diff --git a/apps/attachments/ugok/patch.yaml b/apps/attachments/ugok/backend.yaml similarity index 51% rename from apps/attachments/ugok/patch.yaml rename to apps/attachments/ugok/backend.yaml index a0d11f1..c9206d1 100644 --- a/apps/attachments/ugok/patch.yaml +++ b/apps/attachments/ugok/backend.yaml @@ -1,16 +1,93 @@ --- +# standalone HelmRelease по образцу apps/attachments/wb/backend.yaml — base +# vault-native, а в ugok Vault не используется. Command/args/serviceAccount +# из base не нужны и не нужны были даже вживую: реальный дамп кластера +# показывает, что контейнер стартует штатным entrypoint'ом образа без +# обёртки и без выделенного serviceAccount, а креды S3 монтируются +# напрямую секретом attachments-s3-secret (не генерируются скриптом). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: attachments namespace: attachments + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: attachments: + enabled: true + image: name: _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: attachments + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: attachments-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: _default: - name: attachments-s3-secret @@ -21,6 +98,7 @@ spec: secret: secretName: _default: attachments-s3-secret + envs: - name: POSTGRES_POOL_SIZE value: @@ -43,6 +121,7 @@ spec: - name: YANDEX_S3_USE_SSL value: _default: "true" + secretEnvs: - name: DATABASE_HOST secretName: @@ -64,3 +143,8 @@ spec: secretName: _default: attachments-postgresql-secret secretKey: password + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/attachments/ugok/kustomization.yaml b/apps/attachments/ugok/kustomization.yaml index 6fae072..7b79834 100644 --- a/apps/attachments/ugok/kustomization.yaml +++ b/apps/attachments/ugok/kustomization.yaml @@ -1,11 +1,7 @@ --- +# Не наследуем base (vault-native) — см. комментарий в backend.yaml. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: attachments resources: - - ../base -patches: - - path: patch.yaml - target: - kind: HelmRelease - name: attachments + - backend.yaml diff --git a/apps/bim/ugok/patch.yaml b/apps/bim/ugok/backend.yaml similarity index 58% rename from apps/bim/ugok/patch.yaml rename to apps/bim/ugok/backend.yaml index 5f8d060..d9b724b 100644 --- a/apps/bim/ugok/patch.yaml +++ b/apps/bim/ugok/backend.yaml @@ -1,16 +1,125 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +# Образ оставлен как был в ugok (donstroi1 в wb — похоже на билд другого +# клиента, не переносим — см. предыдущее решение). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: bim + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 60 + failureThreshold: + _default: 10 + readiness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 5 + periodSeconds: + _default: 5 + failureThreshold: + _default: 20 + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: LAST_MASTER_BIM value: @@ -84,6 +193,7 @@ spec: - name: ENABLE_SSL value: _default: "0" + secretEnvs: - name: POSTGRES_USER secretName: @@ -117,3 +227,8 @@ spec: secretName: _default: bim-postgresql-secret secretKey: password + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/bim/ugok/kustomization.yaml b/apps/bim/ugok/kustomization.yaml index f7ec7c3..ebc5960 100644 --- a/apps/bim/ugok/kustomization.yaml +++ b/apps/bim/ugok/kustomization.yaml @@ -1,11 +1,7 @@ --- +# Не наследуем base (vault-native) — см. комментарий в backend.yaml. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: bim resources: - - ../base -patches: - - path: patch.yaml - target: - kind: HelmRelease - name: backend + - backend.yaml diff --git a/apps/checklists/ugok/patch.yaml b/apps/checklists/ugok/backend.yaml similarity index 51% rename from apps/checklists/ugok/patch.yaml rename to apps/checklists/ugok/backend.yaml index c0cc44e..474828e 100644 --- a/apps/checklists/ugok/patch.yaml +++ b/apps/checklists/ugok/backend.yaml @@ -1,20 +1,94 @@ --- +# standalone HelmRelease по образцу apps/checklists/wb/backend.yaml — base +# vault-native, в ugok Vault не используется. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: checklists namespace: checklists + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: checklists: + enabled: true + image: name: - _default: 10.4.10.187:80/library/checklists-backend:production_3d148228 + _default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_3d148228 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: checklists-backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: HTTP_APP_HOST value: - _default: 0.0.0.0 + _default: "0.0.0.0" - name: HTTP_APP_PORT value: _default: "8000" @@ -33,6 +107,7 @@ spec: - name: DEBUG value: _default: "false" + secretEnvs: - name: DATABASE_HOST secretName: @@ -58,3 +133,8 @@ spec: secretName: _default: checklists-public-key secretKey: key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/checklists/ugok/kustomization.yaml b/apps/checklists/ugok/kustomization.yaml index 30177f7..3690fc7 100644 --- a/apps/checklists/ugok/kustomization.yaml +++ b/apps/checklists/ugok/kustomization.yaml @@ -1,11 +1,7 @@ --- +# Не наследуем base (vault-native) — см. комментарий в backend.yaml. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: checklists resources: - - ../base -patches: - - path: patch.yaml - target: - kind: HelmRelease - name: checklists + - backend.yaml diff --git a/apps/comparisons/ugok/patch-backend.yaml b/apps/comparisons/ugok/backend.yaml similarity index 59% rename from apps/comparisons/ugok/patch-backend.yaml rename to apps/comparisons/ugok/backend.yaml index 20df1b4..756d882 100644 --- a/apps/comparisons/ugok/patch-backend.yaml +++ b/apps/comparisons/ugok/backend.yaml @@ -1,16 +1,127 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +# volumes (tasks-execution-config) убраны: в живом дампе кластера у backend +# нет volumeMounts вообще, ни такого ConfigMap'а в namespace. +# Образ оставлен как в ugok (в wb — другое имя репозитория образа целиком, +# не просто тег, см. предыдущее решение по этому приложению). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: comparisons + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-backend:c864f102a3a476b9a80658148da2b3f7acb772ac + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 60 + failureThreshold: + _default: 10 + readiness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 5 + periodSeconds: + _default: 5 + failureThreshold: + _default: 20 + + service: + enabled: true + + name: + _default: backend-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: HTTP_PORT value: @@ -102,6 +213,7 @@ spec: - name: WORKFLOWS_CONFIG_FILEPATH value: _default: /etc/app/tasks-execution-config.json + secretEnvs: - name: DATABASE_USER secretName: @@ -115,3 +227,8 @@ spec: secretName: _default: public-key secretKey: key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/comparisons/ugok/frontend.yaml b/apps/comparisons/ugok/frontend.yaml new file mode 100644 index 0000000..9f87dc6 --- /dev/null +++ b/apps/comparisons/ugok/frontend.yaml @@ -0,0 +1,93 @@ +--- +# volumes (nginx-configmap) убраны: в живом дампе кластера у frontend нет +# volumeMounts и такого ConfigMap'а в namespace. +# Образ оставлен как в ugok (в wb — другое имя репозитория образа целиком). +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: comparisons + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend-static:69d50235fdc8fd654ae63308e23fc27f28e9cd99_relative + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/comparisons/ugok/kustomization.yaml b/apps/comparisons/ugok/kustomization.yaml index e24c110..f576b8d 100644 --- a/apps/comparisons/ugok/kustomization.yaml +++ b/apps/comparisons/ugok/kustomization.yaml @@ -1,15 +1,8 @@ --- +# Не наследуем base (backend vault-native) — см. комментарии в файлах. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: comparisons resources: - - ../base -patches: - - path: patch-backend.yaml - target: - kind: HelmRelease - name: backend - - path: patch-frontend.yaml - target: - kind: HelmRelease - name: frontend + - backend.yaml + - frontend.yaml diff --git a/apps/comparisons/ugok/patch-frontend.yaml b/apps/comparisons/ugok/patch-frontend.yaml deleted file mode 100644 index 33af743..0000000 --- a/apps/comparisons/ugok/patch-frontend.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: frontend - namespace: comparisons -spec: - values: - services: - frontend: - image: - name: - _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend-static:69d50235fdc8fd654ae63308e23fc27f28e9cd99_relative diff --git a/apps/contracts/ugok/backend.yaml b/apps/contracts/ugok/backend.yaml new file mode 100644 index 0000000..fc9027d --- /dev/null +++ b/apps/contracts/ugok/backend.yaml @@ -0,0 +1,100 @@ +--- +# standalone HelmRelease по образцу apps/contracts/wb/backend.yaml — base +# vault-native, в ugok Vault не используется. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: contracts + namespace: contracts + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + contracts: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + secretEnvs: + - name: DB_URL + secretName: + _default: contracts-postgresql-secret + secretKey: url + - name: PUBLIC_KEY + secretName: + _default: contracts-public-key + secretKey: key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/contracts/ugok/kustomization.yaml b/apps/contracts/ugok/kustomization.yaml index eeeb8d7..62dc152 100644 --- a/apps/contracts/ugok/kustomization.yaml +++ b/apps/contracts/ugok/kustomization.yaml @@ -1,11 +1,7 @@ --- +# Не наследуем base (vault-native) — см. комментарий в backend.yaml. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: contracts resources: - - ../base -patches: - - path: patch.yaml - target: - kind: HelmRelease - name: contracts + - backend.yaml diff --git a/apps/contracts/ugok/patch.yaml b/apps/contracts/ugok/patch.yaml deleted file mode 100644 index e39e4cb..0000000 --- a/apps/contracts/ugok/patch.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: contracts - namespace: contracts -spec: - values: - services: - contracts: - image: - name: - _default: 10.4.10.187:80/library/contracts:prod_d3bbd9fc - secretEnvs: - - name: DB_URL - secretName: - _default: contracts-postgresql-secret - secretKey: url - - name: PUBLIC_KEY - secretName: - _default: contracts-public-key - secretKey: key diff --git a/apps/django/ugok/patch-backend.yaml b/apps/django/ugok/backend.yaml similarity index 76% rename from apps/django/ugok/patch-backend.yaml rename to apps/django/ugok/backend.yaml index b65bdd3..9b5a9e1 100644 --- a/apps/django/ugok/patch-backend.yaml +++ b/apps/django/ugok/backend.yaml @@ -1,18 +1,129 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +# command/args из base — только vault-обёртка (в живом дампе кластера у +# backend command/args нет вообще), не переносим. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: django + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: 10.4.10.187:80/library/backend:production_7d0ec48b + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: _default: + - name: django-configmap + mountPath: + _default: /opt/sarex/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + + - name: uwsgi-configmap + mountPath: + _default: /opt/sarex/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: uwsgi-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + - name: kafka-cert-volume mountPath: _default: /usr/local/share/ca-certificates @@ -21,6 +132,7 @@ spec: configMap: name: _default: kafka-cert + envs: - name: ALLOWED_HOSTS value: @@ -166,6 +278,7 @@ spec: - name: KC_USE_REDIRECT_LOGOUT value: _default: "False" + secretEnvs: - name: ZITADEL_ACCESS_TOKEN secretName: @@ -255,3 +368,8 @@ spec: secretName: _default: sarex-s3-secret secretKey: secret_key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/ugok/patch-celery.yaml b/apps/django/ugok/celery.yaml similarity index 74% rename from apps/django/ugok/patch-celery.yaml rename to apps/django/ugok/celery.yaml index c3d9212..f108e41 100644 --- a/apps/django/ugok/patch-celery.yaml +++ b/apps/django/ugok/celery.yaml @@ -1,21 +1,117 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +# command — реальная команда запуска celery из дампа кластера (не +# vault-обёртка). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: celery namespace: django + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: celery: + enabled: true + image: name: _default: 10.4.10.187:80/library/backend:production_7d0ec48b + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "default", "-n", "default_worker.%h", "--concurrency=2"] + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + volumes: _default: + - name: django-configmap + mountPath: + _default: /opt/sarex/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + + - name: uwsgi-configmap + mountPath: + _default: /opt/sarex/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: uwsgi-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + - name: kafka-cert-volume mountPath: _default: /usr/local/share/ca-certificates @@ -24,6 +120,7 @@ spec: configMap: name: _default: kafka-cert + envs: - name: ALLOWED_HOSTS value: @@ -78,16 +175,19 @@ spec: _default: "1" - name: SERVER_API_HOST value: - _default: https://sarex.ugok.la + _default: https://ugok-sarex.uralmine.com - name: SERVER_HOST value: - _default: https://sarex.ugok.la + _default: https://ugok-sarex.uralmine.com - name: WORKFLOWS_HOST value: - _default: https://sarex.ugok.la + _default: http://workflows-api-service.workflow.svc.cluster.local:8000 - name: WORKFLOWS_BASE_HOST value: - _default: https://sarex.ugok.la + _default: http://backend.django.svc.cluster.local:8000 + - name: WORKFLOWS_PREFIX + value: + _default: /internal/v1 - name: WORKFLOWS_USE value: _default: "1" @@ -139,6 +239,9 @@ spec: - name: SERVER_KAFKA_ENABLED value: _default: "True" + - name: RESOURCES_INTERNAL_HOST + value: + _default: http://resources-service.resources.svc.cluster.local:8000 - name: KAFKA_TOPICS value: _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' @@ -166,6 +269,7 @@ spec: - name: KC_USE_REDIRECT_LOGOUT value: _default: "False" + secretEnvs: - name: ZITADEL_ACCESS_TOKEN secretName: @@ -255,3 +359,8 @@ spec: secretName: _default: sarex-s3-secret secretKey: secret_key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/ugok/django-configmap.yaml b/apps/django/ugok/django-configmap.yaml new file mode 100644 index 0000000..0606838 --- /dev/null +++ b/apps/django/ugok/django-configmap.yaml @@ -0,0 +1,10 @@ +--- +# Скопировано из живого ConfigMap кластера ugok (namespace django) — +# монтируется backend/celery в /opt/sarex/config/settings/production.py. +apiVersion: v1 +kind: ConfigMap +metadata: + name: django-configmap + namespace: django +data: + production.py: "\nimport os\nfrom .base import *\nfrom logging.handlers import SysLogHandler\nfrom datetime import timedelta\n\nALLOWED_HOSTS = [\"*\"]\nFILE_UPLOAD_PERMISSIONS = 0o644\nDEBUG = False\nCSRF_COOKIE_SECURE = False\nCSRF_TRUSTED_ORIGINS = [\"https://sarex.ugok.lan\",\"http://sarex.ugok.la\", \"*\"]\nSESSION_COOKIE_SECURE = False\nSECURE_SSL_REDIRECT = False\n\nSECRET_KEY = 't2=9+($2f%7ptsdy4!rby$)mcfl1l%o2e@vs^d(g&(wwi&%k1v'\n\nCORS_ORIGIN_ALLOW_ALL = True\nSERVERSETTINGS.cache_enabled = True\nINSTALLED_APPS = list(INSTALLED_APPS) + ['corsheaders']\n\nCORS_ALLOW_METHODS = (\n 'DELETE',\n 'GET',\n 'OPTIONS',\n 'PATCH',\n 'POST',\n 'PUT',\n)\nBASIC_USER_ID = 2\n\nCORS_ALLOW_HEADERS = (\n 'accept',\n 'accept-encoding',\n 'authorization',\n 'content-type',\n 'user-agent',\n 'x-csrftoken',\n 'x-requested-with',\n 'x-token',\n 'Bearer',\n)\n\nHOST = \"https://sarex.ugok.lan\"\n\nPOSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')\nPOSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')\nPOSTGRES_PASSWORD = os.environ.get('DJANGO_POSTGRES_PASSWORD')\nPOSTGRES_HOST = os.environ.get('DJANGO_POSTGRES_HOST')\nPOSTGRES_PORTS = os.environ.get('DJANGO_POSTGRES_PORTS', \"5432\")\n\nDATABASES = {\n 'default': {\n 'ENGINE': 'django_prometheus.db.backends.postgresql',\n 'NAME': POSTGRES_DATABASE,\n 'USER': POSTGRES_USER,\n 'PASSWORD': POSTGRES_PASSWORD,\n 'HOST': POSTGRES_HOST,\n 'PORT': POSTGRES_PORTS,\n }\n}\n\nLOGGING = {\n 'version': 1,\n 'disable_existing_loggers': False,\n 'filters': {\n 'require_debug_false': {\n '()': 'django.utils.log.RequireDebugFalse',\n }\n },\n 'formatters': {\n 'verbose': {\n 'format': '[contactor] %(levelname)s %(asctime)s %(message)s',\n },\n },\n 'handlers': {\n 'console': {\n 'level': 'DEBUG',\n 'class': 'logging.StreamHandler',\n },\n 'sentry': {\n 'level': 'ERROR',\n 'filters': ['require_debug_false'],\n 'class': 'logging.StreamHandler',\n },\n },\n 'loggers': {\n '': {\n 'handlers': ['console', 'sentry'],\n 'level': 'INFO',\n 'propagate': False,\n },\n }\n}\n\nCOMPARATOR_JWT = os.environ.get(\"COMPARATOR_JWT\", \"default_jwt\")\nCOMPARATOR_URL = os.environ.get(\"COMPARATOR_URL\", \"https://wb.sarex.io/comparator\")\nCOMPARATOR_SECTION = os.environ.get(\"COMPARATOR_SECTION\", \"sarex-production-storage\")\n\nSIMPLE_JWT = {\n 'ACCESS_TOKEN_LIFETIME': timedelta(hours=1),\n 'REFRESH_TOKEN_LIFETIME': timedelta(days=1),\n 'ROTATE_REFRESH_TOKENS': False,\n 'BLACKLIST_AFTER_ROTATION': True,\n 'UPDATE_LAST_LOGIN': False,\n 'ALGORITHM': 'RS512',\n 'SIGNING_KEY': os.environ.get(\"JWT_PRIVATE_KEY\").replace(\"\\\\n\", \"\\n\"),\n 'VERIFYING_KEY': os.environ.get(\"JWT_PUBLIC_KEY\").replace(\"\\\\n\", \"\\n\"),\n 'AUDIENCE': None,\n 'ISSUER': os.environ.get('SIMPLE_JWT_ISSUER', 'default_issuer'),\n 'AUTH_HEADER_TYPES': ('Bearer',),\n 'AUTH_HEADER_NAME': 'HTTP_AUTHORIZATION',\n 'USER_ID_FIELD': 'id',\n 'USER_ID_CLAIM': 'user_id',\n 'AUTH_TOKEN_CLASSES': ('rest_framework_simplejwt.tokens.AccessToken',),\n 'TOKEN_TYPE_CLAIM': 'token_type',\n 'JTI_CLAIM': 'jti',\n 'SLIDING_TOKEN_REFRESH_EXP_CLAIM': 'refresh_exp',\n 'SLIDING_TOKEN_LIFETIME': timedelta(minutes=5),\n 'SLIDING_TOKEN_REFRESH_LIFETIME': timedelta(days=1),\n}\n\nos.environ[\"DJANGO_ALLOW_ASYNC_UNSAFE\"] = \"true\"\nDEFAULT_FILE_STORAGE = 'sarex.core.storages.CustomS3Boto3Storage'\nDATA_UPLOAD_MAX_MEMORY_SIZE = 268435456\n\nif not os.environ.get('ISOLATED', False):\n import sentry_sdk\n from sentry_sdk.integrations.django import DjangoIntegration\n\n sentry_sdk.init(\n dsn=\"https://3df2f4b8d3d14595a06c92e9d7c562cb@sentry.io/1501541\",\n integrations=[DjangoIntegration()],\n environment=os.environ.get('SENTRY_ENVIRONMENT', 'production'),\n send_default_pii=True,\n )\n\nCOMPARISON_API_URL = f\"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/comparisons\"\nDOCUMENTATION_API_URL = f\"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/documentations\"\nPDM_FILES_API_URL = f\"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/files\"\n\nWORKFLOWS_TASKS = {\n \"update_orthomosaic_data\": {\n \"image\": f\"{os.environ.get('WORKFLOWSSETTINGS_REGISTRY')}/update-orthomosaic-data:dev\",\n \"service_requests\": [\"django-auth\"],\n \"backoff_limit\": 3,\n },\n}\n\nREST_FRAMEWORK = { 'DEFAULT_PAGINATION_CLASS': (\n 'rest_framework.pagination.LimitOffsetPagination' ),\n 'DEFAULT_SCHEMA_CLASS': 'rest_framework.schemas.coreapi.AutoSchema',\n 'PAGE_SIZE': 1000, 'DEFAULT_FILTER_BACKENDS': [\n 'django_filters.rest_framework.DjangoFilterBackend' ],\n 'DEFAULT_AUTHENTICATION_CLASSES': [\n 'sarex.authentication.backends.ZitadelJWTAuthentication',\n 'rest_framework.authentication.RemoteUserAuthentication',\n 'rest_framework_simplejwt.authentication.JWTAuthentication',\n 'rest_framework.authentication.BasicAuthentication',\n 'rest_framework.authentication.SessionAuthentication',\n 'sarex.authentication.backends.JWTAuthentication' ],\n 'DEFAULT_PERMISSION_CLASSES': [\n 'rest_framework.permissions.IsAuthenticated', ] }\n\nAUTHENTICATION_BACKENDS = [\n 'sarex.authentication.backends.CustomRemoteUserBackend',\n 'django.contrib.auth.backends.ModelBackend',\n 'guardian.backends.ObjectPermissionBackend',\n]\n\nMIDDLEWARE = [\n 'django_prometheus.middleware.PrometheusBeforeMiddleware',\n 'django.middleware.security.SecurityMiddleware',\n 'django.contrib.sessions.middleware.SessionMiddleware',\n 'django.middleware.common.CommonMiddleware',\n #'django.middleware.csrf.CsrfViewMiddleware',\n #'django_keycloak.middlewares.AuthorizationHeaderMiddleware',\n #'django_keycloak.middlewares.KeycloakSessionMiddleware',\n 'django.contrib.auth.middleware.AuthenticationMiddleware',\n #'django.contrib.auth.middleware.RemoteUserMiddleware',\n 'django.contrib.messages.middleware.MessageMiddleware',\n 'django.middleware.clickjacking.XFrameOptionsMiddleware',\n 'django_user_agents.middleware.UserAgentMiddleware',\n 'simple_history.middleware.HistoryRequestMiddleware',\n 'django_prometheus.middleware.PrometheusAfterMiddleware', ]\n\n\nclass KeyCloakSettings(BaseSettings):\n client_id: str = \"client_id\"\n client_secret: str = \"client_secret\"\n discovery_url: str = \"https://login.wb.sarex.io/realms/sarex/.well-known/openid-configuration\"\n staff: Optional[str] = \"Sarex staff\"\n superuser: Optional[str] = \"Sarex superusers\"\n sync_with_django: bool = True\n sync_admin: bool = False\n group_prefix: str = 'Sarex-Role'\n company_prefix: str = 'Sarex-Company'\n department_prefix: str = 'Sarex-Department'\n position_prefix: str = 'Sarex-Position'\n separator: str = '__'\n sync_user_groups: bool = False\n sync_user_positions: bool = False\n sync_user_departments: bool = False\n sync_user_companies: bool = False\n use_redirect_logout: bool = False\n logout_redirect_uri: str = \"/\"\n default_group_name: Optional[str] = 'Тест'\n default_company_name: Optional[str] = 'Брусника'\n trusted_uri: List[str] = ['/api/core/orthophotos/', '/api/token', '/api/token/me']\n trusted_uri: List[str] = []\n\n class Config:\n env_prefix = \"KC_\"\n\n\nKEYCLOAKSETTINGS = KeyCloakSettings()\n\nREMOTE_USER_DEFAULT_COMPANY_ID = 1\nSAREX_MODULES = [\n {\n \"name\": \"Замечания\",\n \"uri\": \"/remarks\"\n },\n {\n \"name\": \"Управление проектами\",\n \"uri\": \"/management/projects\",\n },\n {\n \"name\": \"Замечания V2\",\n \"uri\": \"/issues\"\n },\n {\n \"name\": \"Документация\",\n \"uri\": \"/documentations\",\n },\n {\n \"name\": \"Согласование документов\",\n \"uri\": \"/reviews\"\n },\n {\n \"name\": \"Рабочие процессы\",\n \"uri\": \"/processes\"\n },\n {\n \"name\": \"Запросы\",\n \"uri\": \"/rfi\"\n },\n {\n \"name\": \"Обзор\",\n \"uri\": \"/projects\"\n },\n {\n \"name\": \"Передача документации\", \n \"uri\": \"/transmittal\"\n },\n]\nAUTH_SETTINGS = {\n \"refresh_token\": False,\n \"refresh_token_uri\": \"/api/token/me\",\n \"refresh_oauth_token\": True,\n \"refresh_oauth_token_uri\": \"/oauth/token\",\n \"refresh_time\": 240,\n}\n\n\nDEBUG=False\nWEB_APP_AUTH_MODE='jwt-session-based'\n\n\nSAREX_MODULES_SETTINGS = {\n \"aero\": {\n \"enable_new_media\": True\n },\n \"sso_logout_redirect\": True\n}\n" diff --git a/apps/django/ugok/frontend.yaml b/apps/django/ugok/frontend.yaml new file mode 100644 index 0000000..4d7e5b4 --- /dev/null +++ b/apps/django/ugok/frontend.yaml @@ -0,0 +1,122 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: django + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: 10.4.10.187:80/library/sarex-frontend-dev:contour_5.22.3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: nginx-configmap + mountPath: + _default: /etc/nginx/nginx.conf + subPath: + _default: nginx.conf + readOnly: + _default: true + configMap: + name: + _default: nginx-configmap + items: + - key: nginx.conf + path: + _default: nginx.conf + + - name: zitadel-configmap + mountPath: + _default: /opt/react_client/static/config.json + subPath: + _default: config.json + readOnly: + _default: true + configMap: + name: + _default: zitadel-configmap + items: + - key: config.json + path: + _default: config.json diff --git a/apps/django/ugok/kafka-cert.yaml b/apps/django/ugok/kafka-cert.yaml new file mode 100644 index 0000000..17257aa --- /dev/null +++ b/apps/django/ugok/kafka-cert.yaml @@ -0,0 +1,39 @@ +--- +# Скопировано из живого ConfigMap кластера ugok (namespace django). +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-cert + namespace: django +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIFLTCCAxWgAwIBAgIUD6mKIbYkBT6T/cgK3Ibgm75vRrAwDQYJKoZIhvcNAQEN + BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2 + MDAeFw0yNjA0MTQwODQ1MTRaFw0yNzA0MTQwODQ1MTRaMC0xEzARBgNVBAoMCmlv + LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB + AQUAA4ICDwAwggIKAoICAQCc9ecE59Ju5JRuGr1ConD8wPINXO9jgKdctuiwZloE + eHYZGfLpEZY1v6CulK3xlVdK4rJRH7MA0r5G3+o7ZkGW4htaAz1zk71npiibLxC/ + 2g7MQoMsfheglB8NpVpjGlbMScCJUIbWZr6UK1JUX9kAPgZBMR3E/R24nlYiygKP + 4T9EEMw0YgKFkXZl20+cH2pmaUK7219+WR/MdiQ+d+445L7DLJNYI/xn9Yoc8OQb + A63SVK5APWwGFvXAjNqrcJpvrud3Age9CRqJ+M4Y6PTu05Pf1C6GUhLfTfsdleU6 + PsORiG/9DVc9rjDOvEk7pwrBYaK4u39BA5XBnppxHuAsxPjbnVAwGBia/3N2vLa4 + Fht4PBIDMH0KUKDRktT+rGFdg+gl1HJ/vT2Z+HqAOdW3DUCt4aY8B10/jPWHWByq + gvRNUSJSBGeLI2Yk3pbQKerS+UOMjcmGXw8gZHSvqwEs6EAX/msSmcTS2wDbu83E + tAXrHyriNpHilIaxlizbb7h3jXVhZX7G2o0BtPqFOsV9eo0bzUcRaf8XWqXHFoGw + 6rks0Q06HOTrARDhAG0qot8pQ6WIM8zYjPT5Jb+Wx2UbPbdLtqY+W/t9udL8Q+tW + eL3+4oTllSeuHtCJy/UX1/GyN+O/PAXxDeEP1AmamweftXALlMhHzV/FHJjvd2L4 + rQIDAQABo0UwQzAdBgNVHQ4EFgQUlPHFj51uMcGYeqJ9bf7BRqOiWdowEgYDVR0T + AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB + ABsb407P4GzhY1in3wwA9wB2evF4WhtuBQw4Cm1/jDFv6Yhe+qTFOM8+g8RiFJl4 + KfGLzzQWiBbZfyKdqYTSDjio2WJhdXjP+V9YVmnNBXAwdTJOUbKjKgZlo1CniC3O + O/xzEmohC6Vkl9Ph4aGzqMivpYfiVjRzs1TeJNzPO131HOwzLUtrXEUJ5I9AWEzE + C0QCdr38ZoXSOq+eNm7q4ANi10ElHoiUdIkgjobCu2y6m+oiaeWLhs+i/LjE93vb + hlIzsIcJRIc5hC7QIORiR4pDuoxn/WP+41wdfUfVF7FugAaPhyF5TOJgTx0baCj9 + 3gtCfcfsy6Md2U4GLXj0UIs5M//7s0pdjCrvyDOCbrZUQs8JUZ4viqIUqVGRSFjg + 5ofP1KgOIbG225T+XaXVapJETu29ggOv/ZhGm9JHZjAKi6yCUvXS2H7VWVk1Ob+e + GAXCtCWPF8C4uM4rkNwXCYzlX4kEeGyq0PifxOlz/KDSY+5C00fK9Ke+4C3aV53v + 1NDoOaOYbObWHls3jrZ4EN08vYh9RIHmLpXCTdwwPqhHj/oJSFwN9ZHh0gW5NcYW + etX8+dQHoVkJP7KDMgAJ3l3Bgh2qOh6bM4gmvAc4Kp7YdlslBxzGscnKbkfoQYl+ + NK4a+hSjXnk7ttSxachKb38LSZRNBA/LGUUB3t07anjZ + -----END CERTIFICATE----- diff --git a/apps/django/ugok/kustomization.yaml b/apps/django/ugok/kustomization.yaml index 4e6345f..cdb5ac2 100644 --- a/apps/django/ugok/kustomization.yaml +++ b/apps/django/ugok/kustomization.yaml @@ -1,41 +1,21 @@ --- +# Не наследуем base (backend/celery/s3-proxy vault-native) — см. комментарии +# в файлах. auth-flow-frontend.yaml/export-project.yaml/pdf-markings.yaml +# скопированы из wb (в base для них нет HelmRelease). apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: django resources: - - ../base + - django-configmap.yaml + - uwsgi-configmap.yaml + - kafka-cert.yaml + - nginx-configmap.yaml + - zitadel-configmap.yaml + - backend.yaml + - celery.yaml + - frontend.yaml + - s3-proxy.yaml + - srx-admin.yaml - auth-flow-frontend.yaml - export-project.yaml -patches: - - path: patch-backend.yaml - target: - kind: HelmRelease - name: backend - - path: patch-celery.yaml - target: - kind: HelmRelease - name: celery - - path: patch-frontend.yaml - target: - kind: HelmRelease - name: frontend - - path: patch-s3-proxy.yaml - target: - kind: HelmRelease - name: s3-proxy - - path: patch-redis-image.yaml - target: - kind: Deployment - name: redis - - path: patch-auth-flow-frontend.yaml - target: - kind: HelmRelease - name: auth-flow-frontend - - path: patch-export-project.yaml - target: - kind: HelmRelease - name: export-project - - path: patch-srx-admin.yaml - target: - kind: HelmRelease - name: srx-admin-frontend + - redis.yaml diff --git a/apps/django/ugok/nginx-configmap.yaml b/apps/django/ugok/nginx-configmap.yaml new file mode 100644 index 0000000..16056fe --- /dev/null +++ b/apps/django/ugok/nginx-configmap.yaml @@ -0,0 +1,10 @@ +--- +# Скопировано из живого ConfigMap кластера ugok (namespace django) — +# монтируется frontend в /etc/nginx/nginx.conf. +apiVersion: v1 +kind: ConfigMap +metadata: + name: nginx-configmap + namespace: django +data: + nginx.conf: "worker_processes auto;\n\npid /var/run/nginx.pid;\n\nevents {\n use epoll;\n worker_connections 1024;\n}\n\nhttp {\n\n # Basic Settings\n large_client_header_buffers 8 128k;\n sendfile on;\n tcp_nopush on;\n tcp_nodelay on;\n keepalive_timeout 300;\n types_hash_max_size 2048;\n client_max_body_size 5000M;\n client_header_buffer_size 5M;\n # server_tokens off;\n # server_names_hash_bucket_size 64;\n # server_name_in_redirect off;\n include /etc/nginx/mime.types;\n default_type application/octet-stream;\n\n # Logging Settings\n access_log /var/log/nginx/access.log;\n error_log /var/log/nginx/error.log;\n\n # GZIP Settings\n gzip on;\n gzip_vary on;\n gzip_proxied any;\n gzip_comp_level 6;\n gzip_buffers 16 8k;\n gzip_http_version 1.1;\n gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;\n\n log_format main '$remote_addr - $remote_user [$time_local] \"$request\" '\n '$status $body_bytes_sent \"$http_referer\" '\n '\"$http_user_agent\" \"$http_x_forwarded_for\"';\n\n server {\n listen 80;\n listen [::]:80;\n root /opt/react_client/;\n\n add_header 'Access-Control-Allow-Origin' '*' always;\n add_header 'Access-Control-Allow-Methods' '*' always;\n add_header 'Access-Control-Allow-Headers' '*' always;\n\n location = /static/index.bundle.js {\n add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';\n if_modified_since off;\n expires off;\n }\n location ~^/api/pm/ {\n proxy_set_header Host $host;\n proxy_pass http://backend-service.pm.svc.cluster.local:8000;\n }\n\n location ~^/media/ {\n rewrite ^/media/(.*)$ /$1 break;\n proxy_set_header Host $host;\n proxy_pass http://s3-proxy-service:80;\n }\n\n location ~^/api/v1/documents/ {\n rewrite /api/(.+) /$1 break;\n proxy_set_header Host $host;\n proxy_pass http://documentations-filestream.documentations.svc.cluster.local:8080;\n }\n\n location ~^/(api|admin)/ {\n proxy_set_header Host $host;\n proxy_pass http://backend:8000;\n }\n \n # location ~^/flows/static/ {\n # rewrite /flows/static/(.+) /$1 break;\n # proxy_pass http://frontend-service.flows:80;\n # }\n \n # location = ~^/orchestrator/ {\n # rewrite ^/orchestrator$ /api/ break;\n # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;\n # }\n\n # location = ~^/orchestrator/api/process {\n # rewrite ^/orchestrator/api/process$ /api/process break;\n # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;\n # }\n \n # location ~ ^/orchestrator/api/process/(.*)$ {\n # rewrite ^/orchestrator/api/process/(.*)$ /api/process/$1 break;\n # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;\n # }\n \n # location = ~^/orchestrator/api/sign {\n # rewrite ^/orchestrator/api/sign$ /api/sign break;\n # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;\n # }\n \n \n location ~^/workspaces-v2/(.+).js {\n proxy_http_version 1.1;\n proxy_set_header Host $host;\n proxy_set_header Connection \"\";\n rewrite /workspaces-v2/(.+) /$1 break;\n proxy_pass http://frontend-svc.workspaces.svc.cluster.local:8080;\n }\n\n location @index {\n add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';\n if_modified_since off;\n expires off;\n try_files /static/index.html =404;\n }\n \n location ~^/workflows/(.+).js {\n rewrite /workflows/(.+) /$1 break;\n proxy_pass http://frontend-service.workflow.svc.cluster.local:8080;\n }\n location /service-worker.js {\n try_files /static/$uri @index;\n }\n\n location / {\n try_files $uri @index;\n }\n }\n}\n" diff --git a/apps/django/ugok/patch-auth-flow-frontend.yaml b/apps/django/ugok/patch-auth-flow-frontend.yaml deleted file mode 100644 index 2e3105f..0000000 --- a/apps/django/ugok/patch-auth-flow-frontend.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: auth-flow-frontend - namespace: django -spec: - values: - services: - auth-flow-frontend: - image: - name: - _default: 10.4.10.187:80/library/auth-flow-frontend:contour_fe9ea2a3 diff --git a/apps/django/ugok/patch-export-project.yaml b/apps/django/ugok/patch-export-project.yaml deleted file mode 100644 index e68be40..0000000 --- a/apps/django/ugok/patch-export-project.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: export-project - namespace: django -spec: - values: - services: - export-project: - image: - name: - _default: 10.4.10.187:80/library/export-project:prod_ef8aa756 diff --git a/apps/django/ugok/patch-frontend.yaml b/apps/django/ugok/patch-frontend.yaml deleted file mode 100644 index b211317..0000000 --- a/apps/django/ugok/patch-frontend.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: frontend - namespace: django -spec: - values: - services: - frontend: - image: - name: - _default: 10.4.10.187:80/library/sarex-frontend-dev:contour_5.22.3 diff --git a/apps/django/ugok/patch-redis-image.yaml b/apps/django/ugok/patch-redis-image.yaml deleted file mode 100644 index 8bce59d..0000000 --- a/apps/django/ugok/patch-redis-image.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- op: replace - path: /spec/template/spec/containers/0/image - value: 10.4.10.187:80/library/redis:latest diff --git a/apps/django/ugok/patch-s3-proxy.yaml b/apps/django/ugok/patch-s3-proxy.yaml deleted file mode 100644 index 8f42d0f..0000000 --- a/apps/django/ugok/patch-s3-proxy.yaml +++ /dev/null @@ -1,36 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: s3-proxy - namespace: django -spec: - values: - services: - s3-proxy: - image: - name: - _default: 10.4.10.187:80/library/s3-proxy:stable - envs: - - name: AWS_API_ENDPOINT - value: - _default: http://minio.minio.svc.cluster.local:9000 - - name: ACCESS_LOG - value: - _default: "true" - - name: CORS_ALLOW_HEADERS - value: - _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding" - secretEnvs: - - name: AWS_ACCESS_KEY_ID - secretName: - _default: sarex-s3-secret - secretKey: access_key - - name: AWS_SECRET_ACCESS_KEY - secretName: - _default: sarex-s3-secret - secretKey: secret_key - - name: AWS_S3_BUCKET - secretName: - _default: sarex-s3-secret - secretKey: bucket diff --git a/apps/django/ugok/patch-srx-admin.yaml b/apps/django/ugok/patch-srx-admin.yaml deleted file mode 100644 index 7ace86d..0000000 --- a/apps/django/ugok/patch-srx-admin.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: srx-admin-frontend - namespace: django -spec: - values: - services: - srx-admin: - image: - name: - _default: 10.4.10.187:80/library/srx-admin:prod_638c3442 diff --git a/apps/django/ugok/redis.yaml b/apps/django/ugok/redis.yaml new file mode 100644 index 0000000..f715c18 --- /dev/null +++ b/apps/django/ugok/redis.yaml @@ -0,0 +1,43 @@ +--- +# Скопировано из apps/django/base/redis-deployment.yaml + redis-service.yaml — +# сырой Deployment (не universal-chart, не vault-native), перенесён в +# standalone-оверлей, чтобы не зависеть от ../base. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: redis + namespace: django + labels: + app: redis +spec: + replicas: 1 + selector: + matchLabels: + app: redis + template: + metadata: + labels: + app: redis + spec: + containers: + - name: redis + image: 10.4.10.187:80/library/redis:latest + imagePullPolicy: Always + ports: + - containerPort: 6379 + protocol: TCP + imagePullSecrets: + - name: regcred +--- +apiVersion: v1 +kind: Service +metadata: + name: redis + namespace: django +spec: + selector: + app: redis + ports: + - port: 6379 + targetPort: 6379 + protocol: TCP diff --git a/apps/django/ugok/s3-proxy.yaml b/apps/django/ugok/s3-proxy.yaml new file mode 100644 index 0000000..1feabd2 --- /dev/null +++ b/apps/django/ugok/s3-proxy.yaml @@ -0,0 +1,109 @@ +--- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: s3-proxy + namespace: django + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + s3-proxy: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: s3-proxy + + replicaCount: + _default: 1 + + port: + _default: 80 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: s3-proxy-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: AWS_API_ENDPOINT + value: + _default: http://minio.minio.svc.cluster.local:9000 + - name: ACCESS_LOG + value: + _default: "true" + - name: CORS_ALLOW_HEADERS + value: + _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding" + + secretEnvs: + - name: AWS_ACCESS_KEY_ID + secretName: + _default: sarex-s3-secret + secretKey: access_key + - name: AWS_SECRET_ACCESS_KEY + secretName: + _default: sarex-s3-secret + secretKey: secret_key + - name: AWS_S3_BUCKET + secretName: + _default: sarex-s3-secret + secretKey: bucket diff --git a/apps/django/ugok/srx-admin.yaml b/apps/django/ugok/srx-admin.yaml new file mode 100644 index 0000000..a3e3842 --- /dev/null +++ b/apps/django/ugok/srx-admin.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: srx-admin-frontend + namespace: django + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + srx-admin: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_638c3442 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: srx-admin-frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: srx-admin-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/django/ugok/uwsgi-configmap.yaml b/apps/django/ugok/uwsgi-configmap.yaml new file mode 100644 index 0000000..507b3b4 --- /dev/null +++ b/apps/django/ugok/uwsgi-configmap.yaml @@ -0,0 +1,9 @@ +--- +# Скопировано из живого ConfigMap кластера ugok (namespace django). +apiVersion: v1 +kind: ConfigMap +metadata: + name: uwsgi-configmap + namespace: django +data: + uwsgi.ini: "[uwsgi]\r\nmodule = config.wsgi:application\r\nDJANGO_SETTINGS_MODULE = config.settings.production\r\nhttp = 0.0.0.0:8000\r\nprocesses = 16\r\nmaster = true\r\nvacuum = true\r\nenable-threads = true\r\nbuffer-size = 65535\r\nstats = :3031\r\nstats-http = true\r\nmemory-report = true\r\nlazy-apps = true\r\nlisten = 128\r\ndisable-write-exception= 0\r\nharakiri = 300\r\nsocket-timeout = 300\r\nchunked-input-timeout = 300\r\nhttp-timeout = 300\r\nworker-reload-mercy = 240\r\nmule-reload-mercy = 240\r\nstatic-map = /static=/opt/sarex/sarex/static/\r\nstatic-map = /media=/media/\r\n" diff --git a/apps/django/ugok/zitadel-configmap.yaml b/apps/django/ugok/zitadel-configmap.yaml new file mode 100644 index 0000000..57c72a3 --- /dev/null +++ b/apps/django/ugok/zitadel-configmap.yaml @@ -0,0 +1,17 @@ +--- +# Скопировано из живого ConfigMap кластера ugok (namespace django) — +# монтируется frontend в /opt/react_client/static/config.json. +apiVersion: v1 +kind: ConfigMap +metadata: + name: zitadel-configmap + namespace: django +data: + config.json: |- + { + "auth_type": "zitadel", + "zitadel": { + "client_id": "368538787334147872", + "host": "https://ugok-zitadel-sarex.uralmine.com" + } + } diff --git a/apps/documentations/ugok/patch-api.yaml b/apps/documentations/ugok/api.yaml similarity index 78% rename from apps/documentations/ugok/patch-api.yaml rename to apps/documentations/ugok/api.yaml index 49acbda..bed7c58 100644 --- a/apps/documentations/ugok/patch-api.yaml +++ b/apps/documentations/ugok/api.yaml @@ -1,16 +1,97 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +# Кастомный тег UGOK_4bf15a64 оставлен как есть (не как в wb — см. +# предыдущее решение по этому приложению). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: documentations-api namespace: documentations + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:UGOK_4bf15a64 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: documentations-api + + replicaCount: + _default: 1 + + port: + _default: 8080 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-api-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: POSTGRES_ADDRESS value: @@ -156,6 +237,7 @@ spec: - name: VALKEY_PORT value: _default: "6379" + secretEnvs: - name: PUBLIC_KEY secretName: @@ -181,3 +263,8 @@ spec: secretName: _default: django-auth secretKey: key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/ugok/patch-filestream.yaml b/apps/documentations/ugok/filestream.yaml similarity index 75% rename from apps/documentations/ugok/patch-filestream.yaml rename to apps/documentations/ugok/filestream.yaml index 65a9347..3e5c706 100644 --- a/apps/documentations/ugok/patch-filestream.yaml +++ b/apps/documentations/ugok/filestream.yaml @@ -1,16 +1,96 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +# Кастомный тег prod_dfaa58f7_ugok оставлен как есть (не как в wb). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: documentations-filestream namespace: documentations + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_dfaa58f7_ugok + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: documentations-filestream + + replicaCount: + _default: 1 + + port: + _default: 8080 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-filestream-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: POSTGRES_ADDRESS value: @@ -126,6 +206,7 @@ spec: - name: VALKEY_PORT value: _default: "6379" + secretEnvs: - name: DJANGO_BASIC_AUTH_FOR_GET_USER secretName: @@ -151,3 +232,8 @@ spec: secretName: _default: public-key secretKey: key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/ugok/frontend.yaml b/apps/documentations/ugok/frontend.yaml new file mode 100644 index 0000000..3de049c --- /dev/null +++ b/apps/documentations/ugok/frontend.yaml @@ -0,0 +1,91 @@ +--- +# Образ оставлен как в ugok (в wb тоже brusnika_-тег — см. предыдущее решение). +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: documentations + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_5a4e4adc + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/documentations/ugok/kustomization.yaml b/apps/documentations/ugok/kustomization.yaml index a654301..7c68d88 100644 --- a/apps/documentations/ugok/kustomization.yaml +++ b/apps/documentations/ugok/kustomization.yaml @@ -1,32 +1,15 @@ --- +# Не наследуем base (api/filestream/pdm/pdf-markings-amqp vault-native) — +# см. комментарии в файлах. pdf-markings.yaml — standalone файл, скопирован +# из apps/documentations/wb/pdf-markings.yaml (в base для этого сервиса нет +# HelmRelease). apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: documentations resources: - - ../base + - api.yaml + - filestream.yaml + - pdm.yaml + - pdf-markings-amqp.yaml - pdf-markings.yaml -patches: - - path: patch-api.yaml - target: - kind: HelmRelease - name: documentations-api - - path: patch-filestream.yaml - target: - kind: HelmRelease - name: documentations-filestream - - path: patch-frontend.yaml - target: - kind: HelmRelease - name: frontend - - path: patch-pdf-markings-amqp.yaml - target: - kind: HelmRelease - name: documentations-pdf-markings-amqp - - path: patch-pdf-markings.yaml - target: - kind: HelmRelease - name: pdf-markings - - path: patch-pdm.yaml - target: - kind: HelmRelease - name: pdm-api + - frontend.yaml diff --git a/apps/documentations/ugok/patch-frontend.yaml b/apps/documentations/ugok/patch-frontend.yaml deleted file mode 100644 index 1dc24ec..0000000 --- a/apps/documentations/ugok/patch-frontend.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: frontend - namespace: documentations -spec: - values: - services: - frontend: - image: - name: - _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_5a4e4adc diff --git a/apps/documentations/ugok/patch-pdf-markings.yaml b/apps/documentations/ugok/patch-pdf-markings.yaml deleted file mode 100644 index e2d70ce..0000000 --- a/apps/documentations/ugok/patch-pdf-markings.yaml +++ /dev/null @@ -1,113 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: pdf-markings - namespace: documentations -spec: - values: - services: - pdf-markings: - image: - name: - _default: 10.4.10.187:80/library/pdf-markings:prod_7d892636 - envs: - - name: APP_NAME - value: - _default: pdm_v2 - - name: VERIFY - value: - _default: "False" - - name: APP_VERSION - value: - _default: 0.0.1 - - name: LOG_LEVEL - value: - _default: INFO - - name: HTTP_PORT - value: - _default: "8000" - - name: DOC_POSTGRES_HOST - value: - _default: postgres-service - - name: DOC_POSTGRES_PORT - value: - _default: "5432" - - name: DOC_POSTGRES_DB - value: - _default: documentations_db - - name: DOC_POSTGRES_POOL_SIZE - value: - _default: "10" - - name: DOC_POSTGRES_SSL_MODE - value: - _default: disable - - name: API_ADDRESS - value: - _default: 0.0.0.0:8000 - - name: DATABASE_SSL_MODE - value: - _default: disable - - name: YANDEX_S3_USE_SSL - value: - _default: "0" - - name: ENVIRONMENT - value: - _default: production - - name: YANDEX_S3_ACCOUNT_PATH - value: - _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json - - name: REDIRECT_URL_QR - value: - _default: https://stamp-verification.sarex.ugok.lan/ - - name: BASE_DOCUMENT_URL - value: - _default: https://sarex.ugok.lan - - name: SENTRY_DSN - value: - _default: "" - secretEnvs: - - name: DOC_POSTGRES_USER - secretName: - _default: documentations-postgresql-secret - secretKey: username - - name: DOC_POSTGRES_PASSWORD - secretName: - _default: documentations-postgresql-secret - secretKey: password - - name: YANDEX_S3_ENDPOINT_URL - secretName: - _default: documentations-s3-secret - secretKey: endpoint - - name: YANDEX_S3_SECRET_ACCESS_KEY - secretName: - _default: documentations-s3-secret - secretKey: secret_key - - name: YANDEX_S3_ACCESS_KEY_ID - secretName: - _default: documentations-s3-secret - secretKey: access_key - - name: RABBITMQ_HOST - secretName: - _default: documentations-rabbitmq-secret - secretKey: host - - name: RABBITMQ_PORT - secretName: - _default: documentations-rabbitmq-secret - secretKey: port - - name: RABBITMQ_USERNAME - secretName: - _default: documentations-rabbitmq-secret - secretKey: username - - name: RABBITMQ_PASSWORD - secretName: - _default: documentations-rabbitmq-secret - secretKey: password - - name: RABBITMQ_VHOST - secretName: - _default: documentations-rabbitmq-secret - secretKey: vhost - - name: RABBITMQ_HEARTBEAT - secretName: - _default: documentations-rabbitmq-secret - secretKey: heartbeat diff --git a/apps/documentations/ugok/patch-pdf-markings-amqp.yaml b/apps/documentations/ugok/pdf-markings-amqp.yaml similarity index 64% rename from apps/documentations/ugok/patch-pdf-markings-amqp.yaml rename to apps/documentations/ugok/pdf-markings-amqp.yaml index 66104e1..f618bd8 100644 --- a/apps/documentations/ugok/patch-pdf-markings-amqp.yaml +++ b/apps/documentations/ugok/pdf-markings-amqp.yaml @@ -1,16 +1,104 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +# Образ/env НЕ трогаем (см. предыдущее решение — версия несовместима с wb). +# command/args сохранены: "start-amqp-worker" — реальный режим запуска +# этого образа, не vault-обёртка. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: documentations-pdf-markings-amqp namespace: documentations + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: 10.4.10.187:80/library/pdf-markings-amqp:prod_53ebb837 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: pdf-markings-amqp + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - start-amqp-worker + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: marks-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: APP_NAME value: @@ -63,6 +151,7 @@ spec: - name: BASE_DOCUMENT_URL value: _default: https://ugok-sarex.uralmine.com + secretEnvs: - name: DOC_POSTGRES_USER secretName: @@ -108,3 +197,8 @@ spec: secretName: _default: documentations-rabbitmq-secret secretKey: heartbeat + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/ugok/pdf-markings.yaml b/apps/documentations/ugok/pdf-markings.yaml index b3e5f72..9ed1d6a 100644 --- a/apps/documentations/ugok/pdf-markings.yaml +++ b/apps/documentations/ugok/pdf-markings.yaml @@ -1,8 +1,6 @@ --- -# Скопировано из apps/documentations/wb/pdf-markings.yaml — в base для этого -# сервиса нет HelmRelease (только documentations-pdf-markings-amqp), а из другого -# оверлея (wb) kustomize напрямую ссылаться не даёт (вне дерева каталога). -# Значения ниже перекрыты патчем patch-pdf-markings.yaml под дамп ugok. +# Скопировано из apps/documentations/wb/pdf-markings.yaml (в base для этого +# сервиса нет HelmRelease), env/secretEnvs — из дампа кластера ugok. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -40,7 +38,7 @@ spec: image: name: - _default: 10.4.10.187:80/library/pdf-markings:prod_7d892636 + _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings:prod_7d892636 pullPolicy: _default: IfNotPresent @@ -97,6 +95,108 @@ spec: secretName: _default: documentations-yc-s3 + envs: + - name: APP_NAME + value: + _default: pdm_v2 + - name: VERIFY + value: + _default: "False" + - name: APP_VERSION + value: + _default: 0.0.1 + - name: LOG_LEVEL + value: + _default: INFO + - name: HTTP_PORT + value: + _default: "8000" + - name: DOC_POSTGRES_HOST + value: + _default: postgres-service + - name: DOC_POSTGRES_PORT + value: + _default: "5432" + - name: DOC_POSTGRES_DB + value: + _default: documentations_db + - name: DOC_POSTGRES_POOL_SIZE + value: + _default: "10" + - name: DOC_POSTGRES_SSL_MODE + value: + _default: disable + - name: API_ADDRESS + value: + _default: 0.0.0.0:8000 + - name: DATABASE_SSL_MODE + value: + _default: disable + - name: YANDEX_S3_USE_SSL + value: + _default: "0" + - name: ENVIRONMENT + value: + _default: production + - name: YANDEX_S3_ACCOUNT_PATH + value: + _default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json + - name: REDIRECT_URL_QR + value: + _default: https://stamp-verification.sarex.ugok.lan/ + - name: BASE_DOCUMENT_URL + value: + _default: https://sarex.ugok.lan + - name: SENTRY_DSN + value: + _default: "" + + secretEnvs: + - name: DOC_POSTGRES_USER + secretName: + _default: documentations-postgresql-secret + secretKey: username + - name: DOC_POSTGRES_PASSWORD + secretName: + _default: documentations-postgresql-secret + secretKey: password + - name: YANDEX_S3_ENDPOINT_URL + secretName: + _default: documentations-s3-secret + secretKey: endpoint + - name: YANDEX_S3_SECRET_ACCESS_KEY + secretName: + _default: documentations-s3-secret + secretKey: secret_key + - name: YANDEX_S3_ACCESS_KEY_ID + secretName: + _default: documentations-s3-secret + secretKey: access_key + - name: RABBITMQ_HOST + secretName: + _default: documentations-rabbitmq-secret + secretKey: host + - name: RABBITMQ_PORT + secretName: + _default: documentations-rabbitmq-secret + secretKey: port + - name: RABBITMQ_USERNAME + secretName: + _default: documentations-rabbitmq-secret + secretKey: username + - name: RABBITMQ_PASSWORD + secretName: + _default: documentations-rabbitmq-secret + secretKey: password + - name: RABBITMQ_VHOST + secretName: + _default: documentations-rabbitmq-secret + secretKey: vhost + - name: RABBITMQ_HEARTBEAT + secretName: + _default: documentations-rabbitmq-secret + secretKey: heartbeat + commitSha: "" gitlabUri: "" gitlabJobUrl: "" diff --git a/apps/documentations/ugok/patch-pdm.yaml b/apps/documentations/ugok/pdm.yaml similarity index 81% rename from apps/documentations/ugok/patch-pdm.yaml rename to apps/documentations/ugok/pdm.yaml index 59050f1..e870878 100644 --- a/apps/documentations/ugok/patch-pdm.yaml +++ b/apps/documentations/ugok/pdm.yaml @@ -1,16 +1,95 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: pdm-api namespace: documentations + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: 10.4.10.187:80/library/pdmv2:prod_9507c2d5 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: pdm-api + + replicaCount: + _default: 1 + + port: + _default: 8080 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: pdm-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: USE_EXPERIMENTAL value: @@ -177,6 +256,7 @@ spec: - name: NOTES_URL value: _default: "" + secretEnvs: - name: RELEASES_TOKEN secretName: @@ -198,3 +278,8 @@ spec: secretName: _default: public-key secretKey: key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/drawings/ugok/backend.yaml b/apps/drawings/ugok/backend.yaml new file mode 100644 index 0000000..dbc4032 --- /dev/null +++ b/apps/drawings/ugok/backend.yaml @@ -0,0 +1,122 @@ +--- +# standalone HelmRelease по образцу apps/drawings/wb/backend.yaml — base +# vault-native, в ugok Vault не используется. +# targetPort сервиса исправлен на 8080 (реальный containerPort из дампа +# кластера) — в base он ошибочно указан как 8000, что не совпадает с +# портом контейнера и делает Service нерабочим. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: drawings + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/drawings-api:015e68e1b2a3dcc13f0b405e1f761b154a825d24 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "3" + - name: API_ADDRESS + value: + _default: 0.0.0.0:8000 + - name: ENABLE_SSL + value: + _default: "0" + + secretEnvs: + - name: POSTGRES_USER + secretName: + _default: drawings-postgresql-secret + secretKey: username + - name: POSTGRES_PASSWORD + secretName: + _default: drawings-postgresql-secret + secretKey: password + - name: POSTGRES_ADDRESS + secretName: + _default: drawings-postgresql-secret + secretKey: host + - name: POSTGRES_DB + secretName: + _default: drawings-postgresql-secret + secretKey: database + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/drawings/ugok/kustomization.yaml b/apps/drawings/ugok/kustomization.yaml index 584ce37..8f7a9ca 100644 --- a/apps/drawings/ugok/kustomization.yaml +++ b/apps/drawings/ugok/kustomization.yaml @@ -1,11 +1,7 @@ --- +# Не наследуем base (vault-native) — см. комментарий в backend.yaml. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: drawings resources: - - ../base -patches: - - path: patch.yaml - target: - kind: HelmRelease - name: backend + - backend.yaml diff --git a/apps/drawings/ugok/patch.yaml b/apps/drawings/ugok/patch.yaml deleted file mode 100644 index 0996157..0000000 --- a/apps/drawings/ugok/patch.yaml +++ /dev/null @@ -1,40 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: backend - namespace: drawings -spec: - values: - services: - backend: - image: - name: - _default: 10.4.10.187:80/library/drawings-api:015e68e1b2a3dcc13f0b405e1f761b154a825d24 - envs: - - name: POSTGRES_POOL_SIZE - value: - _default: "3" - - name: API_ADDRESS - value: - _default: 0.0.0.0:8000 - - name: ENABLE_SSL - value: - _default: "0" - secretEnvs: - - name: POSTGRES_USER - secretName: - _default: drawings-postgresql-secret - secretKey: username - - name: POSTGRES_PASSWORD - secretName: - _default: drawings-postgresql-secret - secretKey: password - - name: POSTGRES_ADDRESS - secretName: - _default: drawings-postgresql-secret - secretKey: host - - name: POSTGRES_DB - secretName: - _default: drawings-postgresql-secret - secretKey: database diff --git a/apps/eav/ugok/backend.yaml b/apps/eav/ugok/backend.yaml new file mode 100644 index 0000000..89a1d52 --- /dev/null +++ b/apps/eav/ugok/backend.yaml @@ -0,0 +1,207 @@ +--- +# standalone HelmRelease по образцу apps/eav/wb/backend.yaml — base +# vault-native (secretEnvs через Vault Agent), а в ugok Vault вообще не +# используется ни одним приложением (см. apps/eav/wb — тот же принцип), +# поэтому не наследуем base, а собираем отдельный HelmRelease с обычными +# secretEnvs, без serviceAccount/podAnnotations/vault-обёртки в command/args. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: eav + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + image: + name: + _default: 10.4.10.187:80/library/eav:prod_0dcebba6 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: + _default: true + type: + _default: tcpSocket + tcpSocket: + port: + _default: 8000 + initialDelaySeconds: + _default: 20 + periodSeconds: + _default: 30 + timeoutSeconds: + _default: 3 + failureThreshold: + _default: 5 + readiness: + enabled: + _default: true + type: + _default: tcpSocket + tcpSocket: + port: + _default: 8000 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 10 + timeoutSeconds: + _default: 3 + failureThreshold: + _default: 6 + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: django-configmap + mountPath: + _default: /server/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + + envs: + - name: KAFKA_ENABLED + value: + _default: "False" + - name: ASSETS_TOPIC + value: + _default: sarex + - name: DJANGO_SETTINGS_MODULE + value: + _default: config.settings.production + - name: DJANGO_POSTGRES_HOST + value: + _default: postgres-service + - name: DJANGO_POSTGRES_DATABASE + value: + _default: eav_db + - name: YC_S3_ENDPOINT_URL + value: + _default: http://minio.minio.svc.cluster.local:9000 + - name: YC_S3_BUCKET_NAME + value: + _default: eav + - name: KAFKA_USERNAME + value: + _default: sarex + - name: KAFKA_SSL_CAFILE + value: + _default: /usr/local/share/ca-certificates/kafka.crt + - name: KAFKA_HOST + value: + _default: ugok-prod-kafka-bootstrap.kafka.svc.cluster.local:9093 + + secretEnvs: + - name: DJANGO_POSTGRES_USER + secretName: + _default: eav-postgresql-secret + secretKey: username + - name: DJANGO_POSTGRES_PASSWORD + secretName: + _default: eav-postgresql-secret + secretKey: password + - name: JWT_PRIVATE_KEY + secretName: + _default: backend-secret + secretKey: ssh_private.key + - name: JWT_PUBLIC_KEY + secretName: + _default: backend-secret + secretKey: ssh_public.key + - name: YC_S3_ACCESS_KEY_ID + secretName: + _default: eav-s3-secret + secretKey: secret_key + - name: YC_S3_SECRET_ACCESS_KEY + secretName: + _default: eav-s3-secret + secretKey: access_key + - name: KAFKA_PASSWORD + secretName: + _default: kafka-cred + secretKey: password + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/eav/ugok/django-configmap.yaml b/apps/eav/ugok/django-configmap.yaml new file mode 100644 index 0000000..386bcfa --- /dev/null +++ b/apps/eav/ugok/django-configmap.yaml @@ -0,0 +1,156 @@ +--- +# Скопировано из живого ConfigMap кластера ugok (namespace eav) — +# монтируется backend'ом в /server/config/settings/production.py. +apiVersion: v1 +kind: ConfigMap +metadata: + name: django-configmap + namespace: eav +data: + production.py: | + # production.py + + from .base import * + from datetime import timedelta + import os + from django.core.exceptions import ImproperlyConfigured + + INSTALLED_APPS.append("corsheaders") + MIDDLEWARE = ["corsheaders.middleware.CorsMiddleware"] + MIDDLEWARE + + # DEBUG SETTINGS START + # --- + + DEBUG = True + ALLOWED_HOSTS = ['*'] + # --- + + # DEBUG SETTINGS END + + # DATABASE SETTINGS START + # --- + + DATABASES = { + "default": { + "ENGINE": "django.db.backends.postgresql", + "NAME": os.getenv("DJANGO_POSTGRES_DATABASE"), + "USER": os.getenv("DJANGO_POSTGRES_USER"), + "PASSWORD": os.getenv("DJANGO_POSTGRES_PASSWORD"), + "HOST": os.getenv("DJANGO_POSTGRES_HOST"), + "PORT": "5432", + } + } + # --- + + # DATABASE SETTINGS END + + # RESPONSE HEADERS START + # --- + + CORS_ORIGIN_ALLOW_ALL = True + + CORS_ALLOWED_ORIGINS = [ + "http://sarex.ugok.lan","https://sarex.ugok.lan" + ] + + CORS_TRUSTED_ORIGINS = [ + "http://sarex.ugok.lan","https://sarex.ugok.lan" + ] + + CSRF_TRUSTED_ORIGINS = [ + "http://sarex.ugok.lan","https://sarex.ugok.lan" + ] + + CORS_ALLOW_METHODS = ( + 'DELETE', + 'GET', + 'OPTIONS', + 'PATCH', + 'POST', + 'PUT', + ) + + CORS_ALLOW_HEADERS = ( + 'accept', + 'accept-encoding', + 'authorization', + 'content-type', + 'user-agent', + 'x-csrftoken', + 'x-requested-with', + 'x-token', + 'Bearer' + ) + # --- + + # RESPONSE HEADERS END + + REST_FRAMEWORK = { + "DEFAULT_PAGINATION_CLASS": ( + "rest_framework.pagination.LimitOffsetPagination" + ), + "DEFAULT_SCHEMA_CLASS": "rest_framework.schemas.coreapi.AutoSchema", + "PAGE_SIZE": 10000, + "DEFAULT_FILTER_BACKENDS": [ + "django_filters.rest_framework.DjangoFilterBackend" + ], + "DEFAULT_AUTHENTICATION_CLASSES": [ + # "rest_framework_simplejwt.authentication.JWTAuthentication", + "rest_framework.authentication.SessionAuthentication", + "rest_framework.authentication.BasicAuthentication", + ], + "DEFAULT_PERMISSION_CLASSES": [ + "rest_framework.permissions.AllowAny", + ] + } + + # JWT SETTINGS START + # --- + + def get_env_variable(var_name, default=None): + try: + return os.getenv(var_name, default) + except KeyError: + error_msg = f"Set the {var_name} environment variable" + if default: + return default + raise ImproperlyConfigured(error_msg) + + SIMPLE_JWT_ISSUER = get_env_variable("SIMPLE_JWT_ISSUER", default="django") + + SIMPLE_JWT = { + "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5), + "REFRESH_TOKEN_LIFETIME": timedelta(days=1), + "ROTATE_REFRESH_TOKENS": False, + "UPDATE_LAST_LOGIN": False, + + "ALGORITHM": "RS512", + "SIGNING_KEY": get_env_variable("JWT_PRIVATE_KEY").replace("\\\n", "\n"), + "VERIFYING_KEY": get_env_variable("JWT_PUBLIC_KEY").replace("\\\n", "\n"), + "AUDIENCE": None, + "ISSUER": SIMPLE_JWT_ISSUER, + + "AUTH_HEADER_TYPES": ("Bearer",), + "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION", + "USER_ID_FIELD": "id", + "USER_ID_CLAIM": "user_id", + + "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",), + "TOKEN_TYPE_CLAIM": "token_type", + + "JTI_CLAIM": "jti", + + "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp", + "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5), + "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1), + } + # --- + + # JWT SETTINGS END + + STATIC_ROOT = '/static/' + STATIC_URL = '/static/' + STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.StaticFilesStorage' + + SESSION_COOKIE_NAME = 'eav-sessionid' + CSRF_COOKIE_NAME = 'eav-csrftoken' diff --git a/apps/eav/ugok/kustomization.yaml b/apps/eav/ugok/kustomization.yaml index 9c3a68a..e201025 100644 --- a/apps/eav/ugok/kustomization.yaml +++ b/apps/eav/ugok/kustomization.yaml @@ -1,11 +1,9 @@ --- +# Не наследуем base (vault-native) — см. комментарий в backend.yaml. +# Структура зеркалит apps/eav/wb/kustomization.yaml. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: eav resources: - - ../base -patches: - - path: patch.yaml - target: - kind: HelmRelease - name: backend + - django-configmap.yaml + - backend.yaml diff --git a/apps/eav/ugok/patch.yaml b/apps/eav/ugok/patch.yaml deleted file mode 100644 index 6d19acf..0000000 --- a/apps/eav/ugok/patch.yaml +++ /dev/null @@ -1,87 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: backend - namespace: eav -spec: - values: - services: - backend: - image: - name: - _default: 10.4.10.187:80/library/eav:prod_0dcebba6 - volumes: - _default: - - name: django-configmap - mountPath: - _default: /server/config/settings/production.py - subPath: - _default: production.py - configMap: - name: - _default: django-configmap - items: - - key: production.py - path: - _default: production.py - envs: - - name: KAFKA_ENABLED - value: - _default: "False" - - name: ASSETS_TOPIC - value: - _default: sarex - - name: DJANGO_SETTINGS_MODULE - value: - _default: config.settings.production - - name: DJANGO_POSTGRES_HOST - value: - _default: postgres-service - - name: DJANGO_POSTGRES_DATABASE - value: - _default: eav_db - - name: YC_S3_ENDPOINT_URL - value: - _default: http://minio.minio.svc.cluster.local:9000 - - name: YC_S3_BUCKET_NAME - value: - _default: eav - - name: KAFKA_USERNAME - value: - _default: sarex - - name: KAFKA_SSL_CAFILE - value: - _default: /usr/local/share/ca-certificates/kafka.crt - - name: KAFKA_HOST - value: - _default: ugok-prod-kafka-bootstrap.kafka.svc.cluster.local:9093 - secretEnvs: - - name: DJANGO_POSTGRES_USER - secretName: - _default: eav-postgresql-secret - secretKey: username - - name: DJANGO_POSTGRES_PASSWORD - secretName: - _default: eav-postgresql-secret - secretKey: password - - name: JWT_PRIVATE_KEY - secretName: - _default: backend-secret - secretKey: ssh_private.key - - name: JWT_PUBLIC_KEY - secretName: - _default: backend-secret - secretKey: ssh_public.key - - name: YC_S3_ACCESS_KEY_ID - secretName: - _default: eav-s3-secret - secretKey: secret_key - - name: YC_S3_SECRET_ACCESS_KEY - secretName: - _default: eav-s3-secret - secretKey: access_key - - name: KAFKA_PASSWORD - secretName: - _default: kafka-cred - secretKey: password diff --git a/apps/flows/ugok/patch-backend.yaml b/apps/flows/ugok/backend.yaml similarity index 77% rename from apps/flows/ugok/patch-backend.yaml rename to apps/flows/ugok/backend.yaml index bbc7f7e..2a80735 100644 --- a/apps/flows/ugok/patch-backend.yaml +++ b/apps/flows/ugok/backend.yaml @@ -1,16 +1,95 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: flows + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: - _default: 10.4.10.187:80/library/flows-backend:production_a7dc8216 + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: LOG_LEVEL value: @@ -114,6 +193,7 @@ spec: - name: PROXY_PATH_PREFIX value: _default: /flows + secretEnvs: - name: KAFKA_USERNAME secretName: @@ -167,3 +247,8 @@ spec: secretName: _default: flows-rabbitmq-secret secretKey: vhost + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/flows/ugok/patch-celery.yaml b/apps/flows/ugok/celery.yaml similarity index 78% rename from apps/flows/ugok/patch-celery.yaml rename to apps/flows/ugok/celery.yaml index 7cd6026..d633e27 100644 --- a/apps/flows/ugok/patch-celery.yaml +++ b/apps/flows/ugok/celery.yaml @@ -1,16 +1,84 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +# command — реальная команда запуска celery (не vault-обёртка). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: celery namespace: flows + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: celery: + enabled: true + image: name: - _default: 10.4.10.187:80/library/flows-backend_worker:production_a7dc8216 + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["celery", "-A", "src.worker", "worker", "-l", "INFO", "-E", "--concurrency=1", "-Q", "flow"] + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: LOG_LEVEL value: @@ -108,6 +176,7 @@ spec: - name: DJANGO_BASE_HOST value: _default: https://ugok-sarex.uralmine.com + secretEnvs: - name: FLOWS_DB_DB secretName: @@ -177,3 +246,8 @@ spec: secretName: _default: flows-rabbitmq-secret secretKey: vhost + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/flows/ugok/frontend.yaml b/apps/flows/ugok/frontend.yaml new file mode 100644 index 0000000..344846c --- /dev/null +++ b/apps/flows/ugok/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: flows + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_dcc5b5e6 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/flows/ugok/kustomization.yaml b/apps/flows/ugok/kustomization.yaml index b12fd72..d27e688 100644 --- a/apps/flows/ugok/kustomization.yaml +++ b/apps/flows/ugok/kustomization.yaml @@ -1,19 +1,9 @@ --- +# Не наследуем base (backend/celery vault-native) — см. комментарии в файлах. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: flows resources: - - ../base -patches: - - path: patch-backend.yaml - target: - kind: HelmRelease - name: backend - - path: patch-celery.yaml - target: - kind: HelmRelease - name: celery - - path: patch-frontend.yaml - target: - kind: HelmRelease - name: frontend + - backend.yaml + - celery.yaml + - frontend.yaml diff --git a/apps/flows/ugok/patch-frontend.yaml b/apps/flows/ugok/patch-frontend.yaml deleted file mode 100644 index 49c3555..0000000 --- a/apps/flows/ugok/patch-frontend.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: frontend - namespace: flows -spec: - values: - services: - frontend: - image: - name: - _default: 10.4.10.187:80/library/flows-frontend:contour_dcc5b5e6 diff --git a/apps/inspections/ugok/patch.yaml b/apps/inspections/ugok/backend.yaml similarity index 68% rename from apps/inspections/ugok/patch.yaml rename to apps/inspections/ugok/backend.yaml index 298fee0..42e9d23 100644 --- a/apps/inspections/ugok/patch.yaml +++ b/apps/inspections/ugok/backend.yaml @@ -1,16 +1,96 @@ --- +# standalone HelmRelease по образцу apps/inspections/wb/backend.yaml — base +# vault-native, в ugok Vault не используется. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: inspections + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: - _default: 10.4.10.187:80/library/sarex-inspections:production_1a33f6f4 + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: inspections-backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: sarex-inspections-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: DEBUG value: @@ -62,7 +142,7 @@ spec: _default: "30" - name: WORKFLOWS_URL value: - _default: http://workflows-service.processing-prod + _default: http://workflows-service.workflow - name: WORKFLOWS_TIMEOUT value: _default: "30" @@ -84,6 +164,7 @@ spec: - name: MAILER_TIMEOUT value: _default: "30" + secretEnvs: - name: DATABASE_USER secretName: @@ -121,3 +202,8 @@ spec: secretName: _default: sarex-backend-auth-secret secretKey: key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/inspections/ugok/kustomization.yaml b/apps/inspections/ugok/kustomization.yaml index b644d0a..3e7e678 100644 --- a/apps/inspections/ugok/kustomization.yaml +++ b/apps/inspections/ugok/kustomization.yaml @@ -1,11 +1,7 @@ --- +# Не наследуем base (vault-native) — см. комментарий в backend.yaml. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: inspections resources: - - ../base -patches: - - path: patch.yaml - target: - kind: HelmRelease - name: backend + - backend.yaml diff --git a/apps/issues/ugok/patch-backend.yaml b/apps/issues/ugok/backend.yaml similarity index 60% rename from apps/issues/ugok/patch-backend.yaml rename to apps/issues/ugok/backend.yaml index 0440efe..a32882a 100644 --- a/apps/issues/ugok/patch-backend.yaml +++ b/apps/issues/ugok/backend.yaml @@ -1,16 +1,129 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +# volumes дополнены uwsgi-configmap: в base этот volume отсутствует, хотя +# в живом дампе кластера он реально смонтирован в оба контейнера. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: issues + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: 10.4.10.187:80/library/issues:production_bbb9d29a + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: issues + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + + - name: uwsgi-configmap + mountPath: + _default: /opt/server/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: uwsgi-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + envs: - name: ENVIRONMENT value: @@ -60,6 +173,7 @@ spec: - name: RABBITMQ_HOSTNAME value: _default: rabbitmq.rabbitmq.svc.cluster.local:5672 + secretEnvs: - name: YC_S3_ACCESS_KEY_ID secretName: @@ -121,3 +235,8 @@ spec: secretName: _default: backend-secret secretKey: ssh_public.key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/ugok/patch-celery.yaml b/apps/issues/ugok/celery.yaml similarity index 66% rename from apps/issues/ugok/patch-celery.yaml rename to apps/issues/ugok/celery.yaml index a0ecfbf..38e7cbd 100644 --- a/apps/issues/ugok/patch-celery.yaml +++ b/apps/issues/ugok/celery.yaml @@ -1,19 +1,115 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: celery namespace: issues + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: celery: + enabled: true + image: name: _default: 10.4.10.187:80/library/issues:production_bbb9d29a + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: _default: ["celery", "-A", "config", "worker", "-l", "info", "-E"] + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + + - name: uwsgi-configmap + mountPath: + _default: /opt/server/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: uwsgi-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + envs: - name: ENVIRONMENT value: @@ -69,6 +165,7 @@ spec: - name: ENABLE_MAILGUN value: _default: "False" + secretEnvs: - name: YC_S3_ACCESS_KEY_ID secretName: @@ -130,3 +227,8 @@ spec: secretName: _default: backend-secret secretKey: ssh_public.key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/ugok/frontend.yaml b/apps/issues/ugok/frontend.yaml new file mode 100644 index 0000000..6afe0c5 --- /dev/null +++ b/apps/issues/ugok/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: issues + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:b56b9da1 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/issues/ugok/kustomization.yaml b/apps/issues/ugok/kustomization.yaml index 8236879..712088d 100644 --- a/apps/issues/ugok/kustomization.yaml +++ b/apps/issues/ugok/kustomization.yaml @@ -1,23 +1,12 @@ --- +# Не наследуем base (backend/celery vault-native) — см. комментарии в файлах. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: issues resources: - - ../base -patches: - - path: patch-backend.yaml - target: - kind: HelmRelease - name: backend - - path: patch-celery.yaml - target: - kind: HelmRelease - name: celery - - path: patch-frontend.yaml - target: - kind: HelmRelease - name: frontend - - path: patch-redis-image.yaml - target: - kind: Deployment - name: redis + - production-configmap.yaml + - uwsgi-configmap.yaml + - backend.yaml + - celery.yaml + - frontend.yaml + - redis.yaml diff --git a/apps/issues/ugok/patch-frontend.yaml b/apps/issues/ugok/patch-frontend.yaml deleted file mode 100644 index 97dd57f..0000000 --- a/apps/issues/ugok/patch-frontend.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: frontend - namespace: issues -spec: - values: - services: - frontend: - image: - name: - _default: 10.4.10.187:80/library/contour_issues-frontend:b56b9da1 diff --git a/apps/issues/ugok/patch-redis-image.yaml b/apps/issues/ugok/patch-redis-image.yaml deleted file mode 100644 index 08a2c4d..0000000 --- a/apps/issues/ugok/patch-redis-image.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# redis-deployment.yaml — сырой Deployment (не universal-chart), образ меняем -# через JSON6902, т.к. strategic-merge на список containers ненадёжен для CRD-less объектов. -- op: replace - path: /spec/template/spec/containers/0/image - value: 10.4.10.187:80/library/redis:latest diff --git a/apps/issues/ugok/production-configmap.yaml b/apps/issues/ugok/production-configmap.yaml new file mode 100644 index 0000000..b06e809 --- /dev/null +++ b/apps/issues/ugok/production-configmap.yaml @@ -0,0 +1,15 @@ +--- +# Скопировано из живого ConfigMap кластера ugok (namespace issues) — монтируется +# backend'ом и celery как /src/config/settings/production.py. +# +# ВНИМАНИЕ: в файле буквально зашиты секреты (SECRET_KEY, DJANGO_TOKEN, +# KAFKA_PASSWORD) и чужой домен brusnika-stage-kafka-bootstrap — копирую +# как есть, как и договаривались, но это стоит знать: значения не +# заворачиваются в env/Secret на уровне HelmRelease, они прямо в коде. +apiVersion: v1 +kind: ConfigMap +metadata: + name: production-configmap + namespace: issues +data: + production.py: "from datetime import timedelta\nimport os\nfrom .base import *\n\n# DEBUG SETTINGS START\n# -----------------------------------------------------------------------------\nDEBUG = True\n# -----------------------------------------------------------------------------\n\nTEST_MODE = False\n\n# SECRETS SETTINGS START\n# -----------------------------------------------------------------------------\n\nAWS_S3_VERIFY=False\nENABLE_MAILGUN=False\nSECRET_KEY = \"FromToMuchLoveOfLiving\" # Delete after Test\n# -----------------------------------------------------------------------------\n\n# ALLOWED HOSTS START\n# -----------------------------------------------------------------------------\nALLOWED_HOSTS = [\"*\"]\n# -----------------------------------------------------------------------------\n\n# APPS SETTINGS START\n# -----------------------------------------------------------------------------\n# INSTALLED_APPS += [\n# \"django_extensions\",\n# ]\n# -----------------------------------------------------------------------------\n\nDJANGO_TOKEN=\"aGFnZW4wMTM6emVhbG90MDk2\"\n\n# DEBUG SETTINGS START\n# -----------------------------------------------------------------------------\nDEBUG = True\n# -----------------------------------------------------------------------------\n\nREVIEW_HOST='http://backend-service.flows.svc.cluster.local:8000'\n# -----------------------------------------------------------------------------\n# EXTERNAL SERVICES END\n\nWORKFLOWS_HOST = \"http://workflows-api-service.workflow.svc.cluster.local:8000\"\nWORKFLOWS_URL = \"http://workflows-api-service.workflow.svc.cluster.local:8000\"\nDOCUMENTATIONS_URL = \"http://documentations-api.documentations.svc.cluster.local:8080\"\nRESOURCES_API_HOST = os.getenv(\"RESOURCES_API_HOST\", default=\"http://resources-service.resources.svc.cluster:8000\")\nKAFKA_HOST = \"brusnika-stage-kafka-bootstrap.kafka.svc.cluster.local:9093\" \nKAFKA_USERNAME = \"sarex\" \nKAFKA_PASSWORD = \"nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC\"\nKAFKA_SSL_CAFILE = os.getenv(\"KAFKA_SSL_CAFILE\", \"/usr/local/share/ca-certificates/kafka.crt\")\nKAFKA_EAV_ASSETS_TOPIC = os.getenv(\"KAFKA_EAV_ASSETS_TOPIC\", \"sarex\")\nKAFKA_ISSUES_TOPIC = os.getenv(\"KAFKA_ISSUES_TOPIC\", \"sarex-issues\")\nSMTP_HOST = 'mail.uchgok.ru'\nSMTP_PORT = 25\nEMAIL_FROM = 'sarex@uchgok.ru'\n\n\nUSE_ASYNC_FUNCTIONS = False\nUSE_NOTIFICATIONS = True\n\n# JWT SETTINGS START\n# ---------------------------------------------------------------------------------------------------------------------\nSIMPLE_JWT_ISSUER = os.getenv(\"SIMPLE_JWT_ISSUER\", default=\"default_issuer\")\n\nSIMPLE_JWT = {\n \"ACCESS_TOKEN_LIFETIME\": timedelta(minutes=5),\n \"REFRESH_TOKEN_LIFETIME\": timedelta(days=1),\n \"ROTATE_REFRESH_TOKENS\": False,\n \"UPDATE_LAST_LOGIN\": False,\n\n \"ALGORITHM\": \"RS512\",\n \"SIGNING_KEY\": os.getenv(\"JWT_PRIVATE_KEY\", default=\"\").replace(\"\\\\n\", \"\\n\"),\n \"VERIFYING_KEY\": os.getenv(\"JWT_PUBLIC_KEY\").replace(\"\\\\n\", \"\\n\"),\n \"AUDIENCE\": None,\n \"ISSUER\": SIMPLE_JWT_ISSUER,\n\n \"AUTH_HEADER_TYPES\": (\"Bearer\",),\n \"AUTH_HEADER_NAME\": \"HTTP_AUTHORIZATION\",\n \"USER_ID_FIELD\": \"id\",\n \"USER_ID_CLAIM\": \"user_id\",\n\n \"AUTH_TOKEN_CLASSES\": (\"rest_framework_simplejwt.tokens.AccessToken\",),\n \"TOKEN_TYPE_CLAIM\": \"token_type\",\n\n \"JTI_CLAIM\": \"jti\",\n\n \"SLIDING_TOKEN_REFRESH_EXP_CLAIM\": \"refresh_exp\",\n \"SLIDING_TOKEN_LIFETIME\": timedelta(minutes=5),\n \"SLIDING_TOKEN_REFRESH_LIFETIME\": timedelta(days=1),\n}\n# ---------------------------------------------------------------------------------------------------------------------\n\nCORS_ALLOWED_ORIGINS = [\n \"https://ugok-sarex.uralmine.com\",\n]\n\nCORS_TRUSTED_ORIGINS = [\n \"https://ugok-sarex.uralmine.com\",\n]\n\nCSRF_TRUSTED_ORIGINS = [\n \"https://ugok-sarex.uralmine.com\",\n]\n\nCORS_ALLOW_ALL_ORIGINS = True\n\nCORS_ALLOW_METHODS = [\n \"DELETE\",\n \"GET\",\n \"OPTIONS\",\n \"PATCH\",\n \"POST\",\n \"PUT\",\n]\n\nSAREX_API = \"http://backend.django.svc.cluster.local:8000\"\n\nAERO_PUBLIC_HOST = os.getenv(\"AERO_PUBLIC_HOST\", default=SAREX_API)\n\nBASE_AERO_URL = \"http://backend.django.svc.cluster.local:8000\"\n\nENVIRONMENT = \"production\"\n\nSESSION_COOKIE_NAME = \"issues-sessionid\"\nCSRF_COOKIE_NAME = \"issues-csrftoken\"\nSTATIC_URL = \"/static/\"\nSTORAGES = {\n 'default': {\n 'BACKEND': \"storages.backends.s3boto3.S3Boto3Storage\",\n },\n 'staticfiles': {\n # Leave whatever setting you already have here, e.g.:\n 'BACKEND': \"storages.backends.s3boto3.S3Boto3Storage\",\n }\n}\n" diff --git a/apps/issues/ugok/redis.yaml b/apps/issues/ugok/redis.yaml new file mode 100644 index 0000000..76e9b04 --- /dev/null +++ b/apps/issues/ugok/redis.yaml @@ -0,0 +1,43 @@ +--- +# Скопировано из apps/issues/base/redis-deployment.yaml + redis-service.yaml — +# сырой Deployment (не universal-chart, не vault-native), просто перенесён +# в standalone-оверлей, чтобы не зависеть от ../base. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: redis + namespace: issues + labels: + app: redis +spec: + replicas: 1 + selector: + matchLabels: + app: redis + template: + metadata: + labels: + app: redis + spec: + containers: + - name: redis + image: 10.4.10.187:80/library/redis:latest + imagePullPolicy: Always + ports: + - containerPort: 6379 + protocol: TCP + imagePullSecrets: + - name: regcred +--- +apiVersion: v1 +kind: Service +metadata: + name: redis + namespace: issues +spec: + selector: + app: redis + ports: + - port: 6379 + targetPort: 6379 + protocol: TCP diff --git a/apps/issues/ugok/uwsgi-configmap.yaml b/apps/issues/ugok/uwsgi-configmap.yaml new file mode 100644 index 0000000..ab6b1aa --- /dev/null +++ b/apps/issues/ugok/uwsgi-configmap.yaml @@ -0,0 +1,24 @@ +--- +# Скопировано из живого ConfigMap кластера ugok (namespace issues). +apiVersion: v1 +kind: ConfigMap +metadata: + name: uwsgi-configmap + namespace: issues +data: + uwsgi.ini: |- + [uwsgi] + plugins-dir = /usr/lib/uwsgi/plugins + + chdir = /src + module = config.wsgi:application + master = true + processes = 4 + http = 0.0.0.0:8000 + chmod-socket = 666 + vacuum = true + harakiri = 6000 + buffer-size = 32768 + + static-map = /static=/opt/src/static/ + static-map = /media=/opt/src/media/ diff --git a/apps/mapper/ugok/backend.yaml b/apps/mapper/ugok/backend.yaml new file mode 100644 index 0000000..3abf71a --- /dev/null +++ b/apps/mapper/ugok/backend.yaml @@ -0,0 +1,123 @@ +--- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +# У mapper в wb нет отдельного оверлея; envs совпадают с тем, что реально +# в дампе ugok (тот же sarex.io-домен, что и в base — совпадение, не ошибка). +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: mapper + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/mapper:prod_b0d05a34 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + limits: + cpu: + _default: "2" + memory: + _default: 512Mi + requests: + cpu: + _default: "1" + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: DOCUMENTATION_HOST + value: + _default: https://api.sarex.io/documentations/api/v1 + - name: FLOW_HOST + value: + _default: https://api.sarex.io/flows/api/v1 + - name: DJANGO_HOST + value: + _default: https://lk.sarex.io/api + - name: NOTE_HOST + value: + _default: https://api.sarex.io/notes/api/v1 + - name: REDIS_USE + value: + _default: "0" + - name: TIMEOUT + value: + _default: "120" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/mapper/ugok/kustomization.yaml b/apps/mapper/ugok/kustomization.yaml index fb2061d..de6d275 100644 --- a/apps/mapper/ugok/kustomization.yaml +++ b/apps/mapper/ugok/kustomization.yaml @@ -1,11 +1,7 @@ --- +# Не наследуем base (vault-native) — см. комментарий в backend.yaml. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: mapper resources: - - ../base -patches: - - path: patch.yaml - target: - kind: HelmRelease - name: backend + - backend.yaml diff --git a/apps/mapper/ugok/patch.yaml b/apps/mapper/ugok/patch.yaml deleted file mode 100644 index f7a9317..0000000 --- a/apps/mapper/ugok/patch.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: backend - namespace: mapper -spec: - values: - services: - backend: - deployment: - resources: - limits: - cpu: - _default: "2" - memory: - _default: 512Mi - requests: - cpu: - _default: "1" - memory: - _default: 128Mi diff --git a/apps/measurements/ugok/backend.yaml b/apps/measurements/ugok/backend.yaml new file mode 100644 index 0000000..a600aef --- /dev/null +++ b/apps/measurements/ugok/backend.yaml @@ -0,0 +1,112 @@ +--- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. +# service.name исправлен на measurement-svc (реальное имя из дампа кластера, +# в base по умолчанию — measurements-svc). +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: measurements + namespace: measurements + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:production_a5bb3e84 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: measurements + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 500m + memory: + _default: 512Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: measurement-svc + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + envs: + - name: DJANGO_HOST + value: + _default: https://lk.sarex.io + - name: S3_JSON_FILE + value: + _default: /opt/cred_s3.json + + secretEnvs: + - name: S3_JSON_SETTINGS + secretName: + _default: s3-json-settings + secretKey: S3_JSON_SETTINGS + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/measurements/ugok/kustomization.yaml b/apps/measurements/ugok/kustomization.yaml index bbca337..59eba88 100644 --- a/apps/measurements/ugok/kustomization.yaml +++ b/apps/measurements/ugok/kustomization.yaml @@ -1,11 +1,7 @@ --- +# Не наследуем base (vault-native) — см. комментарий в backend.yaml. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: measurements resources: - - ../base -patches: - - path: patch.yaml - target: - kind: HelmRelease - name: measurements + - backend.yaml diff --git a/apps/measurements/ugok/patch.yaml b/apps/measurements/ugok/patch.yaml deleted file mode 100644 index 39de557..0000000 --- a/apps/measurements/ugok/patch.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: measurements - namespace: measurements -spec: - values: - services: - backend: - deployment: - resources: - requests: - cpu: - _default: 500m - memory: - _default: 512Mi - envs: - - name: DJANGO_HOST - value: - _default: https://lk.sarex.io - - name: S3_JSON_FILE - value: - _default: /opt/cred_s3.json - secretEnvs: - - name: S3_JSON_SETTINGS - secretName: - _default: s3-json-settings - secretKey: S3_JSON_SETTINGS diff --git a/apps/message-hub/ugok/kustomization.yaml b/apps/message-hub/ugok/kustomization.yaml index 9ae124a..09eb056 100644 --- a/apps/message-hub/ugok/kustomization.yaml +++ b/apps/message-hub/ugok/kustomization.yaml @@ -1,11 +1,7 @@ --- +# Не наследуем base (vault-native) — см. комментарий в message-hub.yaml. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: message-hub resources: - - ../base -patches: - - path: patch.yaml - target: - kind: HelmRelease - name: message-hub + - message-hub.yaml diff --git a/apps/message-hub/ugok/patch.yaml b/apps/message-hub/ugok/message-hub.yaml similarity index 66% rename from apps/message-hub/ugok/patch.yaml rename to apps/message-hub/ugok/message-hub.yaml index ead5072..337ed19 100644 --- a/apps/message-hub/ugok/patch.yaml +++ b/apps/message-hub/ugok/message-hub.yaml @@ -1,16 +1,83 @@ --- +# standalone HelmRelease по образцу apps/message-hub/wb/message-hub.yaml — +# base vault-native, в ugok Vault не используется. Service отключён: в +# живом дампе кластера у message-hub вообще нет Service-объекта (только +# Deployment, потребляет Kafka без входящего HTTP). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: message-hub namespace: message-hub + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: 10.4.10.187:80/library/message-hub:production_e8010fe4 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: message-hub + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: WORKER_TIMEOUT value: @@ -60,9 +127,7 @@ spec: - name: KAFKA_SASL_MECHANISM value: _default: PLAIN - - name: KAFKA_SSL_CAFILE - value: - _default: /usr/local/share/ca-certificates/kafka.crt + secretEnvs: - name: KAFKA_USERNAME secretName: @@ -96,3 +161,8 @@ spec: secretName: _default: message-hub-s3-secret secretKey: endpoint + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/notes/ugok/patch-backend.yaml b/apps/notes/ugok/backend.yaml similarity index 63% rename from apps/notes/ugok/patch-backend.yaml rename to apps/notes/ugok/backend.yaml index a2b5edf..fc87f15 100644 --- a/apps/notes/ugok/patch-backend.yaml +++ b/apps/notes/ugok/backend.yaml @@ -1,16 +1,95 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: notes + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: 10.4.10.187:80/library/notes-backend:production_81366854 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: DJANGO_HOST value: @@ -57,6 +136,7 @@ spec: - name: ENABLE_ND value: _default: "0" + secretEnvs: - name: PG_DB secretName: @@ -78,3 +158,8 @@ spec: secretName: _default: notes-django-auth secretKey: key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/notes/ugok/frontend.yaml b/apps/notes/ugok/frontend.yaml new file mode 100644 index 0000000..4e079e6 --- /dev/null +++ b/apps/notes/ugok/frontend.yaml @@ -0,0 +1,97 @@ +--- +# base монтирует nginx-configmap, но в живом дампе кластера у frontend +# нет ни volumeMounts, ни такого ConfigMap'а в namespace — не подключаем. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: notes + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: 10.4.10.187:80/library/notes-frontend:production_0cb0909f + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/notes/ugok/kustomization.yaml b/apps/notes/ugok/kustomization.yaml index 45e6b52..48cc2d3 100644 --- a/apps/notes/ugok/kustomization.yaml +++ b/apps/notes/ugok/kustomization.yaml @@ -1,15 +1,8 @@ --- +# Не наследуем base (backend vault-native) — см. комментарии в файлах. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: notes resources: - - ../base -patches: - - path: patch-backend.yaml - target: - kind: HelmRelease - name: backend - - path: patch-frontend.yaml - target: - kind: HelmRelease - name: frontend + - backend.yaml + - frontend.yaml diff --git a/apps/notes/ugok/patch-frontend.yaml b/apps/notes/ugok/patch-frontend.yaml deleted file mode 100644 index 608d3b8..0000000 --- a/apps/notes/ugok/patch-frontend.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: frontend - namespace: notes -spec: - values: - services: - frontend: - image: - name: - _default: 10.4.10.187:80/library/notes-frontend:production_0cb0909f diff --git a/apps/pm/ugok/backend-configmap.yaml b/apps/pm/ugok/backend-configmap.yaml new file mode 100644 index 0000000..f6865e2 --- /dev/null +++ b/apps/pm/ugok/backend-configmap.yaml @@ -0,0 +1,32 @@ +--- +# Скопировано из живого ConfigMap кластера ugok (namespace pm) — монтируется +# backend'ом и celery как /opt/sarex/uwsgi.ini. +apiVersion: v1 +kind: ConfigMap +metadata: + name: backend-configmap + namespace: pm +data: + uwsgi.ini: | + [uwsgi] + log-format = {"time": "%(time)", "method": "%(method)", "uri": "%(uri)", "status": "%(status)", "size": "%(size)", "addr": "%(addr)", "user": "%(user)", "proto": "%(proto)", "user_agent": "%(uagent)", "referer": "%(referer)", "trace_id": "%(trace_id)", "span_id": "%(span_id)"} + module = config.wsgi:application + DJANGO_SETTINGS_MODULE = config.settings.base + http = 0.0.0.0:8000 + processes = 8 + master = true + vacuum = true + enable-threads = true + buffer-size = 65535 + stats = :3031 + stats-http = true + memory-report = true + lazy-apps = true + listen = 1024 + disable-write-exception= 0 + harakiri = 300 + socket-timeout = 300 + chunked-input-timeout = 300 + http-timeout = 300 + worker-reload-mercy = 240 + mule-reload-mercy = 240 diff --git a/apps/pm/ugok/backend.yaml b/apps/pm/ugok/backend.yaml new file mode 100644 index 0000000..f2bad55 --- /dev/null +++ b/apps/pm/ugok/backend.yaml @@ -0,0 +1,162 @@ +--- +# standalone HelmRelease по образцу apps/pm/wb/backend.yaml — base +# vault-native, в ugok Vault не используется. Секреты (DB/S3/RabbitMQ) идут +# через уже существующий в кластере Secret sarex-env, смонтированный файлом +# .env (тот же паттерн, что в wb). command/args из base — только +# vault-обёртка (в живом дампе кластера command/args у backend нет вообще, +# как и в wb), не переносим её. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + image: + name: + _default: 10.4.10.187:80/library/pm-backend:production_fa0f1551 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: uwsgi-configmap + mountPath: + _default: /opt/sarex/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: backend-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + + - name: env-file + mountPath: + _default: /opt/sarex/.env + subPath: + _default: .env + readOnly: + _default: true + secret: + secretName: + _default: sarex-env + items: + - key: .env + path: + _default: .env + + - name: kafka-cert-volume + mountPath: + _default: /usr/local/share/ca-certificates + readOnly: + _default: true + configMap: + name: + _default: kafka-cert + + envs: + - name: USERS_INTERNAL_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: RESOURCES_INTERNAL_HOST + value: + _default: http://resources-service.resources.svc.cluster.local:8000 + - name: EAV_HOST + value: + _default: http://eav-service.eav.svc.cluster.local:8000 + - name: EAV_API_PREFIX + value: + _default: /api/v0 + - name: SETTINGS_VERIFY_SSL + value: + _default: "True" + - name: EAV_API_PREFIX_V1 + value: + _default: /api/v1 + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/pm/ugok/celery.yaml b/apps/pm/ugok/celery.yaml new file mode 100644 index 0000000..48e97f1 --- /dev/null +++ b/apps/pm/ugok/celery.yaml @@ -0,0 +1,149 @@ +--- +# standalone HelmRelease по образцу apps/pm/wb/celery.yaml — base +# vault-native, в ugok Vault не используется. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + celery: + enabled: true + + image: + name: + _default: 10.4.10.187:80/library/pm-backend:production_fa0f1551 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "pm", "-n", "default_worker.%h", "--concurrency=2"] + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: uwsgi-configmap + mountPath: + _default: /opt/sarex/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: backend-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + + - name: env-file + mountPath: + _default: /opt/sarex/.env + subPath: + _default: .env + readOnly: + _default: true + secret: + secretName: + _default: sarex-env + items: + - key: .env + path: + _default: .env + + - name: kafka-cert-volume + mountPath: + _default: /usr/local/share/ca-certificates + readOnly: + _default: true + configMap: + name: + _default: kafka-cert + + envs: + - name: USERS_INTERNAL_HOST + value: + _default: http://backend.django.svc.cluster.local:8000 + - name: RESOURCES_INTERNAL_HOST + value: + _default: http://resources-service.resources.svc.cluster.local:8000 + - name: EAV_HOST + value: + _default: http://eav-service.eav.svc.cluster.local:8000 + - name: EAV_API_PREFIX + value: + _default: /api/v0 + - name: EAV_API_PREFIX_V1 + value: + _default: /api/v1 + - name: PLANNING_HOST + value: + _default: http://backend-service.pm.svc.cluster.local:8000/api/pm/msp + - name: PLANNING_USE + value: + _default: "True" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/pm/ugok/frontend.yaml b/apps/pm/ugok/frontend.yaml new file mode 100644 index 0000000..741c740 --- /dev/null +++ b/apps/pm/ugok/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: 10.4.10.187:80/library/pm-frontend:contour_e5c3d387 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 100m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/pm/ugok/kustomization.yaml b/apps/pm/ugok/kustomization.yaml index 148c870..3ff0c62 100644 --- a/apps/pm/ugok/kustomization.yaml +++ b/apps/pm/ugok/kustomization.yaml @@ -1,19 +1,11 @@ --- +# Не наследуем base (backend/celery vault-native; resources-static из base +# в живом дампе кластера отсутствует вообще — не подключаем). apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: pm resources: - - ../base -patches: - - path: patch-backend.yaml - target: - kind: HelmRelease - name: backend - - path: patch-celery.yaml - target: - kind: HelmRelease - name: celery - - path: patch-frontend.yaml - target: - kind: HelmRelease - name: frontend + - backend-configmap.yaml + - backend.yaml + - celery.yaml + - frontend.yaml diff --git a/apps/pm/ugok/patch-backend.yaml b/apps/pm/ugok/patch-backend.yaml deleted file mode 100644 index ab57622..0000000 --- a/apps/pm/ugok/patch-backend.yaml +++ /dev/null @@ -1,53 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: backend - namespace: pm -spec: - values: - services: - backend: - image: - name: - _default: 10.4.10.187:80/library/pm-backend:production_fa0f1551 - volumes: - _default: - - name: kafka-cert-volume - mountPath: - _default: /usr/local/share/ca-certificates - readOnly: - _default: true - configMap: - name: - _default: kafka-cert - - - name: env-file - mountPath: - _default: /opt/sarex/.env - subPath: - _default: .env - readOnly: - _default: true - secret: - secretName: - _default: sarex-env - envs: - - name: USERS_INTERNAL_HOST - value: - _default: http://backend.django.svc.cluster.local:8000 - - name: RESOURCES_INTERNAL_HOST - value: - _default: http://resources-service.resources.svc.cluster.local:8000 - - name: EAV_HOST - value: - _default: http://eav-service.eav.svc.cluster.local:8000 - - name: EAV_API_PREFIX - value: - _default: /api/v0 - - name: SETTINGS_VERIFY_SSL - value: - _default: "True" - - name: EAV_API_PREFIX_V1 - value: - _default: /api/v1 diff --git a/apps/pm/ugok/patch-celery.yaml b/apps/pm/ugok/patch-celery.yaml deleted file mode 100644 index 46f3bbc..0000000 --- a/apps/pm/ugok/patch-celery.yaml +++ /dev/null @@ -1,56 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: celery - namespace: pm -spec: - values: - services: - celery: - image: - name: - _default: 10.4.10.187:80/library/pm-backend:production_fa0f1551 - volumes: - _default: - - name: kafka-cert-volume - mountPath: - _default: /usr/local/share/ca-certificates - readOnly: - _default: true - configMap: - name: - _default: kafka-cert - - - name: env-file - mountPath: - _default: /opt/sarex/.env - subPath: - _default: .env - readOnly: - _default: true - secret: - secretName: - _default: sarex-env - envs: - - name: USERS_INTERNAL_HOST - value: - _default: http://backend.django.svc.cluster.local:8000 - - name: RESOURCES_INTERNAL_HOST - value: - _default: http://resources-service.resources.svc.cluster.local:8000 - - name: EAV_HOST - value: - _default: http://eav-service.eav.svc.cluster.local:8000 - - name: EAV_API_PREFIX - value: - _default: /api/v0 - - name: EAV_API_PREFIX_V1 - value: - _default: /api/v1 - - name: PLANNING_HOST - value: - _default: http://backend-service.pm.svc.cluster.local:8000/api/pm/msp - - name: PLANNING_USE - value: - _default: "True" diff --git a/apps/pm/ugok/patch-frontend.yaml b/apps/pm/ugok/patch-frontend.yaml deleted file mode 100644 index 672250d..0000000 --- a/apps/pm/ugok/patch-frontend.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: frontend - namespace: pm -spec: - values: - services: - frontend: - image: - name: - _default: 10.4.10.187:80/library/pm-frontend:contour_e5c3d387 - resources: - requests: - cpu: - _default: 100m - memory: - _default: 100Mi diff --git a/apps/rfi/ugok/patch-backend.yaml b/apps/rfi/ugok/backend.yaml similarity index 67% rename from apps/rfi/ugok/patch-backend.yaml rename to apps/rfi/ugok/backend.yaml index 6565fb3..0e90c4b 100644 --- a/apps/rfi/ugok/patch-backend.yaml +++ b/apps/rfi/ugok/backend.yaml @@ -1,16 +1,96 @@ --- +# standalone HelmRelease по образцу apps/rfi/wb/backend.yaml — base +# vault-native, в ugok Vault не используется. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: rfi + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: 10.4.10.187:80/library/rfi-backend:production_d1e2e80d + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: rfi-backend-api + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: JWT_AUTH_ENABLE value: @@ -39,6 +119,7 @@ spec: - name: RABBITMQ_HOST value: _default: rabbitmq.rabbitmq.svc.cluster.local + secretEnvs: - name: DJANGO_SECRET_KEY secretName: @@ -96,3 +177,8 @@ spec: secretName: _default: rfi-rabbitmq-secret secretKey: password + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/rfi/ugok/patch-celery.yaml b/apps/rfi/ugok/celery.yaml similarity index 70% rename from apps/rfi/ugok/patch-celery.yaml rename to apps/rfi/ugok/celery.yaml index fdb550b..3e8483c 100644 --- a/apps/rfi/ugok/patch-celery.yaml +++ b/apps/rfi/ugok/celery.yaml @@ -1,21 +1,87 @@ --- +# standalone HelmRelease по образцу apps/rfi/wb/celery.yaml — base +# vault-native, в ugok Vault не используется. command/args — не +# vault-обёртка, а реальная команда запуска celery, сохранена как есть. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: celery namespace: rfi + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: celery: + enabled: true + image: name: _default: 10.4.10.187:80/library/rfi-backend:production_79888e2f + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: _default: ["uv"] args: _default: ["run", "celery", "-A", "config", "worker", "-l", "info"] + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: JWT_AUTH_ENABLE value: @@ -44,6 +110,7 @@ spec: - name: RABBITMQ_HOST value: _default: rabbitmq.rabbitmq.svc.cluster.local + secretEnvs: - name: DJANGO_SECRET_KEY secretName: @@ -101,3 +168,8 @@ spec: secretName: _default: rfi-rabbitmq-secret secretKey: password + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/rfi/ugok/frontend.yaml b/apps/rfi/ugok/frontend.yaml new file mode 100644 index 0000000..62ef90f --- /dev/null +++ b/apps/rfi/ugok/frontend.yaml @@ -0,0 +1,95 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: rfi + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: 10.4.10.187:80/library/rfi-frontend:production_b827756f_wb + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/rfi/ugok/kustomization.yaml b/apps/rfi/ugok/kustomization.yaml index 725ccb6..7e280ed 100644 --- a/apps/rfi/ugok/kustomization.yaml +++ b/apps/rfi/ugok/kustomization.yaml @@ -1,19 +1,9 @@ --- +# Не наследуем base (backend/celery vault-native) — см. комментарии в файлах. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: rfi resources: - - ../base -patches: - - path: patch-backend.yaml - target: - kind: HelmRelease - name: backend - - path: patch-celery.yaml - target: - kind: HelmRelease - name: celery - - path: patch-frontend.yaml - target: - kind: HelmRelease - name: frontend + - backend.yaml + - celery.yaml + - frontend.yaml diff --git a/apps/rfi/ugok/patch-frontend.yaml b/apps/rfi/ugok/patch-frontend.yaml deleted file mode 100644 index bcb86bf..0000000 --- a/apps/rfi/ugok/patch-frontend.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: frontend - namespace: rfi -spec: - values: - services: - frontend: - image: - name: - _default: 10.4.10.187:80/library/rfi-frontend:production_b827756f_wb diff --git a/apps/subscriptions/ugok/django-configmap.yaml b/apps/subscriptions/ugok/django-configmap.yaml new file mode 100644 index 0000000..a138911 --- /dev/null +++ b/apps/subscriptions/ugok/django-configmap.yaml @@ -0,0 +1,107 @@ +--- +# Скопировано из живого ConfigMap кластера ugok (namespace subscriptions). +# Внимание: в CORS_ALLOWED_ORIGINS зашит чужой домен test.sarex.brusnika.tech — +# копирую буквально как есть, не правлю (та же история, что с образами, +# в которых встречались чужие имена клиентов). +apiVersion: v1 +kind: ConfigMap +metadata: + name: django-configmap + namespace: subscriptions +data: + production.py: | + import os + + from .base import * + + # DEBUG SETTINGS START + # ----------------------------------------------------------------------------- + DEBUG = False + # ----------------------------------------------------------------------------- + # DEBUG SETTINGS END + + + # ALLOWED HOSTS START + # ----------------------------------------------------------------------------- + ALLOWED_HOSTS = ["*"] + # ----------------------------------------------------------------------------- + # ALLOWED HOSTS END + + # DATABASE CONFIGURATION START + # ------------------------------------------------------------------------------ + POSTGRES_DATABASE = os.getenv("DATABASE_NAME") + POSTGRES_USER = os.getenv("DATABASE_USER") + POSTGRES_PASSWORD = os.getenv("DATABASE_PASSWORD") + POSTGRES_HOST = os.getenv("DATABASE_HOST") + POSTGRES_PORT = os.getenv("DATABASE_PORT") + + DATABASES = { + "default": { + "ENGINE": "core.db.backends.postgis", + "NAME": POSTGRES_DATABASE, + "USER": POSTGRES_USER, + "PASSWORD": POSTGRES_PASSWORD, + "HOST": POSTGRES_HOST, + "PORT": POSTGRES_PORT, + } + } + # DATABASE CONFIGURATION END + # ------------------------------------------------------------------------------ + + + CORS_ALLOWED_ORIGINS = [ + "https://localhost.8000", + "https://localhost.8080", + "https://test.sarex.brusnika.tech" + ] + + CORS_ALLOW_ALL_ORIGINS = True + + CORS_ALLOW_METHODS = [ + "DELETE", + "GET", + "OPTIONS", + "PATCH", + "POST", + "PUT", + ] + + # MAILGUN START + # ------------------------------------------------------------------------------ + MAILGUN_BASE_URL = os.getenv("MAILGUN_BASE_URL", default="https://api.mailgun.net/v3/mg.sarex.io") + MAILGUN_API_KEY = os.getenv("MAILGUN_API_KEY", default="6383b2d1b300a70b3b686fa1d0f684f8-f45b080f-53294ebe") + IS_MAILGUN_USE = os.getenv("IS_MAILGUN_USE", default=False) + MAILGUN_EMAIL_FROM = os.getenv("MAILGUN_EMAIL_FROM", default="hello@sarex.io") + # ------------------------------------------------------------------------------ + # MAILGUN END + + # SYSTEM_LOG SERVICE SETTINGS START + # ----------------------------------------------------------------------------- + SYSTEM_LOG_HOST = os.getenv("SYSTEM_LOG_HOST") + # ----------------------------------------------------------------------------- + # SYSTEM_LOG SERVICE SETTINGS END + + + # TELEGRAM SETTINGS START + # ----------------------------------------------------------------------------- + IS_USE_TELEGRAM = os.getenv("IS_USE_TELEGRAM", default=False) + TELEGRAM_BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN", default="6174421650:AAGEicmX0fvDX2683LXiGweWfn1U9UTQHFY") + # ----------------------------------------------------------------------------- + # TELEGRAM SETTINGS END + + # USER SERVICE SETTINGS START + # ----------------------------------------------------------------------------- + USER_SERVICE_HOST = os.getenv("USER_SERVICE_HOST") + USER_SERVICE_LOGIN = "hagen013" + USER_SERVICE_PASSWORD = "zealot096" + # ----------------------------------------------------------------------------- + # USER SERVICE SETTINGS END + + + # SMTP + # ------------------------------------------- + SMTP_EMAIL_HOST = os.getenv("SMTP_EMAIL_HOST", default=None) + SMTP_EMAIL_PORT = os.getenv("SMTP_EMAIL_PORT", default=None) + SMTP_EMAIL_FROM = os.getenv("SMTP_EMAIL_FROM", default="hello@sarex.io") + # ------------------------------------------- + # SMTP diff --git a/apps/subscriptions/ugok/kustomization.yaml b/apps/subscriptions/ugok/kustomization.yaml index e6591b1..28ab4c2 100644 --- a/apps/subscriptions/ugok/kustomization.yaml +++ b/apps/subscriptions/ugok/kustomization.yaml @@ -1,6 +1,11 @@ --- +# subscriptions/base — сырой Deployment (не universal-chart), а wb использует +# отдельный standalone HelmRelease (apps/subscriptions/wb/backend.yaml), не +# наследуя base. Для ugok — та же схема, значения из дампа кластера. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: subscriptions resources: + - uwsgi-configmap.yaml + - django-configmap.yaml - backend.yaml diff --git a/apps/subscriptions/ugok/uwsgi-configmap.yaml b/apps/subscriptions/ugok/uwsgi-configmap.yaml new file mode 100644 index 0000000..ca0a699 --- /dev/null +++ b/apps/subscriptions/ugok/uwsgi-configmap.yaml @@ -0,0 +1,23 @@ +--- +# Скопировано из живого ConfigMap кластера ugok (namespace subscriptions). +apiVersion: v1 +kind: ConfigMap +metadata: + name: uwsgi-configmap + namespace: subscriptions +data: + uwsgi.ini: | + [uwsgi] + chdir = /server + module = config.wsgi:application + master = true + master-fifo = /opt/server/uwsgi-backend-server.fifo + processes = 8 + http = 0.0.0.0:8000 + chmod-socket = 666 + vacuum = true + harakiri = 6000 + buffer-size = 32768 + + static-map = /static=/opt/server/static/ + static-map = /media=/opt/server/media/ diff --git a/apps/system-log/ugok/patch-api.yaml b/apps/system-log/ugok/api.yaml similarity index 64% rename from apps/system-log/ugok/patch-api.yaml rename to apps/system-log/ugok/api.yaml index 743100f..393bd6c 100644 --- a/apps/system-log/ugok/patch-api.yaml +++ b/apps/system-log/ugok/api.yaml @@ -1,16 +1,95 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: api namespace: system-log + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: - api: + backend: + enabled: true + image: name: _default: 10.4.10.187:80/library/system-log:prod_08141511 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: api + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: KAFKA_ENABLE value: @@ -69,6 +148,7 @@ spec: - name: DJANGO_HOST value: _default: http://backend.django.svc.cluster.local:8000 + secretEnvs: - name: POSTGRES_USER secretName: @@ -94,3 +174,8 @@ spec: secretName: _default: yc-kafka-certificate secretKey: certificate + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/system-log/ugok/kustomization.yaml b/apps/system-log/ugok/kustomization.yaml index 17ba36b..d45aa48 100644 --- a/apps/system-log/ugok/kustomization.yaml +++ b/apps/system-log/ugok/kustomization.yaml @@ -1,15 +1,8 @@ --- +# Не наследуем base (vault-native) — см. комментарии в файлах. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: system-log resources: - - ../base -patches: - - path: patch-api.yaml - target: - kind: HelmRelease - name: api - - path: patch-worker.yaml - target: - kind: HelmRelease - name: worker + - api.yaml + - worker.yaml diff --git a/apps/system-log/ugok/patch-worker.yaml b/apps/system-log/ugok/worker.yaml similarity index 61% rename from apps/system-log/ugok/patch-worker.yaml rename to apps/system-log/ugok/worker.yaml index 7740574..5b62aba 100644 --- a/apps/system-log/ugok/patch-worker.yaml +++ b/apps/system-log/ugok/worker.yaml @@ -1,16 +1,80 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: worker namespace: system-log + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: - worker: + backend: + enabled: true + image: name: _default: 10.4.10.187:80/library/system_log_worker:de6a0147d285afa273e85c0f074c8b6049d03a32 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: worker + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: APP_NAME value: @@ -51,6 +115,7 @@ spec: - name: DJANGO_HOST value: _default: http://backend.django.svc.cluster.local:8000 + secretEnvs: - name: POSTGRES_USER secretName: @@ -68,3 +133,8 @@ spec: secretName: _default: superuser secretKey: password + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/transmittal/ugok/patch-backend.yaml b/apps/transmittal/ugok/backend.yaml similarity index 86% rename from apps/transmittal/ugok/patch-backend.yaml rename to apps/transmittal/ugok/backend.yaml index 0e6e196..3c06611 100644 --- a/apps/transmittal/ugok/patch-backend.yaml +++ b/apps/transmittal/ugok/backend.yaml @@ -1,22 +1,96 @@ --- +# standalone HelmRelease по образцу apps/transmittal/wb/backend.yaml — base +# vault-native, в ugok Vault не используется. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: transmittal + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: 10.4.10.187:80/library/transmittal-api:prod_4e0db600 - resources: - requests: - cpu: - _default: "1" - memory: - _default: 1Gi + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: "1" + memory: + _default: 1Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: TRANSMITTAL_SERVICE_APP__NAME value: @@ -210,6 +284,7 @@ spec: - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL value: _default: hello@wb.io + secretEnvs: - name: TRANSMITTAL_SERVICE_DATABASE__USER secretName: @@ -247,3 +322,8 @@ spec: secretName: _default: mailgun-cred secretKey: api_key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/transmittal/ugok/frontend.yaml b/apps/transmittal/ugok/frontend.yaml new file mode 100644 index 0000000..b886bf1 --- /dev/null +++ b/apps/transmittal/ugok/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: transmittal + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:wb1_dbf61443 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/transmittal/ugok/kustomization.yaml b/apps/transmittal/ugok/kustomization.yaml index 29d0807..a9e5e48 100644 --- a/apps/transmittal/ugok/kustomization.yaml +++ b/apps/transmittal/ugok/kustomization.yaml @@ -1,19 +1,9 @@ --- +# Не наследуем base (backend/worker vault-native) — см. комментарии в файлах. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: transmittal resources: - - ../base -patches: - - path: patch-backend.yaml - target: - kind: HelmRelease - name: backend - - path: patch-worker.yaml - target: - kind: HelmRelease - name: worker - - path: patch-frontend.yaml - target: - kind: HelmRelease - name: frontend + - backend.yaml + - worker.yaml + - frontend.yaml diff --git a/apps/transmittal/ugok/patch-frontend.yaml b/apps/transmittal/ugok/patch-frontend.yaml deleted file mode 100644 index 4c920ce..0000000 --- a/apps/transmittal/ugok/patch-frontend.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: frontend - namespace: transmittal -spec: - values: - services: - frontend: - image: - name: - _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:wb1_dbf61443 - resources: - requests: - cpu: - _default: 100m - memory: - _default: 100Mi diff --git a/apps/transmittal/ugok/patch-worker.yaml b/apps/transmittal/ugok/worker.yaml similarity index 87% rename from apps/transmittal/ugok/patch-worker.yaml rename to apps/transmittal/ugok/worker.yaml index 6a87f10..2e92d47 100644 --- a/apps/transmittal/ugok/patch-worker.yaml +++ b/apps/transmittal/ugok/worker.yaml @@ -1,25 +1,85 @@ --- +# standalone HelmRelease по образцу apps/transmittal/wb/worker.yaml — base +# vault-native, в ugok Vault не используется. command — реальная команда +# запуска taskiq-воркера (не vault-обёртка), сохранена. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: worker namespace: transmittal + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: worker: + enabled: true + image: name: _default: 10.4.10.187:80/library/transmittal-api:prod_4e0db600 + pullPolicy: + _default: IfNotPresent + deployment: + enabled: true + + name: + _default: worker + + replicaCount: + _default: 1 + + port: + _default: 8000 + command: _default: ["taskiq", "worker", "--no-parse", "transmittal_service.tasks.broker:broker", "transmittal_service.tasks.transmittal.tasks", "transmittal_service.tasks.email.tasks"] - resources: - requests: - cpu: - _default: "1" - memory: - _default: 1Gi + + resources: + requests: + cpu: + _default: "1" + memory: + _default: 1Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: TRANSMITTAL_SERVICE_APP__NAME value: @@ -213,6 +273,7 @@ spec: - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL value: _default: hello@t.io + secretEnvs: - name: TRANSMITTAL_SERVICE_DATABASE__USER secretName: @@ -250,3 +311,8 @@ spec: secretName: _default: mailgun-cred secretKey: api_key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/workspaces/ugok/patch-backend.yaml b/apps/workspaces/ugok/backend.yaml similarity index 50% rename from apps/workspaces/ugok/patch-backend.yaml rename to apps/workspaces/ugok/backend.yaml index b70df92..f4d4fe8 100644 --- a/apps/workspaces/ugok/patch-backend.yaml +++ b/apps/workspaces/ugok/backend.yaml @@ -1,16 +1,123 @@ --- +# standalone HelmRelease — base vault-native, в ugok Vault не используется. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: workspaces + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + image: name: _default: 10.4.10.187:80/library/workspaces:production_bfd943b2 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: workspaces-api + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 10 + periodSeconds: + _default: 60 + failureThreshold: + _default: 10 + readiness: + enabled: + _default: true + type: + _default: httpGet + httpGet: + path: + _default: /ping + port: + _default: 8000 + initialDelaySeconds: + _default: 5 + periodSeconds: + _default: 5 + failureThreshold: + _default: 20 + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + envs: - name: POSTGRES_POOL_SIZE value: @@ -51,6 +158,7 @@ spec: - name: DJANGO_ORIGINATOR value: _default: docs_prod + secretEnvs: - name: POSTGRES_ADDRESS secretName: @@ -76,3 +184,8 @@ spec: secretName: _default: workspaces-django-auth secretKey: key + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/workspaces/ugok/frontend.yaml b/apps/workspaces/ugok/frontend.yaml new file mode 100644 index 0000000..644607c --- /dev/null +++ b/apps/workspaces/ugok/frontend.yaml @@ -0,0 +1,90 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: workspaces + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_2a4ce3fd + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred diff --git a/apps/workspaces/ugok/kustomization.yaml b/apps/workspaces/ugok/kustomization.yaml index 1687c8a..0679093 100644 --- a/apps/workspaces/ugok/kustomization.yaml +++ b/apps/workspaces/ugok/kustomization.yaml @@ -1,15 +1,8 @@ --- +# Не наследуем base (backend vault-native) — см. комментарий в backend.yaml. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: workspaces resources: - - ../base -patches: - - path: patch-backend.yaml - target: - kind: HelmRelease - name: backend - - path: patch-frontend.yaml - target: - kind: HelmRelease - name: frontend + - backend.yaml + - frontend.yaml diff --git a/apps/workspaces/ugok/patch-frontend.yaml b/apps/workspaces/ugok/patch-frontend.yaml deleted file mode 100644 index c279545..0000000 --- a/apps/workspaces/ugok/patch-frontend.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: frontend - namespace: workspaces -spec: - values: - services: - frontend: - image: - name: - _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_2a4ce3fd