From 2f995fe1fa655829fc4421f52942dfdaf02e5255 Mon Sep 17 00:00:00 2001 From: diamondrigido Date: Thu, 5 Nov 2026 15:18:54 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20=D0=B2=D0=BA=D0=BB=D1=8E=D1=87=D0=B8?= =?UTF-8?q?=D0=BB=20legacy=20flow=20=D0=BF=D0=BE=20=D0=B1=D0=B8=D0=BC?= =?UTF-8?q?=D0=B0=D0=BC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../base/cde-api-worker-copy.yaml | 2 +- .../base/cde-api-worker-move.yaml | 2 +- ...cde-api-worker-s32d-process-workflows.yaml | 2 +- apps/documentations/base/cde-api.yaml | 2 +- .../brusnika-prod/cde-api-worker-copy.yaml | 2 +- .../brusnika-prod/cde-api-worker-move.yaml | 2 +- ...cde-api-worker-s32d-process-workflows.yaml | 2 +- .../documentations/brusnika-prod/cde-api.yaml | 2 +- .../brusnika-stage/cde-api-worker-copy.yaml | 2 +- .../brusnika-stage/cde-api-worker-move.yaml | 2 +- ...cde-api-worker-s32d-process-workflows.yaml | 2 +- .../brusnika-stage/cde-api.yaml | 2 +- apps/documentations/cde-api.CONFIGURATION.md | 2 +- apps/documentations/cde-api.env.example | 2 +- .../cronjobs/brusnika-prod/kustomization.yaml | 10 ++ .../brusnika-prod/resource-id-backfill.yaml | 77 +++++++++++ .../cronjobs/brusnika-prod/sizer.yaml | 77 +++++++++++ .../brusnika-prod/workspace-recovery.yaml | 119 +++++++++++++++++ .../brusnika-stage/kustomization.yaml | 10 ++ .../brusnika-stage/resource-id-backfill.yaml | 77 +++++++++++ .../cronjobs/brusnika-stage/sizer.yaml | 77 +++++++++++ .../brusnika-stage/workspace-recovery.yaml | 119 +++++++++++++++++ .../cronjobs/d8-ugmk-prod/kustomization.yaml | 10 ++ .../d8-ugmk-prod/resource-id-backfill.yaml | 84 ++++++++++++ .../cronjobs/d8-ugmk-prod/sizer.yaml | 84 ++++++++++++ .../d8-ugmk-prod/workspace-recovery.yaml | 126 ++++++++++++++++++ .../cronjobs/sarex-contour/kustomization.yaml | 10 ++ .../sarex-contour/resource-id-backfill.yaml | 84 ++++++++++++ .../cronjobs/sarex-contour/sizer.yaml | 84 ++++++++++++ .../sarex-contour/workspace-recovery.yaml | 126 ++++++++++++++++++ .../cronjobs/ugok/kustomization.yaml | 10 ++ .../cronjobs/ugok/resource-id-backfill.yaml | 77 +++++++++++ apps/documentations/cronjobs/ugok/sizer.yaml | 77 +++++++++++ .../cronjobs/ugok/workspace-recovery.yaml | 119 +++++++++++++++++ .../cronjobs/uralkal/kustomization.yaml | 10 ++ .../uralkal/resource-id-backfill.yaml | 84 ++++++++++++ .../cronjobs/uralkal/sizer.yaml | 84 ++++++++++++ .../cronjobs/uralkal/workspace-recovery.yaml | 126 ++++++++++++++++++ .../cronjobs/vad/kustomization.yaml | 10 ++ .../cronjobs/vad/resource-id-backfill.yaml | 84 ++++++++++++ apps/documentations/cronjobs/vad/sizer.yaml | 84 ++++++++++++ .../cronjobs/vad/workspace-recovery.yaml | 126 ++++++++++++++++++ .../cronjobs/wb/kustomization.yaml | 10 ++ .../cronjobs/wb/resource-id-backfill.yaml | 77 +++++++++++ apps/documentations/cronjobs/wb/sizer.yaml | 77 +++++++++++ .../cronjobs/wb/workspace-recovery.yaml | 119 +++++++++++++++++ .../cronjobs/yc-k8s-test/kustomization.yaml | 10 ++ .../yc-k8s-test/resource-id-backfill.yaml | 84 ++++++++++++ .../cronjobs/yc-k8s-test/sizer.yaml | 84 ++++++++++++ .../yc-k8s-test/workspace-recovery.yaml | 126 ++++++++++++++++++ .../d8-ugmk-prod/cde-api-worker-copy.yaml | 2 +- .../d8-ugmk-prod/cde-api-worker-move.yaml | 2 +- ...cde-api-worker-s32d-process-workflows.yaml | 2 +- apps/documentations/d8-ugmk-prod/cde-api.yaml | 2 +- .../ugok/cde-api-worker-copy.yaml | 2 +- .../ugok/cde-api-worker-move.yaml | 2 +- ...cde-api-worker-s32d-process-workflows.yaml | 2 +- apps/documentations/ugok/cde-api.yaml | 2 +- .../uralkal/cde-api-worker-copy.yaml | 2 +- .../uralkal/cde-api-worker-move.yaml | 2 +- ...cde-api-worker-s32d-process-workflows.yaml | 2 +- apps/documentations/uralkal/cde-api.yaml | 2 +- .../vad/cde-api-worker-copy.yaml | 2 +- .../vad/cde-api-worker-move.yaml | 2 +- ...cde-api-worker-s32d-process-workflows.yaml | 2 +- apps/documentations/vad/cde-api.yaml | 2 +- .../wb/cde-api-worker-copy.yaml | 2 +- .../wb/cde-api-worker-move.yaml | 2 +- ...cde-api-worker-s32d-process-workflows.yaml | 2 +- apps/documentations/wb/cde-api.yaml | 2 +- 70 files changed, 2686 insertions(+), 34 deletions(-) create mode 100644 apps/documentations/cronjobs/brusnika-prod/kustomization.yaml create mode 100644 apps/documentations/cronjobs/brusnika-prod/resource-id-backfill.yaml create mode 100644 apps/documentations/cronjobs/brusnika-prod/sizer.yaml create mode 100644 apps/documentations/cronjobs/brusnika-prod/workspace-recovery.yaml create mode 100644 apps/documentations/cronjobs/brusnika-stage/kustomization.yaml create mode 100644 apps/documentations/cronjobs/brusnika-stage/resource-id-backfill.yaml create mode 100644 apps/documentations/cronjobs/brusnika-stage/sizer.yaml create mode 100644 apps/documentations/cronjobs/brusnika-stage/workspace-recovery.yaml create mode 100644 apps/documentations/cronjobs/d8-ugmk-prod/kustomization.yaml create mode 100644 apps/documentations/cronjobs/d8-ugmk-prod/resource-id-backfill.yaml create mode 100644 apps/documentations/cronjobs/d8-ugmk-prod/sizer.yaml create mode 100644 apps/documentations/cronjobs/d8-ugmk-prod/workspace-recovery.yaml create mode 100644 apps/documentations/cronjobs/sarex-contour/kustomization.yaml create mode 100644 apps/documentations/cronjobs/sarex-contour/resource-id-backfill.yaml create mode 100644 apps/documentations/cronjobs/sarex-contour/sizer.yaml create mode 100644 apps/documentations/cronjobs/sarex-contour/workspace-recovery.yaml create mode 100644 apps/documentations/cronjobs/ugok/kustomization.yaml create mode 100644 apps/documentations/cronjobs/ugok/resource-id-backfill.yaml create mode 100644 apps/documentations/cronjobs/ugok/sizer.yaml create mode 100644 apps/documentations/cronjobs/ugok/workspace-recovery.yaml create mode 100644 apps/documentations/cronjobs/uralkal/kustomization.yaml create mode 100644 apps/documentations/cronjobs/uralkal/resource-id-backfill.yaml create mode 100644 apps/documentations/cronjobs/uralkal/sizer.yaml create mode 100644 apps/documentations/cronjobs/uralkal/workspace-recovery.yaml create mode 100644 apps/documentations/cronjobs/vad/kustomization.yaml create mode 100644 apps/documentations/cronjobs/vad/resource-id-backfill.yaml create mode 100644 apps/documentations/cronjobs/vad/sizer.yaml create mode 100644 apps/documentations/cronjobs/vad/workspace-recovery.yaml create mode 100644 apps/documentations/cronjobs/wb/kustomization.yaml create mode 100644 apps/documentations/cronjobs/wb/resource-id-backfill.yaml create mode 100644 apps/documentations/cronjobs/wb/sizer.yaml create mode 100644 apps/documentations/cronjobs/wb/workspace-recovery.yaml create mode 100644 apps/documentations/cronjobs/yc-k8s-test/kustomization.yaml create mode 100644 apps/documentations/cronjobs/yc-k8s-test/resource-id-backfill.yaml create mode 100644 apps/documentations/cronjobs/yc-k8s-test/sizer.yaml create mode 100644 apps/documentations/cronjobs/yc-k8s-test/workspace-recovery.yaml diff --git a/apps/documentations/base/cde-api-worker-copy.yaml b/apps/documentations/base/cde-api-worker-copy.yaml index 43783c4..71d0c69 100644 --- a/apps/documentations/base/cde-api-worker-copy.yaml +++ b/apps/documentations/base/cde-api-worker-copy.yaml @@ -226,7 +226,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/base/cde-api-worker-move.yaml b/apps/documentations/base/cde-api-worker-move.yaml index 8654fa2..9c2ae96 100644 --- a/apps/documentations/base/cde-api-worker-move.yaml +++ b/apps/documentations/base/cde-api-worker-move.yaml @@ -226,7 +226,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/base/cde-api-worker-s32d-process-workflows.yaml b/apps/documentations/base/cde-api-worker-s32d-process-workflows.yaml index 849438d..54242df 100644 --- a/apps/documentations/base/cde-api-worker-s32d-process-workflows.yaml +++ b/apps/documentations/base/cde-api-worker-s32d-process-workflows.yaml @@ -225,7 +225,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/base/cde-api.yaml b/apps/documentations/base/cde-api.yaml index 5f872dd..89f6d78 100644 --- a/apps/documentations/base/cde-api.yaml +++ b/apps/documentations/base/cde-api.yaml @@ -225,7 +225,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DATABASE_MAX_CONN_LIFETIME value: _default: "30m" diff --git a/apps/documentations/brusnika-prod/cde-api-worker-copy.yaml b/apps/documentations/brusnika-prod/cde-api-worker-copy.yaml index 764b1fa..273c646 100644 --- a/apps/documentations/brusnika-prod/cde-api-worker-copy.yaml +++ b/apps/documentations/brusnika-prod/cde-api-worker-copy.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/brusnika-prod/cde-api-worker-move.yaml b/apps/documentations/brusnika-prod/cde-api-worker-move.yaml index 02fdbaa..1c3dab1 100644 --- a/apps/documentations/brusnika-prod/cde-api-worker-move.yaml +++ b/apps/documentations/brusnika-prod/cde-api-worker-move.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/brusnika-prod/cde-api-worker-s32d-process-workflows.yaml b/apps/documentations/brusnika-prod/cde-api-worker-s32d-process-workflows.yaml index 3c36e75..3dbe11d 100644 --- a/apps/documentations/brusnika-prod/cde-api-worker-s32d-process-workflows.yaml +++ b/apps/documentations/brusnika-prod/cde-api-worker-s32d-process-workflows.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/brusnika-prod/cde-api.yaml b/apps/documentations/brusnika-prod/cde-api.yaml index 3e33af5..bfc20cc 100644 --- a/apps/documentations/brusnika-prod/cde-api.yaml +++ b/apps/documentations/brusnika-prod/cde-api.yaml @@ -206,7 +206,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DATABASE_MAX_CONN_LIFETIME value: _default: "30m" diff --git a/apps/documentations/brusnika-stage/cde-api-worker-copy.yaml b/apps/documentations/brusnika-stage/cde-api-worker-copy.yaml index c6dfdd3..4a05189 100644 --- a/apps/documentations/brusnika-stage/cde-api-worker-copy.yaml +++ b/apps/documentations/brusnika-stage/cde-api-worker-copy.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/brusnika-stage/cde-api-worker-move.yaml b/apps/documentations/brusnika-stage/cde-api-worker-move.yaml index bc986d1..fd8688d 100644 --- a/apps/documentations/brusnika-stage/cde-api-worker-move.yaml +++ b/apps/documentations/brusnika-stage/cde-api-worker-move.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/brusnika-stage/cde-api-worker-s32d-process-workflows.yaml b/apps/documentations/brusnika-stage/cde-api-worker-s32d-process-workflows.yaml index 9803f33..bd15287 100644 --- a/apps/documentations/brusnika-stage/cde-api-worker-s32d-process-workflows.yaml +++ b/apps/documentations/brusnika-stage/cde-api-worker-s32d-process-workflows.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/brusnika-stage/cde-api.yaml b/apps/documentations/brusnika-stage/cde-api.yaml index ef7263f..51c2025 100644 --- a/apps/documentations/brusnika-stage/cde-api.yaml +++ b/apps/documentations/brusnika-stage/cde-api.yaml @@ -206,7 +206,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DATABASE_MAX_CONN_LIFETIME value: _default: "30m" diff --git a/apps/documentations/cde-api.CONFIGURATION.md b/apps/documentations/cde-api.CONFIGURATION.md index e32f629..064db8f 100644 --- a/apps/documentations/cde-api.CONFIGURATION.md +++ b/apps/documentations/cde-api.CONFIGURATION.md @@ -171,7 +171,7 @@ Postgres — тот же хост/БД, что у `documentations-api` конт | `CDE_API_USERS_TIMEOUT_MS` | `10000` | api | | `CDE_API_USE_BIMV1_FOR_BIMV2` | `true` | api, process-workflows, copy, move | | `CDE_API_USE_BIM_INSERTER` | `true` | api, process-workflows, copy, move | -| `CDE_API_USE_LEGACY_BIM_FLOW` | `0` | api, process-workflows, copy, move | +| `CDE_API_USE_LEGACY_BIM_FLOW` | `true` | api, process-workflows, copy, move | | `CDE_API_WORKFLOWS_CONFIG_FILEPATH` | `/etc/app/tasks_execution_config.json` | все | | `CDE_API_WORKFLOWS_IMAGES_VERSION` | `master` | api, process-workflows, copy, move | | `CDE_API_WORKFLOW_BASE_URL` | `http://backend-svc.processing.svc.cluster.local:80` | api, process-workflows, copy, move | diff --git a/apps/documentations/cde-api.env.example b/apps/documentations/cde-api.env.example index e55f406..46a42d7 100644 --- a/apps/documentations/cde-api.env.example +++ b/apps/documentations/cde-api.env.example @@ -51,7 +51,7 @@ CDE_API_LAST_MASTER_BIM=36311 CDE_API_LAST_SLAVE_1_BIM=94015 CDE_API_LAST_SLAVE_2_BIM=135771 CDE_API_USE_BIM_INSERTER=true -CDE_API_USE_LEGACY_BIM_FLOW=0 +CDE_API_USE_LEGACY_BIM_FLOW=true CDE_API_DATABASE_MAX_CONN_LIFETIME=30m CDE_API_DATABASE_MAX_CONN_IDLE_TIME=10m CDE_API_DATABASE_HEALTH_CHECK_PERIOD=30s diff --git a/apps/documentations/cronjobs/brusnika-prod/kustomization.yaml b/apps/documentations/cronjobs/brusnika-prod/kustomization.yaml new file mode 100644 index 0000000..b780378 --- /dev/null +++ b/apps/documentations/cronjobs/brusnika-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +# НЕ подключён к apps/documentations/brusnika-prod и clusters/*: подключать отдельно, после выката cde-api +# (см. ../README.md). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: documentations +resources: + - workspace-recovery.yaml + - resource-id-backfill.yaml + - sizer.yaml diff --git a/apps/documentations/cronjobs/brusnika-prod/resource-id-backfill.yaml b/apps/documentations/cronjobs/brusnika-prod/resource-id-backfill.yaml new file mode 100644 index 0000000..ebaed51 --- /dev/null +++ b/apps/documentations/cronjobs/brusnika-prod/resource-id-backfill.yaml @@ -0,0 +1,77 @@ +--- +# Одноразовая задача: CronJob создан в suspend, запускать вручную: kubectl -n documentations create job --from=cronjob/cde-api-resource-id-backfill <имя> +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-resource-id-backfill + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: true + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: regcred + containers: + - name: resource-id-backfill + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-resource-id-backfill:prod_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "resource-id-backfill" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_RESOURCE_BACKFILL_BATCH_SIZE + value: "500" + - name: CDE_API_RESOURCE_BACKFILL_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_RESOURCES_BASE_URL + value: "http://iams.iam.svc.cluster.local:8080" + - name: CDE_API_RESOURCES_TIMEOUT + value: "10s" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "postgres-service" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: postgres-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: postgres-secret + key: password diff --git a/apps/documentations/cronjobs/brusnika-prod/sizer.yaml b/apps/documentations/cronjobs/brusnika-prod/sizer.yaml new file mode 100644 index 0000000..2a4df73 --- /dev/null +++ b/apps/documentations/cronjobs/brusnika-prod/sizer.yaml @@ -0,0 +1,77 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-sizer + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-sizer + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-sizer + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: regcred + containers: + - name: sizer + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-sizer:prod_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-sizer" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_SIZER_BATCH_SIZE + value: "10000" + - name: CDE_API_SIZER_NUM_WORKERS + value: "10" + - name: CDE_API_SIZER_JOB_HALF_PERIOD + value: "12h" + - name: CDE_API_SIZER_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "postgres-service" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: postgres-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: postgres-secret + key: password diff --git a/apps/documentations/cronjobs/brusnika-prod/workspace-recovery.yaml b/apps/documentations/cronjobs/brusnika-prod/workspace-recovery.yaml new file mode 100644 index 0000000..f730105 --- /dev/null +++ b/apps/documentations/cronjobs/brusnika-prod/workspace-recovery.yaml @@ -0,0 +1,119 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-workspace-recovery + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 */12 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: regcred + containers: + - name: workspace-recovery + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-workspace-recovery:prod_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-workspace-recovery" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_REDIS__HOST + value: "redis" + - name: CDE_API_REDIS__PORT + value: "6379" + - name: CDE_API_REDIS__DB + value: "5" + - name: CDE_API_REDIS__SSL + value: "false" + - name: CDE_API_REDIS__DIAL_TIMEOUT_MS + value: "5000" + - name: CDE_API_REDIS__READ_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__WRITE_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__POOL_SIZE + value: "2" + - name: CDE_API_REDIS__MIN_IDLE_CONNS + value: "0" + - name: CDE_API_WORKSPACE_BASE_URL + value: "http://workspaces-service.workspaces.svc.cluster.local:8000" + - name: CDE_API_WORKSPACE_TIMEOUT_MS + value: "10000" + - name: CDE_API_WORKSPACE_RETRY_COUNT + value: "0" + - name: CDE_API_WORKSPACE_RECOVERY_CONCURRENCY + value: "1" + - name: CDE_API_WORKSPACE_RECOVERY_CURSOR_KEY + value: "cde-api:production:workspace-recovery:cursor" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_SIZE + value: "100" + - name: CDE_API_WORKSPACE_RECOVERY_MIN_AGE + value: "1h" + - name: CDE_API_WORKSPACE_RECOVERY_REQUEST_INTERVAL + value: "1s" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_INTERVAL + value: "5s" + - name: CDE_API_WORKSPACE_RECOVERY_MAX_ERROR_DELAY + value: "1m" + - name: CDE_API_WORKSPACE_RECOVERY_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_DATABASE_MAX_CONN_LIFETIME + value: "30m" + - name: CDE_API_DATABASE_MAX_CONN_IDLE_TIME + value: "10m" + - name: CDE_API_DATABASE_HEALTH_CHECK_PERIOD + value: "30s" + - name: CDE_API_DATABASE_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "postgres-service" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: postgres-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: postgres-secret + key: password diff --git a/apps/documentations/cronjobs/brusnika-stage/kustomization.yaml b/apps/documentations/cronjobs/brusnika-stage/kustomization.yaml new file mode 100644 index 0000000..20a0cc7 --- /dev/null +++ b/apps/documentations/cronjobs/brusnika-stage/kustomization.yaml @@ -0,0 +1,10 @@ +--- +# НЕ подключён к apps/documentations/brusnika-stage и clusters/*: подключать отдельно, после выката cde-api +# (см. ../README.md). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: documentations +resources: + - workspace-recovery.yaml + - resource-id-backfill.yaml + - sizer.yaml diff --git a/apps/documentations/cronjobs/brusnika-stage/resource-id-backfill.yaml b/apps/documentations/cronjobs/brusnika-stage/resource-id-backfill.yaml new file mode 100644 index 0000000..8b256ea --- /dev/null +++ b/apps/documentations/cronjobs/brusnika-stage/resource-id-backfill.yaml @@ -0,0 +1,77 @@ +--- +# Одноразовая задача: CronJob создан в suspend, запускать вручную: kubectl -n documentations create job --from=cronjob/cde-api-resource-id-backfill <имя> +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-resource-id-backfill + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: true + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: regcred + containers: + - name: resource-id-backfill + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-resource-id-backfill:stage_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "resource-id-backfill" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_RESOURCE_BACKFILL_BATCH_SIZE + value: "500" + - name: CDE_API_RESOURCE_BACKFILL_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_RESOURCES_BASE_URL + value: "http://iams.iam.svc.cluster.local:8080" + - name: CDE_API_RESOURCES_TIMEOUT + value: "10s" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "192.168.2.45" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: postgres-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: postgres-secret + key: password diff --git a/apps/documentations/cronjobs/brusnika-stage/sizer.yaml b/apps/documentations/cronjobs/brusnika-stage/sizer.yaml new file mode 100644 index 0000000..4ab0514 --- /dev/null +++ b/apps/documentations/cronjobs/brusnika-stage/sizer.yaml @@ -0,0 +1,77 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-sizer + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-sizer + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-sizer + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: regcred + containers: + - name: sizer + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-sizer:stage_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-sizer" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_SIZER_BATCH_SIZE + value: "10000" + - name: CDE_API_SIZER_NUM_WORKERS + value: "10" + - name: CDE_API_SIZER_JOB_HALF_PERIOD + value: "12h" + - name: CDE_API_SIZER_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "192.168.2.45" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: postgres-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: postgres-secret + key: password diff --git a/apps/documentations/cronjobs/brusnika-stage/workspace-recovery.yaml b/apps/documentations/cronjobs/brusnika-stage/workspace-recovery.yaml new file mode 100644 index 0000000..7f225d7 --- /dev/null +++ b/apps/documentations/cronjobs/brusnika-stage/workspace-recovery.yaml @@ -0,0 +1,119 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-workspace-recovery + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 */12 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: regcred + containers: + - name: workspace-recovery + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-workspace-recovery:stage_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-workspace-recovery" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_REDIS__HOST + value: "redis" + - name: CDE_API_REDIS__PORT + value: "6379" + - name: CDE_API_REDIS__DB + value: "5" + - name: CDE_API_REDIS__SSL + value: "false" + - name: CDE_API_REDIS__DIAL_TIMEOUT_MS + value: "5000" + - name: CDE_API_REDIS__READ_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__WRITE_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__POOL_SIZE + value: "2" + - name: CDE_API_REDIS__MIN_IDLE_CONNS + value: "0" + - name: CDE_API_WORKSPACE_BASE_URL + value: "http://workspaces-service.workspaces.svc.cluster.local:8000" + - name: CDE_API_WORKSPACE_TIMEOUT_MS + value: "10000" + - name: CDE_API_WORKSPACE_RETRY_COUNT + value: "0" + - name: CDE_API_WORKSPACE_RECOVERY_CONCURRENCY + value: "1" + - name: CDE_API_WORKSPACE_RECOVERY_CURSOR_KEY + value: "cde-api:stage:workspace-recovery:cursor" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_SIZE + value: "100" + - name: CDE_API_WORKSPACE_RECOVERY_MIN_AGE + value: "1h" + - name: CDE_API_WORKSPACE_RECOVERY_REQUEST_INTERVAL + value: "1s" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_INTERVAL + value: "5s" + - name: CDE_API_WORKSPACE_RECOVERY_MAX_ERROR_DELAY + value: "1m" + - name: CDE_API_WORKSPACE_RECOVERY_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_DATABASE_MAX_CONN_LIFETIME + value: "30m" + - name: CDE_API_DATABASE_MAX_CONN_IDLE_TIME + value: "10m" + - name: CDE_API_DATABASE_HEALTH_CHECK_PERIOD + value: "30s" + - name: CDE_API_DATABASE_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "192.168.2.45" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: postgres-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: postgres-secret + key: password diff --git a/apps/documentations/cronjobs/d8-ugmk-prod/kustomization.yaml b/apps/documentations/cronjobs/d8-ugmk-prod/kustomization.yaml new file mode 100644 index 0000000..4efd8cf --- /dev/null +++ b/apps/documentations/cronjobs/d8-ugmk-prod/kustomization.yaml @@ -0,0 +1,10 @@ +--- +# НЕ подключён к apps/documentations/d8-ugmk-prod и clusters/*: подключать отдельно, после выката cde-api +# (см. ../README.md). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: documentations +resources: + - workspace-recovery.yaml + - resource-id-backfill.yaml + - sizer.yaml diff --git a/apps/documentations/cronjobs/d8-ugmk-prod/resource-id-backfill.yaml b/apps/documentations/cronjobs/d8-ugmk-prod/resource-id-backfill.yaml new file mode 100644 index 0000000..d9e8238 --- /dev/null +++ b/apps/documentations/cronjobs/d8-ugmk-prod/resource-id-backfill.yaml @@ -0,0 +1,84 @@ +--- +# Одноразовая задача: CronJob создан в suspend, запускать вручную: kubectl -n documentations create job --from=cronjob/cde-api-resource-id-backfill <имя> +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-resource-id-backfill + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: true + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: resource-id-backfill + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-resource-id-backfill:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "resource-id-backfill" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_RESOURCE_BACKFILL_BATCH_SIZE + value: "500" + - name: CDE_API_RESOURCE_BACKFILL_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_RESOURCES_BASE_URL + value: "http://iams.iam.svc.cluster.local:8080" + - name: CDE_API_RESOURCES_TIMEOUT + value: "10s" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/d8-ugmk-prod/sizer.yaml b/apps/documentations/cronjobs/d8-ugmk-prod/sizer.yaml new file mode 100644 index 0000000..4aa4ad0 --- /dev/null +++ b/apps/documentations/cronjobs/d8-ugmk-prod/sizer.yaml @@ -0,0 +1,84 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-sizer + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-sizer + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-sizer + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: sizer + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-sizer:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-sizer" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_SIZER_BATCH_SIZE + value: "10000" + - name: CDE_API_SIZER_NUM_WORKERS + value: "10" + - name: CDE_API_SIZER_JOB_HALF_PERIOD + value: "12h" + - name: CDE_API_SIZER_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/d8-ugmk-prod/workspace-recovery.yaml b/apps/documentations/cronjobs/d8-ugmk-prod/workspace-recovery.yaml new file mode 100644 index 0000000..164691a --- /dev/null +++ b/apps/documentations/cronjobs/d8-ugmk-prod/workspace-recovery.yaml @@ -0,0 +1,126 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-workspace-recovery + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 */12 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: workspace-recovery + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-workspace-recovery:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-workspace-recovery" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_REDIS__HOST + value: "redis" + - name: CDE_API_REDIS__PORT + value: "6379" + - name: CDE_API_REDIS__DB + value: "5" + - name: CDE_API_REDIS__SSL + value: "false" + - name: CDE_API_REDIS__DIAL_TIMEOUT_MS + value: "5000" + - name: CDE_API_REDIS__READ_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__WRITE_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__POOL_SIZE + value: "2" + - name: CDE_API_REDIS__MIN_IDLE_CONNS + value: "0" + - name: CDE_API_WORKSPACE_BASE_URL + value: "http://backend-svc.workspaces.svc.cluster.local:80" + - name: CDE_API_WORKSPACE_TIMEOUT_MS + value: "10000" + - name: CDE_API_WORKSPACE_RETRY_COUNT + value: "0" + - name: CDE_API_WORKSPACE_RECOVERY_CONCURRENCY + value: "1" + - name: CDE_API_WORKSPACE_RECOVERY_CURSOR_KEY + value: "cde-api:production:workspace-recovery:cursor" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_SIZE + value: "100" + - name: CDE_API_WORKSPACE_RECOVERY_MIN_AGE + value: "1h" + - name: CDE_API_WORKSPACE_RECOVERY_REQUEST_INTERVAL + value: "1s" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_INTERVAL + value: "5s" + - name: CDE_API_WORKSPACE_RECOVERY_MAX_ERROR_DELAY + value: "1m" + - name: CDE_API_WORKSPACE_RECOVERY_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_DATABASE_MAX_CONN_LIFETIME + value: "30m" + - name: CDE_API_DATABASE_MAX_CONN_IDLE_TIME + value: "10m" + - name: CDE_API_DATABASE_HEALTH_CHECK_PERIOD + value: "30s" + - name: CDE_API_DATABASE_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/sarex-contour/kustomization.yaml b/apps/documentations/cronjobs/sarex-contour/kustomization.yaml new file mode 100644 index 0000000..6f40878 --- /dev/null +++ b/apps/documentations/cronjobs/sarex-contour/kustomization.yaml @@ -0,0 +1,10 @@ +--- +# НЕ подключён к apps/documentations/sarex-contour и clusters/*: подключать отдельно, после выката cde-api +# (см. ../README.md). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: documentations +resources: + - workspace-recovery.yaml + - resource-id-backfill.yaml + - sizer.yaml diff --git a/apps/documentations/cronjobs/sarex-contour/resource-id-backfill.yaml b/apps/documentations/cronjobs/sarex-contour/resource-id-backfill.yaml new file mode 100644 index 0000000..d9e8238 --- /dev/null +++ b/apps/documentations/cronjobs/sarex-contour/resource-id-backfill.yaml @@ -0,0 +1,84 @@ +--- +# Одноразовая задача: CronJob создан в suspend, запускать вручную: kubectl -n documentations create job --from=cronjob/cde-api-resource-id-backfill <имя> +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-resource-id-backfill + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: true + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: resource-id-backfill + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-resource-id-backfill:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "resource-id-backfill" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_RESOURCE_BACKFILL_BATCH_SIZE + value: "500" + - name: CDE_API_RESOURCE_BACKFILL_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_RESOURCES_BASE_URL + value: "http://iams.iam.svc.cluster.local:8080" + - name: CDE_API_RESOURCES_TIMEOUT + value: "10s" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/sarex-contour/sizer.yaml b/apps/documentations/cronjobs/sarex-contour/sizer.yaml new file mode 100644 index 0000000..4aa4ad0 --- /dev/null +++ b/apps/documentations/cronjobs/sarex-contour/sizer.yaml @@ -0,0 +1,84 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-sizer + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-sizer + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-sizer + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: sizer + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-sizer:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-sizer" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_SIZER_BATCH_SIZE + value: "10000" + - name: CDE_API_SIZER_NUM_WORKERS + value: "10" + - name: CDE_API_SIZER_JOB_HALF_PERIOD + value: "12h" + - name: CDE_API_SIZER_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/sarex-contour/workspace-recovery.yaml b/apps/documentations/cronjobs/sarex-contour/workspace-recovery.yaml new file mode 100644 index 0000000..164691a --- /dev/null +++ b/apps/documentations/cronjobs/sarex-contour/workspace-recovery.yaml @@ -0,0 +1,126 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-workspace-recovery + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 */12 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: workspace-recovery + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-workspace-recovery:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-workspace-recovery" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_REDIS__HOST + value: "redis" + - name: CDE_API_REDIS__PORT + value: "6379" + - name: CDE_API_REDIS__DB + value: "5" + - name: CDE_API_REDIS__SSL + value: "false" + - name: CDE_API_REDIS__DIAL_TIMEOUT_MS + value: "5000" + - name: CDE_API_REDIS__READ_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__WRITE_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__POOL_SIZE + value: "2" + - name: CDE_API_REDIS__MIN_IDLE_CONNS + value: "0" + - name: CDE_API_WORKSPACE_BASE_URL + value: "http://backend-svc.workspaces.svc.cluster.local:80" + - name: CDE_API_WORKSPACE_TIMEOUT_MS + value: "10000" + - name: CDE_API_WORKSPACE_RETRY_COUNT + value: "0" + - name: CDE_API_WORKSPACE_RECOVERY_CONCURRENCY + value: "1" + - name: CDE_API_WORKSPACE_RECOVERY_CURSOR_KEY + value: "cde-api:production:workspace-recovery:cursor" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_SIZE + value: "100" + - name: CDE_API_WORKSPACE_RECOVERY_MIN_AGE + value: "1h" + - name: CDE_API_WORKSPACE_RECOVERY_REQUEST_INTERVAL + value: "1s" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_INTERVAL + value: "5s" + - name: CDE_API_WORKSPACE_RECOVERY_MAX_ERROR_DELAY + value: "1m" + - name: CDE_API_WORKSPACE_RECOVERY_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_DATABASE_MAX_CONN_LIFETIME + value: "30m" + - name: CDE_API_DATABASE_MAX_CONN_IDLE_TIME + value: "10m" + - name: CDE_API_DATABASE_HEALTH_CHECK_PERIOD + value: "30s" + - name: CDE_API_DATABASE_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/ugok/kustomization.yaml b/apps/documentations/cronjobs/ugok/kustomization.yaml new file mode 100644 index 0000000..b0b2923 --- /dev/null +++ b/apps/documentations/cronjobs/ugok/kustomization.yaml @@ -0,0 +1,10 @@ +--- +# НЕ подключён к apps/documentations/ugok и clusters/*: подключать отдельно, после выката cde-api +# (см. ../README.md). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: documentations +resources: + - workspace-recovery.yaml + - resource-id-backfill.yaml + - sizer.yaml diff --git a/apps/documentations/cronjobs/ugok/resource-id-backfill.yaml b/apps/documentations/cronjobs/ugok/resource-id-backfill.yaml new file mode 100644 index 0000000..c68933f --- /dev/null +++ b/apps/documentations/cronjobs/ugok/resource-id-backfill.yaml @@ -0,0 +1,77 @@ +--- +# Одноразовая задача: CronJob создан в suspend, запускать вручную: kubectl -n documentations create job --from=cronjob/cde-api-resource-id-backfill <имя> +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-resource-id-backfill + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: true + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: dockerhub + containers: + - name: resource-id-backfill + image: 10.4.10.187:80/library/cde-api-resource-id-backfill:ugok_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "resource-id-backfill" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_RESOURCE_BACKFILL_BATCH_SIZE + value: "500" + - name: CDE_API_RESOURCE_BACKFILL_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_RESOURCES_BASE_URL + value: "http://iams.iam.svc.cluster.local:8080" + - name: CDE_API_RESOURCES_TIMEOUT + value: "10s" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "postgres-service" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations_db" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: documentations-postgresql-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: documentations-postgresql-secret + key: password diff --git a/apps/documentations/cronjobs/ugok/sizer.yaml b/apps/documentations/cronjobs/ugok/sizer.yaml new file mode 100644 index 0000000..0b1da2d --- /dev/null +++ b/apps/documentations/cronjobs/ugok/sizer.yaml @@ -0,0 +1,77 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-sizer + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-sizer + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-sizer + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: dockerhub + containers: + - name: sizer + image: 10.4.10.187:80/library/cde-api-worker-sizer:ugok_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-sizer" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_SIZER_BATCH_SIZE + value: "10000" + - name: CDE_API_SIZER_NUM_WORKERS + value: "10" + - name: CDE_API_SIZER_JOB_HALF_PERIOD + value: "12h" + - name: CDE_API_SIZER_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "postgres-service" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations_db" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: documentations-postgresql-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: documentations-postgresql-secret + key: password diff --git a/apps/documentations/cronjobs/ugok/workspace-recovery.yaml b/apps/documentations/cronjobs/ugok/workspace-recovery.yaml new file mode 100644 index 0000000..12558c4 --- /dev/null +++ b/apps/documentations/cronjobs/ugok/workspace-recovery.yaml @@ -0,0 +1,119 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-workspace-recovery + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 */12 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: dockerhub + containers: + - name: workspace-recovery + image: 10.4.10.187:80/library/cde-api-worker-workspace-recovery:ugok_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-workspace-recovery" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_REDIS__HOST + value: "redis" + - name: CDE_API_REDIS__PORT + value: "6379" + - name: CDE_API_REDIS__DB + value: "5" + - name: CDE_API_REDIS__SSL + value: "false" + - name: CDE_API_REDIS__DIAL_TIMEOUT_MS + value: "5000" + - name: CDE_API_REDIS__READ_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__WRITE_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__POOL_SIZE + value: "2" + - name: CDE_API_REDIS__MIN_IDLE_CONNS + value: "0" + - name: CDE_API_WORKSPACE_BASE_URL + value: "http://backend-svc.workspaces.svc.cluster.local:8000" + - name: CDE_API_WORKSPACE_TIMEOUT_MS + value: "10000" + - name: CDE_API_WORKSPACE_RETRY_COUNT + value: "0" + - name: CDE_API_WORKSPACE_RECOVERY_CONCURRENCY + value: "1" + - name: CDE_API_WORKSPACE_RECOVERY_CURSOR_KEY + value: "cde-api:production:workspace-recovery:cursor" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_SIZE + value: "100" + - name: CDE_API_WORKSPACE_RECOVERY_MIN_AGE + value: "1h" + - name: CDE_API_WORKSPACE_RECOVERY_REQUEST_INTERVAL + value: "1s" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_INTERVAL + value: "5s" + - name: CDE_API_WORKSPACE_RECOVERY_MAX_ERROR_DELAY + value: "1m" + - name: CDE_API_WORKSPACE_RECOVERY_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_DATABASE_MAX_CONN_LIFETIME + value: "30m" + - name: CDE_API_DATABASE_MAX_CONN_IDLE_TIME + value: "10m" + - name: CDE_API_DATABASE_HEALTH_CHECK_PERIOD + value: "30s" + - name: CDE_API_DATABASE_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "postgres-service" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations_db" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: documentations-postgresql-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: documentations-postgresql-secret + key: password diff --git a/apps/documentations/cronjobs/uralkal/kustomization.yaml b/apps/documentations/cronjobs/uralkal/kustomization.yaml new file mode 100644 index 0000000..d5055f7 --- /dev/null +++ b/apps/documentations/cronjobs/uralkal/kustomization.yaml @@ -0,0 +1,10 @@ +--- +# НЕ подключён к apps/documentations/uralkal и clusters/*: подключать отдельно, после выката cde-api +# (см. ../README.md). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: documentations +resources: + - workspace-recovery.yaml + - resource-id-backfill.yaml + - sizer.yaml diff --git a/apps/documentations/cronjobs/uralkal/resource-id-backfill.yaml b/apps/documentations/cronjobs/uralkal/resource-id-backfill.yaml new file mode 100644 index 0000000..d9e8238 --- /dev/null +++ b/apps/documentations/cronjobs/uralkal/resource-id-backfill.yaml @@ -0,0 +1,84 @@ +--- +# Одноразовая задача: CronJob создан в suspend, запускать вручную: kubectl -n documentations create job --from=cronjob/cde-api-resource-id-backfill <имя> +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-resource-id-backfill + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: true + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: resource-id-backfill + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-resource-id-backfill:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "resource-id-backfill" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_RESOURCE_BACKFILL_BATCH_SIZE + value: "500" + - name: CDE_API_RESOURCE_BACKFILL_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_RESOURCES_BASE_URL + value: "http://iams.iam.svc.cluster.local:8080" + - name: CDE_API_RESOURCES_TIMEOUT + value: "10s" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/uralkal/sizer.yaml b/apps/documentations/cronjobs/uralkal/sizer.yaml new file mode 100644 index 0000000..4aa4ad0 --- /dev/null +++ b/apps/documentations/cronjobs/uralkal/sizer.yaml @@ -0,0 +1,84 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-sizer + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-sizer + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-sizer + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: sizer + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-sizer:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-sizer" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_SIZER_BATCH_SIZE + value: "10000" + - name: CDE_API_SIZER_NUM_WORKERS + value: "10" + - name: CDE_API_SIZER_JOB_HALF_PERIOD + value: "12h" + - name: CDE_API_SIZER_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/uralkal/workspace-recovery.yaml b/apps/documentations/cronjobs/uralkal/workspace-recovery.yaml new file mode 100644 index 0000000..164691a --- /dev/null +++ b/apps/documentations/cronjobs/uralkal/workspace-recovery.yaml @@ -0,0 +1,126 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-workspace-recovery + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 */12 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: workspace-recovery + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-workspace-recovery:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-workspace-recovery" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_REDIS__HOST + value: "redis" + - name: CDE_API_REDIS__PORT + value: "6379" + - name: CDE_API_REDIS__DB + value: "5" + - name: CDE_API_REDIS__SSL + value: "false" + - name: CDE_API_REDIS__DIAL_TIMEOUT_MS + value: "5000" + - name: CDE_API_REDIS__READ_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__WRITE_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__POOL_SIZE + value: "2" + - name: CDE_API_REDIS__MIN_IDLE_CONNS + value: "0" + - name: CDE_API_WORKSPACE_BASE_URL + value: "http://backend-svc.workspaces.svc.cluster.local:80" + - name: CDE_API_WORKSPACE_TIMEOUT_MS + value: "10000" + - name: CDE_API_WORKSPACE_RETRY_COUNT + value: "0" + - name: CDE_API_WORKSPACE_RECOVERY_CONCURRENCY + value: "1" + - name: CDE_API_WORKSPACE_RECOVERY_CURSOR_KEY + value: "cde-api:production:workspace-recovery:cursor" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_SIZE + value: "100" + - name: CDE_API_WORKSPACE_RECOVERY_MIN_AGE + value: "1h" + - name: CDE_API_WORKSPACE_RECOVERY_REQUEST_INTERVAL + value: "1s" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_INTERVAL + value: "5s" + - name: CDE_API_WORKSPACE_RECOVERY_MAX_ERROR_DELAY + value: "1m" + - name: CDE_API_WORKSPACE_RECOVERY_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_DATABASE_MAX_CONN_LIFETIME + value: "30m" + - name: CDE_API_DATABASE_MAX_CONN_IDLE_TIME + value: "10m" + - name: CDE_API_DATABASE_HEALTH_CHECK_PERIOD + value: "30s" + - name: CDE_API_DATABASE_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/vad/kustomization.yaml b/apps/documentations/cronjobs/vad/kustomization.yaml new file mode 100644 index 0000000..d7f1747 --- /dev/null +++ b/apps/documentations/cronjobs/vad/kustomization.yaml @@ -0,0 +1,10 @@ +--- +# НЕ подключён к apps/documentations/vad и clusters/*: подключать отдельно, после выката cde-api +# (см. ../README.md). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: documentations +resources: + - workspace-recovery.yaml + - resource-id-backfill.yaml + - sizer.yaml diff --git a/apps/documentations/cronjobs/vad/resource-id-backfill.yaml b/apps/documentations/cronjobs/vad/resource-id-backfill.yaml new file mode 100644 index 0000000..d9e8238 --- /dev/null +++ b/apps/documentations/cronjobs/vad/resource-id-backfill.yaml @@ -0,0 +1,84 @@ +--- +# Одноразовая задача: CronJob создан в suspend, запускать вручную: kubectl -n documentations create job --from=cronjob/cde-api-resource-id-backfill <имя> +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-resource-id-backfill + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: true + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: resource-id-backfill + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-resource-id-backfill:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "resource-id-backfill" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_RESOURCE_BACKFILL_BATCH_SIZE + value: "500" + - name: CDE_API_RESOURCE_BACKFILL_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_RESOURCES_BASE_URL + value: "http://iams.iam.svc.cluster.local:8080" + - name: CDE_API_RESOURCES_TIMEOUT + value: "10s" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/vad/sizer.yaml b/apps/documentations/cronjobs/vad/sizer.yaml new file mode 100644 index 0000000..4aa4ad0 --- /dev/null +++ b/apps/documentations/cronjobs/vad/sizer.yaml @@ -0,0 +1,84 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-sizer + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-sizer + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-sizer + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: sizer + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-sizer:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-sizer" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_SIZER_BATCH_SIZE + value: "10000" + - name: CDE_API_SIZER_NUM_WORKERS + value: "10" + - name: CDE_API_SIZER_JOB_HALF_PERIOD + value: "12h" + - name: CDE_API_SIZER_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/vad/workspace-recovery.yaml b/apps/documentations/cronjobs/vad/workspace-recovery.yaml new file mode 100644 index 0000000..164691a --- /dev/null +++ b/apps/documentations/cronjobs/vad/workspace-recovery.yaml @@ -0,0 +1,126 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-workspace-recovery + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 */12 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: workspace-recovery + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-workspace-recovery:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-workspace-recovery" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_REDIS__HOST + value: "redis" + - name: CDE_API_REDIS__PORT + value: "6379" + - name: CDE_API_REDIS__DB + value: "5" + - name: CDE_API_REDIS__SSL + value: "false" + - name: CDE_API_REDIS__DIAL_TIMEOUT_MS + value: "5000" + - name: CDE_API_REDIS__READ_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__WRITE_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__POOL_SIZE + value: "2" + - name: CDE_API_REDIS__MIN_IDLE_CONNS + value: "0" + - name: CDE_API_WORKSPACE_BASE_URL + value: "http://backend-svc.workspaces.svc.cluster.local:80" + - name: CDE_API_WORKSPACE_TIMEOUT_MS + value: "10000" + - name: CDE_API_WORKSPACE_RETRY_COUNT + value: "0" + - name: CDE_API_WORKSPACE_RECOVERY_CONCURRENCY + value: "1" + - name: CDE_API_WORKSPACE_RECOVERY_CURSOR_KEY + value: "cde-api:production:workspace-recovery:cursor" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_SIZE + value: "100" + - name: CDE_API_WORKSPACE_RECOVERY_MIN_AGE + value: "1h" + - name: CDE_API_WORKSPACE_RECOVERY_REQUEST_INTERVAL + value: "1s" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_INTERVAL + value: "5s" + - name: CDE_API_WORKSPACE_RECOVERY_MAX_ERROR_DELAY + value: "1m" + - name: CDE_API_WORKSPACE_RECOVERY_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_DATABASE_MAX_CONN_LIFETIME + value: "30m" + - name: CDE_API_DATABASE_MAX_CONN_IDLE_TIME + value: "10m" + - name: CDE_API_DATABASE_HEALTH_CHECK_PERIOD + value: "30s" + - name: CDE_API_DATABASE_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/wb/kustomization.yaml b/apps/documentations/cronjobs/wb/kustomization.yaml new file mode 100644 index 0000000..a250df1 --- /dev/null +++ b/apps/documentations/cronjobs/wb/kustomization.yaml @@ -0,0 +1,10 @@ +--- +# НЕ подключён к apps/documentations/wb и clusters/*: подключать отдельно, после выката cde-api +# (см. ../README.md). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: documentations +resources: + - workspace-recovery.yaml + - resource-id-backfill.yaml + - sizer.yaml diff --git a/apps/documentations/cronjobs/wb/resource-id-backfill.yaml b/apps/documentations/cronjobs/wb/resource-id-backfill.yaml new file mode 100644 index 0000000..aaccdee --- /dev/null +++ b/apps/documentations/cronjobs/wb/resource-id-backfill.yaml @@ -0,0 +1,77 @@ +--- +# Одноразовая задача: CronJob создан в suspend, запускать вручную: kubectl -n documentations create job --from=cronjob/cde-api-resource-id-backfill <имя> +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-resource-id-backfill + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: true + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: dockerhub + containers: + - name: resource-id-backfill + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-resource-id-backfill:prod_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "resource-id-backfill" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_RESOURCE_BACKFILL_BATCH_SIZE + value: "500" + - name: CDE_API_RESOURCE_BACKFILL_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_RESOURCES_BASE_URL + value: "http://iams.iam.svc.cluster.local:8080" + - name: CDE_API_RESOURCES_TIMEOUT + value: "10s" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "sarex-vpsql-01.xc.wb.ru" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations_db" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: postgres-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: postgres-secret + key: password diff --git a/apps/documentations/cronjobs/wb/sizer.yaml b/apps/documentations/cronjobs/wb/sizer.yaml new file mode 100644 index 0000000..37ddbfd --- /dev/null +++ b/apps/documentations/cronjobs/wb/sizer.yaml @@ -0,0 +1,77 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-sizer + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-sizer + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-sizer + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: dockerhub + containers: + - name: sizer + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-sizer:prod_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-sizer" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_SIZER_BATCH_SIZE + value: "10000" + - name: CDE_API_SIZER_NUM_WORKERS + value: "10" + - name: CDE_API_SIZER_JOB_HALF_PERIOD + value: "12h" + - name: CDE_API_SIZER_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "sarex-vpsql-01.xc.wb.ru" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations_db" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: postgres-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: postgres-secret + key: password diff --git a/apps/documentations/cronjobs/wb/workspace-recovery.yaml b/apps/documentations/cronjobs/wb/workspace-recovery.yaml new file mode 100644 index 0000000..52b55a9 --- /dev/null +++ b/apps/documentations/cronjobs/wb/workspace-recovery.yaml @@ -0,0 +1,119 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-workspace-recovery + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 */12 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + imagePullSecrets: + - name: dockerhub + containers: + - name: workspace-recovery + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-workspace-recovery:prod_c9bc246 + imagePullPolicy: IfNotPresent + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-workspace-recovery" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_REDIS__HOST + value: "redis" + - name: CDE_API_REDIS__PORT + value: "6379" + - name: CDE_API_REDIS__DB + value: "5" + - name: CDE_API_REDIS__SSL + value: "false" + - name: CDE_API_REDIS__DIAL_TIMEOUT_MS + value: "5000" + - name: CDE_API_REDIS__READ_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__WRITE_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__POOL_SIZE + value: "2" + - name: CDE_API_REDIS__MIN_IDLE_CONNS + value: "0" + - name: CDE_API_WORKSPACE_BASE_URL + value: "http://workspaces-service.workspaces.svc.cluster.local:8000" + - name: CDE_API_WORKSPACE_TIMEOUT_MS + value: "10000" + - name: CDE_API_WORKSPACE_RETRY_COUNT + value: "0" + - name: CDE_API_WORKSPACE_RECOVERY_CONCURRENCY + value: "1" + - name: CDE_API_WORKSPACE_RECOVERY_CURSOR_KEY + value: "cde-api:production:workspace-recovery:cursor" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_SIZE + value: "100" + - name: CDE_API_WORKSPACE_RECOVERY_MIN_AGE + value: "1h" + - name: CDE_API_WORKSPACE_RECOVERY_REQUEST_INTERVAL + value: "1s" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_INTERVAL + value: "5s" + - name: CDE_API_WORKSPACE_RECOVERY_MAX_ERROR_DELAY + value: "1m" + - name: CDE_API_WORKSPACE_RECOVERY_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_DATABASE_MAX_CONN_LIFETIME + value: "30m" + - name: CDE_API_DATABASE_MAX_CONN_IDLE_TIME + value: "10m" + - name: CDE_API_DATABASE_HEALTH_CHECK_PERIOD + value: "30s" + - name: CDE_API_DATABASE_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" + - name: CDE_API_DATABASE__HOST + value: "sarex-vpsql-01.xc.wb.ru" + - name: CDE_API_DATABASE__PORT + value: "5432" + - name: CDE_API_DATABASE__NAME + value: "documentations_db" + - name: CDE_API_DATABASE__USER + valueFrom: + secretKeyRef: + name: postgres-secret + key: username + - name: CDE_API_DATABASE__PASSWORD + valueFrom: + secretKeyRef: + name: postgres-secret + key: password diff --git a/apps/documentations/cronjobs/yc-k8s-test/kustomization.yaml b/apps/documentations/cronjobs/yc-k8s-test/kustomization.yaml new file mode 100644 index 0000000..1e4a799 --- /dev/null +++ b/apps/documentations/cronjobs/yc-k8s-test/kustomization.yaml @@ -0,0 +1,10 @@ +--- +# НЕ подключён к apps/documentations/yc-k8s-test и clusters/*: подключать отдельно, после выката cde-api +# (см. ../README.md). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: documentations +resources: + - workspace-recovery.yaml + - resource-id-backfill.yaml + - sizer.yaml diff --git a/apps/documentations/cronjobs/yc-k8s-test/resource-id-backfill.yaml b/apps/documentations/cronjobs/yc-k8s-test/resource-id-backfill.yaml new file mode 100644 index 0000000..d9e8238 --- /dev/null +++ b/apps/documentations/cronjobs/yc-k8s-test/resource-id-backfill.yaml @@ -0,0 +1,84 @@ +--- +# Одноразовая задача: CronJob создан в suspend, запускать вручную: kubectl -n documentations create job --from=cronjob/cde-api-resource-id-backfill <имя> +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-resource-id-backfill + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: true + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-resource-id-backfill + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: resource-id-backfill + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-resource-id-backfill:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "resource-id-backfill" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_RESOURCE_BACKFILL_BATCH_SIZE + value: "500" + - name: CDE_API_RESOURCE_BACKFILL_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_RESOURCES_BASE_URL + value: "http://iams.iam.svc.cluster.local:8080" + - name: CDE_API_RESOURCES_TIMEOUT + value: "10s" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/yc-k8s-test/sizer.yaml b/apps/documentations/cronjobs/yc-k8s-test/sizer.yaml new file mode 100644 index 0000000..4aa4ad0 --- /dev/null +++ b/apps/documentations/cronjobs/yc-k8s-test/sizer.yaml @@ -0,0 +1,84 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-sizer + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-sizer + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 0 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-sizer + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: sizer + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-sizer:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-sizer" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_SIZER_BATCH_SIZE + value: "10000" + - name: CDE_API_SIZER_NUM_WORKERS + value: "10" + - name: CDE_API_SIZER_JOB_HALF_PERIOD + value: "12h" + - name: CDE_API_SIZER_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/cronjobs/yc-k8s-test/workspace-recovery.yaml b/apps/documentations/cronjobs/yc-k8s-test/workspace-recovery.yaml new file mode 100644 index 0000000..164691a --- /dev/null +++ b/apps/documentations/cronjobs/yc-k8s-test/workspace-recovery.yaml @@ -0,0 +1,126 @@ +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: cde-api-workspace-recovery + namespace: documentations + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + app.kubernetes.io/part-of: cde-api +spec: + schedule: "0 */12 * * *" + timeZone: Etc/UTC + suspend: false + concurrencyPolicy: Forbid + startingDeadlineSeconds: 1800 + successfulJobsHistoryLimit: 2 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 0 + activeDeadlineSeconds: 21600 + template: + metadata: + labels: + app.kubernetes.io/name: cde-api-workspace-recovery + annotations: + proxy.istio.io/config: '{"terminationDrainDuration":"0s"}' + sidecar.istio.io/inject: "true" + sidecar.istio.io/nativeSidecar: "true" + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: documentations + vault.hashicorp.com/agent-inject-secret-cde-api-postgres: secrets/data/apps/documentations/postgres + vault.hashicorp.com/agent-inject-template-cde-api-postgres: |- + {{- with secret "secrets/data/apps/documentations/postgres" -}} + CDE_API_DATABASE__HOST={{ index .Data.data "host" }} + CDE_API_DATABASE__PORT={{ index .Data.data "port" }} + CDE_API_DATABASE__NAME={{ index .Data.data "database" }} + CDE_API_DATABASE__USER={{ index .Data.data "username" }} + CDE_API_DATABASE__PASSWORD={{ index .Data.data "password" }} + {{- end -}} + spec: + restartPolicy: Never + terminationGracePeriodSeconds: 30 + serviceAccountName: documentations-vault + imagePullSecrets: + - name: regcred + containers: + - name: workspace-recovery + image: cr.yandex/crp3ccidau046kdj8g9q/cde-api-worker-workspace-recovery:prod_c9bc246 + imagePullPolicy: IfNotPresent + command: ["/bin/sh", "-ec"] + args: + - | + set -a + [ -f /vault/secrets/cde-api-postgres ] && . /vault/secrets/cde-api-postgres + set +a + exec /opt/worker + resources: + requests: + cpu: 100m + memory: 128Mi + env: + - name: CDE_API_APP_NAME + value: "worker-workspace-recovery" + - name: CDE_API_LOG_LEVEL + value: "info" + - name: CDE_API_REDIS__HOST + value: "redis" + - name: CDE_API_REDIS__PORT + value: "6379" + - name: CDE_API_REDIS__DB + value: "5" + - name: CDE_API_REDIS__SSL + value: "false" + - name: CDE_API_REDIS__DIAL_TIMEOUT_MS + value: "5000" + - name: CDE_API_REDIS__READ_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__WRITE_TIMEOUT_MS + value: "3000" + - name: CDE_API_REDIS__POOL_SIZE + value: "2" + - name: CDE_API_REDIS__MIN_IDLE_CONNS + value: "0" + - name: CDE_API_WORKSPACE_BASE_URL + value: "http://backend-svc.workspaces.svc.cluster.local:80" + - name: CDE_API_WORKSPACE_TIMEOUT_MS + value: "10000" + - name: CDE_API_WORKSPACE_RETRY_COUNT + value: "0" + - name: CDE_API_WORKSPACE_RECOVERY_CONCURRENCY + value: "1" + - name: CDE_API_WORKSPACE_RECOVERY_CURSOR_KEY + value: "cde-api:production:workspace-recovery:cursor" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_SIZE + value: "100" + - name: CDE_API_WORKSPACE_RECOVERY_MIN_AGE + value: "1h" + - name: CDE_API_WORKSPACE_RECOVERY_REQUEST_INTERVAL + value: "1s" + - name: CDE_API_WORKSPACE_RECOVERY_BATCH_INTERVAL + value: "5s" + - name: CDE_API_WORKSPACE_RECOVERY_MAX_ERROR_DELAY + value: "1m" + - name: CDE_API_WORKSPACE_RECOVERY_RUN_TIMEOUT + value: "6h" + - name: CDE_API_DATABASE_POOL_SIZE + value: "2" + - name: CDE_API_DATABASE_MAX_CONN_LIFETIME + value: "30m" + - name: CDE_API_DATABASE_MAX_CONN_IDLE_TIME + value: "10m" + - name: CDE_API_DATABASE_HEALTH_CHECK_PERIOD + value: "30s" + - name: CDE_API_DATABASE_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_OBSERVABILITY_ENABLE + value: "false" + - name: CDE_API_DATABASE__SSLMODE + value: "disable" + - name: CDE_API_DATABASE__INSECURE_SKIP_TLS + value: "false" diff --git a/apps/documentations/d8-ugmk-prod/cde-api-worker-copy.yaml b/apps/documentations/d8-ugmk-prod/cde-api-worker-copy.yaml index 8fb4cc3..3fda701 100644 --- a/apps/documentations/d8-ugmk-prod/cde-api-worker-copy.yaml +++ b/apps/documentations/d8-ugmk-prod/cde-api-worker-copy.yaml @@ -164,7 +164,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/d8-ugmk-prod/cde-api-worker-move.yaml b/apps/documentations/d8-ugmk-prod/cde-api-worker-move.yaml index ffb9d10..d125d0a 100644 --- a/apps/documentations/d8-ugmk-prod/cde-api-worker-move.yaml +++ b/apps/documentations/d8-ugmk-prod/cde-api-worker-move.yaml @@ -164,7 +164,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/d8-ugmk-prod/cde-api-worker-s32d-process-workflows.yaml b/apps/documentations/d8-ugmk-prod/cde-api-worker-s32d-process-workflows.yaml index 17b9b7c..f789fc7 100644 --- a/apps/documentations/d8-ugmk-prod/cde-api-worker-s32d-process-workflows.yaml +++ b/apps/documentations/d8-ugmk-prod/cde-api-worker-s32d-process-workflows.yaml @@ -164,7 +164,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/d8-ugmk-prod/cde-api.yaml b/apps/documentations/d8-ugmk-prod/cde-api.yaml index d2dab55..6086465 100644 --- a/apps/documentations/d8-ugmk-prod/cde-api.yaml +++ b/apps/documentations/d8-ugmk-prod/cde-api.yaml @@ -149,7 +149,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DATABASE_MAX_CONN_LIFETIME value: _default: "30m" diff --git a/apps/documentations/ugok/cde-api-worker-copy.yaml b/apps/documentations/ugok/cde-api-worker-copy.yaml index 5d16f7f..f0c7564 100644 --- a/apps/documentations/ugok/cde-api-worker-copy.yaml +++ b/apps/documentations/ugok/cde-api-worker-copy.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/ugok/cde-api-worker-move.yaml b/apps/documentations/ugok/cde-api-worker-move.yaml index 34230f3..c3a05f4 100644 --- a/apps/documentations/ugok/cde-api-worker-move.yaml +++ b/apps/documentations/ugok/cde-api-worker-move.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/ugok/cde-api-worker-s32d-process-workflows.yaml b/apps/documentations/ugok/cde-api-worker-s32d-process-workflows.yaml index 389d0e8..a0faaa3 100644 --- a/apps/documentations/ugok/cde-api-worker-s32d-process-workflows.yaml +++ b/apps/documentations/ugok/cde-api-worker-s32d-process-workflows.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/ugok/cde-api.yaml b/apps/documentations/ugok/cde-api.yaml index cebe996..0863423 100644 --- a/apps/documentations/ugok/cde-api.yaml +++ b/apps/documentations/ugok/cde-api.yaml @@ -206,7 +206,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DATABASE_MAX_CONN_LIFETIME value: _default: "30m" diff --git a/apps/documentations/uralkal/cde-api-worker-copy.yaml b/apps/documentations/uralkal/cde-api-worker-copy.yaml index 29195eb..7d81870 100644 --- a/apps/documentations/uralkal/cde-api-worker-copy.yaml +++ b/apps/documentations/uralkal/cde-api-worker-copy.yaml @@ -164,7 +164,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/uralkal/cde-api-worker-move.yaml b/apps/documentations/uralkal/cde-api-worker-move.yaml index ebbe8e7..80e278d 100644 --- a/apps/documentations/uralkal/cde-api-worker-move.yaml +++ b/apps/documentations/uralkal/cde-api-worker-move.yaml @@ -164,7 +164,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/uralkal/cde-api-worker-s32d-process-workflows.yaml b/apps/documentations/uralkal/cde-api-worker-s32d-process-workflows.yaml index 9645910..fa8fe31 100644 --- a/apps/documentations/uralkal/cde-api-worker-s32d-process-workflows.yaml +++ b/apps/documentations/uralkal/cde-api-worker-s32d-process-workflows.yaml @@ -164,7 +164,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/uralkal/cde-api.yaml b/apps/documentations/uralkal/cde-api.yaml index c605cb5..d8239c1 100644 --- a/apps/documentations/uralkal/cde-api.yaml +++ b/apps/documentations/uralkal/cde-api.yaml @@ -149,7 +149,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DATABASE_MAX_CONN_LIFETIME value: _default: "30m" diff --git a/apps/documentations/vad/cde-api-worker-copy.yaml b/apps/documentations/vad/cde-api-worker-copy.yaml index 29195eb..7d81870 100644 --- a/apps/documentations/vad/cde-api-worker-copy.yaml +++ b/apps/documentations/vad/cde-api-worker-copy.yaml @@ -164,7 +164,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/vad/cde-api-worker-move.yaml b/apps/documentations/vad/cde-api-worker-move.yaml index ebbe8e7..80e278d 100644 --- a/apps/documentations/vad/cde-api-worker-move.yaml +++ b/apps/documentations/vad/cde-api-worker-move.yaml @@ -164,7 +164,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/vad/cde-api-worker-s32d-process-workflows.yaml b/apps/documentations/vad/cde-api-worker-s32d-process-workflows.yaml index 9645910..fa8fe31 100644 --- a/apps/documentations/vad/cde-api-worker-s32d-process-workflows.yaml +++ b/apps/documentations/vad/cde-api-worker-s32d-process-workflows.yaml @@ -164,7 +164,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://backend-api-svc.documentations.svc.cluster.local:80" diff --git a/apps/documentations/vad/cde-api.yaml b/apps/documentations/vad/cde-api.yaml index 0fd6826..5e70ee5 100644 --- a/apps/documentations/vad/cde-api.yaml +++ b/apps/documentations/vad/cde-api.yaml @@ -149,7 +149,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DATABASE_MAX_CONN_LIFETIME value: _default: "30m" diff --git a/apps/documentations/wb/cde-api-worker-copy.yaml b/apps/documentations/wb/cde-api-worker-copy.yaml index 2f43d09..d6780b8 100644 --- a/apps/documentations/wb/cde-api-worker-copy.yaml +++ b/apps/documentations/wb/cde-api-worker-copy.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/wb/cde-api-worker-move.yaml b/apps/documentations/wb/cde-api-worker-move.yaml index b328d75..59e006a 100644 --- a/apps/documentations/wb/cde-api-worker-move.yaml +++ b/apps/documentations/wb/cde-api-worker-move.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/wb/cde-api-worker-s32d-process-workflows.yaml b/apps/documentations/wb/cde-api-worker-s32d-process-workflows.yaml index eab7db6..0252b2b 100644 --- a/apps/documentations/wb/cde-api-worker-s32d-process-workflows.yaml +++ b/apps/documentations/wb/cde-api-worker-s32d-process-workflows.yaml @@ -209,7 +209,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DOCUMENTATION_V2_URL value: _default: "http://documentations-api.documentations.svc.cluster.local:8080" diff --git a/apps/documentations/wb/cde-api.yaml b/apps/documentations/wb/cde-api.yaml index 34e8862..8d64d2a 100644 --- a/apps/documentations/wb/cde-api.yaml +++ b/apps/documentations/wb/cde-api.yaml @@ -206,7 +206,7 @@ spec: _default: "true" - name: CDE_API_USE_LEGACY_BIM_FLOW value: - _default: "0" + _default: "true" - name: CDE_API_DATABASE_MAX_CONN_LIFETIME value: _default: "30m"