From 5cbcdd4ff7570b98bf4fe289f0be893f5f62875b Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 26 Oct 2026 13:07:00 +0500 Subject: [PATCH] ++ --- apps/issues/uralkal/backend-s3.yaml | 153 ------------------------- apps/issues/uralkal/backend.yaml | 137 ++++++++++++++++++++++ apps/issues/uralkal/celery-s3.yaml | 149 ------------------------ apps/issues/uralkal/celery.yaml | 134 ++++++++++++++++++++++ apps/issues/uralkal/kustomization.yaml | 8 -- 5 files changed, 271 insertions(+), 310 deletions(-) delete mode 100644 apps/issues/uralkal/backend-s3.yaml delete mode 100644 apps/issues/uralkal/celery-s3.yaml diff --git a/apps/issues/uralkal/backend-s3.yaml b/apps/issues/uralkal/backend-s3.yaml deleted file mode 100644 index 0d583fb..0000000 --- a/apps/issues/uralkal/backend-s3.yaml +++ /dev/null @@ -1,153 +0,0 @@ ---- -# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml. -# podAnnotations — map, мержится по ключам. -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: backend - namespace: issues -spec: - values: - services: - backend: - deployment: - args: - _default: - - | - set -a - [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db - [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq - [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 - [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth - [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" - [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" - [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka - set +a - exec /src/entrypoint.sh - - volumes: - _default: - - name: production-configmap - mountPath: - _default: /src/config/settings/production.py - subPath: - _default: production.py - readOnly: - _default: true - configMap: - name: - _default: production-configmap - items: - - key: production.py - path: - _default: production.py - - name: kafka-ca-cert - mountPath: - _default: /usr/local/share/ca-certificates/kafka.crt - subPath: - _default: kafka.crt - readOnly: - _default: true - secret: - secretName: - _default: kafka-kafka-contour-tls - items: - - key: ca.crt - path: - _default: kafka.crt - - envs: - - name: ENVIRONMENT - value: - _default: "production" - - - name: AERO_PUBLIC_HOST - value: - _default: "https://sarex.contour.infra.sarex.tech" - - - name: AERO_HOST - value: - _default: "https://sarex.contour.infra.sarex.tech" - - - name: BASE_AERO_URL - value: - _default: "https://sarex.contour.infra.sarex.tech" - - - name: BASE_AUTH_URL - value: - _default: "http://backend-svc.django.svc.cluster.local:80" - - - name: WORKFLOWS_HOST - value: - _default: "http://backend-svc.workflow.svc.cluster.local:80" - - - name: WORKFLOWS_URL - value: - _default: "http://backend-svc.workflow.svc.cluster.local:80" - - - name: RESOURCES_API_HOST - value: - _default: "http://iam-backend.iam.svc.cluster.local:8000" - - - name: EAV_HOST - value: - _default: "http://backend-svc.eav.svc.cluster.local:80" - - - name: SAREX_API - value: - _default: "http://backend-svc.django.svc.cluster.local:80" - - - name: SAREX_HOST - value: - _default: "https://sarex.local.uralkali.com" - - - name: DOCUMENTATIONS_URL - value: - _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" - - - name: DJANGO_SETTINGS_MODULE - value: - _default: "config.settings.production" - - - name: API_ADDRESS - value: - _default: "8000" - - # Kafka — код (kafka_app/app.py) ждёт KAFKA_HOST единой строкой "host:port", - # KAFKA_SSL_CAFILE — путь к файлу (не PEM-текст, в отличие от flows-backend). - # Хост/порт/CA — те же проверенные значения, что у message-hub/pm/flows. - - name: KAFKA_HOST - value: - _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" - - - name: KAFKA_SSL_CAFILE - value: - _default: "/usr/local/share/ca-certificates/kafka.crt" - - # Топики совпадают с тем, что уже провижено на брокере (см. topics - # в секрете kafka/apps/pm) и с SETTINGS_TOPICS у message-hub. - - name: KAFKA_ISSUES_TOPIC - value: - _default: "issues_broadcast_prod" - - - name: KAFKA_EAV_ASSETS_TOPIC - value: - _default: "assets_broadcast" - - podAnnotations: - _default: - vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues - vault.hashicorp.com/agent-inject-template-issues-s3: |- - {{- with secret "secrets/data/minio/apps/issues" -}} - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - YC_S3_BUCKET_NAME=issues - YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues - vault.hashicorp.com/agent-inject-template-issues-kafka: |- - {{- with secret "secrets/data/kafka/apps/issues" -}} - KAFKA_USERNAME={{ index .Data.data "username" }} - KAFKA_PASSWORD={{ index .Data.data "password" }} - {{- end -}} diff --git a/apps/issues/uralkal/backend.yaml b/apps/issues/uralkal/backend.yaml index ade068e..6a84092 100644 --- a/apps/issues/uralkal/backend.yaml +++ b/apps/issues/uralkal/backend.yaml @@ -8,8 +8,145 @@ spec: values: services: backend: + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_eb983275 deployment: resources: requests: cpu: null memory: null + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka + set +a + exec /src/entrypoint.sh + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + secret: + secretName: + _default: kafka-kafka-contour-tls + items: + - key: ca.crt + path: + _default: kafka.crt + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: AERO_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AERO_URL + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: WORKFLOWS_URL + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: SAREX_HOST + value: + _default: "https://sarex.local.uralkali.com" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_ISSUES_TOPIC + value: + _default: "issues_broadcast_prod" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=issues + YC_S3_ENDPOINT_URL=http://10.133.0.245:9000 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-kafka: |- + {{- with secret "secrets/data/kafka/apps/issues" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/issues/uralkal/celery-s3.yaml b/apps/issues/uralkal/celery-s3.yaml deleted file mode 100644 index 62359c8..0000000 --- a/apps/issues/uralkal/celery-s3.yaml +++ /dev/null @@ -1,149 +0,0 @@ ---- -# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/issues/base/celery.yaml. -# podAnnotations — map, мержится по ключам. -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: celery - namespace: issues -spec: - values: - services: - celery: - deployment: - args: - _default: - - | - set -a - [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db - [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq - [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 - [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth - [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" - [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" - [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka - set +a - exec celery -A config worker -l info -E - - volumes: - _default: - - name: production-configmap - mountPath: - _default: /src/config/settings/production.py - subPath: - _default: production.py - readOnly: - _default: true - configMap: - name: - _default: production-configmap - items: - - key: production.py - path: - _default: production.py - - name: kafka-ca-cert - mountPath: - _default: /usr/local/share/ca-certificates/kafka.crt - subPath: - _default: kafka.crt - readOnly: - _default: true - secret: - secretName: - _default: kafka-kafka-contour-tls - items: - - key: ca.crt - path: - _default: kafka.crt - - envs: - - name: ENVIRONMENT - value: - _default: "production" - - - name: AERO_PUBLIC_HOST - value: - _default: "https://srx.wb.ru" - - - name: AERO_HOST - value: - _default: "https://srx.wb.ru" - - - name: BASE_AERO_URL - value: - _default: "https://srx.wb.ru" - - - name: BASE_AUTH_URL - value: - _default: "http://backend-svc.django.svc.cluster.local:80" - - - name: WORKFLOWS_HOST - value: - _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" - - - name: WORKFLOWS_URL - value: - _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" - - - name: RESOURCES_API_HOST - value: - _default: "http://iam-backend.iam.svc.cluster.local:8000" - - - name: EAV_HOST - value: - _default: "http://backend-svc.eav.svc.cluster.local:80" - - - name: SAREX_API - value: - _default: "http://backend-svc.django.svc.cluster.local:80" - - - name: SAREX_HOST - value: - _default: "https://sarex.local.uralkali.com" - - - name: DOCUMENTATIONS_URL - value: - _default: "http://backend-api-svc.documentations.svc.cluster.local:80" - - - name: DJANGO_SETTINGS_MODULE - value: - _default: "config.settings.production" - - - name: API_ADDRESS - value: - _default: "8000" - - # См. подробные комментарии в apps/issues/d8-ugmk-prod/backend-s3.yaml. - - name: KAFKA_HOST - value: - _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" - - - name: KAFKA_SSL_CAFILE - value: - _default: "/usr/local/share/ca-certificates/kafka.crt" - - - name: KAFKA_ISSUES_TOPIC - value: - _default: "issues_broadcast_prod" - - - name: KAFKA_EAV_ASSETS_TOPIC - value: - _default: "assets_broadcast" - - podAnnotations: - _default: - vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues - vault.hashicorp.com/agent-inject-template-issues-s3: |- - {{- with secret "secrets/data/minio/apps/issues" -}} - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - YC_S3_BUCKET_NAME=issues - YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local - {{- end -}} - vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues - vault.hashicorp.com/agent-inject-template-issues-kafka: |- - {{- with secret "secrets/data/kafka/apps/issues" -}} - KAFKA_USERNAME={{ index .Data.data "username" }} - KAFKA_PASSWORD={{ index .Data.data "password" }} - {{- end -}} diff --git a/apps/issues/uralkal/celery.yaml b/apps/issues/uralkal/celery.yaml index b122579..50541e0 100644 --- a/apps/issues/uralkal/celery.yaml +++ b/apps/issues/uralkal/celery.yaml @@ -13,3 +13,137 @@ spec: requests: cpu: null memory: null + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka + set +a + exec celery -A config worker -l info -E + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + secret: + secretName: + _default: kafka-kafka-contour-tls + items: + - key: ca.crt + path: + _default: kafka.crt + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: AERO_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AERO_URL + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: SAREX_HOST + value: + _default: "https://sarex.local.uralkali.com" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_ISSUES_TOPIC + value: + _default: "issues_broadcast_prod" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=issues + YC_S3_ENDPOINT_URL=http://10.133.0.245:9000 + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-kafka: |- + {{- with secret "secrets/data/kafka/apps/issues" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/issues/uralkal/kustomization.yaml b/apps/issues/uralkal/kustomization.yaml index 0e24432..0a9dfd7 100644 --- a/apps/issues/uralkal/kustomization.yaml +++ b/apps/issues/uralkal/kustomization.yaml @@ -3,14 +3,6 @@ kind: Kustomization resources: - ../base patches: - - path: backend-s3.yaml - target: - kind: HelmRelease - name: backend - - path: celery-s3.yaml - target: - kind: HelmRelease - name: celery - path: backend.yaml target: kind: HelmRelease