pm on WB published to Kafka topic "pm" (stale .env mounted via subPath),
while message-hub consumes "message-hub-prod". PDF export of KSG hung in
PENDING because get_converted_file never reached message-hub.
Set KAFKA_TOPICS explicitly in backend and celery so env overrides .env,
same as prod, d8-ugmk-prod, uralkal and vad.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01173KBT2kTwhxrzr2t3KutB
The base production.py hardcoded SAREX_API = https://srx.wb.ru, ignoring the
env, so issue export (GET /api/core/users/<id>/) failed from closed contours
with CERTIFICATE_VERIFY_FAILED. Read it from SAREX_API with the old value as
default; wb keeps it.
uralkal, vad, d8-ugmk-prod: SAREX_API -> backend-svc.django:80 (server-side
calls, no TLS), and SAREX_HOST set to the contour's public host so links in
exports and notifications stay external.
Deckhouse admission-policy-engine (baseline) rejected the pods because
istio-init needs NET_ADMIN and NET_RAW. Label the namespace
security.deckhouse.io/pod-policy=privileged like the other app namespaces in
ugmk.
premises: d8-ugmk-prod overlay (ugmk Kafka CA mounted, prod-sized requests
dropped), wired into the cluster, /premises/api/ routed on sarex.uralmine.com.
Terraform side is infra/terraform 856ab54.
istio-config d8-ugmk-prod, vad, uralkal: inspections-api reused the name
flows-api-virt-service, so two VirtualServices collided and one of
/flows/api/ and /inspections/api/ was lost. It is now
inspections-api-virt-service.
remarks base frontend image -> remarks-frontend:contour_013c5091.
psql-tools-debug in uralkal sleeps forever so it can be exec'd into.
The overlay inherited SaaS prod hosts from base (api.sarex.io, lk.sarex.io),
which fail TLS verification from the closed contour. Point documentations,
flows, django and notes at their uralkal services; REDIS_USE and TIMEOUT
unchanged.
drawings-api builds its workflows client from WORKFLOW_HOST, which no cluster
set, so POST /internal/v1/exports failed with 'unsupported protocol scheme'.
Add WORKFLOW_HOST and the other export settings from the drawings-api chart
with uralkal service addresses (processing, drawings, attachments).
The overlay inherited base env copied from SaaS prod: DJANGO_HOST
https://lk.sarex.io, workspaces/workflows on api.sarex.io and PG_SSL_MODE
verify-full. From the closed contour every request to django failed with
CERTIFICATE_VERIFY_FAILED. Point django, workspaces and workflows at their
uralkal services, attachments at its real port 8000, disable postgres SSL
(the uralkal server has none). FAAS_SERVICE and RESOURCE_URL stay as in base:
neither service exists in uralkal.
YANDEX_S3_ENDPOINT_URL 10.133.0.245:9000 instead of s3-proxy, same as
documentations; the minioadmin credentials come from minio/apps/attachments
(terraform contour).
Overrides the base tasks-execution-config-comparisons-v2 ConfigMap (mounted
at /etc/app/tasks-execution-config.json) for uralkal: all 16 workflow tasks
run on the k8s executor with 2 CPU / 4Gi requests.
