From f62dfb037d8591853d8877485d51ae295de47ca5 Mon Sep 17 00:00:00 2001 From: ivan Date: Fri, 18 Sep 2026 02:37:49 +0500 Subject: [PATCH] vad: pm, message-hub, cde Co-Authored-By: Claude Sonnet 5 --- apps/cde/vad/kustomization.yaml | 4 + apps/message-hub/vad/kafka-ca-configmap.yaml | 27 +++ apps/message-hub/vad/kustomization.yaml | 10 + apps/message-hub/vad/message-hub.yaml | 105 +++++++++ apps/pm/vad/backend.yaml | 205 ++++++++++++++++++ apps/pm/vad/celery.yaml | 216 +++++++++++++++++++ apps/pm/vad/kafka-ca-configmap.yaml | 27 +++ apps/pm/vad/kustomization.yaml | 15 ++ apps/pm/vad/redis.yaml | 98 +++++++++ clusters/vad/kustomization.yaml | 3 + 10 files changed, 710 insertions(+) create mode 100644 apps/cde/vad/kustomization.yaml create mode 100644 apps/message-hub/vad/kafka-ca-configmap.yaml create mode 100644 apps/message-hub/vad/kustomization.yaml create mode 100644 apps/message-hub/vad/message-hub.yaml create mode 100644 apps/pm/vad/backend.yaml create mode 100644 apps/pm/vad/celery.yaml create mode 100644 apps/pm/vad/kafka-ca-configmap.yaml create mode 100644 apps/pm/vad/kustomization.yaml create mode 100644 apps/pm/vad/redis.yaml diff --git a/apps/cde/vad/kustomization.yaml b/apps/cde/vad/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/apps/cde/vad/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base diff --git a/apps/message-hub/vad/kafka-ca-configmap.yaml b/apps/message-hub/vad/kafka-ca-configmap.yaml new file mode 100644 index 0000000..43ffd32 --- /dev/null +++ b/apps/message-hub/vad/kafka-ca-configmap.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-ca-cert + namespace: message-hub +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw + NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC + h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy + D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV + tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM + Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C + GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA + A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL + QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP + KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j + kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j + TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8 + fdA17/ibw6gFrH2b3vZKcx8D455V + -----END CERTIFICATE----- diff --git a/apps/message-hub/vad/kustomization.yaml b/apps/message-hub/vad/kustomization.yaml new file mode 100644 index 0000000..9bbf73e --- /dev/null +++ b/apps/message-hub/vad/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base + - kafka-ca-configmap.yaml +patches: + - path: message-hub.yaml + target: + kind: HelmRelease + name: message-hub diff --git a/apps/message-hub/vad/message-hub.yaml b/apps/message-hub/vad/message-hub.yaml new file mode 100644 index 0000000..cf48432 --- /dev/null +++ b/apps/message-hub/vad/message-hub.yaml @@ -0,0 +1,105 @@ +--- +# Патч message-hub для vad. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/message-hub/base/message-hub.yaml. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# agent-inject-template-message-hub-kafka; остальные берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: message-hub + namespace: message-hub +spec: + values: + services: + backend: + envs: + - name: WORKER_TIMEOUT + value: + _default: "60" + + - name: PYTHONPATH + value: + _default: "src" + + - name: SETTINGS_MAX_RETRIES + value: + _default: "1" + + - name: SETTINGS_TOPICS + value: + _default: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod", "resources_updated": "iam.resource.updated.v2", "resources_deleted": "iam.resource.deleted.v2"}' + - name: SETTINGS_VERIFY_SSL + value: + _default: "0" + + - name: SAREX_BASE_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:8000" + + - name: PM_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: ISSUES_HOST + value: + _default: "http://backend-svc.issues.svc.cluster.local:80" + + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + - name: CACHE_SSL + value: + _default: "0" + + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local" + + - name: KAFKA_PORT + value: + _default: "9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SASL_SSL" + + volumes: + _default: + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/pm + vault.hashicorp.com/agent-inject-template-message-hub-kafka: |- + {{- with secret "secrets/data/kafka/apps/pm" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + {{- end -}} diff --git a/apps/pm/vad/backend.yaml b/apps/pm/vad/backend.yaml new file mode 100644 index 0000000..65aeeeb --- /dev/null +++ b/apps/pm/vad/backend.yaml @@ -0,0 +1,205 @@ +--- +# Патч backend для vad. +# +# ВНИМАНИЕ: args — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь скрипт из apps/pm/base/backend.yaml. +# При правке args в base их нужно продублировать и сюда. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-pm-s3; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: pm +spec: + values: + services: + backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551 + + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db + [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq + [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 + [ -f /vault/secrets/pm-kafka ] && . /vault/secrets/pm-kafka + set +a + python manage.py makemigrations pm --noinput + python manage.py migrate + exec /opt/sarex/entrypoint.sh + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + # base: "False". При False CACHE_CLIENT = None (config/settings/base.py:190), + # и GET /api/pm/msp/external-task-info/ падает с + # AttributeError: 'NoneType' object has no attribute 'get' — + # sarex/pm/utils/broker_producer.py:38 дёргает .get() без проверки на None. + - name: CACHE_ENABLE + value: + _default: "True" + + # Новые: в base их нет. Дефолт CacheSettings.host — localhost, + # т.е. без них включённый кэш стучится в собственный под. + # Redis разворачивается тут же — apps/pm/vad/redis.yaml. + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "True" + + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]' + + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SASL_SSL" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-prod"}' + + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://sarex.vadroad.ru/api/token/public/" + + - name: SERVER_HOST + value: + _default: "https://sarex.vadroad.ru" + + - name: SERVER_API_HOST + value: + _default: "https://sarex.vadroad.ru" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" + + volumes: + _default: + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-template-pm-s3: |- + {{- with secret "secrets/data/minio/apps/pm" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + S3_VERIFY=False + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}sarex-media-storage{{ end }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm + vault.hashicorp.com/agent-inject-template-pm-kafka: |- + {{- with secret "secrets/data/kafka/apps/pm" -}} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} + KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/pm/vad/celery.yaml b/apps/pm/vad/celery.yaml new file mode 100644 index 0000000..47bfda2 --- /dev/null +++ b/apps/pm/vad/celery.yaml @@ -0,0 +1,216 @@ +--- +# Патч celery для vad. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/pm/base/celery.yaml. +# При добавлении переменной в base её нужно продублировать и сюда. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-pm-s3; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: pm +spec: + values: + services: + celery: + # Образ общий с backend — держать в одной версии обязательно, + # иначе воркер разъедется с API по схеме задач и моделям. + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551 + + # base не переопределяет args, а нам нужно добавить sourcing pm-kafka — + # дублируем скрипт целиком (то же самое, что и в backend.yaml). + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db + [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq + [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3 + [ -f /vault/secrets/pm-kafka ] && . /vault/secrets/pm-kafka + set +a + exec celery -A config worker -B -l info -E -Q pm -n default_worker.%h --concurrency=2 + + envs: + # base: http://backend-service.sarex.svc.cluster.local:8000 — ns sarex не существует + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: CELERY_REDIS_HOST + value: + _default: "redis.pm.svc.cluster.local" + + # base: http://sarex-resources-service.resources — ns resources не развёрнут в контуре + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + # base: http://eav-service.eav — сервис называется backend-svc и слушает 80 + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + - name: TRACING_INSECURE + value: + _default: "False" + + - name: SERVER_ENABLE_SYNC_RESOURCES + value: + _default: "True" + + - name: SERVER_DELETED_TASK_MAX_AGE_DAYS + value: + _default: "1" + + - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR + value: + _default: "17" + + - name: LANG + value: + _default: "C.UTF-8" + + - name: LC_ALL + value: + _default: "C.UTF-8" + + - name: PYTHONUTF8 + value: + _default: "1" + + - name: CACHE_SSL + value: + _default: "False" + + - name: CACHE_SSL_CA_CERTS + value: + _default: "" + + # base: "False". Держим в одном значении с backend: при enable + # config/celery.py включает периодическую синхронизацию ресурсов, + # которая пишет ключи service_accounts / resources:* — их читает + # backend в sarex/pm/utils/resources.py. + - name: CACHE_ENABLE + value: + _default: "True" + + # Новые: в base их нет, дефолт CacheSettings.host — localhost. + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + - name: CLICKHOUSE_ENABLE + value: + _default: "False" + + - name: KAFKA_ENABLE + value: + _default: "True" + + # См. подробные комментарии в apps/pm/vad/backend.yaml — + # то же самое, воркер должен уметь публиковать в Kafka так же, как API. + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]' + + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SASL_SSL" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-prod"}' + + # base: https://lk.sarex.io/api/token/public/ + - name: AUTH_PUBLIC_TOKEN_URL + value: + _default: "https://sarex.vadroad.ru/api/token/public/" + + # base: https://lk.sarex.io + - name: SERVER_HOST + value: + _default: "https://sarex.vadroad.ru" + + # base: https://api.sarex.io + - name: SERVER_API_HOST + value: + _default: "https://sarex.vadroad.ru" + + - name: SERVER_DEBUG + value: + _default: "False" + + - name: SERVER_ALLOWED_HOSTS + value: + _default: '["*"]' + + - name: SERVER_USE_OTEL + value: + _default: "False" + + - name: SERVER_VERIFY_SSL + value: + _default: "False" + + - name: SERVER_LOG_LEVEL + value: + _default: "INFO" + + volumes: + _default: + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + podAnnotations: + _default: + # base склеивал S3_BUCKET с S3_VERIFY: {{- end -}} съедал перевод строки. + # S3_VERIFY поднят выше блока if, у {{ end }} убран хвостовой дефис. + vault.hashicorp.com/agent-inject-template-pm-s3: |- + {{- with secret "secrets/data/minio/apps/pm" -}} + S3_HOST={{ index .Data.data.client "endpoint" }} + S3_LOGIN={{ index .Data.data "access_key" }} + S3_PASSWORD={{ index .Data.data "secret_key" }} + S3_VERIFY=False + {{- $buckets := index .Data.data "buckets" }} + S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}sarex-media-storage{{ end }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm + vault.hashicorp.com/agent-inject-template-pm-kafka: |- + {{- with secret "secrets/data/kafka/apps/pm" -}} + KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }} + KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }} + KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/pm/vad/kafka-ca-configmap.yaml b/apps/pm/vad/kafka-ca-configmap.yaml new file mode 100644 index 0000000..9b76d6b --- /dev/null +++ b/apps/pm/vad/kafka-ca-configmap.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-ca-cert + namespace: pm +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw + NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC + h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy + D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV + tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM + Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C + GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA + A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL + QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP + KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j + kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j + TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8 + fdA17/ibw6gFrH2b3vZKcx8D455V + -----END CERTIFICATE----- diff --git a/apps/pm/vad/kustomization.yaml b/apps/pm/vad/kustomization.yaml new file mode 100644 index 0000000..503cfe2 --- /dev/null +++ b/apps/pm/vad/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base + - redis.yaml + - kafka-ca-configmap.yaml +patches: + - path: backend.yaml + target: + kind: HelmRelease + name: backend + - path: celery.yaml + target: + kind: HelmRelease + name: celery diff --git a/apps/pm/vad/redis.yaml b/apps/pm/vad/redis.yaml new file mode 100644 index 0000000..46a4787 --- /dev/null +++ b/apps/pm/vad/redis.yaml @@ -0,0 +1,98 @@ +--- +# Redis для celery в ns pm. В base его нет — там CELERY_REDIS_HOST указывает +# на redis.pm.svc.cluster.local, но сам сервис не разворачивается. +# +# Имя Service обязано быть ровно "redis" (не redis-svc, как принято в остальных +# релизах), иначе не сойдётся с CELERY_REDIS_HOST в backend.yaml и celery.yaml. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: redis + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + redis: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest + pullPolicy: + _default: Always + + deployment: + enabled: true + + name: + _default: redis + + replicaCount: + _default: 1 + + port: + _default: 6379 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 64Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: redis + + type: + _default: ClusterIP + + port: + _default: 6379 + + targetPort: + _default: 6379 + + # НЕ http: чарт по умолчанию подставляет "http", и тогда Istio навесит + # на 6379 HTTP-фильтры и сломает RESP. Префикс tcp- переводит порт + # в режим обычного TCP-проксирования. + portName: + _default: tcp-redis + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/clusters/vad/kustomization.yaml b/clusters/vad/kustomization.yaml index fa6e43a..667a121 100644 --- a/clusters/vad/kustomization.yaml +++ b/clusters/vad/kustomization.yaml @@ -49,3 +49,6 @@ resources: - ../../apps/stamp-verification/vad - ../../apps/faas/vad - ../../apps/iam/vad + - ../../apps/pm/vad + - ../../apps/message-hub/vad + - ../../apps/cde/vad