premises in ugmk, inspections VS name fix, remarks contour image, debug pod sleep

premises: d8-ugmk-prod overlay (ugmk Kafka CA mounted, prod-sized requests
dropped), wired into the cluster, /premises/api/ routed on sarex.uralmine.com.
Terraform side is infra/terraform 856ab54.

istio-config d8-ugmk-prod, vad, uralkal: inspections-api reused the name
flows-api-virt-service, so two VirtualServices collided and one of
/flows/api/ and /inspections/api/ was lost. It is now
inspections-api-virt-service.

remarks base frontend image -> remarks-frontend:contour_013c5091.
psql-tools-debug in uralkal sleeps forever so it can be exec'd into.

apps/control-interface/uralkal/psql-tools-debug.yaml

@@ -20,5 +20,6 @@ spec:
         - name: debug
           image: cr.yandex/crp3ccidau046kdj8g9q/mc-files:dev9
           imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c", "while true; do sleep 3600; done"]
       imagePullSecrets:
         - name: regcred

apps/premises/d8-ugmk-prod/backend.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: premises
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        volumes:
+          _default:
+            - name: kafka-ca-cert
+              mountPath:
+                _default: /usr/local/share/ca-certificates/kafka.crt
+              subPath:
+                _default: kafka.crt
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-ca-cert
+                items:
+                  - key: kafka.crt
+                    path:
+                      _default: kafka.crt

apps/premises/d8-ugmk-prod/kafka-ca-configmap.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-ca-cert
+  namespace: premises
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
+    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
+    NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+    MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
+    h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
+    D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
+    tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
+    Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
+    GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
+    A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
+    QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
+    KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
+    kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
+    TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
+    fdA17/ibw6gFrH2b3vZKcx8D455V
+    -----END CERTIFICATE-----

apps/premises/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - kafka-ca-configmap.yaml
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend

apps/remarks/base/helmrelease.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/remarks-frontend:wb_002f8896
+            _default: cr.yandex/crp3ccidau046kdj8g9q/remarks-frontend:contour_013c5091
           pullPolicy:
             _default: IfNotPresent
 

clusters/d8-ugmk-prod/kustomization.yaml

@@ -47,6 +47,7 @@ resources:
   - ../../apps/document-link/d8-ugmk-prod
   - ../../apps/bim/d8-ugmk-prod
   - ../../apps/cde/d8-ugmk-prod
+  - ../../apps/premises/d8-ugmk-prod
   - ../../apps/flows/d8-ugmk-prod
   - ../../apps/inspections/d8-ugmk-prod
   - ../../apps/issues/d8-ugmk-prod

infrastructure/istio-config/d8-ugmk-prod/istio-config.yaml

@@ -336,7 +336,7 @@ spec:
                   service: backend-svc.transmittal.svc.cluster.local
                   port: 80
             inspections-api:
-              name: flows-api-virt-service
+              name: inspections-api-virt-service
               namespace: default
               hosts:
                 - sarex.uralmine.com
@@ -348,6 +348,19 @@ spec:
                   rewrite: /api/
                   service: backend-svc.inspections.svc.cluster.local
                   port: 80
+            premises-api:
+              name: premises-api-virt-service
+              namespace: default
+              hosts:
+                - sarex.uralmine.com
+              gateways:
+                - default/platform-gateway
+              routes:
+                - path:
+                    prefix: /premises/api/
+                  rewrite: /api/
+                  service: backend-svc.premises.svc.cluster.local
+                  port: 80
             reviews-frontend:
               name: reviews-frontend-virt-service
               namespace: default

infrastructure/istio-config/uralkal/istio-config.yaml

@@ -338,7 +338,7 @@ spec:
                   service: backend-svc.transmittal.svc.cluster.local
                   port: 80
             inspections-api:
-              name: flows-api-virt-service
+              name: inspections-api-virt-service
               namespace: default
               hosts:
                 - sarex.local.uralkali.com

infrastructure/istio-config/vad/istio-config.yaml

@@ -323,7 +323,7 @@ spec:
                   service: backend-svc.transmittal.svc.cluster.local
                   port: 80
             inspections-api:
-              name: flows-api-virt-service
+              name: inspections-api-virt-service
               namespace: default
               hosts:
                 - sarex.vadroad.ru