ugok: rebuild all apps as standalone HelmReleases, drop vault-native base
Root cause: apps/*/ugok extended ../base via kustomize patches, but base is vault-native (Vault Agent Injector annotations + serviceAccount + command/args wrapper sourcing /vault/secrets/*). The Vault Agent Injector webhook IS deployed cluster-wide in ugok (infrastructure/vault/ugok), so it actually intercepted these pods — but no per-app Vault roles/secrets were ever provisioned there, so every pod hung in Init. Fix, mirrored from apps/*/wb (which never extends base for these apps): rebuild every affected app as a standalone HelmRelease per service, with no serviceAccount/podAnnotations override and no vault-sourcing wrapper in command/args (dropped entirely, or replaced with the real functional command where base's wrapper did double duty — e.g. celery invocations, pm's `python manage.py migrate`, pdf-markings-amqp's `start-amqp-worker`). Also recreates ConfigMaps that were referenced by name in volumes but never actually captured into the repo (eav, subscriptions, pm, issues, django) — copied verbatim from the cluster dump and verified byte-for-byte against it. Incidental bugs found and fixed along the way: - message-hub was still extending base (missed in an earlier pass). - system-log's patches targeted services.api/services.worker while base uses services.backend for both — would have produced duplicate Deployments per release, one of them permanently vault-broken. - contracts' real container port is 8080, not base's default 8000. - drawings' Service.targetPort (8000) didn't match the real containerPort (8080), breaking routing. - inspections/ugok was missing entirely from this pass. apps/documentations: intentionally left without a redis Deployment even though VALKEY_ADDR now points at one — the cluster dump has no redis in that namespace, so provisioning one is a scope decision, not a bug fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
ivan
parent
1cab84dc7b
commit
742a811313
@ -1,16 +1,93 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/attachments/wb/backend.yaml — base
|
||||
# vault-native, а в ugok Vault не используется. Command/args/serviceAccount
|
||||
# из base не нужны и не нужны были даже вживую: реальный дамп кластера
|
||||
# показывает, что контейнер стартует штатным entrypoint'ом образа без
|
||||
# обёртки и без выделенного serviceAccount, а креды S3 монтируются
|
||||
# напрямую секретом attachments-s3-secret (не генерируются скриптом).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: attachments
|
||||
namespace: attachments
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
attachments:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: attachments
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: attachments-service
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: attachments-s3-secret
|
||||
@ -21,6 +98,7 @@ spec:
|
||||
secret:
|
||||
secretName:
|
||||
_default: attachments-s3-secret
|
||||
|
||||
envs:
|
||||
- name: POSTGRES_POOL_SIZE
|
||||
value:
|
||||
@ -43,6 +121,7 @@ spec:
|
||||
- name: YANDEX_S3_USE_SSL
|
||||
value:
|
||||
_default: "true"
|
||||
|
||||
secretEnvs:
|
||||
- name: DATABASE_HOST
|
||||
secretName:
|
||||
@ -64,3 +143,8 @@ spec:
|
||||
secretName:
|
||||
_default: attachments-postgresql-secret
|
||||
secretKey: password
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,11 +1,7 @@
|
||||
---
|
||||
# Не наследуем base (vault-native) — см. комментарий в backend.yaml.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: attachments
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: attachments
|
||||
- backend.yaml
|
||||
|
||||
@ -1,16 +1,125 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
# Образ оставлен как был в ugok (donstroi1 в wb — похоже на билд другого
|
||||
# клиента, не переносим — см. предыдущее решение).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: bim
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled:
|
||||
_default: true
|
||||
type:
|
||||
_default: httpGet
|
||||
httpGet:
|
||||
path:
|
||||
_default: /ping
|
||||
port:
|
||||
_default: 8000
|
||||
initialDelaySeconds:
|
||||
_default: 10
|
||||
periodSeconds:
|
||||
_default: 60
|
||||
failureThreshold:
|
||||
_default: 10
|
||||
readiness:
|
||||
enabled:
|
||||
_default: true
|
||||
type:
|
||||
_default: httpGet
|
||||
httpGet:
|
||||
path:
|
||||
_default: /ping
|
||||
port:
|
||||
_default: 8000
|
||||
initialDelaySeconds:
|
||||
_default: 5
|
||||
periodSeconds:
|
||||
_default: 5
|
||||
failureThreshold:
|
||||
_default: 20
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: LAST_MASTER_BIM
|
||||
value:
|
||||
@ -84,6 +193,7 @@ spec:
|
||||
- name: ENABLE_SSL
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
secretEnvs:
|
||||
- name: POSTGRES_USER
|
||||
secretName:
|
||||
@ -117,3 +227,8 @@ spec:
|
||||
secretName:
|
||||
_default: bim-postgresql-secret
|
||||
secretKey: password
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,11 +1,7 @@
|
||||
---
|
||||
# Не наследуем base (vault-native) — см. комментарий в backend.yaml.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: bim
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- backend.yaml
|
||||
|
||||
@ -1,20 +1,94 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/checklists/wb/backend.yaml — base
|
||||
# vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: checklists
|
||||
namespace: checklists
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
checklists:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/checklists-backend:production_3d148228
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_3d148228
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: checklists-backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: HTTP_APP_HOST
|
||||
value:
|
||||
_default: 0.0.0.0
|
||||
_default: "0.0.0.0"
|
||||
- name: HTTP_APP_PORT
|
||||
value:
|
||||
_default: "8000"
|
||||
@ -33,6 +107,7 @@ spec:
|
||||
- name: DEBUG
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
secretEnvs:
|
||||
- name: DATABASE_HOST
|
||||
secretName:
|
||||
@ -58,3 +133,8 @@ spec:
|
||||
secretName:
|
||||
_default: checklists-public-key
|
||||
secretKey: key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,11 +1,7 @@
|
||||
---
|
||||
# Не наследуем base (vault-native) — см. комментарий в backend.yaml.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: checklists
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: checklists
|
||||
- backend.yaml
|
||||
|
||||
@ -1,16 +1,127 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
# volumes (tasks-execution-config) убраны: в живом дампе кластера у backend
|
||||
# нет volumeMounts вообще, ни такого ConfigMap'а в namespace.
|
||||
# Образ оставлен как в ugok (в wb — другое имя репозитория образа целиком,
|
||||
# не просто тег, см. предыдущее решение по этому приложению).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: comparisons
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-backend:c864f102a3a476b9a80658148da2b3f7acb772ac
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled:
|
||||
_default: true
|
||||
type:
|
||||
_default: httpGet
|
||||
httpGet:
|
||||
path:
|
||||
_default: /ping
|
||||
port:
|
||||
_default: 8000
|
||||
initialDelaySeconds:
|
||||
_default: 10
|
||||
periodSeconds:
|
||||
_default: 60
|
||||
failureThreshold:
|
||||
_default: 10
|
||||
readiness:
|
||||
enabled:
|
||||
_default: true
|
||||
type:
|
||||
_default: httpGet
|
||||
httpGet:
|
||||
path:
|
||||
_default: /ping
|
||||
port:
|
||||
_default: 8000
|
||||
initialDelaySeconds:
|
||||
_default: 5
|
||||
periodSeconds:
|
||||
_default: 5
|
||||
failureThreshold:
|
||||
_default: 20
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-service
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: HTTP_PORT
|
||||
value:
|
||||
@ -102,6 +213,7 @@ spec:
|
||||
- name: WORKFLOWS_CONFIG_FILEPATH
|
||||
value:
|
||||
_default: /etc/app/tasks-execution-config.json
|
||||
|
||||
secretEnvs:
|
||||
- name: DATABASE_USER
|
||||
secretName:
|
||||
@ -115,3 +227,8 @@ spec:
|
||||
secretName:
|
||||
_default: public-key
|
||||
secretKey: key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
93
apps/comparisons/ugok/frontend.yaml
Normal file
93
apps/comparisons/ugok/frontend.yaml
Normal file
@ -0,0 +1,93 @@
|
||||
---
|
||||
# volumes (nginx-configmap) убраны: в живом дампе кластера у frontend нет
|
||||
# volumeMounts и такого ConfigMap'а в namespace.
|
||||
# Образ оставлен как в ugok (в wb — другое имя репозитория образа целиком).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: comparisons
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
frontend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend-static:69d50235fdc8fd654ae63308e23fc27f28e9cd99_relative
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend-service
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 80
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
@ -1,15 +1,8 @@
|
||||
---
|
||||
# Не наследуем base (backend vault-native) — см. комментарии в файлах.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: comparisons
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch-backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: patch-frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: frontend
|
||||
- backend.yaml
|
||||
- frontend.yaml
|
||||
|
||||
@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: comparisons
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend-static:69d50235fdc8fd654ae63308e23fc27f28e9cd99_relative
|
||||
100
apps/contracts/ugok/backend.yaml
Normal file
100
apps/contracts/ugok/backend.yaml
Normal file
@ -0,0 +1,100 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/contracts/wb/backend.yaml — base
|
||||
# vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: contracts
|
||||
namespace: contracts
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
contracts:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8080
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
targetPort:
|
||||
_default: 8080
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
secretEnvs:
|
||||
- name: DB_URL
|
||||
secretName:
|
||||
_default: contracts-postgresql-secret
|
||||
secretKey: url
|
||||
- name: PUBLIC_KEY
|
||||
secretName:
|
||||
_default: contracts-public-key
|
||||
secretKey: key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,11 +1,7 @@
|
||||
---
|
||||
# Не наследуем base (vault-native) — см. комментарий в backend.yaml.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: contracts
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: contracts
|
||||
- backend.yaml
|
||||
|
||||
@ -1,22 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: contracts
|
||||
namespace: contracts
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
contracts:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/contracts:prod_d3bbd9fc
|
||||
secretEnvs:
|
||||
- name: DB_URL
|
||||
secretName:
|
||||
_default: contracts-postgresql-secret
|
||||
secretKey: url
|
||||
- name: PUBLIC_KEY
|
||||
secretName:
|
||||
_default: contracts-public-key
|
||||
secretKey: key
|
||||
@ -1,18 +1,129 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
# command/args из base — только vault-обёртка (в живом дампе кластера у
|
||||
# backend command/args нет вообще), не переносим.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: django
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/backend:production_7d0ec48b
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: django-configmap
|
||||
mountPath:
|
||||
_default: /opt/sarex/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: django-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
|
||||
- name: uwsgi-configmap
|
||||
mountPath:
|
||||
_default: /opt/sarex/uwsgi.ini
|
||||
subPath:
|
||||
_default: uwsgi.ini
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: uwsgi-configmap
|
||||
items:
|
||||
- key: uwsgi.ini
|
||||
path:
|
||||
_default: uwsgi.ini
|
||||
|
||||
- name: kafka-cert-volume
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates
|
||||
@ -21,6 +132,7 @@ spec:
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-cert
|
||||
|
||||
envs:
|
||||
- name: ALLOWED_HOSTS
|
||||
value:
|
||||
@ -166,6 +278,7 @@ spec:
|
||||
- name: KC_USE_REDIRECT_LOGOUT
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
secretEnvs:
|
||||
- name: ZITADEL_ACCESS_TOKEN
|
||||
secretName:
|
||||
@ -255,3 +368,8 @@ spec:
|
||||
secretName:
|
||||
_default: sarex-s3-secret
|
||||
secretKey: secret_key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,21 +1,117 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
# command — реальная команда запуска celery из дампа кластера (не
|
||||
# vault-обёртка).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: celery
|
||||
namespace: django
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
celery:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/backend:production_7d0ec48b
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: celery
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
command:
|
||||
_default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "default", "-n", "default_worker.%h", "--concurrency=2"]
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: false
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: django-configmap
|
||||
mountPath:
|
||||
_default: /opt/sarex/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: django-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
|
||||
- name: uwsgi-configmap
|
||||
mountPath:
|
||||
_default: /opt/sarex/uwsgi.ini
|
||||
subPath:
|
||||
_default: uwsgi.ini
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: uwsgi-configmap
|
||||
items:
|
||||
- key: uwsgi.ini
|
||||
path:
|
||||
_default: uwsgi.ini
|
||||
|
||||
- name: kafka-cert-volume
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates
|
||||
@ -24,6 +120,7 @@ spec:
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-cert
|
||||
|
||||
envs:
|
||||
- name: ALLOWED_HOSTS
|
||||
value:
|
||||
@ -78,16 +175,19 @@ spec:
|
||||
_default: "1"
|
||||
- name: SERVER_API_HOST
|
||||
value:
|
||||
_default: https://sarex.ugok.la
|
||||
_default: https://ugok-sarex.uralmine.com
|
||||
- name: SERVER_HOST
|
||||
value:
|
||||
_default: https://sarex.ugok.la
|
||||
_default: https://ugok-sarex.uralmine.com
|
||||
- name: WORKFLOWS_HOST
|
||||
value:
|
||||
_default: https://sarex.ugok.la
|
||||
_default: http://workflows-api-service.workflow.svc.cluster.local:8000
|
||||
- name: WORKFLOWS_BASE_HOST
|
||||
value:
|
||||
_default: https://sarex.ugok.la
|
||||
_default: http://backend.django.svc.cluster.local:8000
|
||||
- name: WORKFLOWS_PREFIX
|
||||
value:
|
||||
_default: /internal/v1
|
||||
- name: WORKFLOWS_USE
|
||||
value:
|
||||
_default: "1"
|
||||
@ -139,6 +239,9 @@ spec:
|
||||
- name: SERVER_KAFKA_ENABLED
|
||||
value:
|
||||
_default: "True"
|
||||
- name: RESOURCES_INTERNAL_HOST
|
||||
value:
|
||||
_default: http://resources-service.resources.svc.cluster.local:8000
|
||||
- name: KAFKA_TOPICS
|
||||
value:
|
||||
_default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
|
||||
@ -166,6 +269,7 @@ spec:
|
||||
- name: KC_USE_REDIRECT_LOGOUT
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
secretEnvs:
|
||||
- name: ZITADEL_ACCESS_TOKEN
|
||||
secretName:
|
||||
@ -255,3 +359,8 @@ spec:
|
||||
secretName:
|
||||
_default: sarex-s3-secret
|
||||
secretKey: secret_key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
10
apps/django/ugok/django-configmap.yaml
Normal file
10
apps/django/ugok/django-configmap.yaml
Normal file
File diff suppressed because one or more lines are too long
122
apps/django/ugok/frontend.yaml
Normal file
122
apps/django/ugok/frontend.yaml
Normal file
@ -0,0 +1,122 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: django
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
frontend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/sarex-frontend-dev:contour_5.22.3
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 80
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: nginx-configmap
|
||||
mountPath:
|
||||
_default: /etc/nginx/nginx.conf
|
||||
subPath:
|
||||
_default: nginx.conf
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: nginx-configmap
|
||||
items:
|
||||
- key: nginx.conf
|
||||
path:
|
||||
_default: nginx.conf
|
||||
|
||||
- name: zitadel-configmap
|
||||
mountPath:
|
||||
_default: /opt/react_client/static/config.json
|
||||
subPath:
|
||||
_default: config.json
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: zitadel-configmap
|
||||
items:
|
||||
- key: config.json
|
||||
path:
|
||||
_default: config.json
|
||||
39
apps/django/ugok/kafka-cert.yaml
Normal file
39
apps/django/ugok/kafka-cert.yaml
Normal file
@ -0,0 +1,39 @@
|
||||
---
|
||||
# Скопировано из живого ConfigMap кластера ugok (namespace django).
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kafka-cert
|
||||
namespace: django
|
||||
data:
|
||||
kafka.crt: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFLTCCAxWgAwIBAgIUD6mKIbYkBT6T/cgK3Ibgm75vRrAwDQYJKoZIhvcNAQEN
|
||||
BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
|
||||
MDAeFw0yNjA0MTQwODQ1MTRaFw0yNzA0MTQwODQ1MTRaMC0xEzARBgNVBAoMCmlv
|
||||
LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
|
||||
AQUAA4ICDwAwggIKAoICAQCc9ecE59Ju5JRuGr1ConD8wPINXO9jgKdctuiwZloE
|
||||
eHYZGfLpEZY1v6CulK3xlVdK4rJRH7MA0r5G3+o7ZkGW4htaAz1zk71npiibLxC/
|
||||
2g7MQoMsfheglB8NpVpjGlbMScCJUIbWZr6UK1JUX9kAPgZBMR3E/R24nlYiygKP
|
||||
4T9EEMw0YgKFkXZl20+cH2pmaUK7219+WR/MdiQ+d+445L7DLJNYI/xn9Yoc8OQb
|
||||
A63SVK5APWwGFvXAjNqrcJpvrud3Age9CRqJ+M4Y6PTu05Pf1C6GUhLfTfsdleU6
|
||||
PsORiG/9DVc9rjDOvEk7pwrBYaK4u39BA5XBnppxHuAsxPjbnVAwGBia/3N2vLa4
|
||||
Fht4PBIDMH0KUKDRktT+rGFdg+gl1HJ/vT2Z+HqAOdW3DUCt4aY8B10/jPWHWByq
|
||||
gvRNUSJSBGeLI2Yk3pbQKerS+UOMjcmGXw8gZHSvqwEs6EAX/msSmcTS2wDbu83E
|
||||
tAXrHyriNpHilIaxlizbb7h3jXVhZX7G2o0BtPqFOsV9eo0bzUcRaf8XWqXHFoGw
|
||||
6rks0Q06HOTrARDhAG0qot8pQ6WIM8zYjPT5Jb+Wx2UbPbdLtqY+W/t9udL8Q+tW
|
||||
eL3+4oTllSeuHtCJy/UX1/GyN+O/PAXxDeEP1AmamweftXALlMhHzV/FHJjvd2L4
|
||||
rQIDAQABo0UwQzAdBgNVHQ4EFgQUlPHFj51uMcGYeqJ9bf7BRqOiWdowEgYDVR0T
|
||||
AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
|
||||
ABsb407P4GzhY1in3wwA9wB2evF4WhtuBQw4Cm1/jDFv6Yhe+qTFOM8+g8RiFJl4
|
||||
KfGLzzQWiBbZfyKdqYTSDjio2WJhdXjP+V9YVmnNBXAwdTJOUbKjKgZlo1CniC3O
|
||||
O/xzEmohC6Vkl9Ph4aGzqMivpYfiVjRzs1TeJNzPO131HOwzLUtrXEUJ5I9AWEzE
|
||||
C0QCdr38ZoXSOq+eNm7q4ANi10ElHoiUdIkgjobCu2y6m+oiaeWLhs+i/LjE93vb
|
||||
hlIzsIcJRIc5hC7QIORiR4pDuoxn/WP+41wdfUfVF7FugAaPhyF5TOJgTx0baCj9
|
||||
3gtCfcfsy6Md2U4GLXj0UIs5M//7s0pdjCrvyDOCbrZUQs8JUZ4viqIUqVGRSFjg
|
||||
5ofP1KgOIbG225T+XaXVapJETu29ggOv/ZhGm9JHZjAKi6yCUvXS2H7VWVk1Ob+e
|
||||
GAXCtCWPF8C4uM4rkNwXCYzlX4kEeGyq0PifxOlz/KDSY+5C00fK9Ke+4C3aV53v
|
||||
1NDoOaOYbObWHls3jrZ4EN08vYh9RIHmLpXCTdwwPqhHj/oJSFwN9ZHh0gW5NcYW
|
||||
etX8+dQHoVkJP7KDMgAJ3l3Bgh2qOh6bM4gmvAc4Kp7YdlslBxzGscnKbkfoQYl+
|
||||
NK4a+hSjXnk7ttSxachKb38LSZRNBA/LGUUB3t07anjZ
|
||||
-----END CERTIFICATE-----
|
||||
@ -1,41 +1,21 @@
|
||||
---
|
||||
# Не наследуем base (backend/celery/s3-proxy vault-native) — см. комментарии
|
||||
# в файлах. auth-flow-frontend.yaml/export-project.yaml/pdf-markings.yaml
|
||||
# скопированы из wb (в base для них нет HelmRelease).
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: django
|
||||
resources:
|
||||
- ../base
|
||||
- django-configmap.yaml
|
||||
- uwsgi-configmap.yaml
|
||||
- kafka-cert.yaml
|
||||
- nginx-configmap.yaml
|
||||
- zitadel-configmap.yaml
|
||||
- backend.yaml
|
||||
- celery.yaml
|
||||
- frontend.yaml
|
||||
- s3-proxy.yaml
|
||||
- srx-admin.yaml
|
||||
- auth-flow-frontend.yaml
|
||||
- export-project.yaml
|
||||
patches:
|
||||
- path: patch-backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: patch-celery.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: celery
|
||||
- path: patch-frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: frontend
|
||||
- path: patch-s3-proxy.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: s3-proxy
|
||||
- path: patch-redis-image.yaml
|
||||
target:
|
||||
kind: Deployment
|
||||
name: redis
|
||||
- path: patch-auth-flow-frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: auth-flow-frontend
|
||||
- path: patch-export-project.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: export-project
|
||||
- path: patch-srx-admin.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: srx-admin-frontend
|
||||
- redis.yaml
|
||||
|
||||
10
apps/django/ugok/nginx-configmap.yaml
Normal file
10
apps/django/ugok/nginx-configmap.yaml
Normal file
@ -0,0 +1,10 @@
|
||||
---
|
||||
# Скопировано из живого ConfigMap кластера ugok (namespace django) —
|
||||
# монтируется frontend в /etc/nginx/nginx.conf.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nginx-configmap
|
||||
namespace: django
|
||||
data:
|
||||
nginx.conf: "worker_processes auto;\n\npid /var/run/nginx.pid;\n\nevents {\n use epoll;\n worker_connections 1024;\n}\n\nhttp {\n\n # Basic Settings\n large_client_header_buffers 8 128k;\n sendfile on;\n tcp_nopush on;\n tcp_nodelay on;\n keepalive_timeout 300;\n types_hash_max_size 2048;\n client_max_body_size 5000M;\n client_header_buffer_size 5M;\n # server_tokens off;\n # server_names_hash_bucket_size 64;\n # server_name_in_redirect off;\n include /etc/nginx/mime.types;\n default_type application/octet-stream;\n\n # Logging Settings\n access_log /var/log/nginx/access.log;\n error_log /var/log/nginx/error.log;\n\n # GZIP Settings\n gzip on;\n gzip_vary on;\n gzip_proxied any;\n gzip_comp_level 6;\n gzip_buffers 16 8k;\n gzip_http_version 1.1;\n gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;\n\n log_format main '$remote_addr - $remote_user [$time_local] \"$request\" '\n '$status $body_bytes_sent \"$http_referer\" '\n '\"$http_user_agent\" \"$http_x_forwarded_for\"';\n\n server {\n listen 80;\n listen [::]:80;\n root /opt/react_client/;\n\n add_header 'Access-Control-Allow-Origin' '*' always;\n add_header 'Access-Control-Allow-Methods' '*' always;\n add_header 'Access-Control-Allow-Headers' '*' always;\n\n location = /static/index.bundle.js {\n add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';\n if_modified_since off;\n expires off;\n }\n location ~^/api/pm/ {\n proxy_set_header Host $host;\n proxy_pass http://backend-service.pm.svc.cluster.local:8000;\n }\n\n location ~^/media/ {\n rewrite ^/media/(.*)$ /$1 break;\n proxy_set_header Host $host;\n proxy_pass http://s3-proxy-service:80;\n }\n\n location ~^/api/v1/documents/ {\n rewrite /api/(.+) /$1 break;\n proxy_set_header Host $host;\n proxy_pass http://documentations-filestream.documentations.svc.cluster.local:8080;\n }\n\n location ~^/(api|admin)/ {\n proxy_set_header Host $host;\n proxy_pass http://backend:8000;\n }\n \n # location ~^/flows/static/ {\n # rewrite /flows/static/(.+) /$1 break;\n # proxy_pass http://frontend-service.flows:80;\n # }\n \n # location = ~^/orchestrator/ {\n # rewrite ^/orchestrator$ /api/ break;\n # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;\n # }\n\n # location = ~^/orchestrator/api/process {\n # rewrite ^/orchestrator/api/process$ /api/process break;\n # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;\n # }\n \n # location ~ ^/orchestrator/api/process/(.*)$ {\n # rewrite ^/orchestrator/api/process/(.*)$ /api/process/$1 break;\n # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;\n # }\n \n # location = ~^/orchestrator/api/sign {\n # rewrite ^/orchestrator/api/sign$ /api/sign break;\n # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;\n # }\n \n \n location ~^/workspaces-v2/(.+).js {\n proxy_http_version 1.1;\n proxy_set_header Host $host;\n proxy_set_header Connection \"\";\n rewrite /workspaces-v2/(.+) /$1 break;\n proxy_pass http://frontend-svc.workspaces.svc.cluster.local:8080;\n }\n\n location @index {\n add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';\n if_modified_since off;\n expires off;\n try_files /static/index.html =404;\n }\n \n location ~^/workflows/(.+).js {\n rewrite /workflows/(.+) /$1 break;\n proxy_pass http://frontend-service.workflow.svc.cluster.local:8080;\n }\n location /service-worker.js {\n try_files /static/$uri @index;\n }\n\n location / {\n try_files $uri @index;\n }\n }\n}\n"
|
||||
@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: auth-flow-frontend
|
||||
namespace: django
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
auth-flow-frontend:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/auth-flow-frontend:contour_fe9ea2a3
|
||||
@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: export-project
|
||||
namespace: django
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
export-project:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/export-project:prod_ef8aa756
|
||||
@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: django
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/sarex-frontend-dev:contour_5.22.3
|
||||
@ -1,4 +0,0 @@
|
||||
---
|
||||
- op: replace
|
||||
path: /spec/template/spec/containers/0/image
|
||||
value: 10.4.10.187:80/library/redis:latest
|
||||
@ -1,36 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: s3-proxy
|
||||
namespace: django
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
s3-proxy:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/s3-proxy:stable
|
||||
envs:
|
||||
- name: AWS_API_ENDPOINT
|
||||
value:
|
||||
_default: http://minio.minio.svc.cluster.local:9000
|
||||
- name: ACCESS_LOG
|
||||
value:
|
||||
_default: "true"
|
||||
- name: CORS_ALLOW_HEADERS
|
||||
value:
|
||||
_default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
|
||||
secretEnvs:
|
||||
- name: AWS_ACCESS_KEY_ID
|
||||
secretName:
|
||||
_default: sarex-s3-secret
|
||||
secretKey: access_key
|
||||
- name: AWS_SECRET_ACCESS_KEY
|
||||
secretName:
|
||||
_default: sarex-s3-secret
|
||||
secretKey: secret_key
|
||||
- name: AWS_S3_BUCKET
|
||||
secretName:
|
||||
_default: sarex-s3-secret
|
||||
secretKey: bucket
|
||||
@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: srx-admin-frontend
|
||||
namespace: django
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
srx-admin:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/srx-admin:prod_638c3442
|
||||
43
apps/django/ugok/redis.yaml
Normal file
43
apps/django/ugok/redis.yaml
Normal file
@ -0,0 +1,43 @@
|
||||
---
|
||||
# Скопировано из apps/django/base/redis-deployment.yaml + redis-service.yaml —
|
||||
# сырой Deployment (не universal-chart, не vault-native), перенесён в
|
||||
# standalone-оверлей, чтобы не зависеть от ../base.
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: django
|
||||
labels:
|
||||
app: redis
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: redis
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: redis
|
||||
spec:
|
||||
containers:
|
||||
- name: redis
|
||||
image: 10.4.10.187:80/library/redis:latest
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- containerPort: 6379
|
||||
protocol: TCP
|
||||
imagePullSecrets:
|
||||
- name: regcred
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: django
|
||||
spec:
|
||||
selector:
|
||||
app: redis
|
||||
ports:
|
||||
- port: 6379
|
||||
targetPort: 6379
|
||||
protocol: TCP
|
||||
109
apps/django/ugok/s3-proxy.yaml
Normal file
109
apps/django/ugok/s3-proxy.yaml
Normal file
@ -0,0 +1,109 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: s3-proxy
|
||||
namespace: django
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
s3-proxy:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: s3-proxy
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: s3-proxy-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 80
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: AWS_API_ENDPOINT
|
||||
value:
|
||||
_default: http://minio.minio.svc.cluster.local:9000
|
||||
- name: ACCESS_LOG
|
||||
value:
|
||||
_default: "true"
|
||||
- name: CORS_ALLOW_HEADERS
|
||||
value:
|
||||
_default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
|
||||
|
||||
secretEnvs:
|
||||
- name: AWS_ACCESS_KEY_ID
|
||||
secretName:
|
||||
_default: sarex-s3-secret
|
||||
secretKey: access_key
|
||||
- name: AWS_SECRET_ACCESS_KEY
|
||||
secretName:
|
||||
_default: sarex-s3-secret
|
||||
secretKey: secret_key
|
||||
- name: AWS_S3_BUCKET
|
||||
secretName:
|
||||
_default: sarex-s3-secret
|
||||
secretKey: bucket
|
||||
90
apps/django/ugok/srx-admin.yaml
Normal file
90
apps/django/ugok/srx-admin.yaml
Normal file
@ -0,0 +1,90 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: srx-admin-frontend
|
||||
namespace: django
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
srx-admin:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_638c3442
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: srx-admin-frontend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: srx-admin-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 80
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
9
apps/django/ugok/uwsgi-configmap.yaml
Normal file
9
apps/django/ugok/uwsgi-configmap.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
---
|
||||
# Скопировано из живого ConfigMap кластера ugok (namespace django).
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: uwsgi-configmap
|
||||
namespace: django
|
||||
data:
|
||||
uwsgi.ini: "[uwsgi]\r\nmodule = config.wsgi:application\r\nDJANGO_SETTINGS_MODULE = config.settings.production\r\nhttp = 0.0.0.0:8000\r\nprocesses = 16\r\nmaster = true\r\nvacuum = true\r\nenable-threads = true\r\nbuffer-size = 65535\r\nstats = :3031\r\nstats-http = true\r\nmemory-report = true\r\nlazy-apps = true\r\nlisten = 128\r\ndisable-write-exception= 0\r\nharakiri = 300\r\nsocket-timeout = 300\r\nchunked-input-timeout = 300\r\nhttp-timeout = 300\r\nworker-reload-mercy = 240\r\nmule-reload-mercy = 240\r\nstatic-map = /static=/opt/sarex/sarex/static/\r\nstatic-map = /media=/media/\r\n"
|
||||
17
apps/django/ugok/zitadel-configmap.yaml
Normal file
17
apps/django/ugok/zitadel-configmap.yaml
Normal file
@ -0,0 +1,17 @@
|
||||
---
|
||||
# Скопировано из живого ConfigMap кластера ugok (namespace django) —
|
||||
# монтируется frontend в /opt/react_client/static/config.json.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: zitadel-configmap
|
||||
namespace: django
|
||||
data:
|
||||
config.json: |-
|
||||
{
|
||||
"auth_type": "zitadel",
|
||||
"zitadel": {
|
||||
"client_id": "368538787334147872",
|
||||
"host": "https://ugok-zitadel-sarex.uralmine.com"
|
||||
}
|
||||
}
|
||||
@ -1,16 +1,97 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
# Кастомный тег UGOK_4bf15a64 оставлен как есть (не как в wb — см.
|
||||
# предыдущее решение по этому приложению).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: documentations-api
|
||||
namespace: documentations
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations:UGOK_4bf15a64
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: documentations-api
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8080
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-api-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8080
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: POSTGRES_ADDRESS
|
||||
value:
|
||||
@ -156,6 +237,7 @@ spec:
|
||||
- name: VALKEY_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
|
||||
secretEnvs:
|
||||
- name: PUBLIC_KEY
|
||||
secretName:
|
||||
@ -181,3 +263,8 @@ spec:
|
||||
secretName:
|
||||
_default: django-auth
|
||||
secretKey: key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,16 +1,96 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
# Кастомный тег prod_dfaa58f7_ugok оставлен как есть (не как в wb).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: documentations-filestream
|
||||
namespace: documentations
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_dfaa58f7_ugok
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: documentations-filestream
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8080
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-filestream-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8080
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: POSTGRES_ADDRESS
|
||||
value:
|
||||
@ -126,6 +206,7 @@ spec:
|
||||
- name: VALKEY_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
|
||||
secretEnvs:
|
||||
- name: DJANGO_BASIC_AUTH_FOR_GET_USER
|
||||
secretName:
|
||||
@ -151,3 +232,8 @@ spec:
|
||||
secretName:
|
||||
_default: public-key
|
||||
secretKey: key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
91
apps/documentations/ugok/frontend.yaml
Normal file
91
apps/documentations/ugok/frontend.yaml
Normal file
@ -0,0 +1,91 @@
|
||||
---
|
||||
# Образ оставлен как в ugok (в wb тоже brusnika_-тег — см. предыдущее решение).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: documentations
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
frontend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_5a4e4adc
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 80
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
@ -1,32 +1,15 @@
|
||||
---
|
||||
# Не наследуем base (api/filestream/pdm/pdf-markings-amqp vault-native) —
|
||||
# см. комментарии в файлах. pdf-markings.yaml — standalone файл, скопирован
|
||||
# из apps/documentations/wb/pdf-markings.yaml (в base для этого сервиса нет
|
||||
# HelmRelease).
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: documentations
|
||||
resources:
|
||||
- ../base
|
||||
- api.yaml
|
||||
- filestream.yaml
|
||||
- pdm.yaml
|
||||
- pdf-markings-amqp.yaml
|
||||
- pdf-markings.yaml
|
||||
patches:
|
||||
- path: patch-api.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: documentations-api
|
||||
- path: patch-filestream.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: documentations-filestream
|
||||
- path: patch-frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: frontend
|
||||
- path: patch-pdf-markings-amqp.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: documentations-pdf-markings-amqp
|
||||
- path: patch-pdf-markings.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: pdf-markings
|
||||
- path: patch-pdm.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: pdm-api
|
||||
- frontend.yaml
|
||||
|
||||
@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: documentations
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_5a4e4adc
|
||||
@ -1,113 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: pdf-markings
|
||||
namespace: documentations
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
pdf-markings:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/pdf-markings:prod_7d892636
|
||||
envs:
|
||||
- name: APP_NAME
|
||||
value:
|
||||
_default: pdm_v2
|
||||
- name: VERIFY
|
||||
value:
|
||||
_default: "False"
|
||||
- name: APP_VERSION
|
||||
value:
|
||||
_default: 0.0.1
|
||||
- name: LOG_LEVEL
|
||||
value:
|
||||
_default: INFO
|
||||
- name: HTTP_PORT
|
||||
value:
|
||||
_default: "8000"
|
||||
- name: DOC_POSTGRES_HOST
|
||||
value:
|
||||
_default: postgres-service
|
||||
- name: DOC_POSTGRES_PORT
|
||||
value:
|
||||
_default: "5432"
|
||||
- name: DOC_POSTGRES_DB
|
||||
value:
|
||||
_default: documentations_db
|
||||
- name: DOC_POSTGRES_POOL_SIZE
|
||||
value:
|
||||
_default: "10"
|
||||
- name: DOC_POSTGRES_SSL_MODE
|
||||
value:
|
||||
_default: disable
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: 0.0.0.0:8000
|
||||
- name: DATABASE_SSL_MODE
|
||||
value:
|
||||
_default: disable
|
||||
- name: YANDEX_S3_USE_SSL
|
||||
value:
|
||||
_default: "0"
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
_default: production
|
||||
- name: YANDEX_S3_ACCOUNT_PATH
|
||||
value:
|
||||
_default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
|
||||
- name: REDIRECT_URL_QR
|
||||
value:
|
||||
_default: https://stamp-verification.sarex.ugok.lan/
|
||||
- name: BASE_DOCUMENT_URL
|
||||
value:
|
||||
_default: https://sarex.ugok.lan
|
||||
- name: SENTRY_DSN
|
||||
value:
|
||||
_default: ""
|
||||
secretEnvs:
|
||||
- name: DOC_POSTGRES_USER
|
||||
secretName:
|
||||
_default: documentations-postgresql-secret
|
||||
secretKey: username
|
||||
- name: DOC_POSTGRES_PASSWORD
|
||||
secretName:
|
||||
_default: documentations-postgresql-secret
|
||||
secretKey: password
|
||||
- name: YANDEX_S3_ENDPOINT_URL
|
||||
secretName:
|
||||
_default: documentations-s3-secret
|
||||
secretKey: endpoint
|
||||
- name: YANDEX_S3_SECRET_ACCESS_KEY
|
||||
secretName:
|
||||
_default: documentations-s3-secret
|
||||
secretKey: secret_key
|
||||
- name: YANDEX_S3_ACCESS_KEY_ID
|
||||
secretName:
|
||||
_default: documentations-s3-secret
|
||||
secretKey: access_key
|
||||
- name: RABBITMQ_HOST
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: host
|
||||
- name: RABBITMQ_PORT
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: port
|
||||
- name: RABBITMQ_USERNAME
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: username
|
||||
- name: RABBITMQ_PASSWORD
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: password
|
||||
- name: RABBITMQ_VHOST
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: vhost
|
||||
- name: RABBITMQ_HEARTBEAT
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: heartbeat
|
||||
@ -1,16 +1,104 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
# Образ/env НЕ трогаем (см. предыдущее решение — версия несовместима с wb).
|
||||
# command/args сохранены: "start-amqp-worker" — реальный режим запуска
|
||||
# этого образа, не vault-обёртка.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: documentations-pdf-markings-amqp
|
||||
namespace: documentations
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/pdf-markings-amqp:prod_53ebb837
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: pdf-markings-amqp
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
command:
|
||||
_default: ["/bin/sh", "-ec"]
|
||||
args:
|
||||
_default:
|
||||
- start-amqp-worker
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: marks-service
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: APP_NAME
|
||||
value:
|
||||
@ -63,6 +151,7 @@ spec:
|
||||
- name: BASE_DOCUMENT_URL
|
||||
value:
|
||||
_default: https://ugok-sarex.uralmine.com
|
||||
|
||||
secretEnvs:
|
||||
- name: DOC_POSTGRES_USER
|
||||
secretName:
|
||||
@ -108,3 +197,8 @@ spec:
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: heartbeat
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,8 +1,6 @@
|
||||
---
|
||||
# Скопировано из apps/documentations/wb/pdf-markings.yaml — в base для этого
|
||||
# сервиса нет HelmRelease (только documentations-pdf-markings-amqp), а из другого
|
||||
# оверлея (wb) kustomize напрямую ссылаться не даёт (вне дерева каталога).
|
||||
# Значения ниже перекрыты патчем patch-pdf-markings.yaml под дамп ugok.
|
||||
# Скопировано из apps/documentations/wb/pdf-markings.yaml (в base для этого
|
||||
# сервиса нет HelmRelease), env/secretEnvs — из дампа кластера ugok.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
@ -40,7 +38,7 @@ spec:
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/pdf-markings:prod_7d892636
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings:prod_7d892636
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
@ -97,6 +95,108 @@ spec:
|
||||
secretName:
|
||||
_default: documentations-yc-s3
|
||||
|
||||
envs:
|
||||
- name: APP_NAME
|
||||
value:
|
||||
_default: pdm_v2
|
||||
- name: VERIFY
|
||||
value:
|
||||
_default: "False"
|
||||
- name: APP_VERSION
|
||||
value:
|
||||
_default: 0.0.1
|
||||
- name: LOG_LEVEL
|
||||
value:
|
||||
_default: INFO
|
||||
- name: HTTP_PORT
|
||||
value:
|
||||
_default: "8000"
|
||||
- name: DOC_POSTGRES_HOST
|
||||
value:
|
||||
_default: postgres-service
|
||||
- name: DOC_POSTGRES_PORT
|
||||
value:
|
||||
_default: "5432"
|
||||
- name: DOC_POSTGRES_DB
|
||||
value:
|
||||
_default: documentations_db
|
||||
- name: DOC_POSTGRES_POOL_SIZE
|
||||
value:
|
||||
_default: "10"
|
||||
- name: DOC_POSTGRES_SSL_MODE
|
||||
value:
|
||||
_default: disable
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: 0.0.0.0:8000
|
||||
- name: DATABASE_SSL_MODE
|
||||
value:
|
||||
_default: disable
|
||||
- name: YANDEX_S3_USE_SSL
|
||||
value:
|
||||
_default: "0"
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
_default: production
|
||||
- name: YANDEX_S3_ACCOUNT_PATH
|
||||
value:
|
||||
_default: /etc/sarex/yc-s3-storage/yc-s3-service-account.json
|
||||
- name: REDIRECT_URL_QR
|
||||
value:
|
||||
_default: https://stamp-verification.sarex.ugok.lan/
|
||||
- name: BASE_DOCUMENT_URL
|
||||
value:
|
||||
_default: https://sarex.ugok.lan
|
||||
- name: SENTRY_DSN
|
||||
value:
|
||||
_default: ""
|
||||
|
||||
secretEnvs:
|
||||
- name: DOC_POSTGRES_USER
|
||||
secretName:
|
||||
_default: documentations-postgresql-secret
|
||||
secretKey: username
|
||||
- name: DOC_POSTGRES_PASSWORD
|
||||
secretName:
|
||||
_default: documentations-postgresql-secret
|
||||
secretKey: password
|
||||
- name: YANDEX_S3_ENDPOINT_URL
|
||||
secretName:
|
||||
_default: documentations-s3-secret
|
||||
secretKey: endpoint
|
||||
- name: YANDEX_S3_SECRET_ACCESS_KEY
|
||||
secretName:
|
||||
_default: documentations-s3-secret
|
||||
secretKey: secret_key
|
||||
- name: YANDEX_S3_ACCESS_KEY_ID
|
||||
secretName:
|
||||
_default: documentations-s3-secret
|
||||
secretKey: access_key
|
||||
- name: RABBITMQ_HOST
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: host
|
||||
- name: RABBITMQ_PORT
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: port
|
||||
- name: RABBITMQ_USERNAME
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: username
|
||||
- name: RABBITMQ_PASSWORD
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: password
|
||||
- name: RABBITMQ_VHOST
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: vhost
|
||||
- name: RABBITMQ_HEARTBEAT
|
||||
secretName:
|
||||
_default: documentations-rabbitmq-secret
|
||||
secretKey: heartbeat
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
|
||||
@ -1,16 +1,95 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: pdm-api
|
||||
namespace: documentations
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/pdmv2:prod_9507c2d5
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: pdm-api
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8080
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: pdm-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8080
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: USE_EXPERIMENTAL
|
||||
value:
|
||||
@ -177,6 +256,7 @@ spec:
|
||||
- name: NOTES_URL
|
||||
value:
|
||||
_default: ""
|
||||
|
||||
secretEnvs:
|
||||
- name: RELEASES_TOKEN
|
||||
secretName:
|
||||
@ -198,3 +278,8 @@ spec:
|
||||
secretName:
|
||||
_default: public-key
|
||||
secretKey: key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
122
apps/drawings/ugok/backend.yaml
Normal file
122
apps/drawings/ugok/backend.yaml
Normal file
@ -0,0 +1,122 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/drawings/wb/backend.yaml — base
|
||||
# vault-native, в ugok Vault не используется.
|
||||
# targetPort сервиса исправлен на 8080 (реальный containerPort из дампа
|
||||
# кластера) — в base он ошибочно указан как 8000, что не совпадает с
|
||||
# портом контейнера и делает Service нерабочим.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: drawings
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/drawings-api:015e68e1b2a3dcc13f0b405e1f761b154a825d24
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8080
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-service
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
targetPort:
|
||||
_default: 8080
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: POSTGRES_POOL_SIZE
|
||||
value:
|
||||
_default: "3"
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: 0.0.0.0:8000
|
||||
- name: ENABLE_SSL
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
secretEnvs:
|
||||
- name: POSTGRES_USER
|
||||
secretName:
|
||||
_default: drawings-postgresql-secret
|
||||
secretKey: username
|
||||
- name: POSTGRES_PASSWORD
|
||||
secretName:
|
||||
_default: drawings-postgresql-secret
|
||||
secretKey: password
|
||||
- name: POSTGRES_ADDRESS
|
||||
secretName:
|
||||
_default: drawings-postgresql-secret
|
||||
secretKey: host
|
||||
- name: POSTGRES_DB
|
||||
secretName:
|
||||
_default: drawings-postgresql-secret
|
||||
secretKey: database
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,11 +1,7 @@
|
||||
---
|
||||
# Не наследуем base (vault-native) — см. комментарий в backend.yaml.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: drawings
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- backend.yaml
|
||||
|
||||
@ -1,40 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: drawings
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/drawings-api:015e68e1b2a3dcc13f0b405e1f761b154a825d24
|
||||
envs:
|
||||
- name: POSTGRES_POOL_SIZE
|
||||
value:
|
||||
_default: "3"
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: 0.0.0.0:8000
|
||||
- name: ENABLE_SSL
|
||||
value:
|
||||
_default: "0"
|
||||
secretEnvs:
|
||||
- name: POSTGRES_USER
|
||||
secretName:
|
||||
_default: drawings-postgresql-secret
|
||||
secretKey: username
|
||||
- name: POSTGRES_PASSWORD
|
||||
secretName:
|
||||
_default: drawings-postgresql-secret
|
||||
secretKey: password
|
||||
- name: POSTGRES_ADDRESS
|
||||
secretName:
|
||||
_default: drawings-postgresql-secret
|
||||
secretKey: host
|
||||
- name: POSTGRES_DB
|
||||
secretName:
|
||||
_default: drawings-postgresql-secret
|
||||
secretKey: database
|
||||
207
apps/eav/ugok/backend.yaml
Normal file
207
apps/eav/ugok/backend.yaml
Normal file
@ -0,0 +1,207 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/eav/wb/backend.yaml — base
|
||||
# vault-native (secretEnvs через Vault Agent), а в ugok Vault вообще не
|
||||
# используется ни одним приложением (см. apps/eav/wb — тот же принцип),
|
||||
# поэтому не наследуем base, а собираем отдельный HelmRelease с обычными
|
||||
# secretEnvs, без serviceAccount/podAnnotations/vault-обёртки в command/args.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: eav
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/eav:prod_0dcebba6
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled:
|
||||
_default: true
|
||||
type:
|
||||
_default: tcpSocket
|
||||
tcpSocket:
|
||||
port:
|
||||
_default: 8000
|
||||
initialDelaySeconds:
|
||||
_default: 20
|
||||
periodSeconds:
|
||||
_default: 30
|
||||
timeoutSeconds:
|
||||
_default: 3
|
||||
failureThreshold:
|
||||
_default: 5
|
||||
readiness:
|
||||
enabled:
|
||||
_default: true
|
||||
type:
|
||||
_default: tcpSocket
|
||||
tcpSocket:
|
||||
port:
|
||||
_default: 8000
|
||||
initialDelaySeconds:
|
||||
_default: 10
|
||||
periodSeconds:
|
||||
_default: 10
|
||||
timeoutSeconds:
|
||||
_default: 3
|
||||
failureThreshold:
|
||||
_default: 6
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: django-configmap
|
||||
mountPath:
|
||||
_default: /server/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: django-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
|
||||
envs:
|
||||
- name: KAFKA_ENABLED
|
||||
value:
|
||||
_default: "False"
|
||||
- name: ASSETS_TOPIC
|
||||
value:
|
||||
_default: sarex
|
||||
- name: DJANGO_SETTINGS_MODULE
|
||||
value:
|
||||
_default: config.settings.production
|
||||
- name: DJANGO_POSTGRES_HOST
|
||||
value:
|
||||
_default: postgres-service
|
||||
- name: DJANGO_POSTGRES_DATABASE
|
||||
value:
|
||||
_default: eav_db
|
||||
- name: YC_S3_ENDPOINT_URL
|
||||
value:
|
||||
_default: http://minio.minio.svc.cluster.local:9000
|
||||
- name: YC_S3_BUCKET_NAME
|
||||
value:
|
||||
_default: eav
|
||||
- name: KAFKA_USERNAME
|
||||
value:
|
||||
_default: sarex
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
- name: KAFKA_HOST
|
||||
value:
|
||||
_default: ugok-prod-kafka-bootstrap.kafka.svc.cluster.local:9093
|
||||
|
||||
secretEnvs:
|
||||
- name: DJANGO_POSTGRES_USER
|
||||
secretName:
|
||||
_default: eav-postgresql-secret
|
||||
secretKey: username
|
||||
- name: DJANGO_POSTGRES_PASSWORD
|
||||
secretName:
|
||||
_default: eav-postgresql-secret
|
||||
secretKey: password
|
||||
- name: JWT_PRIVATE_KEY
|
||||
secretName:
|
||||
_default: backend-secret
|
||||
secretKey: ssh_private.key
|
||||
- name: JWT_PUBLIC_KEY
|
||||
secretName:
|
||||
_default: backend-secret
|
||||
secretKey: ssh_public.key
|
||||
- name: YC_S3_ACCESS_KEY_ID
|
||||
secretName:
|
||||
_default: eav-s3-secret
|
||||
secretKey: secret_key
|
||||
- name: YC_S3_SECRET_ACCESS_KEY
|
||||
secretName:
|
||||
_default: eav-s3-secret
|
||||
secretKey: access_key
|
||||
- name: KAFKA_PASSWORD
|
||||
secretName:
|
||||
_default: kafka-cred
|
||||
secretKey: password
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
156
apps/eav/ugok/django-configmap.yaml
Normal file
156
apps/eav/ugok/django-configmap.yaml
Normal file
@ -0,0 +1,156 @@
|
||||
---
|
||||
# Скопировано из живого ConfigMap кластера ugok (namespace eav) —
|
||||
# монтируется backend'ом в /server/config/settings/production.py.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: django-configmap
|
||||
namespace: eav
|
||||
data:
|
||||
production.py: |
|
||||
# production.py
|
||||
|
||||
from .base import *
|
||||
from datetime import timedelta
|
||||
import os
|
||||
from django.core.exceptions import ImproperlyConfigured
|
||||
|
||||
INSTALLED_APPS.append("corsheaders")
|
||||
MIDDLEWARE = ["corsheaders.middleware.CorsMiddleware"] + MIDDLEWARE
|
||||
|
||||
# DEBUG SETTINGS START
|
||||
# ---
|
||||
|
||||
DEBUG = True
|
||||
ALLOWED_HOSTS = ['*']
|
||||
# ---
|
||||
|
||||
# DEBUG SETTINGS END
|
||||
|
||||
# DATABASE SETTINGS START
|
||||
# ---
|
||||
|
||||
DATABASES = {
|
||||
"default": {
|
||||
"ENGINE": "django.db.backends.postgresql",
|
||||
"NAME": os.getenv("DJANGO_POSTGRES_DATABASE"),
|
||||
"USER": os.getenv("DJANGO_POSTGRES_USER"),
|
||||
"PASSWORD": os.getenv("DJANGO_POSTGRES_PASSWORD"),
|
||||
"HOST": os.getenv("DJANGO_POSTGRES_HOST"),
|
||||
"PORT": "5432",
|
||||
}
|
||||
}
|
||||
# ---
|
||||
|
||||
# DATABASE SETTINGS END
|
||||
|
||||
# RESPONSE HEADERS START
|
||||
# ---
|
||||
|
||||
CORS_ORIGIN_ALLOW_ALL = True
|
||||
|
||||
CORS_ALLOWED_ORIGINS = [
|
||||
"http://sarex.ugok.lan","https://sarex.ugok.lan"
|
||||
]
|
||||
|
||||
CORS_TRUSTED_ORIGINS = [
|
||||
"http://sarex.ugok.lan","https://sarex.ugok.lan"
|
||||
]
|
||||
|
||||
CSRF_TRUSTED_ORIGINS = [
|
||||
"http://sarex.ugok.lan","https://sarex.ugok.lan"
|
||||
]
|
||||
|
||||
CORS_ALLOW_METHODS = (
|
||||
'DELETE',
|
||||
'GET',
|
||||
'OPTIONS',
|
||||
'PATCH',
|
||||
'POST',
|
||||
'PUT',
|
||||
)
|
||||
|
||||
CORS_ALLOW_HEADERS = (
|
||||
'accept',
|
||||
'accept-encoding',
|
||||
'authorization',
|
||||
'content-type',
|
||||
'user-agent',
|
||||
'x-csrftoken',
|
||||
'x-requested-with',
|
||||
'x-token',
|
||||
'Bearer'
|
||||
)
|
||||
# ---
|
||||
|
||||
# RESPONSE HEADERS END
|
||||
|
||||
REST_FRAMEWORK = {
|
||||
"DEFAULT_PAGINATION_CLASS": (
|
||||
"rest_framework.pagination.LimitOffsetPagination"
|
||||
),
|
||||
"DEFAULT_SCHEMA_CLASS": "rest_framework.schemas.coreapi.AutoSchema",
|
||||
"PAGE_SIZE": 10000,
|
||||
"DEFAULT_FILTER_BACKENDS": [
|
||||
"django_filters.rest_framework.DjangoFilterBackend"
|
||||
],
|
||||
"DEFAULT_AUTHENTICATION_CLASSES": [
|
||||
# "rest_framework_simplejwt.authentication.JWTAuthentication",
|
||||
"rest_framework.authentication.SessionAuthentication",
|
||||
"rest_framework.authentication.BasicAuthentication",
|
||||
],
|
||||
"DEFAULT_PERMISSION_CLASSES": [
|
||||
"rest_framework.permissions.AllowAny",
|
||||
]
|
||||
}
|
||||
|
||||
# JWT SETTINGS START
|
||||
# ---
|
||||
|
||||
def get_env_variable(var_name, default=None):
|
||||
try:
|
||||
return os.getenv(var_name, default)
|
||||
except KeyError:
|
||||
error_msg = f"Set the {var_name} environment variable"
|
||||
if default:
|
||||
return default
|
||||
raise ImproperlyConfigured(error_msg)
|
||||
|
||||
SIMPLE_JWT_ISSUER = get_env_variable("SIMPLE_JWT_ISSUER", default="django")
|
||||
|
||||
SIMPLE_JWT = {
|
||||
"ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
|
||||
"REFRESH_TOKEN_LIFETIME": timedelta(days=1),
|
||||
"ROTATE_REFRESH_TOKENS": False,
|
||||
"UPDATE_LAST_LOGIN": False,
|
||||
|
||||
"ALGORITHM": "RS512",
|
||||
"SIGNING_KEY": get_env_variable("JWT_PRIVATE_KEY").replace("\\\n", "\n"),
|
||||
"VERIFYING_KEY": get_env_variable("JWT_PUBLIC_KEY").replace("\\\n", "\n"),
|
||||
"AUDIENCE": None,
|
||||
"ISSUER": SIMPLE_JWT_ISSUER,
|
||||
|
||||
"AUTH_HEADER_TYPES": ("Bearer",),
|
||||
"AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
|
||||
"USER_ID_FIELD": "id",
|
||||
"USER_ID_CLAIM": "user_id",
|
||||
|
||||
"AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
|
||||
"TOKEN_TYPE_CLAIM": "token_type",
|
||||
|
||||
"JTI_CLAIM": "jti",
|
||||
|
||||
"SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp",
|
||||
"SLIDING_TOKEN_LIFETIME": timedelta(minutes=5),
|
||||
"SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1),
|
||||
}
|
||||
# ---
|
||||
|
||||
# JWT SETTINGS END
|
||||
|
||||
STATIC_ROOT = '/static/'
|
||||
STATIC_URL = '/static/'
|
||||
STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.StaticFilesStorage'
|
||||
|
||||
SESSION_COOKIE_NAME = 'eav-sessionid'
|
||||
CSRF_COOKIE_NAME = 'eav-csrftoken'
|
||||
@ -1,11 +1,9 @@
|
||||
---
|
||||
# Не наследуем base (vault-native) — см. комментарий в backend.yaml.
|
||||
# Структура зеркалит apps/eav/wb/kustomization.yaml.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: eav
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- django-configmap.yaml
|
||||
- backend.yaml
|
||||
|
||||
@ -1,87 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: eav
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/eav:prod_0dcebba6
|
||||
volumes:
|
||||
_default:
|
||||
- name: django-configmap
|
||||
mountPath:
|
||||
_default: /server/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
configMap:
|
||||
name:
|
||||
_default: django-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
envs:
|
||||
- name: KAFKA_ENABLED
|
||||
value:
|
||||
_default: "False"
|
||||
- name: ASSETS_TOPIC
|
||||
value:
|
||||
_default: sarex
|
||||
- name: DJANGO_SETTINGS_MODULE
|
||||
value:
|
||||
_default: config.settings.production
|
||||
- name: DJANGO_POSTGRES_HOST
|
||||
value:
|
||||
_default: postgres-service
|
||||
- name: DJANGO_POSTGRES_DATABASE
|
||||
value:
|
||||
_default: eav_db
|
||||
- name: YC_S3_ENDPOINT_URL
|
||||
value:
|
||||
_default: http://minio.minio.svc.cluster.local:9000
|
||||
- name: YC_S3_BUCKET_NAME
|
||||
value:
|
||||
_default: eav
|
||||
- name: KAFKA_USERNAME
|
||||
value:
|
||||
_default: sarex
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
- name: KAFKA_HOST
|
||||
value:
|
||||
_default: ugok-prod-kafka-bootstrap.kafka.svc.cluster.local:9093
|
||||
secretEnvs:
|
||||
- name: DJANGO_POSTGRES_USER
|
||||
secretName:
|
||||
_default: eav-postgresql-secret
|
||||
secretKey: username
|
||||
- name: DJANGO_POSTGRES_PASSWORD
|
||||
secretName:
|
||||
_default: eav-postgresql-secret
|
||||
secretKey: password
|
||||
- name: JWT_PRIVATE_KEY
|
||||
secretName:
|
||||
_default: backend-secret
|
||||
secretKey: ssh_private.key
|
||||
- name: JWT_PUBLIC_KEY
|
||||
secretName:
|
||||
_default: backend-secret
|
||||
secretKey: ssh_public.key
|
||||
- name: YC_S3_ACCESS_KEY_ID
|
||||
secretName:
|
||||
_default: eav-s3-secret
|
||||
secretKey: secret_key
|
||||
- name: YC_S3_SECRET_ACCESS_KEY
|
||||
secretName:
|
||||
_default: eav-s3-secret
|
||||
secretKey: access_key
|
||||
- name: KAFKA_PASSWORD
|
||||
secretName:
|
||||
_default: kafka-cred
|
||||
secretKey: password
|
||||
@ -1,16 +1,95 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: flows
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/flows-backend:production_a7dc8216
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: LOG_LEVEL
|
||||
value:
|
||||
@ -114,6 +193,7 @@ spec:
|
||||
- name: PROXY_PATH_PREFIX
|
||||
value:
|
||||
_default: /flows
|
||||
|
||||
secretEnvs:
|
||||
- name: KAFKA_USERNAME
|
||||
secretName:
|
||||
@ -167,3 +247,8 @@ spec:
|
||||
secretName:
|
||||
_default: flows-rabbitmq-secret
|
||||
secretKey: vhost
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,16 +1,84 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
# command — реальная команда запуска celery (не vault-обёртка).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: celery
|
||||
namespace: flows
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
celery:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/flows-backend_worker:production_a7dc8216
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: celery
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
command:
|
||||
_default: ["celery", "-A", "src.worker", "worker", "-l", "INFO", "-E", "--concurrency=1", "-Q", "flow"]
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: false
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: LOG_LEVEL
|
||||
value:
|
||||
@ -108,6 +176,7 @@ spec:
|
||||
- name: DJANGO_BASE_HOST
|
||||
value:
|
||||
_default: https://ugok-sarex.uralmine.com
|
||||
|
||||
secretEnvs:
|
||||
- name: FLOWS_DB_DB
|
||||
secretName:
|
||||
@ -177,3 +246,8 @@ spec:
|
||||
secretName:
|
||||
_default: flows-rabbitmq-secret
|
||||
secretKey: vhost
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
90
apps/flows/ugok/frontend.yaml
Normal file
90
apps/flows/ugok/frontend.yaml
Normal file
@ -0,0 +1,90 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: flows
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
frontend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_dcc5b5e6
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 80
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
@ -1,19 +1,9 @@
|
||||
---
|
||||
# Не наследуем base (backend/celery vault-native) — см. комментарии в файлах.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: flows
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch-backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: patch-celery.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: celery
|
||||
- path: patch-frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: frontend
|
||||
- backend.yaml
|
||||
- celery.yaml
|
||||
- frontend.yaml
|
||||
|
||||
@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: flows
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/flows-frontend:contour_dcc5b5e6
|
||||
@ -1,16 +1,96 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/inspections/wb/backend.yaml — base
|
||||
# vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: inspections
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/sarex-inspections:production_1a33f6f4
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: inspections-backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: sarex-inspections-service
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: DEBUG
|
||||
value:
|
||||
@ -62,7 +142,7 @@ spec:
|
||||
_default: "30"
|
||||
- name: WORKFLOWS_URL
|
||||
value:
|
||||
_default: http://workflows-service.processing-prod
|
||||
_default: http://workflows-service.workflow
|
||||
- name: WORKFLOWS_TIMEOUT
|
||||
value:
|
||||
_default: "30"
|
||||
@ -84,6 +164,7 @@ spec:
|
||||
- name: MAILER_TIMEOUT
|
||||
value:
|
||||
_default: "30"
|
||||
|
||||
secretEnvs:
|
||||
- name: DATABASE_USER
|
||||
secretName:
|
||||
@ -121,3 +202,8 @@ spec:
|
||||
secretName:
|
||||
_default: sarex-backend-auth-secret
|
||||
secretKey: key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,11 +1,7 @@
|
||||
---
|
||||
# Не наследуем base (vault-native) — см. комментарий в backend.yaml.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: inspections
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- backend.yaml
|
||||
|
||||
@ -1,16 +1,129 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
# volumes дополнены uwsgi-configmap: в base этот volume отсутствует, хотя
|
||||
# в живом дампе кластера он реально смонтирован в оба контейнера.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: issues
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/issues:production_bbb9d29a
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: issues
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: production-configmap
|
||||
mountPath:
|
||||
_default: /src/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: production-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
|
||||
- name: uwsgi-configmap
|
||||
mountPath:
|
||||
_default: /opt/server/uwsgi.ini
|
||||
subPath:
|
||||
_default: uwsgi.ini
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: uwsgi-configmap
|
||||
items:
|
||||
- key: uwsgi.ini
|
||||
path:
|
||||
_default: uwsgi.ini
|
||||
|
||||
envs:
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
@ -60,6 +173,7 @@ spec:
|
||||
- name: RABBITMQ_HOSTNAME
|
||||
value:
|
||||
_default: rabbitmq.rabbitmq.svc.cluster.local:5672
|
||||
|
||||
secretEnvs:
|
||||
- name: YC_S3_ACCESS_KEY_ID
|
||||
secretName:
|
||||
@ -121,3 +235,8 @@ spec:
|
||||
secretName:
|
||||
_default: backend-secret
|
||||
secretKey: ssh_public.key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,19 +1,115 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: celery
|
||||
namespace: issues
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
celery:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/issues:production_bbb9d29a
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: celery
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
command:
|
||||
_default: ["celery", "-A", "config", "worker", "-l", "info", "-E"]
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: false
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: production-configmap
|
||||
mountPath:
|
||||
_default: /src/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: production-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
|
||||
- name: uwsgi-configmap
|
||||
mountPath:
|
||||
_default: /opt/server/uwsgi.ini
|
||||
subPath:
|
||||
_default: uwsgi.ini
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: uwsgi-configmap
|
||||
items:
|
||||
- key: uwsgi.ini
|
||||
path:
|
||||
_default: uwsgi.ini
|
||||
|
||||
envs:
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
@ -69,6 +165,7 @@ spec:
|
||||
- name: ENABLE_MAILGUN
|
||||
value:
|
||||
_default: "False"
|
||||
|
||||
secretEnvs:
|
||||
- name: YC_S3_ACCESS_KEY_ID
|
||||
secretName:
|
||||
@ -130,3 +227,8 @@ spec:
|
||||
secretName:
|
||||
_default: backend-secret
|
||||
secretKey: ssh_public.key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
90
apps/issues/ugok/frontend.yaml
Normal file
90
apps/issues/ugok/frontend.yaml
Normal file
@ -0,0 +1,90 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: issues
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
frontend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:b56b9da1
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 80
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
@ -1,23 +1,12 @@
|
||||
---
|
||||
# Не наследуем base (backend/celery vault-native) — см. комментарии в файлах.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: issues
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch-backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: patch-celery.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: celery
|
||||
- path: patch-frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: frontend
|
||||
- path: patch-redis-image.yaml
|
||||
target:
|
||||
kind: Deployment
|
||||
name: redis
|
||||
- production-configmap.yaml
|
||||
- uwsgi-configmap.yaml
|
||||
- backend.yaml
|
||||
- celery.yaml
|
||||
- frontend.yaml
|
||||
- redis.yaml
|
||||
|
||||
@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: issues
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/contour_issues-frontend:b56b9da1
|
||||
@ -1,6 +0,0 @@
|
||||
---
|
||||
# redis-deployment.yaml — сырой Deployment (не universal-chart), образ меняем
|
||||
# через JSON6902, т.к. strategic-merge на список containers ненадёжен для CRD-less объектов.
|
||||
- op: replace
|
||||
path: /spec/template/spec/containers/0/image
|
||||
value: 10.4.10.187:80/library/redis:latest
|
||||
15
apps/issues/ugok/production-configmap.yaml
Normal file
15
apps/issues/ugok/production-configmap.yaml
Normal file
@ -0,0 +1,15 @@
|
||||
---
|
||||
# Скопировано из живого ConfigMap кластера ugok (namespace issues) — монтируется
|
||||
# backend'ом и celery как /src/config/settings/production.py.
|
||||
#
|
||||
# ВНИМАНИЕ: в файле буквально зашиты секреты (SECRET_KEY, DJANGO_TOKEN,
|
||||
# KAFKA_PASSWORD) и чужой домен brusnika-stage-kafka-bootstrap — копирую
|
||||
# как есть, как и договаривались, но это стоит знать: значения не
|
||||
# заворачиваются в env/Secret на уровне HelmRelease, они прямо в коде.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: production-configmap
|
||||
namespace: issues
|
||||
data:
|
||||
production.py: "from datetime import timedelta\nimport os\nfrom .base import *\n\n# DEBUG SETTINGS START\n# -----------------------------------------------------------------------------\nDEBUG = True\n# -----------------------------------------------------------------------------\n\nTEST_MODE = False\n\n# SECRETS SETTINGS START\n# -----------------------------------------------------------------------------\n\nAWS_S3_VERIFY=False\nENABLE_MAILGUN=False\nSECRET_KEY = \"FromToMuchLoveOfLiving\" # Delete after Test\n# -----------------------------------------------------------------------------\n\n# ALLOWED HOSTS START\n# -----------------------------------------------------------------------------\nALLOWED_HOSTS = [\"*\"]\n# -----------------------------------------------------------------------------\n\n# APPS SETTINGS START\n# -----------------------------------------------------------------------------\n# INSTALLED_APPS += [\n# \"django_extensions\",\n# ]\n# -----------------------------------------------------------------------------\n\nDJANGO_TOKEN=\"aGFnZW4wMTM6emVhbG90MDk2\"\n\n# DEBUG SETTINGS START\n# -----------------------------------------------------------------------------\nDEBUG = True\n# -----------------------------------------------------------------------------\n\nREVIEW_HOST='http://backend-service.flows.svc.cluster.local:8000'\n# -----------------------------------------------------------------------------\n# EXTERNAL SERVICES END\n\nWORKFLOWS_HOST = \"http://workflows-api-service.workflow.svc.cluster.local:8000\"\nWORKFLOWS_URL = \"http://workflows-api-service.workflow.svc.cluster.local:8000\"\nDOCUMENTATIONS_URL = \"http://documentations-api.documentations.svc.cluster.local:8080\"\nRESOURCES_API_HOST = os.getenv(\"RESOURCES_API_HOST\", default=\"http://resources-service.resources.svc.cluster:8000\")\nKAFKA_HOST = \"brusnika-stage-kafka-bootstrap.kafka.svc.cluster.local:9093\" \nKAFKA_USERNAME = \"sarex\" \nKAFKA_PASSWORD = \"nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC\"\nKAFKA_SSL_CAFILE = os.getenv(\"KAFKA_SSL_CAFILE\", \"/usr/local/share/ca-certificates/kafka.crt\")\nKAFKA_EAV_ASSETS_TOPIC = os.getenv(\"KAFKA_EAV_ASSETS_TOPIC\", \"sarex\")\nKAFKA_ISSUES_TOPIC = os.getenv(\"KAFKA_ISSUES_TOPIC\", \"sarex-issues\")\nSMTP_HOST = 'mail.uchgok.ru'\nSMTP_PORT = 25\nEMAIL_FROM = 'sarex@uchgok.ru'\n\n\nUSE_ASYNC_FUNCTIONS = False\nUSE_NOTIFICATIONS = True\n\n# JWT SETTINGS START\n# ---------------------------------------------------------------------------------------------------------------------\nSIMPLE_JWT_ISSUER = os.getenv(\"SIMPLE_JWT_ISSUER\", default=\"default_issuer\")\n\nSIMPLE_JWT = {\n \"ACCESS_TOKEN_LIFETIME\": timedelta(minutes=5),\n \"REFRESH_TOKEN_LIFETIME\": timedelta(days=1),\n \"ROTATE_REFRESH_TOKENS\": False,\n \"UPDATE_LAST_LOGIN\": False,\n\n \"ALGORITHM\": \"RS512\",\n \"SIGNING_KEY\": os.getenv(\"JWT_PRIVATE_KEY\", default=\"\").replace(\"\\\\n\", \"\\n\"),\n \"VERIFYING_KEY\": os.getenv(\"JWT_PUBLIC_KEY\").replace(\"\\\\n\", \"\\n\"),\n \"AUDIENCE\": None,\n \"ISSUER\": SIMPLE_JWT_ISSUER,\n\n \"AUTH_HEADER_TYPES\": (\"Bearer\",),\n \"AUTH_HEADER_NAME\": \"HTTP_AUTHORIZATION\",\n \"USER_ID_FIELD\": \"id\",\n \"USER_ID_CLAIM\": \"user_id\",\n\n \"AUTH_TOKEN_CLASSES\": (\"rest_framework_simplejwt.tokens.AccessToken\",),\n \"TOKEN_TYPE_CLAIM\": \"token_type\",\n\n \"JTI_CLAIM\": \"jti\",\n\n \"SLIDING_TOKEN_REFRESH_EXP_CLAIM\": \"refresh_exp\",\n \"SLIDING_TOKEN_LIFETIME\": timedelta(minutes=5),\n \"SLIDING_TOKEN_REFRESH_LIFETIME\": timedelta(days=1),\n}\n# ---------------------------------------------------------------------------------------------------------------------\n\nCORS_ALLOWED_ORIGINS = [\n \"https://ugok-sarex.uralmine.com\",\n]\n\nCORS_TRUSTED_ORIGINS = [\n \"https://ugok-sarex.uralmine.com\",\n]\n\nCSRF_TRUSTED_ORIGINS = [\n \"https://ugok-sarex.uralmine.com\",\n]\n\nCORS_ALLOW_ALL_ORIGINS = True\n\nCORS_ALLOW_METHODS = [\n \"DELETE\",\n \"GET\",\n \"OPTIONS\",\n \"PATCH\",\n \"POST\",\n \"PUT\",\n]\n\nSAREX_API = \"http://backend.django.svc.cluster.local:8000\"\n\nAERO_PUBLIC_HOST = os.getenv(\"AERO_PUBLIC_HOST\", default=SAREX_API)\n\nBASE_AERO_URL = \"http://backend.django.svc.cluster.local:8000\"\n\nENVIRONMENT = \"production\"\n\nSESSION_COOKIE_NAME = \"issues-sessionid\"\nCSRF_COOKIE_NAME = \"issues-csrftoken\"\nSTATIC_URL = \"/static/\"\nSTORAGES = {\n 'default': {\n 'BACKEND': \"storages.backends.s3boto3.S3Boto3Storage\",\n },\n 'staticfiles': {\n # Leave whatever setting you already have here, e.g.:\n 'BACKEND': \"storages.backends.s3boto3.S3Boto3Storage\",\n }\n}\n"
|
||||
43
apps/issues/ugok/redis.yaml
Normal file
43
apps/issues/ugok/redis.yaml
Normal file
@ -0,0 +1,43 @@
|
||||
---
|
||||
# Скопировано из apps/issues/base/redis-deployment.yaml + redis-service.yaml —
|
||||
# сырой Deployment (не universal-chart, не vault-native), просто перенесён
|
||||
# в standalone-оверлей, чтобы не зависеть от ../base.
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: issues
|
||||
labels:
|
||||
app: redis
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: redis
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: redis
|
||||
spec:
|
||||
containers:
|
||||
- name: redis
|
||||
image: 10.4.10.187:80/library/redis:latest
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- containerPort: 6379
|
||||
protocol: TCP
|
||||
imagePullSecrets:
|
||||
- name: regcred
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: issues
|
||||
spec:
|
||||
selector:
|
||||
app: redis
|
||||
ports:
|
||||
- port: 6379
|
||||
targetPort: 6379
|
||||
protocol: TCP
|
||||
24
apps/issues/ugok/uwsgi-configmap.yaml
Normal file
24
apps/issues/ugok/uwsgi-configmap.yaml
Normal file
@ -0,0 +1,24 @@
|
||||
---
|
||||
# Скопировано из живого ConfigMap кластера ugok (namespace issues).
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: uwsgi-configmap
|
||||
namespace: issues
|
||||
data:
|
||||
uwsgi.ini: |-
|
||||
[uwsgi]
|
||||
plugins-dir = /usr/lib/uwsgi/plugins
|
||||
|
||||
chdir = /src
|
||||
module = config.wsgi:application
|
||||
master = true
|
||||
processes = 4
|
||||
http = 0.0.0.0:8000
|
||||
chmod-socket = 666
|
||||
vacuum = true
|
||||
harakiri = 6000
|
||||
buffer-size = 32768
|
||||
|
||||
static-map = /static=/opt/src/static/
|
||||
static-map = /media=/opt/src/media/
|
||||
123
apps/mapper/ugok/backend.yaml
Normal file
123
apps/mapper/ugok/backend.yaml
Normal file
@ -0,0 +1,123 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
# У mapper в wb нет отдельного оверлея; envs совпадают с тем, что реально
|
||||
# в дампе ugok (тот же sarex.io-домен, что и в base — совпадение, не ошибка).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: mapper
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/mapper:prod_b0d05a34
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
limits:
|
||||
cpu:
|
||||
_default: "2"
|
||||
memory:
|
||||
_default: 512Mi
|
||||
requests:
|
||||
cpu:
|
||||
_default: "1"
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-service
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: DOCUMENTATION_HOST
|
||||
value:
|
||||
_default: https://api.sarex.io/documentations/api/v1
|
||||
- name: FLOW_HOST
|
||||
value:
|
||||
_default: https://api.sarex.io/flows/api/v1
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: https://lk.sarex.io/api
|
||||
- name: NOTE_HOST
|
||||
value:
|
||||
_default: https://api.sarex.io/notes/api/v1
|
||||
- name: REDIS_USE
|
||||
value:
|
||||
_default: "0"
|
||||
- name: TIMEOUT
|
||||
value:
|
||||
_default: "120"
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,11 +1,7 @@
|
||||
---
|
||||
# Не наследуем base (vault-native) — см. комментарий в backend.yaml.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: mapper
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- backend.yaml
|
||||
|
||||
@ -1,22 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: mapper
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
deployment:
|
||||
resources:
|
||||
limits:
|
||||
cpu:
|
||||
_default: "2"
|
||||
memory:
|
||||
_default: 512Mi
|
||||
requests:
|
||||
cpu:
|
||||
_default: "1"
|
||||
memory:
|
||||
_default: 128Mi
|
||||
112
apps/measurements/ugok/backend.yaml
Normal file
112
apps/measurements/ugok/backend.yaml
Normal file
@ -0,0 +1,112 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
# service.name исправлен на measurement-svc (реальное имя из дампа кластера,
|
||||
# в base по умолчанию — measurements-svc).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: measurements
|
||||
namespace: measurements
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/measurements:production_a5bb3e84
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: measurements
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 500m
|
||||
memory:
|
||||
_default: 512Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: measurement-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: https://lk.sarex.io
|
||||
- name: S3_JSON_FILE
|
||||
value:
|
||||
_default: /opt/cred_s3.json
|
||||
|
||||
secretEnvs:
|
||||
- name: S3_JSON_SETTINGS
|
||||
secretName:
|
||||
_default: s3-json-settings
|
||||
secretKey: S3_JSON_SETTINGS
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,11 +1,7 @@
|
||||
---
|
||||
# Не наследуем base (vault-native) — см. комментарий в backend.yaml.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: measurements
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: measurements
|
||||
- backend.yaml
|
||||
|
||||
@ -1,29 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: measurements
|
||||
namespace: measurements
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
deployment:
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 500m
|
||||
memory:
|
||||
_default: 512Mi
|
||||
envs:
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: https://lk.sarex.io
|
||||
- name: S3_JSON_FILE
|
||||
value:
|
||||
_default: /opt/cred_s3.json
|
||||
secretEnvs:
|
||||
- name: S3_JSON_SETTINGS
|
||||
secretName:
|
||||
_default: s3-json-settings
|
||||
secretKey: S3_JSON_SETTINGS
|
||||
@ -1,11 +1,7 @@
|
||||
---
|
||||
# Не наследуем base (vault-native) — см. комментарий в message-hub.yaml.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: message-hub
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: message-hub
|
||||
- message-hub.yaml
|
||||
|
||||
@ -1,16 +1,83 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/message-hub/wb/message-hub.yaml —
|
||||
# base vault-native, в ugok Vault не используется. Service отключён: в
|
||||
# живом дампе кластера у message-hub вообще нет Service-объекта (только
|
||||
# Deployment, потребляет Kafka без входящего HTTP).
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: message-hub
|
||||
namespace: message-hub
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/message-hub:production_e8010fe4
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: message-hub
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: false
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: WORKER_TIMEOUT
|
||||
value:
|
||||
@ -60,9 +127,7 @@ spec:
|
||||
- name: KAFKA_SASL_MECHANISM
|
||||
value:
|
||||
_default: PLAIN
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
|
||||
secretEnvs:
|
||||
- name: KAFKA_USERNAME
|
||||
secretName:
|
||||
@ -96,3 +161,8 @@ spec:
|
||||
secretName:
|
||||
_default: message-hub-s3-secret
|
||||
secretKey: endpoint
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,16 +1,95 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: notes
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/notes-backend:production_81366854
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-service
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
@ -57,6 +136,7 @@ spec:
|
||||
- name: ENABLE_ND
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
secretEnvs:
|
||||
- name: PG_DB
|
||||
secretName:
|
||||
@ -78,3 +158,8 @@ spec:
|
||||
secretName:
|
||||
_default: notes-django-auth
|
||||
secretKey: key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
97
apps/notes/ugok/frontend.yaml
Normal file
97
apps/notes/ugok/frontend.yaml
Normal file
@ -0,0 +1,97 @@
|
||||
---
|
||||
# base монтирует nginx-configmap, но в живом дампе кластера у frontend
|
||||
# нет ни volumeMounts, ни такого ConfigMap'а в namespace — не подключаем.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: notes
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
frontend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/notes-frontend:production_0cb0909f
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend-service
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 80
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,15 +1,8 @@
|
||||
---
|
||||
# Не наследуем base (backend vault-native) — см. комментарии в файлах.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: notes
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch-backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: patch-frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: frontend
|
||||
- backend.yaml
|
||||
- frontend.yaml
|
||||
|
||||
@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: notes
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/notes-frontend:production_0cb0909f
|
||||
32
apps/pm/ugok/backend-configmap.yaml
Normal file
32
apps/pm/ugok/backend-configmap.yaml
Normal file
@ -0,0 +1,32 @@
|
||||
---
|
||||
# Скопировано из живого ConfigMap кластера ugok (namespace pm) — монтируется
|
||||
# backend'ом и celery как /opt/sarex/uwsgi.ini.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: backend-configmap
|
||||
namespace: pm
|
||||
data:
|
||||
uwsgi.ini: |
|
||||
[uwsgi]
|
||||
log-format = {"time": "%(time)", "method": "%(method)", "uri": "%(uri)", "status": "%(status)", "size": "%(size)", "addr": "%(addr)", "user": "%(user)", "proto": "%(proto)", "user_agent": "%(uagent)", "referer": "%(referer)", "trace_id": "%(trace_id)", "span_id": "%(span_id)"}
|
||||
module = config.wsgi:application
|
||||
DJANGO_SETTINGS_MODULE = config.settings.base
|
||||
http = 0.0.0.0:8000
|
||||
processes = 8
|
||||
master = true
|
||||
vacuum = true
|
||||
enable-threads = true
|
||||
buffer-size = 65535
|
||||
stats = :3031
|
||||
stats-http = true
|
||||
memory-report = true
|
||||
lazy-apps = true
|
||||
listen = 1024
|
||||
disable-write-exception= 0
|
||||
harakiri = 300
|
||||
socket-timeout = 300
|
||||
chunked-input-timeout = 300
|
||||
http-timeout = 300
|
||||
worker-reload-mercy = 240
|
||||
mule-reload-mercy = 240
|
||||
162
apps/pm/ugok/backend.yaml
Normal file
162
apps/pm/ugok/backend.yaml
Normal file
@ -0,0 +1,162 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/pm/wb/backend.yaml — base
|
||||
# vault-native, в ugok Vault не используется. Секреты (DB/S3/RabbitMQ) идут
|
||||
# через уже существующий в кластере Secret sarex-env, смонтированный файлом
|
||||
# .env (тот же паттерн, что в wb). command/args из base — только
|
||||
# vault-обёртка (в живом дампе кластера command/args у backend нет вообще,
|
||||
# как и в wb), не переносим её.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: pm
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/pm-backend:production_fa0f1551
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-service
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: uwsgi-configmap
|
||||
mountPath:
|
||||
_default: /opt/sarex/uwsgi.ini
|
||||
subPath:
|
||||
_default: uwsgi.ini
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: backend-configmap
|
||||
items:
|
||||
- key: uwsgi.ini
|
||||
path:
|
||||
_default: uwsgi.ini
|
||||
|
||||
- name: env-file
|
||||
mountPath:
|
||||
_default: /opt/sarex/.env
|
||||
subPath:
|
||||
_default: .env
|
||||
readOnly:
|
||||
_default: true
|
||||
secret:
|
||||
secretName:
|
||||
_default: sarex-env
|
||||
items:
|
||||
- key: .env
|
||||
path:
|
||||
_default: .env
|
||||
|
||||
- name: kafka-cert-volume
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-cert
|
||||
|
||||
envs:
|
||||
- name: USERS_INTERNAL_HOST
|
||||
value:
|
||||
_default: http://backend.django.svc.cluster.local:8000
|
||||
- name: RESOURCES_INTERNAL_HOST
|
||||
value:
|
||||
_default: http://resources-service.resources.svc.cluster.local:8000
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: http://eav-service.eav.svc.cluster.local:8000
|
||||
- name: EAV_API_PREFIX
|
||||
value:
|
||||
_default: /api/v0
|
||||
- name: SETTINGS_VERIFY_SSL
|
||||
value:
|
||||
_default: "True"
|
||||
- name: EAV_API_PREFIX_V1
|
||||
value:
|
||||
_default: /api/v1
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
149
apps/pm/ugok/celery.yaml
Normal file
149
apps/pm/ugok/celery.yaml
Normal file
@ -0,0 +1,149 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/pm/wb/celery.yaml — base
|
||||
# vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: celery
|
||||
namespace: pm
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
celery:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/pm-backend:production_fa0f1551
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: celery
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
command:
|
||||
_default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "pm", "-n", "default_worker.%h", "--concurrency=2"]
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: false
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: uwsgi-configmap
|
||||
mountPath:
|
||||
_default: /opt/sarex/uwsgi.ini
|
||||
subPath:
|
||||
_default: uwsgi.ini
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: backend-configmap
|
||||
items:
|
||||
- key: uwsgi.ini
|
||||
path:
|
||||
_default: uwsgi.ini
|
||||
|
||||
- name: env-file
|
||||
mountPath:
|
||||
_default: /opt/sarex/.env
|
||||
subPath:
|
||||
_default: .env
|
||||
readOnly:
|
||||
_default: true
|
||||
secret:
|
||||
secretName:
|
||||
_default: sarex-env
|
||||
items:
|
||||
- key: .env
|
||||
path:
|
||||
_default: .env
|
||||
|
||||
- name: kafka-cert-volume
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-cert
|
||||
|
||||
envs:
|
||||
- name: USERS_INTERNAL_HOST
|
||||
value:
|
||||
_default: http://backend.django.svc.cluster.local:8000
|
||||
- name: RESOURCES_INTERNAL_HOST
|
||||
value:
|
||||
_default: http://resources-service.resources.svc.cluster.local:8000
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: http://eav-service.eav.svc.cluster.local:8000
|
||||
- name: EAV_API_PREFIX
|
||||
value:
|
||||
_default: /api/v0
|
||||
- name: EAV_API_PREFIX_V1
|
||||
value:
|
||||
_default: /api/v1
|
||||
- name: PLANNING_HOST
|
||||
value:
|
||||
_default: http://backend-service.pm.svc.cluster.local:8000/api/pm/msp
|
||||
- name: PLANNING_USE
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
90
apps/pm/ugok/frontend.yaml
Normal file
90
apps/pm/ugok/frontend.yaml
Normal file
@ -0,0 +1,90 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: pm
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
frontend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/pm-frontend:contour_e5c3d387
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 100m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 80
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
@ -1,19 +1,11 @@
|
||||
---
|
||||
# Не наследуем base (backend/celery vault-native; resources-static из base
|
||||
# в живом дампе кластера отсутствует вообще — не подключаем).
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: pm
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch-backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: patch-celery.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: celery
|
||||
- path: patch-frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: frontend
|
||||
- backend-configmap.yaml
|
||||
- backend.yaml
|
||||
- celery.yaml
|
||||
- frontend.yaml
|
||||
|
||||
@ -1,53 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: pm
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/pm-backend:production_fa0f1551
|
||||
volumes:
|
||||
_default:
|
||||
- name: kafka-cert-volume
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-cert
|
||||
|
||||
- name: env-file
|
||||
mountPath:
|
||||
_default: /opt/sarex/.env
|
||||
subPath:
|
||||
_default: .env
|
||||
readOnly:
|
||||
_default: true
|
||||
secret:
|
||||
secretName:
|
||||
_default: sarex-env
|
||||
envs:
|
||||
- name: USERS_INTERNAL_HOST
|
||||
value:
|
||||
_default: http://backend.django.svc.cluster.local:8000
|
||||
- name: RESOURCES_INTERNAL_HOST
|
||||
value:
|
||||
_default: http://resources-service.resources.svc.cluster.local:8000
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: http://eav-service.eav.svc.cluster.local:8000
|
||||
- name: EAV_API_PREFIX
|
||||
value:
|
||||
_default: /api/v0
|
||||
- name: SETTINGS_VERIFY_SSL
|
||||
value:
|
||||
_default: "True"
|
||||
- name: EAV_API_PREFIX_V1
|
||||
value:
|
||||
_default: /api/v1
|
||||
@ -1,56 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: celery
|
||||
namespace: pm
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
celery:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/pm-backend:production_fa0f1551
|
||||
volumes:
|
||||
_default:
|
||||
- name: kafka-cert-volume
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-cert
|
||||
|
||||
- name: env-file
|
||||
mountPath:
|
||||
_default: /opt/sarex/.env
|
||||
subPath:
|
||||
_default: .env
|
||||
readOnly:
|
||||
_default: true
|
||||
secret:
|
||||
secretName:
|
||||
_default: sarex-env
|
||||
envs:
|
||||
- name: USERS_INTERNAL_HOST
|
||||
value:
|
||||
_default: http://backend.django.svc.cluster.local:8000
|
||||
- name: RESOURCES_INTERNAL_HOST
|
||||
value:
|
||||
_default: http://resources-service.resources.svc.cluster.local:8000
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: http://eav-service.eav.svc.cluster.local:8000
|
||||
- name: EAV_API_PREFIX
|
||||
value:
|
||||
_default: /api/v0
|
||||
- name: EAV_API_PREFIX_V1
|
||||
value:
|
||||
_default: /api/v1
|
||||
- name: PLANNING_HOST
|
||||
value:
|
||||
_default: http://backend-service.pm.svc.cluster.local:8000/api/pm/msp
|
||||
- name: PLANNING_USE
|
||||
value:
|
||||
_default: "True"
|
||||
@ -1,19 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: pm
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/pm-frontend:contour_e5c3d387
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 100m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
@ -1,16 +1,96 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/rfi/wb/backend.yaml — base
|
||||
# vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: rfi
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/rfi-backend:production_d1e2e80d
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: rfi-backend-api
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: JWT_AUTH_ENABLE
|
||||
value:
|
||||
@ -39,6 +119,7 @@ spec:
|
||||
- name: RABBITMQ_HOST
|
||||
value:
|
||||
_default: rabbitmq.rabbitmq.svc.cluster.local
|
||||
|
||||
secretEnvs:
|
||||
- name: DJANGO_SECRET_KEY
|
||||
secretName:
|
||||
@ -96,3 +177,8 @@ spec:
|
||||
secretName:
|
||||
_default: rfi-rabbitmq-secret
|
||||
secretKey: password
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,21 +1,87 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/rfi/wb/celery.yaml — base
|
||||
# vault-native, в ugok Vault не используется. command/args — не
|
||||
# vault-обёртка, а реальная команда запуска celery, сохранена как есть.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: celery
|
||||
namespace: rfi
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
celery:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/rfi-backend:production_79888e2f
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: celery
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
command:
|
||||
_default: ["uv"]
|
||||
args:
|
||||
_default: ["run", "celery", "-A", "config", "worker", "-l", "info"]
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: false
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: JWT_AUTH_ENABLE
|
||||
value:
|
||||
@ -44,6 +110,7 @@ spec:
|
||||
- name: RABBITMQ_HOST
|
||||
value:
|
||||
_default: rabbitmq.rabbitmq.svc.cluster.local
|
||||
|
||||
secretEnvs:
|
||||
- name: DJANGO_SECRET_KEY
|
||||
secretName:
|
||||
@ -101,3 +168,8 @@ spec:
|
||||
secretName:
|
||||
_default: rfi-rabbitmq-secret
|
||||
secretKey: password
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
95
apps/rfi/ugok/frontend.yaml
Normal file
95
apps/rfi/ugok/frontend.yaml
Normal file
@ -0,0 +1,95 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: rfi
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
frontend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/rfi-frontend:production_b827756f_wb
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 80
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,19 +1,9 @@
|
||||
---
|
||||
# Не наследуем base (backend/celery vault-native) — см. комментарии в файлах.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: rfi
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch-backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: patch-celery.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: celery
|
||||
- path: patch-frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: frontend
|
||||
- backend.yaml
|
||||
- celery.yaml
|
||||
- frontend.yaml
|
||||
|
||||
@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: rfi
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/rfi-frontend:production_b827756f_wb
|
||||
107
apps/subscriptions/ugok/django-configmap.yaml
Normal file
107
apps/subscriptions/ugok/django-configmap.yaml
Normal file
@ -0,0 +1,107 @@
|
||||
---
|
||||
# Скопировано из живого ConfigMap кластера ugok (namespace subscriptions).
|
||||
# Внимание: в CORS_ALLOWED_ORIGINS зашит чужой домен test.sarex.brusnika.tech —
|
||||
# копирую буквально как есть, не правлю (та же история, что с образами,
|
||||
# в которых встречались чужие имена клиентов).
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: django-configmap
|
||||
namespace: subscriptions
|
||||
data:
|
||||
production.py: |
|
||||
import os
|
||||
|
||||
from .base import *
|
||||
|
||||
# DEBUG SETTINGS START
|
||||
# -----------------------------------------------------------------------------
|
||||
DEBUG = False
|
||||
# -----------------------------------------------------------------------------
|
||||
# DEBUG SETTINGS END
|
||||
|
||||
|
||||
# ALLOWED HOSTS START
|
||||
# -----------------------------------------------------------------------------
|
||||
ALLOWED_HOSTS = ["*"]
|
||||
# -----------------------------------------------------------------------------
|
||||
# ALLOWED HOSTS END
|
||||
|
||||
# DATABASE CONFIGURATION START
|
||||
# ------------------------------------------------------------------------------
|
||||
POSTGRES_DATABASE = os.getenv("DATABASE_NAME")
|
||||
POSTGRES_USER = os.getenv("DATABASE_USER")
|
||||
POSTGRES_PASSWORD = os.getenv("DATABASE_PASSWORD")
|
||||
POSTGRES_HOST = os.getenv("DATABASE_HOST")
|
||||
POSTGRES_PORT = os.getenv("DATABASE_PORT")
|
||||
|
||||
DATABASES = {
|
||||
"default": {
|
||||
"ENGINE": "core.db.backends.postgis",
|
||||
"NAME": POSTGRES_DATABASE,
|
||||
"USER": POSTGRES_USER,
|
||||
"PASSWORD": POSTGRES_PASSWORD,
|
||||
"HOST": POSTGRES_HOST,
|
||||
"PORT": POSTGRES_PORT,
|
||||
}
|
||||
}
|
||||
# DATABASE CONFIGURATION END
|
||||
# ------------------------------------------------------------------------------
|
||||
|
||||
|
||||
CORS_ALLOWED_ORIGINS = [
|
||||
"https://localhost.8000",
|
||||
"https://localhost.8080",
|
||||
"https://test.sarex.brusnika.tech"
|
||||
]
|
||||
|
||||
CORS_ALLOW_ALL_ORIGINS = True
|
||||
|
||||
CORS_ALLOW_METHODS = [
|
||||
"DELETE",
|
||||
"GET",
|
||||
"OPTIONS",
|
||||
"PATCH",
|
||||
"POST",
|
||||
"PUT",
|
||||
]
|
||||
|
||||
# MAILGUN START
|
||||
# ------------------------------------------------------------------------------
|
||||
MAILGUN_BASE_URL = os.getenv("MAILGUN_BASE_URL", default="https://api.mailgun.net/v3/mg.sarex.io")
|
||||
MAILGUN_API_KEY = os.getenv("MAILGUN_API_KEY", default="6383b2d1b300a70b3b686fa1d0f684f8-f45b080f-53294ebe")
|
||||
IS_MAILGUN_USE = os.getenv("IS_MAILGUN_USE", default=False)
|
||||
MAILGUN_EMAIL_FROM = os.getenv("MAILGUN_EMAIL_FROM", default="hello@sarex.io")
|
||||
# ------------------------------------------------------------------------------
|
||||
# MAILGUN END
|
||||
|
||||
# SYSTEM_LOG SERVICE SETTINGS START
|
||||
# -----------------------------------------------------------------------------
|
||||
SYSTEM_LOG_HOST = os.getenv("SYSTEM_LOG_HOST")
|
||||
# -----------------------------------------------------------------------------
|
||||
# SYSTEM_LOG SERVICE SETTINGS END
|
||||
|
||||
|
||||
# TELEGRAM SETTINGS START
|
||||
# -----------------------------------------------------------------------------
|
||||
IS_USE_TELEGRAM = os.getenv("IS_USE_TELEGRAM", default=False)
|
||||
TELEGRAM_BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN", default="6174421650:AAGEicmX0fvDX2683LXiGweWfn1U9UTQHFY")
|
||||
# -----------------------------------------------------------------------------
|
||||
# TELEGRAM SETTINGS END
|
||||
|
||||
# USER SERVICE SETTINGS START
|
||||
# -----------------------------------------------------------------------------
|
||||
USER_SERVICE_HOST = os.getenv("USER_SERVICE_HOST")
|
||||
USER_SERVICE_LOGIN = "hagen013"
|
||||
USER_SERVICE_PASSWORD = "zealot096"
|
||||
# -----------------------------------------------------------------------------
|
||||
# USER SERVICE SETTINGS END
|
||||
|
||||
|
||||
# SMTP
|
||||
# -------------------------------------------
|
||||
SMTP_EMAIL_HOST = os.getenv("SMTP_EMAIL_HOST", default=None)
|
||||
SMTP_EMAIL_PORT = os.getenv("SMTP_EMAIL_PORT", default=None)
|
||||
SMTP_EMAIL_FROM = os.getenv("SMTP_EMAIL_FROM", default="hello@sarex.io")
|
||||
# -------------------------------------------
|
||||
# SMTP
|
||||
@ -1,6 +1,11 @@
|
||||
---
|
||||
# subscriptions/base — сырой Deployment (не universal-chart), а wb использует
|
||||
# отдельный standalone HelmRelease (apps/subscriptions/wb/backend.yaml), не
|
||||
# наследуя base. Для ugok — та же схема, значения из дампа кластера.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: subscriptions
|
||||
resources:
|
||||
- uwsgi-configmap.yaml
|
||||
- django-configmap.yaml
|
||||
- backend.yaml
|
||||
|
||||
23
apps/subscriptions/ugok/uwsgi-configmap.yaml
Normal file
23
apps/subscriptions/ugok/uwsgi-configmap.yaml
Normal file
@ -0,0 +1,23 @@
|
||||
---
|
||||
# Скопировано из живого ConfigMap кластера ugok (namespace subscriptions).
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: uwsgi-configmap
|
||||
namespace: subscriptions
|
||||
data:
|
||||
uwsgi.ini: |
|
||||
[uwsgi]
|
||||
chdir = /server
|
||||
module = config.wsgi:application
|
||||
master = true
|
||||
master-fifo = /opt/server/uwsgi-backend-server.fifo
|
||||
processes = 8
|
||||
http = 0.0.0.0:8000
|
||||
chmod-socket = 666
|
||||
vacuum = true
|
||||
harakiri = 6000
|
||||
buffer-size = 32768
|
||||
|
||||
static-map = /static=/opt/server/static/
|
||||
static-map = /media=/opt/server/media/
|
||||
@ -1,16 +1,95 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: api
|
||||
namespace: system-log
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
api:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/system-log:prod_08141511
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: api
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: KAFKA_ENABLE
|
||||
value:
|
||||
@ -69,6 +148,7 @@ spec:
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: http://backend.django.svc.cluster.local:8000
|
||||
|
||||
secretEnvs:
|
||||
- name: POSTGRES_USER
|
||||
secretName:
|
||||
@ -94,3 +174,8 @@ spec:
|
||||
secretName:
|
||||
_default: yc-kafka-certificate
|
||||
secretKey: certificate
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,15 +1,8 @@
|
||||
---
|
||||
# Не наследуем base (vault-native) — см. комментарии в файлах.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: system-log
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch-api.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: api
|
||||
- path: patch-worker.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: worker
|
||||
- api.yaml
|
||||
- worker.yaml
|
||||
|
||||
@ -1,16 +1,80 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: worker
|
||||
namespace: system-log
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
worker:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/system_log_worker:de6a0147d285afa273e85c0f074c8b6049d03a32
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: worker
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: false
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: APP_NAME
|
||||
value:
|
||||
@ -51,6 +115,7 @@ spec:
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: http://backend.django.svc.cluster.local:8000
|
||||
|
||||
secretEnvs:
|
||||
- name: POSTGRES_USER
|
||||
secretName:
|
||||
@ -68,3 +133,8 @@ spec:
|
||||
secretName:
|
||||
_default: superuser
|
||||
secretKey: password
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,22 +1,96 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/transmittal/wb/backend.yaml — base
|
||||
# vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: transmittal
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/transmittal-api:prod_4e0db600
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: "1"
|
||||
memory:
|
||||
_default: 1Gi
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: "1"
|
||||
memory:
|
||||
_default: 1Gi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: TRANSMITTAL_SERVICE_APP__NAME
|
||||
value:
|
||||
@ -210,6 +284,7 @@ spec:
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
|
||||
value:
|
||||
_default: hello@wb.io
|
||||
|
||||
secretEnvs:
|
||||
- name: TRANSMITTAL_SERVICE_DATABASE__USER
|
||||
secretName:
|
||||
@ -247,3 +322,8 @@ spec:
|
||||
secretName:
|
||||
_default: mailgun-cred
|
||||
secretKey: api_key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
90
apps/transmittal/ugok/frontend.yaml
Normal file
90
apps/transmittal/ugok/frontend.yaml
Normal file
@ -0,0 +1,90 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: transmittal
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
frontend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:wb1_dbf61443
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: frontend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 80
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
@ -1,19 +1,9 @@
|
||||
---
|
||||
# Не наследуем base (backend/worker vault-native) — см. комментарии в файлах.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: transmittal
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: patch-backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: patch-worker.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: worker
|
||||
- path: patch-frontend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: frontend
|
||||
- backend.yaml
|
||||
- worker.yaml
|
||||
- frontend.yaml
|
||||
|
||||
@ -1,19 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: frontend
|
||||
namespace: transmittal
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:wb1_dbf61443
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 100m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
@ -1,25 +1,85 @@
|
||||
---
|
||||
# standalone HelmRelease по образцу apps/transmittal/wb/worker.yaml — base
|
||||
# vault-native, в ugok Vault не используется. command — реальная команда
|
||||
# запуска taskiq-воркера (не vault-обёртка), сохранена.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: worker
|
||||
namespace: transmittal
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
worker:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/transmittal-api:prod_4e0db600
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: worker
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
command:
|
||||
_default: ["taskiq", "worker", "--no-parse", "transmittal_service.tasks.broker:broker", "transmittal_service.tasks.transmittal.tasks", "transmittal_service.tasks.email.tasks"]
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: "1"
|
||||
memory:
|
||||
_default: 1Gi
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: "1"
|
||||
memory:
|
||||
_default: 1Gi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled: false
|
||||
readiness:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
enabled: false
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: TRANSMITTAL_SERVICE_APP__NAME
|
||||
value:
|
||||
@ -213,6 +273,7 @@ spec:
|
||||
- name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
|
||||
value:
|
||||
_default: hello@t.io
|
||||
|
||||
secretEnvs:
|
||||
- name: TRANSMITTAL_SERVICE_DATABASE__USER
|
||||
secretName:
|
||||
@ -250,3 +311,8 @@ spec:
|
||||
secretName:
|
||||
_default: mailgun-cred
|
||||
secretKey: api_key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
@ -1,16 +1,123 @@
|
||||
---
|
||||
# standalone HelmRelease — base vault-native, в ugok Vault не используется.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: workspaces
|
||||
|
||||
spec:
|
||||
interval: 10m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: universal-chart
|
||||
version: "0.1.9"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
interval: 10m
|
||||
|
||||
install:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
|
||||
values:
|
||||
global:
|
||||
env: _default
|
||||
|
||||
services:
|
||||
backend:
|
||||
enabled: true
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/workspaces:production_bfd943b2
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
deployment:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: workspaces-api
|
||||
|
||||
replicaCount:
|
||||
_default: 1
|
||||
|
||||
port:
|
||||
_default: 8000
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu:
|
||||
_default: 25m
|
||||
memory:
|
||||
_default: 100Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
enabled:
|
||||
_default: true
|
||||
type:
|
||||
_default: httpGet
|
||||
httpGet:
|
||||
path:
|
||||
_default: /ping
|
||||
port:
|
||||
_default: 8000
|
||||
initialDelaySeconds:
|
||||
_default: 10
|
||||
periodSeconds:
|
||||
_default: 60
|
||||
failureThreshold:
|
||||
_default: 10
|
||||
readiness:
|
||||
enabled:
|
||||
_default: true
|
||||
type:
|
||||
_default: httpGet
|
||||
httpGet:
|
||||
path:
|
||||
_default: /ping
|
||||
port:
|
||||
_default: 8000
|
||||
initialDelaySeconds:
|
||||
_default: 5
|
||||
periodSeconds:
|
||||
_default: 5
|
||||
failureThreshold:
|
||||
_default: 20
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
name:
|
||||
_default: backend-svc
|
||||
|
||||
type:
|
||||
_default: ClusterIP
|
||||
|
||||
port:
|
||||
_default: 80
|
||||
|
||||
targetPort:
|
||||
_default: 8000
|
||||
|
||||
portName:
|
||||
_default: http
|
||||
|
||||
imagePullSecrets:
|
||||
enabled:
|
||||
_default: true
|
||||
name:
|
||||
_default: regcred
|
||||
|
||||
envs:
|
||||
- name: POSTGRES_POOL_SIZE
|
||||
value:
|
||||
@ -51,6 +158,7 @@ spec:
|
||||
- name: DJANGO_ORIGINATOR
|
||||
value:
|
||||
_default: docs_prod
|
||||
|
||||
secretEnvs:
|
||||
- name: POSTGRES_ADDRESS
|
||||
secretName:
|
||||
@ -76,3 +184,8 @@ spec:
|
||||
secretName:
|
||||
_default: workspaces-django-auth
|
||||
secretKey: key
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
owner: ""
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user