Deckhouse admission-policy-engine (baseline) rejected the pods because
istio-init needs NET_ADMIN and NET_RAW. Label the namespace
security.deckhouse.io/pod-policy=privileged like the other app namespaces in
ugmk.
premises: d8-ugmk-prod overlay (ugmk Kafka CA mounted, prod-sized requests
dropped), wired into the cluster, /premises/api/ routed on sarex.uralmine.com.
Terraform side is infra/terraform 856ab54.
istio-config d8-ugmk-prod, vad, uralkal: inspections-api reused the name
flows-api-virt-service, so two VirtualServices collided and one of
/flows/api/ and /inspections/api/ was lost. It is now
inspections-api-virt-service.
remarks base frontend image -> remarks-frontend:contour_013c5091.
psql-tools-debug in uralkal sleeps forever so it can be exec'd into.
The overlay inherited SaaS prod hosts from base (api.sarex.io, lk.sarex.io),
which fail TLS verification from the closed contour. Point documentations,
flows, django and notes at their uralkal services; REDIS_USE and TIMEOUT
unchanged.
drawings-api builds its workflows client from WORKFLOW_HOST, which no cluster
set, so POST /internal/v1/exports failed with 'unsupported protocol scheme'.
Add WORKFLOW_HOST and the other export settings from the drawings-api chart
with uralkal service addresses (processing, drawings, attachments).
The overlay inherited base env copied from SaaS prod: DJANGO_HOST
https://lk.sarex.io, workspaces/workflows on api.sarex.io and PG_SSL_MODE
verify-full. From the closed contour every request to django failed with
CERTIFICATE_VERIFY_FAILED. Point django, workspaces and workflows at their
uralkal services, attachments at its real port 8000, disable postgres SSL
(the uralkal server has none). FAAS_SERVICE and RESOURCE_URL stay as in base:
neither service exists in uralkal.
YANDEX_S3_ENDPOINT_URL 10.133.0.245:9000 instead of s3-proxy, same as
documentations; the minioadmin credentials come from minio/apps/attachments
(terraform contour).
Overrides the base tasks-execution-config-comparisons-v2 ConfigMap (mounted
at /etc/app/tasks-execution-config.json) for uralkal: all 16 workflow tasks
run on the k8s executor with 2 CPU / 4Gi requests.
comparisons-api-v2 calls GET /api/v1/bundles and /api/v1/workspaces on
DOCUMENTATIONS_EXTERNAL_HOST from inside the pod. sarex.local.uralkali.com
is signed by the customer's internal CA, which the image does not trust
(x509: unknown authority), so creating a comparison failed with 500. The
documentations service serves the same /api/v1 paths internally.
documentations base: pdm-api pointed DRAWINGS_INTERNAL_URL at
drawings-api-service:80, which does not exist in the clusters inheriting
base (vad, d8-ugmk-prod, sarex-contour, uralkal, yc-k8s-test); their drawings
service is backend-service:8000. brusnika and wb keep their own pdm copies.
istio-config uralkal: /notes/api/ -> backend-service.notes:8000 (rewrite
/api/) and /notes/static/ -> frontend-service.notes:80.
notes base frontend image -> notes-frontend:contour_5ff34172.
Base image moves to cross-section-app:contour_c5e5d476 for every cluster
inheriting it. istio-config uralkal routes /cross-section/static/ to
cross-section-static:80.
comparisons-api-v2 builds its postgres URI without sslmode, so both lib/pq
(migrations) and pgx (api) default to requiring TLS, which the uralkal
postgres does not serve.
uralkal runs comparisons-api-v2:contour_9a2bab4e (built with bash so the
Vault Agent files can be sourced): migrations up before exec ./api, port 8080
behind the unchanged service port 8000, v2 env schema with uralkal service
addresses. istio-config uralkal routes /comparisons/api/ and
/comparisons/static/. Base frontend image moves to
comparisons-frontend:contour_0570a1f1 for every cluster using base.
- Replace incorrect `WORKFLOWS_HOST` and `WORKFLOWS_URL` references across multiple YAML files to point to `backend-svc.processing.svc.cluster.local`.
- Update `DOCUMENTATIONS_URL` to use the accurate service name `backend-api-svc.documentations.svc.cluster.local`.
- Adjust `SAREX_API` and related settings for consistency using `https://sarex.uralmine.com`.
- Refactor `production-configmap.yaml` to align environment variable overrides and remove obsolete hardcoded values.
- Resolve key INFRA-3005 issues to prevent Excel export and notification failures caused by invalid DNS and configuration.
The base django-configmap hardcoded HOST to the yc-k8s-test domain, and every
cluster inheriting it got that value. HOST now reads DJANGO_HOST with the old
value as the default; backend in vad, uralkal and d8-ugmk-prod sets its own
public host. celery is left on the default.
Manifests exported from the live cluster with server-side and Helm/Lens
metadata stripped; selectors and pod labels kept as they are so Flux takes
the objects over without restarting pods.
orchestrator: cde API, its Service and ServiceAccount, the v1 workers
installed by the old helm release cde and the v2 workers rolled out today.
documentations: hasher and pdf-markings-amqp. Secrets (cde-secret,
hasher-*, postgres-secret, rabbitmq, yc-s3, dockerhub, regcred) stay in the
cluster only. The old apps/cde/brusnika-stage overlay (namespace contracts,
HelmRelease cde) was never wired; its kustomization now lists only these
manifests.
New service on universal-chart with Vault Agent: role premises, SA
premises-vault, creds for its own postgres, kafka and S3 plus the five
neighbour databases the sync script reads. The vad overlay mounts the Kafka CA
and drops the prod-sized resource requests; istio-config routes
sarex.vadroad.ru/premises/api/ to backend-svc.premises.
KAFKA_SASL_MECHANISM is read from auth.sasl_mechanism when the nested auth
map exists and from the top-level sasl_mechanism otherwise, so the pods start
both before and after kafka/apps/pm switches to creds delivered from the
kafka-topics terraform stack.
flows, issues, pm and message-hub read ca.crt from a copy of the Kafka TLS
secret in their own namespace instead of an inline PEM (flows) or a
per-namespace kafka-ca-cert ConfigMap (issues, pm, message-hub). Mount paths
and env names are unchanged. The secret must exist in each namespace before
the pods restart.
universal-chart already injects proxy.istio.io/config and
traffic.sidecar.istio.io/excludeOutboundPorts by default for every
service — explicitly setting them too produced a duplicate-key YAML
error in Flux's post-render step:
error while running post render on files: ... yaml: unmarshal errors:
line 42: mapping key "traffic.sidecar.istio.io/excludeOutboundPorts" already defined at line 25
line 41: mapping key "proxy.istio.io/config" already defined at line 26
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New HelmRelease services.admin-frontend in apps/control-interface/base,
matching the live Deployment's image/port/resources (cpu 100m, memory
100Mi) and istio tracing podAnnotations. Downward-API envs (K8S_POD_UID/
K8S_POD_NAME/K8S_NAMESPACE/OTEL_RESOURCE_ATTRIBUTES) were left out — no
existing app in this repo uses valueFrom/fieldRef in the universal-chart
envs schema and the chart source isn't reachable to confirm support.
imagePullSecrets uses regcred (vad's actual convention) instead of the
source's dockerhub.
Since control-interface/vad and /uralkal both just inherit ../base
unmodified, this also shows up in uralkal as a side effect.
infrastructure/istio-config/vad: adds a plain admin-frontend route
(/admin-frontend/static/ -> admin-frontend-svc.control-interface, rewrite
/), matching the minimal style of the other sarex.vadroad.ru routes —
no cors block, per request.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Missing env vars copied from wb for ams-sync, attachments, bi/frontend,
checklists, django (celery, export-project, sarex-backend), documentations
(api, filestream, pdm), eav, flows (backend, celery, frontend), iam,
inspections, issues (backend, celery), rfi, transmittal/worker.
Image tags updated to match wb for flows (backend/celery/frontend), iam.
Known issue, not yet fixed in this commit: several of the copied env
values are wb-specific hosts (*.wb.ru, one uralmine.com) that don't apply
to brusnika-stage — ZITADEL_HOST/ZITADEL_DOMAIN (django, documentations,
iam), DATABASE_HOST/FLOWS_DB_HOST/ISSUES_DB_HOST (checklists, flows),
SUPERSET_HOST (bi), DJANGO_BASE_HOST/SAREX_BACKEND_URL (flows,
inspections), RESOURCES_INTERNAL_HOST/RESOURCE_URL (ams-sync, django,
flows, notes-related). To be corrected in a follow-up commit.
bi/backend.yaml, bim/backend.yaml and notes/backend.yaml were reverted
before this commit (image-tag updates for bi-backend/bim/notes and bi's
SUPERSET_* env additions are not included).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Every services.<svc>.deployment.resources.requests.{cpu,memory} across the
36 uralkal apps (69 HelmRelease/service entries total) is now nulled via a
kustomize patch, so Helm never renders a requests block for these pods on
uralkal — Kubernetes won't reserve CPU/memory for them there.
Where a uralkal patch already existed for that service (13 cases:
documentations api/filestream/pdf-markings-amqp, django backend, flows
backend/celery, pm backend/celery, transmittal backend/worker, bi,
document-link, stamp-verification, message-hub), the null block was added
into that same file. Where no uralkal patch existed yet (55 cases,
including all 13 cde workers and every plain frontend), a new minimal
patch file was added and wired into that app's kustomization.yaml.
vad and the other clusters are untouched — only apps/*/uralkal/* changed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
apps/<app>/uralkal mirrors apps/<app>/vad for all 36 apps from
clusters/vad/kustomization.yaml, with domains remapped (not a suffix swap —
vad's sarex-login.vadroad.ru etc. use a different host scheme than uralkal's
login.sarex.local.uralkali.com). Two things are left as explicit
placeholders pending real infra: the Zitadel client_id/org_id
(TBD_URALKAL_ZITADEL_CLIENT_ID, since uralkal's Zitadel has no application
registered yet) and the Kafka CA cert in pm/issues/message-hub/flows
(copied from vad, will need swapping once uralkal's Kafka actually
generates its own CA, same as vad's history).
infrastructure/s3-proxy/uralkal: new component, nginx upstream points at
the single uralkal minio endpoint (10.133.0.245:9000) from terraform,
unlike vad's 4-node list.
clusters/uralkal/kustomization.yaml: wires in s3-proxy + all 36 apps.
infrastructure/istio-config/uralkal/istio-config.yaml: adds the 28
path-routed virtualServices under sarex.local.uralkali.com (mirroring
vad's sarex.vadroad.ru routing, incl. the documentations-api CORS policy)
plus stamp-verification/document-link/s3 on their already-declared hosts.
Pre-existing zitadel/superset/camunda-operate blocks are untouched.
apps/django/vad/backend.yaml: drop a stale explanatory comment (also
removed from the uralkal copy before this commit).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
First business app on asterus, overlay copied from brusnika-prod
(no namespace.yaml — ns and regcred created manually, out of band).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
