iac/apps/pm/base/backend.yaml

---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: backend
  namespace: pm

spec:
  interval: 10m

  chart:
    spec:
      chart: universal-chart
      version: "0.1.9"
      sourceRef:
        kind: HelmRepository
        name: yc-oci-charts
        namespace: flux-system
      interval: 10m

  install:
    remediation:
      retries: 3

  upgrade:
    remediation:
      retries: 3

  values:
    global:
      env: _default

    services:
      backend:
        enabled: true

        serviceAccount:
          enabled:
            _default: true
          name:
            _default: pm-vault

        image:
          name:
            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_0843a55d
          pullPolicy:
            _default: IfNotPresent

        deployment:
          enabled: true

          name:
            _default: backend

          replicaCount:
            _default: 1

          port:
            _default: 8000

          command:
            _default: ["/bin/bash", "-ec"]
          args:
            _default:
              - |
                set -a
                [ -f /vault/secrets/pm-db ] && . /vault/secrets/pm-db
                [ -f /vault/secrets/pm-rabbitmq ] && . /vault/secrets/pm-rabbitmq
                [ -f /vault/secrets/pm-s3 ] && . /vault/secrets/pm-s3
                set +a
                exec /opt/sarex/entrypoint.sh                

          resources:
            requests:
              cpu:
                _default: 25m
              memory:
                _default: 128Mi

          probes:
            liveness:
              enabled: false
            readiness:
              enabled: false

        service:
          enabled: true

          name:
            _default: backend-svc

          type:
            _default: ClusterIP

          port:
            _default: 8000

          targetPort:
            _default: 8000

          portName:
            _default: http

        imagePullSecrets:
          enabled:
            _default: true
          name:
            _default: regcred

        envs:
          - name: USERS_INTERNAL_HOST
            value:
              _default: "http://backend-service.sarex.svc.cluster.local:8000"

          - name: CELERY_REDIS_HOST
            value:
              _default: "redis.pm.svc.cluster.local"

          - name: RESOURCES_INTERNAL_HOST
            value:
              _default: "http://sarex-resources-service.resources"

          - name: EAV_HOST
            value:
              _default: "http://eav-service.eav"

          - name: EAV_API_PREFIX
            value:
              _default: "/api/v0"

          - name: EAV_API_PREFIX_V1
            value:
              _default: "/api/v1"

          - name: TRACING_INSECURE
            value:
              _default: "False"

          - name: SERVER_ENABLE_SYNC_RESOURCES
            value:
              _default: "True"

          - name: SERVER_DELETED_TASK_MAX_AGE_DAYS
            value:
              _default: "1"

          - name: SERVER_EXPIRED_TASK_NOTIFICATION_HOUR
            value:
              _default: "17"

          - name: LANG
            value:
              _default: "C.UTF-8"

          - name: LC_ALL
            value:
              _default: "C.UTF-8"

          - name: PYTHONUTF8
            value:
              _default: "1"

          - name: CACHE_SSL
            value:
              _default: "False"

          - name: CACHE_SSL_CA_CERTS
            value:
              _default: ""

          - name: CACHE_ENABLE
            value:
              _default: "False"

          - name: CLICKHOUSE_ENABLE
            value:
              _default: "False"

          - name: KAFKA_ENABLE
            value:
              _default: "False"

          - name: AUTH_PUBLIC_TOKEN_URL
            value:
              _default: "https://lk.sarex.io/api/token/public/"

          - name: SERVER_HOST
            value:
              _default: "https://lk.sarex.io"

          - name: SERVER_API_HOST
            value:
              _default: "https://api.sarex.io"

          - name: SERVER_DEBUG
            value:
              _default: "False"

          - name: SERVER_ALLOWED_HOSTS
            value:
              _default: '["*"]'

          - name: SERVER_USE_OTEL
            value:
              _default: "False"

          - name: SERVER_VERIFY_SSL
            value:
              _default: "False"

          - name: SERVER_LOG_LEVEL
            value:
              _default: "INFO"

        podAnnotations:
          _default:
            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
            vault.hashicorp.com/agent-init-first: "true"
            vault.hashicorp.com/agent-inject: "true"
            vault.hashicorp.com/agent-pre-populate-only: "true"
            vault.hashicorp.com/auth-path: auth/kubernetes
            vault.hashicorp.com/role: pm
            vault.hashicorp.com/agent-inject-secret-pm-db: secrets/data/apps/pm/postgres
            vault.hashicorp.com/agent-inject-template-pm-db: |-
              {{- with secret "secrets/data/apps/pm/postgres" -}}
              DB_USERNAME={{ index .Data.data "username" }}
              DB_PASSWORD={{ index .Data.data "password" }}
              DB_DATABASE={{ index .Data.data "database" }}
              DB_HOST={{ index .Data.data "host" }}
              DB_PORT={{ index .Data.data "port" }}
              {{- end -}}              
            vault.hashicorp.com/agent-inject-secret-pm-rabbitmq: secrets/data/rabbitmq/apps/pm
            vault.hashicorp.com/agent-inject-template-pm-rabbitmq: |-
              {{- with secret "secrets/data/rabbitmq/apps/pm" -}}
              CELERY_RABBITMQ_HOST=rabbitmq.rabbitmq.svc.cluster.local
              CELERY_RABBITMQ_PORT=5672
              CELERY_RABBITMQ_USER={{ index .Data.data "username" }}
              CELERY_RABBITMQ_PASSWORD={{ index .Data.data "password" }}
              CELERY_RABBITMQ_VHOST={{ index .Data.data "vhost" }}
              {{- end -}}              
            vault.hashicorp.com/agent-inject-secret-pm-s3: secrets/data/minio/apps/pm
            vault.hashicorp.com/agent-inject-template-pm-s3: |-
              {{- with secret "secrets/data/minio/apps/pm" -}}
              S3_HOST={{ index .Data.data.client "endpoint" }}
              S3_LOGIN={{ index .Data.data "access_key" }}
              S3_PASSWORD={{ index .Data.data "secret_key" }}
              {{- $buckets := index .Data.data "buckets" }}
              S3_BUCKET={{- if gt (len $buckets) 0 -}}{{ index (index $buckets 0) "name" }}{{- else -}}pm-bucket{{- end -}}
              S3_VERIFY=False
              {{- end -}}              

        commitSha: ""
        gitlabUri: ""
        gitlabJobUrl: ""
        owner: ""