emelinda
8244e56f02
Comment out vs-resources-admin configuration in brusnika-stage Istio settings.
2026-09-30 17:52:55 +03:00
emelinda
70e4b24eee
Uncomment vs-resources-admin configuration in brusnika-stage Istio settings.
2026-09-30 17:42:18 +03:00
emelinda
474298459a
comment vs-resources-admin configuration in brusnika-stage Istio settings.
2026-09-30 17:35:11 +03:00
emelinda
c471cf39e0
Uncomment vs-resources-admin configuration in brusnika-stage Istio settings.
2026-09-30 15:20:40 +03:00
emelinda
809febe4dc
Comment out vs-resources-admin configuration in brusnika-stage Istio settings.
2026-09-30 14:06:07 +03:00
emelinda
c602ca904a
Uncomment vs-resources-admin configuration in brusnika-stage Istio settings.
2026-09-30 09:38:28 +03:00
emelinda
9ea8ab675e
Comment out vs-resources-admin configuration in brusnika-stage Istio settings.
2026-09-30 09:23:04 +03:00
emelinda
e04fc5b850
Update Istio route prefix for resource-management in brusnika-stage configuration.
2026-09-29 17:47:23 +03:00
a204213979
++ uralkal camunda domains
2026-09-28 18:23:45 +03:00
ivan
9ec172c0f4
uralkal: replicate the vad business-app footprint (36 apps) with uralkal domains
...
apps/<app>/uralkal mirrors apps/<app>/vad for all 36 apps from
clusters/vad/kustomization.yaml, with domains remapped (not a suffix swap —
vad's sarex-login.vadroad.ru etc. use a different host scheme than uralkal's
login.sarex.local.uralkali.com). Two things are left as explicit
placeholders pending real infra: the Zitadel client_id/org_id
(TBD_URALKAL_ZITADEL_CLIENT_ID, since uralkal's Zitadel has no application
registered yet) and the Kafka CA cert in pm/issues/message-hub/flows
(copied from vad, will need swapping once uralkal's Kafka actually
generates its own CA, same as vad's history).
infrastructure/s3-proxy/uralkal: new component, nginx upstream points at
the single uralkal minio endpoint (10.133.0.245:9000) from terraform,
unlike vad's 4-node list.
clusters/uralkal/kustomization.yaml: wires in s3-proxy + all 36 apps.
infrastructure/istio-config/uralkal/istio-config.yaml: adds the 28
path-routed virtualServices under sarex.local.uralkali.com (mirroring
vad's sarex.vadroad.ru routing, incl. the documentations-api CORS policy)
plus stamp-verification/document-link/s3 on their already-declared hosts.
Pre-existing zitadel/superset/camunda-operate blocks are untouched.
apps/django/vad/backend.yaml: drop a stale explanatory comment (also
removed from the uralkal copy before this commit).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-28 14:56:17 +03:00
e23783997e
++ uralkal istio-config domains
2026-09-28 11:02:53 +03:00
dcab7c00ed
++ uralkal superset image with deps
2026-09-28 11:02:53 +03:00
ivan
2595d174aa
vad: allow cross-origin credentialed requests to documentations-api (document-link, stamp-verification)
...
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-27 22:41:17 +03:00
ivan
3dcf6ef89f
vad: istio path routing for pm (/pm/api/, /pm/)
...
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-27 21:44:39 +03:00
emelinda
15d1f11d8a
Remove HelmRelease configurations (failed-pod-cleanup.yaml, goalert.yaml, and istio-config.yaml) from brusnika-stage cluster.
2026-09-25 18:04:55 +03:00
4703b77906
++ uralkal bundled postgres
2026-09-25 17:27:14 +03:00
692647f4ec
++ uralkal trino node
2026-09-25 16:47:46 +03:00
69c45fc7f1
++ uralkal apps
2026-09-25 16:46:07 +03:00
26f4d13d47
++ uralkal kafka rabbitmq
2026-09-25 12:07:57 +03:00
b053237833
++ pin uralkal ingressgateway to 1 replica
2026-09-24 11:23:36 +03:00
6ec7167c04
++ uralkal vault istio-base istio-pilot istio-gateway
2026-09-23 17:48:37 +03:00
ivan
ef3120352e
vad: fix zitadel ExternalDomain to match the actual istio host
...
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-18 15:55:01 +05:00
ivan
c75d178fb5
vad: istio path-routing for sarex.vadroad.ru
...
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-18 02:16:07 +05:00
d14b072432
++ vad camunda identity urls to flat sarex- scheme
2026-09-17 13:28:24 +03:00
5f48671f0e
++ vad istio hosts to flat sarex- scheme
2026-09-17 12:54:40 +03:00
ivan
24fa9db719
sarex-contour: remove explanatory comments
...
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-16 12:40:46 +05:00
ivan
9baaa3d7f1
++ sarex-contour: zitadel
...
infrastructure/zitadel/sarex-contour (chart idp-contour 4.12.13), по
образцу overlay vad: без dependsOn на postgresql (БД внешняя, отдельная
машина 111.88.255.180 — заказана через terraform live/database, не
in-cluster HelmRelease), postRenderer снимает nodeSelector с Deployment
+ 2 Job'ов и подменяет vault-agent template на свой (кладёт
Admin.Password/FirstInstance.Org.Human.Password из
secrets/data/zitadel/postgresql).
ExternalDomain — заглушка zitadel.sarex-contour.internal, istio-config
для внешнего доступа ещё не заведён.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-11 18:15:12 +05:00
ivan
48f7934699
++ sarex-contour: rabbitmq — вырезать Certificate/Gateway/VirtualService
...
cert-manager в sarex-contour не раскатан, chart рендерит Certificate/
Gateway/VirtualService для ingress несмотря на values:null (как и в
vad/d8-ugmk-prod) — install падал на "no matches for kind Certificate".
Тот же postRenderer $patch:delete, что у vad.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-11 17:18:05 +05:00
ivan
0c882d76c2
++ sarex-contour: kafka + rabbitmq
...
infrastructure/kafka/sarex-contour, infrastructure/rabbitmq/sarex-contour
(values по образцу yc-k8s-test, controller-only kafka KRaft, rabbitmq
1 реплика, local-path). Vault для них уже заведён отдельно (terraform
environments.sarex-contour.vault, kafka/rabbitmq policy+role+kv).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-11 17:17:00 +05:00
ivan
e37507aa6c
++ sarex-contour: vault ha.replicas=1
...
chart всегда рендерит raft HA; для контура держим одну ноду вместо
дефолтных трёх — меньше unseal-операций и PVC.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-10 18:48:30 +05:00
ivan
b98b4b6ee3
++ sarex-contour: vault dataStorage.size 10Gi
...
chart 0.2.3 дефолтит 20Gi, живой StatefulSet с 0.1.0 — 10Gi, поле
volumeClaimTemplates иммутабельно → helm upgrade падал Forbidden.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-10 18:44:14 +05:00
ivan
f3e2f84947
++ sarex-contour: vault — values по образцу ugok
...
chart 0.2.3 игнорирует server.standalone/ha.enabled и рендерит raft;
не воюем с ним — values только regcred + backup off, как в overlay ugok.
postRenderer снимает nodeSelector dedicated=sts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-10 18:28:10 +05:00
ivan
b9154da622
++ sarex-contour: vault — снять nodeSelector dedicated=sts
...
chart vault-contour 0.2.3 прибивает server-под к нодам dedicated=sts,
в кластере их нет → под висел Pending. postRenderer + values обнуляют
nodeSelector/tolerations на StatefulSet и injector.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-10 18:17:47 +05:00
ivan
b4f3fc6851
++ sarex-contour: vault под управление flux
...
vault уже стоял в кластере (helm CLI, chart 0.1.0, standalone/raft,
инициализирован, данных нет). Overlay infrastructure/vault/sarex-contour:
values как у прочих свежих контуров (regcred, backup off, standalone),
namespace istio-injection: disabled. helm-controller перенимает релиз
`vault` и апгрейдит до 0.2.3 (base). StatefulSet updateStrategy: OnDelete —
под не дёргается автоматически.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-10 18:15:57 +05:00
ivan
5d5fde4374
++ sarex-contour: ingressgateway replicaCount=1
...
base-чарт istio-gateway прибит к control-plane нодам и просит 3 реплики
с hostPort — в sarex-contour одна control-plane нода, 2 пода висли Pending.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-10 17:27:36 +05:00
ivan
ea759acd09
++ sarex-contour: flux entrypoint + istio rollout
...
Новый кластер clusters/sarex-contour: flux-system (bootstrap на
gitlab.sarex.io, path ./clusters/sarex-contour), helm-repositories
(yc-oci-charts), раскатка istio-base/istiod/ingressgateway.
Gateway опубликован через NodePort 30080/30443 — в контуре нет
облачного LoadBalancer.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-10 17:18:46 +05:00
d37c229249
++ default local-path storage class to retain
2026-09-01 18:21:48 +03:00
ivan
9591d770be
++
2026-08-31 16:55:22 +05:00
ivan
1ffe61ea88
feat(bi/d8-ugmk-prod): istio-маршруты для bi на sarex-bi.uralmine.com
...
/analytics-v2/api/ -> /api/ -> bi-backend-service.bi:80
/analytics-v2/static/, /analytics-v2/ -> / -> bi-frontend-frontend-svc.bi:80
Префиксы уже, чем catch-all `/` -> superset на том же хосте.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-31 16:54:09 +05:00
bd62e7c153
++ force empty nodeselector and tolerations for ugok vault
2026-08-28 13:21:49 +03:00
75cecf0321
++ add vault install for ugok
2026-08-28 13:14:11 +03:00
b911b7ea50
++ deploy dedicated in-cluster postgres for zitadel, point zitadel at it
2026-08-26 14:22:02 +03:00
2bbf786aa6
++ revert keycloak db password to allowed vault path
2026-08-26 14:17:25 +03:00
7b5f249581
++ read identity password from canonical vault key, drop staging secret
2026-08-26 14:03:22 +03:00
09b0d4e8d1
++ point keycloak db password at its own vault path
2026-08-26 12:53:12 +03:00
30e58fdc30
++ fix gateway wildcard and drop foreign domains
2026-08-26 12:32:46 +03:00
9e66a1e31d
++ route s3 domain through ingressgateway to nginx service
2026-08-26 12:20:56 +03:00
8bbc158e49
++ add s3-proxy nginx service for vad
2026-08-26 12:15:11 +03:00
d2df6afaa4
++ add istio-config for vad with self-signed tls
2026-08-26 12:06:00 +03:00
f051fd67b8
++ zitadel admin password reads same key as user
2026-08-26 11:58:30 +03:00
4420efb5a1
++ match ugmk zitadel admin username pattern
2026-08-26 11:51:32 +03:00
c38032e64e
++ add kafka camunda zitadel overlays for vad
2026-08-26 11:32:23 +03:00
9db6db713a
++ nest ingressgateway service override under internal defaults key
2026-08-25 18:43:38 +03:00
b5acdf28b5
++ fix vad ingressgateway values schema, expose 30080/30443
2026-08-25 18:40:55 +03:00
e2c3079ab1
++ fix vad rabbitmq gateway crd and istio image pull secrets
2026-08-25 18:28:13 +03:00
83262697c0
++ add vault, rabbitmq and istio for vad
2026-08-25 18:22:55 +03:00
98f8ad1635
++ null out sarex_db and resources_db chart defaults in trino catalogs
2026-08-25 14:57:43 +03:00
88b58158de
++ point trino at django_db, drop dead resources_db catalog
2026-08-21 15:56:15 +03:00
b5efcc378c
++ bump pgbouncer chart to 1.0.12
2026-08-21 14:45:05 +03:00
29cc95ef33
++ add pgbouncer backup pooler to brusnika-prod
2026-08-21 14:21:13 +03:00
fb1a36c2fd
++ switch superset domain to sarex-bi.uralmine.com
2026-08-20 15:48:55 +03:00
c45150bc98
++ fix trino worker node selector render
2026-08-20 15:48:55 +03:00
1cb049ba9b
++ place trino worker on processing node
2026-08-20 14:16:49 +03:00
327212ea6f
++ use mirrored ugmk superset trino images
2026-08-20 14:09:26 +03:00
3b5a6ddcc0
++ fix ugmk superset trino contour charts
2026-08-20 14:09:26 +03:00
34c05548f6
++ add superset trino ugmk
2026-08-20 13:19:52 +03:00
e9c582800e
++ use wb superset jwt k8s secret
2026-08-17 17:19:21 +03:00
1827903c41
++ fix wb superset guest token secret delivery
2026-08-17 17:00:33 +03:00
c10d84861f
fix identity.fullURL for ugmk, was falling back to chart default identity.camunda.sarex.io instead of camunda-identity.sarex-k8s.uralmine.com
2026-08-07 14:43:35 +03:00
emelinda
8447ab76bb
Add frontend HelmRelease to d8-ugmk-prod and configure Istio route for s3-proxy in Istio config
2026-08-05 15:33:56 +03:00
emelinda
af6135f2b0
Re-enable and configure multiple virtual services in yc-ecp Istio configuration for main-gateway.
2026-08-05 02:16:35 +03:00
emelinda
db0b8988f1
Refactor yc-ecp configuration: update HelmRelease affinity settings for frontend and re-enable commented Istio routes for main-gateway.
2026-08-05 02:06:17 +03:00
emelinda
218d233eb7
Add Django frontend app to yc-ecp: define namespace, configure HelmRelease with chart and deployment details, update Istio configuration, and include in cluster Kustomization
2026-08-05 01:58:35 +03:00
emelinda
d46ba48d22
Update yc-ecp Istio configuration: add main-gateway and TLS settings for aero.invest.sarex.io
2026-08-05 01:05:11 +03:00
emelinda
c7c244e95d
Update yc-ecp Istio configuration: add imagePullSecrets for cert-manager and enforce HTTPS for dashboard bindings
2026-08-05 00:11:41 +03:00
emelinda
3a5b3b07e6
Add Measurements app to yc-ecp: define HelmRelease, configure Istio certificates, and update cluster Kustomization
2026-08-05 00:00:06 +03:00
emelinda
172e889f00
Add Kubernetes Dashboard configuration to yc-ecp: define HelmRelease, update Istio Gateway and VirtualService, and include in cluster Kustomization
2026-08-04 23:34:53 +03:00
emelinda
e491466a37
Refactor yc-ecp Istio and cert-manager configurations: adjust ClusterIssuer specs, update certificate and VirtualService keys, and add port names.
2026-08-04 23:27:13 +03:00
emelinda
6b107c872a
Remove deprecated Let's Encrypt ClusterIssuer configurations and update dependencies in yc-ecp cert-manager and Istio configuration.
2026-08-04 23:14:05 +03:00
emelinda
9e4a27f898
Remove unused Let's Encrypt ClusterIssuer configurations from yc-ecp cert-manager directory.
2026-08-04 23:07:06 +03:00
emelinda
da36ac822f
Remove unused ClusterIssuer references from yc-ecp cert-manager kustomization
2026-08-04 23:06:33 +03:00
emelinda
4cd9a8b4d5
Add imagePullSecrets to Let's Encrypt ClusterIssuer for DockerHub authentication
2026-08-04 22:58:10 +03:00
emelinda
c4e6c079f7
Migrate cert-manager configuration to yc-ecp infrastructure directory with updated HelmRelease, ClusterIssuer, and Kustomization files.
2026-08-04 22:53:59 +03:00
emelinda
6e94f826c3
Migrate Istio and Vault configurations to separate yc-ecp infrastructure directories with updated HelmRelease and Kustomization files.
2026-08-04 22:34:42 +03:00
ivan
1e1280d74e
++
2026-08-04 18:54:52 +05:00
ivan
27327f2c9c
++
2026-08-04 14:36:19 +05:00
ivan
0703f6a7ea
++
2026-08-04 14:07:53 +05:00
ivan
0c04c357dc
++
2026-08-04 13:29:50 +05:00
ivan
ebe1bbfd08
++
2026-08-04 13:19:31 +05:00
ivan
fb765a9cf9
++
2026-08-04 12:41:10 +05:00
ivan
8a0eee6538
++
2026-08-03 20:41:38 +05:00
fb30bab0b8
++ prefix uralmine service domains with sarex
2026-08-03 11:06:10 +03:00
a4f1424403
++ move uralmine service domains up one level
2026-08-03 10:56:18 +03:00
ivan
9cb672cf34
++
2026-08-02 01:10:27 +05:00
ivan
325aad49da
++
2026-08-02 00:50:33 +05:00
ivan
6c81ba0080
++
2026-08-02 00:41:18 +05:00
ivan
3dd3c12537
++
2026-08-01 15:13:48 +05:00
ivan
7ad5c5f4b1
++
2026-08-01 14:41:41 +05:00
ivan
950c1a5c51
++
2026-08-01 14:00:43 +05:00
ivan
ab7611fc7e
++
2026-07-31 17:47:56 +05:00
ivan
84c51343f9
++
2026-07-31 17:32:56 +05:00
ivan
e88027ffa6
++
2026-07-31 16:56:56 +05:00
ivan
11fbf26d6d
++
2026-07-31 16:12:24 +05:00
ivan
4e7757b7b4
++
2026-07-31 16:08:52 +05:00
ivan
b98d3f6ab2
++
2026-07-31 15:27:24 +05:00
ivan
7868779771
++
2026-07-31 15:12:16 +05:00
ivan
d57fcf8229
++
2026-07-31 13:59:05 +05:00
ivan
77d6f20146
++
2026-07-29 17:55:36 +05:00
ivan
f0aecc51ad
++
2026-07-29 15:45:47 +05:00
ivan
29414b27ba
++
2026-07-29 15:12:17 +05:00
ivan
2d455821fb
++
2026-07-29 15:11:26 +05:00
ivan
a7d90941f9
++
2026-07-28 16:35:58 +05:00
5b22347385
++ fix superset remediation
2026-07-22 14:13:19 +03:00
46d0de18fb
add ss + trino to wb
2026-07-22 13:10:48 +03:00
eaa5afcac4
fix rmq
2026-07-20 19:44:25 +03:00
e28264a6ed
enable rmq loopback user
2026-07-20 19:30:09 +03:00
edd195cdae
bump rmq chart
2026-07-20 18:38:31 +03:00
0c1e3f8c59
add kafka authorizer
2026-07-17 18:06:03 +03:00
6abde9cce2
++ change infra domains
2026-07-15 14:53:57 +03:00
63cdb767e6
++ move ugmk infrastructure patches to overlays
2026-07-15 13:00:34 +03:00
9bfb5cc3b8
restore buisness owned postgresql from company dumps
2026-06-29 18:45:57 +03:00
bc8222b5cd
restore buisness owned postgresql from company dumps
2026-06-29 18:20:02 +03:00
1565d9550e
restore buisness owned postgresql from company dumps
2026-06-29 17:54:02 +03:00
51779f11c1
add contour envoy filters
2026-06-29 13:30:50 +03:00
057989099b
++ bump pg-sanitizer image to infra_6622cc06 (fix circular fk prune)
2026-06-26 15:05:48 +03:00
7830bd2f08
++ add signoz otel compatibility service
2026-06-25 17:14:28 +03:00
5995e6ff11
++ fix otel vault agent resources
2026-06-25 12:36:09 +03:00
3908af1fbf
++ fix istio gateway values
2026-06-25 12:06:43 +03:00
26d7b18586
++ fix istio gateway replicas
2026-06-25 11:58:44 +03:00
d733f45be5
++ fix openobserve otel secrets
2026-06-24 20:42:11 +03:00
f511b95adf
++ disable otel extra pod monitors
2026-06-24 16:24:17 +03:00
3a53ee3306
++ disable otel prometheus feature gates
2026-06-24 15:58:22 +03:00
2f9a3fb81b
++ disable otel monitor crds
2026-06-24 15:40:19 +03:00
7bbe836fef
++ relax otel rollout dependencies
2026-06-24 15:31:15 +03:00
c02e553ba4
++ add otel istio tracing config
2026-06-24 15:25:48 +03:00
531fb6d0f0
++ bump sanitizer-multi image and enable fk gate
...
- workflowtemplate-multi: image infra_4079fdcf -> infra_68ef2cee
- enable run_fk_integrity_validation by default, add run_fk_orphan_prune param
- cronworkflow-multi: same fk param defaults for when it is resumed
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 13:34:35 +03:00
010bf6d0cf
++ fix openobserve pull secret
2026-06-24 11:02:56 +03:00
beb833890f
++ fix postgresql namespace duplicate
2026-06-24 10:31:40 +03:00
emelinda
ba6fe89549
Refactor yc-k8s-test infrastructure by splitting kustomization files into resource-specific directories.
2026-06-23 11:56:05 +03:00
b5d9d17550
Use fixed pg sanitizer multi image
2026-06-22 14:33:19 +03:00
2e94d2329c
Add pg sanitizer multi workflow
2026-06-20 21:31:59 +03:00
07f948900c
Disable istio injection for openobserve namespace
2026-06-18 10:18:09 +03:00
176445e9f9
Tune sanitizer postgres and bump workflow image
2026-06-16 17:15:05 +03:00
a342d22cd7
Fix pg sanitizer workflow env indentation
2026-06-15 17:34:20 +03:00
dde00fcfdc
Reduce pg sanitizer restore memory settings
2026-06-15 17:27:50 +03:00
2d880a3649
Use pg sanitizer image 0.1.8
2026-06-15 17:17:22 +03:00
c4093f18d0
Use yc pg dumper chart 0.1.5
2026-06-12 09:50:56 +03:00
77c5f0a56b
Use pg sanitizer image 0.1.7
2026-06-12 00:35:56 +03:00
7e52436d70
Use pg sanitizer image 0.1.6
2026-06-11 20:31:51 +03:00
991018b35c
Suspend pg sanitizer cron workflow
2026-06-11 19:25:22 +03:00
