true" + + - name: IS_CONTOUR + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: cde + vault.hashicorp.com/agent-inject-secret-cde-env: secrets/data/vault/apps/cde + vault.hashicorp.com/agent-inject-template-cde-env: |- + {{- with secret "secrets/data/vault/apps/cde" -}} + {{- range $k, $v := .Data.data }} + export {{ $k }}=$(printf '%b' {{ printf "%q" (printf "%v" $v) }}) + {{- end }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/cde/base/kustomization.yaml b/apps/cde/base/kustomization.yaml index 9c18fbf..753fbe5 100644 --- a/apps/cde/base/kustomization.yaml +++ b/apps/cde/base/kustomization.yaml @@ -4,13 +4,16 @@ kind: Kustomization namespace: cde resources: - namespace.yaml - - serviceaccount.yaml - cde.yaml - cde-splitpdf.yaml - - backend-service.yaml - cde-flowscallback.yaml + - cde-worker-alert.yaml - cde-worker-copy.yaml + - cde-worker-copyv2.yaml - cde-worker-create-versions.yaml + - cde-worker-create-versionsv2.yaml - cde-worker-markings.yaml + - cde-worker-markingsv2.yaml - cde-worker-sign.yaml + - cde-worker-signv2.yaml - cde-worker-update-bundles.yaml diff --git a/apps/cde/base/namespace.yaml b/apps/cde/base/namespace.yaml index f080923..35c9fae 100644 --- a/apps/cde/base/namespace.yaml +++ b/apps/cde/base/namespace.yaml @@ -5,3 +5,4 @@ metadata: name: cde labels: istio-injection: enabled + security.deckhouse.io/pod-policy: privileged \ No newline at end of file diff --git a/apps/cde/base/serviceaccount.yaml b/apps/cde/base/serviceaccount.yaml deleted file mode 100644 index ebb471d..0000000 --- a/apps/cde/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: cde-vault - namespace: cde diff --git a/apps/cde/d8-ugmk-prod/kustomization.yaml b/apps/cde/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..0fee837 --- /dev/null +++ b/apps/cde/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: cde diff --git a/apps/cde/d8-ugmk-prod/namespace.yaml b/apps/cde/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..453a53c --- /dev/null +++ b/apps/cde/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: cde + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/comparisons/base/backend.yaml b/apps/comparisons/base/backend.yaml index cdb60db..bcf8476 100644 --- a/apps/comparisons/base/backend.yaml +++ b/apps/comparisons/base/backend.yaml @@ -244,17 +244,17 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: comparisons - vault.hashicorp.com/agent-inject-secret-comparisons-db: secrets/data/postgresql/apps/comparisons + vault.hashicorp.com/agent-inject-secret-comparisons-db: secrets/data/apps/comparisons/postgres vault.hashicorp.com/agent-inject-template-comparisons-db: |- - {{- with secret "secrets/data/postgresql/apps/comparisons" -}} - DATABASE_HOST=postgresql.comparisons.svc.cluster.local - DATABASE_PORT=5432 - DATABASE_DB=comparisons_db + {{- with secret "secrets/data/apps/comparisons/postgres" -}} + DATABASE_HOST={{ index .Data.data "host" }} + DATABASE_PORT={{ index .Data.data "port" }} + DATABASE_DB={{ index .Data.data "database" }} DATABASE_USER={{ index .Data.data "username" }} DATABASE_PASSWORD={{ index .Data.data "password" }} - POSTGRES_ADDRESS=postgresql.comparisons.svc.cluster.local - POSTGRES_PORT=5432 - POSTGRES_DB=comparisons_db + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} POSTGRES_USER={{ index .Data.data "username" }} POSTGRES_PASSWORD={{ index .Data.data "password" }} {{- end -}} diff --git a/apps/comparisons/d8-ugmk-prod/namespace.yaml b/apps/comparisons/d8-ugmk-prod/namespace.yaml index 9c83f6a..cc54650 100644 --- a/apps/comparisons/d8-ugmk-prod/namespace.yaml +++ b/apps/comparisons/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: comparisons labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/contracts/base/helmrelease.yaml b/apps/contracts/base/helmrelease.yaml index 4cb4942..a42e8ae 100644 --- a/apps/contracts/base/helmrelease.yaml +++ b/apps/contracts/base/helmrelease.yaml @@ -90,9 +90,9 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: contracts - vault.hashicorp.com/agent-inject-secret-contracts-db: secrets/data/postgresql/apps/contracts + vault.hashicorp.com/agent-inject-secret-contracts-db: secrets/data/apps/contracts/postgres vault.hashicorp.com/agent-inject-template-contracts-db: |- - {{- with secret "secrets/data/postgresql/apps/contracts" -}} + {{- with secret "secrets/data/apps/contracts/postgres" -}} DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@postgresql.contracts.svc.cluster.local:5432/contracts_db?sslmode=disable {{- end -}} vault.hashicorp.com/agent-inject-secret-contracts-jwt-public: secrets/data/vault/common/rsa_keys diff --git a/apps/control-interface/d8-ugmk-prod/namespace.yaml b/apps/control-interface/d8-ugmk-prod/namespace.yaml index e773ad1..f4c67bb 100644 --- a/apps/control-interface/d8-ugmk-prod/namespace.yaml +++ b/apps/control-interface/d8-ugmk-prod/namespace.yaml @@ -3,5 +3,5 @@ kind: Namespace metadata: name: control-interface labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/cross-section/d8-ugmk-prod/namespace.yaml b/apps/cross-section/d8-ugmk-prod/namespace.yaml index 10b2d97..5b8d5e4 100644 --- a/apps/cross-section/d8-ugmk-prod/namespace.yaml +++ b/apps/cross-section/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: cross-section labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/django/base/django-configmap.yaml b/apps/django/base/django-configmap.yaml index 9b7db5d..77ca238 100644 --- a/apps/django/base/django-configmap.yaml +++ b/apps/django/base/django-configmap.yaml @@ -296,6 +296,11 @@ data: "name": "Запросы", "uri": "/rfi" }, + { + "name": "Управление проектами", + "uri": "/management/projects" + }, + # { # "name": "Обзор", # "uri": "/projects" diff --git a/apps/django/base/nginx-configmap.yaml b/apps/django/base/nginx-configmap.yaml index cfe04eb..4080296 100644 --- a/apps/django/base/nginx-configmap.yaml +++ b/apps/django/base/nginx-configmap.yaml @@ -62,11 +62,13 @@ data: if_modified_since off; expires off; } - # location ~^/api/pm/ { - # #rewrite /api/(.+) /$1 break; - # proxy_set_header Host $host; - # proxy_pass http://backend-svc.pm.svc.cluster.local:8000; - # } + location ~^/api/pm/ { + #rewrite /api/(.+) /$1 break; + proxy_http_version 1.1; + proxy_set_header Connection ""; + proxy_set_header Host $host; + proxy_pass http://backend-svc.pm.svc.cluster.local:8000; + } # location ~^/api/v1/documents/ { # #rewrite /api/(.+) /$1 break; @@ -74,25 +76,27 @@ data: # proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80; # } - # location ~^/(api|admin)/ { - # proxy_set_header Host $host; - # proxy_pass http://backend-svc.django.svc.cluster.local:80; - # } + location ~^/(api|admin)/ { + proxy_http_version 1.1; + proxy_set_header Connection ""; + proxy_set_header Host $host; + proxy_pass http://backend-svc.django.svc.cluster.local:80; + } - # location ~^/workspaces-v2/(.+).js { - # proxy_http_version 1.1; - # proxy_set_header Connection ""; - # rewrite /workspaces-v2/(.+) /$1 break; - # proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; - # } + location ~^/workspaces-v2/(.+).js { + proxy_http_version 1.1; + proxy_set_header Connection ""; + rewrite /workspaces-v2/(.+) /$1 break; + proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; + } - # location ~^/workspaces-v2/(.+)\.wasm$ { - # proxy_http_version 1.1; - # proxy_set_header Connection ""; - # rewrite ^/workspaces-v2/(.+) /$1 break; - # proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; - # } + location ~^/workspaces-v2/(.+)\.wasm$ { + proxy_http_version 1.1; + proxy_set_header Connection ""; + rewrite ^/workspaces-v2/(.+) /$1 break; + proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; + } location @index { add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0'; @@ -101,10 +105,12 @@ data: try_files /static/index.html =404; } - # location ~^/workflows/(.+).js { - # rewrite /workflows/(.+) /$1 break; - # proxy_pass http://frontend-svc.processing.svc.cluster.local:80; - # } + location ~^/workflows/(.+).js { + proxy_http_version 1.1; + proxy_set_header Connection ""; + rewrite /workflows/(.+) /$1 break; + proxy_pass http://frontend-svc.processing.svc.cluster.local:80; + } location /service-worker.js { try_files /static/$uri @index; } diff --git a/apps/django/base/zitadel-configmap.yaml b/apps/django/base/zitadel-configmap.yaml index 8398f6a..8b71cec 100644 --- a/apps/django/base/zitadel-configmap.yaml +++ b/apps/django/base/zitadel-configmap.yaml @@ -8,8 +8,8 @@ data: { "auth_type": "zitadel", "zitadel": { - "client_id": "383923818340615274", - "host": "https://sarex-login.uralmine.com" + "client_id": "379557107642492501", + "host": "https://zitadel.contour.infra.sarex.tech" } } diff --git a/apps/django/d8-ugmk-prod/backend.yaml b/apps/django/d8-ugmk-prod/backend.yaml new file mode 100644 index 0000000..dde6df0 --- /dev/null +++ b/apps/django/d8-ugmk-prod/backend.yaml @@ -0,0 +1,140 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: django +spec: + values: + services: + backend: + envs: + - name: ALLOWED_HOSTS + value: + _default: "*" + - name: SERVER_USE_CHANGELOG + value: + _default: "0" + - name: SERVER_ZITADEL_ENABLED + value: + _default: "True" + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: CELERY_REDIS_HOST + value: + _default: redis + - name: CELERY_REDIS_PORT + value: + _default: "6379" + - name: DJANGO_REDIS_HOST + value: + _default: redis + - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED + value: + _default: "True" + - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED + value: + _default: "True" + - name: DJANGO_REDIS_PORT + value: + _default: "6379" + - name: BIMV2_INTERNAL_HOST + value: + _default: http://bim-backend-v2-service.bim-api + - name: BIMV2_TIMEOUT + value: + _default: "60" + - name: JWT_KID + value: + _default: "1" + - name: PDM_SYNC + value: + _default: "1" + - name: KC_SYNC_ENABLE + value: + _default: "0" + - name: MEASUREMENTS_HOST + value: + _default: http://measurements-service.measurements.svc.cluster.local:8000/api + - name: MEASUREMENTS_USE_MEASUREMENTS + value: + _default: "1" + - name: SERVER_API_HOST + value: + _default: https://sarex.uralmine.com + - name: SERVER_HOST + value: + _default: https://sarex.uralmine.com + - name: WORKFLOWS_HOST + value: + _default: http://backend-svc.processing.svc.cluster.local:80 + - name: WORKFLOWS_BASE_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: WORKFLOWS_PREFIX + value: + _default: /internal/v1 + - name: WORKFLOWS_USE + value: + _default: "1" + - name: SERVER_S3_STREAM_IMPORT + value: + _default: "1" + - name: SERVER_SAVE_DIFF_DEM + value: + _default: "1" + - name: SERVER_USE_CLICKHOUSE + value: + _default: "0" + - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK + value: + _default: "0" + - name: SERVER_USE_DJANGO_STORAGE + value: + _default: "1" + - name: SERVER_USE_METASHAPE + value: + _default: "0" + - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG + value: + _default: "1" + - name: SERVER_CHANGELOG_MODE + value: + _default: "0" + - name: SERVER_DJANGO_URLS + value: + _default: "1" + - name: CHECK_IMPORT_HASH + value: + _default: "1" + - name: EAV_ENABLE + value: + _default: "1" + - name: SERVER_CHECK_IMPORT_HASH + value: + _default: "1" + - name: SERVER_CHUNKED_PATH + value: + _default: /tmp/chunked_uploads/%Y/%m/%d + - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS + value: + _default: "0" + - name: SERVER_USE_WRORKFLOW_STATUS + value: + _default: "1" + - name: ZITADEL_HOST + value: + _default: https://sarex-login.uralmine.com + - name: SERVER_KAFKA_ENABLED + value: + _default: "False" + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + - name: KAFKA_SSL_CAFILE + value: + _default: /usr/local/share/ca-certificates/kafka.crt + - name: KC_USE_REDIRECT_LOGOUT + value: + _default: "False" diff --git a/apps/django/d8-ugmk-prod/kustomization.yaml b/apps/django/d8-ugmk-prod/kustomization.yaml index 4956ad3..84d7732 100644 --- a/apps/django/d8-ugmk-prod/kustomization.yaml +++ b/apps/django/d8-ugmk-prod/kustomization.yaml @@ -3,4 +3,13 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: django resources: - - ../base \ No newline at end of file + - ../base +patches: + - path: backend.yaml + target: + kind: HelmRelease + name: backend + - path: zitadel-configmap.yaml + target: + kind: ConfigMap + name: zitadel-configmap \ No newline at end of file diff --git a/apps/django/d8-ugmk-prod/zitadel-configmap.yaml b/apps/django/d8-ugmk-prod/zitadel-configmap.yaml new file mode 100644 index 0000000..243b1bc --- /dev/null +++ b/apps/django/d8-ugmk-prod/zitadel-configmap.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: zitadel-configmap + namespace: django +data: + config.json: | + { + "auth_type": "zitadel", + "zitadel": { + "client_id": "383923818340615274", + "host": "https://sarex-login.uralmine.com" + } + } diff --git a/apps/document-link/d8-ugmk-prod/namespace.yaml b/apps/document-link/d8-ugmk-prod/namespace.yaml index dd4f6ec..4a9e663 100644 --- a/apps/document-link/d8-ugmk-prod/namespace.yaml +++ b/apps/document-link/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: document-link labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/documentations/base/api.yaml b/apps/documentations/base/api.yaml index c0470f8..10657cd 100644 --- a/apps/documentations/base/api.yaml +++ b/apps/documentations/base/api.yaml @@ -88,6 +88,9 @@ spec: - name: POSTGRES_POOL_SIZE value: _default: "20" + - name: USE_LEGACY_BIM_FLOW + value: + _default: "true" - name: ZITADEL_ACCOUNT value: _default: /vault/secrets/documentations-zitadel-account-json @@ -96,7 +99,7 @@ spec: _default: zitadel-srx.wb.ru - name: USE_ZITADEL value: - _default: "0" + _default: "1" - name: FLOWS_URL value: _default: http://backend-svc.flows.svc.cluster.local:80 @@ -150,10 +153,10 @@ spec: _default: http://backend-svc.workspaces.svc.cluster.local:80/ - name: BIM_API_URL value: - _default: http://bim-api-service.bim.svc.cluster.local:8080/ + _default: http://backend-svc.bim.svc.cluster.local:80/ - name: BIM_API_V2_URL value: - _default: http://backend-service.bim.svc.cluster.local:8000/ + _default: http://backend-svc.bim.svc.cluster.local:80/ - name: WORKSPACE_BUNDLE_VERSION value: _default: v1 diff --git a/apps/documentations/base/filestream.yaml b/apps/documentations/base/filestream.yaml index c72314d..ffbd568 100644 --- a/apps/documentations/base/filestream.yaml +++ b/apps/documentations/base/filestream.yaml @@ -96,7 +96,7 @@ spec: _default: zitadel-srx.wb.ru - name: USE_ZITADEL value: - _default: "0" + _default: "1" - name: FLOWS_URL value: _default: http://backend-svc.flows.svc.cluster.local:80 @@ -150,10 +150,10 @@ spec: _default: http://backend-svc.workspaces.svc.cluster.local:80/ - name: BIM_API_URL value: - _default: http://bim-api-service.bim.svc.cluster.local:8080/ + _default: http://backend-svc.bim.svc.cluster.local:80/ - name: BIM_API_V2_URL value: - _default: http://backend-service.bim.svc.cluster.local:8000/ + _default: http://backend-svc.bim.svc.cluster.local:80/ - name: WORKSPACE_BUNDLE_VERSION value: _default: v1 diff --git a/apps/documentations/base/hasher.yaml b/apps/documentations/base/hasher.yaml new file mode 100644 index 0000000..dff8e51 --- /dev/null +++ b/apps/documentations/base/hasher.yaml @@ -0,0 +1,163 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-hasher + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: documentations-vault + deployment: + enabled: true + name: + _default: hasher + replicaCount: + _default: 1 + port: + _default: 8080 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/documentations-hasher-rabbitmq ] && . /vault/secrets/documentations-hasher-rabbitmq + [ -f /vault/secrets/documentations-hasher-s3 ] && . /vault/secrets/documentations-hasher-s3 + set +a + exec ./server + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: hasher-service + type: + _default: ClusterIP + port: + _default: 8080 + targetPort: + _default: 8080 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: HASHER_APP__LOG_LEVEL + value: + _default: INFO + + - name: HASHER_APP__NUM_WORKERS + value: + _default: "4" + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE + value: + _default: hash.compute.normal.tasks + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE + value: + _default: hash.compute + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE + value: + _default: direct + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY + value: + _default: hash.compute.normal + + - name: HASHER_S3__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: HASHER_S3__CONNECT_TIMEOUT + value: + _default: "10" + + - name: HASHER_S3__READ_TIMEOUT + value: + _default: "30" + + - name: HASHER_S3__REGION_NAME + value: + _default: ru-central1 + + - name: HASHER_S3__USE_SSL + value: + _default: "true" + + - name: HASHER_S3__VERIFY + value: + _default: "true" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "4317,4318,9411,8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-documentations-hasher-rabbitmq: secrets/data/apps/documentations/hasher/rabbitmq + vault.hashicorp.com/agent-inject-template-documentations-hasher-rabbitmq: |- + {{- with secret "secrets/data/apps/documentations/hasher/rabbitmq" -}} + HASHER_AMQP__HOST={{ index .Data.data "host" }} + HASHER_AMQP__PORT={{ index .Data.data "port" }} + HASHER_AMQP__USERNAME={{ index .Data.data "username" }} + HASHER_AMQP__PASSWORD={{ index .Data.data "password" }} + HASHER_AMQP__VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-hasher-s3: secrets/data/apps/documentations/hasher/s3 + vault.hashicorp.com/agent-inject-template-documentations-hasher-s3: |- + {{- with secret "secrets/data/apps/documentations/hasher/s3" -}} + HASHER_S3__ENDPOINT={{ index .Data.data "endpoint" }} + HASHER_S3__ACCESS_KEY={{ index .Data.data "access_key" }} + HASHER_S3__SECRET_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/base/kustomization.yaml b/apps/documentations/base/kustomization.yaml index d15ef61..a9e034f 100644 --- a/apps/documentations/base/kustomization.yaml +++ b/apps/documentations/base/kustomization.yaml @@ -8,5 +8,7 @@ resources: - filestream.yaml - frontend.yaml - pdm.yaml + - pdf-markings-amqp.yaml + - hasher.yaml - redis-deployment.yaml - redis-service.yaml diff --git a/apps/documentations/base/pdf-markings-amqp.yaml b/apps/documentations/base/pdf-markings-amqp.yaml new file mode 100644 index 0000000..772dee2 --- /dev/null +++ b/apps/documentations/base/pdf-markings-amqp.yaml @@ -0,0 +1,172 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-pdf-markings-amqp + namespace: documentations +spec: + interval: 10m + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + install: + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: + backend: + enabled: true + serviceAccount: + enabled: + _default: true + name: + _default: documentations-vault + deployment: + enabled: true + name: + _default: pdf-markings-amqp + replicaCount: + _default: 1 + port: + _default: 8000 + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/documentations-marks-db ] && . /vault/secrets/documentations-marks-db + [ -f /vault/secrets/documentations-marks-rabbitmq ] && . /vault/secrets/documentations-marks-rabbitmq + [ -f /vault/secrets/documentations-marks-s3 ] && . /vault/secrets/documentations-marks-s3 + set +a + exec ./server + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + probes: + liveness: + enabled: false + readiness: + enabled: false + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be + pullPolicy: + _default: IfNotPresent + service: + enabled: true + name: + _default: marks-service + type: + _default: ClusterIP + port: + _default: 8000 + targetPort: + _default: 8000 + portName: + _default: http + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: + - name: MARKS_APP__LOG_LEVEL + value: + _default: INFO + + - name: MARKS_CRYPTO__HASHING_ALGO + value: + _default: md_gost12_256 + + - name: MARKS_QR__REDIRECT_URL + value: + _default: "https://stamp-verification.srx.wb.ru/" + + - name: MARKS_QR__BASE_DOCUMENT_URL + value: + _default: "https://srx.wb.ru" + + - name: MARKS_S3__REGION + value: + _default: ru-central1 + + - name: MARKS_S3__USE_SSL + value: + _default: "true" + + - name: MARKS_S3__SSL_VERIFY + value: + _default: "true" + + - name: MARKS_S3__DEFAULT_BUCKET + value: + _default: documentations-marks + + - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE + value: + _default: pdf_markings_input + + - name: MARKS_RABBITMQ__HOST + value: + _default: rabbitmq.rabbitmq.svc.cluster.local + + - name: MARKS_RABBITMQ__PORT + value: + _default: "5672" + + - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS + value: + _default: "60" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "4317,4318,9411,8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-documentations-marks-db: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-documentations-marks-db: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + MARKS_DOCUMENTS_DB__HOST={{ index .Data.data "host" }} + MARKS_DOCUMENTS_DB__PORT={{ index .Data.data "port" }} + MARKS_DOCUMENTS_DB__DATABASE={{ index .Data.data "database" }} + MARKS_DOCUMENTS_DB__USERNAME={{ index .Data.data "username" }} + MARKS_DOCUMENTS_DB__PASSWORD={{ index .Data.data "password" }} + MARKS_DOCUMENTS_DB__SSLMODE=disable + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-marks-rabbitmq: secrets/data/rabbitmq/apps/documentations + vault.hashicorp.com/agent-inject-template-documentations-marks-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/documentations" -}} + MARKS_RABBITMQ__USERNAME={{ index .Data.data "username" }} + MARKS_RABBITMQ__PASSWORD={{ index .Data.data "password" }} + MARKS_RABBITMQ__VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-documentations-marks-s3: secrets/data/apps/documentations/marks-s3 + vault.hashicorp.com/agent-inject-template-documentations-marks-s3: |- + {{- with secret "secrets/data/apps/documentations/marks-s3" -}} + MARKS_S3__URL={{ index .Data.data "endpoint_url" }} + MARKS_S3__ACCESS_KEY={{ index .Data.data "access_key" }} + MARKS_S3__SECRET_KEY={{ index .Data.data "secret_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/base/pdm.yaml b/apps/documentations/base/pdm.yaml index b86f0ba..128c9c5 100644 --- a/apps/documentations/base/pdm.yaml +++ b/apps/documentations/base/pdm.yaml @@ -129,10 +129,10 @@ spec: _default: http://attachments-service.attachments.svc.cluster.local:8000 - name: BIM_API_V2_URL value: - _default: http://backend-service.bim.svc.cluster.local:8000/ + _default: http://backend-svc.bim.svc.cluster.local:80/ - name: BIM_V2_HOST value: - _default: http://backend-service.bim.svc.cluster.local:8000/ + _default: http://backend-svc.bim.svc.cluster.local:80/ - name: CACHE_CLEANUP_INTERVAL value: _default: 60s diff --git a/apps/documentations/d8-ugmk-prod/api.yaml b/apps/documentations/d8-ugmk-prod/api.yaml new file mode 100644 index 0000000..5b2e0ff --- /dev/null +++ b/apps/documentations/d8-ugmk-prod/api.yaml @@ -0,0 +1,149 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-api + namespace: documentations +spec: + values: + services: + backend: + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: ZITADEL_ACCOUNT + value: + _default: /vault/secrets/documentations-zitadel-account-json + - name: ZITADEL_DOMAIN + value: + _default: sarex-login.uralmine.com + - name: USE_ZITADEL + value: + _default: "1" + - name: FLOWS_URL + value: + _default: http://backend-svc.flows.svc.cluster.local:80 + - name: LAST_MASTER_BIM + value: + _default: "36311" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: USE_LEGACY_BIM_FLOW + value: + _default: "true" + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: WORKSPACE_V2_EXTERNAL_URL + value: + _default: https://sarex.uralmine.com/workspaces-v2/ + - name: ENABLE_S3 + value: + _default: "1" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: LAST_SLAVE_1_BIM + value: + _default: "1000000" + - name: HOST + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80 + - name: FILE_STREAM_HOST + value: + _default: sarex.uralmine.com + - name: DOCUMENTATION_URL + value: + _default: http://documentations-api.documentations.svc.cluster.local:80/ + - name: WORKFLOW_URL + value: + _default: http://backend-svc.processing.svc.cluster.local:80/ + - name: WORKSPACE_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + - name: BIM_API_URL + value: + _default: http://backend-svc.bim.svc.cluster.local:80/ + - name: BIM_API_V2_URL + value: + _default: http://backend-svc.bim.svc.cluster.local:80/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: SYSTEM_LOG_URL + value: + _default: http://backend-svc.system-log.svc.cluster.local:80 + - name: DJANGO_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: MARKS_PROCESSING_URL + value: + _default: http://marks-service:8000 + - name: PUBLIC_LINK_HOST + value: + _default: https://document-link-srx.wb.ru + - name: NAMESPACE + value: + _default: documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: S3_SERVICE_ACCOUNT + value: + _default: /vault/secrets/documentations-s3-account-json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: ENABLE_SMTP + value: + _default: "True" + - name: ENABLE_MAILGUN + value: + _default: "False" + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET + value: + _default: "mock" + - name: ENABLE_AUTH_JWT_IN_URL + value: + _default: "true" + - name: ENABLE_SIGNATURE_IN_URL + value: + _default: "false" + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "0" + - name: VALKEY_ADDR + value: + _default: redis:6379 + - name: VALKEY_HOST + value: + _default: redis + - name: VALKEY_PORT + value: + _default: "6379" diff --git a/apps/documentations/d8-ugmk-prod/filestream.yaml b/apps/documentations/d8-ugmk-prod/filestream.yaml new file mode 100644 index 0000000..a9ecae9 --- /dev/null +++ b/apps/documentations/d8-ugmk-prod/filestream.yaml @@ -0,0 +1,146 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-filestream + namespace: documentations +spec: + values: + services: + backend: + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + - name: ZITADEL_ACCOUNT + value: + _default: /vault/secrets/documentations-zitadel-account-json + - name: ZITADEL_DOMAIN + value: + _default: sarex-login.uralmine.com + - name: USE_ZITADEL + value: + _default: "1" + - name: FLOWS_URL + value: + _default: http://backend-svc.flows.svc.cluster.local:80 + - name: LAST_MASTER_BIM + value: + _default: "36311" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8080 + - name: API_ADDRESS_FILE + value: + _default: 0.0.0.0:8080 + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + - name: ENABLE_SQL_QUERY + value: + _default: "0" + - name: ENABLE_SSL + value: + _default: "0" + - name: WORKSPACE_V2_EXTERNAL_URL + value: + _default: https://sarex.uralmine.com/workspaces-v2/ + - name: ENABLE_S3 + value: + _default: "1" + - name: CONTAINER_REGISTRY + value: + _default: cr.yandex/crp3ccidau046kdj8g9q + - name: ENVIRONMENT + value: + _default: production + - name: LAST_SLAVE_1_BIM + value: + _default: "1000000" + - name: HOST + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80 + - name: FILE_STREAM_HOST + value: + _default: sarex.uralmine.com + - name: DOCUMENTATION_URL + value: + _default: http://backend-api-svc.documentations.svc.cluster.local:80/ + - name: WORKFLOW_URL + value: + _default: http://workflows-api-service.workflow.svc.cluster.local:8000/ + - name: WORKSPACE_URL + value: + _default: http://backend-svc.workspaces.svc.cluster.local:80/ + - name: BIM_API_URL + value: + _default: http://backend-svc.bim.svc.cluster.local:80/ + - name: BIM_API_V2_URL + value: + _default: http://backend-svc.bim.svc.cluster.local:80/ + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: v1 + - name: SYSTEM_LOG_URL + value: + _default: http://api-service.system-log.svc.cluster.local:80 + - name: DJANGO_HOST + value: + _default: http://backend-svc.django.svc.cluster.local:80 + - name: MARKS_PROCESSING_URL + value: + _default: http://marks-service:8000 + - name: PUBLIC_LINK_HOST + value: + _default: https://document-link-srx.wb.ru + - name: NAMESPACE + value: + _default: documentations + - name: DJANGO_ORIGINATOR + value: + _default: docs_prod + - name: WORKFLOW_IMAGES_VERSION + value: + _default: master + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: master + - name: S3_SERVICE_ACCOUNT + value: + _default: /vault/secrets/documentations-s3-account-json + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: 6h + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: 60s + - name: ENABLE_SMTP + value: + _default: "True" + - name: ENABLE_MAILGUN + value: + _default: "False" + - name: CACHE_CLEANUP_INTERVAL + value: + _default: 60s + - name: ENABLE_AUTH_JWT_IN_URL + value: + _default: "false" + - name: ENABLE_SIGNATURE_IN_URL + value: + _default: "true" + - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET + value: + _default: "mock" + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "0" + - name: VALKEY_ADDR + value: + _default: redis:6379 + - name: VALKEY_HOST + value: + _default: redis + - name: VALKEY_PORT + value: + _default: "6379" diff --git a/apps/documentations/d8-ugmk-prod/kustomization.yaml b/apps/documentations/d8-ugmk-prod/kustomization.yaml index 87e17f7..56d6b60 100644 --- a/apps/documentations/d8-ugmk-prod/kustomization.yaml +++ b/apps/documentations/d8-ugmk-prod/kustomization.yaml @@ -3,4 +3,13 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: documentations resources: - - ../base \ No newline at end of file + - ../base +patches: + - path: api.yaml + target: + kind: HelmRelease + name: documentations-api + - path: filestream.yaml + target: + kind: HelmRelease + name: documentations-filestream \ No newline at end of file diff --git a/apps/drawings/base/backend.yaml b/apps/drawings/base/backend.yaml index 341bdb6..0cf8937 100644 --- a/apps/drawings/base/backend.yaml +++ b/apps/drawings/base/backend.yaml @@ -119,11 +119,11 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: drawings - vault.hashicorp.com/agent-inject-secret-drawings-db: secrets/data/postgresql/apps/drawings + vault.hashicorp.com/agent-inject-secret-drawings-db: secrets/data/apps/drawings/postgres vault.hashicorp.com/agent-inject-template-drawings-db: |- - {{- with secret "secrets/data/postgresql/apps/drawings" -}} - POSTGRES_ADDRESS=postgresql.drawings.svc.cluster.local:5432 - POSTGRES_DB=drawings_db + {{- with secret "secrets/data/apps/drawings/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }}:{{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} POSTGRES_USER={{ index .Data.data "username" }} POSTGRES_PASSWORD={{ index .Data.data "password" }} {{- end -}} diff --git a/apps/drawings/d8-ugmk-prod/namespace.yaml b/apps/drawings/d8-ugmk-prod/namespace.yaml index 5d45457..468680a 100644 --- a/apps/drawings/d8-ugmk-prod/namespace.yaml +++ b/apps/drawings/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: drawings labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/eav/base/django-configmap.yaml b/apps/eav/base/django-configmap.yaml index b610500..040349e 100644 --- a/apps/eav/base/django-configmap.yaml +++ b/apps/eav/base/django-configmap.yaml @@ -104,9 +104,10 @@ data: ], "DEFAULT_AUTHENTICATION_CLASSES": [ "core.auth.ZitadelJWTAuthentication", - "rest_framework_simplejwt.authentication.JWTAuthentication", - "rest_framework.authentication.SessionAuthentication", - "rest_framework.authentication.BasicAuthentication", + "rest_framework_simplejwt.authentication.JWTStatelessUserAuthentication", + #"rest_framework_simplejwt.authentication.JWTAuthentication", + #"rest_framework.authentication.SessionAuthentication", + #"rest_framework.authentication.BasicAuthentication", ], "DEFAULT_PERMISSION_CLASSES": [ "rest_framework.permissions.AllowAny", @@ -125,7 +126,7 @@ data: return default raise ImproperlyConfigured(error_msg) - SIMPLE_JWT_ISSUER = get_env_variable("SIMPLE_JWT_ISSUER", default="django") + SIMPLE_JWT_ISSUER = get_env_variable("SIMPLE_JWT_ISSUER", default="default_issuer") SIMPLE_JWT = { diff --git a/apps/faas/d8-ugmk-prod/namespace.yaml b/apps/faas/d8-ugmk-prod/namespace.yaml index 3058a54..332fe39 100644 --- a/apps/faas/d8-ugmk-prod/namespace.yaml +++ b/apps/faas/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: faas labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/flows/base/backend-deployment.yaml b/apps/flows/base/backend-deployment.yaml deleted file mode 100644 index baf18f3..0000000 --- a/apps/flows/base/backend-deployment.yaml +++ /dev/null @@ -1,137 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: flows - labels: - app: backend - service: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - service: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: flows - vault.hashicorp.com/agent-inject-secret-flows-postgresql: secrets/data/postgresql/apps/flows - vault.hashicorp.com/agent-inject-template-flows-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/flows" -}} - PG_DB=flows_db - PG_LOGIN={{ index .Data.data "username" }} - PG_HOST=postgresql.flows.svc.cluster.local - PG_PORT=5432 - PG_PASSWORD={{ index .Data.data "password" }} - DOCUMENTATION_PG_HOST=postgresql.flows.svc.cluster.local - DOCUMENTATION_PG_PORT=5432 - DOCUMENTATION_PG_DATABASE=flows_db - DOCUMENTATION_PG_USERNAME={{ index .Data.data "username" }} - DOCUMENTATION_PG_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-rabbitmq: secrets/data/rabbitmq/apps/flows - vault.hashicorp.com/agent-inject-template-flows-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/flows" -}} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - RABBITMQ_PORT=5672 - ADMIN_PANEL_SECRET_KEY=rabbitmq.rabbitmq:5672 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-flows-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_TOKEN={{ index .Data.data "key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-flows-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: flows-vault - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_2a439111 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql - [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq - [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth - [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" - set +a - exec /opt/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: LOG_LEVEL - value: DEBUG - - name: BASE_HOST - value: https://srx.wb.ru - - name: CELERY_QUEUE - value: flow - - name: EAV_HOST - value: http://backend-svc.eav.svc.cluster.local:80 - - name: DJANGO_HOST - value: http://backend-svc.django.svc.cluster.local:80/api - - name: PLANNING_HOST - value: http://backend-svc.pm.svc.cluster.local:80/api/pm/msp - - name: PLANNING_USE - value: "True" - - name: DOCUMENTATION_HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1 - - name: DOCUMENTATION_EXTERNAL_HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80/api/v1 - - name: ENABLE_ANALYTICS - value: "1" - - name: ENABLE_CELERY - value: "1" - - name: ENABLE_MAILGUN - value: "0" - - name: ENABLE_METRICS - value: "0" - - name: FROM_EMAIL - value: sarex@rwb.ru - - name: GATEWAY_URL - value: http://pdm-api.documentations.svc.cluster.local:8080 - - name: RESOURCE_URL - value: http://resources-service.resources.svc.cluster.local:8000 - - name: SERVICE_HOST - value: https://srx.wb.ru/flows/api/v1 - - name: SMTP_HOST - value: mail.rwb.ru - - name: CHECKLIST_HOST - value: http://checklists-backend-service.checklists.svc.cluster.local:80 - - name: SMTP_PORT - value: "465" - - name: SYNC_RESOURCE_ID - value: "1" - - name: TIMEOUT - value: "120" - - name: WORKFLOWS_HOST - value: http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1 - - name: WORKFLOWS_TIMEOUT - value: "60" - - name: DOCUMENTATION_TIMEOUT - value: "60" - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/flows/base/backend-service.yaml b/apps/flows/base/backend-service.yaml deleted file mode 100644 index 7a8d196..0000000 --- a/apps/flows/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: flows -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/flows/base/backend.yaml b/apps/flows/base/backend.yaml new file mode 100644 index 0000000..c399461 --- /dev/null +++ b/apps/flows/base/backend.yaml @@ -0,0 +1,262 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: flows + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: flows-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_2a439111 + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql + [ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db + [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq + [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth + [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" + set +a + exec /opt/entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://srx.wb.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:80/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@rwb.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: SERVICE_HOST + value: + _default: "https://srx.wb.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "mail.rwb.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "465" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: flows + vault.hashicorp.com/agent-inject-secret-flows-postgresql: secrets/data/apps/flows/postgres + vault.hashicorp.com/agent-inject-template-flows-postgresql: |- + {{- with secret "secrets/data/apps/flows/postgres" -}} + PG_DB={{ index .Data.data "database" }} + PG_LOGIN={{ index .Data.data "username" }} + PG_HOST={{ index .Data.data "host" }} + PG_PORT={{ index .Data.data "port" }} + PG_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-documentations-db: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-flows-documentations-db: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + DOCUMENTATION_PG_HOST={{ index .Data.data "host" }} + DOCUMENTATION_PG_PORT={{ index .Data.data "port" }} + DOCUMENTATION_PG_DATABASE={{ index .Data.data "database" }} + DOCUMENTATION_PG_USERNAME={{ index .Data.data "username" }} + DOCUMENTATION_PG_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-rabbitmq: secrets/data/rabbitmq/apps/flows + vault.hashicorp.com/agent-inject-template-flows-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/flows" -}} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + RABBITMQ_PORT=5672 + ADMIN_PANEL_SECRET_KEY=rabbitmq.rabbitmq:5672 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-flows-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-flows-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/flows/base/celery-deployment.yaml b/apps/flows/base/celery-deployment.yaml deleted file mode 100644 index 78e1d72..0000000 --- a/apps/flows/base/celery-deployment.yaml +++ /dev/null @@ -1,137 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: celery - namespace: flows - labels: - app: celery - service: celery -spec: - replicas: 1 - selector: - matchLabels: - app: celery - template: - metadata: - labels: - app: celery - service: celery - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: flows - vault.hashicorp.com/agent-inject-secret-flows-postgresql: secrets/data/postgresql/apps/flows - vault.hashicorp.com/agent-inject-template-flows-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/flows" -}} - PG_DB=flows_db - PG_LOGIN={{ index .Data.data "username" }} - PG_HOST=postgresql.flows.svc.cluster.local - PG_PORT=5432 - PG_PASSWORD={{ index .Data.data "password" }} - DOCUMENTATION_PG_HOST=postgresql.flows.svc.cluster.local - DOCUMENTATION_PG_PORT=5432 - DOCUMENTATION_PG_DATABASE=flows_db - DOCUMENTATION_PG_USERNAME={{ index .Data.data "username" }} - DOCUMENTATION_PG_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-rabbitmq: secrets/data/rabbitmq/apps/flows - vault.hashicorp.com/agent-inject-template-flows-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/flows" -}} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - RABBITMQ_PORT=5672 - ADMIN_PANEL_SECRET_KEY=rabbitmq.rabbitmq:5672 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-flows-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_TOKEN={{ index .Data.data "key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-flows-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-flows-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: flows-vault - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_2a439111 - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql - [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq - [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth - [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" - set +a - exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: LOG_LEVEL - value: DEBUG - - name: BASE_HOST - value: https://srx.wb.ru - - name: CELERY_QUEUE - value: flow - - name: EAV_HOST - value: http://backend-svc.eav.svc.cluster.local:80 - - name: DJANGO_HOST - value: http://backend-svc.django.svc.cluster.local:80/api - - name: PLANNING_HOST - value: http://backend-service.pm.svc.cluster.local:80/api/pm/msp - - name: PLANNING_USE - value: "True" - - name: DOCUMENTATION_HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1 - - name: DOCUMENTATION_EXTERNAL_HOST - value: http://backend-api-svc.documentations.svc.cluster.local:80/api/v1 - - name: ENABLE_ANALYTICS - value: "1" - - name: ENABLE_CELERY - value: "1" - - name: ENABLE_MAILGUN - value: "0" - - name: ENABLE_METRICS - value: "0" - - name: FROM_EMAIL - value: sarex@rwb.ru - - name: GATEWAY_URL - value: http://pdm-api.documentations.svc.cluster.local:8080 - - name: RESOURCE_URL - value: http://resources-service.resources.svc.cluster.local:8000 - - name: SERVICE_HOST - value: https://srx.wb.ru/flows/api/v1 - - name: SMTP_HOST - value: mail.rwb.ru - - name: CHECKLIST_HOST - value: http://checklists-backend-service.checklists.svc.cluster.local:80 - - name: SMTP_PORT - value: "465" - - name: SYNC_RESOURCE_ID - value: "1" - - name: TIMEOUT - value: "120" - - name: WORKFLOWS_HOST - value: http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1 - - name: WORKFLOWS_TIMEOUT - value: "60" - - name: DOCUMENTATION_TIMEOUT - value: "60" - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/flows/base/celery.yaml b/apps/flows/base/celery.yaml new file mode 100644 index 0000000..4e20e5f --- /dev/null +++ b/apps/flows/base/celery.yaml @@ -0,0 +1,248 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: flows + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + celery: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: flows-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_2a439111 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql + [ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db + [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq + [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth + [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" + set +a + exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://srx.wb.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:80/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@rwb.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: SERVICE_HOST + value: + _default: "https://srx.wb.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "mail.rwb.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "465" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: flows + vault.hashicorp.com/agent-inject-secret-flows-postgresql: secrets/data/apps/flows/postgres + vault.hashicorp.com/agent-inject-template-flows-postgresql: |- + {{- with secret "secrets/data/apps/flows/postgres" -}} + PG_DB={{ index .Data.data "database" }} + PG_LOGIN={{ index .Data.data "username" }} + PG_HOST={{ index .Data.data "host" }} + PG_PORT={{ index .Data.data "port" }} + PG_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-documentations-db: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-flows-documentations-db: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + DOCUMENTATION_PG_HOST={{ index .Data.data "host" }} + DOCUMENTATION_PG_PORT={{ index .Data.data "port" }} + DOCUMENTATION_PG_DATABASE={{ index .Data.data "database" }} + DOCUMENTATION_PG_USERNAME={{ index .Data.data "username" }} + DOCUMENTATION_PG_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-rabbitmq: secrets/data/rabbitmq/apps/flows + vault.hashicorp.com/agent-inject-template-flows-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/flows" -}} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + RABBITMQ_PORT=5672 + ADMIN_PANEL_SECRET_KEY=rabbitmq.rabbitmq:5672 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-flows-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-flows-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/flows/base/frontend-deployment.yaml b/apps/flows/base/frontend-deployment.yaml deleted file mode 100644 index d22c44a..0000000 --- a/apps/flows/base/frontend-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: flows - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_5b2bd144 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/flows/base/frontend-service.yaml b/apps/flows/base/frontend-service.yaml deleted file mode 100644 index 560deee..0000000 --- a/apps/flows/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: flows -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/flows/base/frontend.yaml b/apps/flows/base/frontend.yaml new file mode 100644 index 0000000..2864ef0 --- /dev/null +++ b/apps/flows/base/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: flows + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_5b2bd144 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/flows/base/kustomization.yaml b/apps/flows/base/kustomization.yaml index 2f070b6..7986c03 100644 --- a/apps/flows/base/kustomization.yaml +++ b/apps/flows/base/kustomization.yaml @@ -4,9 +4,6 @@ kind: Kustomization namespace: flows resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - celery-deployment.yaml - - frontend-deployment.yaml - - backend-service.yaml - - frontend-service.yaml + - backend.yaml + - celery.yaml + - frontend.yaml diff --git a/apps/flows/base/serviceaccount.yaml b/apps/flows/base/serviceaccount.yaml deleted file mode 100644 index 90ea5b2..0000000 --- a/apps/flows/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: flows-vault - namespace: flows diff --git a/apps/flows/d8-ugmk-prod/kustomization.yaml b/apps/flows/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..d399533 --- /dev/null +++ b/apps/flows/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: flows diff --git a/apps/flows/d8-ugmk-prod/namespace.yaml b/apps/flows/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..c02e305 --- /dev/null +++ b/apps/flows/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: flows + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/flows/dsinv/backend.yaml b/apps/flows/dsinv/backend.yaml index 1daaea0..2cd9861 100644 --- a/apps/flows/dsinv/backend.yaml +++ b/apps/flows/dsinv/backend.yaml @@ -1,92 +1,182 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: flows spec: - replicas: 2 - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a5d748f0 - env: - - name: DEBUG - value: 'false' - - name: PLANNING_HOST - value: http://backend-service.pm.svc.cluster.local:8000/api/pm/msp - - name: PLANNING_USE - value: 'True' - - name: PG_PORT - value: '5432' - - name: EAV_HOST - value: http://eav-service.eav.svc.cluster.local:8000 - - name: PROXY_PATH_PREFIX - value: /flows - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000/api - - name: DOCUMENTATION_TIMEOUT - value: '240' - - name: DOCUMENTATION_HOST - value: http://documentations-service.documentations.svc.cluster.local:8080/internal/v1 - - name: DOCUMENTATION_EXTERNAL_HOST - value: http://documentations-service.documentations.svc.cluster.local:8080/api/v1 - - name: BASE_HOST - value: https://sarex.dsinv.ru - - name: DOCUMENTATION_PG_PORT - value: '5432' - - name: DOCUMENTATION_PG_DATABASE - value: documentations - - name: DOCUMENTATION_PG_HOST - value: postgres-service.documentations.svc.cluster.local - - name: WORKFLOWS_HOST - value: http://workflows-service.workflow.svc.cluster.local:8000/api/v1 - - name: WORKFLOWS_NOTIFICATIONS_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: WORKFLOWS_NOTIFICATIONS_SMTP_HOST - value: relay.dsinv.ru - - name: WORKFLOWS_NOTIFICATIONS_SMTP_PORT - value: '25' - - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAI - value: sarex@dsinv.ru - - name: NOTIFICATION_SETTINGS_USE_MAILGUN - value: '0' - - name: RESOURCES_HOST - value: http://resources-service.resources.svc.cluster.local:8000 - - name: ENABLE_METRICS - value: '0' - - name: ENABLE_MAILGUN - value: '0' - - name: SMTP_HOST - value: relay.dsinv.ru - - name: SMTP_PORT - value: '25' - - name: FROM_EMAIL - value: sarex@dsinv.ru - - name: TIMEOUT - value: '240' - - name: WORKFLOWS_TIMEOUT - value: '20' - - name: RESOURCE_URL - value: http://resources-service.resources.svc.cluster.local:8000/ - - name: GATEWAY_URL - value: http://pdm-api.documentations.svc.cluster.local:8080/ - - name: SYNC_RESOURCE_ID - value: '1' - - name: SERVICE_HOST - value: https://sarex.dsinv.ru/flows/api/v1 - - name: ENABLE_ANALYTICS - value: '1' - - name: ENABLE_CELERY - value: '1' - - name: CELERY_QUEUE - value: flow - - name: RABBITMQ_HOST - value: rabbitmq-service.flows.svc - - name: RABBITMQ_PORT - value: '5672' - - name: RABBITMQ_VHOST - value: flow - - name: PG_HOST - value: postgres-service.flows.svc.cluster.local + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a5d748f0 + + deployment: + replicaCount: + _default: 2 + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://documentations-service.documentations.svc.cluster.local:8080/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://documentations-service.documentations.svc.cluster.local:8080/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@dsinv.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080/" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000/" + + - name: SERVICE_HOST + value: + _default: "https://sarex.dsinv.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "25" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "240" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "20" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "240" + + - name: DEBUG + value: + _default: "false" + + - name: PG_PORT + value: + _default: "5432" + + - name: PROXY_PATH_PREFIX + value: + _default: "/flows" + + - name: DOCUMENTATION_PG_PORT + value: + _default: "5432" + + - name: DOCUMENTATION_PG_DATABASE + value: + _default: "documentations" + + - name: DOCUMENTATION_PG_HOST + value: + _default: "postgres-service.documentations.svc.cluster.local" + + - name: WORKFLOWS_NOTIFICATIONS_REGISTRY + value: + _default: "cr.yandex/crp3ccidau046kdj8g9q" + + - name: WORKFLOWS_NOTIFICATIONS_SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: WORKFLOWS_NOTIFICATIONS_SMTP_PORT + value: + _default: "25" + + - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAI + value: + _default: "sarex@dsinv.ru" + + - name: NOTIFICATION_SETTINGS_USE_MAILGUN + value: + _default: "0" + + - name: RESOURCES_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: RABBITMQ_HOST + value: + _default: "rabbitmq-service.flows.svc" + + - name: RABBITMQ_PORT + value: + _default: "5672" + + - name: RABBITMQ_VHOST + value: + _default: "flow" + + - name: PG_HOST + value: + _default: "postgres-service.flows.svc.cluster.local" diff --git a/apps/flows/dsinv/celery.yaml b/apps/flows/dsinv/celery.yaml index c77e992..a3e146b 100644 --- a/apps/flows/dsinv/celery.yaml +++ b/apps/flows/dsinv/celery.yaml @@ -1,93 +1,198 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: celery namespace: flows spec: - template: - spec: - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a5d748f0 - env: - - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAIL - value: sarex@dsinv.ru - - name: ENABLE_METRICS - value: '0' - - name: ENABLE_MAILGUN - value: '0' - - name: SMTP_HOST - value: relay.dsinv.ru - - name: SMTP_PORT - value: '25' - - name: FROM_EMAIL - value: sarex@dsinv.ru - - name: MAILGUN_HOST - value: http:localhost:8000 - - name: MAILGUN_API_KEY - value: empty - - name: NOTIFICATION_SETTINGS_USE_MAILGUN - value: '0' - - name: WORKFLOWS_HOST - value: http://workflows-service.workflow.svc.cluster.local:8000/api/v1 - - name: FLOWS_HOST - value: http://backend-service.flows.svc.cluster.local:8000 - - name: WORKFLOWS_NOTIFICATIONS_REGISTRY - value: cr.yandex/crp3ccidau046kdj8g9q - - name: WORKFLOWS_NOTIFICATIONS_SMTP_HOST - value: relay.dsinv.ru - - name: WORKFLOWS_NOTIFICATIONS_SMTP_PORT - value: '25' - - name: PLANNING_HOST - value: http://backend-service.pm.svc.cluster.local:8000/api/pm/msp - - name: PLANNING_USE - value: 'True' - - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAI - value: sarex@dsinv.ru - - name: FLOWS_DB_HOST - value: postgres-service.flows.svc.cluster.local - - name: ISSUES_DB_HOST - value: postgres-service.issues.svc.cluster.local - - name: DEBUG - value: '0' - - name: PG_PORT - value: '5432' - - name: FLOWS_DB_PORT - value: '5432' - - name: ISSUES_DB_PORT - value: '5432' - - name: DJANGO_HOST - value: http://backend.django.svc.cluster.local:8000/api - - name: DJANGO_BASE_HOST - value: https://sarex.dsinv.ru - - name: DOCUMENTATION_HOST - value: http://documentations-service.documentations.svc.cluster.local:8080/internal/v1 - - name: BASE_HOST - value: https://sarex.dsinv.ru - - name: RESOURCES_HOST - value: http://resources-service.resources.svc.cluster.local:8000/ - - name: TIMEOUT - value: '120' - - name: RESOURCE_URL - value: http://resources-service.resources/api/v1 - - name: GATEWAY_URL - value: http://pdm-api.documentations.svc.cluster.local:8080/api/v1 - - name: SYNC_RESOURCE_ID - value: '1' - - name: SERVICE_HOST - value: https://sarex.dsinv.ru/flows/api/v1 - - name: ENABLE_ANALYTICS - value: '1' - - name: ENABLE_CELERY - value: '1' - - name: CELERY_QUEUE - value: flow - - name: RABBITMQ_HOST - value: rabbitmq-service.flows.svc - - name: RABBITMQ_PORT - value: '5672' - - name: RABBITMQ_VHOST - value: flow - - name: PG_HOST - value: postgres-service.flows.svc.cluster.local + values: + services: + celery: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a5d748f0 + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://documentations-service.documentations.svc.cluster.local:8080/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@dsinv.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080/api/v1" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources/api/v1" + + - name: SERVICE_HOST + value: + _default: "https://sarex.dsinv.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "25" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAIL + value: + _default: "sarex@dsinv.ru" + + - name: MAILGUN_HOST + value: + _default: "http:localhost:8000" + + - name: MAILGUN_API_KEY + value: + _default: "empty" + + - name: NOTIFICATION_SETTINGS_USE_MAILGUN + value: + _default: "0" + + - name: FLOWS_HOST + value: + _default: "http://backend-service.flows.svc.cluster.local:8000" + + - name: WORKFLOWS_NOTIFICATIONS_REGISTRY + value: + _default: "cr.yandex/crp3ccidau046kdj8g9q" + + - name: WORKFLOWS_NOTIFICATIONS_SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: WORKFLOWS_NOTIFICATIONS_SMTP_PORT + value: + _default: "25" + + - name: WORKFLOWS_NOTIFICATIONS_FROM_EMAI + value: + _default: "sarex@dsinv.ru" + + - name: FLOWS_DB_HOST + value: + _default: "postgres-service.flows.svc.cluster.local" + + - name: ISSUES_DB_HOST + value: + _default: "postgres-service.issues.svc.cluster.local" + + - name: DEBUG + value: + _default: "0" + + - name: PG_PORT + value: + _default: "5432" + + - name: FLOWS_DB_PORT + value: + _default: "5432" + + - name: ISSUES_DB_PORT + value: + _default: "5432" + + - name: DJANGO_BASE_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: RESOURCES_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000/" + + - name: RABBITMQ_HOST + value: + _default: "rabbitmq-service.flows.svc" + + - name: RABBITMQ_PORT + value: + _default: "5672" + + - name: RABBITMQ_VHOST + value: + _default: "flow" + + - name: PG_HOST + value: + _default: "postgres-service.flows.svc.cluster.local" diff --git a/apps/flows/dsinv/frontend.yaml b/apps/flows/dsinv/frontend.yaml index 2665046..a7938ed 100644 --- a/apps/flows/dsinv/frontend.yaml +++ b/apps/flows/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: flows spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_bad7aeb2 + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_bad7aeb2 diff --git a/apps/flows/dsinv/kustomization.yaml b/apps/flows/dsinv/kustomization.yaml index 0f1f7e1..77a3b6e 100644 --- a/apps/flows/dsinv/kustomization.yaml +++ b/apps/flows/dsinv/kustomization.yaml @@ -10,13 +10,13 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend - path: celery.yaml target: - kind: Deployment + kind: HelmRelease name: celery - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend diff --git a/apps/inspections/base/backend-deployment.yaml b/apps/inspections/base/backend-deployment.yaml deleted file mode 100644 index a61a392..0000000 --- a/apps/inspections/base/backend-deployment.yaml +++ /dev/null @@ -1,120 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: inspections-backend - namespace: inspections - labels: - app: inspections-backend -spec: - replicas: 1 - selector: - matchLabels: - app: inspections-backend - template: - metadata: - labels: - app: inspections-backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: inspections - vault.hashicorp.com/agent-inject-secret-inspections-db: secrets/data/postgresql/apps/inspections - vault.hashicorp.com/agent-inject-template-inspections-db: |- - {{- with secret "secrets/data/postgresql/apps/inspections" -}} - DATABASE_HOST=postgresql.inspections.svc.cluster.local - DATABASE_PORT=5432 - DATABASE_NAME=inspections_db - DATABASE_USER={{ index .Data.data "username" }} - DATABASE_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-inspections-kafka: secrets/data/kafka/apps/inspections - vault.hashicorp.com/agent-inject-template-inspections-kafka: |- - {{- with secret "secrets/data/kafka/apps/inspections" -}} - KAFKA_HOST={{ index .Data.data.auth "bootstrap_servers" }} - KAFKA_USERNAME={{ index .Data.data "username" }} - KAFKA_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-inspections-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-inspections-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - SAREX_BACKEND_AUTH={{ index .Data.data "key" }} - {{- end -}} - spec: - serviceAccountName: inspections-vault - containers: - - name: inspections-backend - image: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4 - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/inspections-db ] && . /vault/secrets/inspections-db - [ -f /vault/secrets/inspections-kafka ] && . /vault/secrets/inspections-kafka - [ -f /vault/secrets/inspections-django-auth ] && . /vault/secrets/inspections-django-auth - set +a - exec ./entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: DEBUG - value: "false" - - name: SERVICE_URL - value: https://srx.wb.ru - - name: HTTP_APP_HOST - value: 0.0.0.0 - - name: HTTP_APP_PORT - value: "8000" - - name: HTTP_APP_ROOT_PATH - value: /inspections - - name: HTTP_APP_WORKERS - value: "3" - - name: HTTP_APP_ADMIN_ENABLE - value: "true" - - name: KAFKA_SSL_CAFILE - value: /usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt - - name: KAFKA_EAV_ASSETS_TOPIC - value: assets_broadcast - - name: JWT_AUTH_ENABLE - value: "true" - - name: NOTIFICATIONS_ENABLE - value: "true" - - name: NOTIFICATIONS_EMAIL_FROM - value: hello@sarex.io - - name: SAREX_BACKEND_URL - value: https://srx.wb.ru - - name: SAREX_BACKEND_TIMEOUT - value: "30" - - name: EAV_URL - value: http://eav-service.eav - - name: EAV_TIMEOUT - value: "30" - - name: WORKFLOWS_URL - value: http://workflows-service.processing-prod - - name: WORKFLOWS_TIMEOUT - value: "30" - - name: WORKFLOWS_EMAIL_DOCKER_IMAGE - value: cr.yandex/crp3ccidau046kdj8g9q/notification:email - - name: MOBILE_APP_CURRENT_VERSION - value: 1.0.0 - - name: MOBILE_APP_RECOMMENDED_VERSION - value: 1.0.0 - - name: MOBILE_APP_REQUIRED_VERSION - value: 1.0.0 - - name: MAILER_URL - value: http://mailer-service.mailer:8000 - - name: MAILER_TIMEOUT - value: "30" - - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/inspections/base/backend-service.yaml b/apps/inspections/base/backend-service.yaml deleted file mode 100644 index f938e6d..0000000 --- a/apps/inspections/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: rfi-backend-api-svc - namespace: rfi -spec: - type: ClusterIP - selector: - app: rfi-backend-api - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/inspections/base/backend.yaml b/apps/inspections/base/backend.yaml new file mode 100644 index 0000000..5176017 --- /dev/null +++ b/apps/inspections/base/backend.yaml @@ -0,0 +1,240 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: inspections + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: inspections-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: inspections-backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/inspections-db ] && . /vault/secrets/inspections-db + [ -f /vault/secrets/inspections-kafka ] && . /vault/secrets/inspections-kafka + [ -f /vault/secrets/inspections-django-auth ] && . /vault/secrets/inspections-django-auth + set +a + exec ./entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: DEBUG + value: + _default: "false" + + - name: SERVICE_URL + value: + _default: "https://srx.wb.ru" + + - name: HTTP_APP_HOST + value: + _default: "0.0.0.0" + + - name: HTTP_APP_PORT + value: + _default: "8000" + + - name: HTTP_APP_ROOT_PATH + value: + _default: "/inspections" + + - name: HTTP_APP_WORKERS + value: + _default: "3" + + - name: HTTP_APP_ADMIN_ENABLE + value: + _default: "true" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + + - name: JWT_AUTH_ENABLE + value: + _default: "true" + + - name: NOTIFICATIONS_ENABLE + value: + _default: "true" + + - name: NOTIFICATIONS_EMAIL_FROM + value: + _default: "hello@sarex.io" + + - name: SAREX_BACKEND_URL + value: + _default: "https://srx.wb.ru" + + - name: SAREX_BACKEND_TIMEOUT + value: + _default: "30" + + - name: EAV_URL + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: EAV_TIMEOUT + value: + _default: "30" + + - name: WORKFLOWS_URL + value: + _default: "http://backend-svc.processing.svc.cluster.local:80" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "30" + + - name: WORKFLOWS_EMAIL_DOCKER_IMAGE + value: + _default: "cr.yandex/crp3ccidau046kdj8g9q/notification:email" + + - name: MOBILE_APP_CURRENT_VERSION + value: + _default: "1.0.0" + + - name: MOBILE_APP_RECOMMENDED_VERSION + value: + _default: "1.0.0" + + - name: MOBILE_APP_REQUIRED_VERSION + value: + _default: "1.0.0" + + - name: MAILER_URL + value: + _default: "http://mailer-service.mailer:8000" + + - name: MAILER_TIMEOUT + value: + _default: "30" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: inspections + vault.hashicorp.com/agent-inject-secret-inspections-db: secrets/data/apps/inspections/postgres + vault.hashicorp.com/agent-inject-template-inspections-db: |- + {{- with secret "secrets/data/apps/inspections/postgres" -}} + DATABASE_HOST={{ index .Data.data "host" }} + DATABASE_PORT={{ index .Data.data "port" }} + DATABASE_NAME={{ index .Data.data "database" }} + DATABASE_USER={{ index .Data.data "username" }} + DATABASE_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-inspections-kafka: secrets/data/kafka/apps/inspections + vault.hashicorp.com/agent-inject-template-inspections-kafka: |- + {{- with secret "secrets/data/kafka/apps/inspections" -}} + KAFKA_HOST={{ index .Data.data.auth "bootstrap_servers" }} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-inspections-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-inspections-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + SAREX_BACKEND_AUTH={{ index .Data.data "key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/inspections/base/kustomization.yaml b/apps/inspections/base/kustomization.yaml index 2b4238a..53d2b37 100644 --- a/apps/inspections/base/kustomization.yaml +++ b/apps/inspections/base/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization namespace: inspections resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml + - backend.yaml diff --git a/apps/inspections/base/serviceaccount.yaml b/apps/inspections/base/serviceaccount.yaml deleted file mode 100644 index b9f482d..0000000 --- a/apps/inspections/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: inspections-vault - namespace: inspections diff --git a/apps/inspections/d8-ugmk-prod/kustomization.yaml b/apps/inspections/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..025bf58 --- /dev/null +++ b/apps/inspections/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: inspections diff --git a/apps/inspections/d8-ugmk-prod/namespace.yaml b/apps/inspections/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..983b433 --- /dev/null +++ b/apps/inspections/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: inspections + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/inspections/dsinv/inspections-backend.yaml b/apps/inspections/dsinv/inspections-backend.yaml index b35cd4d..ce1c50f 100644 --- a/apps/inspections/dsinv/inspections-backend.yaml +++ b/apps/inspections/dsinv/inspections-backend.yaml @@ -1,61 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: - name: inspections-backend + name: backend namespace: inspections spec: - template: - spec: - containers: - - name: inspections-backend - image: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d - env: - - name: DEBUG - value: 'false' - - name: SERVICE_URL - value: https://srx.wb.ru - - name: HTTP_APP_HOST - value: 0.0.0.0 - - name: HTTP_APP_PORT - value: '8000' - - name: HTTP_APP_ROOT_PATH - value: /inspections - - name: HTTP_APP_WORKERS - value: '3' - - name: HTTP_APP_ADMIN_ENABLE - value: 'true' - - name: KAFKA_SSL_CAFILE - value: /usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt - - name: KAFKA_EAV_ASSETS_TOPIC - value: assets_broadcast - - name: JWT_AUTH_ENABLE - value: 'true' - - name: NOTIFICATIONS_ENABLE - value: 'true' - - name: NOTIFICATIONS_EMAIL_FROM - value: hello@sarex.io - - name: SAREX_BACKEND_URL - value: https://srx.wb.ru - - name: SAREX_BACKEND_TIMEOUT - value: '30' - - name: EAV_URL - value: http://eav-service.eav - - name: EAV_TIMEOUT - value: '30' - - name: WORKFLOWS_URL - value: http://workflows-service.processing-prod - - name: WORKFLOWS_TIMEOUT - value: '30' - - name: WORKFLOWS_EMAIL_DOCKER_IMAGE - value: cr.yandex/crp3ccidau046kdj8g9q/notification:email - - name: MOBILE_APP_CURRENT_VERSION - value: 1.0.0 - - name: MOBILE_APP_RECOMMENDED_VERSION - value: 1.0.0 - - name: MOBILE_APP_REQUIRED_VERSION - value: 1.0.0 - - name: MAILER_URL - value: http://mailer-service.mailer:8000 - - name: MAILER_TIMEOUT - value: '30' + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d diff --git a/apps/inspections/dsinv/kustomization.yaml b/apps/inspections/dsinv/kustomization.yaml index afe1f3d..d7a1bd2 100644 --- a/apps/inspections/dsinv/kustomization.yaml +++ b/apps/inspections/dsinv/kustomization.yaml @@ -9,5 +9,5 @@ resources: patches: - path: inspections-backend.yaml target: - kind: Deployment - name: inspections-backend + kind: HelmRelease + name: backend diff --git a/apps/issues/base/backend-deployment.yaml b/apps/issues/base/backend-deployment.yaml deleted file mode 100644 index 24c69ab..0000000 --- a/apps/issues/base/backend-deployment.yaml +++ /dev/null @@ -1,135 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: issues - labels: - app: backend - service: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - service: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: issues - vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/postgresql/apps/issues - vault.hashicorp.com/agent-inject-template-issues-db: |- - {{- with secret "secrets/data/postgresql/apps/issues" -}} - DATABASE_PORT=5432 - DATABASE_HOST=postgresql.issues.svc.cluster.local - DATABASE_USER={{ index .Data.data "username" }} - DATABASE_PASSWORD={{ index .Data.data "password" }} - DATABASE_NAME=issues_db - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues - vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/issues" -}} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues - vault.hashicorp.com/agent-inject-template-issues-s3: |- - {{- with secret "secrets/data/minio/apps/issues" -}} - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - YC_S3_BUCKET_NAME=rfi - YC_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-issues-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_TOKEN={{ index .Data.data "key" }} - SAREX_USERNAME={{ index .Data.data "username" }} - SAREX_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-issues-jwt-private: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "private_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-issues-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: issues-vault - volumes: - - name: production-configmap - configMap: - name: production-configmap - items: - - key: production.py - path: production.py - defaultMode: 420 - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db - [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq - [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 - [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth - [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" - [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" - set +a - exec /src/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: ENVIRONMENT - value: production - - name: AERO_PUBLIC_HOST - value: https://sarex.contour.infra.sarex.tech - - name: AERO_HOST - value: https://sarex.contour.infra.sarex.tech - - name: BASE_AERO_URL - value: https://sarex.contour.infra.sarex.tech - - name: BASE_AUTH_URL - value: http://backend-svc.django.svc.cluster.local:80 - - name: WORKFLOWS_HOST - value: http://backend-svc.workflow.svc.cluster.local:80 - - name: WORKFLOWS_URL - value: http://backend-svc.workflow.svc.cluster.local:80 - - name: RESOURCES_API_HOST - value: http://backend-svc.resources.svc.cluster.local:80 - - name: EAV_HOST - value: http://backend-svc.eav.svc.cluster.local:80 - - name: SAREX_API - value: https://sarex.contour.infra.sarex.tech - - name: DOCUMENTATIONS_URL - value: http://documentations-api-svc.documentations.svc.cluster.local:80 - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: API_ADDRESS - value: "8000" - resources: - requests: - cpu: "25m" - memory: 128Mi - volumeMounts: - - name: production-configmap - mountPath: /src/config/settings/production.py - subPath: production.py - imagePullSecrets: - - name: regcred diff --git a/apps/issues/base/backend-service.yaml b/apps/issues/base/backend-service.yaml deleted file mode 100644 index d5d299e..0000000 --- a/apps/issues/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: issues -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/issues/base/backend.yaml b/apps/issues/base/backend.yaml new file mode 100644 index 0000000..cc341c8 --- /dev/null +++ b/apps/issues/base/backend.yaml @@ -0,0 +1,237 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: issues + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: issues-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + set +a + exec /src/entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: AERO_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AERO_URL + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: WORKFLOWS_URL + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: issues + vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/apps/issues/postgres + vault.hashicorp.com/agent-inject-template-issues-db: |- + {{- with secret "secrets/data/apps/issues/postgres" -}} + DATABASE_PORT={{ index .Data.data "port" }} + DATABASE_HOST={{ index .Data.data "host" }} + DATABASE_USER={{ index .Data.data "username" }} + DATABASE_PASSWORD={{ index .Data.data "password" }} + DATABASE_NAME={{ index .Data.data "database" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues + vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/issues" -}} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=rfi + YC_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-issues-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + SAREX_USERNAME={{ index .Data.data "username" }} + SAREX_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/base/celery-deployment.yaml b/apps/issues/base/celery-deployment.yaml deleted file mode 100644 index c5fd887..0000000 --- a/apps/issues/base/celery-deployment.yaml +++ /dev/null @@ -1,135 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: celery - namespace: issues - labels: - app: celery - service: celery -spec: - replicas: 1 - selector: - matchLabels: - app: celery - template: - metadata: - labels: - app: celery - service: celery - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: issues - vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/postgresql/apps/issues - vault.hashicorp.com/agent-inject-template-issues-db: |- - {{- with secret "secrets/data/postgresql/apps/issues" -}} - DATABASE_PORT=5432 - DATABASE_HOST=postgresql.issues.svc.cluster.local - DATABASE_USER={{ index .Data.data "username" }} - DATABASE_PASSWORD={{ index .Data.data "password" }} - DATABASE_NAME=issues_db - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues - vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/issues" -}} - RABBITMQ_VHOST={{ index .Data.data "vhost" }} - RABBITMQ_USERNAME={{ index .Data.data "username" }} - RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local - RABBITMQ_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues - vault.hashicorp.com/agent-inject-template-issues-s3: |- - {{- with secret "secrets/data/minio/apps/issues" -}} - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - YC_S3_BUCKET_NAME=rfi - YC_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-issues-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - DJANGO_TOKEN={{ index .Data.data "key" }} - SAREX_USERNAME={{ index .Data.data "username" }} - SAREX_PASSWORD={{ index .Data.data "password" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-issues-jwt-private: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "private_key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-issues-jwt-public: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - {{ index .Data.data "public_key" }} - {{- end -}} - spec: - serviceAccountName: issues-vault - volumes: - - name: production-configmap - configMap: - name: production-configmap - items: - - key: production.py - path: production.py - defaultMode: 420 - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa - imagePullPolicy: IfNotPresent - command: ["/bin/sh", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db - [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq - [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 - [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth - [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" - [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" - set +a - exec celery -A config worker -l info -E - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: ENVIRONMENT - value: production - - name: AERO_PUBLIC_HOST - value: https://srx.wb.ru - - name: AERO_HOST - value: https://srx.wb.ru - - name: BASE_AERO_URL - value: https://srx.wb.ru - - name: BASE_AUTH_URL - value: http://backend-svc.django.svc.cluster.local:80 - - name: WORKFLOWS_HOST - value: http://workflows-api-service.workflow.svc.cluster.local:8000 - - name: WORKFLOWS_URL - value: http://workflows-api-service.workflow.svc.cluster.local:8000 - - name: RESOURCES_API_HOST - value: http://backend-svc.resources.svc.cluster.local:80 - - name: EAV_HOST - value: http://backend-svc.eav.svc.cluster.local:80 - - name: SAREX_API - value: https://srx.wb.ru - - name: DOCUMENTATIONS_URL - value: http://backend-api-svc.documentations.svc.cluster.local:80 - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: API_ADDRESS - value: "8000" - resources: - requests: - cpu: "25m" - memory: 128Mi - volumeMounts: - - name: production-configmap - mountPath: /src/config/settings/production.py - subPath: production.py - imagePullSecrets: - - name: regcred diff --git a/apps/issues/base/celery.yaml b/apps/issues/base/celery.yaml new file mode 100644 index 0000000..5caf9ee --- /dev/null +++ b/apps/issues/base/celery.yaml @@ -0,0 +1,222 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: issues + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + celery: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: issues-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + set +a + exec celery -A config worker -l info -E + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://srx.wb.ru" + + - name: AERO_HOST + value: + _default: "https://srx.wb.ru" + + - name: BASE_AERO_URL + value: + _default: "https://srx.wb.ru" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://srx.wb.ru" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: issues + vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/apps/issues/postgres + vault.hashicorp.com/agent-inject-template-issues-db: |- + {{- with secret "secrets/data/apps/issues/postgres" -}} + DATABASE_PORT={{ index .Data.data "port" }} + DATABASE_HOST={{ index .Data.data "host" }} + DATABASE_USER={{ index .Data.data "username" }} + DATABASE_PASSWORD={{ index .Data.data "password" }} + DATABASE_NAME={{ index .Data.data "database" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues + vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/issues" -}} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=rfi + YC_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-issues-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + SAREX_USERNAME={{ index .Data.data "username" }} + SAREX_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/base/frontend-deployment.yaml b/apps/issues/base/frontend-deployment.yaml deleted file mode 100644 index f34f03e..0000000 --- a/apps/issues/base/frontend-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: issues - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:716a2b73 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/issues/base/frontend-service.yaml b/apps/issues/base/frontend-service.yaml deleted file mode 100644 index fdb438b..0000000 --- a/apps/issues/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: issues -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/issues/base/frontend.yaml b/apps/issues/base/frontend.yaml new file mode 100644 index 0000000..d01827e --- /dev/null +++ b/apps/issues/base/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: issues + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:716a2b73 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/issues/base/kustomization.yaml b/apps/issues/base/kustomization.yaml index 2b1272a..36da654 100644 --- a/apps/issues/base/kustomization.yaml +++ b/apps/issues/base/kustomization.yaml @@ -4,10 +4,7 @@ kind: Kustomization namespace: issues resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - celery-deployment.yaml - - frontend-deployment.yaml - - backend-service.yaml - - frontend-service.yaml + - backend.yaml + - celery.yaml + - frontend.yaml - production-configmap.yaml diff --git a/apps/issues/base/serviceaccount.yaml b/apps/issues/base/serviceaccount.yaml deleted file mode 100644 index 30a477e..0000000 --- a/apps/issues/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: issues-vault - namespace: issues diff --git a/apps/issues/d8-ugmk-prod/kustomization.yaml b/apps/issues/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..b64e558 --- /dev/null +++ b/apps/issues/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: issues diff --git a/apps/issues/d8-ugmk-prod/namespace.yaml b/apps/issues/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..10ec0c1 --- /dev/null +++ b/apps/issues/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: issues + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/issues/dsinv/backend.yaml b/apps/issues/dsinv/backend.yaml index d168bfd..05c5595 100644 --- a/apps/issues/dsinv/backend.yaml +++ b/apps/issues/dsinv/backend.yaml @@ -1,53 +1,102 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: issues spec: - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/issues:production_31aef17b - env: - - name: ENABLE_MAILGUN - value: 'False' - - name: SMTP_HOST - value: relay.dsinv.ru - - name: SMTP_PORT - value: '25' - - name: EMAIL_FROM - value: sarex@dsinv.ru - - name: USE_NOTIFICATIONS - value: 'True' - - name: DJANGO_SETTINGS_MODULE - value: config.settings.production - - name: REDIS_HOST - value: redis-service.issues.svc.cluster.local - - name: DATABASE_HOST - value: postgres-service.issues.svc.cluster.local - - name: DATABASE_PORT - value: '5432' - - name: DATABASE_NAME - value: issues - - name: API_ADDRESS - value: '8000' - - name: ENVIRONMENT - value: production - - name: AERO_PUBLIC_HOST - value: https://sarex.dsinv.ru - - name: BASE_AERO_URL - value: http://backend.django.svc.cluster.local:8000 - - name: BASE_AUTH_URL - value: http://backend.django.svc.cluster.local:8000 - - name: WORKFLOWS_HOST - value: http://workflows-service.workflow.svc.cluster.local:8000 - - name: WORKFLOWS_URL - value: https://sarex.dsinv.ru - - name: RESOURCES_API_HOST - value: http://resources-service.resources.svc.cluster.local:8000 - - name: EAV_HOST - value: http://eav-service.eav.svc.cluster.local:8000 - - name: SAREX_API - value: http://backend.django.svc.cluster.local:8000 + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_31aef17b + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: AERO_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AERO_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: BASE_AUTH_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "https://sarex.dsinv.ru" + + - name: RESOURCES_API_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: SAREX_API + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + - name: ENABLE_MAILGUN + value: + _default: "False" + + - name: SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: SMTP_PORT + value: + _default: "25" + + - name: EMAIL_FROM + value: + _default: "sarex@dsinv.ru" + + - name: USE_NOTIFICATIONS + value: + _default: "True" + + - name: REDIS_HOST + value: + _default: "redis-service.issues.svc.cluster.local" + + - name: DATABASE_HOST + value: + _default: "postgres-service.issues.svc.cluster.local" + + - name: DATABASE_PORT + value: + _default: "5432" + + - name: DATABASE_NAME + value: + _default: "issues" diff --git a/apps/issues/dsinv/celery.yaml b/apps/issues/dsinv/celery.yaml index 53618ac..8c6a8e7 100644 --- a/apps/issues/dsinv/celery.yaml +++ b/apps/issues/dsinv/celery.yaml @@ -1,57 +1,110 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: celery namespace: issues spec: - template: - spec: - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/issues:production_31aef17b - env: - - name: KAFKA_EAV_ASSETS_TOPIC - value: sarex - - name: AERO_PUBLIC_HOST - value: https://sarex.dsinv.ru - - name: ENABLE_MAILGUN - value: 'False' - - name: SMTP_HOST - value: relay.dsinv.ru - - name: SMTP_PORT - value: '25' - - name: EMAIL_FROM - value: sarex@dsinv.ru - - name: REDIS_HOST - value: redis-service.issues.svc.cluster.local - - name: DATABASE_HOST - value: postgres-service.issues.svc.cluster.local - - name: DATABASE_PORT - value: '5432' - - name: DATABASE_NAME - value: issues - - name: USE_NOTIFICATIONS - value: 'True' - - name: API_ADDRESS - value: '8000' - - name: YC_S3_VERIFY - value: 'False' - - name: ENVIRONMENT - value: production - - name: AERO_HOST - value: https://sarex.dsinv.ru - - name: BASE_AERO_URL - value: http://backend.django.svc.cluster.local:8000 - - name: BASE_AUTH_URL - value: https://sarex.dsinv.ru - - name: WORKFLOWS_HOST - value: http://workflows-service.workflow.svc.cluster.local:8000 - - name: WORKFLOWS_URL - value: https://sarex.dsinv.ru - - name: RESOURCES_API_HOST - value: http://resources-service.resources.svc.cluster.local:8000 - - name: EAV_HOST - value: http://eav-service.eav.svc.cluster.local:8000 - - name: SAREX_API - value: http://backend.django.svc.cluster.local:8000 + values: + services: + celery: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_31aef17b + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: AERO_HOST + value: + _default: "https://sarex.dsinv.ru" + + - name: BASE_AERO_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: BASE_AUTH_URL + value: + _default: "https://sarex.dsinv.ru" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "https://sarex.dsinv.ru" + + - name: RESOURCES_API_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: SAREX_API + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "sarex" + + - name: ENABLE_MAILGUN + value: + _default: "False" + + - name: SMTP_HOST + value: + _default: "relay.dsinv.ru" + + - name: SMTP_PORT + value: + _default: "25" + + - name: EMAIL_FROM + value: + _default: "sarex@dsinv.ru" + + - name: REDIS_HOST + value: + _default: "redis-service.issues.svc.cluster.local" + + - name: DATABASE_HOST + value: + _default: "postgres-service.issues.svc.cluster.local" + + - name: DATABASE_PORT + value: + _default: "5432" + + - name: DATABASE_NAME + value: + _default: "issues" + + - name: USE_NOTIFICATIONS + value: + _default: "True" + + - name: YC_S3_VERIFY + value: + _default: "False" diff --git a/apps/issues/dsinv/frontend.yaml b/apps/issues/dsinv/frontend.yaml index c255a44..5fa4785 100644 --- a/apps/issues/dsinv/frontend.yaml +++ b/apps/issues/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: issues spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:24ab8d2b + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:24ab8d2b diff --git a/apps/issues/dsinv/kustomization.yaml b/apps/issues/dsinv/kustomization.yaml index 951dc84..ec32d79 100644 --- a/apps/issues/dsinv/kustomization.yaml +++ b/apps/issues/dsinv/kustomization.yaml @@ -7,13 +7,13 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend - path: celery.yaml target: - kind: Deployment + kind: HelmRelease name: celery - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend diff --git a/apps/mapper/base/backend.yaml b/apps/mapper/base/backend.yaml index b5bf4d2..84c779e 100644 --- a/apps/mapper/base/backend.yaml +++ b/apps/mapper/base/backend.yaml @@ -147,14 +147,14 @@ spec: {{- with secret "secrets/data/vault/common/django_auth" -}} MAPPER_DJANGO_TOKEN={{ index .Data.data "key" }} {{- end -}} - vault.hashicorp.com/agent-inject-secret-mapper-db: secrets/data/postgresql/apps/mapper + vault.hashicorp.com/agent-inject-secret-mapper-db: secrets/data/apps/mapper/postgres vault.hashicorp.com/agent-inject-template-mapper-db: |- - {{- with secret "secrets/data/postgresql/apps/mapper" -}} + {{- with secret "secrets/data/apps/mapper/postgres" -}} MAPPER_DB_USER={{ index .Data.data "username" }} MAPPER_DB_PASSWORD={{ index .Data.data "password" }} - MAPPER_DB_HOST=postgresql.mapper.svc.cluster.local - MAPPER_DB_PORT=5432 - MAPPER_DB_NAME=mapper_db + MAPPER_DB_HOST={{ index .Data.data "host" }} + MAPPER_DB_PORT={{ index .Data.data "port" }} + MAPPER_DB_NAME={{ index .Data.data "database" }} {{- end -}} vault.hashicorp.com/agent-inject-secret-mapper-rabbitmq: secrets/data/rabbitmq/apps/mapper vault.hashicorp.com/agent-inject-template-mapper-rabbitmq: |- diff --git a/apps/mapper/d8-ugmk-prod/namespace.yaml b/apps/mapper/d8-ugmk-prod/namespace.yaml index 3e969b0..ce8019c 100644 --- a/apps/mapper/d8-ugmk-prod/namespace.yaml +++ b/apps/mapper/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: mapper labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/measurements/d8-ugmk-prod/namespace.yaml b/apps/measurements/d8-ugmk-prod/namespace.yaml index c05d4e2..3067c9b 100644 --- a/apps/measurements/d8-ugmk-prod/namespace.yaml +++ b/apps/measurements/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: measurements labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/message-hub/base/deployment.yaml b/apps/message-hub/base/deployment.yaml deleted file mode 100644 index 90b3cce..0000000 --- a/apps/message-hub/base/deployment.yaml +++ /dev/null @@ -1,96 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: message-hub - namespace: message-hub - labels: - app: message-hub - service: message-hub -spec: - replicas: 1 - selector: - matchLabels: - app: message-hub - template: - metadata: - labels: - app: message-hub - service: message-hub - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: message-hub - vault.hashicorp.com/agent-inject-secret-message-hub-db: secrets/data/postgresql/apps/message-hub - vault.hashicorp.com/agent-inject-template-message-hub-db: |- - {{- with secret "secrets/data/postgresql/apps/message-hub" -}} - DB_USERNAME={{ index .Data.data "username" }} - DB_PASSWORD={{ index .Data.data "password" }} - DB_DATABASE=pm_db - DB_HOST=postgresql.pm.svc.cluster.local - DB_PORT=5432 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-message-hub-s3: secrets/data/minio/apps/message-hub - vault.hashicorp.com/agent-inject-template-message-hub-s3: |- - {{- with secret "secrets/data/minio/apps/message-hub" -}} - S3_HOST={{ index .Data.data.client "endpoint" }} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}rfi{{- end -}} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/message-hub - vault.hashicorp.com/agent-inject-template-message-hub-kafka: |- - {{- with secret "secrets/data/kafka/apps/message-hub" -}} - KAFKA_USERNAME={{ index .Data.data "username" }} - KAFKA_PASSWORD={{ index .Data.data "password" }} - KAFKA_HOST=kafka-kafka-contour-controller-headless.kafka.svc.cluster.local - KAFKA_PORT=9094 - KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} - KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} - {{- end -}} - spec: - serviceAccountName: message-hub-vault - containers: - - name: message-hub - image: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_24425472 - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/message-hub-db ] && . /vault/secrets/message-hub-db - [ -f /vault/secrets/message-hub-s3 ] && . /vault/secrets/message-hub-s3 - [ -f /vault/secrets/message-hub-kafka ] && . /vault/secrets/message-hub-kafka - set +a - exec /opt/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: WORKER_TIMEOUT - value: "60" - - name: PYTHONPATH - value: src - - name: SETTINGS_MAX_RETRIES - value: "1" - - name: SETTINGS_TOPICS - value: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}' - - name: SETTINGS_PDF_CONVERTER_HOST - value: http://export-project-service.django.svc.cluster.local:8000 - - name: SAREX_BASE_HOST - value: http://backend-service.pm.svc.cluster.local:8000 - - name: CACHE_HOST - value: redis.pm.svc.cluster.local - - name: CACHE_PORT - value: "6379" - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/message-hub/base/kustomization.yaml b/apps/message-hub/base/kustomization.yaml index 8ae7d0c..30e0638 100644 --- a/apps/message-hub/base/kustomization.yaml +++ b/apps/message-hub/base/kustomization.yaml @@ -4,6 +4,4 @@ kind: Kustomization namespace: message-hub resources: - namespace.yaml - - serviceaccount.yaml - - deployment.yaml - - service.yaml + - message-hub.yaml diff --git a/apps/message-hub/base/message-hub.yaml b/apps/message-hub/base/message-hub.yaml new file mode 100644 index 0000000..eec8a25 --- /dev/null +++ b/apps/message-hub/base/message-hub.yaml @@ -0,0 +1,183 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: message-hub + namespace: message-hub + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: message-hub-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_24425472 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: message-hub + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/message-hub-db ] && . /vault/secrets/message-hub-db + [ -f /vault/secrets/message-hub-s3 ] && . /vault/secrets/message-hub-s3 + [ -f /vault/secrets/message-hub-kafka ] && . /vault/secrets/message-hub-kafka + set +a + exec /opt/entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: message-hub-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: WORKER_TIMEOUT + value: + _default: "60" + + - name: PYTHONPATH + value: + _default: "src" + + - name: SETTINGS_MAX_RETRIES + value: + _default: "1" + + - name: SETTINGS_TOPICS + value: + _default: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}' + + - name: SETTINGS_PDF_CONVERTER_HOST + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: SAREX_BASE_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000" + + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: message-hub + vault.hashicorp.com/agent-inject-secret-message-hub-db: secrets/data/apps/message-hub/postgres + vault.hashicorp.com/agent-inject-template-message-hub-db: |- + {{- with secret "secrets/data/apps/message-hub/postgres" -}} + DB_USERNAME={{ index .Data.data "username" }} + DB_PASSWORD={{ index .Data.data "password" }} + DB_DATABASE={{ index .Data.data "database" }} + DB_HOST={{ index .Data.data "host" }} + DB_PORT={{ index .Data.data "port" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-message-hub-s3: secrets/data/minio/apps/message-hub + vault.hashicorp.com/agent-inject-template-message-hub-s3: |- + {{- with secret "secrets/data/minio/apps/message-hub" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}rfi{{- end -}} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/message-hub + vault.hashicorp.com/agent-inject-template-message-hub-kafka: |- + {{- with secret "secrets/data/kafka/apps/message-hub" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + KAFKA_HOST=kafka-kafka-contour-controller-headless.kafka.svc.cluster.local + KAFKA_PORT=9094 + KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/message-hub/base/service.yaml b/apps/message-hub/base/service.yaml deleted file mode 100644 index 087538d..0000000 --- a/apps/message-hub/base/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: message-hub-svc - namespace: message-hub -spec: - type: ClusterIP - selector: - app: message-hub - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/message-hub/base/serviceaccount.yaml b/apps/message-hub/base/serviceaccount.yaml deleted file mode 100644 index c5f9269..0000000 --- a/apps/message-hub/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: message-hub-vault - namespace: message-hub diff --git a/apps/message-hub/d8-ugmk-prod/kustomization.yaml b/apps/message-hub/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..fed75be --- /dev/null +++ b/apps/message-hub/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: message-hub diff --git a/apps/message-hub/d8-ugmk-prod/namespace.yaml b/apps/message-hub/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..8a7c4da --- /dev/null +++ b/apps/message-hub/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: message-hub + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/message-hub/dsinv/kustomization.yaml b/apps/message-hub/dsinv/kustomization.yaml index eea88a2..5c6ba46 100644 --- a/apps/message-hub/dsinv/kustomization.yaml +++ b/apps/message-hub/dsinv/kustomization.yaml @@ -7,5 +7,5 @@ resources: patches: - path: message-hub.yaml target: - kind: Deployment + kind: HelmRelease name: message-hub diff --git a/apps/message-hub/dsinv/message-hub.yaml b/apps/message-hub/dsinv/message-hub.yaml index 85723db..a7dd8e9 100644 --- a/apps/message-hub/dsinv/message-hub.yaml +++ b/apps/message-hub/dsinv/message-hub.yaml @@ -1,49 +1,90 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: message-hub namespace: message-hub spec: - template: - spec: - containers: - - name: message-hub - image: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_d11aa910 - env: - - name: WORKER_TIMEOUT - value: '60' - - name: PYTHONPATH - value: src - - name: SETTINGS_MAX_RETRIES - value: '1' - - name: SETTINGS_TOPICS - value: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod"}' - - name: PDF_CONVERTER_HOST - value: http://export-project-service.django.svc.cluster.local:8000 - - name: SAREX_BASE_HOST - value: http://backend-service.pm.svc.cluster.local:8000 - - name: PM_HOST - value: http://backend-service.pm.svc.cluster.local:8000 - - name: DB_HOST - value: postgres-service.pm.svc.cluster.local - - name: DB_PORT - value: '5432' - - name: DB_DATABASE - value: pm - - name: CACHE_HOST - value: redis.pm.svc.cluster.local - - name: CACHE_PORT - value: '6379' - - name: CACHE_SSL - value: '0' - - name: KAFKA_HOST - value: donstroi-kafka-bootstrap.kafka.svc.cluster.local - - name: KAFKA_PORT - value: '9093' - - name: KAFKA_SECURITY_PROTOCOL - value: SSL - - name: KAFKA_SASL_MECHANISM - value: PLAIN - - name: KAFKA_SSL_CAFILE - value: /usr/local/share/ca-certificates/kafka.crt + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_d11aa910 + + envs: + - name: WORKER_TIMEOUT + value: + _default: "60" + + - name: PYTHONPATH + value: + _default: "src" + + - name: SETTINGS_MAX_RETRIES + value: + _default: "1" + + - name: SETTINGS_TOPICS + value: + _default: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod"}' + + - name: SETTINGS_PDF_CONVERTER_HOST + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: SAREX_BASE_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000" + + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + - name: PDF_CONVERTER_HOST + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: PM_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000" + + - name: DB_HOST + value: + _default: "postgres-service.pm.svc.cluster.local" + + - name: DB_PORT + value: + _default: "5432" + + - name: DB_DATABASE + value: + _default: "pm" + + - name: CACHE_SSL + value: + _default: "0" + + - name: KAFKA_HOST + value: + _default: "donstroi-kafka-bootstrap.kafka.svc.cluster.local" + + - name: KAFKA_PORT + value: + _default: "9093" + + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SSL" + + - name: KAFKA_SASL_MECHANISM + value: + _default: "PLAIN" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" diff --git a/apps/pm/base/backend-deployment.yaml b/apps/pm/base/backend-deployment.yaml deleted file mode 100644 index 6c2ea97..0000000 --- a/apps/pm/base/backend-deployment.yaml +++ /dev/null @@ -1,132 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: pm - labels: - app: backend - service: api -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - service: api - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: pm - vault.hashicorp.com/agent-inject-secret-pm-db: secrets/data/postgresql/apps/pm - vault.hashicorp.com/agent-inject-template-pm-db: |- - {{- with secret "secrets/data/postgresql/apps/pm" -}} - DB_USERNAME={{ index .Data.data "username" }} - DB_PASSWORD={{ index .Data.data "password" }} - DB_DATABASE=pm_db - DB_HOST=postgresql.pm.svc.cluster.local - DB_PORT=5432 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-pm-rabbitmq: secrets/data/rabbitmq/apps/pm - vault.hashicorp.com/agent-inject-template-pm-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/pm" -}} - CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - CELERY_RABBITMQ_PORT=5672 - CELERY_RABBITMQ_USER={{ index .Data.data "username" }} - CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} - CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-pm-s3: secrets/data/minio/apps/pm - vault.hashicorp.com/agent-inject-template-pm-s3: |- - {{- with secret "secrets/data/minio/apps/pm" -}} - S3_HOST={{ index .Data.data.client "endpoint" }} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}pm-bucket{{- end -}} - S3_VERIFY=False - {{- end -}} - spec: - serviceAccountName: pm-vault - containers: - - name: api - image: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_0843a55d - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db - [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq - [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 - set +a - exec /opt/sarex/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: USERS_INTERNAL_HOST - value: http://backend-service.sarex.svc.cluster.local:8000 - - name: CELERY_REDIS_HOST - value: redis.pm.svc.cluster.local - - name: RESOURCES_INTERNAL_HOST - value: http://sarex-resources-service.resources - - name: EAV_HOST - value: http://eav-service.eav - - name: EAV_API_PREFIX - value: /api/v0 - - name: EAV_API_PREFIX_V1 - value: /api/v1 - - name: TRACING_INSECURE - value: "False" - - name: SERVER_ENABLE_SYNC_RESOURCES - value: "True" - - name: SERVER_DELETED_TASK_MAX_AGE_DAYS - value: "1" - - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR - value: "17" - - name: LANG - value: C.UTF-8 - - name: LC_ALL - value: C.UTF-8 - - name: PYTHONUTF8 - value: "1" - - name: CACHE_SSL - value: "False" - - name: CACHE_SSL_CA_CERTS - value: "" - - name: CACHE_ENABLE - value: "False" - - name: CLICKHOUSE_ENABLE - value: "False" - - name: KAFKA_ENABLE - value: "False" - - name: AUTH_PUBLIC_TOKEN_URL - value: "https://lk.sarex.io/api/token/public/" - - name: SERVER_HOST - value: "https://lk.sarex.io" - - name: SERVER_API_HOST - value: "https://api.sarex.io" - - name: SERVER_DEBUG - value: "False" - - name: SERVER_ALLOWED_HOSTS - value: '["*"]' - - name: SERVER_USE_OTEL - value: "False" - - name: SERVER_VERIFY_SSL - value: "False" - - name: SERVER_LOG_LEVEL - value: "INFO" - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/pm/base/backend-service.yaml b/apps/pm/base/backend-service.yaml deleted file mode 100644 index 55abdc2..0000000 --- a/apps/pm/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: pm -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 8000 - targetPort: 8000 - protocol: TCP diff --git a/apps/pm/base/backend.yaml b/apps/pm/base/backend.yaml new file mode 100644 index 0000000..1a98551 --- /dev/null +++ b/apps/pm/base/backend.yaml @@ -0,0 +1,256 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: pm-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_a889f6a3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db + [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq + [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 + set +a + python manage.py migrate + exec /opt/sarex/entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + - name: CACHE_ENABLE + value: + _default: "False" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "False" + + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://sarex.uralmine.com/api/token/public/" + + - name: SERVER_HOST + value: + _default: "https://sarex.uralmine.com" + + - name: SERVER_API_HOST + value: + _default: "https://sarex.uralmine.com" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: pm + vault.hashicorp.com/agent-inject-secret-pm-db: secrets/data/apps/pm/postgres + vault.hashicorp.com/agent-inject-template-pm-db: |- + {{- with secret "secrets/data/apps/pm/postgres" -}} + DB_USERNAME={{ index .Data.data "username" }} + DB_PASSWORD={{ index .Data.data "password" }} + DB_DATABASE={{ index .Data.data "database" }} + DB_HOST={{ index .Data.data "host" }} + DB_PORT={{ index .Data.data "port" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-rabbitmq: secrets/data/rabbitmq/apps/pm + vault.hashicorp.com/agent-inject-template-pm-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/pm" -}} + CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + CELERY_RABBITMQ_PORT=5672 + CELERY_RABBITMQ_USER={{ index .Data.data "username" }} + CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-s3: secrets/data/minio/apps/pm + vault.hashicorp.com/agent-inject-template-pm-s3: |- + {{- with secret "secrets/data/minio/apps/pm" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}pm-bucket{{- end -}} + S3_VERIFY=False + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/pm/base/celery-deployment.yaml b/apps/pm/base/celery-deployment.yaml deleted file mode 100644 index e063065..0000000 --- a/apps/pm/base/celery-deployment.yaml +++ /dev/null @@ -1,131 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: celery - namespace: pm - labels: - app: celery - service: celery -spec: - replicas: 1 - selector: - matchLabels: - app: celery - template: - metadata: - labels: - app: celery - service: celery - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: pm - vault.hashicorp.com/agent-inject-secret-pm-db: secrets/data/postgresql/apps/pm - vault.hashicorp.com/agent-inject-template-pm-db: |- - {{- with secret "secrets/data/postgresql/apps/pm" -}} - DB_USERNAME={{ index .Data.data "username" }} - DB_PASSWORD={{ index .Data.data "password" }} - DB_DATABASE=pm_db - DB_HOST=postgresql.pm.svc.cluster.local - DB_PORT=5432 - {{- end -}} - vault.hashicorp.com/agent-inject-secret-pm-rabbitmq: secrets/data/rabbitmq/apps/pm - vault.hashicorp.com/agent-inject-template-pm-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/pm" -}} - CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local - CELERY_RABBITMQ_PORT=5672 - CELERY_RABBITMQ_USER={{ index .Data.data "username" }} - CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} - CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-pm-s3: secrets/data/minio/apps/pm - vault.hashicorp.com/agent-inject-template-pm-s3: |- - {{- with secret "secrets/data/minio/apps/pm" -}} - S3_HOST={{ index .Data.data.client "endpoint" }} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}pm-bucket{{- end -}} - S3_VERIFY=False - {{- end -}} - spec: - serviceAccountName: pm-vault - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_0843a55d - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db - [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq - [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 - set +a - exec celery -A config worker -B -l info -E -Q pm -n default_worker.%h --concurrency=2 - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: USERS_INTERNAL_HOST - value: http://backend-service.sarex.svc.cluster.local:8000 - - name: CELERY_REDIS_HOST - value: redis.pm.svc.cluster.local - - name: RESOURCES_INTERNAL_HOST - value: http://sarex-resources-service.resources - - name: EAV_HOST - value: http://eav-service.eav - - name: EAV_API_PREFIX - value: /api/v0 - - name: EAV_API_PREFIX_V1 - value: /api/v1 - - name: TRACING_INSECURE - value: "False" - - name: SERVER_ENABLE_SYNC_RESOURCES - value: "True" - - name: SERVER_DELETED_TASK_MAX_AGE_DAYS - value: "1" - - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR - value: "17" - - name: LANG - value: C.UTF-8 - - name: LC_ALL - value: C.UTF-8 - - name: PYTHONUTF8 - value: "1" - - name: CACHE_SSL - value: "False" - - name: CACHE_SSL_CA_CERTS - value: "" - - name: CACHE_ENABLE - value: "False" - - name: CLICKHOUSE_ENABLE - value: "False" - - name: KAFKA_ENABLE - value: "False" - - name: AUTH_PUBLIC_TOKEN_URL - value: "https://lk.sarex.io/api/token/public/" - - name: SERVER_HOST - value: "https://lk.sarex.io" - - name: SERVER_API_HOST - value: "https://api.sarex.io" - - name: SERVER_DEBUG - value: "False" - - name: SERVER_ALLOWED_HOSTS - value: '["*"]' - - name: SERVER_USE_OTEL - value: "False" - - name: SERVER_VERIFY_SSL - value: "False" - - name: SERVER_LOG_LEVEL - value: "INFO" - resources: - requests: - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/pm/base/celery.yaml b/apps/pm/base/celery.yaml new file mode 100644 index 0000000..b04f8a7 --- /dev/null +++ b/apps/pm/base/celery.yaml @@ -0,0 +1,238 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + celery: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: pm-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_a889f6a3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db + [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq + [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 + set +a + exec celery -A config worker -B -l info -E -Q pm -n default_worker.%h --concurrency=2 + + resources: + requests: + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend-service.sarex.svc.cluster.local:8000" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://sarex-resources-service.resources" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + - name: CACHE_ENABLE + value: + _default: "False" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "False" + + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://lk.sarex.io/api/token/public/" + + - name: SERVER_HOST + value: + _default: "https://lk.sarex.io" + + - name: SERVER_API_HOST + value: + _default: "https://api.sarex.io" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: pm + vault.hashicorp.com/agent-inject-secret-pm-db: secrets/data/apps/pm/postgres + vault.hashicorp.com/agent-inject-template-pm-db: |- + {{- with secret "secrets/data/apps/pm/postgres" -}} + DB_USERNAME={{ index .Data.data "username" }} + DB_PASSWORD={{ index .Data.data "password" }} + DB_DATABASE={{ index .Data.data "database" }} + DB_HOST={{ index .Data.data "host" }} + DB_PORT={{ index .Data.data "port" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-rabbitmq: secrets/data/rabbitmq/apps/pm + vault.hashicorp.com/agent-inject-template-pm-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/pm" -}} + CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local + CELERY_RABBITMQ_PORT=5672 + CELERY_RABBITMQ_USER={{ index .Data.data "username" }} + CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }} + CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-s3: secrets/data/minio/apps/pm + vault.hashicorp.com/agent-inject-template-pm-s3: |- + {{- with secret "secrets/data/minio/apps/pm" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}pm-bucket{{- end -}} + S3_VERIFY=False + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/pm/base/frontend.yaml b/apps/pm/base/frontend.yaml new file mode 100644 index 0000000..d52e7d9 --- /dev/null +++ b/apps/pm/base/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_e5c3d387 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/pm/base/kustomization.yaml b/apps/pm/base/kustomization.yaml index d742c1d..aa00f14 100644 --- a/apps/pm/base/kustomization.yaml +++ b/apps/pm/base/kustomization.yaml @@ -4,8 +4,7 @@ kind: Kustomization namespace: pm resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - backend-service.yaml - - celery-deployment.yaml + - backend.yaml + - celery.yaml + - frontend.yaml - backend-configmap.yaml diff --git a/apps/pm/base/serviceaccount.yaml b/apps/pm/base/serviceaccount.yaml deleted file mode 100644 index e6e28dc..0000000 --- a/apps/pm/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: pm-vault - namespace: pm diff --git a/apps/pm/d8-ugmk-prod/kustomization.yaml b/apps/pm/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..8c72385 --- /dev/null +++ b/apps/pm/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: pm diff --git a/apps/pm/d8-ugmk-prod/namespace.yaml b/apps/pm/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..4c42f10 --- /dev/null +++ b/apps/pm/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: pm + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/pm/dsinv/backend.yaml b/apps/pm/dsinv/backend.yaml index fa93fa6..d96d44e 100644 --- a/apps/pm/dsinv/backend.yaml +++ b/apps/pm/dsinv/backend.yaml @@ -1,29 +1,118 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: pm spec: - template: - spec: - containers: - - name: api - image: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_3d7e8ea6 - env: - - name: LANG - value: C.UTF-8 - - name: LC_ALL - value: C.UTF-8 - - name: PYTHONUTF8 - value: '1' - - name: USERS_INTERNAL_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: RESOURCES_INTERNAL_HOST - value: http://resources-service.resources.svc.cluster.local:8000 - - name: EAV_HOST - value: http://eav-service.eav.svc.cluster.local:8000 - - name: EAV_API_PREFIX - value: /api/v0 - - name: EAV_API_PREFIX_V1 - value: /api/v1 + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_3d7e8ea6 + + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + - name: CACHE_ENABLE + value: + _default: "False" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "False" + + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://lk.sarex.io/api/token/public/" + + - name: SERVER_HOST + value: + _default: "https://lk.sarex.io" + + - name: SERVER_API_HOST + value: + _default: "https://api.sarex.io" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" diff --git a/apps/pm/dsinv/celery.yaml b/apps/pm/dsinv/celery.yaml index 1f50c91..c4a3b17 100644 --- a/apps/pm/dsinv/celery.yaml +++ b/apps/pm/dsinv/celery.yaml @@ -1,29 +1,118 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: celery namespace: pm spec: - template: - spec: - containers: - - name: celery - image: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_2becf38c - env: - - name: USERS_INTERNAL_HOST - value: http://backend.django.svc.cluster.local:8000 - - name: RESOURCES_INTERNAL_HOST - value: http://resources-service.resources.svc.cluster.local:8000 - - name: EAV_HOST - value: http://eav-service.eav.svc.cluster.local:8000 - - name: EAV_API_PREFIX - value: /api/v0 - - name: EAV_API_PREFIX_V1 - value: /api/v1 - - name: LANG - value: C.UTF-8 - - name: LC_ALL - value: C.UTF-8 - - name: PYTHONUTF8 - value: '1' + values: + services: + celery: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_2becf38c + + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + - name: CACHE_ENABLE + value: + _default: "False" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "False" + + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://lk.sarex.io/api/token/public/" + + - name: SERVER_HOST + value: + _default: "https://lk.sarex.io" + + - name: SERVER_API_HOST + value: + _default: "https://api.sarex.io" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" diff --git a/apps/pm/dsinv/kustomization.yaml b/apps/pm/dsinv/kustomization.yaml index 65dd5ff..825915b 100644 --- a/apps/pm/dsinv/kustomization.yaml +++ b/apps/pm/dsinv/kustomization.yaml @@ -8,9 +8,9 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend - path: celery.yaml target: - kind: Deployment + kind: HelmRelease name: celery diff --git a/apps/prescriptions/d8-ugmk-prod/namespace.yaml b/apps/prescriptions/d8-ugmk-prod/namespace.yaml index b591ad0..1ecd7b1 100644 --- a/apps/prescriptions/d8-ugmk-prod/namespace.yaml +++ b/apps/prescriptions/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: prescriptions labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/processing/base/api.yaml b/apps/processing/base/api.yaml index fbfd678..88226b9 100644 --- a/apps/processing/base/api.yaml +++ b/apps/processing/base/api.yaml @@ -139,14 +139,14 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: processing - vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/postgresql/apps/processing + vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/apps/processing/postgres vault.hashicorp.com/agent-inject-template-processing-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/processing" -}} - POSTGRES_ADDRESS=postgresql.processing.svc.cluster.local - POSTGRES_PORT=5432 + {{- with secret "secrets/data/apps/processing/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} POSTGRES_USER={{ index .Data.data "username" }} POSTGRES_PASSWORD={{ index .Data.data "password" }} - POSTGRES_DB=workflow_db + POSTGRES_DB={{ index .Data.data "database" }} {{- end -}} vault.hashicorp.com/agent-inject-secret-processing-jwt-public: secrets/data/vault/common/rsa_keys vault.hashicorp.com/agent-inject-template-processing-jwt-public: |- diff --git a/apps/processing/base/engine-low.yaml b/apps/processing/base/engine-low.yaml index 51d410b..eaed6b5 100644 --- a/apps/processing/base/engine-low.yaml +++ b/apps/processing/base/engine-low.yaml @@ -399,14 +399,14 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: processing - vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/postgresql/apps/processing + vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/apps/processing/postgres vault.hashicorp.com/agent-inject-template-processing-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/processing" -}} - POSTGRES_ADDRESS=postgresql.processing.svc.cluster.local - POSTGRES_PORT=5432 + {{- with secret "secrets/data/apps/processing/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} POSTGRES_USER={{ index .Data.data "username" }} POSTGRES_PASSWORD={{ index .Data.data "password" }} - POSTGRES_DB=workflow_db + POSTGRES_DB={{ index .Data.data "database" }} {{- end -}} vault.hashicorp.com/agent-inject-secret-processing-rabbitmq: secrets/data/rabbitmq/apps/processing vault.hashicorp.com/agent-inject-template-processing-rabbitmq: |- diff --git a/apps/processing/base/engine.yaml b/apps/processing/base/engine.yaml index 5916e90..049437b 100644 --- a/apps/processing/base/engine.yaml +++ b/apps/processing/base/engine.yaml @@ -391,14 +391,14 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: processing - vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/postgresql/apps/processing + vault.hashicorp.com/agent-inject-secret-processing-postgresql: secrets/data/apps/processing/postgres vault.hashicorp.com/agent-inject-template-processing-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/processing" -}} - POSTGRES_ADDRESS=postgresql.processing.svc.cluster.local - POSTGRES_PORT=5432 + {{- with secret "secrets/data/apps/processing/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} POSTGRES_USER={{ index .Data.data "username" }} POSTGRES_PASSWORD={{ index .Data.data "password" }} - POSTGRES_DB=workflow_db + POSTGRES_DB={{ index .Data.data "database" }} {{- end -}} vault.hashicorp.com/agent-inject-secret-processing-rabbitmq: secrets/data/rabbitmq/apps/processing vault.hashicorp.com/agent-inject-template-processing-rabbitmq: |- diff --git a/apps/processing/base/kustomization.yaml b/apps/processing/base/kustomization.yaml index b41abbe..8619375 100644 --- a/apps/processing/base/kustomization.yaml +++ b/apps/processing/base/kustomization.yaml @@ -4,6 +4,7 @@ kind: Kustomization namespace: processing resources: - namespace.yaml + - rbac.yaml - api.yaml - engine-low.yaml - engine.yaml diff --git a/apps/processing/base/rbac.yaml b/apps/processing/base/rbac.yaml new file mode 100644 index 0000000..32eaca5 --- /dev/null +++ b/apps/processing/base/rbac.yaml @@ -0,0 +1,41 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: processing-jobs + namespace: processing +rules: + - apiGroups: + - batch + resources: + - jobs + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: processing-jobs + namespace: processing +subjects: + - kind: ServiceAccount + name: processing-vault + namespace: processing +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: processing-jobs diff --git a/apps/processing/d8-ugmk-prod/namespace.yaml b/apps/processing/d8-ugmk-prod/namespace.yaml index f2b167e..85f81c0 100644 --- a/apps/processing/d8-ugmk-prod/namespace.yaml +++ b/apps/processing/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: processing labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/projects/d8-ugmk-prod/namespace.yaml b/apps/projects/d8-ugmk-prod/namespace.yaml index 8765f8f..2d9d84c 100644 --- a/apps/projects/d8-ugmk-prod/namespace.yaml +++ b/apps/projects/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: projects labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/remarks/d8-ugmk-prod/namespace.yaml b/apps/remarks/d8-ugmk-prod/namespace.yaml index 8060131..a978585 100644 --- a/apps/remarks/d8-ugmk-prod/namespace.yaml +++ b/apps/remarks/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: remarks labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/resources/base/backend-deployment.yaml b/apps/resources/base/backend-deployment.yaml index 58a7475..13923c6 100644 --- a/apps/resources/base/backend-deployment.yaml +++ b/apps/resources/base/backend-deployment.yaml @@ -21,12 +21,12 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: resources - vault.hashicorp.com/agent-inject-secret-resources-db: secrets/data/postgresql/apps/resources + vault.hashicorp.com/agent-inject-secret-resources-db: secrets/data/apps/resources/postgres vault.hashicorp.com/agent-inject-template-resources-db: |- - {{- with secret "secrets/data/postgresql/apps/resources" -}} - DATABASE_HOST=postgresql.resources.svc.cluster.local - DATABASE_PORT=5432 - DATABASE_NAME=resources_db + {{- with secret "secrets/data/apps/resources/postgres" -}} + DATABASE_HOST={{ index .Data.data "host" }} + DATABASE_PORT={{ index .Data.data "port" }} + DATABASE_NAME={{ index .Data.data "database" }} DATABASE_USER={{ index .Data.data "username" }} DATABASE_PASSWORD={{ index .Data.data "password" }} {{- end -}} diff --git a/apps/reviews/d8-ugmk-prod/namespace.yaml b/apps/reviews/d8-ugmk-prod/namespace.yaml index 721a28c..469b77a 100644 --- a/apps/reviews/d8-ugmk-prod/namespace.yaml +++ b/apps/reviews/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: reviews labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/rfi/base/celery.yaml b/apps/rfi/base/celery.yaml index fae9018..4b42a33 100644 --- a/apps/rfi/base/celery.yaml +++ b/apps/rfi/base/celery.yaml @@ -90,7 +90,7 @@ spec: _default: https://lk.srx.wb.ru:30443/rfi - name: SAREX_BACKEND_URL value: - _default: http://backend-svc.django.svc.cluster.local + _default: http://backend-svc.django.svc.cluster.local:80 - name: EAV_URL value: _default: http://backend-svc.eav.svc.cluster.local:80 diff --git a/apps/stamp-verification/d8-ugmk-prod/namespace.yaml b/apps/stamp-verification/d8-ugmk-prod/namespace.yaml index c6c157d..cd1142d 100644 --- a/apps/stamp-verification/d8-ugmk-prod/namespace.yaml +++ b/apps/stamp-verification/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: stamp-verification labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/subscriptions/base/backend-deployment.yaml b/apps/subscriptions/base/backend-deployment.yaml index b9e881d..896cc93 100644 --- a/apps/subscriptions/base/backend-deployment.yaml +++ b/apps/subscriptions/base/backend-deployment.yaml @@ -22,12 +22,12 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: subscriptions - vault.hashicorp.com/agent-inject-secret-subscriptions-postgresql: secrets/data/postgresql/apps/subscriptions + vault.hashicorp.com/agent-inject-secret-subscriptions-postgresql: secrets/data/apps/subscriptions/postgres vault.hashicorp.com/agent-inject-template-subscriptions-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/subscriptions" -}} - DATABASE_HOST=postgresql.subscriptions.svc.cluster.local - DATABASE_PORT=5432 - DATABASE_NAME=subscriptions_db + {{- with secret "secrets/data/apps/subscriptions/postgres" -}} + DATABASE_HOST={{ index .Data.data "host" }} + DATABASE_PORT={{ index .Data.data "port" }} + DATABASE_NAME={{ index .Data.data "database" }} DATABASE_USER={{ index .Data.data "username" }} DATABASE_PASSWORD={{ index .Data.data "password" }} {{- end -}} diff --git a/apps/system-log/base/api.yaml b/apps/system-log/base/api.yaml index 2e8c0f1..e82e541 100644 --- a/apps/system-log/base/api.yaml +++ b/apps/system-log/base/api.yaml @@ -179,12 +179,12 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: system-log - vault.hashicorp.com/agent-inject-secret-system-log-postgresql: secrets/data/postgresql/apps/system-log + vault.hashicorp.com/agent-inject-secret-system-log-postgresql: secrets/data/apps/system-log/postgres vault.hashicorp.com/agent-inject-template-system-log-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/system-log" -}} - POSTGRES_ADDRESS=postgresql.system-log.svc.cluster.local - POSTGRES_PORT=5432 - POSTGRES_DB=system_log_db + {{- with secret "secrets/data/apps/system-log/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} POSTGRES_USER={{ index .Data.data "username" }} POSTGRES_PASSWORD={{ index .Data.data "password" }} {{- end -}} diff --git a/apps/system-log/base/worker.yaml b/apps/system-log/base/worker.yaml index a1c32e7..ae2173d 100644 --- a/apps/system-log/base/worker.yaml +++ b/apps/system-log/base/worker.yaml @@ -155,12 +155,12 @@ spec: vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/auth-path: auth/kubernetes vault.hashicorp.com/role: system-log - vault.hashicorp.com/agent-inject-secret-system-log-postgresql: secrets/data/postgresql/apps/system-log + vault.hashicorp.com/agent-inject-secret-system-log-postgresql: secrets/data/apps/system-log/postgres vault.hashicorp.com/agent-inject-template-system-log-postgresql: |- - {{- with secret "secrets/data/postgresql/apps/system-log" -}} - POSTGRES_ADDRESS=postgresql.system-log.svc.cluster.local - POSTGRES_PORT=5432 - POSTGRES_DB=system_log_db + {{- with secret "secrets/data/apps/system-log/postgres" -}} + POSTGRES_ADDRESS={{ index .Data.data "host" }} + POSTGRES_PORT={{ index .Data.data "port" }} + POSTGRES_DB={{ index .Data.data "database" }} POSTGRES_USER={{ index .Data.data "username" }} POSTGRES_PASSWORD={{ index .Data.data "password" }} {{- end -}} diff --git a/apps/system-log/d8-ugmk-prod/namespace.yaml b/apps/system-log/d8-ugmk-prod/namespace.yaml index 58875f5..4d234bb 100644 --- a/apps/system-log/d8-ugmk-prod/namespace.yaml +++ b/apps/system-log/d8-ugmk-prod/namespace.yaml @@ -4,5 +4,5 @@ kind: Namespace metadata: name: system-log labels: - istio-injection: disabled + istio-injection: enabled security.deckhouse.io/pod-policy: privileged diff --git a/apps/transmittal/base/backend-deployment.yaml b/apps/transmittal/base/backend-deployment.yaml deleted file mode 100644 index f03dec5..0000000 --- a/apps/transmittal/base/backend-deployment.yaml +++ /dev/null @@ -1,211 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: backend - namespace: transmittal - labels: - app: backend - service: backend -spec: - replicas: 1 - selector: - matchLabels: - app: backend - template: - metadata: - labels: - app: backend - service: backend - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: transmittal - vault.hashicorp.com/agent-inject-secret-transmittal-db: secrets/data/postgresql/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-db: |- - {{- with secret "secrets/data/postgresql/apps/transmittal" -}} - TRANSMITTAL_SERVICE_DATABASE__USER={{ index .Data.data "username" }} - TRANSMITTAL_SERVICE_DATABASE__PASSWORD={{ index .Data.data "password" }} - TRANSMITTAL_SERVICE_DATABASE__HOST=postgresql.transmittal.svc.cluster.local - TRANSMITTAL_SERVICE_DATABASE__PORT=5432 - TRANSMITTAL_SERVICE_DATABASE__NAME=transmittal_db - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-rabbitmq: secrets/data/rabbitmq/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/transmittal" -}} - TRANSMITTAL_SERVICE_RABBITMQ__USER={{ index .Data.data "username" }} - TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD={{ index .Data.data "password" }} - TRANSMITTAL_SERVICE_RABBITMQ__VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-s3: secrets/data/minio/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-s3: |- - {{- with secret "secrets/data/minio/apps/transmittal" -}} - TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY={{ index .Data.data "access_key" }} - TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY={{ index .Data.data "secret_key" }} - {{- $buckets := index .Data.data "buckets" }} - TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}transmittal-storage{{- end -}} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-transmittal-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED={{ index .Data.data "key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-public-key: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-transmittal-public-key: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY={{ printf "%q" (index .Data.data "public_key") }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-mailgun: secrets/data/vault/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-mailgun: |- - {{- with secret "secrets/data/vault/apps/transmittal" -}} - TRANSMITTAL_SERVICE_MAILGUN__API_KEY={{ index .Data.data "TRANSMITTAL_SERVICE_MAILGUN__API_KEY" }} - {{- end -}} - spec: - serviceAccountName: transmittal-vault - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/transmittal-db ] && . /vault/secrets/transmittal-db - [ -f /vault/secrets/transmittal-rabbitmq ] && . /vault/secrets/transmittal-rabbitmq - [ -f /vault/secrets/transmittal-s3 ] && . /vault/secrets/transmittal-s3 - [ -f /vault/secrets/transmittal-django-auth ] && . /vault/secrets/transmittal-django-auth - [ -f /vault/secrets/transmittal-public-key ] && . /vault/secrets/transmittal-public-key - [ -f /vault/secrets/transmittal-mailgun ] && . /vault/secrets/transmittal-mailgun - set +a - exec scripts/entrypoint.sh - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: TRANSMITTAL_SERVICE_APP__NAME - value: Transmittal Service - - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL - value: ERROR - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL - value: http://backend-svc.flows.svc.cluster.local:80 - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT - value: "30" - - name: TRANSMITTAL_SERVICE_APP__HOST - value: https://sarex.contour.infra.sarex.tech/transmittal - - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT - value: prod - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS - value: "true" - - name: TRANSMITTAL_SERVICE_UVICORN__HOST - value: 0.0.0.0 - - name: TRANSMITTAL_SERVICE_UVICORN__PORT - value: "8000" - - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD - value: "false" - - name: TRANSMITTAL_SERVICE_OTEL__ENABLE - value: "false" - - name: TRANSMITTAL_SERVICE_OTEL__HOST - value: http://signoz-otel-collector-external.signoz.svc.cluster.local:4317 - - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME - value: backend.transmittals-prod - - name: TRANSMITTAL_SERVICE_OTEL__INSECURE - value: "false" - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE - value: verify-full - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH - value: /opt/.postgresql/root.crt - - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL - value: info - - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS - value: "2" - - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH - - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL - value: "false" - - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST - value: rabbitmq.rabbitmq.svc.cluster.local - - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT - value: "5672" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL - value: http://backend-svc.django.svc.cluster.local:80 - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL - value: http://backend-svc.resources.svc.cluster.local:80 - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL - value: http://documentations-api.documentations.svc.cluster.local:8080 - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT - value: "10" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME - value: ru-central1 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY - value: "true" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT - value: minio.minio.svc.cluster.local:9000 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL - value: "false" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL - value: http://export-project-service.django.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL - value: http://marks-service.documentations.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL - value: https://api.mailgun.net/v3/mg.sarex.io - - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL - value: hello@wb.io - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/transmittal/base/backend-service.yaml b/apps/transmittal/base/backend-service.yaml deleted file mode 100644 index 47f7a8d..0000000 --- a/apps/transmittal/base/backend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: backend-svc - namespace: transmittal -spec: - type: ClusterIP - selector: - app: backend - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP diff --git a/apps/transmittal/base/backend.yaml b/apps/transmittal/base/backend.yaml new file mode 100644 index 0000000..fce07eb --- /dev/null +++ b/apps/transmittal/base/backend.yaml @@ -0,0 +1,401 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: transmittal + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: transmittal-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/transmittal-db ] && . /vault/secrets/transmittal-db + [ -f /vault/secrets/transmittal-rabbitmq ] && . /vault/secrets/transmittal-rabbitmq + [ -f /vault/secrets/transmittal-s3 ] && . /vault/secrets/transmittal-s3 + [ -f /vault/secrets/transmittal-django-auth ] && . /vault/secrets/transmittal-django-auth + [ -f /vault/secrets/transmittal-public-key ] && . /vault/secrets/transmittal-public-key + [ -f /vault/secrets/transmittal-mailgun ] && . /vault/secrets/transmittal-mailgun + set +a + exec scripts/entrypoint.sh + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://sarex.contour.infra.sarex.tech/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "minio.minio.svc.cluster.local:9000" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.documentations.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: transmittal + vault.hashicorp.com/agent-inject-secret-transmittal-db: secrets/data/apps/transmittal/postgres + vault.hashicorp.com/agent-inject-template-transmittal-db: |- + {{- with secret "secrets/data/apps/transmittal/postgres" -}} + TRANSMITTAL_SERVICE_DATABASE__USER={{ index .Data.data "username" }} + TRANSMITTAL_SERVICE_DATABASE__PASSWORD={{ index .Data.data "password" }} + TRANSMITTAL_SERVICE_DATABASE__HOST={{ index .Data.data "host" }} + TRANSMITTAL_SERVICE_DATABASE__PORT={{ index .Data.data "port" }} + TRANSMITTAL_SERVICE_DATABASE__NAME={{ index .Data.data "database" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-rabbitmq: secrets/data/rabbitmq/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/transmittal" -}} + TRANSMITTAL_SERVICE_RABBITMQ__USER={{ index .Data.data "username" }} + TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD={{ index .Data.data "password" }} + TRANSMITTAL_SERVICE_RABBITMQ__VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-s3: secrets/data/minio/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-s3: |- + {{- with secret "secrets/data/minio/apps/transmittal" -}} + TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY={{ index .Data.data "access_key" }} + TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY={{ index .Data.data "secret_key" }} + {{- $buckets := index .Data.data "buckets" }} + TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}transmittal-storage{{- end -}} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-transmittal-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-public-key: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-transmittal-public-key: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY={{ printf "%q" (index .Data.data "public_key") }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-mailgun: secrets/data/vault/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-mailgun: |- + {{- with secret "secrets/data/vault/apps/transmittal" -}} + TRANSMITTAL_SERVICE_MAILGUN__API_KEY={{ index .Data.data "TRANSMITTAL_SERVICE_MAILGUN__API_KEY" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/transmittal/base/frontend-deployment.yaml b/apps/transmittal/base/frontend-deployment.yaml deleted file mode 100644 index cd346e5..0000000 --- a/apps/transmittal/base/frontend-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: frontend - namespace: transmittal - labels: - app: frontend -spec: - replicas: 1 - selector: - matchLabels: - app: frontend - template: - metadata: - labels: - app: frontend - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:wb1_dbf61443 - imagePullPolicy: IfNotPresent - ports: - - name: http - containerPort: 80 - protocol: TCP - resources: - requests: - cpu: 25m - memory: 100Mi - imagePullSecrets: - - name: regcred diff --git a/apps/transmittal/base/frontend-service.yaml b/apps/transmittal/base/frontend-service.yaml deleted file mode 100644 index 9bdeadb..0000000 --- a/apps/transmittal/base/frontend-service.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: frontend-svc - namespace: transmittal -spec: - type: ClusterIP - selector: - app: frontend - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP diff --git a/apps/transmittal/base/frontend.yaml b/apps/transmittal/base/frontend.yaml new file mode 100644 index 0000000..b886bf1 --- /dev/null +++ b/apps/transmittal/base/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: transmittal + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:wb1_dbf61443 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/transmittal/base/kustomization.yaml b/apps/transmittal/base/kustomization.yaml index 0356b25..b2993ef 100644 --- a/apps/transmittal/base/kustomization.yaml +++ b/apps/transmittal/base/kustomization.yaml @@ -4,9 +4,6 @@ kind: Kustomization namespace: transmittal resources: - namespace.yaml - - serviceaccount.yaml - - backend-deployment.yaml - - worker-deployment.yaml - - frontend-deployment.yaml - - backend-service.yaml - - frontend-service.yaml + - backend.yaml + - worker.yaml + - frontend.yaml diff --git a/apps/transmittal/base/serviceaccount.yaml b/apps/transmittal/base/serviceaccount.yaml deleted file mode 100644 index cb9d042..0000000 --- a/apps/transmittal/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: transmittal-vault - namespace: transmittal diff --git a/apps/transmittal/base/worker-deployment.yaml b/apps/transmittal/base/worker-deployment.yaml deleted file mode 100644 index ea01603..0000000 --- a/apps/transmittal/base/worker-deployment.yaml +++ /dev/null @@ -1,211 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: worker - namespace: transmittal - labels: - app: worker - service: worker -spec: - replicas: 1 - selector: - matchLabels: - app: worker - template: - metadata: - labels: - app: worker - service: worker - annotations: - traffic.sidecar.istio.io/excludeOutboundPorts: "8200" - vault.hashicorp.com/agent-init-first: "true" - vault.hashicorp.com/agent-inject: "true" - vault.hashicorp.com/agent-pre-populate-only: "true" - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: transmittal - vault.hashicorp.com/agent-inject-secret-transmittal-db: secrets/data/postgresql/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-db: |- - {{- with secret "secrets/data/postgresql/apps/transmittal" -}} - TRANSMITTAL_SERVICE_DATABASE__USER={{ index .Data.data "username" }} - TRANSMITTAL_SERVICE_DATABASE__PASSWORD={{ index .Data.data "password" }} - TRANSMITTAL_SERVICE_DATABASE__HOST=postgresql.transmittal.svc.cluster.local - TRANSMITTAL_SERVICE_DATABASE__PORT=5432 - TRANSMITTAL_SERVICE_DATABASE__NAME=transmittal_db - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-rabbitmq: secrets/data/rabbitmq/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-rabbitmq: |- - {{- with secret "secrets/data/rabbitmq/apps/transmittal" -}} - TRANSMITTAL_SERVICE_RABBITMQ__USER={{ index .Data.data "username" }} - TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD={{ index .Data.data "password" }} - TRANSMITTAL_SERVICE_RABBITMQ__VHOST={{ index .Data.data "vhost" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-s3: secrets/data/minio/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-s3: |- - {{- with secret "secrets/data/minio/apps/transmittal" -}} - TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY={{ index .Data.data "access_key" }} - TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY={{ index .Data.data "secret_key" }} - {{- $buckets := index .Data.data "buckets" }} - TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}transmittal-storage{{- end -}} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-django-auth: secrets/data/vault/common/django_auth - vault.hashicorp.com/agent-inject-template-transmittal-django-auth: |- - {{- with secret "secrets/data/vault/common/django_auth" -}} - TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED={{ index .Data.data "key" }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-public-key: secrets/data/vault/common/rsa_keys - vault.hashicorp.com/agent-inject-template-transmittal-public-key: |- - {{- with secret "secrets/data/vault/common/rsa_keys" -}} - TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY={{ printf "%q" (index .Data.data "public_key") }} - {{- end -}} - vault.hashicorp.com/agent-inject-secret-transmittal-mailgun: secrets/data/vault/apps/transmittal - vault.hashicorp.com/agent-inject-template-transmittal-mailgun: |- - {{- with secret "secrets/data/vault/apps/transmittal" -}} - TRANSMITTAL_SERVICE_MAILGUN__API_KEY={{ index .Data.data "TRANSMITTAL_SERVICE_MAILGUN__API_KEY" }} - {{- end -}} - spec: - serviceAccountName: transmittal-vault - containers: - - name: worker - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae - imagePullPolicy: IfNotPresent - command: ["/bin/bash", "-ec"] - args: - - | - set -a - [ -f /vault/secrets/transmittal-db ] && . /vault/secrets/transmittal-db - [ -f /vault/secrets/transmittal-rabbitmq ] && . /vault/secrets/transmittal-rabbitmq - [ -f /vault/secrets/transmittal-s3 ] && . /vault/secrets/transmittal-s3 - [ -f /vault/secrets/transmittal-django-auth ] && . /vault/secrets/transmittal-django-auth - [ -f /vault/secrets/transmittal-public-key ] && . /vault/secrets/transmittal-public-key - [ -f /vault/secrets/transmittal-mailgun ] && . /vault/secrets/transmittal-mailgun - set +a - exec taskiq worker --no-parse transmittal_service.tasks.broker:broker transmittal_service.tasks.transmittal.tasks transmittal_service.tasks.email.tasks - ports: - - name: http - containerPort: 8000 - protocol: TCP - env: - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL - value: http://backend-svc.flows.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT - value: "30" - - name: TRANSMITTAL_SERVICE_APP__NAME - value: Transmittal Service - - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL - value: ERROR - - name: TRANSMITTAL_SERVICE_APP__HOST - value: https://lk.srx.wb.ru:30443/transmittal - - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT - value: prod - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS - value: "true" - - name: TRANSMITTAL_SERVICE_UVICORN__HOST - value: 0.0.0.0 - - name: TRANSMITTAL_SERVICE_UVICORN__PORT - value: "8000" - - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD - value: "false" - - name: TRANSMITTAL_SERVICE_OTEL__ENABLE - value: "false" - - name: TRANSMITTAL_SERVICE_OTEL__HOST - value: http://signoz-otel-collector-external.signoz.svc.cluster.local:4317 - - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME - value: backend.transmittals-prod - - name: TRANSMITTAL_SERVICE_OTEL__INSECURE - value: "false" - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE - value: verify-full - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH - value: /opt/.postgresql/root.crt - - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL - value: info - - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS - value: "2" - - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH - - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL - value: "false" - - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST - value: rabbitmq.rabbitmq.svc.cluster.local - - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT - value: "5672" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL - value: http://backend.django.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL - value: http://resources-service.resources.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL - value: http://documentations-api.documentations.svc.cluster.local:8080 - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT - value: "10" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME - value: ru-central1 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY - value: "true" - - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT - value: minio.minio.svc.cluster.local:9000 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL - value: "false" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL - value: http://export-project-service.django.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL - value: http://marks-service.documentations.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT - value: "50" - - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL - value: https://api.mailgun.net/v3/mg.sarex.io - - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS - value: "10" - - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS - value: "5" - - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT - value: "15" - - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL - value: hello@wb.io - resources: - requests: - cpu: "25m" - memory: 128Mi - imagePullSecrets: - - name: regcred diff --git a/apps/transmittal/base/worker.yaml b/apps/transmittal/base/worker.yaml new file mode 100644 index 0000000..82ce921 --- /dev/null +++ b/apps/transmittal/base/worker.yaml @@ -0,0 +1,386 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: worker + namespace: transmittal + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + worker: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: transmittal-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: worker + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/bash", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/transmittal-db ] && . /vault/secrets/transmittal-db + [ -f /vault/secrets/transmittal-rabbitmq ] && . /vault/secrets/transmittal-rabbitmq + [ -f /vault/secrets/transmittal-s3 ] && . /vault/secrets/transmittal-s3 + [ -f /vault/secrets/transmittal-django-auth ] && . /vault/secrets/transmittal-django-auth + [ -f /vault/secrets/transmittal-public-key ] && . /vault/secrets/transmittal-public-key + [ -f /vault/secrets/transmittal-mailgun ] && . /vault/secrets/transmittal-mailgun + set +a + exec taskiq worker --no-parse transmittal_service.tasks.broker:broker transmittal_service.tasks.transmittal.tasks transmittal_service.tasks.email.tasks + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://lk.srx.wb.ru:30443/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "minio.minio.svc.cluster.local:9000" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.documentations.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "50" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: transmittal + vault.hashicorp.com/agent-inject-secret-transmittal-db: secrets/data/apps/transmittal/postgres + vault.hashicorp.com/agent-inject-template-transmittal-db: |- + {{- with secret "secrets/data/apps/transmittal/postgres" -}} + TRANSMITTAL_SERVICE_DATABASE__USER={{ index .Data.data "username" }} + TRANSMITTAL_SERVICE_DATABASE__PASSWORD={{ index .Data.data "password" }} + TRANSMITTAL_SERVICE_DATABASE__HOST={{ index .Data.data "host" }} + TRANSMITTAL_SERVICE_DATABASE__PORT={{ index .Data.data "port" }} + TRANSMITTAL_SERVICE_DATABASE__NAME={{ index .Data.data "database" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-rabbitmq: secrets/data/rabbitmq/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/transmittal" -}} + TRANSMITTAL_SERVICE_RABBITMQ__USER={{ index .Data.data "username" }} + TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD={{ index .Data.data "password" }} + TRANSMITTAL_SERVICE_RABBITMQ__VHOST={{ index .Data.data "vhost" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-s3: secrets/data/minio/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-s3: |- + {{- with secret "secrets/data/minio/apps/transmittal" -}} + TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY={{ index .Data.data "access_key" }} + TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY={{ index .Data.data "secret_key" }} + {{- $buckets := index .Data.data "buckets" }} + TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}transmittal-storage{{- end -}} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-transmittal-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED={{ index .Data.data "key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-public-key: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-transmittal-public-key: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY={{ printf "%q" (index .Data.data "public_key") }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-transmittal-mailgun: secrets/data/vault/apps/transmittal + vault.hashicorp.com/agent-inject-template-transmittal-mailgun: |- + {{- with secret "secrets/data/vault/apps/transmittal" -}} + TRANSMITTAL_SERVICE_MAILGUN__API_KEY={{ index .Data.data "TRANSMITTAL_SERVICE_MAILGUN__API_KEY" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/transmittal/brusnika-prod/backend.yaml b/apps/transmittal/brusnika-prod/backend.yaml index 766e8e5..a3d7e7f 100644 --- a/apps/transmittal/brusnika-prod/backend.yaml +++ b/apps/transmittal/brusnika-prod/backend.yaml @@ -35,7 +35,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4e0db600 pullPolicy: _default: IfNotPresent diff --git a/apps/transmittal/brusnika-prod/worker.yaml b/apps/transmittal/brusnika-prod/worker.yaml index 95e7011..22bf530 100644 --- a/apps/transmittal/brusnika-prod/worker.yaml +++ b/apps/transmittal/brusnika-prod/worker.yaml @@ -35,7 +35,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_d94cce67 + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4e0db600 pullPolicy: _default: IfNotPresent diff --git a/apps/transmittal/d8-ugmk-prod/kustomization.yaml b/apps/transmittal/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..eed0fa0 --- /dev/null +++ b/apps/transmittal/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: namespace.yaml + target: + kind: Namespace + name: transmittal diff --git a/apps/transmittal/d8-ugmk-prod/namespace.yaml b/apps/transmittal/d8-ugmk-prod/namespace.yaml new file mode 100644 index 0000000..0d819a0 --- /dev/null +++ b/apps/transmittal/d8-ugmk-prod/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: transmittal + labels: + istio-injection: enabled + security.deckhouse.io/pod-policy: privileged diff --git a/apps/transmittal/dsinv/backend.yaml b/apps/transmittal/dsinv/backend.yaml index 586d271..5e272f0 100644 --- a/apps/transmittal/dsinv/backend.yaml +++ b/apps/transmittal/dsinv/backend.yaml @@ -1,129 +1,286 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: backend namespace: transmittal spec: - template: - spec: - containers: - - name: backend - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4de0b503 - env: - - name: TRANSMITTAL_SERVICE_SMTP__ENABLE_TLS - value: 'false' - - name: TRANSMITTAL_SERVICE_SMTP__HOST - value: relay.dsinv.ru - - name: TRANSMITTAL_SERVICE_SMTP__PORT - value: '25' - - name: TRANSMITTAL_SERVICE_SMTP__EMAIL - value: sarex@dsinv.ru - - name: TRANSMITTAL_SERVICE_APP__NAME - value: Transmittal Service - - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL - value: ERROR - - name: TRANSMITTAL_SERVICE_APP__HOST - value: https://sarex.dsinv.ru/transmittal - - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT - value: prod - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS - value: '["https://lk.sarex.io", "lk.sarex.io"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS - value: 'true' - - name: TRANSMITTAL_SERVICE_UVICORN__HOST - value: 0.0.0.0 - - name: TRANSMITTAL_SERVICE_UVICORN__PORT - value: '8000' - - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD - value: 'false' - - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL - value: info - - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS - value: '2' - - name: TRANSMITTAL_SERVICE_DATABASE__HOST - value: postgres-service - - name: TRANSMITTAL_SERVICE_DATABASE__PORT - value: '5432' - - name: TRANSMITTAL_SERVICE_DATABASE__NAME - value: transmittals - - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL - value: 'false' - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE - value: verify-full - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH - value: /opt/.postgresql/root.crt - - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST - value: api - - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST - value: rabbitmq-service - - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT - value: '5672' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL - value: https://sarex.dsinv.ru - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL - value: http://sarex-resources-service.resources-prod - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL - value: http://documentations-service.documentations-prod - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT - value: '10' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME - value: ru-central1 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY - value: 'false' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET - value: transmittal-storage - - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT - value: minio-service.minio.svc.cluster.local:9000 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL - value: 'false' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL - value: http://export-project-service.django.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL - value: http://marks-service.workflow.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_OTEL__ENABLE - value: 'false' - - name: TRANSMITTAL_SERVICE_OTEL__HOST - value: http://signoz-otel-collector-external.signoz.svc.cluster.local:4317 - - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME - value: backend.transmittals-prod - - name: TRANSMITTAL_SERVICE_OTEL__INSECURE - value: 'false' + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4de0b503 + + envs: + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://sarex.dsinv.ru/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["https://lk.sarex.io", "lk.sarex.io"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq-service" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "https://sarex.dsinv.ru" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://sarex-resources-service.resources-prod" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://documentations-service.documentations-prod" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "minio-service.minio.svc.cluster.local:9000" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.workflow.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + + - name: TRANSMITTAL_SERVICE_SMTP__ENABLE_TLS + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_SMTP__HOST + value: + _default: "relay.dsinv.ru" + + - name: TRANSMITTAL_SERVICE_SMTP__PORT + value: + _default: "25" + + - name: TRANSMITTAL_SERVICE_SMTP__EMAIL + value: + _default: "sarex@dsinv.ru" + + - name: TRANSMITTAL_SERVICE_DATABASE__HOST + value: + _default: "postgres-service" + + - name: TRANSMITTAL_SERVICE_DATABASE__PORT + value: + _default: "5432" + + - name: TRANSMITTAL_SERVICE_DATABASE__NAME + value: + _default: "transmittals" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST + value: + _default: "api" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET + value: + _default: "transmittal-storage" diff --git a/apps/transmittal/dsinv/frontend.yaml b/apps/transmittal/dsinv/frontend.yaml index 2095754..bb3a1fe 100644 --- a/apps/transmittal/dsinv/frontend.yaml +++ b/apps/transmittal/dsinv/frontend.yaml @@ -1,12 +1,13 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: frontend namespace: transmittal spec: - template: - spec: - containers: - - name: frontend - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:4c915d45 + values: + services: + frontend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:4c915d45 diff --git a/apps/transmittal/dsinv/kustomization.yaml b/apps/transmittal/dsinv/kustomization.yaml index 2553b7b..a6599fa 100644 --- a/apps/transmittal/dsinv/kustomization.yaml +++ b/apps/transmittal/dsinv/kustomization.yaml @@ -7,13 +7,13 @@ resources: patches: - path: backend.yaml target: - kind: Deployment + kind: HelmRelease name: backend - path: frontend.yaml target: - kind: Deployment + kind: HelmRelease name: frontend - path: worker.yaml target: - kind: Deployment + kind: HelmRelease name: worker diff --git a/apps/transmittal/dsinv/worker.yaml b/apps/transmittal/dsinv/worker.yaml index 90a0130..467d2e2 100644 --- a/apps/transmittal/dsinv/worker.yaml +++ b/apps/transmittal/dsinv/worker.yaml @@ -1,129 +1,286 @@ --- -apiVersion: apps/v1 -kind: Deployment +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease metadata: name: worker namespace: transmittal spec: - template: - spec: - containers: - - name: worker - image: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4de0b503 - env: - - name: TRANSMITTAL_SERVICE_SMTP__ENABLE_TLS - value: 'false' - - name: TRANSMITTAL_SERVICE_SMTP__HOST - value: relay.dsinv.ru - - name: TRANSMITTAL_SERVICE_SMTP__PORT - value: '25' - - name: TRANSMITTAL_SERVICE_SMTP__EMAIL - value: sarex@dsinv.ru - - name: TRANSMITTAL_SERVICE_APP__NAME - value: Transmittal Service - - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL - value: ERROR - - name: TRANSMITTAL_SERVICE_APP__HOST - value: https://sarex.dsinv.ru/transmittal - - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT - value: prod - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS - value: '["https://lk.sarex.io", "lk.sarex.io"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS - value: '["*"]' - - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS - value: 'true' - - name: TRANSMITTAL_SERVICE_UVICORN__HOST - value: 0.0.0.0 - - name: TRANSMITTAL_SERVICE_UVICORN__PORT - value: '8000' - - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD - value: 'false' - - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL - value: info - - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS - value: '2' - - name: TRANSMITTAL_SERVICE_DATABASE__HOST - value: postgres-service - - name: TRANSMITTAL_SERVICE_DATABASE__PORT - value: '5432' - - name: TRANSMITTAL_SERVICE_DATABASE__NAME - value: transmittals - - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL - value: 'false' - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE - value: verify-full - - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH - value: /opt/.postgresql/root.crt - - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST - value: api - - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST - value: rabbitmq-service - - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT - value: '5672' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL - value: https://sarex.dsinv.ru - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL - value: http://sarex-resources-service.resources-prod - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL - value: http://documentations-service.documentations-prod - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT - value: '10' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME - value: ru-central1 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY - value: 'false' - - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET - value: transmittal-storage - - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT - value: minio-service.minio.svc.cluster.local:9000 - - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL - value: 'false' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL - value: http://export-project-service.django.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL - value: http://marks-service.workflow.svc.cluster.local:8000 - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS - value: '10' - - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS - value: '5' - - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT - value: '30' - - name: TRANSMITTAL_SERVICE_OTEL__ENABLE - value: 'false' - - name: TRANSMITTAL_SERVICE_OTEL__HOST - value: http://signoz-otel-collector-external.signoz.svc.cluster.local:4317 - - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME - value: backend.transmittals-prod - - name: TRANSMITTAL_SERVICE_OTEL__INSECURE - value: 'false' + values: + services: + worker: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_4de0b503 + + envs: + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL + value: + _default: "http://backend-svc.flows.svc.cluster.local:80" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_APP__HOST + value: + _default: "https://sarex.dsinv.ru/transmittal" + + - name: TRANSMITTAL_SERVICE_APP__ENVIRONMENT + value: + _default: "prod" + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_ORIGINS + value: + _default: '["https://lk.sarex.io", "lk.sarex.io"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_METHODS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_HEADERS + value: + _default: '["*"]' + + - name: TRANSMITTAL_SERVICE_CORS__ALLOW_CREDENTIALS + value: + _default: "true" + + - name: TRANSMITTAL_SERVICE_UVICORN__HOST + value: + _default: "0.0.0.0" + + - name: TRANSMITTAL_SERVICE_UVICORN__PORT + value: + _default: "8000" + + - name: TRANSMITTAL_SERVICE_UVICORN__ENABLE_AUTO_RELOAD + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__ENABLE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_OTEL__HOST + value: + _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317" + + - name: TRANSMITTAL_SERVICE_OTEL__SERVICE_NAME + value: + _default: "backend.transmittals-prod" + + - name: TRANSMITTAL_SERVICE_OTEL__INSECURE + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_MODE + value: + _default: "verify-full" + + - name: TRANSMITTAL_SERVICE_DATABASE__SSL_ROOT_CERT_PATH + value: + _default: "/opt/.postgresql/root.crt" + + - name: TRANSMITTAL_SERVICE_UVICORN__LOG_LEVEL + value: + _default: "info" + + - name: TRANSMITTAL_SERVICE_UVICORN__NUM_WORKERS + value: + _default: "2" + + - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + value: + _default: "" + + - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST + value: + _default: "rabbitmq-service" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PORT + value: + _default: "5672" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL + value: + _default: "https://sarex.dsinv.ru" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL + value: + _default: "http://sarex-resources-service.resources-prod" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL + value: + _default: "http://documentations-service.documentations-prod" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__CONNECT_TIMEOUT + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__READ_TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__REGION_NAME + value: + _default: "ru-central1" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__VERIFY + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT + value: + _default: "minio-service.minio.svc.cluster.local:9000" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__USE_SSL + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__BASE_URL + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_HTML_TO_PDF_CONVERTER__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_MARKINGS__BASE_URL + value: + _default: "http://marks-service.workflow.svc.cluster.local:8000" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MARKINGS__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MARKINGS__TIMEOUT + value: + _default: "30" + + - name: TRANSMITTAL_SERVICE_MAILGUN__BASE_URL + value: + _default: "https://api.mailgun.net/v3/mg.sarex.io" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_CONNECTIONS + value: + _default: "10" + + - name: TRANSMITTAL_SERVICE_MAILGUN__MAX_KEEPALIVE_CONNECTIONS + value: + _default: "5" + + - name: TRANSMITTAL_SERVICE_MAILGUN__TIMEOUT + value: + _default: "15" + + - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL + value: + _default: "hello@wb.io" + + - name: TRANSMITTAL_SERVICE_SMTP__ENABLE_TLS + value: + _default: "false" + + - name: TRANSMITTAL_SERVICE_SMTP__HOST + value: + _default: "relay.dsinv.ru" + + - name: TRANSMITTAL_SERVICE_SMTP__PORT + value: + _default: "25" + + - name: TRANSMITTAL_SERVICE_SMTP__EMAIL + value: + _default: "sarex@dsinv.ru" + + - name: TRANSMITTAL_SERVICE_DATABASE__HOST + value: + _default: "postgres-service" + + - name: TRANSMITTAL_SERVICE_DATABASE__PORT + value: + _default: "5432" + + - name: TRANSMITTAL_SERVICE_DATABASE__NAME + value: + _default: "transmittals" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST + value: + _default: "api" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET + value: + _default: "transmittal-storage" diff --git a/apps/workspaces/base/frontend.yaml b/apps/workspaces/base/frontend.yaml index 84bb622..a96f0da 100644 --- a/apps/workspaces/base/frontend.yaml +++ b/apps/workspaces/base/frontend.yaml @@ -29,7 +29,7 @@ spec: enabled: true image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_7f95769f + _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_2a4ce3fd pullPolicy: _default: IfNotPresent deployment: diff --git a/clusters/d8-ugmk-prod/istio-ingress/certificate.yaml b/clusters/d8-ugmk-prod/istio-ingress/certificate.yaml index 6fb5625..d95d380 100644 --- a/clusters/d8-ugmk-prod/istio-ingress/certificate.yaml +++ b/clusters/d8-ugmk-prod/istio-ingress/certificate.yaml @@ -4,9 +4,8 @@ metadata: name: sarex-wildcard namespace: d8-ingress-istio spec: - commonName: "*.sarex-k8s.uralmine.com" + commonName: "*.uralmine.com" dnsNames: - - "*.sarex-k8s.uralmine.com" - "*.uralmine.com" issuerRef: group: cert-manager.io diff --git a/clusters/d8-ugmk-prod/kustomization.yaml b/clusters/d8-ugmk-prod/kustomization.yaml index bede3ef..7294059 100644 --- a/clusters/d8-ugmk-prod/kustomization.yaml +++ b/clusters/d8-ugmk-prod/kustomization.yaml @@ -42,4 +42,12 @@ resources: - ../../apps/prescriptions/d8-ugmk-prod - ../../apps/mapper/d8-ugmk-prod - ../../apps/stamp-verification/d8-ugmk-prod - - ../../apps/document-link/d8-ugmk-prod \ No newline at end of file + - ../../apps/document-link/d8-ugmk-prod + - ../../apps/bim/d8-ugmk-prod + - ../../apps/cde/d8-ugmk-prod + - ../../apps/flows/d8-ugmk-prod + - ../../apps/inspections/d8-ugmk-prod + - ../../apps/issues/d8-ugmk-prod + - ../../apps/pm/d8-ugmk-prod + - ../../apps/message-hub/d8-ugmk-prod + - ../../apps/transmittal/d8-ugmk-prod \ No newline at end of file diff --git a/infrastructure/camunda/d8-ugmk-prod/camunda.yaml b/infrastructure/camunda/d8-ugmk-prod/camunda.yaml index 30d0764..2601400 100644 --- a/infrastructure/camunda/d8-ugmk-prod/camunda.yaml +++ b/infrastructure/camunda/d8-ugmk-prod/camunda.yaml @@ -164,15 +164,15 @@ spec: - name: regcred identity: auth: - publicIssuerUrl: "https://camunda-keycloak.sarex-k8s.uralmine.com/auth/realms/camunda-platform" + publicIssuerUrl: "https://sarex-camunda-keycloak.uralmine.com/auth/realms/camunda-platform" identity: - redirectUrl: "https://camunda-identity.sarex-k8s.uralmine.com" + redirectUrl: "https://sarex-camunda-identity.uralmine.com" operate: - redirectUrl: "https://camunda-operate.sarex-k8s.uralmine.com" + redirectUrl: "https://sarex-camunda-operate.uralmine.com" tasklist: - redirectUrl: "https://camunda-tasklist.sarex-k8s.uralmine.com" + redirectUrl: "https://sarex-camunda-tasklist.uralmine.com" optimize: - redirectUrl: "https://camunda-optimize.sarex-k8s.uralmine.com" + redirectUrl: "https://sarex-camunda-optimize.uralmine.com" webModeler: redirectUrl: "https://camunda-web-modeler.contour.infra.sarex.tech" console: diff --git a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml index 0d01b9d..f50c455 100644 --- a/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml +++ b/infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml @@ -14,52 +14,6 @@ spec: d8-ugmk-prod: istio: gateways: - camunda: - name: camunda-gateway - namespace: default - selector: - istio.deckhouse.io/ingress-gateway-class: istio - servers: - - hosts: - - camunda-keycloak.sarex-k8s.uralmine.com - tls: - credentialName: istio-ingress-tls - - hosts: - - camunda-identity.sarex-k8s.uralmine.com - tls: - credentialName: istio-ingress-tls - - hosts: - - camunda-operate.sarex-k8s.uralmine.com - tls: - credentialName: istio-ingress-tls - - hosts: - - camunda-tasklist.sarex-k8s.uralmine.com - tls: - credentialName: istio-ingress-tls - - hosts: - - camunda-optimize.sarex-k8s.uralmine.com - tls: - credentialName: istio-ingress-tls - rabbitmq: - name: rabbitmq-gateway - namespace: default - selector: - istio.deckhouse.io/ingress-gateway-class: istio - servers: - - hosts: - - rabbitmq.sarex-k8s.uralmine.com - tls: - credentialName: istio-ingress-tls - zitadel: - name: zitadel-gateway - namespace: default - selector: - istio.deckhouse.io/ingress-gateway-class: istio - servers: - - hosts: - - sarex-login.uralmine.com - tls: - credentialName: istio-ingress-tls platform: name: platform-gateway namespace: default @@ -68,6 +22,13 @@ spec: servers: - hosts: - sarex.uralmine.com + - sarex-login.uralmine.com + - sarex-rabbitmq.uralmine.com + - sarex-camunda-keycloak.uralmine.com + - sarex-camunda-identity.uralmine.com + - sarex-camunda-operate.uralmine.com + - sarex-camunda-tasklist.uralmine.com + - sarex-camunda-optimize.uralmine.com tls: credentialName: istio-ingress-tls virtualServices: @@ -79,15 +40,15 @@ spec: gateways: - default/platform-gateway routes: - - path: - prefix: /admin/ - service: backend-svc.django.svc.cluster.local - port: 80 + # - path: + # prefix: /admin/ + # service: backend-svc.django.svc.cluster.local + # port: 80 - - path: - prefix: /api/ - service: backend-svc.django.svc.cluster.local - port: 80 + # - path: + # prefix: /api/ + # service: backend-svc.django.svc.cluster.local + # port: 80 - path: prefix: / @@ -132,6 +93,50 @@ spec: rewrite: / service: frontend-svc.documentations.svc.cluster.local port: 80 + rfi-frontend: + name: rfi-frontend-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /rfi/static/ + rewrite: / + service: frontend-svc.rfi.svc.cluster.local + port: 80 + rfi-api: + name: rfi-api-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /rfi/api/ + rewrite: /api/ + service: backend-svc.rfi.svc.cluster.local + port: 80 + pm: + name: pm-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /pm/api/ + rewrite: /api/ + service: backend-svc.pm.svc.cluster.local + port: 8000 + - path: + prefix: /pm/ + rewrite: / + service: frontend-svc.pm.svc.cluster.local + port: 80 documentations-api: name: documentations-api-virt-service namespace: default @@ -145,6 +150,19 @@ spec: rewrite: /api/ service: backend-api-svc.documentations.svc.cluster.local port: 80 + workspaces-api: + name: workspaces-api-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /workspaces/api/ + rewrite: /api/ + service: backend-svc.workspaces.svc.cluster.local + port: 80 gateway-platform: name: pdm-virt-service namespace: default @@ -158,6 +176,197 @@ spec: rewrite: / service: pdm-svc.documentations.svc.cluster.local port: 80 + issues-api: + name: issues-api-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /issues/api/ + rewrite: /api/ + service: backend-svc.issues.svc.cluster.local + port: 80 + flows-api: + name: flows-api-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /flows/api/ + rewrite: /api/ + service: backend-svc.flows.svc.cluster.local + port: 80 + issues-frontend: + name: issues-frontend-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /issues/static/ + rewrite: / + service: frontend-svc.issues.svc.cluster.local + port: 80 + auth-frontend: + name: auth-frontend-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /auth/callback + rewrite: / + service: frontend-svc.auth-flow.svc.cluster.local + port: 80 + flows-frontend: + name: flows-frontend-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /flows/static/ + rewrite: / + service: frontend-svc.flows.svc.cluster.local + port: 80 + transmittal-frontend: + name: transmittal-frontend-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /transmittal/static/ + rewrite: / + service: frontend-svc.transmittal.svc.cluster.local + port: 80 + workflows-api: + name: workflows-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /workflows/api/ + rewrite: /api/ + service: backend-svc.processing.svc.cluster.local + port: 80 + transmittals-api: + name: transmittals-api-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /transmittals/api/ + rewrite: /api/ + service: backend-svc.transmittal.svc.cluster.local + port: 80 + inspections-api: + name: flows-api-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /inspections/api/ + rewrite: /api/ + service: backend-svc.inspections.svc.cluster.local + port: 80 + reviews-frontend: + name: reviews-frontend-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /reviews/static/ + rewrite: / + service: frontend-svc.reviews.svc.cluster.local + port: 80 + eav-api: + name: eav-api-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /eav/api/v0 + rewrite: /api/v4 + service: backend-svc.eav.svc.cluster.local + port: 80 + - path: + prefix: /eav/api/v2 + rewrite: /api/v5 + service: backend-svc.eav.svc.cluster.local + port: 80 + - path: + prefix: /eav/api/v3 + rewrite: /api/v3 + service: backend-svc.eav.svc.cluster.local + port: 80 + - path: + prefix: /eav/api/v4 + rewrite: /api/v4 + service: backend-svc.eav.svc.cluster.local + port: 80 + - path: + prefix: /eav/api/v1 + rewrite: /api/v6 + service: backend-svc.eav.svc.cluster.local + port: 80 + - path: + prefix: /eav/admin/ + rewrite: /eav/admin/ + service: backend-svc.eav.svc.cluster.local + port: 80 + cde-api: + name: cde-api-virt-service + namespace: default + hosts: + - sarex.uralmine.com + gateways: + - default/platform-gateway + routes: + - path: + prefix: /orchestrator/api/process/ + rewrite: /api/process/ + service: cde-svc.cde.svc.cluster.local + port: 80 + - path: + prefix: /orchestrator/api/sign + rewrite: /api/sign + service: cde-svc.cde.svc.cluster.local + port: 80 + - path: + prefix: /orchestrator/ + rewrite: /api/ + service: cde-svc.cde.svc.cluster.local + port: 80 srx-admin-frontend: name: srx-admin-frontend-virt-service namespace: default @@ -174,9 +383,9 @@ spec: camunda-keycloak: namespace: default hosts: - - camunda-keycloak.sarex-k8s.uralmine.com + - sarex-camunda-keycloak.uralmine.com gateways: - - default/camunda-gateway + - default/platform-gateway routes: - path: prefix: / @@ -185,9 +394,9 @@ spec: camunda-identity: namespace: default hosts: - - camunda-identity.sarex-k8s.uralmine.com + - sarex-camunda-identity.uralmine.com gateways: - - default/camunda-gateway + - default/platform-gateway routes: - path: prefix: / @@ -196,9 +405,9 @@ spec: camunda-operate: namespace: default hosts: - - camunda-operate.sarex-k8s.uralmine.com + - sarex-camunda-operate.uralmine.com gateways: - - default/camunda-gateway + - default/platform-gateway routes: - path: prefix: / @@ -207,9 +416,9 @@ spec: camunda-tasklist: namespace: default hosts: - - camunda-tasklist.sarex-k8s.uralmine.com + - sarex-camunda-tasklist.uralmine.com gateways: - - default/camunda-gateway + - default/platform-gateway routes: - path: prefix: / @@ -218,9 +427,9 @@ spec: camunda-optimize: namespace: default hosts: - - camunda-optimize.sarex-k8s.uralmine.com + - sarex-camunda-optimize.uralmine.com gateways: - - default/camunda-gateway + - default/platform-gateway routes: - path: prefix: / @@ -229,9 +438,9 @@ spec: rabbitmq: namespace: default hosts: - - rabbitmq.sarex-k8s.uralmine.com + - sarex-rabbitmq.uralmine.com gateways: - - default/rabbitmq-gateway + - default/platform-gateway routes: - path: prefix: / @@ -242,7 +451,7 @@ spec: hosts: - sarex-login.uralmine.com gateways: - - default/zitadel-gateway + - default/platform-gateway routes: - path: prefix: /