++

apps/pm/brusnika-stage/backend.yaml

@@ -98,6 +98,15 @@ spec:
                 secretName:
                   _default: sarex-env
 
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
 
         labels:
           monitoring: prometheus

apps/pm/brusnika-stage/kafka-cert-configmap.yaml

@@ -0,0 +1,40 @@
+---
+# Strimzi cluster-CA контура brusnika-stage (kafka/brusnika-stage-cluster-ca-cert, key ca.crt).
+# Действует до Jun 10 2027; при ротации cluster-CA обновить отсюда.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: pm
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUHl1sFdJibCl67FlnkLuzZkby05swDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNjA2MTAxMTMyMzNaFw0yNzA2MTAxMTMyMzNaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQDIe7yiKN1mnVPfDGcRk3b02gV3FsVmVB2aZIGVWOB7
+    02Wmo89cVqq5lI6g3+ZB2t4Hp2SFAogzT0HNYa0SxxjAcA7BgA+qvtfMOETkkYng
+    CazNMRZHUSd1cZFyTejY9Ek2I4aHJJT4QWF9lG6A4u9btAG54RBtaTZ+sDJcRWx4
+    IwyzZazfXOD5ZtAuxkmH/pNj794jANf32RSWzhEXqziYRjGuJpclH6HWJT52pL8P
+    GJE5t6tsgWyxUKKB+XDF7CJcbhT6fX50IbOEa4brHvN8iHysB5C9eiTe0agwc8tO
+    iISH1JCTppDChjgf1d8JAof/y5/FHBIWpJL5fL68Y4wKYspNI3zBI0MJ22R3z10w
+    3AAto2b8rh6su8zAj6vy7KU8zZroR4jnZ9ZdJZzY1V5rvjS5JEcHuyb7gMxx7GZW
+    W060Mzunwshz+N2hqIQh4E9jF+Yi3PHk4UnT0P9XPSytPgcrarjxgbQ2mTVAq3hF
+    a6Gh6mIZ7dVuKo9eqYKlSlMQHfMNWJEPHLvDMAEkvuEVLa2xnXuegyDcTSbLlmD6
+    DXHFY5XyfHpNYQylpyGgSl4P+53ymYUZUKqAMnV0egLnEXfId4i2r7hJAxSTeTwP
+    8RbI+T1RbgiVTxWswn0BlJ9M1EraOovsBVFJmyN3a4od+Ar/4lqSPNOWSjSj2ikz
+    BwIDAQABo0UwQzAdBgNVHQ4EFgQUKRE5tbzCzuNbUx/F7yNVEaDglXUwEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    ALY9eSpTFL3ht8NdLvTZBq54Jz7LvnSXHKH8ikbDBtP9Tn1BV4qgyW16OeDUFX98
+    ud93JjilYZiqd7JwJlJXWqTYBLOpfSQnZSj91Si6qGBTsnrzPMKfCg3gjaBrSddF
+    1EllJZ657Nzdfc41bleewEfpdvtIQ0f/sY7rQl0m7PZxvlrb3KOyqrHAjsVyDI8o
+    6yTbV/ssi3njpRLDBkjgPw15yjCGUtqyoTATzyFYd/EB/GotNBiy/Si8sx447+vg
+    VvPHD0maLXqEwW2bnF+9H/8onyZUdMtjpyXkLLiknpk/4y4pRK9V0a3jJ/TUvJ5N
+    s/MQzt3hgKECBIIwy2K6r72/0W9fQQKdbQl+FkiHRZbkAs7whq5zsh2oahCokZQl
+    kdG5CThIeywElWIoCxwRlGf9IXIcq+f64QF5y+d4tEScaJ25gdTQJg+wJZFZdpcg
+    Xr7owOyAdnn7Fe6qpCLIhj78I6CiD0z8LREWa0R2xz5fOqt9v8ZfcXizr/EIbbBc
+    0FCG2DDvVwpXq2UaLQKdV0hMilFOpgUvjZNfjRqQ9T3O1T+/n350r2bedjdyp2JE
+    nqFytDX4g4ChkqW84KJpnT2RWOHr7GWwZMMnmKikBQo+gf7aBCbE2d6rpw5MlOAR
+    e+yRWhxtJYHCkSBY9kAQ9cgzPoW1fOVWj7wAG4vcW2wf
+    -----END CERTIFICATE-----

apps/pm/brusnika-stage/kustomization.yaml

@@ -3,5 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: pm
 resources:
+  - kafka-cert-configmap.yaml
   - frontend.yaml
   - backend.yaml