979e5c2a51
Every services.<svc>.deployment.resources.requests.{cpu,memory} across the
36 uralkal apps (69 HelmRelease/service entries total) is now nulled via a
kustomize patch, so Helm never renders a requests block for these pods on
uralkal — Kubernetes won't reserve CPU/memory for them there.
Where a uralkal patch already existed for that service (13 cases:
documentations api/filestream/pdf-markings-amqp, django backend, flows
backend/celery, pm backend/celery, transmittal backend/worker, bi,
document-link, stamp-verification, message-hub), the null block was added
into that same file. Where no uralkal patch existed yet (55 cases,
including all 13 cde workers and every plain frontend), a new minimal
patch file was added and wired into that app's kustomization.yaml.
vad and the other clusters are untouched — only apps/*/uralkal/* changed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
173 lines
6.3 KiB
YAML
173 lines
6.3 KiB
YAML
---
|
||
# Патч backend для контура УГМК — подключение к Kafka.
|
||
#
|
||
# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
|
||
# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
|
||
# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
|
||
# podAnnotations — map, мержится по ключам, поэтому переопределён только
|
||
# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
|
||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||
kind: HelmRelease
|
||
metadata:
|
||
name: backend
|
||
namespace: flows
|
||
spec:
|
||
values:
|
||
services:
|
||
backend:
|
||
deployment:
|
||
resources:
|
||
requests:
|
||
cpu: null
|
||
memory: null
|
||
deployment:
|
||
args:
|
||
_default:
|
||
- |
|
||
set -a
|
||
[ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql
|
||
[ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db
|
||
[ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq
|
||
[ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth
|
||
[ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)"
|
||
[ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka
|
||
set +a
|
||
exec /opt/entrypoint.sh
|
||
|
||
envs:
|
||
- name: LOG_LEVEL
|
||
value:
|
||
_default: "DEBUG"
|
||
|
||
- name: BASE_HOST
|
||
value:
|
||
_default: "https://sarex.local.uralkali.com"
|
||
|
||
- name: CELERY_QUEUE
|
||
value:
|
||
_default: "flow"
|
||
|
||
- name: EAV_HOST
|
||
value:
|
||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||
|
||
- name: DJANGO_HOST
|
||
value:
|
||
_default: "http://backend-svc.django.svc.cluster.local:80/api"
|
||
|
||
- name: PLANNING_HOST
|
||
value:
|
||
_default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp"
|
||
|
||
- name: PLANNING_USE
|
||
value:
|
||
_default: "True"
|
||
|
||
- name: DOCUMENTATION_HOST
|
||
value:
|
||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
|
||
|
||
- name: DOCUMENTATION_EXTERNAL_HOST
|
||
value:
|
||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
|
||
|
||
- name: ENABLE_ANALYTICS
|
||
value:
|
||
_default: "1"
|
||
|
||
- name: ENABLE_CELERY
|
||
value:
|
||
_default: "1"
|
||
|
||
- name: ENABLE_MAILGUN
|
||
value:
|
||
_default: "0"
|
||
|
||
- name: ENABLE_METRICS
|
||
value:
|
||
_default: "0"
|
||
|
||
- name: FROM_EMAIL
|
||
value:
|
||
_default: "sarex@sarex.local.uralkali.com"
|
||
|
||
- name: GATEWAY_URL
|
||
value:
|
||
_default: "http://pdm-svc.documentations.svc.cluster.local:80"
|
||
|
||
- name: RESOURCE_URL
|
||
value:
|
||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||
|
||
- name: SERVICE_HOST
|
||
value:
|
||
_default: "https://sarex.local.uralkali.com/flows/api/v1"
|
||
|
||
- name: SMTP_HOST
|
||
value:
|
||
_default: "post.sarex.local.uralkali.com"
|
||
|
||
- name: CHECKLIST_HOST
|
||
value:
|
||
_default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
|
||
|
||
- name: SMTP_PORT
|
||
value:
|
||
_default: "587"
|
||
|
||
- name: SYNC_RESOURCE_ID
|
||
value:
|
||
_default: "1"
|
||
|
||
- name: TIMEOUT
|
||
value:
|
||
_default: "120"
|
||
|
||
- name: WORKFLOWS_HOST
|
||
value:
|
||
_default: "http://backend-svc.processing.svc.cluster.local:80/api/v1"
|
||
|
||
- name: WORKFLOWS_TIMEOUT
|
||
value:
|
||
_default: "60"
|
||
|
||
- name: DOCUMENTATION_TIMEOUT
|
||
value:
|
||
_default: "60"
|
||
|
||
- name: KAFKA_HOST
|
||
value:
|
||
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||
|
||
- name: KAFKA_SSL_CERT
|
||
value:
|
||
_default: |
|
||
-----BEGIN CERTIFICATE-----
|
||
MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
|
||
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
|
||
MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
|
||
MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
|
||
tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
|
||
h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
|
||
k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
|
||
GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
|
||
zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
|
||
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
|
||
Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
|
||
A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
|
||
vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
|
||
OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
|
||
fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
|
||
ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
|
||
0FC16VuidLG0HUCCawFjRiAg9rIA
|
||
-----END CERTIFICATE-----
|
||
|
||
podAnnotations:
|
||
_default:
|
||
vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows
|
||
vault.hashicorp.com/agent-inject-template-flows-kafka: |-
|
||
{{- with secret "secrets/data/kafka/apps/flows" -}}
|
||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||
{{- end -}}
|