control-interface/admin-frontend: drop explicit podAnnotations

universal-chart already injects proxy.istio.io/config and traffic.sidecar.istio.io/excludeOutboundPorts by default for every service — explicitly setting them too produced a duplicate-key YAML error in Flux's post-render step: error while running post render on files: ... yaml: unmarshal errors: line 42: mapping key "traffic.sidecar.istio.io/excludeOutboundPorts" already defined at line 25 line 41: mapping key "proxy.istio.io/config" already defined at line 26 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
control-interface: add admin-frontend (universal-chart) to base, route it in vad istio-config
2026-10-02 15:40:19 +05:00 · 2026-10-02 15:34:54 +05:00 · 2026-10-02 14:57:19 +05:00 · 2026-10-02 14:51:30 +05:00 · 2026-10-02 12:33:16 +05:00 · 2026-10-01 18:50:27 +05:00
126 changed files with 1761 additions and 20 deletions
--- a/apps/ams-sync/brusnika-stage/backend.yaml
+++ b/apps/ams-sync/brusnika-stage/backend.yaml
@ -138,6 +138,10 @@ spec:
          - name: KAFKA_SASL_MECHANISM
            value:
              _default: "SCRAM-SHA-512"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
        secretEnvs:
          - name: TELEGRAM_TOKEN
            secretName:
--- a/apps/attachments/brusnika-stage/backend.yaml
+++ b/apps/attachments/brusnika-stage/backend.yaml
@ -110,6 +110,10 @@ spec:
          - name: YANDEX_S3_VERIFY
            value:
              _default: "false"
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "false"
+
        secretEnvs:
          - name: DATABASE_HOST
            secretName:
--- a/apps/auth-flow/uralkal/helmrelease.yaml
+++ b/apps/auth-flow/uralkal/helmrelease.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: auth-flow
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/auth-flow/uralkal/kustomization.yaml
+++ b/apps/auth-flow/uralkal/kustomization.yaml
@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
--- a/apps/bi/brusnika-stage/frontend.yaml
+++ b/apps/bi/brusnika-stage/frontend.yaml
@ -37,7 +37,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:production_afb137d4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:contour_9cfd1a0b
          pullPolicy:
            _default: IfNotPresent

--- a/apps/bi/uralkal/backend.yaml
+++ b/apps/bi/uralkal/backend.yaml
@ -8,6 +8,11 @@ spec:
  values:
    services:
      main:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
        envs:
          - name: SETTINGS_DEBUG
            value:
--- a/apps/bi/uralkal/frontend.yaml
+++ b/apps/bi/uralkal/frontend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: bi-frontend
+  namespace: bi
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/bi/uralkal/kustomization.yaml
+++ b/apps/bi/uralkal/kustomization.yaml
@ -7,3 +7,7 @@ patches:
    target:
      kind: HelmRelease
      name: bi-backend
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: bi-frontend
--- a/apps/bim/uralkal/backend.yaml
+++ b/apps/bim/uralkal/backend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: bim
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/bim/uralkal/kustomization.yaml
+++ b/apps/bim/uralkal/kustomization.yaml
@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
--- a/apps/cde/uralkal/cde-flowscallback.yaml
+++ b/apps/cde/uralkal/cde-flowscallback.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-flowscallback
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-flowscallback:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde-splitpdf.yaml
+++ b/apps/cde/uralkal/cde-splitpdf.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-splitpdf
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-splitpdf:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde-worker-alert.yaml
+++ b/apps/cde/uralkal/cde-worker-alert.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-alert
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-alert:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde-worker-copy.yaml
+++ b/apps/cde/uralkal/cde-worker-copy.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-copy
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-copy:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde-worker-copyv2.yaml
+++ b/apps/cde/uralkal/cde-worker-copyv2.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-copyv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-copyv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde-worker-create-versions.yaml
+++ b/apps/cde/uralkal/cde-worker-create-versions.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-create-versions
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-create-versions:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde-worker-create-versionsv2.yaml
+++ b/apps/cde/uralkal/cde-worker-create-versionsv2.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-create-versionsv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-create-versionsv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde-worker-markings.yaml
+++ b/apps/cde/uralkal/cde-worker-markings.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-markings
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-markings:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde-worker-markingsv2.yaml
+++ b/apps/cde/uralkal/cde-worker-markingsv2.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-markingsv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-markingsv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde-worker-sign.yaml
+++ b/apps/cde/uralkal/cde-worker-sign.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-sign
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-sign:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde-worker-signv2.yaml
+++ b/apps/cde/uralkal/cde-worker-signv2.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-signv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-signv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde-worker-update-bundles.yaml
+++ b/apps/cde/uralkal/cde-worker-update-bundles.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-update-bundles
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-update-bundles:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/cde.yaml
+++ b/apps/cde/uralkal/cde.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde
+  namespace: cde
+spec:
+  values:
+    services:
+      cde:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cde/uralkal/kustomization.yaml
+++ b/apps/cde/uralkal/kustomization.yaml
@ -2,3 +2,56 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: cde-flowscallback.yaml
+    target:
+      kind: HelmRelease
+      name: cde-flowscallback
+  - path: cde-splitpdf.yaml
+    target:
+      kind: HelmRelease
+      name: cde-splitpdf
+  - path: cde-worker-alert.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-alert
+  - path: cde-worker-copy.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-copy
+  - path: cde-worker-copyv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-copyv2
+  - path: cde-worker-create-versions.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-create-versions
+  - path: cde-worker-create-versionsv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-create-versionsv2
+  - path: cde-worker-markings.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-markings
+  - path: cde-worker-markingsv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-markingsv2
+  - path: cde-worker-sign.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-sign
+  - path: cde-worker-signv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-signv2
+  - path: cde-worker-update-bundles.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-update-bundles
+  - path: cde.yaml
+    target:
+      kind: HelmRelease
+      name: cde
--- a/apps/checklists/brusnika-stage/backend.yaml
+++ b/apps/checklists/brusnika-stage/backend.yaml
@ -114,6 +114,18 @@ spec:
          - name: DEBUG
            value:
              _default: "false"
+          - name: DATABASE_HOST
+            value:
+              _default: "192.168.2.45"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "checklists_db"
+
        secretEnvs:
          - name: DATABASE_HOST
            secretName:
--- a/apps/checklists/uralkal/helmrelease.yaml
+++ b/apps/checklists/uralkal/helmrelease.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: checklists
+  namespace: checklists
+spec:
+  values:
+    services:
+      checklists:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/checklists/uralkal/kustomization.yaml
+++ b/apps/checklists/uralkal/kustomization.yaml
@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: checklists
--- a/apps/comparisons/uralkal/backend.yaml
+++ b/apps/comparisons/uralkal/backend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: comparisons
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/comparisons/uralkal/frontend.yaml
+++ b/apps/comparisons/uralkal/frontend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: comparisons
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/comparisons/uralkal/kustomization.yaml
+++ b/apps/comparisons/uralkal/kustomization.yaml
@ -2,3 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
--- a/apps/control-interface/base/admin-frontend.yaml
+++ b/apps/control-interface/base/admin-frontend.yaml
@ -0,0 +1,94 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: admin-frontend
+  namespace: control-interface
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      admin-frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/admin-frontend:contour_9dc27b40
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: admin-frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: admin-frontend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""
--- a/apps/control-interface/base/kustomization.yaml
+++ b/apps/control-interface/base/kustomization.yaml
@ -4,4 +4,5 @@ kind: Kustomization
 namespace: control-interface
 resources:
  - helmrelease.yaml
+  - admin-frontend.yaml

--- a/apps/cross-section/uralkal/helmrelease.yaml
+++ b/apps/cross-section/uralkal/helmrelease.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cross-section-static
+  namespace: cross-section
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/cross-section/uralkal/kustomization.yaml
+++ b/apps/cross-section/uralkal/kustomization.yaml
@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: cross-section-static
--- a/apps/django/brusnika-stage/celery.yaml
+++ b/apps/django/brusnika-stage/celery.yaml
@ -330,6 +330,14 @@ spec:
          - name: KC_USE_REDIRECT_LOGOUT
            value:
              _default: "True"
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
        secretEnvs:
          - name: SERVER_SUPERSET_JWT_SECRET
            secretName:
--- a/apps/django/brusnika-stage/export-project.yaml
+++ b/apps/django/brusnika-stage/export-project.yaml
@ -88,6 +88,11 @@ spec:
        labels:
          monitoring: prometheus

+        envs:
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
        commitSha: ""
        gitlabUri: ""
        gitlabJobUrl: ""
--- a/apps/django/brusnika-stage/sarex-backend.yaml
+++ b/apps/django/brusnika-stage/sarex-backend.yaml
@ -313,6 +313,18 @@ spec:
          - name: KC_USE_REDIRECT_LOGOUT
            value:
              _default: "True"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+
        secretEnvs:
          - name: SERVER_SUPERSET_JWT_SECRET
            secretName:
--- a/apps/django/uralkal/backend.yaml
+++ b/apps/django/uralkal/backend.yaml
@ -8,6 +8,11 @@ spec:
  values:
    services:
      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
        envs:
          - name: ALLOWED_HOSTS
            value:
--- a/apps/django/uralkal/celery.yaml
+++ b/apps/django/uralkal/celery.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: django
+spec:
+  values:
+    services:
+      celery:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/django/uralkal/frontend.yaml
+++ b/apps/django/uralkal/frontend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: django
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/django/uralkal/kustomization.yaml
+++ b/apps/django/uralkal/kustomization.yaml
@ -19,3 +19,15 @@ patches:
    target:
      kind: HelmRelease
      name: s3-proxy
+  - path: celery.yaml
+    target:
+      kind: HelmRelease
+      name: celery
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
+  - path: srx-admin.yaml
+    target:
+      kind: HelmRelease
+      name: srx-admin-frontend
--- a/apps/django/uralkal/srx-admin.yaml
+++ b/apps/django/uralkal/srx-admin.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: srx-admin-frontend
+  namespace: django
+spec:
+  values:
+    services:
+      srx-admin:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/django/uralkal/zitadel-configmap.yaml
+++ b/apps/django/uralkal/zitadel-configmap.yaml
@ -8,7 +8,7 @@ data:
    {
      "auth_type": "zitadel",
      "zitadel": {
-        "client_id": "392748423989716183",
+        "client_id": "392748840802936023",
        "host": "https://login.sarex.local.uralkali.com"
      }
    }
--- a/apps/django/vad/nginx-configmap.yaml
+++ b/apps/django/vad/nginx-configmap.yaml
@ -60,12 +60,12 @@ data:
                expires off;
            }

-            # location ~^/api/pm/ {
-            #     proxy_http_version 1.1;
-            #     proxy_set_header Connection "";
-            #     proxy_set_header Host $host;
-            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            # }
+            location ~^/api/pm/ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                proxy_set_header Host $host;
+                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            }

            location ~^/api/v1/documents/ {
                proxy_http_version 1.1;
--- a/apps/document-link/uralkal/frontend.yaml
+++ b/apps/document-link/uralkal/frontend.yaml
@ -8,6 +8,11 @@ spec:
  values:
    services:
      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
        image:
          name:
            _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:vad_60487abb
--- a/apps/documentations/brusnika-prod/api.yaml
+++ b/apps/documentations/brusnika-prod/api.yaml
@ -37,7 +37,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_b34286a7
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
          pullPolicy:
            _default: IfNotPresent

@ -267,6 +267,15 @@ spec:
          - name: USE_CACHE_IN_FILE_STREAMER
            value:
              _default: "1"
+
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
        secretEnvs:
          - name: PUBLIC_KEY
            secretName:
--- a/apps/documentations/brusnika-stage/api.yaml
+++ b/apps/documentations/brusnika-stage/api.yaml
@ -255,6 +255,34 @@ spec:
          - name: USE_CACHE_IN_FILE_STREAMER
            value:
              _default: "1"
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
        secretEnvs:
          - name: PUBLIC_KEY
            secretName:
--- a/apps/documentations/brusnika-stage/filestream.yaml
+++ b/apps/documentations/brusnika-stage/filestream.yaml
@ -255,6 +255,19 @@ spec:
          - name: USE_CACHE_IN_FILE_STREAMER
            value:
              _default: "1"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
        secretEnvs:
          - name: PUBLIC_KEY
            secretName:
--- a/apps/documentations/brusnika-stage/pdm.yaml
+++ b/apps/documentations/brusnika-stage/pdm.yaml
@ -308,6 +308,14 @@ spec:
          - name: WORKSPACE_URL
            value:
              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+          - name: BUCKET_NAME
+            value:
+              _default: "attachments-storage"
+
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+
        secretEnvs:
          - name: RELEASES_TOKEN
            secretName:
--- a/apps/documentations/uralkal/api.yaml
+++ b/apps/documentations/uralkal/api.yaml
@ -8,6 +8,11 @@ spec:
  values:
    services:
      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
        envs:
          - name: POSTGRES_POOL_SIZE
            value:
@ -20,7 +25,7 @@ spec:
              _default: login.sarex.local.uralkali.com
          - name: USE_ZITADEL
            value:
-              _default: "1"
+              _default: "0"
          - name: FLOWS_URL
            value:
              _default: http://backend-svc.flows.svc.cluster.local:80
--- a/apps/documentations/uralkal/filestream.yaml
+++ b/apps/documentations/uralkal/filestream.yaml
@ -8,6 +8,11 @@ spec:
  values:
    services:
      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
        envs:
          - name: POSTGRES_POOL_SIZE
            value:
@ -20,7 +25,7 @@ spec:
              _default: login.sarex.local.uralkali.com
          - name: USE_ZITADEL
            value:
-              _default: "1"
+              _default: "0"
          - name: FLOWS_URL
            value:
              _default: http://backend-svc.flows.svc.cluster.local:80
--- a/apps/documentations/uralkal/frontend.yaml
+++ b/apps/documentations/uralkal/frontend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: documentations
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/documentations/uralkal/hasher.yaml
+++ b/apps/documentations/uralkal/hasher.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-hasher
+  namespace: documentations
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/documentations/uralkal/kustomization.yaml
+++ b/apps/documentations/uralkal/kustomization.yaml
@ -15,3 +15,15 @@ patches:
    target:
      kind: HelmRelease
      name: documentations-pdf-markings-amqp
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
+  - path: hasher.yaml
+    target:
+      kind: HelmRelease
+      name: documentations-hasher
+  - path: pdm.yaml
+    target:
+      kind: HelmRelease
+      name: pdm-api
--- a/apps/documentations/uralkal/pdf-markings-amqp.yaml
+++ b/apps/documentations/uralkal/pdf-markings-amqp.yaml
@ -8,6 +8,11 @@ spec:
  values:
    services:
      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
        envs:
          - name: MARKS_APP__LOG_LEVEL
            value:
--- a/apps/documentations/uralkal/pdm.yaml
+++ b/apps/documentations/uralkal/pdm.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdm-api
+  namespace: documentations
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/eav/brusnika-stage/helmrelease.yaml
+++ b/apps/eav/brusnika-stage/helmrelease.yaml
@ -166,6 +166,10 @@ spec:
          - name: YC_S3_BUCKET_NAME
            value:
              _default: "eav"
+          - name: KAFKA_ENABLED
+            value:
+              _default: "False"
+
        secretEnvs:
          - name: KAFKA_PASSWORD
            secretName:
--- a/apps/eav/uralkal/helmrelease.yaml
+++ b/apps/eav/uralkal/helmrelease.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: eav
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/eav/uralkal/kustomization.yaml
+++ b/apps/eav/uralkal/kustomization.yaml
@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: backend
--- a/apps/faas/uralkal/backend.yaml
+++ b/apps/faas/uralkal/backend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: export-reviews
+  namespace: faas
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/faas/uralkal/kustomization.yaml
+++ b/apps/faas/uralkal/kustomization.yaml
@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: export-reviews
--- a/apps/flows/brusnika-stage/backend.yaml
+++ b/apps/flows/brusnika-stage/backend.yaml
@ -35,7 +35,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_e8a366a3
          pullPolicy:
            _default: IfNotPresent

@ -225,6 +225,22 @@ spec:
          - name: DOCUMENTATION_TIMEOUT
            value:
              _default: "60"
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: PROXY_PATH_PREFIX
+            value:
+              _default: "/flows"
+
+          - name: CHECKLIST_HOST
+            value:
+              _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
+
        secretEnvs:
          - name: ADMIN_PANEL_SECRET_KEY
            secretName:
--- a/apps/flows/brusnika-stage/celery.yaml
+++ b/apps/flows/brusnika-stage/celery.yaml
@ -35,7 +35,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
          pullPolicy:
            _default: IfNotPresent

@ -223,6 +223,34 @@ spec:
          - name: DOCUMENTATION_TIMEOUT
            value:
              _default: "60"
+          - name: FLOWS_HOST
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: RESOURCES_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: FLOWS_DB_HOST
+            value:
+              _default: "192.168.2.45"
+
+          - name: FLOWS_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_HOST
+            value:
+              _default: "192.168.2.45"
+
+          - name: DJANGO_BASE_HOST
+            value:
+              _default: "https://test.sarex.brusnika.tech"
+
        secretEnvs:
          - name: ADMIN_PANEL_SECRET_KEY
            secretName:
--- a/apps/flows/brusnika-stage/frontend.yaml
+++ b/apps/flows/brusnika-stage/frontend.yaml
@ -35,7 +35,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_dcc5b5e6
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
          pullPolicy:
            _default: IfNotPresent

--- a/apps/flows/uralkal/backend.yaml
+++ b/apps/flows/uralkal/backend.yaml
@ -15,6 +15,11 @@ spec:
  values:
    services:
      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
        deployment:
          args:
            _default:
--- a/apps/flows/uralkal/celery.yaml
+++ b/apps/flows/uralkal/celery.yaml
@ -15,6 +15,11 @@ spec:
  values:
    services:
      celery:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
        deployment:
          args:
            _default:
--- a/apps/flows/uralkal/frontend.yaml
+++ b/apps/flows/uralkal/frontend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: flows
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/flows/uralkal/kustomization.yaml
+++ b/apps/flows/uralkal/kustomization.yaml
@ -11,3 +11,7 @@ patches:
    target:
      kind: HelmRelease
      name: celery
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
--- a/apps/iam/base/backend.yaml
+++ b/apps/iam/base/backend.yaml
@ -42,7 +42,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_b52d632c
          pullPolicy:
            _default: IfNotPresent

--- a/apps/iam/brusnika-stage/backend.yaml
+++ b/apps/iam/brusnika-stage/backend.yaml
@ -35,7 +35,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:production_786e19c3
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
          pullPolicy:
            _default: IfNotPresent

@ -158,6 +158,22 @@ spec:
          - name: KAFKA_TOPIC_COMPANY_RESOURCE_PERMISSIONS
            value:
              _default: "company_resource_permissions"
+          - name: AUTH_ENABLED
+            value:
+              _default: "true"
+
+          - name: ZITADEL_ENABLED
+            value:
+              _default: "false"
+
+          - name: ZITADEL_ORG_RULES_FILE
+            value:
+              _default: "config/zitadel/org-rules-prod.json"
+
+          - name: KAFKA_TOPIC_LEGACY_AMS_SYNC
+            value:
+              _default: "ams-sync"
+
        secretEnvs:
          - name: DB_DSN
            secretName:
--- a/apps/inspections/brusnika-stage/backend.yaml
+++ b/apps/inspections/brusnika-stage/backend.yaml
@ -130,6 +130,94 @@ spec:
          - name: API_ADDRESS
            value:
              _default: "8000"
+          - name: DEBUG
+            value:
+              _default: "false"
+
+          - name: HTTP_APP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: "/inspections"
+
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "3"
+
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: "hello@sarex.io"
+
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: "https://test.sarex.brusnika.tech"
+
+          - name: SAREX_BACKEND_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav"
+
+          - name: EAV_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: WORKFLOWS_EMAIL_DOCKER_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/notification:email"
+
+          - name: MOBILE_APP_CURRENT_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_RECOMMENDED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_REQUIRED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MAILER_URL
+            value:
+              _default: "http://mailer-service.mailer:8000"
+
+          - name: MAILER_TIMEOUT
+            value:
+              _default: "30"
+
        secretEnvs:
          - name: DATABASE_USER
            secretName:
--- a/apps/inspections/uralkal/backend.yaml
+++ b/apps/inspections/uralkal/backend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: inspections
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/inspections/uralkal/kustomization.yaml
+++ b/apps/inspections/uralkal/kustomization.yaml
@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
--- a/apps/issues/brusnika-stage/backend.yaml
+++ b/apps/issues/brusnika-stage/backend.yaml
@ -176,6 +176,10 @@ spec:
          - name: API_ADDRESS
            value:
              _default: "8000"
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
        secretEnvs:
          - name: YC_S3_ACCESS_KEY_ID
            secretName:
--- a/apps/issues/brusnika-stage/celery.yaml
+++ b/apps/issues/brusnika-stage/celery.yaml
@ -187,6 +187,18 @@ spec:
          - name: API_ADDRESS
            value:
              _default: "8000"
+          - name: USE_NOTIFICATIONS
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
        secretEnvs:
          - name: YC_S3_ACCESS_KEY_ID
            secretName:
--- a/apps/issues/uralkal/backend.yaml
+++ b/apps/issues/uralkal/backend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: issues
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/issues/uralkal/celery.yaml
+++ b/apps/issues/uralkal/celery.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: issues
+spec:
+  values:
+    services:
+      celery:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/issues/uralkal/frontend.yaml
+++ b/apps/issues/uralkal/frontend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: issues
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/issues/uralkal/kustomization.yaml
+++ b/apps/issues/uralkal/kustomization.yaml
@ -12,3 +12,15 @@ patches:
    target:
      kind: HelmRelease
      name: celery
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: celery.yaml
+    target:
+      kind: HelmRelease
+      name: celery
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
--- a/apps/mapper/uralkal/backend.yaml
+++ b/apps/mapper/uralkal/backend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: mapper
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/mapper/uralkal/kustomization.yaml
+++ b/apps/mapper/uralkal/kustomization.yaml
@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
--- a/apps/measurements/uralkal/backend.yaml
+++ b/apps/measurements/uralkal/backend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: measurements
+  namespace: measurements
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/measurements/uralkal/kustomization.yaml
+++ b/apps/measurements/uralkal/kustomization.yaml
@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: measurements
--- a/apps/message-hub/uralkal/message-hub.yaml
+++ b/apps/message-hub/uralkal/message-hub.yaml
@ -14,6 +14,11 @@ spec:
  values:
    services:
      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
        envs:
          - name: WORKER_TIMEOUT
            value:
--- a/apps/notes/uralkal/backend.yaml
+++ b/apps/notes/uralkal/backend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: notes
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/notes/uralkal/frontend.yaml
+++ b/apps/notes/uralkal/frontend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: notes
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/notes/uralkal/kustomization.yaml
+++ b/apps/notes/uralkal/kustomization.yaml
@ -2,3 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
--- a/apps/pm/uralkal/backend.yaml
+++ b/apps/pm/uralkal/backend.yaml
@ -15,6 +15,11 @@ spec:
  values:
    services:
      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
        image:
          name:
            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551
--- a/apps/pm/uralkal/celery.yaml
+++ b/apps/pm/uralkal/celery.yaml
@ -15,6 +15,11 @@ spec:
  values:
    services:
      celery:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
        # Образ общий с backend — держать в одной версии обязательно,
        # иначе воркер разъедется с API по схеме задач и моделям.
        image:
--- a/apps/pm/uralkal/frontend.yaml
+++ b/apps/pm/uralkal/frontend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: pm
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/pm/uralkal/kustomization.yaml
+++ b/apps/pm/uralkal/kustomization.yaml
@ -13,3 +13,11 @@ patches:
    target:
      kind: HelmRelease
      name: celery
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
+  - path: resources-static.yaml
+    target:
+      kind: HelmRelease
+      name: resources-static
--- a/apps/pm/uralkal/resources-static.yaml
+++ b/apps/pm/uralkal/resources-static.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: resources-static
+  namespace: pm
+spec:
+  values:
+    services:
+      resources-static:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/prescriptions/uralkal/frontend.yaml
+++ b/apps/prescriptions/uralkal/frontend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: prescriptions
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/prescriptions/uralkal/kustomization.yaml
+++ b/apps/prescriptions/uralkal/kustomization.yaml
@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
--- a/apps/processing/uralkal/api.yaml
+++ b/apps/processing/uralkal/api.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: workflows-api
+  namespace: processing
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/processing/uralkal/engine-low.yaml
+++ b/apps/processing/uralkal/engine-low.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: engine-low
+  namespace: processing
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/processing/uralkal/engine.yaml
+++ b/apps/processing/uralkal/engine.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: engine
+  namespace: processing
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/processing/uralkal/frontend.yaml
+++ b/apps/processing/uralkal/frontend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: processing
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/apps/processing/uralkal/kustomization.yaml
+++ b/apps/processing/uralkal/kustomization.yaml
@ -2,3 +2,20 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+patches:
+  - path: api.yaml
+    target:
+      kind: HelmRelease
+      name: workflows-api
+  - path: engine-low.yaml
+    target:
+      kind: HelmRelease
+      name: engine-low
+  - path: engine.yaml
+    target:
+      kind: HelmRelease
+      name: engine
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
--- a/apps/projects/uralkal/frontend.yaml
+++ b/apps/projects/uralkal/frontend.yaml
@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: projects
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
ivan	64fe3c00fb	control-interface/admin-frontend: drop explicit podAnnotations universal-chart already injects proxy.istio.io/config and traffic.sidecar.istio.io/excludeOutboundPorts by default for every service — explicitly setting them too produced a duplicate-key YAML error in Flux's post-render step: error while running post render on files: ... yaml: unmarshal errors: line 42: mapping key "traffic.sidecar.istio.io/excludeOutboundPorts" already defined at line 25 line 41: mapping key "proxy.istio.io/config" already defined at line 26 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-10-02 15:40:19 +05:00
ivan	5564778337	control-interface: add admin-frontend (universal-chart) to base, route it in vad istio-config New HelmRelease services.admin-frontend in apps/control-interface/base, matching the live Deployment's image/port/resources (cpu 100m, memory 100Mi) and istio tracing podAnnotations. Downward-API envs (K8S_POD_UID/ K8S_POD_NAME/K8S_NAMESPACE/OTEL_RESOURCE_ATTRIBUTES) were left out — no existing app in this repo uses valueFrom/fieldRef in the universal-chart envs schema and the chart source isn't reachable to confirm support. imagePullSecrets uses regcred (vad's actual convention) instead of the source's dockerhub. Since control-interface/vad and /uralkal both just inherit ../base unmodified, this also shows up in uralkal as a side effect. infrastructure/istio-config/vad: adds a plain admin-frontend route (/admin-frontend/static/ -> admin-frontend-svc.control-interface, rewrite /), matching the minimal style of the other sarex.vadroad.ru routes — no cors block, per request. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-10-02 15:34:54 +05:00
ivan	0bd15c6ae5	++	2026-10-02 14:57:19 +05:00
ivan	e00a7905fb	++	2026-10-02 14:51:30 +05:00
ivan	7531341438	++	2026-10-02 12:33:16 +05:00
ivan	d44378a432	brusnika-stage: route checklists/inspections/workflows/workspaces/comparisons/etc. through Istio instead of the global-ingress nginx proxy Adds 13 new VirtualServices on the existing test.sarex.brusnika.tech host and ingress-nginx/main-gateway, matching the active (non-commented) location blocks in global-ingress's nginx-configmap (fetched live from the cluster and cross-checked service/port/namespace names against what's actually running). The root path (/) stays routed to nginx-service.global-ingress as a fallback for anything not covered here. Two deliberate deviations from literally replaying the nginx config: - /comparisons/api/: nginx proxies to port 8080, but the real backend-service.comparisons Service listens on 80 (targetPort 8080) — used 80. - /orchestrator/: nginx declares 4 location blocks, but the first (bare ~^/orchestrator/) shadows the other three for any non-empty path (nginx picks the first matching regex location, not the most specific), so only one route (no rewrite) was ported, matching what nginx actually does today. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-10-01 18:50:27 +05:00
ivan	6251cfed5c	brusnika-stage: bring images and env vars up to wb level Missing env vars copied from wb for ams-sync, attachments, bi/frontend, checklists, django (celery, export-project, sarex-backend), documentations (api, filestream, pdm), eav, flows (backend, celery, frontend), iam, inspections, issues (backend, celery), rfi, transmittal/worker. Image tags updated to match wb for flows (backend/celery/frontend), iam. Known issue, not yet fixed in this commit: several of the copied env values are wb-specific hosts (.wb.ru, one uralmine.com) that don't apply to brusnika-stage — ZITADEL_HOST/ZITADEL_DOMAIN (django, documentations, iam), DATABASE_HOST/FLOWS_DB_HOST/ISSUES_DB_HOST (checklists, flows), SUPERSET_HOST (bi), DJANGO_BASE_HOST/SAREX_BACKEND_URL (flows, inspections), RESOURCES_INTERNAL_HOST/RESOURCE_URL (ams-sync, django, flows, notes-related). To be corrected in a follow-up commit. bi/backend.yaml, bim/backend.yaml and notes/backend.yaml were reverted before this commit (image-tag updates for bi-backend/bim/notes and bi's SUPERSET_ env additions are not included). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-10-01 18:04:55 +05:00
ivan	e4c3294bb8	++	2026-10-01 17:43:58 +05:00
Дмитрий Емелин	0c54886814	Merge branch 'pdm/update_for_brusnika_copy' into 'master' fix: update brusnika for copy See merge request infra/iac!4	2026-09-30 15:25:45 +00:00
diamondrigido	7cac4ff295	fix: update brusnika for copy	2026-09-30 17:17:53 +02:00
emelinda	a438f5bd6b	Uncomment `vs-resources-admin` configuration in `brusnika-stage` Istio settings.	2026-09-30 17:55:40 +03:00
emelinda	8244e56f02	Comment out `vs-resources-admin` configuration in `brusnika-stage` Istio settings.	2026-09-30 17:52:55 +03:00
emelinda	70e4b24eee	Uncomment `vs-resources-admin` configuration in `brusnika-stage` Istio settings.	2026-09-30 17:42:18 +03:00
emelinda	474298459a	comment `vs-resources-admin` configuration in `brusnika-stage` Istio settings.	2026-09-30 17:35:11 +03:00
emelinda	c471cf39e0	Uncomment `vs-resources-admin` configuration in `brusnika-stage` Istio settings.	2026-09-30 15:20:40 +03:00
ivan	979e5c2a51	uralkal: clear CPU/memory requests for all 36 business apps Every services.<svc>.deployment.resources.requests.{cpu,memory} across the 36 uralkal apps (69 HelmRelease/service entries total) is now nulled via a kustomize patch, so Helm never renders a requests block for these pods on uralkal — Kubernetes won't reserve CPU/memory for them there. Where a uralkal patch already existed for that service (13 cases: documentations api/filestream/pdf-markings-amqp, django backend, flows backend/celery, pm backend/celery, transmittal backend/worker, bi, document-link, stamp-verification, message-hub), the null block was added into that same file. Where no uralkal patch existed yet (55 cases, including all 13 cde workers and every plain frontend), a new minimal patch file was added and wired into that app's kustomization.yaml. vad and the other clusters are untouched — only apps//uralkal/ changed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-30 15:06:51 +03:00
ivan	b32e4667c1	++	2026-09-30 14:11:08 +03:00
emelinda	01b8a7b553	Merge remote-tracking branch 'origin/master'	2026-09-30 14:06:19 +03:00
emelinda	809febe4dc	Comment out `vs-resources-admin` configuration in `brusnika-stage` Istio settings.	2026-09-30 14:06:07 +03:00
Kochetkov S	1fe6cb2eba	++ first contour pipeline	2026-09-30 11:22:55 +03:00