New service on universal-chart with Vault Agent: role premises, SA
premises-vault, creds for its own postgres, kafka and S3 plus the five
neighbour databases the sync script reads. The vad overlay mounts the Kafka CA
and drops the prod-sized resource requests; istio-config routes
sarex.vadroad.ru/premises/api/ to backend-svc.premises.
/orchestrator/api/process/, /orchestrator/api/sign and /orchestrator/ are
rewritten to /api/... before reaching cde.orchestrator:8080, same rules as
the cde-api virtual service in vad. Replaces the single prefix route that
passed the path through unchanged.
Same cde-api virtual service as d8-ugmk-prod: /orchestrator/api/process/,
/orchestrator/api/sign and /orchestrator/ are rewritten to /api/... and sent
to cde-svc.cde.svc.cluster.local:80.
New HelmRelease services.admin-frontend in apps/control-interface/base,
matching the live Deployment's image/port/resources (cpu 100m, memory
100Mi) and istio tracing podAnnotations. Downward-API envs (K8S_POD_UID/
K8S_POD_NAME/K8S_NAMESPACE/OTEL_RESOURCE_ATTRIBUTES) were left out — no
existing app in this repo uses valueFrom/fieldRef in the universal-chart
envs schema and the chart source isn't reachable to confirm support.
imagePullSecrets uses regcred (vad's actual convention) instead of the
source's dockerhub.
Since control-interface/vad and /uralkal both just inherit ../base
unmodified, this also shows up in uralkal as a side effect.
infrastructure/istio-config/vad: adds a plain admin-frontend route
(/admin-frontend/static/ -> admin-frontend-svc.control-interface, rewrite
/), matching the minimal style of the other sarex.vadroad.ru routes —
no cors block, per request.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds 13 new VirtualServices on the existing test.sarex.brusnika.tech host
and ingress-nginx/main-gateway, matching the active (non-commented)
location blocks in global-ingress's nginx-configmap (fetched live from the
cluster and cross-checked service/port/namespace names against what's
actually running). The root path (/) stays routed to
nginx-service.global-ingress as a fallback for anything not covered here.
Two deliberate deviations from literally replaying the nginx config:
- /comparisons/api/: nginx proxies to port 8080, but the real
backend-service.comparisons Service listens on 80 (targetPort 8080) —
used 80.
- /orchestrator/: nginx declares 4 location blocks, but the first
(bare ~^/orchestrator/) shadows the other three for any non-empty
path (nginx picks the first matching regex location, not the most
specific), so only one route (no rewrite) was ported, matching what
nginx actually does today.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
apps/<app>/uralkal mirrors apps/<app>/vad for all 36 apps from
clusters/vad/kustomization.yaml, with domains remapped (not a suffix swap —
vad's sarex-login.vadroad.ru etc. use a different host scheme than uralkal's
login.sarex.local.uralkali.com). Two things are left as explicit
placeholders pending real infra: the Zitadel client_id/org_id
(TBD_URALKAL_ZITADEL_CLIENT_ID, since uralkal's Zitadel has no application
registered yet) and the Kafka CA cert in pm/issues/message-hub/flows
(copied from vad, will need swapping once uralkal's Kafka actually
generates its own CA, same as vad's history).
infrastructure/s3-proxy/uralkal: new component, nginx upstream points at
the single uralkal minio endpoint (10.133.0.245:9000) from terraform,
unlike vad's 4-node list.
clusters/uralkal/kustomization.yaml: wires in s3-proxy + all 36 apps.
infrastructure/istio-config/uralkal/istio-config.yaml: adds the 28
path-routed virtualServices under sarex.local.uralkali.com (mirroring
vad's sarex.vadroad.ru routing, incl. the documentations-api CORS policy)
plus stamp-verification/document-link/s3 on their already-declared hosts.
Pre-existing zitadel/superset/camunda-operate blocks are untouched.
apps/django/vad/backend.yaml: drop a stale explanatory comment (also
removed from the uralkal copy before this commit).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
infrastructure/zitadel/sarex-contour (chart idp-contour 4.12.13), по
образцу overlay vad: без dependsOn на postgresql (БД внешняя, отдельная
машина 111.88.255.180 — заказана через terraform live/database, не
in-cluster HelmRelease), postRenderer снимает nodeSelector с Deployment
+ 2 Job'ов и подменяет vault-agent template на свой (кладёт
Admin.Password/FirstInstance.Org.Human.Password из
secrets/data/zitadel/postgresql).
ExternalDomain — заглушка zitadel.sarex-contour.internal, istio-config
для внешнего доступа ещё не заведён.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
cert-manager в sarex-contour не раскатан, chart рендерит Certificate/
Gateway/VirtualService для ingress несмотря на values:null (как и в
vad/d8-ugmk-prod) — install падал на "no matches for kind Certificate".
Тот же postRenderer $patch:delete, что у vad.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
infrastructure/kafka/sarex-contour, infrastructure/rabbitmq/sarex-contour
(values по образцу yc-k8s-test, controller-only kafka KRaft, rabbitmq
1 реплика, local-path). Vault для них уже заведён отдельно (terraform
environments.sarex-contour.vault, kafka/rabbitmq policy+role+kv).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
chart всегда рендерит raft HA; для контура держим одну ноду вместо
дефолтных трёх — меньше unseal-операций и PVC.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
chart 0.2.3 игнорирует server.standalone/ha.enabled и рендерит raft;
не воюем с ним — values только regcred + backup off, как в overlay ugok.
postRenderer снимает nodeSelector dedicated=sts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
chart vault-contour 0.2.3 прибивает server-под к нодам dedicated=sts,
в кластере их нет → под висел Pending. postRenderer + values обнуляют
nodeSelector/tolerations на StatefulSet и injector.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
vault уже стоял в кластере (helm CLI, chart 0.1.0, standalone/raft,
инициализирован, данных нет). Overlay infrastructure/vault/sarex-contour:
values как у прочих свежих контуров (regcred, backup off, standalone),
namespace istio-injection: disabled. helm-controller перенимает релиз
`vault` и апгрейдит до 0.2.3 (base). StatefulSet updateStrategy: OnDelete —
под не дёргается автоматически.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
base-чарт istio-gateway прибит к control-plane нодам и просит 3 реплики
с hostPort — в sarex-contour одна control-plane нода, 2 пода висли Pending.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Новый кластер clusters/sarex-contour: flux-system (bootstrap на
gitlab.sarex.io, path ./clusters/sarex-contour), helm-repositories
(yc-oci-charts), раскатка istio-base/istiod/ingressgateway.
Gateway опубликован через NodePort 30080/30443 — в контуре нет
облачного LoadBalancer.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
