++ camunda processing nodes

KAFKA_SASL_MECHANISM is read from auth.sasl_mechanism when the nested auth
map exists and from the top-level sasl_mechanism otherwise, so the pods start
both before and after kafka/apps/pm switches to creds delivered from the
kafka-topics terraform stack.

CLAUDE.md

@@ -39,7 +39,8 @@
 **Кластер.** `clusters/<cluster>/kustomization.yaml` — плоский список `../../apps/<app>/<cluster>`. Инфраструктура подключается двумя разными способами:
 
 - `d8-ugmk-prod` — прямо в корневом kustomization как `../../infrastructure/<comp>/d8-ugmk-prod`;
-- `brusnika-prod`, `brusnika-stage`, `wb` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/<c>/infrastructure/patches/*.yaml`.
+- `brusnika-prod`, `brusnika-stage` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на оверлеи `../../../infrastructure/<comp>/<c>` (`base` + патч HelmRelease + сопутствующие манифесты компонента);
+- `wb` — через `clusters/wb/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/wb/infrastructure/patches/*.yaml`.
 
 Кластеры: `brusnika-prod`, `brusnika-stage`, `d8-ugmk-prod`, `wb`, `yc-cps-prod`, `yc-ecp`, `yc-infra-prod`, `yc-k8s-test`, `yc-k8s-test-02`, `contour`.
 

apps/ams-sync/brusnika-stage/backend.yaml

@@ -138,6 +138,10 @@ spec:
           - name: KAFKA_SASL_MECHANISM
             value:
               _default: "SCRAM-SHA-512"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: TELEGRAM_TOKEN
             secretName:

apps/attachments/brusnika-stage/backend.yaml

@@ -110,6 +110,10 @@ spec:
           - name: YANDEX_S3_VERIFY
             value:
               _default: "false"
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "false"
+
         secretEnvs:
           - name: DATABASE_HOST
             secretName:

apps/bi/base/backend.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 500m
+                _default: 25m
               memory:
-                _default: 1Gi
+                _default: 128Mi
 
           probes:
             liveness:

apps/bi/brusnika-stage/frontend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:production_afb137d4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:contour_9cfd1a0b
           pullPolicy:
             _default: IfNotPresent
 

apps/cde/base/cde-flowscallback.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 500m
+                _default: 25m
               memory:
-                _default: 1Gi
+                _default: 128Mi
 
           probes:
             liveness:

apps/cde/base/cde-worker-copy.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: "1"
+                _default: 25m
               memory:
-                _default: 1Gi
+                _default: 228Mi
 
           probes:
             liveness:

apps/cde/base/cde.yaml

@@ -71,7 +71,7 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 500m
+                _default: 250m
               memory:
                 _default: 512Mi
 

apps/control-interface/base/admin-frontend.yaml

@@ -0,0 +1,94 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: admin-frontend
+  namespace: control-interface
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      admin-frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/admin-frontend:contour_9dc27b40
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: admin-frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: admin-frontend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/control-interface/base/kustomization.yaml

@@ -4,4 +4,5 @@ kind: Kustomization
 namespace: control-interface
 resources:
   - helmrelease.yaml
+  - admin-frontend.yaml
 

apps/control-interface/uralkal/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - ../base
   - namespace.yaml
+  - psql-tools-debug.yaml

apps/control-interface/uralkal/psql-tools-debug.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: psql-tools-debug
+  namespace: control-interface
+  labels:
+    app: psql-tools-debug
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: psql-tools-debug
+  template:
+    metadata:
+      labels:
+        app: psql-tools-debug
+    spec:
+      containers:
+        - name: debug
+          image: cr.yandex/crp3ccidau046kdj8g9q/mc-files:latest
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c"]
+          args:
+            - while true; do sleep 3600; done
+      imagePullSecrets:
+        - name: regcred

apps/django/brusnika-prod/s3-proxy.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_37a48176
+            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
           pullPolicy:
             _default: IfNotPresent
 
@@ -89,7 +89,7 @@ spec:
         envs:
           - name: AWS_API_ENDPOINT
             value:
-              _default: "http://minio-svc.minio.svc.cluster.local:9000"
+              _default: "https://obs.ru-moscow-1.hc.sbercloud.ru"
           - name: APP_PORT
             value:
               _default: "8000"

apps/django/brusnika-stage/celery.yaml

@@ -330,6 +330,14 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/brusnika-stage/export-project.yaml

@@ -88,6 +88,11 @@ spec:
         labels:
           monitoring: prometheus
 
+        envs:
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/django/brusnika-stage/sarex-backend.yaml

@@ -313,6 +313,18 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/uralkal/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            # location ~^/api/pm/ {
+            location ~^/api/pm/ {
-            #     proxy_http_version 1.1;
+                proxy_http_version 1.1;
-            #     proxy_set_header Connection "";
+                proxy_set_header Connection "";
-            #     proxy_set_header Host $host;
+                proxy_set_header Host $host;
-            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            # }
+            }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;

apps/django/vad/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            # location ~^/api/pm/ {
+            location ~^/api/pm/ {
-            #     proxy_http_version 1.1;
+                proxy_http_version 1.1;
-            #     proxy_set_header Connection "";
+                proxy_set_header Connection "";
-            #     proxy_set_header Host $host;
+                proxy_set_header Host $host;
-            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            # }
+            }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;

apps/documentations/brusnika-prod/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_b34286a7
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
           pullPolicy:
             _default: IfNotPresent
 
@@ -267,6 +267,15 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/api.yaml

@@ -255,6 +255,34 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/filestream.yaml

@@ -255,6 +255,19 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/pdm.yaml

@@ -308,6 +308,14 @@ spec:
           - name: WORKSPACE_URL
             value:
               _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+          - name: BUCKET_NAME
+            value:
+              _default: "attachments-storage"
+
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+
         secretEnvs:
           - name: RELEASES_TOKEN
             secretName:

apps/documentations/uralkal/api.yaml

@@ -13,6 +13,9 @@ spec:
             requests:
               cpu: null
               memory: null
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api:contour_8631bb0e
         envs:
           - name: POSTGRES_POOL_SIZE
             value:
@@ -23,6 +26,9 @@ spec:
           - name: ZITADEL_DOMAIN
             value:
               _default: login.sarex.local.uralkali.com
+          - name: ZITADEL_INSECURE_SKIP_VERIFY
+            value:
+              _default: "true"
           - name: USE_ZITADEL
             value:
               _default: "1"

apps/documentations/uralkal/filestream.yaml

@@ -13,10 +13,16 @@ spec:
             requests:
               cpu: null
               memory: null
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:contour_8631bb0e
         envs:
           - name: POSTGRES_POOL_SIZE
             value:
               _default: "20"
+          - name: ZITADEL_INSECURE_SKIP_VERIFY
+            value:
+              _default: "true"
           - name: ZITADEL_ACCOUNT
             value:
               _default: /vault/secrets/documentations-zitadel-account-json

apps/eav/brusnika-stage/helmrelease.yaml

@@ -166,6 +166,10 @@ spec:
           - name: YC_S3_BUCKET_NAME
             value:
               _default: "eav"
+          - name: KAFKA_ENABLED
+            value:
+              _default: "False"
+
         secretEnvs:
           - name: KAFKA_PASSWORD
             secretName:

apps/flows/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 
@@ -225,6 +225,22 @@ spec:
           - name: DOCUMENTATION_TIMEOUT
             value:
               _default: "60"
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: PROXY_PATH_PREFIX
+            value:
+              _default: "/flows"
+
+          - name: CHECKLIST_HOST
+            value:
+              _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
+
         secretEnvs:
           - name: ADMIN_PANEL_SECRET_KEY
             secretName:

apps/flows/brusnika-stage/celery.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
           pullPolicy:
             _default: IfNotPresent
 
@@ -223,6 +223,34 @@ spec:
           - name: DOCUMENTATION_TIMEOUT
             value:
               _default: "60"
+          - name: FLOWS_HOST
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: RESOURCES_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: FLOWS_DB_HOST
+            value:
+              _default: "192.168.2.45"
+
+          - name: FLOWS_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_HOST
+            value:
+              _default: "192.168.2.45"
+
+          - name: DJANGO_BASE_HOST
+            value:
+              _default: "https://test.sarex.brusnika.tech"
+
         secretEnvs:
           - name: ADMIN_PANEL_SECRET_KEY
             secretName:

apps/flows/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_dcc5b5e6
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/uralkal/backend.yaml

@@ -83,6 +83,10 @@ spec:
             value:
               _default: "0"
           
+          - name: ENABLE_EVENTS
+            value:
+              _default: "0"
+
           - name: ENABLE_METRICS
             value:
               _default: "0"
@@ -139,28 +143,11 @@ spec:
             value:
               _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
 
+        secretEnvs:
           - name: KAFKA_SSL_CERT
-            value:
+            secretName:
-              _default: |
+              _default: kafka-kafka-contour-tls
-                -----BEGIN CERTIFICATE-----
+            secretKey: "ca.crt"
-                MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-                MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-                MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-                tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-                h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-                k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-                GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-                zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-                Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-                A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-                vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-                OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-                fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-                ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-                0FC16VuidLG0HUCCawFjRiAg9rIA
-                -----END CERTIFICATE-----
 
         podAnnotations:
           _default:

apps/flows/uralkal/celery.yaml

@@ -1,11 +1,4 @@
 ---
-# Патч celery для контура УГМК — подключение к Kafka.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml.
-# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
-# podAnnotations — map, мержится по ключам, поэтому переопределён только
-# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -140,28 +133,11 @@ spec:
             value:
               _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
 
+        secretEnvs:
           - name: KAFKA_SSL_CERT
-            value:
+            secretName:
-              _default: |
+              _default: kafka-kafka-contour-tls
-                -----BEGIN CERTIFICATE-----
+            secretKey: "ca.crt"
-                MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-                MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-                MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-                tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-                h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-                k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-                GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-                zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-                Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-                A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-                vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-                OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-                fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-                ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-                0FC16VuidLG0HUCCawFjRiAg9rIA
-                -----END CERTIFICATE-----
 
         podAnnotations:
           _default:

apps/iam/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:production_786e19c3
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
           pullPolicy:
             _default: IfNotPresent
 
@@ -158,6 +158,22 @@ spec:
           - name: KAFKA_TOPIC_COMPANY_RESOURCE_PERMISSIONS
             value:
               _default: "company_resource_permissions"
+          - name: AUTH_ENABLED
+            value:
+              _default: "true"
+
+          - name: ZITADEL_ENABLED
+            value:
+              _default: "false"
+
+          - name: ZITADEL_ORG_RULES_FILE
+            value:
+              _default: "config/zitadel/org-rules-prod.json"
+
+          - name: KAFKA_TOPIC_LEGACY_AMS_SYNC
+            value:
+              _default: "ams-sync"
+
         secretEnvs:
           - name: DB_DSN
             secretName:

apps/iam/uralkal/backend-s3.yaml

@@ -57,6 +57,10 @@ spec:
             value:
               _default: "iam"
 
+          - name: ZITADEL_TLS_INSECURE_SKIP_VERIFY
+            value:
+              _default: "true"
+
           - name: S3_REGION
             value:
               _default: "ru-central1"

apps/inspections/brusnika-stage/backend.yaml

@@ -130,6 +130,94 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
+          - name: DEBUG
+            value:
+              _default: "false"
+
+          - name: HTTP_APP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: "/inspections"
+
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "3"
+
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: "hello@sarex.io"
+
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: "https://test.sarex.brusnika.tech"
+
+          - name: SAREX_BACKEND_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav"
+
+          - name: EAV_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: WORKFLOWS_EMAIL_DOCKER_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/notification:email"
+
+          - name: MOBILE_APP_CURRENT_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_RECOMMENDED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_REQUIRED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MAILER_URL
+            value:
+              _default: "http://mailer-service.mailer:8000"
+
+          - name: MAILER_TIMEOUT
+            value:
+              _default: "30"
+
         secretEnvs:
           - name: DATABASE_USER
             secretName:

apps/issues/brusnika-stage/backend.yaml

@@ -176,6 +176,10 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID
             secretName:

apps/issues/brusnika-stage/celery.yaml

@@ -187,6 +187,18 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
+          - name: USE_NOTIFICATIONS
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID
             secretName:

apps/issues/uralkal/backend-s3.yaml

@@ -49,11 +49,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              configMap:
+              secret:
-                name:
+                secretName:
-                  _default: kafka-ca-cert
+                  _default: kafka-kafka-contour-tls
                 items:
-                  - key: kafka.crt
+                  - key: ca.crt
                     path:
                       _default: kafka.crt
 

apps/issues/uralkal/celery-s3.yaml

@@ -49,11 +49,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              configMap:
+              secret:
-                name:
+                secretName:
-                  _default: kafka-ca-cert
+                  _default: kafka-kafka-contour-tls
                 items:
-                  - key: kafka.crt
+                  - key: ca.crt
                     path:
                       _default: kafka.crt
 

apps/issues/uralkal/kafka-ca-configmap.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-ca-cert
-  namespace: issues
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-    0FC16VuidLG0HUCCawFjRiAg9rIA
-    -----END CERTIFICATE-----

apps/issues/uralkal/kustomization.yaml

@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
-  - kafka-ca-configmap.yaml
 patches:
   - path: backend-s3.yaml
     target:

apps/message-hub/uralkal/kafka-ca-configmap.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-ca-cert
-  namespace: message-hub
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-    0FC16VuidLG0HUCCawFjRiAg9rIA
-    -----END CERTIFICATE-----

apps/message-hub/uralkal/kustomization.yaml

@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
-  - kafka-ca-configmap.yaml
 patches:
   - path: message-hub.yaml
     target:

apps/message-hub/uralkal/message-hub.yaml

@@ -91,11 +91,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              configMap:
+              secret:
-                name:
+                secretName:
-                  _default: kafka-ca-cert
+                  _default: kafka-kafka-contour-tls
                 items:
-                  - key: kafka.crt
+                  - key: ca.crt
                     path:
                       _default: kafka.crt
 
@@ -106,5 +106,5 @@ spec:
               {{- with secret "secrets/data/kafka/apps/pm" -}}
               KAFKA_USERNAME={{ index .Data.data "username" }}
               KAFKA_PASSWORD={{ index .Data.data "password" }}
-              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
+              KAFKA_SASL_MECHANISM={{ if .Data.data.auth }}{{ index .Data.data.auth "sasl_mechanism" }}{{ else }}{{ index .Data.data "sasl_mechanism" }}{{ end }}
               {{- end -}}

apps/pm/uralkal/backend.yaml

@@ -182,11 +182,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              configMap:
+              secret:
-                name:
+                secretName:
-                  _default: kafka-ca-cert
+                  _default: kafka-kafka-contour-tls
                 items:
-                  - key: kafka.crt
+                  - key: ca.crt
                     path:
                       _default: kafka.crt
 
@@ -204,7 +204,7 @@ spec:
             vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm
             vault.hashicorp.com/agent-inject-template-pm-kafka: |-
               {{- with secret "secrets/data/kafka/apps/pm" -}}
-              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
+              KAFKA_SASL_MECHANISM={{ if .Data.data.auth }}{{ index .Data.data.auth "sasl_mechanism" }}{{ else }}{{ index .Data.data "sasl_mechanism" }}{{ end }}
               KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
               KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
               {{- end -}}

apps/pm/uralkal/celery.yaml

@@ -191,11 +191,11 @@ spec:
                 _default: kafka.crt
               readOnly:
                 _default: true
-              configMap:
+              secret:
-                name:
+                secretName:
-                  _default: kafka-ca-cert
+                  _default: kafka-kafka-contour-tls
                 items:
-                  - key: kafka.crt
+                  - key: ca.crt
                     path:
                       _default: kafka.crt
 
@@ -215,7 +215,7 @@ spec:
             vault.hashicorp.com/agent-inject-secret-pm-kafka: secrets/data/kafka/apps/pm
             vault.hashicorp.com/agent-inject-template-pm-kafka: |-
               {{- with secret "secrets/data/kafka/apps/pm" -}}
-              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
+              KAFKA_SASL_MECHANISM={{ if .Data.data.auth }}{{ index .Data.data.auth "sasl_mechanism" }}{{ else }}{{ index .Data.data "sasl_mechanism" }}{{ end }}
               KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
               KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
               {{- end -}}

apps/pm/uralkal/kafka-ca-configmap.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-ca-cert
-  namespace: pm
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-    0FC16VuidLG0HUCCawFjRiAg9rIA
-    -----END CERTIFICATE-----

apps/pm/uralkal/kustomization.yaml

@@ -3,7 +3,6 @@ kind: Kustomization
 resources:
   - ../base
   - redis.yaml
-  - kafka-ca-configmap.yaml
 patches:
   - path: backend.yaml
     target:

apps/rfi/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:dev4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d
           pullPolicy:
             _default: IfNotPresent
 
@@ -102,7 +102,7 @@ spec:
 
           - name: NOTIFICATIONS_SERVICE_URL
             value:
-              _default: "https://lk.srx.wb.ru:30443/rfi"
+              _default: "https://test.sarex.brusnika.tech"
 
           - name: SAREX_BACKEND_URL
             value:
@@ -131,6 +131,10 @@ spec:
           - name: DB_PORT
             value:
               _default: "5432"
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: DJANGO_SECRET_KEY
             secretName:

apps/transmittal/brusnika-stage/backend.yaml

@@ -343,7 +343,7 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
             value:
-              _default: "hello@wb.io"
+              _default: "smtp-relay.gmail.com"
         secretEnvs:
           - name: TRANSMITTAL_SERVICE_DATABASE__USER
             secretName:

apps/transmittal/brusnika-stage/worker.yaml

@@ -334,7 +334,23 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
             value:
-              _default: "hello@wb.io"
+              _default: "smtp-relay.gmail.com"
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_KEEPALIVE_CONNECTIONS
+            value:
+              _default: "5"
+
+          - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__TIMEOUT
+            value:
+              _default: "30"
+
         secretEnvs:
           - name: TRANSMITTAL_SERVICE_DATABASE__USER
             secretName:

clusters/brusnika-prod/infrastructure/clusterissuer-letsencrypt.yaml

@@ -20,6 +20,7 @@ spec:
             - identity.camunda.cde.brusnika.ru
             - jupyter.brusnika.onprem.sarex.io
             - keycloak.camunda.cde.brusnika.ru
+            - minio-console.brusnika.onprem.sarex.io
             - minio.brusnika.onprem.sarex.io
             - openobserve.brusnika.onprem.sarex.io
             - operate.camunda.cde.brusnika.ru

clusters/brusnika-prod/infrastructure/kustomization.yaml

@@ -3,134 +3,21 @@ kind: Kustomization
 resources:
   - ../../../infrastructure/istio-base
   - ../../../infrastructure/istio-pilot
-  - ../../../infrastructure/istio-gateway
+  - ../../../infrastructure/istio-gateway/brusnika-prod
-  - ../../../infrastructure/istio-config
+  - ../../../infrastructure/istio-config/brusnika-prod
-  - ../../../infrastructure/vault
+  - ../../../infrastructure/vault/brusnika-prod
-  - ../../../infrastructure/zitadel
+  - ../../../infrastructure/zitadel/brusnika-prod
-  - ../../../infrastructure/minio
+  - ../../../infrastructure/minio/brusnika-prod
-  - ../../../infrastructure/openobserve
+  - ../../../infrastructure/openobserve/brusnika-prod
-  - ../../../infrastructure/vmstack
+  - ../../../infrastructure/vmstack/brusnika-prod
-  - ../../../infrastructure/prometheus-stack
+  - ../../../infrastructure/prometheus-stack/brusnika-prod
-  - ../../../infrastructure/opentelemetry-operator
+  - ../../../infrastructure/opentelemetry-operator/brusnika-prod
-  - ../../../infrastructure/opentelemetry-collector
+  - ../../../infrastructure/opentelemetry-collector/brusnika-prod
-  - ../../../infrastructure/goalert
+  - ../../../infrastructure/goalert/brusnika-prod
-  - ../../../infrastructure/kafka-exporter
+  - ../../../infrastructure/kafka-exporter/brusnika-prod
-  - ../../../infrastructure/postgres-exporter
+  - ../../../infrastructure/postgres-exporter/brusnika-prod
-  - ../../../infrastructure/pgbouncer
+  - ../../../infrastructure/pgbouncer/brusnika-prod
-  - ./vault-ingress.yaml
   - ./clusterissuer-letsencrypt.yaml
-  - ./node-exporter-vmnodescrape.yaml
-  - ./istio-gateway-stats-scrape.yaml
-  - ./istio-dashboard-compat-vmrule.yaml
   - ./camunda-servicemonitors.yaml
   - ./rabbitmq-exporter.yaml
-  - ./kafka-exporter-yc.yaml
+  - ../../../infrastructure/failed-pod-cleanup/brusnika-prod
-  - ./kafka-exporter-yc-rules.yaml
-  - ./kafka-exporter-yc-dashboard.yaml
-  - ../../../infrastructure/failed-pod-cleanup
-patches:
-  - path: ./patches/istio-gateway.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: ingressgateway
-      namespace: istio-system
-  - path: ./patches/istio-config.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: istio-config
-      namespace: default
-  - path: ./patches/vault.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: vault
-      namespace: vault
-  - path: ./patches/zitadel.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: zitadel
-      namespace: zitadel
-  - path: ./patches/minio.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: minio
-      namespace: minio
-  - path: ./patches/openobserve.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: openobserve
-      namespace: openobserve
-  - path: ./patches/vmstack.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: vmstack
-      namespace: vmstack
-  - path: ./patches/prometheus-stack.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: prometheus-stack
-      namespace: prometheus-stack
-  - path: ./patches/opentelemetry-operator.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: opentelemetry-operator
-      namespace: opentelemetry-operator
-  - path: ./patches/opentelemetry-collector.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: opentelemetry-collector
-      namespace: opentelemetry-collector
-  - path: ./patches/goalert.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: goalert
-      namespace: goalert
-  - path: ./patches/kafka-exporter.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: kafka-exporter
-      namespace: kafka-exporter
-  - path: ./patches/postgres-exporter.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: postgres-exporter
-      namespace: postgres-exporter
-  - path: ./patches/failed-pod-cleanup.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: failed-pod-cleanup
-      namespace: default
-  - path: ./patches/pgbouncer.yaml
-    target:
-      group: helm.toolkit.fluxcd.io
-      version: v2
-      kind: HelmRelease
-      name: pgbouncer
-      namespace: pgbouncer

infrastructure/camunda/uralkal/camunda.yaml

@@ -14,139 +14,169 @@ spec:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: StatefulSet
-              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: batch
               version: v1
               kind: Job
-              namespace: camunda
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-connectors
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-identity
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-operate
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-optimize
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-tasklist
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: Deployment
-              namespace: camunda
               name: camunda-zeebe-gateway
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
           - target:
               group: apps
               version: v1
               kind: StatefulSet
-              namespace: camunda
               name: camunda-zeebe
             patch: |-
               - op: add
                 path: /spec/template/spec/nodeSelector
                 value:
-                  dedicated: generic
+                  dedicated: processing
               - op: add
                 path: /spec/template/spec/tolerations
-                value: []
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
   values:
     global:
       vault:

infrastructure/failed-pod-cleanup/brusnika-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./failed-pod-cleanup.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: failed-pod-cleanup
+      namespace: default

infrastructure/goalert/brusnika-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./goalert.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: goalert
+      namespace: goalert

infrastructure/istio-config/brusnika-prod/istio-config.yaml

@@ -103,6 +103,13 @@ spec:
               issuerRef:
                 name: letsencrypt
                 kind: ClusterIssuer
+            minio-console-tls:
+              namespace: ingress-nginx
+              dnsNames:
+                - minio-console.brusnika.onprem.sarex.io
+              issuerRef:
+                name: letsencrypt
+                kind: ClusterIssuer
             projects-secret-name:
               namespace: ingress-nginx
               dnsNames:
@@ -278,6 +285,16 @@ spec:
                     - minio.brusnika.onprem.sarex.io
                   tls:
                     credentialName: brusnika-secret-name
+            minio-console:
+              name: minio-console-gw
+              namespace: ingress-nginx
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - minio-console.brusnika.onprem.sarex.io
+                  tls:
+                    credentialName: minio-console-tls
             sso-check:
               name: sso-check-gw
               namespace: ingress-nginx
@@ -526,10 +543,554 @@ spec:
                     prefix: /integration/
                   service: yet-another-nginx-service.global-ingress.svc.cluster.local
                   port: 80
+                - path:
+                    prefix: /checklists/admin/
+                  service: backend-service.checklist.svc.cluster.local
+                  port: 8000
+                - path:
+                    prefix: /checklists/api/
+                  rewrite: /api/
+                  service: backend-service.checklist.svc.cluster.local
+                  port: 8000
                 - path:
                     prefix: /
                   service: nginx-service.global-ingress.svc.cluster.local
                   port: 80
+            projects-frontend:
+              namespace: projects
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /projects/static/
+                  rewrite: /
+                  service: frontend-service.projects.svc.cluster.local
+                  port: 8000
+            transmittal-frontend-static:
+              namespace: transmittal
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /transmittal/static/
+                  rewrite: /
+                  service: transmittal-frontend-static.transmittal.svc.cluster.local
+                  port: 80
+            flows-frontend:
+              namespace: flows
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /flows/static/
+                  rewrite: /
+                  service: frontend-service.flows.svc.cluster.local
+                  port: 80
+            reviews-frontend:
+              namespace: reviews
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /reviews/static/
+                  rewrite: /
+                  service: frontend-service.reviews.svc.cluster.local
+                  port: 80
+            documentation-frontend-static:
+              namespace: documentations
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /documentations/static/
+                  rewrite: /
+                  service: documentation-frontend-static-service.documentations.svc.cluster.local
+                  port: 80
+            inspections-frontend:
+              namespace: inspections
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /inspections/static/
+                  rewrite: /
+                  service: frontend-service.inspections.svc.cluster.local
+                  port: 80
+            comparisons-static:
+              namespace: comparisons
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /comparisons/static/
+                  rewrite: /
+                  service: comparisons-service.comparisons.svc.cluster.local
+                  port: 8080
+            notes-frontend:
+              namespace: notes
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /notes/static/
+                  rewrite: /
+                  service: frontend-service.notes.svc.cluster.local
+                  port: 8080
+            transmittal-api-virt-service:
+              namespace: transmittal
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /transmittals/api/
+                  rewrite: /api/
+                  service: transmittal-service.transmittal.svc.cluster.local
+                  port: 80
+            inspections-backend:
+              namespace: inspections
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /inspections/api/
+                  rewrite: /api/
+                  service: backend-service.inspections.svc.cluster.local
+                  port: 8000
+            workflows-api:
+              namespace: workflow
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /workflows/api/
+                  rewrite: /api/
+                  service: workflows-api-service.workflow.svc.cluster.local
+                  port: 8000
+            workspaces-api:
+              namespace: workspaces
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /workspaces/api/
+                  rewrite: /api/
+                  service: workspaces-service.workspaces.svc.cluster.local
+                  port: 8000
+            bim-backend-v2:
+              namespace: bim
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /bimv2/api/
+                  rewrite: /api/
+                  service: backend-service.bim.svc.cluster.local
+                  port: 8000
+            notes-backend:
+              namespace: notes
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /notes/api/
+                  rewrite: /api/
+                  service: backend-service.notes.svc.cluster.local
+                  port: 8000
+            mapper-backend:
+              namespace: mapper
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /mapper/api/
+                  rewrite: /api/
+                  service: backend-service.mapper.svc.cluster.local
+                  port: 8000
+            eav:
+              namespace: eav
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /eav/api/
+                  rewrite: /api/
+                  service: eav-service.eav.svc.cluster.local
+                  port: 8000
+                - path:
+                    prefix: /eav/admin/
+                  service: eav-service.eav.svc.cluster.local
+                  port: 8000
+            comparisons-backend:
+              namespace: comparisons
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /comparisons/api/
+                  rewrite: /api/
+                  service: backend-service.comparisons.svc.cluster.local
+                  port: 80
+            django-media:
+              namespace: django
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /media/
+                  rewrite: /
+                  service: s3-proxy-service.django.svc.cluster.local
+                  port: 80
+            resources:
+              namespace: resources
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /resources/
+                  rewrite: /
+                  service: resources-service.resources.svc.cluster.local
+                  port: 8000
+                - path:
+                    prefix: /res-admin/
+                  service: resources-service.resources.svc.cluster.local
+                  port: 8000
+                - path:
+                    prefix: /resource-management/
+                  service: resources-service.resources.svc.cluster.local
+                  port: 8000
+            srx-admin:
+              namespace: django
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /control-interface/
+                  rewrite: /
+                  service: srx-admin-svc.django.svc.cluster.local
+                  port: 8080
+            administration-users:
+              namespace: django
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /administration/users
+                  service: frontend-service.django.svc.cluster.local
+                  port: 80
+            cde:
+              namespace: orchestrator
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              routes:
+                - path:
+                    prefix: /orchestrator/
+                  rewrite: /api/
+                  service: cde.orchestrator.svc.cluster.local
+                  port: 8080
+            pdm-api-api:
+              namespace: documentations
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+              headers:
+                request:
+                  remove:
+                    - Cookie
+              routes:
+                - path:
+                    prefix: /gateway/api/
+                  rewrite: /api/
+                  service: pdm-api.documentations.svc.cluster.local
+                  port: 8080
+            documentations:
+              namespace: documentations
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+                extraAllowMethods:
+                  - HEAD
+                extraAllowHeaders:
+                  - Range
+                  - Cache-Control
+              routes:
+                - path:
+                    prefix: /documentations/api/
+                  rewrite: /api/
+                  service: documentations-api.documentations.svc.cluster.local
+                  port: 8080
+                - path:
+                    prefix: /files/api/
+                  rewrite: /api/
+                  service: documentations-filestream.documentations.svc.cluster.local
+                  port: 8080
+            issues-vs:
+              namespace: issues
+              hosts:
+                - cde.brusnika.ru
+              gateways:
+                - ingress-nginx/global-cde-gw
+              cors:
+                allowCredentials: true
+                allowOrigins:
+                  - exact: https://cde.brusnika.ru
+                  - exact: https://stamp-verification.cde.brusnika.ru
+                  - exact: https://document-link.cde.brusnika.ru
+              routes:
+                - path:
+                    prefix: /issues-management/
+                  service: issues-service.issues.svc.cluster.local
+                  port: 80
+                - path:
+                    prefix: /issues/api/
+                  rewrite: /api/
+                  service: issues-service.issues.svc.cluster.local
+                  port: 80
+                - path:
+                    prefix: /issues/static/
+                  rewrite: /
+                  service: static-service.issues.svc.cluster.local
+                  port: 80
+                - path:
+                    prefix: /remarks/static/
+                  rewrite: /
+                  service: remarks-static.issues.svc.cluster.local
+                  port: 80
             jupyter-vs:
               namespace: jupyter
               hosts:
@@ -580,7 +1141,28 @@ spec:
                 - ingress-nginx/minio-gw
               cors:
                 allowOrigins:
-                  - regex: ".*"
+                  - exact: https://minio.brusnika.onprem.sarex.io
+              routes:
+                - match:
+                    - port: 80
+                      uri:
+                        prefix: /
+                  redirect:
+                    scheme: https
+                    redirectCode: 308
+                - path:
+                    prefix: /
+                  service: minio.minio.svc.cluster.local
+                  port: 9000
+            minio-console-vs:
+              namespace: minio
+              hosts:
+                - minio-console.brusnika.onprem.sarex.io
+              gateways:
+                - ingress-nginx/minio-console-gw
+              cors:
+                allowOrigins:
+                  - exact: https://minio-console.brusnika.onprem.sarex.io
               routes:
                 - match:
                     - port: 80

infrastructure/istio-config/brusnika-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./istio-config.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: istio-config
+      namespace: default

infrastructure/istio-config/brusnika-stage/istio-config.yaml

@@ -469,6 +469,212 @@ spec:
                     prefix: /
                   service: gitea.gitea.svc.cluster.local
                   port: 3000
+            workflows-static-vs:
+              namespace: workflow
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /static/workflows/
+                  rewrite: /
+                  service: frontend-service.workflow.svc.cluster.local
+                  port: 8080
+            workspaces-v2-static-vs:
+              namespace: workspaces
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /static/workspaces-v2/
+                  rewrite: /
+                  service: workspaces-v2-frontend-static-service.workspaces.svc.cluster.local
+                  port: 8080
+            checklists-vs:
+              namespace: checklist
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /checklists/admin/
+                  service: backend-service.checklist.svc.cluster.local
+                  port: 8000
+                - path:
+                    prefix: /checklists/api/
+                  rewrite: /api/
+                  service: backend-service.checklist.svc.cluster.local
+                  port: 8000
+            res-admin-vs:
+              namespace: resources
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /res-admin/
+                  service: resources-service.resources.svc.cluster.local
+                  port: 8000
+            inspections-vs:
+              namespace: inspections
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /inspections/static/
+                  rewrite: /
+                  service: frontend-service.inspections.svc.cluster.local
+                  port: 80
+                - path:
+                    prefix: /inspections/api/
+                  rewrite: /api/
+                  service: inspections-service.inspections.svc.cluster.local
+                  port: 80
+            workflows-api-vs:
+              namespace: workflow
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /workflows/api/
+                  rewrite: /api/
+                  service: workflows-api-service.workflow.svc.cluster.local
+                  port: 8000
+            workspaces-api-vs:
+              namespace: workspaces
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /workspaces/api/
+                  rewrite: /api/
+                  service: workspaces-service.workspaces.svc.cluster.local
+                  port: 8000
+            global-media-vs:
+              namespace: django
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /media/
+                  rewrite: /
+                  service: s3-proxy-service.django.svc.cluster.local
+                  port: 80
+            remarks-static-vs:
+              namespace: issues
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /remarks/static/
+                  rewrite: /
+                  service: remarks-static.issues.svc.cluster.local
+                  port: 80
+            global-resources-vs:
+              namespace: resources
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /resources/
+                  rewrite: /
+                  service: resources-service.resources.svc.cluster.local
+                  port: 8000
+            comparisons-vs:
+              namespace: comparisons
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /comparisons/static/
+                  rewrite: /
+                  service: comparisons-service.comparisons.svc.cluster.local
+                  port: 8080
+                - path:
+                    prefix: /comparisons/api/
+                  rewrite: /api/
+                  service: backend-service.comparisons.svc.cluster.local
+                  port: 80
+            administration-users-vs:
+              namespace: django
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /administration/users
+                  service: frontend-service.django.svc.cluster.local
+                  port: 80
+            orchestrator-vs:
+              namespace: orchestrator
+              hosts:
+                - test.sarex.brusnika.tech
+              gateways:
+                - ingress-nginx/main-gateway
+              cors:
+                allowOrigins:
+                  - regex: ".*"
+              routes:
+                - path:
+                    prefix: /orchestrator/
+                  service: cde.orchestrator.svc.cluster.local
+                  port: 8080
             global-test-vs:
               namespace: global-ingress
               hosts:
@@ -982,19 +1188,19 @@ spec:
                   service: workspaces-service.workspaces.svc.cluster.local
                   port: 8000
 
-#            vs-resources-admin:
+            vs-resources-admin:
-#              namespace: ingress-nginx
+              namespace: ingress-nginx
-#              hosts:
+              hosts:
-#                - test.sarex.brusnika.tech
+                - test.sarex.brusnika.tech
-#              gateways:
+              gateways:
-#                - ingress-nginx/main-gateway
+                - ingress-nginx/main-gateway
-#              routes:
+              routes:
-#                - match:
+                - match:
-#                    - uri:
+                    - uri:
-#                        prefix: /resource-management
+                        prefix: /resource-management
-#                  rewrite: /resource-management
+                  rewrite: /resource-management
-#                  service: resources-service.resources.svc.cluster.local
+                  service: resources-service.resources.svc.cluster.local
-#                  port: 8000
+                  port: 8000
 
 #            vs-workspaces-frontend-v2:
 #              namespace: ingress-nginx

infrastructure/istio-config/vad/istio-config.yaml

@@ -399,6 +399,19 @@ spec:
                   rewrite: /
                   service: frontend-svc.control-interface.svc.cluster.local
                   port: 8080
+            admin-frontend:
+              name: admin-frontend-virt-service
+              namespace: default
+              hosts:
+                - sarex.vadroad.ru
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /admin-frontend/static/
+                  rewrite: /
+                  service: admin-frontend-svc.control-interface.svc.cluster.local
+                  port: 8080
             s3-proxy-media:
               name: s3-proxy-media-virt-service
               namespace: default

infrastructure/istio-gateway/brusnika-prod/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - ./istio-gateway-stats-scrape.yaml
+  - ./istio-dashboard-compat-vmrule.yaml
+patches:
+  - path: ./istio-gateway.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: ingressgateway
+      namespace: istio-system

infrastructure/kafka-exporter/brusnika-prod/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - ./kafka-exporter-yc.yaml
+  - ./kafka-exporter-yc-rules.yaml
+  - ./kafka-exporter-yc-dashboard.yaml
+patches:
+  - path: ./kafka-exporter.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: kafka-exporter
+      namespace: kafka-exporter

infrastructure/minio/brusnika-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./minio.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: minio
+      namespace: minio

infrastructure/minio/brusnika-prod/minio.yaml

@@ -11,7 +11,7 @@ spec:
     mode: standalone
     environment:
       MINIO_SERVER_URL: "https://minio.brusnika.onprem.sarex.io"
-      MINIO_BROWSER_REDIRECT_URL: "https://minio.brusnika.onprem.sarex.io/console/"
+      MINIO_BROWSER_REDIRECT_URL: "https://minio-console.brusnika.onprem.sarex.io"
       MINIO_API_CORS_ALLOW_ORIGIN: "https://minio.brusnika.onprem.sarex.io"
     imagePullSecrets:
       - name: regcred

infrastructure/openobserve/brusnika-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./openobserve.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: openobserve
+      namespace: openobserve

infrastructure/opentelemetry-collector/brusnika-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./opentelemetry-collector.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: opentelemetry-collector
+      namespace: opentelemetry-collector

infrastructure/opentelemetry-operator/brusnika-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./opentelemetry-operator.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: opentelemetry-operator
+      namespace: opentelemetry-operator

infrastructure/pgbouncer/brusnika-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./pgbouncer.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: pgbouncer
+      namespace: pgbouncer

infrastructure/postgres-exporter/brusnika-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./postgres-exporter.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: postgres-exporter
+      namespace: postgres-exporter

infrastructure/prometheus-stack/brusnika-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./prometheus-stack.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: prometheus-stack
+      namespace: prometheus-stack

infrastructure/vault/brusnika-prod/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - ./vault-ingress.yaml
+patches:
+  - path: ./vault.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: vault
+      namespace: vault

infrastructure/vmstack/brusnika-prod/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - ./node-exporter-vmnodescrape.yaml
+patches:
+  - path: ./vmstack.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: vmstack
+      namespace: vmstack

infrastructure/zitadel/brusnika-prod/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: ./zitadel.yaml
+    target:
+      group: helm.toolkit.fluxcd.io
+      version: v2
+      kind: HelmRelease
+      name: zitadel
+      namespace: zitadel