sarex/iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master'

Browse Source
This commit is contained in:
emelinda 2026-10-26 18:11:13 +05:00
commit cb99195564
11 changed files with 610 additions and 315 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

280
apps/django/ugok/django-configmap.yaml
View File

File diff suppressed because one or more lines are too long

2
apps/documentations/base/api.yaml
View File

@ -65,7 +65,7 @@ spec:
enabled: false
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_4ffd8437
pullPolicy:
_default: IfNotPresent
service:

153
apps/issues/uralkal/backend-s3.yaml
View File

@ -1,153 +0,0 @@
---
# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml.
# podAnnotations — map, мержится по ключам.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: backend
namespace: issues
spec:
values:
services:
backend:
deployment:
args:
_default:
- |
set -a
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
set +a
exec /src/entrypoint.sh
volumes:
_default:
- name: production-configmap
mountPath:
_default: /src/config/settings/production.py
subPath:
_default: production.py
readOnly:
_default: true
configMap:
name:
_default: production-configmap
items:
- key: production.py
path:
_default: production.py
- name: kafka-ca-cert
mountPath:
_default: /usr/local/share/ca-certificates/kafka.crt
subPath:
_default: kafka.crt
readOnly:
_default: true
secret:
secretName:
_default: kafka-kafka-contour-tls
items:
- key: ca.crt
path:
_default: kafka.crt
envs:
- name: ENVIRONMENT
value:
_default: "production"
- name: AERO_PUBLIC_HOST
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: AERO_HOST
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: BASE_AERO_URL
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: BASE_AUTH_URL
value:
_default: "http://backend-svc.django.svc.cluster.local:80"
- name: WORKFLOWS_HOST
value:
_default: "http://backend-svc.workflow.svc.cluster.local:80"
- name: WORKFLOWS_URL
value:
_default: "http://backend-svc.workflow.svc.cluster.local:80"
- name: RESOURCES_API_HOST
value:
_default: "http://iam-backend.iam.svc.cluster.local:8000"
- name: EAV_HOST
value:
_default: "http://backend-svc.eav.svc.cluster.local:80"
- name: SAREX_API
value:
_default: "http://backend-svc.django.svc.cluster.local:80"
- name: SAREX_HOST
value:
_default: "https://sarex.local.uralkali.com"
- name: DOCUMENTATIONS_URL
value:
_default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
- name: DJANGO_SETTINGS_MODULE
value:
_default: "config.settings.production"
- name: API_ADDRESS
value:
_default: "8000"
# Kafka — код (kafka_app/app.py) ждёт KAFKA_HOST единой строкой "host:port",
# KAFKA_SSL_CAFILE — путь к файлу (не PEM-текст, в отличие от flows-backend).
# Хост/порт/CA — те же проверенные значения, что у message-hub/pm/flows.
- name: KAFKA_HOST
value:
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
- name: KAFKA_SSL_CAFILE
value:
_default: "/usr/local/share/ca-certificates/kafka.crt"
# Топики совпадают с тем, что уже провижено на брокере (см. topics
# в секрете kafka/apps/pm) и с SETTINGS_TOPICS у message-hub.
- name: KAFKA_ISSUES_TOPIC
value:
_default: "issues_broadcast_prod"
- name: KAFKA_EAV_ASSETS_TOPIC
value:
_default: "assets_broadcast"
podAnnotations:
_default:
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
vault.hashicorp.com/agent-inject-template-issues-s3: |-
{{- with secret "secrets/data/minio/apps/issues" -}}
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
YC_S3_BUCKET_NAME=issues
YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
{{- with secret "secrets/data/kafka/apps/issues" -}}
KAFKA_USERNAME={{ index .Data.data "username" }}
KAFKA_PASSWORD={{ index .Data.data "password" }}
{{- end -}}

137
apps/issues/uralkal/backend.yaml
View File

@ -8,8 +8,145 @@ spec:
values:
services:
backend:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_eb983275
deployment:
resources:
requests:
cpu: null
memory: null
args:
_default:
- |
set -a
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
set +a
exec /src/entrypoint.sh
volumes:
_default:
- name: production-configmap
mountPath:
_default: /src/config/settings/production.py
subPath:
_default: production.py
readOnly:
_default: true
configMap:
name:
_default: production-configmap
items:
- key: production.py
path:
_default: production.py
- name: kafka-ca-cert
mountPath:
_default: /usr/local/share/ca-certificates/kafka.crt
subPath:
_default: kafka.crt
readOnly:
_default: true
secret:
secretName:
_default: kafka-kafka-contour-tls
items:
- key: ca.crt
path:
_default: kafka.crt
envs:
- name: ENVIRONMENT
value:
_default: "production"
- name: AERO_PUBLIC_HOST
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: AERO_HOST
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: BASE_AERO_URL
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: BASE_AUTH_URL
value:
_default: "http://backend-svc.django.svc.cluster.local:80"
- name: WORKFLOWS_HOST
value:
_default: "http://backend-svc.workflow.svc.cluster.local:80"
- name: WORKFLOWS_URL
value:
_default: "http://backend-svc.workflow.svc.cluster.local:80"
- name: RESOURCES_API_HOST
value:
_default: "http://iam-backend.iam.svc.cluster.local:8000"
- name: EAV_HOST
value:
_default: "http://backend-svc.eav.svc.cluster.local:80"
- name: SAREX_API
value:
_default: "http://backend-svc.django.svc.cluster.local:80"
- name: SAREX_HOST
value:
_default: "https://sarex.local.uralkali.com"
- name: DOCUMENTATIONS_URL
value:
_default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
- name: DJANGO_SETTINGS_MODULE
value:
_default: "config.settings.production"
- name: API_ADDRESS
value:
_default: "8000"
- name: KAFKA_HOST
value:
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
- name: KAFKA_SSL_CAFILE
value:
_default: "/usr/local/share/ca-certificates/kafka.crt"
- name: KAFKA_ISSUES_TOPIC
value:
_default: "issues_broadcast_prod"
- name: KAFKA_EAV_ASSETS_TOPIC
value:
_default: "assets_broadcast"
podAnnotations:
_default:
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
vault.hashicorp.com/agent-inject-template-issues-s3: |-
{{- with secret "secrets/data/minio/apps/issues" -}}
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
YC_S3_BUCKET_NAME=issues
YC_S3_ENDPOINT_URL=http://10.133.0.245:9000
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
{{- with secret "secrets/data/kafka/apps/issues" -}}
KAFKA_USERNAME={{ index .Data.data "username" }}
KAFKA_PASSWORD={{ index .Data.data "password" }}
{{- end -}}

149
apps/issues/uralkal/celery-s3.yaml
View File

@ -1,149 +0,0 @@
---
# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
# поэтому здесь продублирован весь набор из apps/issues/base/celery.yaml.
# podAnnotations — map, мержится по ключам.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: celery
namespace: issues
spec:
values:
services:
celery:
deployment:
args:
_default:
- |
set -a
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
set +a
exec celery -A config worker -l info -E
volumes:
_default:
- name: production-configmap
mountPath:
_default: /src/config/settings/production.py
subPath:
_default: production.py
readOnly:
_default: true
configMap:
name:
_default: production-configmap
items:
- key: production.py
path:
_default: production.py
- name: kafka-ca-cert
mountPath:
_default: /usr/local/share/ca-certificates/kafka.crt
subPath:
_default: kafka.crt
readOnly:
_default: true
secret:
secretName:
_default: kafka-kafka-contour-tls
items:
- key: ca.crt
path:
_default: kafka.crt
envs:
- name: ENVIRONMENT
value:
_default: "production"
- name: AERO_PUBLIC_HOST
value:
_default: "https://srx.wb.ru"
- name: AERO_HOST
value:
_default: "https://srx.wb.ru"
- name: BASE_AERO_URL
value:
_default: "https://srx.wb.ru"
- name: BASE_AUTH_URL
value:
_default: "http://backend-svc.django.svc.cluster.local:80"
- name: WORKFLOWS_HOST
value:
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
- name: WORKFLOWS_URL
value:
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
- name: RESOURCES_API_HOST
value:
_default: "http://iam-backend.iam.svc.cluster.local:8000"
- name: EAV_HOST
value:
_default: "http://backend-svc.eav.svc.cluster.local:80"
- name: SAREX_API
value:
_default: "http://backend-svc.django.svc.cluster.local:80"
- name: SAREX_HOST
value:
_default: "https://sarex.local.uralkali.com"
- name: DOCUMENTATIONS_URL
value:
_default: "http://backend-api-svc.documentations.svc.cluster.local:80"
- name: DJANGO_SETTINGS_MODULE
value:
_default: "config.settings.production"
- name: API_ADDRESS
value:
_default: "8000"
# См. подробные комментарии в apps/issues/d8-ugmk-prod/backend-s3.yaml.
- name: KAFKA_HOST
value:
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
- name: KAFKA_SSL_CAFILE
value:
_default: "/usr/local/share/ca-certificates/kafka.crt"
- name: KAFKA_ISSUES_TOPIC
value:
_default: "issues_broadcast_prod"
- name: KAFKA_EAV_ASSETS_TOPIC
value:
_default: "assets_broadcast"
podAnnotations:
_default:
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
vault.hashicorp.com/agent-inject-template-issues-s3: |-
{{- with secret "secrets/data/minio/apps/issues" -}}
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
YC_S3_BUCKET_NAME=issues
YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
{{- with secret "secrets/data/kafka/apps/issues" -}}
KAFKA_USERNAME={{ index .Data.data "username" }}
KAFKA_PASSWORD={{ index .Data.data "password" }}
{{- end -}}

134
apps/issues/uralkal/celery.yaml
View File

@ -13,3 +13,137 @@ spec:
requests:
cpu: null
memory: null
args:
_default:
- |
set -a
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
set +a
exec celery -A config worker -l info -E
volumes:
_default:
- name: production-configmap
mountPath:
_default: /src/config/settings/production.py
subPath:
_default: production.py
readOnly:
_default: true
configMap:
name:
_default: production-configmap
items:
- key: production.py
path:
_default: production.py
- name: kafka-ca-cert
mountPath:
_default: /usr/local/share/ca-certificates/kafka.crt
subPath:
_default: kafka.crt
readOnly:
_default: true
secret:
secretName:
_default: kafka-kafka-contour-tls
items:
- key: ca.crt
path:
_default: kafka.crt
envs:
- name: ENVIRONMENT
value:
_default: "production"
- name: AERO_PUBLIC_HOST
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: AERO_HOST
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: BASE_AERO_URL
value:
_default: "https://sarex.contour.infra.sarex.tech"
- name: BASE_AUTH_URL
value:
_default: "http://backend-svc.django.svc.cluster.local:80"
- name: WORKFLOWS_HOST
value:
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
- name: WORKFLOWS_URL
value:
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
- name: RESOURCES_API_HOST
value:
_default: "http://iam-backend.iam.svc.cluster.local:8000"
- name: EAV_HOST
value:
_default: "http://backend-svc.eav.svc.cluster.local:80"
- name: SAREX_API
value:
_default: "http://backend-svc.django.svc.cluster.local:80"
- name: SAREX_HOST
value:
_default: "https://sarex.local.uralkali.com"
- name: DOCUMENTATIONS_URL
value:
_default: "http://backend-api-svc.documentations.svc.cluster.local:80"
- name: DJANGO_SETTINGS_MODULE
value:
_default: "config.settings.production"
- name: API_ADDRESS
value:
_default: "8000"
- name: KAFKA_HOST
value:
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
- name: KAFKA_SSL_CAFILE
value:
_default: "/usr/local/share/ca-certificates/kafka.crt"
- name: KAFKA_ISSUES_TOPIC
value:
_default: "issues_broadcast_prod"
- name: KAFKA_EAV_ASSETS_TOPIC
value:
_default: "assets_broadcast"
podAnnotations:
_default:
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
vault.hashicorp.com/agent-inject-template-issues-s3: |-
{{- with secret "secrets/data/minio/apps/issues" -}}
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
YC_S3_BUCKET_NAME=issues
YC_S3_ENDPOINT_URL=http://10.133.0.245:9000
{{- end -}}
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
{{- with secret "secrets/data/kafka/apps/issues" -}}
KAFKA_USERNAME={{ index .Data.data "username" }}
KAFKA_PASSWORD={{ index .Data.data "password" }}
{{- end -}}

8
apps/issues/uralkal/kustomization.yaml
View File

@ -3,14 +3,6 @@ kind: Kustomization
resources:
- ../base
patches:
- path: backend-s3.yaml
target:
kind: HelmRelease
name: backend
- path: celery-s3.yaml
target:
kind: HelmRelease
name: celery
- path: backend.yaml
target:
kind: HelmRelease

12
apps/processing/base/engine-low.yaml
View File

@ -42,7 +42,7 @@ spec:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_89322f69
_default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_835b57c1
pullPolicy:
_default: IfNotPresent
@ -131,6 +131,16 @@ spec:
- name: API_ADDRESS
value:
_default: "0.0.0.0:8000"
- name: ENABLE_CROSS_SECTION_API_DB
value:
_default: "1"
- name: CROSS_SECTION_API_DB
value:
_default: "/etc/cross_section/cross-section-api-db-prod.json"
- name: CROSS_SECTION_API_DEBUG
value:
_default: "0"
- name: DJANGO_HOST
value:

2
apps/processing/wb/engine.yaml
View File

@ -171,7 +171,7 @@ spec:
- name: RABBITMQ_COMPLETENESS_EXCHANGE
value: "autodesk.outputMessage"
- name: RABBITMQ_COMPLETENESS_TOPIC
value: "output"
value: "output_navis"
- name: CONTROL_PLANE_PERIOD
value: "10s"
- name: WORKFLOW_PRIORITY

46
infrastructure/istio-config/vk-infra/istio-config.yaml
View File

@ -58,6 +58,18 @@ spec:
renewBefore: 360h0m0s
privateKey:
rotationPolicy: Always
srx-ui-kit-tls:
dnsNames:
- srx-ui-kit.infra.sarex.tech
- srx-ui-kit-stage.infra.sarex.tech
issuerRef:
name: letsencrypt-issuer-istio
kind: ClusterIssuer
spec:
duration: 2160h0m0s
renewBefore: 360h0m0s
privateKey:
rotationPolicy: Always
nexus-tls:
dnsNames:
- nexus.infra.sarex.tech
@ -104,6 +116,18 @@ spec:
tls:
credentialName: kb-tls
mode: SIMPLE
srx-ui-kit:
name: srx-ui-kit-gateway
namespace: istio-system
selector:
istio: ingressgateway
servers:
- hosts:
- srx-ui-kit.infra.sarex.tech
- srx-ui-kit-stage.infra.sarex.tech
tls:
credentialName: srx-ui-kit-tls
mode: SIMPLE
nexus:
name: nexus-gateway
namespace: istio-system
@ -149,6 +173,28 @@ spec:
prefix: /
service: kb-service.kb.svc.cluster.local
port: 80
srx-ui-kit-virt-service:
namespace: istio-system
hosts:
- srx-ui-kit.infra.sarex.tech
gateways:
- istio-system/srx-ui-kit-gateway
routes:
- path:
prefix: /
service: universal-static-site-srx-ui-kit-pages.gitlab-pages-srx-ui-kit.svc.cluster.local
port: 80
srx-ui-kit-stage-virt-service:
namespace: istio-system
hosts:
- srx-ui-kit-stage.infra.sarex.tech
gateways:
- istio-system/srx-ui-kit-gateway
routes:
- path:
prefix: /
service: universal-static-site-srx-ui-kit-stage-pages.gitlab-pages-srx-ui-kit-stage.svc.cluster.local
port: 80
nexus-virt-service:
namespace: istio-system
hosts:

2
infrastructure/istio-gateway/vk-prod/lb-service.yaml
View File

@ -10,7 +10,7 @@ metadata:
istio: ingressgateway
spec:
type: LoadBalancer
loadBalancerIP: 161.104.106.190
loadBalancerIP: 168.113.132.114
externalTrafficPolicy: Local
selector:
app: istio-ingressgateway