The overlay inherited SaaS prod hosts from base (api.sarex.io, lk.sarex.io),
which fail TLS verification from the closed contour. Point documentations,
flows, django and notes at their uralkal services; REDIS_USE and TIMEOUT
unchanged.
drawings-api builds its workflows client from WORKFLOW_HOST, which no cluster
set, so POST /internal/v1/exports failed with 'unsupported protocol scheme'.
Add WORKFLOW_HOST and the other export settings from the drawings-api chart
with uralkal service addresses (processing, drawings, attachments).
The overlay inherited base env copied from SaaS prod: DJANGO_HOST
https://lk.sarex.io, workspaces/workflows on api.sarex.io and PG_SSL_MODE
verify-full. From the closed contour every request to django failed with
CERTIFICATE_VERIFY_FAILED. Point django, workspaces and workflows at their
uralkal services, attachments at its real port 8000, disable postgres SSL
(the uralkal server has none). FAAS_SERVICE and RESOURCE_URL stay as in base:
neither service exists in uralkal.
YANDEX_S3_ENDPOINT_URL 10.133.0.245:9000 instead of s3-proxy, same as
documentations; the minioadmin credentials come from minio/apps/attachments
(terraform contour).
Overrides the base tasks-execution-config-comparisons-v2 ConfigMap (mounted
at /etc/app/tasks-execution-config.json) for uralkal: all 16 workflow tasks
run on the k8s executor with 2 CPU / 4Gi requests.
comparisons-api-v2 calls GET /api/v1/bundles and /api/v1/workspaces on
DOCUMENTATIONS_EXTERNAL_HOST from inside the pod. sarex.local.uralkali.com
is signed by the customer's internal CA, which the image does not trust
(x509: unknown authority), so creating a comparison failed with 500. The
documentations service serves the same /api/v1 paths internally.
documentations base: pdm-api pointed DRAWINGS_INTERNAL_URL at
drawings-api-service:80, which does not exist in the clusters inheriting
base (vad, d8-ugmk-prod, sarex-contour, uralkal, yc-k8s-test); their drawings
service is backend-service:8000. brusnika and wb keep their own pdm copies.
istio-config uralkal: /notes/api/ -> backend-service.notes:8000 (rewrite
/api/) and /notes/static/ -> frontend-service.notes:80.
notes base frontend image -> notes-frontend:contour_5ff34172.
Base image moves to cross-section-app:contour_c5e5d476 for every cluster
inheriting it. istio-config uralkal routes /cross-section/static/ to
cross-section-static:80.
comparisons-api-v2 builds its postgres URI without sslmode, so both lib/pq
(migrations) and pgx (api) default to requiring TLS, which the uralkal
postgres does not serve.
uralkal runs comparisons-api-v2:contour_9a2bab4e (built with bash so the
Vault Agent files can be sourced): migrations up before exec ./api, port 8080
behind the unchanged service port 8000, v2 env schema with uralkal service
addresses. istio-config uralkal routes /comparisons/api/ and
/comparisons/static/. Base frontend image moves to
comparisons-frontend:contour_0570a1f1 for every cluster using base.
- Replace incorrect `WORKFLOWS_HOST` and `WORKFLOWS_URL` references across multiple YAML files to point to `backend-svc.processing.svc.cluster.local`.
- Update `DOCUMENTATIONS_URL` to use the accurate service name `backend-api-svc.documentations.svc.cluster.local`.
- Adjust `SAREX_API` and related settings for consistency using `https://sarex.uralmine.com`.
- Refactor `production-configmap.yaml` to align environment variable overrides and remove obsolete hardcoded values.
- Resolve key INFRA-3005 issues to prevent Excel export and notification failures caused by invalid DNS and configuration.
