uralkal: django — CronJob kc-sync-users, синхронизация пользователей из Keycloak camunda каждые 10 минут

apps/django/uralkal/kc-sync-configmap.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kc-sync-configmap
+  namespace: django
+data:
+  kc_sync.py: |
+    from .production import *
+
+
+    class KeyCloakSyncJobSettings(KeyCloakSettings):
+        base_url: str = ""
+        realm: str = "master"
+
+
+    KEYCLOAKSETTINGS = KeyCloakSyncJobSettings()

apps/django/uralkal/kc-sync-cronjob.yaml

@@ -0,0 +1,102 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: kc-sync-users
+  namespace: django
+spec:
+  schedule: "*/10 * * * *"
+  concurrencyPolicy: Forbid
+  startingDeadlineSeconds: 300
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 540
+      ttlSecondsAfterFinished: 3600
+      template:
+        metadata:
+          annotations:
+            sidecar.istio.io/inject: "false"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: django
+            vault.hashicorp.com/agent-inject-secret-django-postgresql: secrets/data/apps/django/postgres
+            vault.hashicorp.com/agent-inject-template-django-postgresql: |-
+              {{- with secret "secrets/data/apps/django/postgres" -}}
+              DJANGO_POSTGRES_HOST={{ index .Data.data "host" }}
+              DJANGO_POSTGRES_PORTS={{ index .Data.data "port" }}
+              DJANGO_POSTGRES_DATABASE={{ index .Data.data "database" }}
+              DJANGO_POSTGRES_USER={{ index .Data.data "username" }}
+              DJANGO_POSTGRES_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-jwt-private: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-django-jwt-private: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "private_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-django-jwt-public: secrets/data/vault/common/rsa_keys
+            vault.hashicorp.com/agent-inject-template-django-jwt-public: |-
+              {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+              {{ index .Data.data "public_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-kc-admin: secrets/data/camunda/keycloak-admin
+            vault.hashicorp.com/agent-inject-template-kc-admin: |-
+              {{- with secret "secrets/data/camunda/keycloak-admin" -}}
+              {{ index .Data.data "admin-password" }}
+              {{- end -}}
+        spec:
+          serviceAccountName: django-vault
+          automountServiceAccountToken: true
+          restartPolicy: Never
+          imagePullSecrets:
+            - name: regcred
+          containers:
+            - name: kc-sync
+              image: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b
+              imagePullPolicy: IfNotPresent
+              workingDir: /opt/sarex
+              command: ["/bin/sh", "-ec"]
+              args:
+                - |
+                  exec python manage.py synchronization_keycloak --username "$KC_ADMIN_USERNAME" --password "$(cat /vault/secrets/kc-admin)" --only-users
+              env:
+                - name: DJANGO_SETTINGS_MODULE
+                  value: config.settings.kc_sync
+                - name: DJANGO_HOST
+                  value: https://sarex.local.uralkali.com
+                - name: ISOLATED
+                  value: "1"
+                - name: KC_ADMIN_USERNAME
+                  value: admin
+                - name: KC_BASE_URL
+                  value: http://camunda-keycloak.camunda.svc.cluster.local/auth
+                - name: KC_REALM
+                  value: master
+                - name: KC_STAFF
+                  value: GL_sarex-staff
+                - name: KC_SUPERUSER
+                  value: GL_sarex-admins
+                - name: KC_SYNC_ADMIN
+                  value: "True"
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 256Mi
+              volumeMounts:
+                - name: django-configmap
+                  mountPath: /opt/sarex/config/settings/production.py
+                  subPath: production.py
+                  readOnly: true
+                - name: kc-sync-configmap
+                  mountPath: /opt/sarex/config/settings/kc_sync.py
+                  subPath: kc_sync.py
+                  readOnly: true
+          volumes:
+            - name: django-configmap
+              configMap:
+                name: django-configmap
+            - name: kc-sync-configmap
+              configMap:
+                name: kc-sync-configmap

apps/django/uralkal/kustomization.yaml

@@ -2,6 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - kc-sync-configmap.yaml
+  - kc-sync-cronjob.yaml
 patches:
   - path: nginx-configmap.yaml
     target: