979e5c2a51
Every services.<svc>.deployment.resources.requests.{cpu,memory} across the
36 uralkal apps (69 HelmRelease/service entries total) is now nulled via a
kustomize patch, so Helm never renders a requests block for these pods on
uralkal — Kubernetes won't reserve CPU/memory for them there.
Where a uralkal patch already existed for that service (13 cases:
documentations api/filestream/pdf-markings-amqp, django backend, flows
backend/celery, pm backend/celery, transmittal backend/worker, bi,
document-link, stamp-verification, message-hub), the null block was added
into that same file. Where no uralkal patch existed yet (55 cases,
including all 13 cde workers and every plain frontend), a new minimal
patch file was added and wired into that app's kustomization.yaml.
vad and the other clusters are untouched — only apps/*/uralkal/* changed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
111 lines
3.5 KiB
YAML
111 lines
3.5 KiB
YAML
---
|
||
# Патч message-hub для vad.
|
||
#
|
||
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
|
||
# поэтому здесь продублирован весь набор из apps/message-hub/base/message-hub.yaml.
|
||
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||
# agent-inject-template-message-hub-kafka; остальные берутся из base.
|
||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||
kind: HelmRelease
|
||
metadata:
|
||
name: message-hub
|
||
namespace: message-hub
|
||
spec:
|
||
values:
|
||
services:
|
||
backend:
|
||
deployment:
|
||
resources:
|
||
requests:
|
||
cpu: null
|
||
memory: null
|
||
envs:
|
||
- name: WORKER_TIMEOUT
|
||
value:
|
||
_default: "60"
|
||
|
||
- name: PYTHONPATH
|
||
value:
|
||
_default: "src"
|
||
|
||
- name: SETTINGS_MAX_RETRIES
|
||
value:
|
||
_default: "1"
|
||
|
||
- name: SETTINGS_TOPICS
|
||
value:
|
||
_default: '{"planning": "message-hub-prod", "assets":"assets_broadcast","issues": "issues_broadcast_prod", "resources_updated": "iam.resource.updated.v2", "resources_deleted": "iam.resource.deleted.v2"}'
|
||
- name: SETTINGS_VERIFY_SSL
|
||
value:
|
||
_default: "0"
|
||
|
||
- name: SAREX_BASE_HOST
|
||
value:
|
||
_default: "http://backend-svc.pm.svc.cluster.local:8000"
|
||
|
||
- name: PM_HOST
|
||
value:
|
||
_default: "http://backend-svc.pm.svc.cluster.local:8000"
|
||
|
||
- name: EAV_HOST
|
||
value:
|
||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||
|
||
- name: ISSUES_HOST
|
||
value:
|
||
_default: "http://backend-svc.issues.svc.cluster.local:80"
|
||
|
||
- name: CACHE_HOST
|
||
value:
|
||
_default: "redis.pm.svc.cluster.local"
|
||
|
||
- name: CACHE_PORT
|
||
value:
|
||
_default: "6379"
|
||
|
||
- name: CACHE_SSL
|
||
value:
|
||
_default: "0"
|
||
|
||
- name: KAFKA_HOST
|
||
value:
|
||
_default: "kafka-kafka-contour.kafka.svc.cluster.local"
|
||
|
||
- name: KAFKA_PORT
|
||
value:
|
||
_default: "9092"
|
||
|
||
- name: KAFKA_SSL_CAFILE
|
||
value:
|
||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||
- name: KAFKA_SECURITY_PROTOCOL
|
||
value:
|
||
_default: "SASL_SSL"
|
||
|
||
volumes:
|
||
_default:
|
||
- name: kafka-ca-cert
|
||
mountPath:
|
||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||
subPath:
|
||
_default: kafka.crt
|
||
readOnly:
|
||
_default: true
|
||
configMap:
|
||
name:
|
||
_default: kafka-ca-cert
|
||
items:
|
||
- key: kafka.crt
|
||
path:
|
||
_default: kafka.crt
|
||
|
||
podAnnotations:
|
||
_default:
|
||
vault.hashicorp.com/agent-inject-secret-message-hub-kafka: secrets/data/kafka/apps/pm
|
||
vault.hashicorp.com/agent-inject-template-message-hub-kafka: |-
|
||
{{- with secret "secrets/data/kafka/apps/pm" -}}
|
||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||
KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
|
||
{{- end -}}
|