ivan
e5c01279b7
ugok: bootstrap application layer on universal-chart from cluster dump
...
Adds apps/<app>/ugok overlays for 31 applications, derived strictly from
a live cluster dump (kubectl get deployment/service/configmap/secret),
following the wb overlay pattern (standalone HelmRelease patches on
universal-chart, plain k8s Secret + secretKeyRef instead of Vault Agent
since the ugok cluster has zero Vault usage cluster-wide).
- processing (workflow namespace) does not extend base: base is
vault-native, ugok is not, so it's four standalone HelmReleases
modeled on apps/processing/wb/*.
- issues/redis and django/redis are raw Deployments patched via JSON6902.
- documentations/pdf-markings and django/auth-flow-frontend,
export-project are copied in as standalone files (base has no
HelmRelease for them, and kustomize forbids cross-overlay references
outside a directory's own tree).
- Images and images-with-registry updated to match wb where the same
build lineage applies; left as-is where the wb tag carries a distinct
client/cluster name (donstroi1, brusnika_*, dev4, UGOK_*, ugok1_*) or
points at a different image repository entirely.
- Missing backend envs backfilled from wb where safe (internal
svc.cluster.local refs, feature flags, already-established ugok
domains); skipped where wb-specific (external DB/Kafka hosts, TLS CA
content, features not deployed in ugok like gatekeeper/Superset).
- message-hub patch was missing its entire env block from the original
bootstrap; rebuilt from the raw dump (not wb, whose Kafka/DB config is
incompatible) plus a handful of small env gaps found while
cross-checking every ugok app's rendered envs against the raw dump.
clusters/ugok/kustomization.yaml keeps the apps section commented out —
not wired into the Flux Kustomization yet, pending review.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-28 23:41:50 +05:00
75cecf0321
++ add vault install for ugok
2026-08-28 13:14:11 +03:00
de24873d04
++ revert bad certSecretRef field on gitrepository
2026-08-28 12:58:36 +03:00
f39659f7bf
++ add gitea ca secretref for ugok
2026-08-28 12:51:32 +03:00
d9703b0c19
++ add ugok cluster flux entry
2026-08-28 12:35:30 +03:00
b911b7ea50
++ deploy dedicated in-cluster postgres for zitadel, point zitadel at it
2026-08-26 14:22:02 +03:00
8bbc158e49
++ add s3-proxy nginx service for vad
2026-08-26 12:15:11 +03:00
d2df6afaa4
++ add istio-config for vad with self-signed tls
2026-08-26 12:06:00 +03:00
c38032e64e
++ add kafka camunda zitadel overlays for vad
2026-08-26 11:32:23 +03:00
83262697c0
++ add vault, rabbitmq and istio for vad
2026-08-25 18:22:55 +03:00
5b3fb7d3f6
++ add yc-oci-charts helm repository for vad
2026-08-25 15:34:13 +03:00
abb6c45590
++ add vad cluster flux entrypoint
2026-08-25 15:27:18 +03:00
e44528627c
++ pin pgbouncer service to LoadBalancer with elb annotations
2026-08-21 15:53:26 +03:00
b5efcc378c
++ bump pgbouncer chart to 1.0.12
2026-08-21 14:45:05 +03:00
29cc95ef33
++ add pgbouncer backup pooler to brusnika-prod
2026-08-21 14:21:13 +03:00
34c05548f6
++ add superset trino ugmk
2026-08-20 13:19:52 +03:00
4198f1dfbc
++ remove unused sanitizer db
2026-08-19 08:18:47 +00:00
9ee7e1f76a
++ fix wb superset guest role
2026-08-18 16:54:27 +03:00
1ccb177d3c
++ fix wb superset iframe headers
2026-08-17 18:12:12 +03:00
e9c582800e
++ use wb superset jwt k8s secret
2026-08-17 17:19:21 +03:00
1827903c41
++ fix wb superset guest token secret delivery
2026-08-17 17:00:33 +03:00
1017f93c6e
++ schedule wb trino coordinator on processing
2026-08-14 15:16:06 +03:00
89d5bc0f09
++ tune trino memory for wb
2026-08-14 14:54:29 +03:00
ivan
c6baeedd0c
++
2026-08-13 01:32:27 +05:00
ivan
67610ef269
++
2026-08-13 00:15:42 +05:00
ivan
744db30c5d
++
2026-08-12 23:35:53 +05:00
ivan
e854d6064a
++
2026-08-12 23:21:34 +05:00
5bd29a46f1
++ expand brusnika-stage rabbitmq pvc
2026-08-12 15:25:32 +03:00
eb2192b8f0
++ absolute disk free limit for brusnika-stage rabbitmq
...
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-12 14:52:35 +03:00
ivan
fbdad7f412
++
2026-08-12 16:35:37 +05:00
60d2901a0e
++ shared rabbitmq for brusnika-stage
...
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-12 12:07:17 +03:00
1ae2a13198
expose vault UI for wb via istio at vault-srx.wb.ru, routes to vault-vault-contour-active on 8200
...
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-11 12:41:56 +03:00
802f0b44fc
pin wb vault to generic node group, chart default nodeSelector targets a dedicated STS pool that does not exist in this cluster, same fix as d8-ugmk-prod
...
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-11 12:29:04 +03:00
9391ea9c82
add vault to wb
2026-08-11 12:23:55 +03:00
c55bec5b5d
++ fix acme http01 challenges on external-stage, route all domains through istio instead of the dead nginx solver
2026-08-05 17:24:04 +03:00
emelinda
9da34bb9cc
Re-enable Django app in yc-ecp cluster Kustomization file.
2026-08-05 02:12:32 +03:00
emelinda
8d9e1d3d9e
Comment out Django app in yc-ecp cluster Kustomization file.
2026-08-05 02:11:22 +03:00
emelinda
218d233eb7
Add Django frontend app to yc-ecp: define namespace, configure HelmRelease with chart and deployment details, update Istio configuration, and include in cluster Kustomization
2026-08-05 01:58:35 +03:00
emelinda
64412e1b94
Add Measurements app to yc-ecp: define namespace, update HelmRelease with chart details, and include in cluster Kustomization
2026-08-05 00:35:29 +03:00
emelinda
4abcd33cd5
Comment out Measurements app in yc-ecp cluster Kustomization file.
2026-08-05 00:26:54 +03:00
emelinda
3a5b3b07e6
Add Measurements app to yc-ecp: define HelmRelease, configure Istio certificates, and update cluster Kustomization
2026-08-05 00:00:06 +03:00
emelinda
172e889f00
Add Kubernetes Dashboard configuration to yc-ecp: define HelmRelease, update Istio Gateway and VirtualService, and include in cluster Kustomization
2026-08-04 23:34:53 +03:00
emelinda
c4e6c079f7
Migrate cert-manager configuration to yc-ecp infrastructure directory with updated HelmRelease, ClusterIssuer, and Kustomization files.
2026-08-04 22:53:59 +03:00
emelinda
6e94f826c3
Migrate Istio and Vault configurations to separate yc-ecp infrastructure directories with updated HelmRelease and Kustomization files.
2026-08-04 22:34:42 +03:00
ivan
8a0eee6538
++
2026-08-03 20:41:38 +05:00
a4f1424403
++ move uralmine service domains up one level
2026-08-03 10:56:18 +03:00
ivan
c7b749fd09
++
2026-07-31 12:55:03 +05:00
emelinda
2296dae803
Disable initChownData in Grafana configuration within Prometheus Stack.
2026-07-30 20:04:12 +03:00
emelinda
833652bbc3
Reduce Prometheus Stack timeout to 5m and set disableWait for install, upgrade, and rollback operations.
2026-07-30 19:51:19 +03:00
emelinda
86cbaceeb3
Reduce gotk-sync interval from 10m to 1m in Flux configuration.
2026-07-30 18:20:07 +03:00
emelinda
432fdf4c2e
Update Istio configuration to rename Superset references to BI in host mappings
2026-07-30 18:17:53 +03:00
ivan
da9494b483
change charts
2026-07-30 19:42:35 +05:00
emelinda
7553651efd
Update Grafana securityContext in Prometheus Stack to enforce non-root user settings
2026-07-30 17:23:31 +03:00
ivan
5726d02b62
++
2026-07-29 18:19:52 +05:00
ivan
73ec054bba
++
2026-07-29 17:34:10 +05:00
ivan
76a3ba7d4e
++
2026-07-28 19:15:38 +05:00
ivan
24521afd47
++
2026-07-28 19:10:02 +05:00
ivan
5c43502cba
++
2026-07-28 17:05:43 +05:00
ivan
7bf12669d5
++
2026-07-28 15:19:32 +05:00
ivan
2bd1276cdb
++
2026-07-25 21:18:11 +05:00
ivan
12e4d88957
++
2026-07-25 20:40:22 +05:00
ivan
377280b2fa
++
2026-07-25 20:32:08 +05:00
d2ac44a245
++ fix superset redis image
2026-07-22 13:50:01 +03:00
d8f9c4381d
++ fix superset env duplicates
2026-07-22 13:28:22 +03:00
46d0de18fb
add ss + trino to wb
2026-07-22 13:10:48 +03:00
ivan
52ab310c65
++
2026-07-21 14:22:34 +05:00
446284bf4a
remove bootstrap jobs form ugmk
2026-07-20 18:48:11 +03:00
emelinda
ccbfd63a08
Migrate attachments app to HelmRelease in d8-ugmk-prod, enable in kustomization, and update related configurations. Remove legacy namespace resource.
2026-07-18 21:43:49 +03:00
emelinda
3febe6382b
Remove attachments app from d8-ugmk-prod kustomization and its namespace resource
2026-07-18 20:47:24 +03:00
emelinda
0d87e03126
add control-interface in d8-ugmk-prod
2026-07-15 18:42:26 +03:00
emelinda
06acc89567
remove control-interface in d8-ugmk-prod
2026-07-15 18:35:57 +03:00
emelinda
a8aeb7df0e
Migrate auth-flow app from raw manifest definitions to HelmRelease and add to d8-ugmk-prod kustomization. Remove deprecated deployment and service resources and update related configurations.
2026-07-15 18:04:32 +03:00
emelinda
0e0108ea52
Migrate remarks app from raw manifest definitions to HelmRelease and add to d8-ugmk-prod kustomization. Remove deprecated resources and update related configurations.
2026-07-15 17:55:40 +03:00
emelinda
68b2fc9eaf
Migrate reviews app from raw manifest definitions to HelmRelease and add to d8-ugmk-prod kustomization. Remove deprecated resources and update related configurations.
2026-07-15 17:30:01 +03:00
emelinda
c46132f75c
Migrate cross-section-static from raw manifest definitions to HelmRelease and add to d8-ugmk-prod kustomization. Remove deprecated resources and update related configurations.
2026-07-15 17:13:06 +03:00
emelinda
d60dc2a5e1
Enable attachments app in d8-ugmk-prod kustomization
2026-07-15 15:44:43 +03:00
emelinda
58c189cd69
Comment out attachments app in d8-ugmk-prod kustomization
2026-07-15 15:42:46 +03:00
6abde9cce2
++ change infra domains
2026-07-15 14:53:57 +03:00
emelinda
8a350b4391
Restructure d8-ugmk-prod kustomization to directly include infrastructure resources instead of nested directory.
2026-07-15 14:41:59 +03:00
ivan
ed80fd33e6
++
2026-07-15 16:32:44 +05:00
63cdb767e6
++ move ugmk infrastructure patches to overlays
2026-07-15 13:00:34 +03:00
52f90cb00c
++ clear postgresql chart node selector
2026-07-15 12:34:47 +03:00
b343438779
++ move zitadel postgresql to master node
2026-07-15 12:26:52 +03:00
4b165fe6e1
++ add deckhouse istio ingress and selfsigned tls
2026-07-15 12:07:54 +03:00
26f10ce34b
++ add istio routes for ugmk services
2026-07-15 11:50:31 +03:00
77b8c84b71
++ move camunda databases external and scale down
2026-07-15 11:05:02 +03:00
67ad879aa3
++ remove default sts selector from postgresql
2026-07-14 16:44:07 +03:00
576b67f566
++ fix generic scheduling for postgresql and zitadel
2026-07-14 16:24:53 +03:00
089c125fa3
++ fix postgresql namespace for zitadel
2026-07-14 16:17:43 +03:00
6beaa1bbbf
++ deploy zitadel to a dedicated postgresql 17
2026-07-14 16:04:32 +03:00
9f582bdc84
fuhrer fixes
2026-07-13 21:11:55 +03:00
7dba565792
++ add d8 ugmk prod service infra
2026-07-13 20:32:32 +03:00
38b96ebecc
++ patch vault workloads to generic in d8-ugmk-prod
2026-07-13 17:26:31 +03:00
cb5ca1633c
++ pin vault to generic nodes in d8-ugmk-prod
2026-07-13 17:21:00 +03:00
097696fdb4
++ disable istio injection for vault in d8-ugmk-prod
2026-07-13 17:13:35 +03:00
5dcd01daa4
++ add d8-ugmk-prod flux bootstrap and vault
2026-07-13 17:06:40 +03:00
ivan
5516bd7074
++
2026-07-08 15:05:04 +05:00
6a111ccc18
++ enable vault prometheus metrics
2026-07-01 17:10:16 +03:00
ivan
21052884cb
++
2026-06-29 14:38:29 +05:00
c02e553ba4
++ add otel istio tracing config
2026-06-24 15:25:48 +03:00
emelinda
ba6fe89549
Refactor yc-k8s-test infrastructure by splitting kustomization files into resource-specific directories.
2026-06-23 11:56:05 +03:00
7960ce5106
Fix brusnika kafka and rabbitmq dashboards
2026-06-18 13:04:37 +03:00
721f62270e
Fix brusnika observability exporters and alerts
2026-06-18 12:26:04 +03:00
849e0bfd9e
Tune brusnika stage CPU throttling alert
2026-06-18 11:18:22 +03:00
be808a600a
Fix brusnika observability alerting and grafana secrets
2026-06-18 11:10:38 +03:00
c22151e766
Add explicit vault inject for brusnika prod openobserve
2026-06-17 21:49:03 +03:00
729b7abf05
Preserve vault inject annotations for openobserve
2026-06-17 21:42:24 +03:00
191cf8336d
Disable istio injection for brusnika prod openobserve
2026-06-17 21:40:04 +03:00
9f93bd9761
Fix brusnika prod minio and openobserve rollout
2026-06-17 20:05:15 +03:00
7aa875282d
Enable brusnika prod vm observability resources
2026-06-17 19:43:29 +03:00
d1d25f5587
Bootstrap brusnika prod observability CRDs first
2026-06-17 19:41:00 +03:00
b7b65a03c2
Add observability stack for brusnika prod
2026-06-17 19:35:39 +03:00
176445e9f9
Tune sanitizer postgres and bump workflow image
2026-06-16 17:15:05 +03:00
1c13a407a2
Move brusnika-stage vmalert to port 8880
2026-06-16 14:39:51 +03:00
1aa171b31b
Use recreate strategy for brusnika-stage vmalert
2026-06-16 14:33:26 +03:00
28f0c78b43
Enable host network for brusnika-stage vmalert
2026-06-16 14:21:52 +03:00
be737a2ec6
Add stage Alertmanager notifier for brusnika-stage
2026-06-16 13:29:54 +03:00
531ef1256f
Fix brusnika-stage PrometheusRule cluster labels
2026-06-16 13:17:45 +03:00
4fc24151ea
Fix brusnika-stage vmstack alert routing
2026-06-16 13:10:38 +03:00
e75601354e
Fix brusnika-stage alert labels
2026-06-16 12:47:27 +03:00
87d89c22f2
Guard YC Kafka silence alert window
2026-06-16 12:21:33 +03:00
c0162c7fa3
Use host network for brusnika-stage YC Kafka exporter
2026-06-16 12:08:27 +03:00
3c3ad8ea5a
Patch YC Kafka exporter node selector
2026-06-16 12:03:51 +03:00
5735c7871d
Pin brusnika-stage YC Kafka exporter to egress node
2026-06-16 12:00:13 +03:00
840bd2e544
Relax brusnika-stage YC Kafka exporter probes
2026-06-16 11:49:20 +03:00
7489bf07da
Unblock brusnika-stage YC Kafka exporter release
2026-06-16 11:38:55 +03:00
69d07ba476
Add brusnika-stage YC Kafka exporter monitoring
2026-06-16 11:33:38 +03:00
1fd954fd68
Avoid waiting for sanitizer PostgreSQL rollout
2026-06-15 16:42:27 +03:00
6a8a43960c
Tune sanitizer PostgreSQL probes
2026-06-15 16:35:26 +03:00
2ea18c8183
Fix brusnika-stage dashboard node variable queries
2026-06-15 15:42:03 +03:00
982638c5cb
Fix brusnika-stage observability dashboard variables
2026-06-15 15:36:11 +03:00
c8e57ec88d
Fix brusnika-stage observability dashboard scrapes
2026-06-15 15:21:49 +03:00
a86707c4b1
change kafka-exporter image
2026-06-15 14:42:52 +03:00
08ecee4992
Add regcred to brusnika-stage kafka exporter
2026-06-15 14:28:35 +03:00
ad6e4bbe23
Read brusnika-stage OpenObserve auth from Vault file in otel
2026-06-15 14:24:47 +03:00
07aeb166ba
Apply brusnika-stage otel Vault wrapper to agent daemonset
2026-06-15 14:06:51 +03:00
b34f1cf1b2
Do not block brusnika-stage otel on unschedulable daemonset pods
2026-06-15 13:57:35 +03:00
455abec970
Escape brusnika-stage otel Vault annotation template
2026-06-15 13:48:23 +03:00
24c6b31f7e
Fix brusnika-stage OpenObserve MinIO endpoint
2026-06-15 13:28:42 +03:00
fbf8abcffe
Use OpenObserve server startup for migrations
2026-06-15 13:14:36 +03:00
8d2a76d7b5
Fix brusnika-stage openobserve startup migration
2026-06-15 12:56:42 +03:00
a934e247ed
Add brusnika-stage observability daemonset tolerations
2026-06-15 12:50:56 +03:00
2b1c8d7bbb
Fix brusnika-stage goalert database and observability readiness
2026-06-15 12:36:09 +03:00
805394607a
Fix brusnika-stage observability secrets and certs
2026-06-15 12:03:39 +03:00
2abd7d9658
Fix brusnika-stage observability helm ordering
2026-06-15 11:02:31 +03:00
b3ff0ab531
Fix brusnika-stage observability bootstrap ordering
2026-06-15 10:55:24 +03:00
374973950b
Add observability stack to brusnika-stage
2026-06-15 10:51:19 +03:00
6b787e2da7
Use PostgreSQL contour 13.0.9
2026-06-11 14:24:04 +03:00
854d723299
Fix pg sanitizer workflow connectivity
2026-06-11 14:17:31 +03:00
c6f31a50bd
Add pg sanitizer Argo workflow
2026-06-11 13:24:39 +03:00
