The base production.py hardcoded SAREX_API = https://srx.wb.ru, ignoring the
env, so issue export (GET /api/core/users/<id>/) failed from closed contours
with CERTIFICATE_VERIFY_FAILED. Read it from SAREX_API with the old value as
default; wb keeps it.
uralkal, vad, d8-ugmk-prod: SAREX_API -> backend-svc.django:80 (server-side
calls, no TLS), and SAREX_HOST set to the contour's public host so links in
exports and notifications stay external.
Deckhouse admission-policy-engine (baseline) rejected the pods because
istio-init needs NET_ADMIN and NET_RAW. Label the namespace
security.deckhouse.io/pod-policy=privileged like the other app namespaces in
ugmk.
premises: d8-ugmk-prod overlay (ugmk Kafka CA mounted, prod-sized requests
dropped), wired into the cluster, /premises/api/ routed on sarex.uralmine.com.
Terraform side is infra/terraform 856ab54.
istio-config d8-ugmk-prod, vad, uralkal: inspections-api reused the name
flows-api-virt-service, so two VirtualServices collided and one of
/flows/api/ and /inspections/api/ was lost. It is now
inspections-api-virt-service.
remarks base frontend image -> remarks-frontend:contour_013c5091.
psql-tools-debug in uralkal sleeps forever so it can be exec'd into.
The overlay inherited SaaS prod hosts from base (api.sarex.io, lk.sarex.io),
which fail TLS verification from the closed contour. Point documentations,
flows, django and notes at their uralkal services; REDIS_USE and TIMEOUT
unchanged.
drawings-api builds its workflows client from WORKFLOW_HOST, which no cluster
set, so POST /internal/v1/exports failed with 'unsupported protocol scheme'.
Add WORKFLOW_HOST and the other export settings from the drawings-api chart
with uralkal service addresses (processing, drawings, attachments).
The overlay inherited base env copied from SaaS prod: DJANGO_HOST
https://lk.sarex.io, workspaces/workflows on api.sarex.io and PG_SSL_MODE
verify-full. From the closed contour every request to django failed with
CERTIFICATE_VERIFY_FAILED. Point django, workspaces and workflows at their
uralkal services, attachments at its real port 8000, disable postgres SSL
(the uralkal server has none). FAAS_SERVICE and RESOURCE_URL stay as in base:
neither service exists in uralkal.
YANDEX_S3_ENDPOINT_URL 10.133.0.245:9000 instead of s3-proxy, same as
documentations; the minioadmin credentials come from minio/apps/attachments
(terraform contour).
Overrides the base tasks-execution-config-comparisons-v2 ConfigMap (mounted
at /etc/app/tasks-execution-config.json) for uralkal: all 16 workflow tasks
run on the k8s executor with 2 CPU / 4Gi requests.
comparisons-api-v2 calls GET /api/v1/bundles and /api/v1/workspaces on
DOCUMENTATIONS_EXTERNAL_HOST from inside the pod. sarex.local.uralkali.com
is signed by the customer's internal CA, which the image does not trust
(x509: unknown authority), so creating a comparison failed with 500. The
documentations service serves the same /api/v1 paths internally.
