ns postgres-tls-test: postgresql-contour pg-tls с tls.autoGenerated,
ssl_min_protocol_version TLSv1.2, pg_hba только hostssl (local для
администрирования); notes-tls на образе notes-backend с
PG_SSL_MODE/PGSSLMODE=verify-full и CA из pg-tls-crt.
regcred в ns создаётся вручную.
driftDetection.mode: enabled патчем в clusters/uralkal/kustomization.yaml,
base и другие контуры не затронуты. Исключены webhooks в
Mutating/ValidatingWebhookConfiguration (caBundle пишут vault-injector и
istiod) и /spec/replicas Deployment у istiod (HPA istio-system/istiod).
Kustomization flux-system уже prune: true, interval: 10m.
apps/<app>/uralkal mirrors apps/<app>/vad for all 36 apps from
clusters/vad/kustomization.yaml, with domains remapped (not a suffix swap —
vad's sarex-login.vadroad.ru etc. use a different host scheme than uralkal's
login.sarex.local.uralkali.com). Two things are left as explicit
placeholders pending real infra: the Zitadel client_id/org_id
(TBD_URALKAL_ZITADEL_CLIENT_ID, since uralkal's Zitadel has no application
registered yet) and the Kafka CA cert in pm/issues/message-hub/flows
(copied from vad, will need swapping once uralkal's Kafka actually
generates its own CA, same as vad's history).
infrastructure/s3-proxy/uralkal: new component, nginx upstream points at
the single uralkal minio endpoint (10.133.0.245:9000) from terraform,
unlike vad's 4-node list.
clusters/uralkal/kustomization.yaml: wires in s3-proxy + all 36 apps.
infrastructure/istio-config/uralkal/istio-config.yaml: adds the 28
path-routed virtualServices under sarex.local.uralkali.com (mirroring
vad's sarex.vadroad.ru routing, incl. the documentations-api CORS policy)
plus stamp-verification/document-link/s3 on their already-declared hosts.
Pre-existing zitadel/superset/camunda-operate blocks are untouched.
apps/django/vad/backend.yaml: drop a stale explanatory comment (also
removed from the uralkal copy before this commit).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
