Merge branch 'master' of gitlab.sarex.io:infra/iac into aero

# Conflicts:
#	.gitignore

.gitignore

@@ -4,10 +4,5 @@ CLAUDE.md
 .env
 
 tmp
+.tmp/
 snapshots/*
-k3s/*
-k3s-master/*
-
-# самоподписанные TLS-сертификаты
-nginx/certs/*.crt
-nginx/certs/*.key

apps/checklists/base/backend-deployment.yaml

@@ -1,80 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: checklists-backend
-  namespace: checklists
-  labels:
-    app: checklists-backend
-    service: api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: checklists-backend
-  template:
-    metadata:
-      labels:
-        app: checklists-backend
-        service: checklists-backend
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: checklists
-        vault.hashicorp.com/agent-inject-secret-checklists-db: secrets/data/postgresql/apps/checklists
-        vault.hashicorp.com/agent-inject-template-checklists-db: |-
-          {{- with secret "secrets/data/postgresql/apps/checklists" -}}
-          DATABASE_HOST=postgresql.checklists.svc.cluster.local
-          DATABASE_PORT=5432
-          DATABASE_NAME=checklists_db
-          DATABASE_USER={{ index .Data.data "username" }}
-          DATABASE_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-checklists-jwt-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-checklists-jwt-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: checklists-vault
-      containers:
-        - name: api
-          image: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/bash", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/checklists-db ] && . /vault/secrets/checklists-db
-              [ -f /vault/secrets/checklists-jwt-public ] && export JWT_AUTH_PUBLIC_KEY="$(cat /vault/secrets/checklists-jwt-public)"
-              set +a
-              exec ./entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: HTTP_APP_HOST
-              value: 0.0.0.0
-            - name: HTTP_APP_PORT
-              value: "8000"
-            - name: HTTP_APP_ROOT_PATH
-              value: /checklists
-            - name: HTTP_APP_WORKERS
-              value: "1"
-            - name: HTTP_APP_ADMIN_ENABLE
-              value: "true"
-            - name: JWT_AUTH_ENABLE
-              value: "true"
-            - name: DEBUG
-              value: "false"
-
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/checklists/base/backend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: rfi-backend-api-svc
-  namespace: checklists
-spec:
-  type: ClusterIP
-  selector:
-    app: checklists-backend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8000
-      protocol: TCP

apps/checklists/base/helmrelease.yaml

@@ -0,0 +1,124 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: checklists
+  namespace: checklists
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      checklists:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: checklists-vault
+        deployment:
+          enabled: true
+          name:
+            _default: checklists-backend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/bash", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/checklists-db ] && . /vault/secrets/checklists-db
+                [ -f /vault/secrets/checklists-jwt-public ] && export JWT_AUTH_PUBLIC_KEY="$(cat /vault/secrets/checklists-jwt-public)"
+                set +a
+                exec ./entrypoint.sh
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: rfi-backend-api-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8000
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: HTTP_APP_HOST
+            value:
+              _default: "0.0.0.0"
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: /checklists
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "1"
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+          - name: DEBUG
+            value:
+              _default: "false"
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: checklists
+            vault.hashicorp.com/agent-inject-secret-checklists-db: secrets/data/apps/checklists/postgres
+            vault.hashicorp.com/agent-inject-template-checklists-db: |-
+              {{- with secret "secrets/data/apps/checklists/postgres" -}}
+              DATABASE_HOST={{ index .Data.data "host" }}
+              DATABASE_PORT={{ index .Data.data "port" }}
+              DATABASE_NAME={{ index .Data.data "database" }}
+              DATABASE_USER={{ index .Data.data "username" }}
+              DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-checklists-jwt-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-checklists-jwt-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}

apps/checklists/base/kustomization.yaml

@@ -4,6 +4,4 @@ kind: Kustomization
 namespace: checklists
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
-  - backend-deployment.yaml 
-  - backend-service.yaml
+  - helmrelease.yaml

apps/checklists/base/namespace.yaml

@@ -5,3 +5,4 @@ metadata:
   name: checklists
   labels:
     istio-injection: enabled
+    security.deckhouse.io/pod-policy: privileged

apps/checklists/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: checklists-vault
-  namespace: checklists

apps/checklists/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: checklists
+resources:
+  - ../base

apps/contracts/base/deployment.yaml

@@ -1,89 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backend
-  namespace: contracts
-  labels:
-    app: backend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: backend
-  template:
-    metadata:
-      labels:
-        app: backend
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: contracts
-        vault.hashicorp.com/agent-inject-secret-contracts-db: secrets/data/postgresql/apps/contracts
-        vault.hashicorp.com/agent-inject-template-contracts-db: |-
-          {{- with secret "secrets/data/postgresql/apps/contracts" -}}
-          DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@postgresql.contracts.svc.cluster.local:5432/contracts_db?sslmode=disable
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-contracts-jwt-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-contracts-jwt-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-contracts-rabbitmq: secrets/data/rabbitmq/apps/contracts
-        vault.hashicorp.com/agent-inject-template-contracts-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/contracts" -}}
-          CONTRACTS_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
-          CONTRACTS_RABBITMQ_USERNAME={{ index .Data.data "username" }}
-          CONTRACTS_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
-          CONTRACTS_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
-          CONTRACTS_RABBITMQ_PORT=5672
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-contracts-s3: secrets/data/minio/apps/contracts
-        vault.hashicorp.com/agent-inject-template-contracts-s3: |-
-          {{- with secret "secrets/data/minio/apps/contracts" -}}
-          CONTRACTS_S3_ENDPOINT={{ index .Data.data.client "endpoint" }}
-          CONTRACTS_S3_REGION={{ index .Data.data.client "region" }}
-          CONTRACTS_S3_BUCKET=contracts
-          CONTRACTS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          CONTRACTS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-contracts-kafka: secrets/data/kafka/apps/contracts
-        vault.hashicorp.com/agent-inject-template-contracts-kafka: |-
-          {{- with secret "secrets/data/kafka/apps/contracts" -}}
-          CONTRACTS_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }}
-          CONTRACTS_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
-          CONTRACTS_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
-          CONTRACTS_KAFKA_USERNAME={{ index .Data.data "username" }}
-          CONTRACTS_KAFKA_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: contracts-vault
-      containers:
-        - name: backend
-          image: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/contracts-db ] && . /vault/secrets/contracts-db
-              [ -f /vault/secrets/contracts-jwt-public ] && export PUBLIC_KEY="$(cat /vault/secrets/contracts-jwt-public)"
-              [ -f /vault/secrets/contracts-rabbitmq ] && . /vault/secrets/contracts-rabbitmq
-              [ -f /vault/secrets/contracts-s3 ] && . /vault/secrets/contracts-s3
-              [ -f /vault/secrets/contracts-kafka ] && . /vault/secrets/contracts-kafka
-              set +a
-              exec /usr/local/bin/http
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: ADDRESS
-              value: ":8000"
-            - name: ENABLE_SSL
-              value: "false"
-      imagePullSecrets:
-        - name: regcred

apps/contracts/base/helmrelease.yaml

@@ -0,0 +1,129 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: contracts
+  namespace: contracts
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      contracts:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: contracts-vault
+        deployment:
+          enabled: true
+          name:
+            _default: backend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/contracts-db ] && . /vault/secrets/contracts-db
+                [ -f /vault/secrets/contracts-jwt-public ] && export PUBLIC_KEY="$(cat /vault/secrets/contracts-jwt-public)"
+                [ -f /vault/secrets/contracts-rabbitmq ] && . /vault/secrets/contracts-rabbitmq
+                [ -f /vault/secrets/contracts-s3 ] && . /vault/secrets/contracts-s3
+                [ -f /vault/secrets/contracts-kafka ] && . /vault/secrets/contracts-kafka
+                set +a
+                exec /usr/local/bin/http
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: backend-service
+          type:
+            _default: ClusterIP
+          port:
+            _default: 8000
+          targetPort:
+            _default: 8000
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: ADDRESS
+            value:
+              _default: ":8000"
+          - name: ENABLE_SSL
+            value:
+              _default: "false"
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: contracts
+            vault.hashicorp.com/agent-inject-secret-contracts-db: secrets/data/postgresql/apps/contracts
+            vault.hashicorp.com/agent-inject-template-contracts-db: |-
+              {{- with secret "secrets/data/postgresql/apps/contracts" -}}
+              DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@postgresql.contracts.svc.cluster.local:5432/contracts_db?sslmode=disable
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-contracts-jwt-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-contracts-jwt-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-contracts-rabbitmq: secrets/data/rabbitmq/apps/contracts
+            vault.hashicorp.com/agent-inject-template-contracts-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/contracts" -}}
+              CONTRACTS_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
+              CONTRACTS_RABBITMQ_USERNAME={{ index .Data.data "username" }}
+              CONTRACTS_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
+              CONTRACTS_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
+              CONTRACTS_RABBITMQ_PORT=5672
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-contracts-s3: secrets/data/minio/apps/contracts
+            vault.hashicorp.com/agent-inject-template-contracts-s3: |-
+              {{- with secret "secrets/data/minio/apps/contracts" -}}
+              CONTRACTS_S3_ENDPOINT={{ index .Data.data.client "endpoint" }}
+              CONTRACTS_S3_REGION={{ index .Data.data.client "region" }}
+              CONTRACTS_S3_BUCKET=contracts
+              CONTRACTS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              CONTRACTS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-contracts-kafka: secrets/data/kafka/apps/contracts
+            vault.hashicorp.com/agent-inject-template-contracts-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/contracts" -}}
+              CONTRACTS_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }}
+              CONTRACTS_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
+              CONTRACTS_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
+              CONTRACTS_KAFKA_USERNAME={{ index .Data.data "username" }}
+              CONTRACTS_KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}

apps/contracts/base/kustomization.yaml

@@ -4,6 +4,4 @@ kind: Kustomization
 namespace: contracts
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
-  - deployment.yaml
-  - service.yaml
+  - helmrelease.yaml

apps/contracts/base/namespace.yaml

@@ -5,3 +5,4 @@ metadata:
   name: contracts
   labels:
     istio-injection: enabled
+    security.deckhouse.io/pod-policy: privileged

apps/contracts/base/service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-service
-  namespace: contracts
-spec:
-  type: ClusterIP
-  selector:
-    app: backend
-  ports:
-    - name: http
-      port: 8000
-      targetPort: 8000
-      protocol: TCP

apps/contracts/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: contracts-vault
-  namespace: contracts

apps/contracts/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: contracts
+resources:
+  - ../base

apps/control-interface/base/helmrelease.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_feb59026
+            _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_638c3442
           pullPolicy:
             _default: IfNotPresent
 

apps/control-interface/base/kustomization.yaml

@@ -1,6 +1,7 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: django
+namespace: control-interface
 resources:
   - helmrelease.yaml
+

apps/control-interface/d8-ugmk-prod/kustomization.yaml

@@ -1,7 +1,7 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: django
+namespace: control-interface
 resources:
   - ../base
   - namespace.yaml

apps/django/base/backend-deployment.yaml

@@ -1,222 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backend
-  namespace: django
-  labels:
-    app: backend
-    service: backend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: backend
-  template:
-    metadata:
-      labels:
-        app: backend
-        service: backend
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: django
-        vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/postgresql/apps/django
-        vault.hashicorp.com/agent-inject-template-django-postgresql: |-
-          {{- with secret "secrets/data/postgresql/apps/django" -}}
-          DJANGO_POSTGRES_HOST=postgresql.django.svc.cluster.local
-          DJANGO_POSTGRES_PORTS=5432
-          DJANGO_POSTGRES_DATABASE=sarex_db
-          DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
-          DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django
-        vault.hashicorp.com/agent-inject-template-django-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/django" -}}
-          CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
-          CELERY_RABBITMQ_USER={{ index .Data.data "username" }}
-          CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
-          CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
-          DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local
-          DJANGO_RABBIT_USER={{ index .Data.data "username" }}
-          DJANGO_RABBIT_PASS={{ index .Data.data "password" }}
-          DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django
-        vault.hashicorp.com/agent-inject-template-django-s3: |-
-          {{- with secret "secrets/data/minio/apps/django" }}
-          AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech
-          S3_HOST=https://minio.contour.infra.sarex.tech
-          {{- $buckets := index .Data.data "buckets" }}
-          S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
-          S3_LOGIN={{ index .Data.data "access_key" }}
-          S3_PASSWORD={{ index .Data.data "secret_key" }}
-          {{- end }}
-        vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django
-        vault.hashicorp.com/agent-inject-template-django-kafka: |-
-          {{- with secret "secrets/data/kafka/apps/django" -}}
-          KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]"
-          KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
-          KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
-          KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
-          KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "private_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-django-common: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: django-vault
-      volumes:
-        - name: django-configmap
-          configMap:
-            name: django-configmap
-            items:
-              - key: production.py
-                path: production.py
-          defaultMode: 420
-        - name: uwsgi-configmap
-          configMap:
-            name: uwsgi-configmap
-            items:
-              - key: uwsgi.ini
-                path: uwsgi.ini
-            defaultMode: 420
-      containers:
-        - name: backend
-          image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
-              [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
-              [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
-              [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka
-              [ -f /vault/secrets/django-common ] && . /vault/secrets/django-common
-              [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
-              [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
-              set +a
-              exec /opt/sarex/entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: ALLOWED_HOSTS
-              value: '*'
-            - name: SERVER_USE_CHANGELOG
-              value: "0"
-            - name: SERVER_ZITADEL_ENABLED
-              value: "True"
-            - name: DJANGO_SETTINGS_MODULE
-              value: config.settings.production
-            - name: CELERY_REDIS_HOST
-              value: redis
-            - name: CELERY_REDIS_PORT
-              value: "6379"
-            - name: DJANGO_REDIS_HOST
-              value: redis
-            - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
-              value: "True"
-            - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
-              value: "True"
-            - name: DJANGO_REDIS_PORT
-              value: "6379"
-            - name: BIMV2_INTERNAL_HOST
-              value: http://bim-backend-v2-service.bim-api
-            - name: BIMV2_TIMEOUT
-              value: "60"
-            - name: JWT_KID
-              value: "1"
-            - name: PDM_SYNC
-              value: "1"
-            - name: KC_SYNC_ENABLE
-              value: "0"
-            - name: MEASUREMENTS_HOST
-              value: http://measurements-service.measurements.svc.cluster.local:8000/api
-            - name: MEASUREMENTS_USE_MEASUREMENTS
-              value: "1"
-            - name: SERVER_API_HOST
-              value: https://sarex.contour.infra.sarex.tech
-            - name: SERVER_HOST
-              value: https://sarex.contour.infra.sarex.tech
-            - name: WORKFLOWS_HOST
-              value: http://backend-svc.processing.svc.cluster.local:80
-            - name: WORKFLOWS_BASE_HOST
-              value: http://backend-svc.django.svc.cluster.local:80
-            - name: WORKFLOWS_PREFIX
-              value: /internal/v1
-            - name: WORKFLOWS_USE
-              value: "1"
-            - name: SERVER_S3_STREAM_IMPORT
-              value: "1"
-            - name: SERVER_SAVE_DIFF_DEM
-              value: "1"
-            - name: SERVER_USE_CLICKHOUSE
-              value: "0"
-            - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
-              value: "0"
-            - name: SERVER_USE_DJANGO_STORAGE
-              value: "1"
-            - name: SERVER_USE_METASHAPE
-              value: "0"
-            - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
-              value: "1"
-            - name: SERVER_CHANGELOG_MODE
-              value: "0"
-            - name: SERVER_DJANGO_URLS
-              value: "1"
-            - name: CHECK_IMPORT_HASH
-              value: "1"
-            - name: EAV_ENABLE
-              value: "1"
-            - name: SERVER_CHECK_IMPORT_HASH
-              value: "1"
-            - name: SERVER_CHUNKED_PATH
-              value: /tmp/chunked_uploads/%Y/%m/%d
-            - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
-              value: "0"
-            - name: SERVER_USE_WRORKFLOW_STATUS
-              value: "1"
-            - name: ZITADEL_HOST
-              value: https://zitadel.contour.infra.sarex.tech
-            - name: SERVER_KAFKA_ENABLED
-              value: "False"
-            - name: KAFKA_TOPICS
-              value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
-            - name: KAFKA_SSL_CAFILE
-              value: /usr/local/share/ca-certificates/kafka.crt
-            - name: KC_USE_REDIRECT_LOGOUT
-              value: "False"
-
-
-
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-          volumeMounts:
-            - name: django-configmap
-              mountPath: /opt/sarex/config/settings/production.py
-              subPath: production.py
-            - name: uwsgi-configmap
-              mountPath: /opt/sarex/uwsgi.ini
-              subPath: uwsgi.ini
-      imagePullSecrets:
-        - name: regcred

apps/django/base/backend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-svc
-  namespace: django
-spec:
-  type: ClusterIP
-  selector:
-    app: backend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8000
-      protocol: TCP

apps/django/base/backend.yaml

@@ -0,0 +1,312 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: django
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: django-vault
+        deployment:
+          enabled: true
+          name:
+            _default: backend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
+                [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
+                [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
+                [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka
+                [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
+                [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
+                set +a
+                exec /opt/sarex/entrypoint.sh
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_f813140d
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: backend-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8000
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        volumes:
+          _default:
+            - name: django-configmap
+              mountPath:
+                _default: /opt/sarex/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+        envs:
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "0"
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "True"
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: redis
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: redis
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: http://bim-backend-v2-service.bim-api
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+          - name: JWT_KID
+            value:
+              _default: "1"
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+          - name: SERVER_API_HOST
+            value:
+              _default: https://sarex.contour.infra.sarex.tech
+          - name: SERVER_HOST
+            value:
+              _default: https://sarex.contour.infra.sarex.tech
+          - name: WORKFLOWS_HOST
+            value:
+              _default: http://backend-svc.processing.svc.cluster.local:80
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: WORKFLOWS_PREFIX
+            value:
+              _default: /internal/v1
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+          - name: SERVER_SAVE_DIFF_DEM
+            value:
+              _default: "1"
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "1"
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "0"
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: /tmp/chunked_uploads/%Y/%m/%d
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+          - name: ZITADEL_HOST
+            value:
+              _default: https://zitadel.contour.infra.sarex.tech
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "False"
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: /usr/local/share/ca-certificates/kafka.crt
+          - name: KC_USE_REDIRECT_LOGOUT
+            value:
+              _default: "False"
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: django
+            vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres
+            vault.hashicorp.com/agent-inject-template-django-postgresql: |-
+              {{- with secret "secrets/data/apps/django/postgres" -}}
+              DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
+              DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }}
+              DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
+              DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
+              DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django
+            vault.hashicorp.com/agent-inject-template-django-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/django" -}}
+              CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
+              CELERY_RABBITMQ_USER={{ index .Data.data "username" }}
+              CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
+              CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
+              DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local
+              DJANGO_RABBIT_USER={{ index .Data.data "username" }}
+              DJANGO_RABBIT_PASS={{ index .Data.data "password" }}
+              DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django
+            vault.hashicorp.com/agent-inject-template-django-s3: |-
+              {{- with secret "secrets/data/minio/apps/django" }}
+              AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech
+              S3_HOST=https://minio.contour.infra.sarex.tech
+              {{- $buckets := index .Data.data "buckets" }}
+              S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              S3_LOGIN={{ index .Data.data "access_key" }}
+              S3_PASSWORD={{ index .Data.data "secret_key" }}
+              {{- end }}
+            vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django
+            vault.hashicorp.com/agent-inject-template-django-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/django" -}}
+              KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]"
+              KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
+              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
+              KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
+              KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "private_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-django-common: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }}
+              {{- end -}}

apps/django/base/celery-deployment.yaml

@@ -1,204 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: celery
-  namespace: django
-  labels:
-    app: celery
-    service: celery
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: celery
-  template:
-    metadata:
-      labels:
-        app: celery
-        service: celery
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: django
-        vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/postgresql/apps/django
-        vault.hashicorp.com/agent-inject-template-django-postgresql: |-
-          {{- with secret "secrets/data/postgresql/apps/django" -}}
-          DJANGO_POSTGRES_HOST=postgresql.django.svc.cluster.local
-          DJANGO_POSTGRES_PORTS=5432
-          DJANGO_POSTGRES_DATABASE=sarex_db
-          DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
-          DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django
-        vault.hashicorp.com/agent-inject-template-django-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/django" -}}
-          CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
-          CELERY_RABBITMQ_USER={{ index .Data.data "username" }}
-          CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
-          CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
-          DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local
-          DJANGO_RABBIT_USER={{ index .Data.data "username" }}
-          DJANGO_RABBIT_PASS={{ index .Data.data "password" }}
-          DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django
-        vault.hashicorp.com/agent-inject-template-django-s3: |-
-          {{- with secret "secrets/data/minio/apps/django" -}}
-          AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech
-          S3_HOST=https://minio.contour.infra.sarex.tech
-          {{- $buckets := index .Data.data "buckets" }}
-          S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}django{{- end -}}
-          S3_LOGIN={{ index .Data.data "access_key" }}
-          S3_PASSWORD={{ index .Data.data "secret_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django
-        vault.hashicorp.com/agent-inject-template-django-kafka: |-
-          {{- with secret "secrets/data/kafka/apps/django" -}}
-          KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]"
-          KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
-          KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
-          KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
-          KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "private_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-django-common: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: django-vault
-      volumes:
-        - name: django-configmap
-          configMap:
-            name: django-configmap
-            items:
-              - key: production.py
-                path: production.py
-          defaultMode: 420
-      containers:
-        - name: celery
-          image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
-              [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
-              [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
-              [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka
-              [ -f /vault/secrets/django-common ] && . /vault/secrets/django-common
-              [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
-              [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
-              set +a
-              exec celery -A config worker -B -l info -E -Q default -n default_worker.%h --concurrency=2
-
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: ALLOWED_HOSTS
-              value: '*'
-            - name: SERVER_USE_CHANGELOG
-              value: "0"
-            - name: SERVER_ZITADEL_ENABLED
-              value: "False"
-            - name: DJANGO_SETTINGS_MODULE
-              value: config.settings.production
-            - name: CELERY_REDIS_HOST
-              value: redis
-            - name: CELERY_REDIS_PORT
-              value: "6379"
-            - name: DJANGO_REDIS_HOST
-              value: redis
-            - name: DJANGO_REDIS_PORT
-              value: "6379"
-            - name: BIMV2_INTERNAL_HOST
-              value: http://bim-backend-v2-service.bim-api
-            - name: BIMV2_TIMEOUT
-              value: "60"
-            - name: JWT_KID
-              value: "1"
-            - name: PDM_SYNC
-              value: "1"
-            - name: KC_SYNC_ENABLE
-              value: "0"
-            - name: MEASUREMENTS_HOST
-              value: http://measurements-service.measurements.svc.cluster.local:8000/api
-            - name: MEASUREMENTS_USE_MEASUREMENTS
-              value: "1"
-            - name: SERVER_API_HOST
-              value: https://wb.sarex.io
-            - name: SERVER_HOST
-              value: https://wb.sarex.io
-            - name: WORKFLOWS_HOST
-              value: https://wb.sarex.io
-            - name: WORKFLOWS_BASE_HOST
-              value: https://wb.sarex.io
-            - name: WORKFLOWS_USE
-              value: "1"
-            - name: SERVER_S3_STREAM_IMPORT
-              value: "1"
-            - name: SERVER_SAVE_DIFF_DEM
-              value: "1"
-            - name: SERVER_USE_CLICKHOUSE
-              value: "0"
-            - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
-              value: "0"
-            - name: SERVER_USE_DJANGO_STORAGE
-              value: "1"
-            - name: SERVER_USE_METASHAPE
-              value: "0"
-            - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
-              value: "1"
-            - name: SERVER_CHANGELOG_MODE
-              value: "0"
-            - name: SERVER_DJANGO_URLS
-              value: "1"
-            - name: CHECK_IMPORT_HASH
-              value: "1"
-            - name: EAV_ENABLE
-              value: "1"
-            - name: SERVER_CHECK_IMPORT_HASH
-              value: "1"
-            - name: SERVER_CHUNKED_PATH
-              value: /tmp/chunked_uploads/%Y/%m/%d
-            - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
-              value: "0"
-            - name: SERVER_USE_WRORKFLOW_STATUS
-              value: "1"
-            - name: ZITADEL_HOST
-              value: https://zitadel-srx.wb.ru
-            - name: SERVER_KAFKA_ENABLED
-              value: "False"
-            - name: KAFKA_TOPICS
-              value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
-            - name: KAFKA_SSL_CAFILE
-              value: /usr/local/share/ca-certificates/kafka.crt
-            - name: KC_USE_REDIRECT_LOGOUT
-              value: "False"
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-          volumeMounts:
-            - name: django-configmap
-              mountPath: /opt/sarex/config/settings/production.py
-              subPath: production.py
-      imagePullSecrets:
-        - name: regcred

apps/django/base/celery.yaml

@@ -0,0 +1,279 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: django
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      celery:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: django-vault
+        deployment:
+          enabled: true
+          name:
+            _default: celery
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
+                [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
+                [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
+                [ -f /vault/secrets/django-kafka ] && . /vault/secrets/django-kafka
+                [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
+                [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
+                set +a
+                exec celery -A config worker -B -l info -E -Q default -n default_worker.%h --concurrency=2
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: false
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        volumes:
+          _default:
+            - name: django-configmap
+              mountPath:
+                _default: /opt/sarex/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+        envs:
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "0"
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "False"
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: redis
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: redis
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: http://bim-backend-v2-service.bim-api
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+          - name: JWT_KID
+            value:
+              _default: "1"
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+          - name: SERVER_API_HOST
+            value:
+              _default: https://wb.sarex.io
+          - name: SERVER_HOST
+            value:
+              _default: https://wb.sarex.io
+          - name: WORKFLOWS_HOST
+            value:
+              _default: https://wb.sarex.io
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: https://wb.sarex.io
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+          - name: SERVER_SAVE_DIFF_DEM
+            value:
+              _default: "1"
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "1"
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "0"
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: /tmp/chunked_uploads/%Y/%m/%d
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+          - name: ZITADEL_HOST
+            value:
+              _default: https://zitadel-srx.wb.ru
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "False"
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: /usr/local/share/ca-certificates/kafka.crt
+          - name: KC_USE_REDIRECT_LOGOUT
+            value:
+              _default: "False"
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: django
+            vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres
+            vault.hashicorp.com/agent-inject-template-django-postgresql: |-
+              {{- with secret "secrets/data/apps/django/postgres" -}}
+              DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
+              DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }}
+              DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
+              DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
+              DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-rabbitmq: secrets/data/rabbitmq/apps/django
+            vault.hashicorp.com/agent-inject-template-django-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/django" -}}
+              CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
+              CELERY_RABBITMQ_USER={{ index .Data.data "username" }}
+              CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
+              CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
+              DJANGO_RABBIT_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local
+              DJANGO_RABBIT_USER={{ index .Data.data "username" }}
+              DJANGO_RABBIT_PASS={{ index .Data.data "password" }}
+              DJANGO_RABBIT_VHOST={{ index .Data.data "vhost" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-s3: secrets/data/minio/apps/django
+            vault.hashicorp.com/agent-inject-template-django-s3: |-
+              {{- with secret "secrets/data/minio/apps/django" -}}
+              AWS_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech
+              S3_HOST=https://minio.contour.infra.sarex.tech
+              {{- $buckets := index .Data.data "buckets" }}
+              S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}django{{- end -}}
+              S3_LOGIN={{ index .Data.data "access_key" }}
+              S3_PASSWORD={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-kafka: secrets/data/kafka/apps/django
+            vault.hashicorp.com/agent-inject-template-django-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/django" -}}
+              KAFKA_BOOTSTRAP_SERVERS="[\"{{ index .Data.data.auth "bootstrap_servers" }}\"]"
+              KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
+              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
+              KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
+              KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "private_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-common: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-django-common: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              ZITADEL_ACCESS_TOKEN={{ index .Data.data "django_zitadel_access_token" }}
+              {{- end -}}

apps/django/base/frontend-deployment.yaml

@@ -1,55 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: django
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-    spec:
-      volumes:
-        - name: nginx-configmap
-          configMap:
-            name: nginx-configmap
-            items:
-              - key: nginx.conf
-                path: nginx.conf
-          defaultMode: 420
-        - name: zitadel-configmap
-          configMap:
-            name: zitadel-configmap
-            items:
-              - key: config.json
-                path: config.json
-          defaultMode: 420
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.0
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-          volumeMounts:
-            - name: nginx-configmap
-              mountPath: /etc/nginx/nginx.conf
-              subPath: nginx.conf
-            - name: zitadel-configmap
-              readOnly: true
-              mountPath: /opt/react_client/static/config.json
-              subPath: config.json
-      imagePullSecrets:
-        - name: regcred

apps/django/base/frontend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-svc
-  namespace: django
-spec:
-  type: ClusterIP
-  selector:
-    app: frontend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/django/base/frontend.yaml

@@ -0,0 +1,101 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: django
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      frontend:
+        enabled: true
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.0
+          pullPolicy:
+            _default: IfNotPresent
+        deployment:
+          enabled: true
+          name:
+            _default: frontend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 80
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        service:
+          enabled: true
+          name:
+            _default: frontend-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 80
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        volumes:
+          _default:
+            - name: nginx-configmap
+              mountPath:
+                _default: /etc/nginx/nginx.conf
+              subPath:
+                _default: nginx.conf
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: nginx-configmap
+                items:
+                  - key: nginx.conf
+                    path:
+                      _default: nginx.conf
+
+            - name: zitadel-configmap
+              mountPath:
+                _default: /opt/react_client/static/config.json
+              subPath:
+                _default: config.json
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: zitadel-configmap
+                items:
+                  - key: config.json
+                    path:
+                      _default: config.json

apps/django/base/kustomization.yaml

@@ -4,17 +4,14 @@ kind: Kustomization
 namespace: django
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
-  - backend-deployment.yaml
-  - celery-deployment.yaml
-  - frontend-deployment.yaml
-  - backend-service.yaml
-  - frontend-service.yaml
   - django-configmap.yaml
-  - srx-admin-deployment.yaml
-  - srx-admin-service.yaml
   - nginx-configmap.yaml
   - uwsgi-configmap.yaml
   - zitadel-configmap.yaml
-  - s3-proxy-service.yaml
+  - backend.yaml
+  - celery.yaml
+  - frontend.yaml
+  - srx-admin.yaml
   - s3-proxy.yaml
+  - redis-deployment.yaml
+  - redis-service.yaml

apps/django/base/namespace.yaml

@@ -5,3 +5,4 @@ metadata:
   name: django
   labels:
     istio-injection: enabled
+    security.deckhouse.io/pod-policy: privileged

apps/django/base/nginx-configmap.yaml

@@ -62,36 +62,37 @@ data:
                 if_modified_since off;
                 expires off;
             }
-            location ~^/api/pm/ {
-                #rewrite /api/(.+) /$1 break;
-                proxy_set_header Host $host;
-                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            }
+            # location ~^/api/pm/ {
+            #     #rewrite /api/(.+) /$1 break;
+            #     proxy_set_header Host $host;
+            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            # }
 
-            location ~^/api/v1/documents/ {
-                #rewrite /api/(.+) /$1 break;
-                proxy_set_header Host $host;
-                proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80;
-            }
+            # location ~^/api/v1/documents/ {
+            #     #rewrite /api/(.+) /$1 break;
+            #     proxy_set_header Host $host;
+            #     proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80;
+            # }
 
             # location ~^/(api|admin)/ {
             #     proxy_set_header Host $host;
             #     proxy_pass http://backend-svc.django.svc.cluster.local:80;
             # }
             
-            location ~^/workspaces-v2/(.+).js {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                rewrite /workspaces-v2/(.+) /$1 break;
-                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
-            }
+            # location ~^/workspaces-v2/(.+).js {
+            #     proxy_http_version 1.1;
+            #     proxy_set_header Connection "";
+            #     rewrite /workspaces-v2/(.+) /$1 break;
+            #     proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
+            # }
+            
 
-            location ~^/workspaces-v2/(.+)\.wasm$ {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                rewrite ^/workspaces-v2/(.+) /$1 break;
-                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
-            }
+            # location ~^/workspaces-v2/(.+)\.wasm$ {
+            #     proxy_http_version 1.1;
+            #     proxy_set_header Connection "";
+            #     rewrite ^/workspaces-v2/(.+) /$1 break;
+            #     proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
+            # }
 
             location @index {
                 add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';

apps/django/base/s3-proxy-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: s3-proxy-svc
-  namespace: django
-spec:
-  type: ClusterIP
-  selector:
-    app: s3-proxy
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/django/base/s3-proxy.yaml

@@ -1,69 +1,97 @@
-apiVersion: apps/v1
-kind: Deployment
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: s3-proxy
   namespace: django
-  labels:
-    app: s3-proxy
-
 spec:
-  replicas: 1
-
-  selector:
-    matchLabels:
-      app: s3-proxy
-
-  template:
-    metadata:
-      labels:
-        app: s3-proxy
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: django
-
-        vault.hashicorp.com/agent-inject-secret-s3: secrets/data/minio/apps/django
-
-        vault.hashicorp.com/agent-inject-template-s3: |
-          {{- with secret "secrets/data/minio/apps/django" }}
-          AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech
-          {{- $buckets := index .Data.data "buckets" }}
-          AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
-          AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end }}
-
+  interval: 10m
+  chart:
     spec:
-      serviceAccountName: django-vault
-
-      containers:
-        - name: s3-proxy
-          image: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:vault_6e586217
-          imagePullPolicy: Always
-
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      s3-proxy:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: django-vault
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:vault_6e586217
+          pullPolicy:
+            _default: Always
+        deployment:
+          enabled: true
+          name:
+            _default: s3-proxy
+          replicaCount:
+            _default: 1
+          port:
+            _default: 80
           command:
-            - /bin/sh
-            - -ec
-
+            _default: ["/bin/sh", "-ec"]
           args:
-            - |
-              set -a
-              [ -f /vault/secrets/s3 ] && . /vault/secrets/s3
-              set +a
-
-              exec /s3-proxy
-
-          ports:
-            - name: http
-              containerPort: 80
-
-          env:
-            - name: ACCESS_LOG
-              value: "true"
-
-            - name: CORS_ALLOW_HEADERS
-              value: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/s3 ] && . /vault/secrets/s3
+                set +a
+                exec /s3-proxy
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        service:
+          enabled: true
+          name:
+            _default: s3-proxy-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 80
+          portName:
+            _default: http
+        envs:
+          - name: ACCESS_LOG
+            value:
+              _default: "true"
+          - name: CORS_ALLOW_HEADERS
+            value:
+              _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: django
+            vault.hashicorp.com/agent-inject-secret-s3: secrets/data/minio/apps/django
+            vault.hashicorp.com/agent-inject-template-s3: |
+              {{- with secret "secrets/data/minio/apps/django" }}
+              AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech
+              {{- $buckets := index .Data.data "buckets" }}
+              AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end }}

apps/django/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: django-vault
-  namespace: django

apps/django/base/srx-admin-deployment.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: srx-admin-frontend
-  namespace: django
-  labels:
-    app: srx-admin-frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: srx-admin-frontend
-  template:
-    metadata:
-      labels:
-        app: srx-admin-frontend
-    spec:
-      containers:
-        - name: srx-admin-frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_3b9cb250
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-      imagePullSecrets:
-        - name: regcred

apps/django/base/srx-admin-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: srx-admin-svc
-  namespace: django
-spec:
-  type: ClusterIP
-  selector:
-    app: srx-admin
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/django/base/srx-admin.yaml

@@ -0,0 +1,70 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: srx-admin-frontend
+  namespace: django
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      srx-admin:
+        enabled: true
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_3b9cb250
+          pullPolicy:
+            _default: IfNotPresent
+        deployment:
+          enabled: true
+          name:
+            _default: srx-admin-frontend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 80
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        service:
+          enabled: true
+          name:
+            _default: srx-admin-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 80
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred

apps/django/base/zitadel-configmap.yaml

@@ -8,8 +8,8 @@ data:
     {
       "auth_type": "zitadel",
       "zitadel": {
-        "client_id": "379557107642492501",
-        "host": "https://zitadel.contour.infra.sarex.tech"
+        "client_id": "383923818340615274",
+        "host": "https://sarex-login.uralmine.com"
       }
     }
 

apps/django/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: django
+resources:
+  - ../base

apps/django/dsinv/backend.yaml

@@ -1,110 +1,161 @@
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: backend
   namespace: django
 spec:
-  replicas: 2
-  template:
-    spec:
-      containers:
-      - name: backend
-        image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1
-        env:
-        - name: GK_ENCRYPTION_KEY
-          value: zfDjuszywHSbAhY8KJQbESbpUYN74XTs
-        - name: SERVER_DONSTROI_STYLE
-          value: 'True'
-        - name: SERVER_API_HOST
-          value: https://sarex.dsinv.ru
-        - name: SERVER_VERIFY_SSL
-          value: 'False'
-        - name: SERVER_SUPERSET_HOST
-          value: https://bi.sarex.dsinv.ru
-        - name: GATEWAY_HOST
-          value: http://pdm-api.documentations.svc.cluster.local:8080
-        - name: KC_DEFAULT_COMPANY_NAME
-          value: Донстрой
-        - name: KC_SYNC_USER_GROUPS
-          value: '0'
-        - name: SERVER_ZITADEL_ENABLED
-          value: 'False'
-        - name: KC_SYNC_USER_POSITIONS
-          value: '0'
-        - name: KC_SYNC_USER_DEPARTMENTS
-          value: '0'
-        - name: SERVER_CHANGELOG_MODE_CELERY
-          value: 'True'
-        - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
-          value: 'True'
-        - name: DJANGO_SETTINGS_MODULE
-          value: config.settings.production
-        - name: CC_PATH
-          value: /usr/local/bin/CloudCompare
-        - name: CC_COMPARISONS_BASE_DIR
-          value: /tmp
-        - name: PCVT_PATH
-          value: /usr/local/bin/PotreeConverter
-        - name: POTREE_CONVERTER_PATH
-          value: /usr/local/bin/PotreeConverter
-        - name: WORKFLOWS_BASE_HOST
-          value: http://backend.django.svc.cluster.local:8000
-        - name: WORKFLOWS_HOST
-          value: http://workflows-service.workflow.svc.cluster.local:8000
-        - name: WORKFLOWS_PREFIX
-          value: /api/v1
-        - name: SERVER_HOST
-          value: https://sarex.dsinv.ru
-        - name: S3_HOST
-          value: http://minio-service.minio.svc.cluster.local:9000
-        - name: AWS_S3_ENDPOINT_URL
-          value: http://minio-service.minio.svc.cluster.local:9000
-        - name: MEASUREMENTS_USE_MEASUREMENTS
-          value: '1'
-        - name: MEASUREMENTS_HOST
-          value: http://measurement-service.measurements.svc.cluster.local:8000/api
-        - name: SERVER_USE_DJANGO_STORAGE
-          value: '1'
-        - name: SERVER_DJANGO_URLS
-          value: '1'
-        - name: SERVER_S3_STREAM_IMPORT
-          value: '1'
-        - name: WORKFLOWS_USE
-          value: '1'
-        - name: SERVER_KAFKA_ENABLED
-          value: 'True'
-        - name: KAFKA_TOPICS
-          value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
-        - name: KAFKA_BOOTSTRAP_SERVERS
-          value: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
-        - name: KAFKA_SECURITY_PROTOCOL
-          value: SSL
-        - name: KAFKA_SASL_MECHANISM
-          value: SCRAM-SHA-512
-        - name: KAFKA_SSL_CAFILE
-          value: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt
-        - name: WORKFLOWS_REGISTRY
-          value: cr.yandex/crp3ccidau046kdj8g9q
-        - name: DJANGO_REDIS_HOST
-          value: redis-service.django.svc.cluster.local
-        - name: DJANGO_RABBIT_HOSTNAME
-          value: rabbitmq-service.django.svc.cluster.local
-        - name: CELERY_RABBITMQ_HOST
-          value: rabbitmq-service.django.svc.cluster.local
-        - name: DJANGO_POSTGRES_HOST
-          value: postgres-service
-        - name: DJANGO_POSTGRES_PORTS
-          value: '5432'
-        - name: ALLOWED_HOSTS
-          value: '*'
-        - name: USE_SSL_FOR_URL_SERIALIZATION
-          value: '0'
-        - name: SERVER_REPLACE_HOST
-          value: '1'
-        - name: SERVER_JWT_PROXY
-          value: '0'
-        - name: PDM_SYNC
-          value: '1'
-        - name: CELERY_REDIS_HOST
-          value: redis-service
+  values:
+    services:
+      backend:
+        deployment:
+          replicaCount:
+            _default: 2
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1
+        envs:
+          - name: GK_ENCRYPTION_KEY
+            value:
+              _default: zfDjuszywHSbAhY8KJQbESbpUYN74XTs
+          - name: SERVER_DONSTROI_STYLE
+            value:
+              _default: "True"
+          - name: SERVER_API_HOST
+            value:
+              _default: https://sarex.dsinv.ru
+          - name: SERVER_VERIFY_SSL
+            value:
+              _default: "False"
+          - name: SERVER_SUPERSET_HOST
+            value:
+              _default: https://bi.sarex.dsinv.ru
+          - name: GATEWAY_HOST
+            value:
+              _default: http://pdm-api.documentations.svc.cluster.local:8080
+          - name: KC_DEFAULT_COMPANY_NAME
+            value:
+              _default: Донстрой
+          - name: KC_SYNC_USER_GROUPS
+            value:
+              _default: "0"
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "False"
+          - name: KC_SYNC_USER_POSITIONS
+            value:
+              _default: "0"
+          - name: KC_SYNC_USER_DEPARTMENTS
+            value:
+              _default: "0"
+          - name: SERVER_CHANGELOG_MODE_CELERY
+            value:
+              _default: "True"
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "True"
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+          - name: CC_PATH
+            value:
+              _default: /usr/local/bin/CloudCompare
+          - name: CC_COMPARISONS_BASE_DIR
+            value:
+              _default: /tmp
+          - name: PCVT_PATH
+            value:
+              _default: /usr/local/bin/PotreeConverter
+          - name: POTREE_CONVERTER_PATH
+            value:
+              _default: /usr/local/bin/PotreeConverter
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
+          - name: WORKFLOWS_HOST
+            value:
+              _default: http://workflows-service.workflow.svc.cluster.local:8000
+          - name: WORKFLOWS_PREFIX
+            value:
+              _default: /api/v1
+          - name: SERVER_HOST
+            value:
+              _default: https://sarex.dsinv.ru
+          - name: S3_HOST
+            value:
+              _default: http://minio-service.minio.svc.cluster.local:9000
+          - name: AWS_S3_ENDPOINT_URL
+            value:
+              _default: http://minio-service.minio.svc.cluster.local:9000
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: http://measurement-service.measurements.svc.cluster.local:8000/api
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "True"
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: SSL
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: SCRAM-SHA-512
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt
+          - name: WORKFLOWS_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: redis-service.django.svc.cluster.local
+          - name: DJANGO_RABBIT_HOSTNAME
+            value:
+              _default: rabbitmq-service.django.svc.cluster.local
+          - name: CELERY_RABBITMQ_HOST
+            value:
+              _default: rabbitmq-service.django.svc.cluster.local
+          - name: DJANGO_POSTGRES_HOST
+            value:
+              _default: postgres-service
+          - name: DJANGO_POSTGRES_PORTS
+            value:
+              _default: "5432"
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+          - name: USE_SSL_FOR_URL_SERIALIZATION
+            value:
+              _default: "0"
+          - name: SERVER_REPLACE_HOST
+            value:
+              _default: "1"
+          - name: SERVER_JWT_PROXY
+            value:
+              _default: "0"
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: redis-service

apps/django/dsinv/celery.yaml

@@ -1,87 +1,125 @@
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: celery
   namespace: django
 spec:
-  template:
-    spec:
-      containers:
-      - name: celery
-        image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1
-        env:
-        - name: DJANGO_SETTINGS_MODULE
-          value: config.settings.production
-        - name: CC_PATH
-          value: /usr/local/bin/CloudCompare
-        - name: CC_COMPARISONS_BASE_DIR
-          value: /tmp
-        - name: AWS_S3_ENDPOINT_URL
-          value: http://minio-service.minio.svc.cluster.local:9000
-        - name: PCVT_PATH
-          value: /usr/local/bin/PotreeConverter
-        - name: POTREE_CONVERTER_PATH
-          value: /usr/local/bin/PotreeConverter
-        - name: WORKFLOWS_BASE_HOST
-          value: http://backend.django.svc.cluster.local:8000
-        - name: WORKFLOWS_HOST
-          value: https://sarex.dsinv.ru
-        - name: SERVER_CACHE_ENABLED
-          value: 'True'
-        - name: SERVER_API_HOST
-          value: https://sarex.dsinv.ru
-        - name: SERVER_VERIFY_SSL
-          value: 'False'
-        - name: SERVER_HOST
-          value: https://sarex.dsinv.ru
-        - name: S3_HOST
-          value: http://minio-service.minio.svc.cluster.local:9000
-        - name: MEASUREMENTS_USE_MEASUREMENTS
-          value: '1'
-        - name: MEASUREMENTS_HOST
-          value: http://measurements-service.measurements.svc.cluster.local:8000/api
-        - name: SERVER_USE_DJANGO_STORAGE
-          value: '1'
-        - name: SERVER_DJANGO_URLS
-          value: '1'
-        - name: CACHE_HOST
-          value: redis.pm.svc.cluster.local
-        - name: SERVER_DONSTROI_STYLE
-          value: 'True'
-        - name: SERVER_S3_STREAM_IMPORT
-          value: '1'
-        - name: WORKFLOWS_USE
-          value: '1'
-        - name: WORKFLOWS_REGISTRY
-          value: cr.yandex/crp3ccidau046kdj8g9q
-        - name: CELERY_REDIS_HOST
-          value: redis-service
-        - name: CELERY_RABBITMQ_HOST
-          value: rabbitmq-service.django.svc.cluster.local
-        - name: DJANGO_POSTGRES_HOST
-          value: postgres-service
-        - name: SERVER_KAFKA_ENABLED
-          value: 'True'
-        - name: KAFKA_TOPICS
-          value: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
-        - name: KAFKA_BOOTSTRAP_SERVERS
-          value: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
-        - name: KAFKA_SECURITY_PROTOCOL
-          value: SSL
-        - name: KAFKA_SASL_MECHANISM
-          value: SCRAM-SHA-512
-        - name: KAFKA_SSL_CAFILE
-          value: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt
-        - name: DJANGO_POSTGRES_PORTS
-          value: '5432'
-        - name: ALLOWED_HOSTS
-          value: '*'
-        - name: USE_SSL_FOR_URL_SERIALIZATION
-          value: '0'
-        - name: SERVER_REPLACE_HOST
-          value: '1'
-        - name: SERVER_JWT_PROXY
-          value: '1'
-        - name: PDM_SYNC
-          value: '1'
+  values:
+    services:
+      celery:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_c0c6bbb1
+        envs:
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+          - name: CC_PATH
+            value:
+              _default: /usr/local/bin/CloudCompare
+          - name: CC_COMPARISONS_BASE_DIR
+            value:
+              _default: /tmp
+          - name: AWS_S3_ENDPOINT_URL
+            value:
+              _default: http://minio-service.minio.svc.cluster.local:9000
+          - name: PCVT_PATH
+            value:
+              _default: /usr/local/bin/PotreeConverter
+          - name: POTREE_CONVERTER_PATH
+            value:
+              _default: /usr/local/bin/PotreeConverter
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
+          - name: WORKFLOWS_HOST
+            value:
+              _default: https://sarex.dsinv.ru
+          - name: SERVER_CACHE_ENABLED
+            value:
+              _default: "True"
+          - name: SERVER_API_HOST
+            value:
+              _default: https://sarex.dsinv.ru
+          - name: SERVER_VERIFY_SSL
+            value:
+              _default: "False"
+          - name: SERVER_HOST
+            value:
+              _default: https://sarex.dsinv.ru
+          - name: S3_HOST
+            value:
+              _default: http://minio-service.minio.svc.cluster.local:9000
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+          - name: CACHE_HOST
+            value:
+              _default: redis.pm.svc.cluster.local
+          - name: SERVER_DONSTROI_STYLE
+            value:
+              _default: "True"
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+          - name: WORKFLOWS_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: redis-service
+          - name: CELERY_RABBITMQ_HOST
+            value:
+              _default: rabbitmq-service.django.svc.cluster.local
+          - name: DJANGO_POSTGRES_HOST
+            value:
+              _default: postgres-service
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "True"
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["donstroi-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: SSL
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: SCRAM-SHA-512
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: /etc/ca-certificates/Yandex/YandexInternalRootCA.crt
+          - name: DJANGO_POSTGRES_PORTS
+            value:
+              _default: "5432"
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+          - name: USE_SSL_FOR_URL_SERIALIZATION
+            value:
+              _default: "0"
+          - name: SERVER_REPLACE_HOST
+            value:
+              _default: "1"
+          - name: SERVER_JWT_PROXY
+            value:
+              _default: "1"
+          - name: PDM_SYNC
+            value:
+              _default: "1"

apps/django/dsinv/frontend.yaml

@@ -1,12 +1,13 @@
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: frontend
   namespace: django
 spec:
-  template:
-    spec:
-      containers:
-      - name: frontend
-        image: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.15.7
+  values:
+    services:
+      frontend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.15.7

apps/django/dsinv/kustomization.yaml

@@ -8,13 +8,13 @@ resources:
 patches:
 - path: backend.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: backend
 - path: celery.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: celery
 - path: frontend.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: frontend

apps/django/yc-k8s-test/kustomization.yaml

@@ -4,6 +4,4 @@ kind: Kustomization
 resources:
   - ../base
   - postgresql.yaml
-  - redis-deployment.yaml
-  - redis-service.yaml
 patches: []

apps/documentations/base/api-deployment.yaml

@@ -1,173 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: documentations-api
-  namespace: documentations
-  labels:
-    app: documentations-api
-    service: documentations-api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: documentations-api
-  template:
-    metadata:
-      labels:
-        app: documentations-api
-        service: documentations-api
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: documentations
-        vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/postgresql/apps/documentations
-        vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
-          {{- with secret "secrets/data/postgresql/apps/documentations" -}}
-          POSTGRES_ADDRESS=postgresql.documentations.svc.cluster.local
-          POSTGRES_PORT=5432
-          POSTGRES_DB=documentations_db
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-common: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
-          DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }}
-          DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          {{ index .Data.data "documentations_s3_service_account_json" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          {{ index .Data.data "documentations_zitadel_account_json" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: documentations-vault
-      containers:
-        - name: documentations-api
-          image: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
-              [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
-              [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
-              set +a
-              exec /app/entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: POSTGRES_POOL_SIZE
-              value: "20"
-            - name: ZITADEL_ACCOUNT
-              value: /vault/secrets/documentations-zitadel-account-json
-            - name: ZITADEL_DOMAIN
-              value: zitadel-srx.wb.ru
-            - name: USE_ZITADEL
-              value: "0"
-            - name: FLOWS_URL
-              value: http://backend-svc.flows.svc.cluster.local:80
-            - name: LAST_MASTER_BIM
-              value: "36311"
-            - name: API_ADDRESS
-              value: 0.0.0.0:8080
-            - name: API_ADDRESS_FILE
-              value: 0.0.0.0:8080
-            - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-              value: "5"
-            - name: ENABLE_SQL_QUERY
-              value: "0"
-            - name: ENABLE_SSL
-              value: "0"
-            - name: WORKSPACE_V2_EXTERNAL_URL
-              value: https://sarex.contour.infra.sarex.tech/workspaces-v2/
-            - name: ENABLE_S3
-              value: "1"
-            - name: CONTAINER_REGISTRY
-              value: cr.yandex/crp3ccidau046kdj8g9q
-            - name: ENVIRONMENT
-              value: production
-            - name: LAST_SLAVE_1_BIM
-              value: "1000000"
-            - name: HOST
-              value: http://backend-api-svc.documentations.svc.cluster.local:80
-            - name: FILE_STREAM_HOST
-              value: sarex.contour.infra.sarex.tech
-            - name: DOCUMENTATION_URL
-              value: http://documentations-api.documentations.svc.cluster.local:80/
-            - name: WORKFLOW_URL
-              value: http://backend-svc.processing.svc.cluster.local:80/
-            - name: WORKSPACE_URL
-              value: http://backend-svc.workspaces.svc.cluster.local:80/
-            - name: BIM_API_URL
-              value: http://bim-api-service.bim.svc.cluster.local:8080/
-            - name: BIM_API_V2_URL
-              value: http://backend-service.bim.svc.cluster.local:8000/
-            - name: WORKSPACE_BUNDLE_VERSION
-              value: v1
-            - name: SYSTEM_LOG_URL
-              value: http://backend-svc.system-log.svc.cluster.local:80
-            - name: DJANGO_HOST
-              value: http://backend-svc.django.svc.cluster.local:80
-            - name: MARKS_PROCESSING_URL
-              value: http://marks-service:8000
-            - name: PUBLIC_LINK_HOST
-              value: https://document-link-srx.wb.ru
-            - name: NAMESPACE
-              value: documentations
-            - name: DJANGO_ORIGINATOR
-              value: docs_prod
-            - name: WORKFLOW_IMAGES_VERSION
-              value: master
-            - name: WORKFLOWS_IMAGES_VERSION
-              value: master
-            - name: S3_SERVICE_ACCOUNT
-              value: /vault/secrets/documentations-s3-account-json
-            - name: READ_WRITE_TIMEOUT_FILE_STREAM
-              value: 6h
-            - name: CACHE_DEFAULT_EXPIRATION
-              value: 60s
-            - name: ENABLE_SMTP
-              value: "True"
-            - name: ENABLE_MAILGUN
-              value: "False"
-            - name: CACHE_CLEANUP_INTERVAL
-              value: 60s
-            - name: ENABLE_AUTH_JWT_IN_URL
-              value: "true"
-            - name: ENABLE_SIGNATURE_IN_URL
-              value: "false"
-            - name: USE_CACHE_IN_FILE_STREAMER
-              value: "0"
-            - name: VALKEY_ADDR
-              value: redis:6379
-            - name: VALKEY_HOST
-              value: redis
-            - name: VALKEY_PORT
-              value: "6379"
-      
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-
-      imagePullSecrets:
-        - name: regcred

apps/documentations/base/api-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-api-svc
-  namespace: documentations
-spec:
-  type: ClusterIP
-  selector:
-    app: documentations-api
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP

apps/documentations/base/api.yaml

@@ -0,0 +1,260 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-api
+  namespace: documentations
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: documentations-vault
+        deployment:
+          enabled: true
+          name:
+            _default: documentations-api
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8080
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
+                [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
+                [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
+                set +a
+                exec /app/entrypoint.sh
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: backend-api-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8080
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-zitadel-account-json
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: zitadel-srx.wb.ru
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://sarex.contour.infra.sarex.tech/workspaces-v2/
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+          - name: HOST
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80
+          - name: FILE_STREAM_HOST
+            value:
+              _default: sarex.contour.infra.sarex.tech
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://documentations-api.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://backend-svc.processing.svc.cluster.local:80/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: BIM_API_URL
+            value:
+              _default: http://bim-api-service.bim.svc.cluster.local:8080/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://backend-svc.system-log.svc.cluster.local:80
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service:8000
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://document-link-srx.wb.ru
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            value:
+              _default: "mock"
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "true"
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "false"
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "0"
+          - name: VALKEY_ADDR
+            value:
+              _default: redis:6379
+          - name: VALKEY_HOST
+            value:
+              _default: redis
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: documentations
+            vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres
+            vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
+              {{- with secret "secrets/data/apps/documentations/postgres" -}}
+              POSTGRES_ADDRESS={{ index .Data.data "host" }}
+              POSTGRES_PORT={{ index .Data.data "port" }}
+              POSTGRES_DB={{ index .Data.data "database" }}
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-common: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
+              DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              {{ index .Data.data "documentations_s3_service_account_json" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              {{ index .Data.data "documentations_zitadel_account_json" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}

apps/documentations/base/filestream-deployment.yaml

@@ -1,173 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: documentations-filestream
-  namespace: documentations
-  labels:
-    app: documentations-filestream
-    service: documentations-filestream
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: documentations-filestream
-  template:
-    metadata:
-      labels:
-        app: documentations-filestream
-        service: documentations-filestream
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: documentations
-        vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/postgresql/apps/documentations
-        vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
-          {{- with secret "secrets/data/postgresql/apps/documentations" -}}
-          POSTGRES_ADDRESS=postgresql.documentations.svc.cluster.local
-          POSTGRES_PORT=5432
-          POSTGRES_DB=documentations_db
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-common: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
-          DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }}
-          DOCUMENT_PUBLIC_LINK_JWT_SECRET={{ index .Data.data "documentations_public_link_jwt_secret" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          {{ index .Data.data "documentations_s3_service_account_json" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          {{ index .Data.data "documentations_zitadel_account_json" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: documentations-vault
-      containers:
-        - name: documentations-filestream
-          image: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
-              [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
-              [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
-              set +a
-              exec /app/file_entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: POSTGRES_POOL_SIZE
-              value: "20"
-            - name: ZITADEL_ACCOUNT
-              value: /vault/secrets/documentations-zitadel-account-json
-            - name: ZITADEL_DOMAIN
-              value: zitadel-srx.wb.ru
-            - name: USE_ZITADEL
-              value: "0"
-            - name: FLOWS_URL
-              value: http://backend-svc.flows.svc.cluster.local:80
-            - name: LAST_MASTER_BIM
-              value: "36311"
-            - name: API_ADDRESS
-              value: 0.0.0.0:8080
-            - name: API_ADDRESS_FILE
-              value: 0.0.0.0:8080
-            - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-              value: "5"
-            - name: ENABLE_SQL_QUERY
-              value: "0"
-            - name: ENABLE_SSL
-              value: "0"
-            - name: WORKSPACE_V2_EXTERNAL_URL
-              value: https://srx.wb.ru/workspaces-v2/
-            - name: ENABLE_S3
-              value: "1"
-            - name: CONTAINER_REGISTRY
-              value: cr.yandex/crp3ccidau046kdj8g9q
-            - name: ENVIRONMENT
-              value: production
-            - name: LAST_SLAVE_1_BIM
-              value: "1000000"
-            - name: HOST
-              value: http://backend-api-svc.documentations.svc.cluster.local:80
-            - name: FILE_STREAM_HOST
-              value: srx.wb.ru
-            - name: DOCUMENTATION_URL
-              value: http://backend-api-svc.documentations.svc.cluster.local:80/
-            - name: WORKFLOW_URL
-              value: http://workflows-api-service.workflow.svc.cluster.local:8000/
-            - name: WORKSPACE_URL
-              value: http://backend-svc.workspaces.svc.cluster.local:80/
-            - name: BIM_API_URL
-              value: http://bim-api-service.bim.svc.cluster.local:8080/
-            - name: BIM_API_V2_URL
-              value: http://backend-service.bim.svc.cluster.local:8000/
-            - name: WORKSPACE_BUNDLE_VERSION
-              value: v1
-            - name: SYSTEM_LOG_URL
-              value: http://api-service.system-log.svc.cluster.local:80
-            - name: DJANGO_HOST
-              value: http://backend-svc.django.svc.cluster.local:80
-            - name: MARKS_PROCESSING_URL
-              value: http://marks-service:8000
-            - name: PUBLIC_LINK_HOST
-              value: https://document-link-srx.wb.ru
-            - name: NAMESPACE
-              value: documentations
-            - name: DJANGO_ORIGINATOR
-              value: docs_prod
-            - name: WORKFLOW_IMAGES_VERSION
-              value: master
-            - name: WORKFLOWS_IMAGES_VERSION
-              value: master
-            - name: S3_SERVICE_ACCOUNT
-              value: /vault/secrets/documentations-s3-account-json
-            - name: READ_WRITE_TIMEOUT_FILE_STREAM
-              value: 6h
-            - name: CACHE_DEFAULT_EXPIRATION
-              value: 60s
-            - name: ENABLE_SMTP
-              value: "True"
-            - name: ENABLE_MAILGUN
-              value: "False"
-            - name: CACHE_CLEANUP_INTERVAL
-              value: 60s
-            - name: ENABLE_AUTH_JWT_IN_URL
-              value: "false"
-            - name: ENABLE_SIGNATURE_IN_URL
-              value: "true"
-            - name: USE_CACHE_IN_FILE_STREAMER
-              value: "0"
-            - name: VALKEY_ADDR
-              value: redis:6379
-            - name: VALKEY_HOST
-              value: redis
-            - name: VALKEY_PORT
-              value: "6379"
-      
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-
-      imagePullSecrets:
-        - name: regcred

apps/documentations/base/filestream-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-filestream-svc
-  namespace: documentations
-spec:
-  type: ClusterIP
-  selector:
-    app: documentations-filestream
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP

apps/documentations/base/filestream.yaml

@@ -0,0 +1,260 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-filestream
+  namespace: documentations
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: documentations-vault
+        deployment:
+          enabled: true
+          name:
+            _default: documentations-filestream
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8080
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
+                [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
+                [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
+                set +a
+                exec /app/file_entrypoint.sh
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: backend-filestream-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8080
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-zitadel-account-json
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: zitadel-srx.wb.ru
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://srx.wb.ru/workspaces-v2/
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+          - name: HOST
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80
+          - name: FILE_STREAM_HOST
+            value:
+              _default: srx.wb.ru
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://workflows-api-service.workflow.svc.cluster.local:8000/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: BIM_API_URL
+            value:
+              _default: http://bim-api-service.bim.svc.cluster.local:8080/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:80
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service:8000
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://document-link-srx.wb.ru
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            value:
+              _default: "mock"
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "0"
+          - name: VALKEY_ADDR
+            value:
+              _default: redis:6379
+          - name: VALKEY_HOST
+            value:
+              _default: redis
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: documentations
+            vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres
+            vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
+              {{- with secret "secrets/data/apps/documentations/postgres" -}}
+              POSTGRES_ADDRESS={{ index .Data.data "host" }}
+              POSTGRES_PORT={{ index .Data.data "port" }}
+              POSTGRES_DB={{ index .Data.data "database" }}
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-common: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
+              DJANGO_BASIC_AUTH_FOR_GET_USER={{ index .Data.data "key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              {{ index .Data.data "documentations_s3_service_account_json" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-zitadel-account-json: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-zitadel-account-json: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              {{ index .Data.data "documentations_zitadel_account_json" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}

apps/documentations/base/frontend-deployment.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: documentations
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-    spec:
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ae1bb076
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-      imagePullSecrets:
-        - name: regcred

apps/documentations/base/frontend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-svc
-  namespace: documentations
-spec:
-  type: ClusterIP
-  selector:
-    app: frontend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/documentations/base/frontend.yaml

@@ -0,0 +1,70 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: documentations
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      frontend:
+        enabled: true
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ae1bb076
+          pullPolicy:
+            _default: IfNotPresent
+        deployment:
+          enabled: true
+          name:
+            _default: frontend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 80
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        service:
+          enabled: true
+          name:
+            _default: frontend-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 80
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred

apps/documentations/base/kustomization.yaml

@@ -4,12 +4,9 @@ kind: Kustomization
 namespace: documentations
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
-  - api-deployment.yaml
-  - pdm-deployment.yaml
-  - filestream-deployment.yaml
-  - frontend-deployment.yaml
-  - api-service.yaml
-  - pdm-service.yaml
-  - filestream-service.yaml
-  - frontend-service.yaml
+  - api.yaml
+  - filestream.yaml
+  - frontend.yaml
+  - pdm.yaml
+  - redis-deployment.yaml
+  - redis-service.yaml

apps/documentations/base/namespace.yaml

@@ -5,3 +5,4 @@ metadata:
   name: documentations
   labels:
     istio-injection: enabled
+    security.deckhouse.io/pod-policy: privileged

apps/documentations/base/pdm-deployment.yaml

@@ -1,181 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pdm-api
-  namespace: documentations
-  labels:
-    app: pdm-api
-    service: pdm-api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pdm-api
-  template:
-    metadata:
-      labels:
-        app: pdm-api
-        service: pdm-api
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: documentations
-        vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/postgresql/apps/documentations
-        vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
-          {{- with secret "secrets/data/postgresql/apps/documentations" -}}
-          POSTGRES_ADDRESS=postgresql.documentations.svc.cluster.local
-          POSTGRES_PORT=5432
-          POSTGRES_DB=documentations_db
-          POSTGRES_USER={{ index .Data.data "username" }}
-          POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-common: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
-          RELEASES_TOKEN={{ index .Data.data "documentations_releases_token" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          {{ index .Data.data "documentations_s3_service_account_json" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: documentations-vault
-      containers:
-        - name: pdm-api
-          image: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
-              [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
-              [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
-              set +a
-              exec ./httpserver
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: USE_EXPERIMENTAL
-              value: "true"
-            - name: POSTGRES_POOL_SIZE
-              value: "20"
-            - name: TRANSMITTALS_BASE_URL
-              value: mock
-            - name: API_ADDRESS
-              value: 0.0.0.0:8080
-            - name: API_ADDRESS_FILE
-              value: 0.0.0.0:8080
-            - name: BUCKET_NAME
-              value: attachments-storage
-            - name: API_HOST_PREFIX
-              value: /
-            - name: APP_NAME
-              value: pdm_v2
-            - name: APP_VERSION
-              value: 0.0.1
-            - name: ENABLE_PERMISSIONS_FILTER
-              value: "1"
-            - name: PERMISSIONS_FILTER_COMPANIES
-              value: '[1]'
-            - name: TRANSMITTALS_ENABLE
-              value: "false"
-            - name: DRAWINGS_INTERNAL_URL
-              value: http://drawings-api-service.drawings.svc.cluster.local:80
-            - name: ATTACHMENTS_URL
-              value: http://attachments-service.attachments.svc.cluster.local:8000
-            - name: BIM_API_V2_URL
-              value: http://backend-service.bim.svc.cluster.local:8000/
-            - name: BIM_V2_HOST
-              value: http://backend-service.bim.svc.cluster.local:8000/
-            - name: CACHE_CLEANUP_INTERVAL
-              value: 60s
-            - name: CACHE_DEFAULT_EXPIRATION
-              value: 60s
-            - name: DJANGO_HOST
-              value: http://backend-svc.django.svc.cluster.local:80
-            - name: DJANGO_ORIGINATOR
-              value: docs_prod
-            - name: DOCUMENTATION_URL
-              value: http://backend-api-svc.documentations.svc.cluster.local:80/
-            - name: EAV_URL
-              value: http://backend-svc.eav.svc.cluster.local:80
-            - name: ENABLE_OBSERVABILITY
-              value: "false"
-            - name: ENABLE_S3
-              value: "1"
-            - name: ENABLE_SSL
-              value: "0"
-            - name: ENVIRONMENT
-              value: prod
-            - name: FLOWS_URL
-              value: http://backend-svc.flows.svc.cluster.local:80
-            - name: HEIGHT_THUMB_ATTACHMENTS
-              value: "300"
-            - name: HEIGHT_THUMB_STATES
-              value: "73"
-            - name: HTTP_PORT
-              value: "8080"
-            - name: INSPECTIONS_URL
-              value: http://inspections-service.inspections.svc.cluster.local:80
-            - name: LOG_LEVEL
-              value: INFO
-            - name: NOTES_URL
-            - name: OBSERVABILITY_COLLECTOR_ENDPOINT
-              value: temp
-            - name: READ_WRITE_TIMEOUT_FILE_STREAM
-              value: 6h
-            - name: RELEASES_URL
-              value: https://gitlab.com
-            - name: REMARKS_URL
-              value: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks
-            - name: RESOURCES_URL
-              value: http://backend-svc.resources.svc.cluster.local:80
-            - name: S3_SERVICE_ACCOUNT
-              value: /vault/secrets/documentations-s3-account-json
-            - name: STATES_URL
-              value: http://backend-svc.workspaces.svc.cluster.local:80/
-            - name: SUBSCRIPTIONS_URL
-              value: http://backend-svc.subscriptions.svc.cluster.local:80
-            - name: SYSTEM_LOG_URL
-              value: http://api-service.system-log.svc.cluster.local:80
-            - name: TARGET_URL
-              value: http://backend-svc.django.svc.cluster.local:80
-            - name: USE_CACHE_IN_FILE_STREAMER
-              value: "1"
-            - name: USE_SUBSCRIPTIONS
-              value: "false"
-            - name: WIDTH_THUMB_ATTACHMENTS
-              value: "300"
-            - name: WIDTH_THUMB_STATES
-              value: "120"
-            - name: WORKFLOWS_IMAGES_VERSION
-              value: master
-            - name: WORKFLOW_IMAGES_VERSION
-              value: master
-            - name: WORKFLOW_URL
-              value: http://backend-svc.processing.svc.cluster.local:80/
-            - name: WORKSPACE_BUNDLE_VERSION
-              value: v1
-            - name: WORKSPACE_URL
-              value: http://backend-svc.workspaces.svc.cluster.local:80/
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-
-      imagePullSecrets:
-        - name: regcred

apps/documentations/base/pdm-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pdm-svc
-  namespace: documentations
-spec:
-  type: ClusterIP
-  selector:
-    app: pdm-api
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP

apps/documentations/base/pdm.yaml

@@ -0,0 +1,278 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdm-api
+  namespace: documentations
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: documentations-vault
+        deployment:
+          enabled: true
+          name:
+            _default: pdm-api
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8080
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/documentations-postgresql ] && . /vault/secrets/documentations-postgresql
+                [ -f /vault/secrets/documentations-common ] && . /vault/secrets/documentations-common
+                [ -f /vault/secrets/documentations-rsa-public ] && export PUBLIC_KEY="$(cat /vault/secrets/documentations-rsa-public)"
+                set +a
+                exec ./httpserver
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: pdm-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8080
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: USE_EXPERIMENTAL
+            value:
+              _default: "true"
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: TRANSMITTALS_BASE_URL
+            value:
+              _default: mock
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: BUCKET_NAME
+            value:
+              _default: attachments-storage
+          - name: API_HOST_PREFIX
+            value:
+              _default: /
+          - name: APP_NAME
+            value:
+              _default: pdm_v2
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+          - name: ENABLE_PERMISSIONS_FILTER
+            value:
+              _default: "1"
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+          - name: TRANSMITTALS_ENABLE
+            value:
+              _default: "false"
+          - name: DRAWINGS_INTERNAL_URL
+            value:
+              _default: http://drawings-api-service.drawings.svc.cluster.local:80
+          - name: ATTACHMENTS_URL
+            value:
+              _default: http://attachments-service.attachments.svc.cluster.local:8000
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: BIM_V2_HOST
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
+          - name: EAV_URL
+            value:
+              _default: http://backend-svc.eav.svc.cluster.local:80
+          - name: ENABLE_OBSERVABILITY
+            value:
+              _default: "false"
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: ENVIRONMENT
+            value:
+              _default: prod
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-svc.flows.svc.cluster.local:80
+          - name: HEIGHT_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+          - name: HEIGHT_THUMB_STATES
+            value:
+              _default: "73"
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+          - name: INSPECTIONS_URL
+            value:
+              _default: http://inspections-service.inspections.svc.cluster.local:80
+          - name: LOG_LEVEL
+            value:
+              _default: INFO
+          - name: NOTES_URL
+            value:
+              _default: ""
+          - name: OBSERVABILITY_COLLECTOR_ENDPOINT
+            value:
+              _default: temp
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: RELEASES_URL
+            value:
+              _default: https://gitlab.com
+          - name: REMARKS_URL
+            value:
+              _default: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks
+          - name: RESOURCES_URL
+            value:
+              _default: http://iam-backend.iam.svc.cluster.local:8000
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /vault/secrets/documentations-s3-account-json
+          - name: STATES_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+          - name: SUBSCRIPTIONS_URL
+            value:
+              _default: http://backend-svc.subscriptions.svc.cluster.local:80
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:80
+          - name: TARGET_URL
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+          - name: USE_SUBSCRIPTIONS
+            value:
+              _default: "false"
+          - name: WIDTH_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+          - name: WIDTH_THUMB_STATES
+            value:
+              _default: "120"
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: RELEASES_TOKEN
+            value:
+              _default: "mock"
+          - name: WORKFLOW_URL
+            value:
+              _default: http://backend-svc.processing.svc.cluster.local:80/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: WORKSPACE_URL
+            value:
+              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: documentations
+            vault.hashicorp.com/agent-inject-secret-documentations-postgresql: secrets/data/apps/documentations/postgres
+            vault.hashicorp.com/agent-inject-template-documentations-postgresql: |-
+              {{- with secret "secrets/data/apps/documentations/postgres" -}}
+              POSTGRES_ADDRESS={{ index .Data.data "host" }}
+              POSTGRES_PORT={{ index .Data.data "port" }}
+              POSTGRES_DB={{ index .Data.data "database" }}
+              POSTGRES_USER={{ index .Data.data "username" }}
+              POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-common: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-common: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_BASIC_AUTH={{ index .Data.data "key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-s3-account-json: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-documentations-s3-account-json: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              {{ index .Data.data "documentations_s3_service_account_json" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-documentations-rsa-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-documentations-rsa-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}

apps/documentations/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: documentations-vault
-  namespace: documentations

apps/documentations/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: documentations
+resources:
+  - ../base

apps/documentations/dsinv/documentations-api.yaml

@@ -1,110 +1,161 @@
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: documentations-api
   namespace: documentations
 spec:
-  replicas: 4
-  template:
-    spec:
-      containers:
-      - name: documentations-api
-        image: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_54880e92
-        env:
-        - name: PUBLIC_LINK_HOST
-          value: https://document-link.sarex.dsinv.ru
-        - name: POSTGRES_ADDRESS
-          value: postgres-service
-        - name: POSTGRES_PORT
-          value: '5432'
-        - name: POSTGRES_DB
-          value: documentations
-        - name: POSTGRES_POOL_SIZE
-          value: '20'
-        - name: LAST_MASTER_BIM
-          value: '36311'
-        - name: API_ADDRESS
-          value: 0.0.0.0:8080
-        - name: API_ADDRESS_FILE
-          value: 0.0.0.0:8080
-        - name: ENABLE_SQL_QUERY
-          value: '0'
-        - name: ENABLE_SSL
-          value: '0'
-        - name: ENABLE_MAILGUN
-          value: 'false'
-        - name: ENABLE_SMTP
-          value: 'true'
-        - name: ENABLE_S3
-          value: '1'
-        - name: USE_BIM_INSERTER
-          value: '0'
-        - name: CONTAINER_REGISTRY
-          value: cr.yandex/crp3ccidau046kdj8g9q
-        - name: ENVIRONMENT
-          value: production
-        - name: HOST
-          value: http://documentations-service.documentations.svc.cluster.local:8080
-        - name: FILE_STREAM_HOST
-          value: sarex.dsinv.ru
-        - name: DOCUMENTATION_URL
-          value: http://documentations-service.documentations.svc.cluster.local:8080/
-        - name: WORKFLOW_URL
-          value: http://workflows-service.workflow.svc.cluster.local:8000/
-        - name: WORKSPACE_URL
-          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
-        - name: BIM_API_URL
-          value: http://bim-api-service.bim.svc.cluster.local:8080/
-        - name: BIM_API_V2_URL
-          value: http://backend-service.bim.svc.cluster.local:8000/
-        - name: WORKSPACE_BUNDLE_VERSION
-          value: v1
-        - name: SYSTEM_LOG_URL
-          value: http://api-service.system-log.svc.cluster.local:8000
-        - name: DJANGO_HOST
-          value: http://backend.django.svc.cluster.local:8000
-        - name: MARKS_PROCESSING_URL
-          value: http://marks-service.documentations.svc.cluster.local:8000
-        - name: NAMESPACE
-          value: documentations
-        - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-          value: '5'
-        - name: DJANGO_ORIGINATOR
-          value: docs_prod
-        - name: WORKFLOW_IMAGES_VERSION
-          value: master
-        - name: WORKSPACE_V2_EXTERNAL_URL
-          value: https://sarex.dsinv.ru/workspaces-v2/
-        - name: WORKFLOWS_IMAGES_VERSION
-          value: master
-        - name: FLOWS_URL
-          value: http://backend-service.flows.svc.cluster.local:8000
-        - name: S3_SERVICE_ACCOUNT
-          value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
-        - name: READ_WRITE_TIMEOUT_FILE_STREAM
-          value: 6h
-        - name: CACHE_DEFAULT_EXPIRATION
-          value: 60s
-        - name: CACHE_CLEANUP_INTERVAL
-          value: 60s
-        - name: USE_CACHE_IN_FILE_STREAMER
-          value: '1'
-        - name: IS_CONVERTED_PDF_UPLOADING_TO_S3
-          value: 'false'
-        - name: TRACER_USE
-          value: '0'
-        - name: TRACER_HOST
-          value: signoz-otel-collector-external.signoz.svc.cluster.local:4317
-        - name: SERVICE_NAME
-          value: documentations-api.documentations-prod
-        - name: SERVICE_NAME_FILESTREAM
-          value: filestream-api.documentations-prod
-        - name: TRACER_USE_INSECURE
-          value: '1'
-        - name: DELETE_S3D_AFTER_MESHOPT
-          value: 'true'
-        - name: CONVERT_DWG_TO_GEOJSON
-          value: 'false'
-        - name: CONVERT_DXF_TO_GEOJSON
-          value: 'false'
+  values:
+    services:
+      backend:
+        deployment:
+          replicaCount:
+            _default: 4
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_54880e92
+        envs:
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: https://document-link.sarex.dsinv.ru
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: postgres-service
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+          - name: POSTGRES_DB
+            value:
+              _default: documentations
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "false"
+          - name: ENABLE_SMTP
+            value:
+              _default: "true"
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: USE_BIM_INSERTER
+            value:
+              _default: "0"
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: HOST
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:8080
+          - name: FILE_STREAM_HOST
+            value:
+              _default: sarex.dsinv.ru
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:8080/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://workflows-service.workflow.svc.cluster.local:8000/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:8000/
+          - name: BIM_API_URL
+            value:
+              _default: http://bim-api-service.bim.svc.cluster.local:8080/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:8000
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: http://marks-service.documentations.svc.cluster.local:8000
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: https://sarex.dsinv.ru/workspaces-v2/
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-service.flows.svc.cluster.local:8000
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+          - name: IS_CONVERTED_PDF_UPLOADING_TO_S3
+            value:
+              _default: "false"
+          - name: TRACER_USE
+            value:
+              _default: "0"
+          - name: TRACER_HOST
+            value:
+              _default: signoz-otel-collector-external.signoz.svc.cluster.local:4317
+          - name: SERVICE_NAME
+            value:
+              _default: documentations-api.documentations-prod
+          - name: SERVICE_NAME_FILESTREAM
+            value:
+              _default: filestream-api.documentations-prod
+          - name: TRACER_USE_INSECURE
+            value:
+              _default: "1"
+          - name: DELETE_S3D_AFTER_MESHOPT
+            value:
+              _default: "true"
+          - name: CONVERT_DWG_TO_GEOJSON
+            value:
+              _default: "false"
+          - name: CONVERT_DXF_TO_GEOJSON
+            value:
+              _default: "false"

apps/documentations/dsinv/documentations-filestream.yaml

@@ -1,74 +1,107 @@
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: documentations-filestream
   namespace: documentations
 spec:
-  replicas: 3
-  template:
-    spec:
-      containers:
-      - name: documentations-filestream
-        image: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_54880e92
-        env:
-        - name: POSTGRES_ADDRESS
-          value: postgres-service
-        - name: POSTGRES_PORT
-          value: '5432'
-        - name: POSTGRES_DB
-          value: documentations
-        - name: POSTGRES_POOL_SIZE
-          value: '20'
-        - name: API_ADDRESS
-          value: 0.0.0.0:8080
-        - name: API_ADDRESS_FILE
-          value: 0.0.0.0:8080
-        - name: ENABLE_SQL_QUERY
-          value: '1'
-        - name: ENABLE_SSL
-          value: '0'
-        - name: ENABLE_S3
-          value: '1'
-        - name: CONTAINER_REGISTRY
-          value: cr.yandex/crp3ccidau046kdj8g9q
-        - name: ENVIRONMENT
-          value: production
-        - name: HOST
-          value: http://documentations-service.documentations.svc.cluster.local:8080
-        - name: FILE_STREAM_HOST
-          value: sarex.dsinv.ru
-        - name: DOCUMENTATION_URL
-          value: http://documentations-service.documentations.svc.cluster.local:8080/
-        - name: WORKFLOW_URL
-          value: http://workflows-service.workflow.svc.cluster.local:8000/
-        - name: WORKSPACE_URL
-          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
-        - name: BIM_API_URL
-          value: http://bim-api-service.bim.svc.cluster.local:8080/
-        - name: BIM_API_V2_URL
-          value: http://backend-service.bim.svc.cluster.local:8000/
-        - name: WORKSPACE_BUNDLE_VERSION
-          value: v1
-        - name: DJANGO_HOST
-          value: http://backend.django.svc.cluster.local:8000
-        - name: NAMESPACE
-          value: sarex-documentations
-        - name: DJANGO_ORIGINATOR
-          value: docs_prod
-        - name: WORKFLOW_IMAGES_VERSION
-          value: master
-        - name: WORKFLOWS_IMAGES_VERSION
-          value: master
-        - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-          value: '5'
-        - name: S3_SERVICE_ACCOUNT
-          value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
-        - name: READ_WRITE_TIMEOUT_FILE_STREAM
-          value: 6h
-        - name: CACHE_DEFAULT_EXPIRATION
-          value: 60s
-        - name: CACHE_CLEANUP_INTERVAL
-          value: 60s
-        - name: USE_CACHE_IN_FILE_STREAMER
-          value: '1'
+  values:
+    services:
+      backend:
+        deployment:
+          replicaCount:
+            _default: 3
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_54880e92
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: postgres-service
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+          - name: POSTGRES_DB
+            value:
+              _default: documentations
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "1"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: cr.yandex/crp3ccidau046kdj8g9q
+          - name: ENVIRONMENT
+            value:
+              _default: production
+          - name: HOST
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:8080
+          - name: FILE_STREAM_HOST
+            value:
+              _default: sarex.dsinv.ru
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:8080/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://workflows-service.workflow.svc.cluster.local:8000/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:8000/
+          - name: BIM_API_URL
+            value:
+              _default: http://bim-api-service.bim.svc.cluster.local:8080/
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
+          - name: NAMESPACE
+            value:
+              _default: sarex-documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"

apps/documentations/dsinv/frontend.yaml

@@ -1,12 +1,13 @@
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: frontend
   namespace: documentations
 spec:
-  template:
-    spec:
-      containers:
-      - name: frontend
-        image: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_b80d28d4
+  values:
+    services:
+      frontend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_b80d28d4

apps/documentations/dsinv/kustomization.yaml

@@ -10,17 +10,17 @@ resources:
 patches:
 - path: documentations-api.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: documentations-api
 - path: documentations-filestream.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: documentations-filestream
 - path: frontend.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: frontend
 - path: pdm-api.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: pdm-api

apps/documentations/dsinv/pdm-api.yaml

@@ -1,120 +1,173 @@
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: pdm-api
   namespace: documentations
 spec:
-  replicas: 3
-  template:
-    spec:
-      containers:
-      - name: pdm-api
-        image: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_542e5343
-        env:
-        - name: OBSERVABILITY_COLLECTOR_ENDPOINT
-          value: temp
-        - name: USE_SUBSCRIPTIONS
-          value: 'false'
-        - name: RELEASES_URL
-          value: https://gitlab.com
-        - name: APP_NAME
-          value: pdm_v2
-        - name: APP_VERSION
-          value: 0.0.1
-        - name: LOG_LEVEL
-          value: INFO
-        - name: HTTP_PORT
-          value: '8080'
-        - name: POSTGRES_ADDRESS
-          value: postgres-service.documentations.svc.cluster.local
-        - name: POSTGRES_PORT
-          value: '5432'
-        - name: POSTGRES_DB
-          value: documentations
-        - name: POSTGRES_POOL_SIZE
-          value: '20'
-        - name: API_ADDRESS
-          value: 0.0.0.0:8080
-        - name: API_ADDRESS_FILE
-          value: 0.0.0.0:8080
-        - name: ENABLE_OBSERVABILITY
-          value: 'false'
-        - name: ENABLE_SSL
-          value: '0'
-        - name: ENABLE_S3
-          value: '1'
-        - name: DOCUMENTATION_URL
-          value: http://documentations-service.documentations.svc.cluster.local:8080/
-        - name: WORKFLOW_URL
-          value: http://workflows-service.workflow.svc.cluster.local:8000/
-        - name: WORKSPACE_URL
-          value: http://workspaces-service.workspaces.svc.cluster.local:8000
-        - name: BIM_API_V2_URL
-          value: http://backend-service.bim.svc.cluster.local:8000/
-        - name: BIM_V2_HOST
-          value: http://backend-service.bim.svc.cluster.local:8000/
-        - name: WORKSPACE_BUNDLE_VERSION
-          value: v1
-        - name: DJANGO_HOST
-          value: http://backend.django.svc.cluster.local:8000
-        - name: NAMESPACE
-          value: documentations
-        - name: DJANGO_ORIGINATOR
-          value: docs_prod
-        - name: FLOWS_URL
-          value: http://backend-service.flows.svc.cluster.local:8000
-        - name: RESOURCES_URL
-          value: http://resources-service.resources.svc.cluster.local:8000
-        - name: REMARKS_URL
-          value: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks
-        - name: ATTACHMENTS_URL
-          value: http://attachments-service.attachments.svc.cluster.local:80
-        - name: WORKFLOW_IMAGES_VERSION
-          value: master
-        - name: WORKFLOWS_IMAGES_VERSION
-          value: master
-        - name: WORKFLOWS_IMAGES_VERSION
-          value: master
-        - name: INSPECTIONS_URL
-          value: http://inspections-service.inspections
-        - name: STATES_URL
-          value: http://workspaces-service.workspaces.svc.cluster.local:8000/
-        - name: WIDTH_THUMB_STATES
-          value: '120'
-        - name: HEIGHT_THUMB_STATES
-          value: '73'
-        - name: WIDTH_THUMB_ATTACHMENTS
-          value: '300'
-        - name: HEIGHT_THUMB_ATTACHMENTS
-          value: '300'
-        - name: ENABLE_PERMISSIONS_FILTER
-          value: '1'
-        - name: PERMISSIONS_FILTER_COMPANIES
-          value: '[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]'
-        - name: SUBSCRIPTIONS_URL
-          value: http://sarex-subscriptions-service.subscriptions
-        - name: SYSTEM_LOG_URL
-          value: http://api-service.system-log.svc.cluster.local:8000
-        - name: API_HOST_PREFIX
-          value: /gateway
-        - name: TARGET_URL
-          value: http://backend.django.svc.cluster.local:8000
-        - name: EAV_URL
-          value: http://eav-service.eav.svc.cluster.local:8000
-        - name: NOTES_URL
-          value: http://backend-service.notes.svc.cluster.local:8000
-        - name: S3_SERVICE_ACCOUNT
-          value: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
-        - name: READ_WRITE_TIMEOUT_FILE_STREAM
-          value: 6h
-        - name: CACHE_DEFAULT_EXPIRATION
-          value: 60s
-        - name: CACHE_CLEANUP_INTERVAL
-          value: 60s
-        - name: USE_CACHE_IN_FILE_STREAMER
-          value: '1'
-        - name: ENVIRONMENT
-          value: prod
-        - name: TRANSMITTALS_BASE_URL
-          value: http://transmittal-service.transmittals.svc.cluster.local:80
+  values:
+    services:
+      backend:
+        deployment:
+          replicaCount:
+            _default: 3
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_542e5343
+        envs:
+          - name: OBSERVABILITY_COLLECTOR_ENDPOINT
+            value:
+              _default: temp
+          - name: USE_SUBSCRIPTIONS
+            value:
+              _default: "false"
+          - name: RELEASES_URL
+            value:
+              _default: https://gitlab.com
+          - name: APP_NAME
+            value:
+              _default: pdm_v2
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+          - name: LOG_LEVEL
+            value:
+              _default: INFO
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: postgres-service.documentations.svc.cluster.local
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+          - name: POSTGRES_DB
+            value:
+              _default: documentations
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+          - name: API_ADDRESS
+            value:
+              _default: 0.0.0.0:8080
+          - name: API_ADDRESS_FILE
+            value:
+              _default: 0.0.0.0:8080
+          - name: ENABLE_OBSERVABILITY
+            value:
+              _default: "false"
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+          - name: DOCUMENTATION_URL
+            value:
+              _default: http://documentations-service.documentations.svc.cluster.local:8080/
+          - name: WORKFLOW_URL
+            value:
+              _default: http://workflows-service.workflow.svc.cluster.local:8000/
+          - name: WORKSPACE_URL
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:8000
+          - name: BIM_API_V2_URL
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: BIM_V2_HOST
+            value:
+              _default: http://backend-service.bim.svc.cluster.local:8000/
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: v1
+          - name: DJANGO_HOST
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
+          - name: NAMESPACE
+            value:
+              _default: documentations
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: docs_prod
+          - name: FLOWS_URL
+            value:
+              _default: http://backend-service.flows.svc.cluster.local:8000
+          - name: RESOURCES_URL
+            value:
+              _default: http://resources-service.resources.svc.cluster.local:8000
+          - name: REMARKS_URL
+            value:
+              _default: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks
+          - name: ATTACHMENTS_URL
+            value:
+              _default: http://attachments-service.attachments.svc.cluster.local:80
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: master
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: master
+          - name: INSPECTIONS_URL
+            value:
+              _default: http://inspections-service.inspections
+          - name: STATES_URL
+            value:
+              _default: http://workspaces-service.workspaces.svc.cluster.local:8000/
+          - name: WIDTH_THUMB_STATES
+            value:
+              _default: "120"
+          - name: HEIGHT_THUMB_STATES
+            value:
+              _default: "73"
+          - name: WIDTH_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+          - name: HEIGHT_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+          - name: ENABLE_PERMISSIONS_FILTER
+            value:
+              _default: "1"
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]"
+          - name: SUBSCRIPTIONS_URL
+            value:
+              _default: http://sarex-subscriptions-service.subscriptions
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: http://api-service.system-log.svc.cluster.local:8000
+          - name: API_HOST_PREFIX
+            value:
+              _default: /gateway
+          - name: TARGET_URL
+            value:
+              _default: http://backend.django.svc.cluster.local:8000
+          - name: EAV_URL
+            value:
+              _default: http://eav-service.eav.svc.cluster.local:8000
+          - name: NOTES_URL
+            value:
+              _default: http://backend-service.notes.svc.cluster.local:8000
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: 6h
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: 60s
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: 60s
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+          - name: ENVIRONMENT
+            value:
+              _default: prod
+          - name: TRANSMITTALS_BASE_URL
+            value:
+              _default: http://transmittal-service.transmittals.svc.cluster.local:80

apps/documentations/yc-k8s-test/kustomization.yaml

@@ -4,6 +4,4 @@ kind: Kustomization
 resources:
   - ../base
   - postgresql.yaml
-  - redis-deployment.yaml
-  - redis-service.yaml
 patches: []

apps/eav/CONFIGURATION.md

@@ -22,7 +22,7 @@
 | Локально (manage.py / uWSGI) | Переменные окружения процесса (`.env` нужно экспортировать вручную) |
 | Локально (docker-compose) | `docker-compose.yml`: блок `environment` сервиса `backend` + образ `postgres` (timescaledb-postgis) |
 | Kubernetes (Helm, репозиторий приложения) | `.helm/values-<env>.yaml`: блоки `backend.deployment.envs` (обычные значения) и `backend.deployment.secrets` (из k8s-секретов через `secretKeyRef`); шаблон `templates/server.yaml`, роутинг — `templates/mesh-config.yaml` (Istio VirtualService) |
-| Kubernetes (infra, Flux/Kustomize) | `infra/iac/apps/eav/base/backend-deployment.yaml`: секреты инъектируются Vault-агентом (`vault.hashicorp.com/agent-inject-*`) и экспортируются в окружение в `args`; настройки `production.py` монтируются из `django-configmap` |
+| Kubernetes (infra, Flux/Kustomize) | `infra/iac/apps/eav/base/helmrelease.yaml` (universal-chart): секреты инъектируются Vault-агентом (`vault.hashicorp.com/agent-inject-*`) и экспортируются в окружение в `args`; настройки `production.py` монтируются из `django-configmap` |
 | CI/CD (GitLab) | `.gitlab-ci.yml`: общие шаблоны `generic/common-ci`, переменные пайплайна в `workflow.rules` |
 
 Способы запуска процессов:
@@ -153,7 +153,7 @@
 
 ## Переменные в infra-манифесте (Flux/Kustomize, `infra/iac/apps/eav`)
 
-В отличие от Helm-чарта приложения, боевой деплой Sarex использует Vault-инъекцию (`base/backend-deployment.yaml`). Секреты рендерятся Vault-агентом в файлы `/vault/secrets/*` и экспортируются в окружение в `args` контейнера перед запуском `entrypoint.sh`:
+В отличие от Helm-чарта приложения, боевой деплой Sarex использует Vault-инъекцию (`base/helmrelease.yaml`, чарт `universal-chart`). Секреты рендерятся Vault-агентом в файлы `/vault/secrets/*` и экспортируются в окружение в `args` контейнера перед запуском `entrypoint.sh`:
 
 | Переменная(ые) | Источник (Vault path) |
 | --- | --- |

apps/eav/base/backend-deployment.yaml

@@ -1,117 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backend
-  namespace: eav
-  labels:
-    app: backend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: backend
-  template:
-    metadata:
-      labels:
-        app: backend
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: eav
-        vault.hashicorp.com/agent-inject-secret-eav-db: secrets/data/postgresql/apps/eav
-        vault.hashicorp.com/agent-inject-template-eav-db: |-
-          {{- with secret "secrets/data/postgresql/apps/eav" -}}
-          DJANGO_POSTGRES_HOST=postgresql.eav.svc.cluster.local
-          DJANGO_POSTGRES_PORT=5432
-          DJANGO_POSTGRES_DATABASE=eav_db
-          DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
-          DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-eav-s3: secrets/data/minio/apps/eav
-        vault.hashicorp.com/agent-inject-template-eav-s3: |-
-          {{- with secret "secrets/data/minio/apps/eav" -}}
-          YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
-          YC_S3_BUCKET_NAME=eav
-          YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-eav-jwt-private: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-eav-jwt-private: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "private_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-eav-jwt-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-eav-jwt-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: eav-vault
-      volumes:
-        - name: django-configmap
-          configMap:
-            name: django-configmap
-            items:
-              - key: production.py
-                path: production.py
-          defaultMode: 420
-
-      containers:
-        - name: backend
-          image: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/eav-db ] && . /vault/secrets/eav-db
-              [ -f /vault/secrets/eav-s3 ] && . /vault/secrets/eav-s3
-              [ -f /vault/secrets/eav-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/eav-jwt-private)"
-              [ -f /vault/secrets/eav-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/eav-jwt-public)"
-              set +a
-              exec /server/entrypoint.sh
-
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-
-          env:
-            - name: KAFKA_ENABLED
-              value: "False"
-            - name: ASSETS_TOPIC
-              value: sarex
-            - name: DJANGO_SETTINGS_MODULE
-              value: config.settings.production
-
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-
-          volumeMounts:
-            - name: django-configmap
-              mountPath: /server/config/settings/production.py
-              subPath: production.py
-
-          livenessProbe:
-            tcpSocket:
-              port: 8000
-            initialDelaySeconds: 20
-            periodSeconds: 30
-            timeoutSeconds: 3
-            failureThreshold: 5
-
-          readinessProbe:
-            tcpSocket:
-              port: 8000
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 6
-
-      imagePullSecrets:
-        - name: regcred

apps/eav/base/backend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-svc
-  namespace: eav
-spec:
-  type: ClusterIP
-  selector:
-    app: backend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8000
-      protocol: TCP

apps/eav/base/helmrelease.yaml

@@ -0,0 +1,176 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: eav
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: eav-vault
+        deployment:
+          enabled: true
+          name:
+            _default: backend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/eav-db ] && . /vault/secrets/eav-db
+                [ -f /vault/secrets/eav-s3 ] && . /vault/secrets/eav-s3
+                [ -f /vault/secrets/eav-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/eav-jwt-private)"
+                [ -f /vault/secrets/eav-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/eav-jwt-public)"
+                set +a
+                exec /server/entrypoint.sh
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              type:
+                _default: tcpSocket
+              tcpSocket:
+                port:
+                  _default: 8000
+              initialDelaySeconds:
+                _default: 20
+              periodSeconds:
+                _default: 30
+              timeoutSeconds:
+                _default: 3
+              failureThreshold:
+                _default: 5
+            readiness:
+              enabled:
+                _default: true
+              type:
+                _default: tcpSocket
+              tcpSocket:
+                port:
+                  _default: 8000
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 10
+              timeoutSeconds:
+                _default: 3
+              failureThreshold:
+                _default: 6
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: backend-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8000
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        volumes:
+          _default:
+            - name: django-configmap
+              mountPath:
+                _default: /server/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+        envs:
+          - name: KAFKA_ENABLED
+            value:
+              _default: "False"
+          - name: ASSETS_TOPIC
+            value:
+              _default: sarex
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: eav
+            vault.hashicorp.com/agent-inject-secret-eav-db: secrets/data/apps/eav/postgres
+            vault.hashicorp.com/agent-inject-template-eav-db: |-
+              {{- with secret "secrets/data/apps/eav/postgres" -}}
+              DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
+              DJANGO_POSTGRES_PORT={{ index .Data.data "port" }}
+              DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
+              DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
+              DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-eav-s3: secrets/data/minio/apps/eav
+            vault.hashicorp.com/agent-inject-template-eav-s3: |-
+              {{- with secret "secrets/data/minio/apps/eav" -}}
+              YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
+              YC_S3_BUCKET_NAME=eav
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-eav-jwt-private: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-eav-jwt-private: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "private_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-eav-jwt-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-eav-jwt-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}

apps/eav/base/kustomization.yaml

@@ -4,7 +4,5 @@ kind: Kustomization
 namespace: eav
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
-  - backend-deployment.yaml
-  - backend-service.yaml
+  - helmrelease.yaml
   - django-configmap.yaml

apps/eav/base/namespace.yaml

@@ -5,3 +5,4 @@ metadata:
   name: eav
   labels:
     istio-injection: enabled
+    security.deckhouse.io/pod-policy: privileged

apps/eav/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: eav-vault
-  namespace: eav

apps/eav/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: eav
+resources:
+  - ../base

apps/eav/dsinv/backend.yaml

@@ -1,27 +1,35 @@
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: backend
   namespace: eav
 spec:
-  template:
-    spec:
-      containers:
-      - name: backend
-        image: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_ddce2b51
-        env:
-        - name: DJANGO_SETTINGS_MODULE
-          value: config.settings.production
-        - name: ASSETS_TOPIC
-          value: sarex
-        - name: KAFKA_SSL_CAFILE
-          value: /usr/local/share/ca-certificates/ca.crt
-        - name: DJANGO_POSTGRES_HOST
-          value: postgres-service
-        - name: DJANGO_POSTGRES_DATABASE
-          value: eav_db
-        - name: YC_S3_ENDPOINT_URL
-          value: http://minio-service.minio.svc.cluster.local:9000
-        - name: YC_S3_BUCKET_NAME
-          value: eav
+  values:
+    services:
+      backend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_ddce2b51
+        envs:
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+          - name: ASSETS_TOPIC
+            value:
+              _default: sarex
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: /usr/local/share/ca-certificates/ca.crt
+          - name: DJANGO_POSTGRES_HOST
+            value:
+              _default: postgres-service
+          - name: DJANGO_POSTGRES_DATABASE
+            value:
+              _default: eav_db
+          - name: YC_S3_ENDPOINT_URL
+            value:
+              _default: http://minio-service.minio.svc.cluster.local:9000
+          - name: YC_S3_BUCKET_NAME
+            value:
+              _default: eav

apps/eav/dsinv/kustomization.yaml

@@ -7,5 +7,5 @@ resources:
 patches:
 - path: backend.yaml
   target:
-    kind: Deployment
+    kind: HelmRelease
     name: backend

apps/eav/yc-k8s-test/kustomization.yaml

@@ -7,5 +7,5 @@ resources:
 patches:
   - path: replicas.yaml
     target:
-      kind: Deployment
+      kind: HelmRelease
       name: backend

apps/eav/yc-k8s-test/replicas.yaml

@@ -1,8 +1,13 @@
 ---
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
 metadata:
   name: backend
   namespace: eav
 spec:
-  replicas: 1
+  values:
+    services:
+      backend:
+        deployment:
+          replicaCount:
+            _default: 1

apps/iam/base/backend.yaml

@@ -0,0 +1,214 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: iam-backend
+  namespace: iam
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: iam-vault
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: iam-backend
+
+          replicaCount:
+            _default: 1
+            production: 4
+
+          port:
+            _default: 8080
+
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/iam-db ] && . /vault/secrets/iam-db
+                [ -f /vault/secrets/iam-zitadel ] && . /vault/secrets/iam-zitadel
+                [ -f /vault/secrets/iam-kafka ] && . /vault/secrets/iam-kafka
+                [ -f /vault/secrets/iam-s3 ] && . /vault/secrets/iam-s3
+                set +a
+                exec ./server
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: iam-backend
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        labels:
+          monitoring: prometheus
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "debug"
+
+          - name: AUTH_ENABLED
+            value:
+              _default: "true"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+
+          - name: HTTP_READ_BUFFER_SIZE
+            value:
+              _default: "131072"
+
+          - name: DB_MIGRATIONS_PATH
+            value:
+              _default: "migrations"
+
+          - name: ZITADEL_ENABLED
+            value:
+              _default: "false"
+
+          - name: ZITADEL_HOST
+            value:
+              _default: "https://login.sarex.io"
+
+          - name: ZITADEL_ORG_RULES_FILE
+            value:
+              _default: "config/zitadel/org-rules-prod.json"
+
+          - name: S3_ENABLED
+            value:
+              _default: "true"
+
+          - name: S3_ENDPOINT_URL
+            value:
+              _default: "https://storage.yandexcloud.net"
+
+          - name: S3_BUCKET_NAME
+            value:
+              _default: "sarex-media-storage"
+
+          - name: S3_REGION
+            value:
+              _default: "ru-central1"
+
+          - name: S3_PRESIGN_EXPIRES
+            value:
+              _default: "1h"
+
+          - name: KAFKA_ENABLED
+            value:
+              _default: "false"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/etc/ca-certificates/Yandex/ca-cert"
+
+          - name: KAFKA_TOPIC_LEGACY_AMS_SYNC
+            value:
+              _default: "ams-sync"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "4317,4318,9411,8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: iam
+            vault.hashicorp.com/agent-inject-secret-iam-db: secrets/data/apps/iam/postgres
+            vault.hashicorp.com/agent-inject-template-iam-db: |-
+              {{- with secret "secrets/data/apps/iam/postgres" -}}
+              DB_DSN=postgres://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@{{ index .Data.data "host" }}:{{ index .Data.data "port" }}/{{ index .Data.data "database" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-iam-zitadel: secrets/data/apps/iam/zitadel
+            vault.hashicorp.com/agent-inject-template-iam-zitadel: |-
+              {{- with secret "secrets/data/apps/iam/zitadel" -}}
+              ZITADEL_ACCESS_TOKEN={{ index .Data.data "access_token" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-iam-kafka: secrets/data/kafka/apps/iam
+            vault.hashicorp.com/agent-inject-template-iam-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/iam" -}}
+              KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
+              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
+              KAFKA_BROKERS={{ index .Data.data.auth "bootstrap_servers" }}
+              KAFKA_SASL_PLAIN_USERNAME={{ index .Data.data "username" }}
+              KAFKA_SASL_PLAIN_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-iam-s3: secrets/data/minio/apps/iam
+            vault.hashicorp.com/agent-inject-template-iam-s3: |-
+              {{- with secret "secrets/data/minio/apps/iam" -}}
+              S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/iam/base/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: iam
+resources:
+  - namespace.yaml
+  - backend.yaml

apps/iam/base/namespace.yaml

@@ -1,7 +1,8 @@
+---
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: notes
+  name: iam
   labels:
-    istio-injection: disabled
+    istio-injection: enabled
     security.deckhouse.io/pod-policy: privileged

apps/iam/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: iam
+resources:
+  - ../base

apps/notes/base/backend-deployment.yaml

@@ -1,120 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backend
-  namespace: notes
-  labels:
-    app: backend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: backend
-  template:
-    metadata:
-      labels:
-        app: backend
-        service: main
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: notes
-        vault.hashicorp.com/agent-inject-secret-notes-db: secrets/data/postgresql/apps/notes
-        vault.hashicorp.com/agent-inject-template-notes-db: |-
-          {{- with secret "secrets/data/postgresql/apps/notes" -}}
-          PG_HOST=postgresql.notes.svc.cluster.local
-          PG_PORT=5432
-          PG_DB=notes_db
-          PG_LOGIN={{ index .Data.data "username" }}
-          PG_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-notes-django-auth: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-notes-django-auth: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_TOKEN={{ index .Data.data "key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-notes-rabbitmq: secrets/data/rabbitmq/apps/notes
-        vault.hashicorp.com/agent-inject-template-notes-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/notes" -}}
-          NOTES_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
-          NOTES_RABBITMQ_USERNAME={{ index .Data.data "username" }}
-          NOTES_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
-          NOTES_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
-          NOTES_RABBITMQ_PORT=5672
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-notes-s3: secrets/data/minio/apps/notes
-        vault.hashicorp.com/agent-inject-template-notes-s3: |-
-          {{- with secret "secrets/data/minio/apps/notes" -}}
-          NOTES_S3_ENDPOINT={{ index .Data.data.client "endpoint" }}
-          NOTES_S3_REGION={{ index .Data.data.client "region" }}
-          NOTES_S3_BUCKET=notes
-          NOTES_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          NOTES_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-notes-kafka: secrets/data/kafka/apps/notes
-        vault.hashicorp.com/agent-inject-template-notes-kafka: |-
-          {{- with secret "secrets/data/kafka/apps/notes" -}}
-          NOTES_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }}
-          NOTES_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
-          NOTES_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
-          NOTES_KAFKA_USERNAME={{ index .Data.data "username" }}
-          NOTES_KAFKA_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: notes-vault
-      containers:
-        - name: main
-          image: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/bash", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/notes-db ] && . /vault/secrets/notes-db
-              [ -f /vault/secrets/notes-django-auth ] && . /vault/secrets/notes-django-auth
-              [ -f /vault/secrets/notes-rabbitmq ] && . /vault/secrets/notes-rabbitmq
-              [ -f /vault/secrets/notes-s3 ] && . /vault/secrets/notes-s3
-              [ -f /vault/secrets/notes-kafka ] && . /vault/secrets/notes-kafka
-              set +a
-              exec /bin/bash /opt/entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: PG_SSL_MODE
-              value: verify-full
-            - name: DJANGO_HOST
-              value: https://lk.sarex.io
-            - name: BASE_HOST
-              value: https://api.sarex.io/notes
-            - name: TIMEOUT
-              value: "120"
-            - name: FAAS_SERVICE
-              value: https://api.sarex.io/lambdas
-            - name: WORKSPACE_URL
-              value: https://api.sarex.io/workspaces/api/v1
-            - name: WORKFLOW_HOST
-              value: https://api.sarex.io/workflows/api/v1
-            - name: WORKFLOW_TAG
-              value: stable
-            - name: RESOURCE_URL
-              value: https://api.sarex.io/resources/api/v1
-            - name: SYNC_RESOURCE_ID
-              value: "0"
-            - name: ENABLE_ND
-              value: "0"
-            - name: ATTACHMENT_HOST
-              value: http://attachments-service.attachments.svc.cluster.local:80/api/v1
-            - name: PG_PORT
-              value: "5432"
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/notes/base/backend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-service
-  namespace: notes
-spec:
-  type: ClusterIP
-  selector:
-    app: backend
-  ports:
-    - name: http
-      port: 8000
-      targetPort: 8000
-      protocol: TCP

apps/notes/base/backend.yaml

@@ -0,0 +1,177 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: notes
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: notes-vault
+        deployment:
+          enabled: true
+          name:
+            _default: backend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/bash", "-c"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/notes-db ] && source /vault/secrets/notes-db
+                [ -f /vault/secrets/notes-django-auth ] && source /vault/secrets/notes-django-auth
+                [ -f /vault/secrets/notes-rabbitmq ] && source /vault/secrets/notes-rabbitmq
+                [ -f /vault/secrets/notes-s3 ] && source /vault/secrets/notes-s3
+                [ -f /vault/secrets/notes-kafka ] && source /vault/secrets/notes-kafka
+                set +a
+                /bin/bash /opt/entrypoint.sh
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: backend-service
+          type:
+            _default: ClusterIP
+          port:
+            _default: 8000
+          targetPort:
+            _default: 8000
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: PG_SSL_MODE
+            value:
+              _default: verify-full
+          - name: DJANGO_HOST
+            value:
+              _default: https://lk.sarex.io
+          - name: BASE_HOST
+            value:
+              _default: https://api.sarex.io/notes
+          - name: TIMEOUT
+            value:
+              _default: "120"
+          - name: FAAS_SERVICE
+            value:
+              _default: https://api.sarex.io/lambdas
+          - name: WORKSPACE_URL
+            value:
+              _default: https://api.sarex.io/workspaces/api/v1
+          - name: WORKFLOW_HOST
+            value:
+              _default: https://api.sarex.io/workflows/api/v1
+          - name: WORKFLOW_TAG
+            value:
+              _default: stable
+          - name: RESOURCE_URL
+            value:
+              _default: https://api.sarex.io/resources/api/v1
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "0"
+          - name: ENABLE_ND
+            value:
+              _default: "0"
+          - name: ATTACHMENT_HOST
+            value:
+              _default: http://attachments-service.attachments.svc.cluster.local:80/api/v1
+          - name: PG_PORT
+            value:
+              _default: "5432"
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: notes
+            vault.hashicorp.com/agent-inject-secret-notes-db: secrets/data/apps/notes/postgres
+            vault.hashicorp.com/agent-inject-template-notes-db: |-
+              {{- with secret "secrets/data/apps/notes/postgres" -}}
+              PG_HOST={{ index .Data.data "host" }}
+              PG_PORT={{ index .Data.data "port" }}
+              PG_DB={{ index .Data.data "database" }}
+              PG_LOGIN={{ index .Data.data "username" }}
+              PG_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-notes-django-auth: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-notes-django-auth: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_TOKEN={{ index .Data.data "key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-notes-rabbitmq: secrets/data/rabbitmq/apps/notes
+            vault.hashicorp.com/agent-inject-template-notes-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/notes" -}}
+              NOTES_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
+              NOTES_RABBITMQ_USERNAME={{ index .Data.data "username" }}
+              NOTES_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
+              NOTES_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
+              NOTES_RABBITMQ_PORT=5672
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-notes-s3: secrets/data/minio/apps/notes
+            vault.hashicorp.com/agent-inject-template-notes-s3: |-
+              {{- with secret "secrets/data/minio/apps/notes" -}}
+              NOTES_S3_ENDPOINT={{ index .Data.data.client "endpoint" }}
+              NOTES_S3_REGION={{ index .Data.data.client "region" }}
+              NOTES_S3_BUCKET=notes
+              NOTES_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              NOTES_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-notes-kafka: secrets/data/kafka/apps/notes
+            vault.hashicorp.com/agent-inject-template-notes-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/notes" -}}
+              NOTES_KAFKA_BOOTSTRAP_SERVERS={{ index .Data.data.auth "bootstrap_servers" }}
+              NOTES_KAFKA_SECURITY_PROTOCOL={{ index .Data.data.auth "security_protocol" }}
+              NOTES_KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
+              NOTES_KAFKA_USERNAME={{ index .Data.data "username" }}
+              NOTES_KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}

apps/notes/base/frontend-deployment.yaml

@@ -1,58 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: notes
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-        service: frontend
-    spec:
-      volumes:
-        - name: nginx-configmap
-          configMap:
-            name: nginx-configmap
-            items:
-              - key: nginx.conf
-                path: nginx.conf
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-          volumeMounts:
-            - name: nginx-configmap
-              mountPath: /etc/nginx/nginx.conf
-              subPath: nginx.conf
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            failureThreshold: 10
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            failureThreshold: 20
-      imagePullSecrets:
-        - name: regcred

apps/notes/base/frontend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: frontend-service
-  namespace: notes
-spec:
-  type: ClusterIP
-  selector:
-    app: frontend
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-      protocol: TCP

apps/notes/base/frontend.yaml

@@ -0,0 +1,86 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: notes
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      frontend:
+        enabled: true
+        deployment:
+          enabled: true
+          name:
+            _default: frontend
+          replicaCount:
+            _default: 1
+          port:
+            _default: 80
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 100Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: frontend-service
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 80
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        volumes:
+          _default:
+            - name: nginx-configmap
+              mountPath:
+                _default: /etc/nginx/nginx.conf
+              subPath:
+                _default: nginx.conf
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: nginx-configmap
+                items:
+                  - key: nginx.conf
+                    path: nginx.conf
+                defaultMode: 420

apps/notes/base/kustomization.yaml

@@ -3,10 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: notes
 resources:
-  - namespace.yaml
-  - serviceaccount.yaml
-  - backend-deployment.yaml
-  - backend-service.yaml
-  - frontend-deployment.yaml
-  - frontend-service.yaml
   - nginx-configmap.yaml
+  - backend.yaml
+  - frontend.yaml
+  - namespace.yaml

apps/notes/base/namespace.yaml

@@ -5,3 +5,6 @@ metadata:
   name: notes
   labels:
     istio-injection: enabled
+    security.deckhouse.io/pod-policy: privileged
+
+

apps/notes/base/serviceaccount.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: notes-vault
-  namespace: notes

apps/notes/d8-ugmk-prod/kustomization.yaml

@@ -1,11 +1,11 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: notes
 resources:
   - ../base
 patches:
-  - path: namespace.yaml
+  - path: patch.yaml
     target:
-      kind: Namespace
-      name: notes
-  - path: patch.yaml
+      kind: HelmRelease
+      name: frontend

apps/rfi/base/backend-deployment.yaml

@@ -1,99 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: rfi-backend-api
-  namespace: rfi
-  labels:
-    app: rfi-backend-api
-    service: api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: rfi-backend-api
-  template:
-    metadata:
-      labels:
-        app: rfi-backend-api
-        service: api
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: rfi
-        vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/postgresql/apps/rfi
-        vault.hashicorp.com/agent-inject-template-rfi-db: |-
-          {{- with secret "secrets/data/postgresql/apps/rfi" -}}
-          DB_HOST=postgresql.rfi.svc.cluster.local
-          DB_PORT=5432
-          DB_NAME=rfi_db
-          DB_USER={{ index .Data.data "username" }}
-          DB_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi
-        vault.hashicorp.com/agent-inject-template-rfi-s3: |-
-          {{- with secret "secrets/data/minio/apps/rfi" -}}
-          YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
-          YC_S3_BUCKET_NAME=rfi
-          YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi
-        vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/rfi" -}}
-          RABBITMQ_VHOST={{ index .Data.data "vhost" }}
-          RABBITMQ_USERNAME={{ index .Data.data "username" }}
-          RABBITMQ_PASSWORD={{ index .Data.data "password" }}
-          RABBITMQ_PORT=5672
-          RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-rfi-django-auth: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_SECRET_KEY={{ index .Data.data "key" }}
-          SAREX_BACKEND_AUTH={{ index .Data.data "key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: rfi-vault
-      containers:
-        - name: api
-          image: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db
-              [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3
-              [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq
-              [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth
-              set +a
-              exec ./entrypoint.sh
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: JWT_AUTH_ENABLE
-              value: "True"
-            - name: NOTIFICATIONS_ENABLE
-              value: "false"
-            - name: NOTIFICATIONS_EMAIL_FROM
-              value: hello@sarex.io
-            - name: NOTIFICATIONS_SERVICE_URL
-              value: https://sarex.contour.infra.sarex.tech/rfi
-            - name: SAREX_BACKEND_URL
-              value: http://backend-svc.django.svc.cluster.local
-            - name: EAV_URL
-              value: http://backend-svc.eav.svc.cluster.local:80
-            - name: GATEWAY_URL
-              value: http://pdm-svc.documentations.svc.cluster.local:80
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/rfi/base/backend-service.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend-svc
-  namespace: rfi
-spec:
-  type: ClusterIP
-  selector:
-    app: rfi-backend-api
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8000
-      protocol: TCP

apps/rfi/base/backend.yaml

@@ -0,0 +1,149 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: rfi
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      backend:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: rfi-vault
+        deployment:
+          enabled: true
+          name:
+            _default: rfi-backend-api
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db
+                [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3
+                [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq
+                [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth
+                set +a
+                exec ./entrypoint.sh
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: true
+          name:
+            _default: backend-svc
+          type:
+            _default: ClusterIP
+          port:
+            _default: 80
+          targetPort:
+            _default: 8000
+          portName:
+            _default: http
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "True"
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "false"
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: hello@sarex.io
+          - name: NOTIFICATIONS_SERVICE_URL
+            value:
+              _default: https://sarex.contour.infra.sarex.tech/rfi
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: http://backend-svc.django.svc.cluster.local
+          - name: EAV_URL
+            value:
+              _default: http://backend-svc.eav.svc.cluster.local:80
+          - name: GATEWAY_URL
+            value:
+              _default: http://pdm-svc.documentations.svc.cluster.local:80
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: rfi
+            vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres
+            vault.hashicorp.com/agent-inject-template-rfi-db: |-
+              {{- with secret "secrets/data/apps/rfi/postgres" -}}
+              DB_HOST={{ index .Data.data "host" }}
+              DB_PORT={{ index .Data.data "port" }}
+              DB_NAME={{ index .Data.data "database" }}
+              DB_USER={{ index .Data.data "username" }}
+              DB_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi
+            vault.hashicorp.com/agent-inject-template-rfi-s3: |-
+              {{- with secret "secrets/data/minio/apps/rfi" -}}
+              YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
+              YC_S3_BUCKET_NAME=rfi
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi
+            vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/rfi" -}}
+              RABBITMQ_VHOST={{ index .Data.data "vhost" }}
+              RABBITMQ_USERNAME={{ index .Data.data "username" }}
+              RABBITMQ_PASSWORD={{ index .Data.data "password" }}
+              RABBITMQ_PORT=5672
+              RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-rfi-django-auth: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_SECRET_KEY={{ index .Data.data "key" }}
+              SAREX_BACKEND_AUTH={{ index .Data.data "key" }}
+              {{- end -}}

apps/rfi/base/celery-deployment.yaml

@@ -1,99 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: celery
-  namespace: rfi
-  labels:
-    app: celery
-    service: celery
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: celery
-  template:
-    metadata:
-      labels:
-        app: celery
-        service: celery
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: rfi
-        vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/postgresql/apps/rfi
-        vault.hashicorp.com/agent-inject-template-rfi-db: |-
-          {{- with secret "secrets/data/postgresql/apps/rfi" -}}
-          DB_HOST=postgresql.rfi.svc.cluster.local
-          DB_PORT=5432
-          DB_NAME=rfi_db
-          DB_USER={{ index .Data.data "username" }}
-          DB_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi
-        vault.hashicorp.com/agent-inject-template-rfi-s3: |-
-          {{- with secret "secrets/data/minio/apps/rfi" -}}
-          YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
-          YC_S3_BUCKET_NAME=rfi
-          YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi
-        vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/rfi" -}}
-          RABBITMQ_VHOST={{ index .Data.data "vhost" }}
-          RABBITMQ_USERNAME={{ index .Data.data "username" }}
-          RABBITMQ_PASSWORD={{ index .Data.data "password" }}
-          RABBITMQ_PORT=5672
-          RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth
-        vault.hashicorp.com/agent-inject-template-rfi-django-auth: |-
-          {{- with secret "secrets/data/vault/common/django_auth" -}}
-          DJANGO_SECRET_KEY={{ index .Data.data "key" }}
-          SAREX_BACKEND_AUTH={{ index .Data.data "key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: rfi-vault
-      containers:
-        - name: celery
-          image: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:dev4
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db
-              [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3
-              [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq
-              [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth
-              set +a
-              exec uv run celery -A config worker -l info
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: JWT_AUTH_ENABLE
-              value: "True"
-            - name: NOTIFICATIONS_ENABLE
-              value: "false"
-            - name: NOTIFICATIONS_EMAIL_FROM
-              value: hello@sarex.io
-            - name: NOTIFICATIONS_SERVICE_URL
-              value: https://lk.srx.wb.ru:30443/rfi
-            - name: SAREX_BACKEND_URL
-              value: http://backend-svc.django.svc.cluster.local
-            - name: EAV_URL
-              value: http://backend-svc.eav.svc.cluster.local:80
-            - name: GATEWAY_URL
-              value: http://pdm-api.documentations.svc.cluster.local:8080
-          resources:
-            requests:
-              cpu: "25m"
-              memory: 128Mi
-      imagePullSecrets:
-        - name: regcred

apps/rfi/base/celery.yaml

@@ -0,0 +1,139 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: rfi
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    global:
+      env: _default
+    services:
+      celery:
+        enabled: true
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: rfi-vault
+        deployment:
+          enabled: true
+          name:
+            _default: celery
+          replicaCount:
+            _default: 1
+          port:
+            _default: 8000
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/rfi-db ] && . /vault/secrets/rfi-db
+                [ -f /vault/secrets/rfi-s3 ] && . /vault/secrets/rfi-s3
+                [ -f /vault/secrets/rfi-rabbitmq ] && . /vault/secrets/rfi-rabbitmq
+                [ -f /vault/secrets/rfi-django-auth ] && . /vault/secrets/rfi-django-auth
+                set +a
+                exec uv run celery -A config worker -l info
+          resources:
+            requests:
+              cpu:
+                _default: 25m
+              memory:
+                _default: 128Mi
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:dev4
+          pullPolicy:
+            _default: IfNotPresent
+        service:
+          enabled: false
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+        envs:
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "True"
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "false"
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: hello@sarex.io
+          - name: NOTIFICATIONS_SERVICE_URL
+            value:
+              _default: https://lk.srx.wb.ru:30443/rfi
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: http://backend-svc.django.svc.cluster.local
+          - name: EAV_URL
+            value:
+              _default: http://backend-svc.eav.svc.cluster.local:80
+          - name: GATEWAY_URL
+            value:
+              _default: http://pdm-api.documentations.svc.cluster.local:8080
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: rfi
+            vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/rfi/postgres
+            vault.hashicorp.com/agent-inject-template-rfi-db: |-
+              {{- with secret "secrets/data/apps/rfi/postgres" -}}
+              DB_HOST={{ index .Data.data "host" }}
+              DB_PORT={{ index .Data.data "port" }}
+              DB_NAME={{ index .Data.data "database" }}
+              DB_USER={{ index .Data.data "username" }}
+              DB_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-s3: secrets/data/minio/apps/rfi
+            vault.hashicorp.com/agent-inject-template-rfi-s3: |-
+              {{- with secret "secrets/data/minio/apps/rfi" -}}
+              YC_S3_ENDPOINT_URL={{ index .Data.data.client "endpoint" }}
+              YC_S3_BUCKET_NAME=rfi
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-rabbitmq: secrets/data/rabbitmq/apps/rfi
+            vault.hashicorp.com/agent-inject-template-rfi-rabbitmq: |-
+              {{- with secret "secrets/data/rabbitmq/apps/rfi" -}}
+              RABBITMQ_VHOST={{ index .Data.data "vhost" }}
+              RABBITMQ_USERNAME={{ index .Data.data "username" }}
+              RABBITMQ_PASSWORD={{ index .Data.data "password" }}
+              RABBITMQ_PORT=5672
+              RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-rfi-django-auth: secrets/data/vault/common/django_auth
+            vault.hashicorp.com/agent-inject-template-rfi-django-auth: |-
+              {{- with secret "secrets/data/vault/common/django_auth" -}}
+              DJANGO_SECRET_KEY={{ index .Data.data "key" }}
+              SAREX_BACKEND_AUTH={{ index .Data.data "key" }}
+              {{- end -}}

apps/rfi/base/frontend-deployment.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frontend
-  namespace: rfi
-  labels:
-    app: frontend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: frontend
-  template:
-    metadata:
-      labels:
-        app: frontend
-    spec:
-      containers:
-        - name: frontend
-          image: cr.yandex/crp3ccidau046kdj8g9q/rfi-frontend:production_b827756f_wb
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          resources:
-            requests:
-              cpu: 25m
-              memory: 100Mi
-      imagePullSecrets:
-        - name: regcred