premises: d8-ugmk-prod overlay (ugmk Kafka CA mounted, prod-sized requests
dropped), wired into the cluster, /premises/api/ routed on sarex.uralmine.com.
Terraform side is infra/terraform 856ab54.
istio-config d8-ugmk-prod, vad, uralkal: inspections-api reused the name
flows-api-virt-service, so two VirtualServices collided and one of
/flows/api/ and /inspections/api/ was lost. It is now
inspections-api-virt-service.
remarks base frontend image -> remarks-frontend:contour_013c5091.
psql-tools-debug in uralkal sleeps forever so it can be exec'd into.
documentations base: pdm-api pointed DRAWINGS_INTERNAL_URL at
drawings-api-service:80, which does not exist in the clusters inheriting
base (vad, d8-ugmk-prod, sarex-contour, uralkal, yc-k8s-test); their drawings
service is backend-service:8000. brusnika and wb keep their own pdm copies.
istio-config uralkal: /notes/api/ -> backend-service.notes:8000 (rewrite
/api/) and /notes/static/ -> frontend-service.notes:80.
notes base frontend image -> notes-frontend:contour_5ff34172.
Base image moves to cross-section-app:contour_c5e5d476 for every cluster
inheriting it. istio-config uralkal routes /cross-section/static/ to
cross-section-static:80.
uralkal runs comparisons-api-v2:contour_9a2bab4e (built with bash so the
Vault Agent files can be sourced): migrations up before exec ./api, port 8080
behind the unchanged service port 8000, v2 env schema with uralkal service
addresses. istio-config uralkal routes /comparisons/api/ and
/comparisons/static/. Base frontend image moves to
comparisons-frontend:contour_0570a1f1 for every cluster using base.
New service on universal-chart with Vault Agent: role premises, SA
premises-vault, creds for its own postgres, kafka and S3 plus the five
neighbour databases the sync script reads. The vad overlay mounts the Kafka CA
and drops the prod-sized resource requests; istio-config routes
sarex.vadroad.ru/premises/api/ to backend-svc.premises.
/orchestrator/api/process/, /orchestrator/api/sign and /orchestrator/ are
rewritten to /api/... before reaching cde.orchestrator:8080, same rules as
the cde-api virtual service in vad. Replaces the single prefix route that
passed the path through unchanged.
Same cde-api virtual service as d8-ugmk-prod: /orchestrator/api/process/,
/orchestrator/api/sign and /orchestrator/ are rewritten to /api/... and sent
to cde-svc.cde.svc.cluster.local:80.
New HelmRelease services.admin-frontend in apps/control-interface/base,
matching the live Deployment's image/port/resources (cpu 100m, memory
100Mi) and istio tracing podAnnotations. Downward-API envs (K8S_POD_UID/
K8S_POD_NAME/K8S_NAMESPACE/OTEL_RESOURCE_ATTRIBUTES) were left out — no
existing app in this repo uses valueFrom/fieldRef in the universal-chart
envs schema and the chart source isn't reachable to confirm support.
imagePullSecrets uses regcred (vad's actual convention) instead of the
source's dockerhub.
Since control-interface/vad and /uralkal both just inherit ../base
unmodified, this also shows up in uralkal as a side effect.
infrastructure/istio-config/vad: adds a plain admin-frontend route
(/admin-frontend/static/ -> admin-frontend-svc.control-interface, rewrite
/), matching the minimal style of the other sarex.vadroad.ru routes —
no cors block, per request.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds 13 new VirtualServices on the existing test.sarex.brusnika.tech host
and ingress-nginx/main-gateway, matching the active (non-commented)
location blocks in global-ingress's nginx-configmap (fetched live from the
cluster and cross-checked service/port/namespace names against what's
actually running). The root path (/) stays routed to
nginx-service.global-ingress as a fallback for anything not covered here.
Two deliberate deviations from literally replaying the nginx config:
- /comparisons/api/: nginx proxies to port 8080, but the real
backend-service.comparisons Service listens on 80 (targetPort 8080) —
used 80.
- /orchestrator/: nginx declares 4 location blocks, but the first
(bare ~^/orchestrator/) shadows the other three for any non-empty
path (nginx picks the first matching regex location, not the most
specific), so only one route (no rewrite) was ported, matching what
nginx actually does today.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
apps/<app>/uralkal mirrors apps/<app>/vad for all 36 apps from
clusters/vad/kustomization.yaml, with domains remapped (not a suffix swap —
vad's sarex-login.vadroad.ru etc. use a different host scheme than uralkal's
login.sarex.local.uralkali.com). Two things are left as explicit
placeholders pending real infra: the Zitadel client_id/org_id
(TBD_URALKAL_ZITADEL_CLIENT_ID, since uralkal's Zitadel has no application
registered yet) and the Kafka CA cert in pm/issues/message-hub/flows
(copied from vad, will need swapping once uralkal's Kafka actually
generates its own CA, same as vad's history).
infrastructure/s3-proxy/uralkal: new component, nginx upstream points at
the single uralkal minio endpoint (10.133.0.245:9000) from terraform,
unlike vad's 4-node list.
clusters/uralkal/kustomization.yaml: wires in s3-proxy + all 36 apps.
infrastructure/istio-config/uralkal/istio-config.yaml: adds the 28
path-routed virtualServices under sarex.local.uralkali.com (mirroring
vad's sarex.vadroad.ru routing, incl. the documentations-api CORS policy)
plus stamp-verification/document-link/s3 on their already-declared hosts.
Pre-existing zitadel/superset/camunda-operate blocks are untouched.
apps/django/vad/backend.yaml: drop a stale explanatory comment (also
removed from the uralkal copy before this commit).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
