documentations base: pdm-api pointed DRAWINGS_INTERNAL_URL at
drawings-api-service:80, which does not exist in the clusters inheriting
base (vad, d8-ugmk-prod, sarex-contour, uralkal, yc-k8s-test); their drawings
service is backend-service:8000. brusnika and wb keep their own pdm copies.
istio-config uralkal: /notes/api/ -> backend-service.notes:8000 (rewrite
/api/) and /notes/static/ -> frontend-service.notes:80.
notes base frontend image -> notes-frontend:contour_5ff34172.
Base image moves to cross-section-app:contour_c5e5d476 for every cluster
inheriting it. istio-config uralkal routes /cross-section/static/ to
cross-section-static:80.
comparisons-api-v2 builds its postgres URI without sslmode, so both lib/pq
(migrations) and pgx (api) default to requiring TLS, which the uralkal
postgres does not serve.
uralkal runs comparisons-api-v2:contour_9a2bab4e (built with bash so the
Vault Agent files can be sourced): migrations up before exec ./api, port 8080
behind the unchanged service port 8000, v2 env schema with uralkal service
addresses. istio-config uralkal routes /comparisons/api/ and
/comparisons/static/. Base frontend image moves to
comparisons-frontend:contour_0570a1f1 for every cluster using base.
- Replace incorrect `WORKFLOWS_HOST` and `WORKFLOWS_URL` references across multiple YAML files to point to `backend-svc.processing.svc.cluster.local`.
- Update `DOCUMENTATIONS_URL` to use the accurate service name `backend-api-svc.documentations.svc.cluster.local`.
- Adjust `SAREX_API` and related settings for consistency using `https://sarex.uralmine.com`.
- Refactor `production-configmap.yaml` to align environment variable overrides and remove obsolete hardcoded values.
- Resolve key INFRA-3005 issues to prevent Excel export and notification failures caused by invalid DNS and configuration.
The base django-configmap hardcoded HOST to the yc-k8s-test domain, and every
cluster inheriting it got that value. HOST now reads DJANGO_HOST with the old
value as the default; backend in vad, uralkal and d8-ugmk-prod sets its own
public host. celery is left on the default.
Manifests exported from the live cluster with server-side and Helm/Lens
metadata stripped; selectors and pod labels kept as they are so Flux takes
the objects over without restarting pods.
orchestrator: cde API, its Service and ServiceAccount, the v1 workers
installed by the old helm release cde and the v2 workers rolled out today.
documentations: hasher and pdf-markings-amqp. Secrets (cde-secret,
hasher-*, postgres-secret, rabbitmq, yc-s3, dockerhub, regcred) stay in the
cluster only. The old apps/cde/brusnika-stage overlay (namespace contracts,
HelmRelease cde) was never wired; its kustomization now lists only these
manifests.
New service on universal-chart with Vault Agent: role premises, SA
premises-vault, creds for its own postgres, kafka and S3 plus the five
neighbour databases the sync script reads. The vad overlay mounts the Kafka CA
and drops the prod-sized resource requests; istio-config routes
sarex.vadroad.ru/premises/api/ to backend-svc.premises.
KAFKA_SASL_MECHANISM is read from auth.sasl_mechanism when the nested auth
map exists and from the top-level sasl_mechanism otherwise, so the pods start
both before and after kafka/apps/pm switches to creds delivered from the
kafka-topics terraform stack.
flows, issues, pm and message-hub read ca.crt from a copy of the Kafka TLS
secret in their own namespace instead of an inline PEM (flows) or a
per-namespace kafka-ca-cert ConfigMap (issues, pm, message-hub). Mount paths
and env names are unchanged. The secret must exist in each namespace before
the pods restart.
universal-chart already injects proxy.istio.io/config and
traffic.sidecar.istio.io/excludeOutboundPorts by default for every
service — explicitly setting them too produced a duplicate-key YAML
error in Flux's post-render step:
error while running post render on files: ... yaml: unmarshal errors:
line 42: mapping key "traffic.sidecar.istio.io/excludeOutboundPorts" already defined at line 25
line 41: mapping key "proxy.istio.io/config" already defined at line 26
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New HelmRelease services.admin-frontend in apps/control-interface/base,
matching the live Deployment's image/port/resources (cpu 100m, memory
100Mi) and istio tracing podAnnotations. Downward-API envs (K8S_POD_UID/
K8S_POD_NAME/K8S_NAMESPACE/OTEL_RESOURCE_ATTRIBUTES) were left out — no
existing app in this repo uses valueFrom/fieldRef in the universal-chart
envs schema and the chart source isn't reachable to confirm support.
imagePullSecrets uses regcred (vad's actual convention) instead of the
source's dockerhub.
Since control-interface/vad and /uralkal both just inherit ../base
unmodified, this also shows up in uralkal as a side effect.
infrastructure/istio-config/vad: adds a plain admin-frontend route
(/admin-frontend/static/ -> admin-frontend-svc.control-interface, rewrite
/), matching the minimal style of the other sarex.vadroad.ru routes —
no cors block, per request.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Missing env vars copied from wb for ams-sync, attachments, bi/frontend,
checklists, django (celery, export-project, sarex-backend), documentations
(api, filestream, pdm), eav, flows (backend, celery, frontend), iam,
inspections, issues (backend, celery), rfi, transmittal/worker.
Image tags updated to match wb for flows (backend/celery/frontend), iam.
Known issue, not yet fixed in this commit: several of the copied env
values are wb-specific hosts (*.wb.ru, one uralmine.com) that don't apply
to brusnika-stage — ZITADEL_HOST/ZITADEL_DOMAIN (django, documentations,
iam), DATABASE_HOST/FLOWS_DB_HOST/ISSUES_DB_HOST (checklists, flows),
SUPERSET_HOST (bi), DJANGO_BASE_HOST/SAREX_BACKEND_URL (flows,
inspections), RESOURCES_INTERNAL_HOST/RESOURCE_URL (ams-sync, django,
flows, notes-related). To be corrected in a follow-up commit.
bi/backend.yaml, bim/backend.yaml and notes/backend.yaml were reverted
before this commit (image-tag updates for bi-backend/bim/notes and bi's
SUPERSET_* env additions are not included).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Every services.<svc>.deployment.resources.requests.{cpu,memory} across the
36 uralkal apps (69 HelmRelease/service entries total) is now nulled via a
kustomize patch, so Helm never renders a requests block for these pods on
uralkal — Kubernetes won't reserve CPU/memory for them there.
Where a uralkal patch already existed for that service (13 cases:
documentations api/filestream/pdf-markings-amqp, django backend, flows
backend/celery, pm backend/celery, transmittal backend/worker, bi,
document-link, stamp-verification, message-hub), the null block was added
into that same file. Where no uralkal patch existed yet (55 cases,
including all 13 cde workers and every plain frontend), a new minimal
patch file was added and wired into that app's kustomization.yaml.
vad and the other clusters are untouched — only apps/*/uralkal/* changed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
apps/<app>/uralkal mirrors apps/<app>/vad for all 36 apps from
clusters/vad/kustomization.yaml, with domains remapped (not a suffix swap —
vad's sarex-login.vadroad.ru etc. use a different host scheme than uralkal's
login.sarex.local.uralkali.com). Two things are left as explicit
placeholders pending real infra: the Zitadel client_id/org_id
(TBD_URALKAL_ZITADEL_CLIENT_ID, since uralkal's Zitadel has no application
registered yet) and the Kafka CA cert in pm/issues/message-hub/flows
(copied from vad, will need swapping once uralkal's Kafka actually
generates its own CA, same as vad's history).
infrastructure/s3-proxy/uralkal: new component, nginx upstream points at
the single uralkal minio endpoint (10.133.0.245:9000) from terraform,
unlike vad's 4-node list.
clusters/uralkal/kustomization.yaml: wires in s3-proxy + all 36 apps.
infrastructure/istio-config/uralkal/istio-config.yaml: adds the 28
path-routed virtualServices under sarex.local.uralkali.com (mirroring
vad's sarex.vadroad.ru routing, incl. the documentations-api CORS policy)
plus stamp-verification/document-link/s3 on their already-declared hosts.
Pre-existing zitadel/superset/camunda-operate blocks are untouched.
apps/django/vad/backend.yaml: drop a stale explanatory comment (also
removed from the uralkal copy before this commit).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
First business app on asterus, overlay copied from brusnika-prod
(no namespace.yaml — ns and regcred created manually, out of band).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
django's nginx-configmap is patched for vad: pm and processing aren't
deployed there yet (kept commented out), documentations is enabled
since it's going in alongside django this time.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
apps/control-interface/base has no namespace.yaml (unlike reviews,
remarks, auth-flow), so Flux failed applying the HelmRelease into a
namespace that was never created.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
