The base production.py hardcoded SAREX_API = https://srx.wb.ru, ignoring the
env, so issue export (GET /api/core/users/<id>/) failed from closed contours
with CERTIFICATE_VERIFY_FAILED. Read it from SAREX_API with the old value as
default; wb keeps it.
uralkal, vad, d8-ugmk-prod: SAREX_API -> backend-svc.django:80 (server-side
calls, no TLS), and SAREX_HOST set to the contour's public host so links in
exports and notifications stay external.
Deckhouse admission-policy-engine (baseline) rejected the pods because
istio-init needs NET_ADMIN and NET_RAW. Label the namespace
security.deckhouse.io/pod-policy=privileged like the other app namespaces in
ugmk.
premises: d8-ugmk-prod overlay (ugmk Kafka CA mounted, prod-sized requests
dropped), wired into the cluster, /premises/api/ routed on sarex.uralmine.com.
Terraform side is infra/terraform 856ab54.
istio-config d8-ugmk-prod, vad, uralkal: inspections-api reused the name
flows-api-virt-service, so two VirtualServices collided and one of
/flows/api/ and /inspections/api/ was lost. It is now
inspections-api-virt-service.
remarks base frontend image -> remarks-frontend:contour_013c5091.
psql-tools-debug in uralkal sleeps forever so it can be exec'd into.
The overlay inherited SaaS prod hosts from base (api.sarex.io, lk.sarex.io),
which fail TLS verification from the closed contour. Point documentations,
flows, django and notes at their uralkal services; REDIS_USE and TIMEOUT
unchanged.
drawings-api builds its workflows client from WORKFLOW_HOST, which no cluster
set, so POST /internal/v1/exports failed with 'unsupported protocol scheme'.
Add WORKFLOW_HOST and the other export settings from the drawings-api chart
with uralkal service addresses (processing, drawings, attachments).
The overlay inherited base env copied from SaaS prod: DJANGO_HOST
https://lk.sarex.io, workspaces/workflows on api.sarex.io and PG_SSL_MODE
verify-full. From the closed contour every request to django failed with
CERTIFICATE_VERIFY_FAILED. Point django, workspaces and workflows at their
uralkal services, attachments at its real port 8000, disable postgres SSL
(the uralkal server has none). FAAS_SERVICE and RESOURCE_URL stay as in base:
neither service exists in uralkal.
YANDEX_S3_ENDPOINT_URL 10.133.0.245:9000 instead of s3-proxy, same as
documentations; the minioadmin credentials come from minio/apps/attachments
(terraform contour).
Overrides the base tasks-execution-config-comparisons-v2 ConfigMap (mounted
at /etc/app/tasks-execution-config.json) for uralkal: all 16 workflow tasks
run on the k8s executor with 2 CPU / 4Gi requests.
comparisons-api-v2 calls GET /api/v1/bundles and /api/v1/workspaces on
DOCUMENTATIONS_EXTERNAL_HOST from inside the pod. sarex.local.uralkali.com
is signed by the customer's internal CA, which the image does not trust
(x509: unknown authority), so creating a comparison failed with 500. The
documentations service serves the same /api/v1 paths internally.
documentations base: pdm-api pointed DRAWINGS_INTERNAL_URL at
drawings-api-service:80, which does not exist in the clusters inheriting
base (vad, d8-ugmk-prod, sarex-contour, uralkal, yc-k8s-test); their drawings
service is backend-service:8000. brusnika and wb keep their own pdm copies.
istio-config uralkal: /notes/api/ -> backend-service.notes:8000 (rewrite
/api/) and /notes/static/ -> frontend-service.notes:80.
notes base frontend image -> notes-frontend:contour_5ff34172.
Base image moves to cross-section-app:contour_c5e5d476 for every cluster
inheriting it. istio-config uralkal routes /cross-section/static/ to
cross-section-static:80.
comparisons-api-v2 builds its postgres URI without sslmode, so both lib/pq
(migrations) and pgx (api) default to requiring TLS, which the uralkal
postgres does not serve.
uralkal runs comparisons-api-v2:contour_9a2bab4e (built with bash so the
Vault Agent files can be sourced): migrations up before exec ./api, port 8080
behind the unchanged service port 8000, v2 env schema with uralkal service
addresses. istio-config uralkal routes /comparisons/api/ and
/comparisons/static/. Base frontend image moves to
comparisons-frontend:contour_0570a1f1 for every cluster using base.
- Replace incorrect `WORKFLOWS_HOST` and `WORKFLOWS_URL` references across multiple YAML files to point to `backend-svc.processing.svc.cluster.local`.
- Update `DOCUMENTATIONS_URL` to use the accurate service name `backend-api-svc.documentations.svc.cluster.local`.
- Adjust `SAREX_API` and related settings for consistency using `https://sarex.uralmine.com`.
- Refactor `production-configmap.yaml` to align environment variable overrides and remove obsolete hardcoded values.
- Resolve key INFRA-3005 issues to prevent Excel export and notification failures caused by invalid DNS and configuration.
The base django-configmap hardcoded HOST to the yc-k8s-test domain, and every
cluster inheriting it got that value. HOST now reads DJANGO_HOST with the old
value as the default; backend in vad, uralkal and d8-ugmk-prod sets its own
public host. celery is left on the default.
Manifests exported from the live cluster with server-side and Helm/Lens
metadata stripped; selectors and pod labels kept as they are so Flux takes
the objects over without restarting pods.
orchestrator: cde API, its Service and ServiceAccount, the v1 workers
installed by the old helm release cde and the v2 workers rolled out today.
documentations: hasher and pdf-markings-amqp. Secrets (cde-secret,
hasher-*, postgres-secret, rabbitmq, yc-s3, dockerhub, regcred) stay in the
cluster only. The old apps/cde/brusnika-stage overlay (namespace contracts,
HelmRelease cde) was never wired; its kustomization now lists only these
manifests.
