apps/workspaces/sarex-contour — чистое наследование base (backend +
frontend), replicaCount уже 1 в base, патчей не нужно. БД внешняя
(111.88.255.180) — заказана через terraform live/database, секрет
apps/workspaces/postgres заведён через vault-secrets applications-блок.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
infrastructure/zitadel/sarex-contour (chart idp-contour 4.12.13), по
образцу overlay vad: без dependsOn на postgresql (БД внешняя, отдельная
машина 111.88.255.180 — заказана через terraform live/database, не
in-cluster HelmRelease), postRenderer снимает nodeSelector с Deployment
+ 2 Job'ов и подменяет vault-agent template на свой (кладёт
Admin.Password/FirstInstance.Org.Human.Password из
secrets/data/zitadel/postgresql).
ExternalDomain — заглушка zitadel.sarex-contour.internal, istio-config
для внешнего доступа ещё не заведён.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
infrastructure/kafka/sarex-contour, infrastructure/rabbitmq/sarex-contour
(values по образцу yc-k8s-test, controller-only kafka KRaft, rabbitmq
1 реплика, local-path). Vault для них уже заведён отдельно (terraform
environments.sarex-contour.vault, kafka/rabbitmq policy+role+kv).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
apps/control-interface/sarex-contour наследует base (по образцу
d8-ugmk-prod), namespace control-interface, istio-injection: enabled.
Оверлей yc-k8s-test для control-interface не копировали — там
namespace: django и патч на несуществующий HelmRelease srx-admin,
похоже на скопипащенный мёртвый код из apps/django/yc-k8s-test.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
vault уже стоял в кластере (helm CLI, chart 0.1.0, standalone/raft,
инициализирован, данных нет). Overlay infrastructure/vault/sarex-contour:
values как у прочих свежих контуров (regcred, backup off, standalone),
namespace istio-injection: disabled. helm-controller перенимает релиз
`vault` и апгрейдит до 0.2.3 (base). StatefulSet updateStrategy: OnDelete —
под не дёргается автоматически.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Новый кластер clusters/sarex-contour: flux-system (bootstrap на
gitlab.sarex.io, path ./clusters/sarex-contour), helm-repositories
(yc-oci-charts), раскатка istio-base/istiod/ingressgateway.
Gateway опубликован через NodePort 30080/30443 — в контуре нет
облачного LoadBalancer.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Не наследуют base (vault-native) — отдельные HelmRelease на universal-chart
с обычными secretEnvs, как остальные сервисы этих контуров. Свои хосты,
имена сервисов и kafka-bootstrap на контур; KAFKA_ENABLE=0, поэтому kafka
без секретов. Подключены к соответствующим clusters/*/kustomization.yaml.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds apps/<app>/ugok overlays for 31 applications, derived strictly from
a live cluster dump (kubectl get deployment/service/configmap/secret),
following the wb overlay pattern (standalone HelmRelease patches on
universal-chart, plain k8s Secret + secretKeyRef instead of Vault Agent
since the ugok cluster has zero Vault usage cluster-wide).
- processing (workflow namespace) does not extend base: base is
vault-native, ugok is not, so it's four standalone HelmReleases
modeled on apps/processing/wb/*.
- issues/redis and django/redis are raw Deployments patched via JSON6902.
- documentations/pdf-markings and django/auth-flow-frontend,
export-project are copied in as standalone files (base has no
HelmRelease for them, and kustomize forbids cross-overlay references
outside a directory's own tree).
- Images and images-with-registry updated to match wb where the same
build lineage applies; left as-is where the wb tag carries a distinct
client/cluster name (donstroi1, brusnika_*, dev4, UGOK_*, ugok1_*) or
points at a different image repository entirely.
- Missing backend envs backfilled from wb where safe (internal
svc.cluster.local refs, feature flags, already-established ugok
domains); skipped where wb-specific (external DB/Kafka hosts, TLS CA
content, features not deployed in ugok like gatekeeper/Superset).
- message-hub patch was missing its entire env block from the original
bootstrap; rebuilt from the raw dump (not wb, whose Kafka/DB config is
incompatible) plus a handful of small env gaps found while
cross-checking every ugok app's rendered envs against the raw dump.
clusters/ugok/kustomization.yaml keeps the apps section commented out —
not wired into the Flux Kustomization yet, pending review.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
