++ camunda legacy wait

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -4,6 +4,8 @@ include:
 
 stages:
   - build
+  - slices
+  - slices-publish
 
 variables:
   RELEASE_NAME: iac-offline
@@ -33,3 +35,31 @@ build_offline_mirror:
     - docker push ${IMAGE_NAME}
     - docker push ${CR}/${RELEASE_NAME}:latest
   timeout: 30m
+
+generate_slice_jobs:
+  stage: slices
+  image: ${CR}/infra/slice-builder:1.0.0
+  tags:
+    - build
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v?(?:\d+\.){2}\d+$/
+  variables:
+    GIT_DEPTH: "1"
+  script:
+    - python3 ci/publish-slice.py generate --release "$CI_COMMIT_TAG" --commit "$CI_COMMIT_SHA" --out slices-pipeline.yml
+    - cat slices-pipeline.yml
+  artifacts:
+    paths:
+      - slices-pipeline.yml
+
+publish_contour_slices:
+  stage: slices-publish
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v?(?:\d+\.){2}\d+$/
+  needs:
+    - generate_slice_jobs
+  trigger:
+    include:
+      - artifact: slices-pipeline.yml
+        job: generate_slice_jobs
+    strategy: depend

apps/attachments/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:production_6dbb4dce
+            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
           pullPolicy:
             _default: IfNotPresent
 

apps/attachments/uralkal/patch.yaml

@@ -24,7 +24,7 @@ spec:
             vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments
             vault.hashicorp.com/agent-inject-template-attachments-s3: |-
               {{- with secret "secrets/data/minio/apps/attachments" -}}
-              YANDEX_S3_ENDPOINT_URL=s3-proxy.s3-proxy.svc.cluster.local
+              YANDEX_S3_ENDPOINT_URL=10.133.0.245:9000
               YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
               YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
               YANDEX_S3_USE_SSL=false

apps/bi/brusnika-stage/backend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_37902c73
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_e607dcc6
           pullPolicy:
             _default: IfNotPresent
 
@@ -119,6 +119,10 @@ spec:
             _default: regcred
 
         envs:
+          - name: SUPERSET_HOST
+            value:
+              _default: "https://superset.test.sarex.brusnika.tech"
+
           - name: SETTINGS_DEBUG
             value:
               _default: "0"

apps/bim/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a
           pullPolicy:
             _default: IfNotPresent
 

apps/cde/brusnika-stage/cde-flowscallback.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-flowscallback
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-flowscallback
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-flowscallback
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-flowscallback
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-flowscallback
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-splitpdf.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-splitpdf
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-splitpdf
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-splitpdf
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-splitpdf
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_4.4.1
+        imagePullPolicy: Always
+        name: cde-worker-splitpdf
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-alert.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-alert
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-alert
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-alert
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-alert
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/orchestrator:latest
+        imagePullPolicy: Always
+        name: cde-worker-alert
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copy.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-copy
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-copy
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-copy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-copy
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-copy
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copyv2.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-copyv2
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-copyv2
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-copy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-copy
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/copyv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-copy
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-markings.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-markings
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-markings
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-markings
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-markings
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:preprod_eb50f30e
+        imagePullPolicy: Always
+        name: cde-worker-markings
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-sign.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-sign
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-sign
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-sign
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-sign
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-sign
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-update-bundles.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-update-bundles
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-updatebundles
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-updatebundles
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-updatebundles
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-update-bundles
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde.yaml

@@ -0,0 +1,55 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/cde:production_e5316bd0
+        imagePullPolicy: Always
+        livenessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          successThreshold: 1
+          tcpSocket:
+            port: 8080
+          timeoutSeconds: 1
+        name: cde
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          successThreshold: 1
+          tcpSocket:
+            port: 8080
+          timeoutSeconds: 1
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/createversionsv2-worke.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: createversionsv2-worke
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-createversions
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-createversions
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-createversions
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'true'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/createversionsv2-worker:preprod_90202b78
+        imagePullPolicy: Always
+        name: createversionsv2-worke
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/kustomization.yaml

@@ -1,6 +1,19 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: contracts
+namespace: orchestrator
 resources:
-  - helmrelease.yaml
+  - serviceaccount.yaml
+  - service.yaml
+  - cde.yaml
+  - cde-flowscallback.yaml
+  - cde-splitpdf.yaml
+  - cde-worker-alert.yaml
+  - cde-worker-copy.yaml
+  - cde-worker-markings.yaml
+  - cde-worker-sign.yaml
+  - cde-worker-update-bundles.yaml
+  - cde-worker-copyv2.yaml
+  - createversionsv2-worke.yaml
+  - markingsv2-worker.yaml
+  - signv2-worker.yaml

apps/cde/brusnika-stage/markingsv2-worker.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: markingsv2-worker
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-markings
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-markings
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-markings
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/markingsv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-markings
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/service.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: 8080

apps/cde/brusnika-stage/serviceaccount.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+    app.kubernetes.io/version: 0.0.1

apps/cde/brusnika-stage/signv2-worker.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: signv2-worker
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-sign
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-sign
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-sign
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/signv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-sign
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/comparisons/base/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend:prod_6dc6e0c2
+            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend:contour_0570a1f1
           pullPolicy:
             _default: IfNotPresent
 

apps/comparisons/uralkal/backend.yaml

@@ -8,8 +8,105 @@ spec:
   values:
     services:
       backend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-api-v2:contour_9a2bab4e
+
         deployment:
+          port:
+            _default: 8080
+
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/comparisons-db ] && . /vault/secrets/comparisons-db
+                [ -f /vault/secrets/comparisons-jwt-public ] && export AUTH_PUBLIC_KEY="$(cat /vault/secrets/comparisons-jwt-public)"
+                set +a
+                cd /opt/comparisons
+                ./migrations up
+                exec ./api
+
           resources:
             requests:
               cpu: null
               memory: null
+
+          probes:
+            liveness:
+              httpGet:
+                port:
+                  _default: 8080
+            readiness:
+              httpGet:
+                port:
+                  _default: 8080
+
+        service:
+          targetPort:
+            _default: 8080
+
+        envs:
+          - name: APP_NAME
+            value:
+              _default: "comparisons-api-v2"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOGGER_LOG_LEVEL
+            value:
+              _default: "info"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "postgres"
+
+          - name: PGSSLMODE
+            value:
+              _default: "disable"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+
+          - name: DOCUMENTATIONS_INTERNAL_HOST
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local"
+
+          - name: DOCUMENTATIONS_EXTERNAL_HOST
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://backend-svc.processing.svc.cluster.local"
+
+          - name: WORKFLOWS_IMAGE_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOWS_DJANGO_HOST
+            value:
+              _default: "https://sarex.local.uralkali.com"
+
+          - name: WORKFLOWS_BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://backend-svc.bim.svc.cluster.local"
+
+          - name: WORKSPACES_HOST
+            value:
+              _default: "http://backend-svc.workspaces.svc.cluster.local"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local"
+
+          - name: ABAP_FIXED_CONC
+            value:
+              _default: "0"
+
+          - name: WORKFLOWS_CONFIG_FILEPATH
+            value:
+              _default: "/etc/app/tasks-execution-config.json"

apps/comparisons/uralkal/kustomization.yaml

@@ -3,6 +3,10 @@ kind: Kustomization
 resources:
   - ../base
 patches:
+  - path: tasks-execution-config.yaml
+    target:
+      kind: ConfigMap
+      name: tasks-execution-config-comparisons-v2
   - path: backend.yaml
     target:
       kind: HelmRelease

apps/comparisons/uralkal/tasks-execution-config.yaml

@@ -0,0 +1,122 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: tasks-execution-config-comparisons-v2
+  namespace: comparisons
+data:
+  tasks-execution-config-comparisons-v2.json: |
+    {
+        "abap": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "bim2bim_comparison": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "bim_api_metadata_inserter_v2": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "bim_api_metadata_inserter_v4": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "bim_abap_updater": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "build_ooc": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "calculate_deviation_job": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "cloud_to_cloud": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "cloud_to_surface": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "convert_to_potree": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "deviation_icp": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "las_to_tiff": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "pdf_cv_comparer": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "pdf_georeferencing": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "split_pdf_document": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "webhook_caller": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        }
+    }

apps/control-interface/uralkal/ams-sync.yaml

@@ -1,183 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ams-sync
-  namespace: control-interface
-  labels:
-    app: ams-sync
-    service: backend
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: ams-sync
-  template:
-    metadata:
-      labels:
-        app: ams-sync
-        service: backend
-    spec:
-      containers:
-        - name: backend
-          image: cr.yandex/crp3ccidau046kdj8g9q/ams-sync:ugok
-          command: ["sleep", "999999999999"]
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8000
-              protocol: TCP
-          env:
-            - name: AMS_SYNC_TOPIC
-              value: ams-sync
-            - name: ENVIRONMENT
-              value: PRODUCTION
-            - name: HOST_ORGANIZATION_ID
-              value: '392748423989716183'
-            - name: ALERT_ENABLED
-              value: 'False'
-            - name: USER_SERVER_HOST
-              value: https://sarex.local.uralkali.com
-            - name: AUTH_HOST
-              value: https://sarex.local.uralkali.com
-            - name: VERIFY_USERS
-              value: 'True'
-            - name: KAFKA_SECURITY_PROTOCOL
-              value: SSL
-            - name: KAFKA_SASL_MECHANISM
-              value: SCRAM-SHA-512
-            - name: RESOURCES_INTERNAL_HOST
-              value: http://iams.iam.svc.cluster.local:8080
-            - name: TELEGRAM_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: telegram-secret
-                  key: telegram-token
-            - name: TELEGRAM_GROUP_ID
-              valueFrom:
-                secretKeyRef:
-                  name: telegram-secret
-                  key: telegram-group-id
-            - name: ZITADEL_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: zitadel-token-secret
-                  key: zitadel-host
-            - name: ZITADEL_SERVICE_ACCESS_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: zitadel-token-secret
-                  key: zitadel-access-token
-            - name: KAFKA_BOOTSTRAP_SERVERS
-              valueFrom:
-                secretKeyRef:
-                  name: ams-kafka-secret
-                  key: kafka-bootstrap-servers
-            - name: KAFKA_SASL_PLAIN_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: ams-kafka-secret
-                  key: kafka-username
-            - name: KAFKA_SASL_PLAIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: ams-kafka-secret
-                  key: kafka-password
-            - name: KAFKA_SSL_CAFILE
-              valueFrom:
-                secretKeyRef:
-                  name: ams-kafka-secret
-                  key: kafka-ca-file
-            - name: AUTH_ADMIN_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: auth-secret
-                  key: admin-username
-            - name: AUTH_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: auth-secret
-                  key: admin-password
-            - name: USER_DB_NAME
-              valueFrom:
-                secretKeyRef:
-                  name: user-db-secret
-                  key: user-db-name
-            - name: USER_DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: user-db-secret
-                  key: user-db-user
-            - name: USER_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: user-db-secret
-                  key: user-db-password
-            - name: USER_DB_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: user-db-secret
-                  key: user-db-host
-            - name: USER_DB_PORT
-              valueFrom:
-                secretKeyRef:
-                  name: user-db-secret
-                  key: user-db-port
-      imagePullSecrets:
-        - name: regcred
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: ams-kafka-secret
-  namespace: control-interface
-type: Opaque
-data:
-  kafka-bootstrap-servers: WyJicnVzbmlrYS1zdGFnZS1rYWZrYS1ib290c3RyYXAua2Fma2Euc3ZjLmNsdXN0ZXIubG9jYWw6OTA5MyJd
-  kafka-ca-file: L2V0Yy9jYS1jZXJ0aWZpY2F0ZXMvWWFuZGV4L1lhbmRleEludGVybmFsUm9vdENBLmNydA==
-  kafka-password: bkszNnNhc3ZTZm9JdEpuWFE0cXhhdjJPVVdJUFg1WkM=
-  kafka-username: c2FyZXg=
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: auth-secret
-  namespace: control-interface
-type: Opaque
-data:
-  admin-password: emVhbG90MDk2
-  admin-username: aGFnZW4wMTM=
-  host: aHR0cHM6Ly9zYXJleC5sb2NhbC51cmFsa2FsaS5jb20=
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: telegram-secret
-  namespace: control-interface
-type: Opaque
-data:
-  telegram-group-id: LTEwMDIzNTAyNzE=
-  telegram-token: NzAyOTgxMDQ2ODpBQUZBUUI1X0Y5TV92R2RndGlXOVBDRzVTUndIcFg2SnNUZw==
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: user-db-secret
-  namespace: control-interface
-type: Opaque
-data:
-  user-db-host: MTAuMTMzLjAuMjQ5
-  user-db-name: c2FyZXhfZGI=
-  user-db-password: QXNOUkE3WUhoUVlIWnNCRXFRUVBxRUUwdEU0ZmtwTTU=
-  user-db-port: NTQzMg==
-  user-db-user: ZGphbmdv
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: zitadel-token-secret
-  namespace: control-interface
-type: Opaque
-data:
-  zitadel-access-token: OXk5V0VZR05YYm11UXFxQlRjNDFNSTV1Yjc5R3R6VkR0dFZRM2ZiSE5PMnVpQU9YNTAwRzYyN3BDeUk5TEd2Y1Q0TFlHd2w=
-  zitadel-host: aHR0cHM6Ly9sb2dpbi5zYXJleC5sb2NhbC51cmFsa2FsaS5jb20=

apps/control-interface/uralkal/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
   - ../base
   - namespace.yaml
   - psql-tools-debug.yaml
-  - ams-sync.yaml

apps/control-interface/uralkal/psql-tools-debug.yaml

@@ -18,10 +18,8 @@ spec:
     spec:
       containers:
         - name: debug
-          image: cr.yandex/crp3ccidau046kdj8g9q/zitadel-bpmn:cc_contour_5.22.3_ca40c204
+          image: cr.yandex/crp3ccidau046kdj8g9q/mc-files:dev5
           imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-c"]
-          args:
-            - while true; do sleep 3600; done
+          command: ["/bin/sh", "-c", "while true; do sleep 3600; done"]
       imagePullSecrets:
         - name: regcred

apps/cross-section/base/helmrelease.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/cross-section-app:production_e09e648b
+            _default: cr.yandex/crp3ccidau046kdj8g9q/cross-section-app:contour_c5e5d476
           pullPolicy:
             _default: IfNotPresent
 

apps/django/base/django-configmap.yaml

@@ -87,7 +87,7 @@ data:
         'Bearer',
     )
 
-    HOST = "https://sarex.contour.infra.sarex.tech"
+    HOST = os.environ.get("DJANGO_HOST", "https://sarex.contour.infra.sarex.tech")
 
     POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
     POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')
@@ -305,6 +305,11 @@ data:
             "uri": "/management/projects"
         },
 
+        {
+            "name": "Справочники",
+            "uri": "/assets"
+        },
+
         #  {
         #     "name": "Обзор",
         #     "uri": "/projects"

apps/django/base/frontend.yaml

@@ -29,7 +29,7 @@ spec:
         enabled: true
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.3
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.30.1
           pullPolicy:
             _default: IfNotPresent
         deployment:

apps/django/brusnika-stage/nginx-configmap.yaml

@@ -101,7 +101,8 @@ data:
 
             location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
                 alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
-                add_header Content-Type application/wasm always;
+                types { }
+                default_type application/wasm;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -110,7 +111,8 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -119,7 +121,8 @@ data:
 
             location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
                 alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -128,7 +131,8 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -136,7 +140,8 @@ data:
             }
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                add_header Content-Type application/wasm always;
+                types { }
+                default_type application/wasm;
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
             }
 
@@ -144,7 +149,8 @@ data:
             rewrite /workspaces-v2/(.+) /$1 break;
             proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
 
-            add_header Content-Type application/wasm;
+            proxy_hide_header Content-Type;
+            add_header Content-Type application/wasm always;
             proxy_set_header Accept application/wasm;
         }
 

apps/django/d8-ugmk-prod/backend.yaml

@@ -8,6 +8,9 @@ spec:
   values:
     services:
       backend:
+        deployment:
+          replicaCount:
+            _default: 2
         envs:
           - name: ALLOWED_HOSTS
             value:
@@ -18,6 +21,9 @@ spec:
           - name: SERVER_ZITADEL_ENABLED
             value:
               _default: "True"
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.uralmine.com"
           - name: DJANGO_SETTINGS_MODULE
             value:
               _default: config.settings.production

apps/django/uralkal/backend.yaml

@@ -14,6 +14,10 @@ spec:
               cpu: null
               memory: null
         envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.local.uralkali.com"
+
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/django/vad/backend.yaml

@@ -9,6 +9,10 @@ spec:
     services:
       backend:
         envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.vadroad.ru"
+
           - name: ALLOWED_HOSTS
             value:
               _default: "*"

apps/documentations/asterus/pdf-markings-amqp.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_9dea5b64
           pullPolicy:
             _default: IfNotPresent
 

apps/documentations/base/api.yaml

@@ -65,7 +65,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_89c8039a
           pullPolicy:
             _default: IfNotPresent
         service:
@@ -89,6 +89,9 @@ spec:
           - name: POSTGRES_POOL_SIZE
             value:
               _default: "20"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
           - name: USE_LEGACY_BIM_FLOW
             value:
               _default: "true"
@@ -236,6 +239,9 @@ spec:
           - name: VALKEY_PORT
             value:
               _default: "6379"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
         podAnnotations:
           _default:
             traffic.sidecar.istio.io/excludeOutboundPorts: "8200"

apps/documentations/base/filestream.yaml

@@ -97,6 +97,9 @@ spec:
           - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
             value:
               _default: "true"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
           - name: USE_ZITADEL
             value:
               _default: "1"
@@ -223,6 +226,9 @@ spec:
           - name: VALKEY_PORT
             value:
               _default: "6379"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
         podAnnotations:
           _default:
             traffic.sidecar.istio.io/excludeOutboundPorts: "8200"

apps/documentations/base/pdf-markings-amqp.yaml

@@ -37,7 +37,7 @@ spec:
           name:
             _default: pdf-markings-amqp
           replicaCount:
-            _default: 1
+            _default: 2
           port:
             _default: 8000
           command:
@@ -64,7 +64,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_9dea5b64
           pullPolicy:
             _default: IfNotPresent
         service:

apps/documentations/base/pdm.yaml

@@ -123,7 +123,7 @@ spec:
               _default: "false"
           - name: DRAWINGS_INTERNAL_URL
             value:
-              _default: http://drawings-api-service.drawings.svc.cluster.local:80
+              _default: http://backend-service.drawings.svc.cluster.local:8000
           - name: ATTACHMENTS_URL
             value:
               _default: http://attachments-service.attachments.svc.cluster.local:8000
@@ -210,7 +210,7 @@ spec:
               _default: http://backend-svc.subscriptions.svc.cluster.local:80
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://api-service.system-log.svc.cluster.local:80
+              _default: http://backend-svc.system-log.svc.cluster.local:80
           - name: TARGET_URL
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/brusnika-stage/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
           pullPolicy:
             _default: IfNotPresent
 
@@ -100,6 +100,10 @@ spec:
         labels:
           monitoring: prometheus
         envs:
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
           - name: POSTGRES_ADDRESS
             value:
               _default: "192.168.2.45"

apps/documentations/brusnika-stage/hasher.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hasher
+  namespace: documentations
+  labels:
+    app: hasher
+    service: normal
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: hasher
+  template:
+    metadata:
+      labels:
+        app: hasher
+        service: normal
+    spec:
+      containers:
+      - env:
+        - name: HASHER_APP__LOG_LEVEL
+          value: INFO
+        - name: HASHER_APP__NUM_WORKERS
+          value: '4'
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
+          value: hash.compute.normal.tasks
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
+          value: hash.compute
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
+          value: direct
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
+          value: hash.compute.normal
+        - name: HASHER_S3__MAX_POOL_CONNECTIONS
+          value: '10'
+        - name: HASHER_S3__CONNECT_TIMEOUT
+          value: '10'
+        - name: HASHER_S3__READ_TIMEOUT
+          value: '30'
+        - name: HASHER_S3__REGION_NAME
+          value: ru-central1
+        - name: HASHER_S3__USE_SSL
+          value: 'true'
+        - name: HASHER_S3__VERIFY
+          value: 'true'
+        - name: HASHER_AMQP__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: user
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__HOST
+          valueFrom:
+            secretKeyRef:
+              key: host
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__PORT
+          valueFrom:
+            secretKeyRef:
+              key: port
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__VHOST
+          valueFrom:
+            secretKeyRef:
+              key: vhost
+              name: hasher-rabbitmq-secret
+        - name: HASHER_S3__ENDPOINT
+          valueFrom:
+            secretKeyRef:
+              key: endpoint
+              name: hasher-s3-secret
+        - name: HASHER_S3__ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access_key
+              name: hasher-s3-secret
+        - name: HASHER_S3__SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: secret_key
+              name: hasher-s3-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
+        imagePullPolicy: IfNotPresent
+        name: normal
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+      imagePullSecrets:
+      - name: regcred

apps/documentations/brusnika-stage/kustomization.yaml

@@ -7,3 +7,5 @@ resources:
   - pdm.yaml
   - api.yaml
   - filestream.yaml
+  - hasher.yaml
+  - pdf-markings-amqp.yaml

apps/documentations/brusnika-stage/pdf-markings-amqp.yaml

@@ -0,0 +1,125 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pdf-markings-amqp
+  namespace: documentations
+  labels:
+    app: pdf-markings-amqp
+    service: api
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pdf-markings-amqp
+  strategy:
+    rollingUpdate:
+      maxSurge: 3
+      maxUnavailable: 3
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: pdf-markings-amqp
+        service: api
+    spec:
+      containers:
+      - env:
+        - name: MARKS_APP__LOG_LEVEL
+          value: INFO
+        - name: MARKS_CRYPTO__HASHING_ALGO
+          value: md_gost12_256
+        - name: MARKS_DOCUMENTS_DB__HOST
+          value: 192.168.2.45
+        - name: MARKS_DOCUMENTS_DB__PORT
+          value: '5432'
+        - name: MARKS_DOCUMENTS_DB__DATABASE
+          value: documentations
+        - name: MARKS_DOCUMENTS_DB__SSLMODE
+          value: disable
+        - name: MARKS_QR__REDIRECT_URL
+          value: https://stamp-verification.test.sarex.brusnika.tech/
+        - name: MARKS_QR__BASE_DOCUMENT_URL
+          value: https://test.sarex.brusnika.tech
+        - name: MARKS_S3__USE_SSL
+          value: 'false'
+        - name: MARKS_S3__SSL_VERIFY
+          value: 'false'
+        - name: MARKS_S3__REGION
+          value: ru-central1
+        - name: MARKS_S3__DEFAULT_BUCKET
+          value: documentations-stage-1-sarex-new
+        - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
+          value: pdf_markings_input
+        - name: MARKS_DOCUMENTS_DB__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: postgres-secret
+        - name: MARKS_DOCUMENTS_DB__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: postgres-secret
+        - name: MARKS_S3__URL
+          valueFrom:
+            secretKeyRef:
+              key: endpoint_url
+              name: yc-s3
+        - name: MARKS_S3__ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: key_id
+              name: yc-s3
+        - name: MARKS_S3__SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access_key
+              name: yc-s3
+        - name: MARKS_RABBITMQ__HOST
+          valueFrom:
+            secretKeyRef:
+              key: host
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__PORT
+          valueFrom:
+            secretKeyRef:
+              key: port
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__VHOST
+          valueFrom:
+            secretKeyRef:
+              key: vhost
+              name: rabbitmq
+        - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
+          valueFrom:
+            secretKeyRef:
+              key: heartbeat
+              name: rabbitmq
+        image: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+        imagePullPolicy: IfNotPresent
+        name: api
+        ports:
+        - containerPort: 8000
+          name: http
+          protocol: TCP
+        volumeMounts:
+        - mountPath: /etc/sarex/yc-s3-storage
+          name: yc-s3
+          readOnly: true
+      volumes:
+      - name: yc-s3
+        secret:
+          secretName: yc-s3
+      imagePullSecrets:
+      - name: regcred

apps/documentations/brusnika-stage/pdm.yaml

@@ -124,11 +124,11 @@ spec:
 
           - name: TRANSMITTALS_BASE_URL
             value:
-              _default: ""
+              _default: "http://transmittal-service.transmittal.svc.cluster.local:80"
 
           - name: TRANSMITTALS_ENABLE
             value:
-              _default: "false"
+              _default: "true"
 
           - name: DRAWINGS_INTERNAL_URL
             value:

apps/documentations/d8-ugmk-prod/api.yaml

@@ -156,3 +156,6 @@ spec:
           - name: VALKEY_PORT
             value:
               _default: "6379"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"

apps/documentations/d8-ugmk-prod/filestream.yaml

@@ -83,7 +83,7 @@ spec:
               _default: v1
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://api-service.system-log.svc.cluster.local:80
+              _default: http://backend-svc.system-log.svc.cluster.local:80
           - name: DJANGO_HOST
             value:
               _default: http://backend-svc.django.svc.cluster.local:80
@@ -144,3 +144,6 @@ spec:
           - name: VALKEY_PORT
             value:
               _default: "6379"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"

apps/documentations/d8-ugmk-prod/kustomization.yaml

@@ -12,4 +12,8 @@ patches:
   - path: filestream.yaml
     target:
       kind: HelmRelease
-      name: documentations-filestream
+      name: documentations-filestream
+  - path: pdf-markings-amqp.yaml
+    target:
+      kind: HelmRelease
+      name: documentations-pdf-markings-amqp

apps/documentations/d8-ugmk-prod/pdf-markings-amqp.yaml

@@ -0,0 +1,62 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-pdf-markings-amqp
+  namespace: documentations
+spec:
+  values:
+    services:
+      backend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings:contour_ce9ed6d7
+
+        envs:
+          - name: MARKS_APP__LOG_LEVEL
+            value:
+              _default: INFO
+
+          - name: MARKS_CRYPTO__HASHING_ALGO
+            value:
+              _default: md_gost12_256
+
+          - name: MARKS_QR__REDIRECT_URL
+            value:
+              _default: "https://sarex-stamp-verification.uralmine.com/"
+
+          - name: MARKS_QR__BASE_DOCUMENT_URL
+            value:
+              _default: "https://sarex.uralmine.com"
+
+          - name: MARKS_S3__REGION
+            value:
+              _default: ru-central1
+
+          - name: MARKS_S3__USE_SSL
+            value:
+              _default: "true"
+
+          - name: MARKS_S3__SSL_VERIFY
+            value:
+              _default: "false"
+
+          - name: MARKS_S3__DEFAULT_BUCKET
+            value:
+              _default: documentations-marks
+
+          - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
+            value:
+              _default: pdf_markings_input
+
+          - name: MARKS_RABBITMQ__HOST
+            value:
+              _default: rabbitmq.rabbitmq.svc.cluster.local
+
+          - name: MARKS_RABBITMQ__PORT
+            value:
+              _default: "5672"
+
+          - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
+            value:
+              _default: "60"

apps/documentations/wb/api.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_0be18f51
           pullPolicy:
             _default: IfNotPresent
 
@@ -134,6 +134,10 @@ spec:
           - name: POSTGRES_POOL_SIZE
             value:
               _default: "20"
+          
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
 
           - name: ZITADEL_ACCOUNT
             value:
@@ -215,9 +219,13 @@ spec:
             value:
               _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
 
+          # Сервиса bim-api-service в контуре wb нет: в ns bim есть только
+          # backend-service:8000 (bim v2), на него же BIM_API_URL смотрит в
+          # brusnika-stage и asterus. Клиент bim-api (resty, retry 5 x 1s)
+          # на неразрешимом DNS отваливался ровно за ~5 с.
           - name: BIM_API_URL
             value:
-              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
 
           - name: BIM_API_V2_URL
             value:
@@ -311,6 +319,19 @@ spec:
             value:
               _default: "true"
 
+          - name: USE_MARKS_RABBITMQ
+            value:
+              _default: '1'
+          - name: MARKS_RABBITMQ_HOST
+            value: 
+              _default: rabbitmq.rabbitmq.svc.cluster.local
+          - name: MARKS_RABBITMQ_PORT
+            value: 
+              _default: '5672'
+          - name: MARKS_RABBITMQ_API
+            value: 
+              _default: cde
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:
@@ -342,6 +363,16 @@ spec:
               _default: "django-auth"
             secretKey: "key"
 
+          - name: MARKS_RABBITMQ_USER
+            secretName:
+              _default: "hasher-rabbitmq-secret"
+            secretKey: "user"
+
+          - name: MARKS_RABBITMQ_PASSWORD
+            secretName:
+              _default: "hasher-rabbitmq-secret"
+            secretKey: "password"
+
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/documentations/wb/filestream.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_3f19a21d
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_fef3add2
           pullPolicy:
             _default: IfNotPresent
 
@@ -56,13 +56,16 @@ spec:
             limits:
               cpu:
                 _default: 639m
+              # Range-отдача BIM-моделей идёт стримом, но поверх неё работает
+              # gorilla CompressHandler (gzip), и все поды регулярно уходили
+              # в OOMKilled (exit 137) на 198Mi.
               memory:
-                _default: 198Mi
+                _default: 512Mi
             requests:
               cpu:
                 _default: 50m
               memory:
-                _default: 85Mi
+                _default: 128Mi
 
           probes:
             liveness:
@@ -134,6 +137,10 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "0.0.0.0:8080"
+          
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
 
           - name: API_ADDRESS_FILE
             value:
@@ -191,9 +198,13 @@ spec:
             value:
               _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
 
+          # Сервиса bim-api-service в контуре wb нет: в ns bim есть только
+          # backend-service:8000 (bim v2), на него же BIM_API_URL смотрит в
+          # brusnika-stage и asterus. Клиент bim-api (resty, retry 5 x 1s)
+          # на неразрешимом DNS отваливался ровно за ~5 с.
           - name: BIM_API_URL
             value:
-              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
 
           - name: BIM_API_V2_URL
             value:

apps/documentations/wb/pdf-markings-amqp.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_9dea5b64
           pullPolicy:
             _default: IfNotPresent
 

apps/drawings/uralkal/backend.yaml

@@ -0,0 +1,46 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: drawings
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: WORKFLOW_HOST
+            value:
+              _default: "http://backend-svc.processing.svc.cluster.local/"
+
+          - name: IMAGE_NAME_EXPORT_TO_DWG
+            value:
+              _default: "cross-sections-to-dwg"
+
+          - name: IMAGE_TAG
+            value:
+              _default: "develop"
+
+          - name: TASK_VERSION
+            value:
+              _default: "1"
+
+          - name: DRAWING_INTERNAL_URL
+            value:
+              _default: "http://backend-service.drawings.svc.cluster.local:8000/"
+
+          - name: ATTACHMENT_URL
+            value:
+              _default: "http://attachments-service.attachments.svc.cluster.local:8000"

apps/drawings/uralkal/kustomization.yaml

@@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend

apps/eav/wb/django-configmap.yaml

@@ -18,7 +18,7 @@ data:
 
     # DEBUG SETTINGS START
     # ---------------------------------------------------------------------------------------------------------------------
-    DEBUG = True
+    DEBUG = False
     ALLOWED_HOSTS = ['*']
     # ---------------------------------------------------------------------------------------------------------------------
     # DEBUG SETTINGS END

apps/faas/wb/backend.yaml

@@ -55,14 +55,14 @@ spec:
           resources:
             limits:
               cpu:
-                _default: 23m
+                _default: "1"
               memory:
-                _default: 506Mi
+                _default: 1Gi
             requests:
               cpu:
-                _default: 12m
+                _default: 100m
               memory:
-                _default: 330Mi
+                _default: 512Mi
 
           probes:
             liveness:
@@ -97,23 +97,23 @@ spec:
         envs:
           - name: BASE_HOST
             value:
-              _default: "https://srx.wb.ru"
+              _default: "http://frontend-service.django.svc.cluster.local:80"
 
           - name: DJANGO_HOST
             value:
-              _default: "https://srx.wb.ru"
+              _default: "http://backend.django.svc.cluster.local:8000"
 
           - name: REVIEWS_HOST
             value:
-              _default: "https://srx.wb.ru/flows"
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
 
           - name: GATEWAY_HOST
             value:
-              _default: "https://srx.wb.ru/gateway"
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
 
           - name: DOCUMENTATIONS_HOST
             value:
-              _default: "https://srx.wb.ru/documentations"
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
 
           - name: EAV_HOST
             value:
@@ -151,6 +151,10 @@ spec:
             value:
               _default: "180"
 
+          - name: GUNICORN_CMD_ARGS
+            value:
+              _default: "--timeout 3600 --graceful-timeout 30"
+
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/flows/brusnika-stage/celery.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
           pullPolicy:
             _default: IfNotPresent
 
@@ -252,6 +252,26 @@ spec:
               _default: "https://test.sarex.brusnika.tech"
 
         secretEnvs:
+          - name: FLOWS_DB_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: FLOWS_DB_USERNAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: FLOWS_DB_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_AUTH
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
           - name: ADMIN_PANEL_SECRET_KEY
             secretName:
               _default: "admin-secret"

apps/flows/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
           pullPolicy:
             _default: IfNotPresent
 

apps/flows/d8-ugmk-prod/backend.yaml

@@ -1,11 +1,4 @@
 ---
-# Патч backend для контура УГМК — подключение к Kafka.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
-# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
-# podAnnotations — map, мержится по ключам, поэтому переопределён только
-# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -16,6 +9,8 @@ spec:
     services:
       backend:
         deployment:
+          replicaCount:
+            _default: 2
           args:
             _default:
               - |
@@ -29,6 +24,19 @@ spec:
                 set +a
                 exec /opt/entrypoint.sh
 
+        volumes:
+          _default:
+            - name: authentication
+              mountPath:
+                _default: /opt/src/flow/admin/authentication.py
+              subPath:
+                _default: authentication.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: authentication
+
         envs:
           - name: LOG_LEVEL
             value:
@@ -98,6 +106,10 @@ spec:
             value:
               _default: "https://sarex.uralmine.com/flows/api/v1"
 
+          - name: PROXY_PATH_PREFIX
+            value:
+              _default: /flows
+
           - name: SMTP_HOST
             value:
               _default: "post.uralmine.com"

apps/iam/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
           pullPolicy:
             _default: IfNotPresent
 

apps/iam/d8-ugmk-prod/iams-service.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: iams
+  namespace: iam
+spec:
+  type: ClusterIP
+  selector:
+    app: iam-backend
+  ports:
+    - name: http
+      port: 8080
+      targetPort: 8080
+      protocol: TCP

apps/iam/d8-ugmk-prod/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 namespace: iam
 resources:
   - ../base
+  - iams-service.yaml
 patches:
   - path: backend-s3.yaml
     target:

apps/iam/vad/iams-service.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: iams
+  namespace: iam
+spec:
+  type: ClusterIP
+  selector:
+    app: iam-backend
+  ports:
+    - name: http
+      port: 8080
+      targetPort: 8080
+      protocol: TCP

apps/iam/vad/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 namespace: iam
 resources:
   - ../base
+  - iams-service.yaml
 patches:
   - path: backend-s3.yaml
     target:

apps/inspections/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
+            _default: cr.yandex/crp3ccidau046kdj8g9q/inspections-backend:contour_32f00e42
           pullPolicy:
             _default: IfNotPresent
 

apps/inspections/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/base/production-configmap.yaml

@@ -122,7 +122,7 @@ data:
         "PUT",
     ]
 
-    SAREX_API = "https://srx.wb.ru"
+    SAREX_API = os.getenv("SAREX_API", "https://srx.wb.ru")
 
     AERO_PUBLIC_HOST = os.getenv("AERO_PUBLIC_HOST", default=SAREX_API)
 

apps/issues/brusnika-stage/backend.yaml

@@ -176,9 +176,6 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
-          - name: RABBITMQ_HOSTNAME
-            value:
-              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
 
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID

apps/issues/d8-ugmk-prod/backend-s3.yaml

@@ -64,27 +64,37 @@ spec:
 
           - name: AERO_PUBLIC_HOST
             value:
-              _default: "https://sarex.contour.infra.sarex.tech"
+              _default: "https://sarex.uralmine.com"
 
           - name: AERO_HOST
             value:
-              _default: "https://sarex.contour.infra.sarex.tech"
+              _default: "https://sarex.uralmine.com"
 
+          # server-to-server, не публичный хост: по коду issues-backend это
+          # базовый URL django (src/api/services.py, src/issues/notifications.py).
+          # Фактически значение всё равно берётся из production-configmap,
+          # где BASE_AERO_URL зашит на этот же адрес.
           - name: BASE_AERO_URL
             value:
-              _default: "https://sarex.contour.infra.sarex.tech"
+              _default: "http://backend-svc.django.svc.cluster.local:80"
 
           - name: BASE_AUTH_URL
             value:
               _default: "http://backend-svc.django.svc.cluster.local:80"
 
+          # INFRA-3005: namespace workflow в УГМК не существует, processing
+          # поставляется как backend-svc в namespace processing
+          # (apps/processing/base/api.yaml:74 + d8-ugmk-prod/namespace.yaml).
+          # Формат — базовый URL без пути и без слэша на конце: код сам
+          # добавляет /internal/v1/... (src/issues/mailing.py:122,
+          # src/api/services.py:616).
           - name: WORKFLOWS_HOST
             value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+              _default: "http://backend-svc.processing.svc.cluster.local:80"
 
           - name: WORKFLOWS_URL
             value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+              _default: "http://backend-svc.processing.svc.cluster.local:80"
 
           - name: RESOURCES_API_HOST
             value:
@@ -94,13 +104,23 @@ spec:
             value:
               _default: "http://backend-svc.eav.svc.cluster.local:80"
 
+          # Внимание: реально действует значение из production-configmap —
+          # там SAREX_API переприсваивается после `from .base import *`.
+          # См. apps/issues/d8-ugmk-prod/production-configmap.yaml (INFRA-3005).
           - name: SAREX_API
             value:
-              _default: "https://sarex.contour.infra.sarex.tech"
+              _default: "http://backend-svc.django.svc.cluster.local:80"
 
+          - name: SAREX_HOST
+            value:
+              _default: "https://sarex.uralmine.com"
+
+          # Реальное имя сервиса — backend-api-svc (apps/documentations/base/api.yaml:74).
+          # Было documentations-api-svc — такого сервиса нет; не стреляло только
+          # потому, что production-configmap перетирает эту переменную хардкодом.
           - name: DOCUMENTATIONS_URL
             value:
-              _default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
 
           - name: DJANGO_SETTINGS_MODULE
             value:

apps/issues/d8-ugmk-prod/celery-s3.yaml

@@ -62,29 +62,35 @@ spec:
             value:
               _default: "production"
 
+          # AERO_PUBLIC_HOST участвует в сборке ссылок в уведомлениях
+          # (src/issues/notifications.py:324) — с чужим хостом в письмах УГМК
+          # уходили ссылки на srx.wb.ru.
           - name: AERO_PUBLIC_HOST
             value:
-              _default: "https://srx.wb.ru"
+              _default: "https://sarex.uralmine.com"
 
           - name: AERO_HOST
             value:
-              _default: "https://srx.wb.ru"
+              _default: "https://sarex.uralmine.com"
 
+          # server-to-server — внутренний django, см. backend-s3.yaml.
           - name: BASE_AERO_URL
             value:
-              _default: "https://srx.wb.ru"
+              _default: "http://backend-svc.django.svc.cluster.local:80"
 
           - name: BASE_AUTH_URL
             value:
               _default: "http://backend-svc.django.svc.cluster.local:80"
 
+          # INFRA-3005: именно этот хост ронял celery-задачу экспорта в Excel
+          # и все уведомления. См. backend-s3.yaml и production-configmap.yaml.
           - name: WORKFLOWS_HOST
             value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+              _default: "http://backend-svc.processing.svc.cluster.local:80"
 
           - name: WORKFLOWS_URL
             value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+              _default: "http://backend-svc.processing.svc.cluster.local:80"
 
           - name: RESOURCES_API_HOST
             value:
@@ -94,9 +100,14 @@ spec:
             value:
               _default: "http://backend-svc.eav.svc.cluster.local:80"
 
+          # Реально действует значение из production-configmap, см. там.
           - name: SAREX_API
             value:
-              _default: "https://srx.wb.ru"
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: SAREX_HOST
+            value:
+              _default: "https://sarex.uralmine.com"
 
           - name: DOCUMENTATIONS_URL
             value:

apps/issues/d8-ugmk-prod/kafka-app.yaml

@@ -138,27 +138,29 @@ spec:
 
           - name: AERO_PUBLIC_HOST
             value:
-              _default: "https://sarex.contour.infra.sarex.tech"
+              _default: "https://sarex.uralmine.com"
 
           - name: AERO_HOST
             value:
-              _default: "https://sarex.contour.infra.sarex.tech"
+              _default: "https://sarex.uralmine.com"
 
+          # server-to-server — внутренний django, см. backend-s3.yaml.
           - name: BASE_AERO_URL
             value:
-              _default: "https://sarex.contour.infra.sarex.tech"
+              _default: "http://backend-svc.django.svc.cluster.local:80"
 
           - name: BASE_AUTH_URL
             value:
               _default: "http://backend-svc.django.svc.cluster.local:80"
 
+          # INFRA-3005: см. backend-s3.yaml и production-configmap.yaml.
           - name: WORKFLOWS_HOST
             value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+              _default: "http://backend-svc.processing.svc.cluster.local:80"
 
           - name: WORKFLOWS_URL
             value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+              _default: "http://backend-svc.processing.svc.cluster.local:80"
 
           - name: RESOURCES_API_HOST
             value:
@@ -168,13 +170,15 @@ spec:
             value:
               _default: "http://backend-svc.eav.svc.cluster.local:80"
 
+          # Реально действует значение из production-configmap, см. там.
           - name: SAREX_API
             value:
-              _default: "https://sarex.contour.infra.sarex.tech"
+              _default: "https://sarex.uralmine.com"
 
+          # Реальное имя сервиса — backend-api-svc, см. backend-s3.yaml.
           - name: DOCUMENTATIONS_URL
             value:
-              _default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
 
           - name: DJANGO_SETTINGS_MODULE
             value:

apps/issues/d8-ugmk-prod/kustomization.yaml

@@ -18,3 +18,7 @@ patches:
     target:
       kind: HelmRelease
       name: celery
+  - path: production-configmap.yaml
+    target:
+      kind: ConfigMap
+      name: production-configmap

apps/issues/d8-ugmk-prod/production-configmap.yaml

@@ -0,0 +1,153 @@
+---
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: production-configmap
+  namespace: issues
+data:
+  production.py: |
+    from datetime import timedelta
+    import os
+    from .base import *
+
+    # DEBUG SETTINGS START
+    # -----------------------------------------------------------------------------
+    DEBUG = True
+    # -----------------------------------------------------------------------------
+
+    TEST_MODE = False
+
+    # SECRETS SETTINGS START
+    # -----------------------------------------------------------------------------
+    SECRET_KEY = "FromToMuchLoveOfLiving"  # Delete after Test
+    # -----------------------------------------------------------------------------
+
+    DJANGO_TOKEN = os.getenv("DJANGO_TOKEN")
+
+    # ALLOWED HOSTS START
+    # -----------------------------------------------------------------------------
+    ALLOWED_HOSTS = ["*"]
+    # -----------------------------------------------------------------------------
+
+    # APPS SETTINGS START
+    # -----------------------------------------------------------------------------
+    # INSTALLED_APPS += [
+    #     "django_extensions",
+    # ]
+    # -----------------------------------------------------------------------------
+
+    # DEBUG SETTINGS START
+    # -----------------------------------------------------------------------------
+    DEBUG = False
+    # -----------------------------------------------------------------------------
+
+    REVIEW_HOST='http://backend-svc.flows.svc.cluster.local:80'
+    # -----------------------------------------------------------------------------
+    # EXTERNAL SERVICES END
+
+    # INFRA-3005: в base здесь хардкод workflows-api-service.workflow — такого
+    # сервиса в УГМК нет (DNS: "Name or service not known"), из-за чего падал
+    # POST {WORKFLOWS_HOST}/internal/v1/companies/{id}/workflows в
+    # issues/mailing.py:122 (WorkflowsMailer) — а это и рассылка уведомлений,
+    # и финальный шаг celery-задачи экспорта в Excel.
+    # В УГМК workflows (processing) живёт как backend-svc в namespace processing.
+    WORKFLOWS_HOST = os.getenv("WORKFLOWS_HOST", "http://backend-svc.processing.svc.cluster.local:80")
+    WORKFLOWS_URL = os.getenv("WORKFLOWS_URL", "http://backend-svc.processing.svc.cluster.local:80")
+    # backend-api-svc — реальное имя сервиса documentations (base/api.yaml:74).
+    DOCUMENTATIONS_URL = "http://backend-api-svc.documentations.svc.cluster.local:80"
+    RESOURCES_API_HOST = os.getenv("RESOURCES_API_HOST", default="http://resources-service.resources.svc.cluster:8000")
+    KAFKA_HOST = os.getenv("KAFKA_HOST")
+    KAFKA_USERNAME = os.getenv("KAFKA_USERNAME")
+    KAFKA_PASSWORD = os.getenv("KAFKA_PASSWORD")
+    KAFKA_SSL_CAFILE = os.getenv("KAFKA_SSL_CAFILE", "/usr/local/share/ca-certificates/kafka.crt")
+    KAFKA_EAV_ASSETS_TOPIC = os.getenv("KAFKA_EAV_ASSETS_TOPIC", "sarex")
+    KAFKA_ISSUES_TOPIC = os.getenv("KAFKA_ISSUES_TOPIC", "sarex-issues")
+
+
+    USE_ASYNC_FUNCTIONS = True
+    USE_NOTIFICATIONS = True
+
+    # JWT SETTINGS START
+    if not os.environ.get("JWT_PRIVATE_KEY"):
+        os.environ["JWT_PRIVATE_KEY"] = _read_secret_file("/vault/secrets/django-jwt-private")
+    if not os.environ.get("JWT_PUBLIC_KEY"):
+        os.environ["JWT_PUBLIC_KEY"] = _read_secret_file("/vault/secrets/django-jwt-public")
+    # ---------------------------------------------------------------------------------------------------------------------
+    SIMPLE_JWT_ISSUER = os.getenv("SIMPLE_JWT_ISSUER", default="default_issuer")
+
+    SIMPLE_JWT = {
+        "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
+        "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
+        "ROTATE_REFRESH_TOKENS": False,
+        "UPDATE_LAST_LOGIN": False,
+
+        "ALGORITHM": "RS512",
+        "SIGNING_KEY": os.getenv("JWT_PRIVATE_KEY", default="").replace("\\n", "\n"),
+        "VERIFYING_KEY": os.getenv("JWT_PUBLIC_KEY").replace("\\n", "\n"),
+        "AUDIENCE": None,
+        "ISSUER": SIMPLE_JWT_ISSUER,
+
+        "AUTH_HEADER_TYPES": ("Bearer",),
+        "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
+        "USER_ID_FIELD": "id",
+        "USER_ID_CLAIM": "user_id",
+
+        "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
+        "TOKEN_TYPE_CLAIM": "token_type",
+
+        "JTI_CLAIM": "jti",
+
+        "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp",
+        "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5),
+        "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1),
+    }
+    # ---------------------------------------------------------------------------------------------------------------------
+
+    CORS_ALLOWED_ORIGINS = [
+        "https://sarex.uralmine.com",
+    ]
+
+    CORS_TRUSTED_ORIGINS = [
+        "https://sarex.uralmine.com",
+    ]
+
+    CSRF_TRUSTED_ORIGINS = [
+        "https://sarex.uralmine.com",
+    ]
+
+    CORS_ALLOW_ALL_ORIGINS = True
+    ENABLE_MAILGUN=False
+    SMTP_PORT=587
+    SMTP_HOST="post.uralmine.com"
+    EMAIL_FROM="sarex@uralmine.com"
+
+    CORS_ALLOW_METHODS = [
+        "DELETE",
+        "GET",
+        "OPTIONS",
+        "PATCH",
+        "POST",
+        "PUT",
+    ]
+
+    SAREX_API = os.getenv("SAREX_API", "https://sarex.uralmine.com")
+
+    AERO_PUBLIC_HOST = os.getenv("AERO_PUBLIC_HOST", default=SAREX_API)
+
+    BASE_AERO_URL = "http://backend-svc.django.svc.cluster.local:80"
+
+    ENVIRONMENT = "production"
+
+    SESSION_COOKIE_NAME = "issues-sessionid"
+    CSRF_COOKIE_NAME = "issues-csrftoken"
+    STATIC_URL = "/static/"
+    STORAGES = {
+        'default': {
+            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
+        },
+        'staticfiles': {
+            # Leave whatever setting you already have here, e.g.:
+            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
+        }
+    }

apps/issues/uralkal/backend-s3.yaml

@@ -1,149 +0,0 @@
----
-# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml.
-# podAnnotations — map, мержится по ключам.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: issues
-spec:
-  values:
-    services:
-      backend:
-        deployment:
-          args:
-            _default:
-              - |
-                set -a
-                [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
-                [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
-                [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
-                [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
-                [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
-                [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
-                [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
-                set +a
-                exec /src/entrypoint.sh
-
-        volumes:
-          _default:
-            - name: production-configmap
-              mountPath:
-                _default: /src/config/settings/production.py
-              subPath:
-                _default: production.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: production-configmap
-                items:
-                  - key: production.py
-                    path:
-                      _default: production.py
-            - name: kafka-ca-cert
-              mountPath:
-                _default: /usr/local/share/ca-certificates/kafka.crt
-              subPath:
-                _default: kafka.crt
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: kafka-kafka-contour-tls
-                items:
-                  - key: ca.crt
-                    path:
-                      _default: kafka.crt
-
-        envs:
-          - name: ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: AERO_PUBLIC_HOST
-            value:
-              _default: "https://sarex.contour.infra.sarex.tech"
-
-          - name: AERO_HOST
-            value:
-              _default: "https://sarex.contour.infra.sarex.tech"
-
-          - name: BASE_AERO_URL
-            value:
-              _default: "https://sarex.contour.infra.sarex.tech"
-
-          - name: BASE_AUTH_URL
-            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80"
-
-          - name: WORKFLOWS_URL
-            value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80"
-
-          - name: RESOURCES_API_HOST
-            value:
-              _default: "http://iam-backend.iam.svc.cluster.local:8000"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://backend-svc.eav.svc.cluster.local:80"
-
-          - name: SAREX_API
-            value:
-              _default: "https://sarex.contour.infra.sarex.tech"
-
-          - name: DOCUMENTATIONS_URL
-            value:
-              _default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
-
-          - name: DJANGO_SETTINGS_MODULE
-            value:
-              _default: "config.settings.production"
-
-          - name: API_ADDRESS
-            value:
-              _default: "8000"
-
-          # Kafka — код (kafka_app/app.py) ждёт KAFKA_HOST единой строкой "host:port",
-          # KAFKA_SSL_CAFILE — путь к файлу (не PEM-текст, в отличие от flows-backend).
-          # Хост/порт/CA — те же проверенные значения, что у message-hub/pm/flows.
-          - name: KAFKA_HOST
-            value:
-              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
-
-          - name: KAFKA_SSL_CAFILE
-            value:
-              _default: "/usr/local/share/ca-certificates/kafka.crt"
-
-          # Топики совпадают с тем, что уже провижено на брокере (см. topics
-          # в секрете kafka/apps/pm) и с SETTINGS_TOPICS у message-hub.
-          - name: KAFKA_ISSUES_TOPIC
-            value:
-              _default: "issues_broadcast_prod"
-
-          - name: KAFKA_EAV_ASSETS_TOPIC
-            value:
-              _default: "assets_broadcast"
-
-        podAnnotations:
-          _default:
-            vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
-            vault.hashicorp.com/agent-inject-template-issues-s3: |-
-              {{- with secret "secrets/data/minio/apps/issues" -}}
-              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-              YC_S3_BUCKET_NAME=issues
-              YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
-            vault.hashicorp.com/agent-inject-template-issues-kafka: |-
-              {{- with secret "secrets/data/kafka/apps/issues" -}}
-              KAFKA_USERNAME={{ index .Data.data "username" }}
-              KAFKA_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}

apps/issues/uralkal/backend.yaml

@@ -8,8 +8,145 @@ spec:
   values:
     services:
       backend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_eb983275
         deployment:
           resources:
             requests:
               cpu: null
               memory: null
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
+                [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
+                [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
+                [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
+                [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
+                [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
+                [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
+                set +a
+                exec /src/entrypoint.sh
+
+        volumes:
+          _default:
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+            - name: kafka-ca-cert
+              mountPath:
+                _default: /usr/local/share/ca-certificates/kafka.crt
+              subPath:
+                _default: kafka.crt
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: kafka-kafka-contour-tls
+                items:
+                  - key: ca.crt
+                    path:
+                      _default: kafka.crt
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: SAREX_API
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: SAREX_HOST
+            value:
+              _default: "https://sarex.local.uralkali.com"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          - name: KAFKA_HOST
+            value:
+              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: KAFKA_ISSUES_TOPIC
+            value:
+              _default: "issues_broadcast_prod"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-s3: |-
+              {{- with secret "secrets/data/minio/apps/issues" -}}
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YC_S3_BUCKET_NAME=issues
+              YC_S3_ENDPOINT_URL=http://10.133.0.245:9000
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/issues" -}}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}

apps/issues/uralkal/celery-s3.yaml

@@ -1,145 +0,0 @@
----
-# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/issues/base/celery.yaml.
-# podAnnotations — map, мержится по ключам.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: celery
-  namespace: issues
-spec:
-  values:
-    services:
-      celery:
-        deployment:
-          args:
-            _default:
-              - |
-                set -a
-                [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
-                [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
-                [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
-                [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
-                [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
-                [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
-                [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
-                set +a
-                exec celery -A config worker -l info -E
-
-        volumes:
-          _default:
-            - name: production-configmap
-              mountPath:
-                _default: /src/config/settings/production.py
-              subPath:
-                _default: production.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: production-configmap
-                items:
-                  - key: production.py
-                    path:
-                      _default: production.py
-            - name: kafka-ca-cert
-              mountPath:
-                _default: /usr/local/share/ca-certificates/kafka.crt
-              subPath:
-                _default: kafka.crt
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: kafka-kafka-contour-tls
-                items:
-                  - key: ca.crt
-                    path:
-                      _default: kafka.crt
-
-        envs:
-          - name: ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: AERO_PUBLIC_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: AERO_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: BASE_AERO_URL
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: BASE_AUTH_URL
-            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
-
-          - name: WORKFLOWS_URL
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
-
-          - name: RESOURCES_API_HOST
-            value:
-              _default: "http://iam-backend.iam.svc.cluster.local:8000"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://backend-svc.eav.svc.cluster.local:80"
-
-          - name: SAREX_API
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: DOCUMENTATIONS_URL
-            value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
-
-          - name: DJANGO_SETTINGS_MODULE
-            value:
-              _default: "config.settings.production"
-
-          - name: API_ADDRESS
-            value:
-              _default: "8000"
-
-          # См. подробные комментарии в apps/issues/d8-ugmk-prod/backend-s3.yaml.
-          - name: KAFKA_HOST
-            value:
-              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
-
-          - name: KAFKA_SSL_CAFILE
-            value:
-              _default: "/usr/local/share/ca-certificates/kafka.crt"
-
-          - name: KAFKA_ISSUES_TOPIC
-            value:
-              _default: "issues_broadcast_prod"
-
-          - name: KAFKA_EAV_ASSETS_TOPIC
-            value:
-              _default: "assets_broadcast"
-
-        podAnnotations:
-          _default:
-            vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
-            vault.hashicorp.com/agent-inject-template-issues-s3: |-
-              {{- with secret "secrets/data/minio/apps/issues" -}}
-              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-              YC_S3_BUCKET_NAME=issues
-              YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
-            vault.hashicorp.com/agent-inject-template-issues-kafka: |-
-              {{- with secret "secrets/data/kafka/apps/issues" -}}
-              KAFKA_USERNAME={{ index .Data.data "username" }}
-              KAFKA_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}

apps/issues/uralkal/celery.yaml

@@ -13,3 +13,137 @@ spec:
             requests:
               cpu: null
               memory: null
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
+                [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
+                [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
+                [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
+                [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
+                [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
+                [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
+                set +a
+                exec celery -A config worker -l info -E
+
+        volumes:
+          _default:
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+            - name: kafka-ca-cert
+              mountPath:
+                _default: /usr/local/share/ca-certificates/kafka.crt
+              subPath:
+                _default: kafka.crt
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: kafka-kafka-contour-tls
+                items:
+                  - key: ca.crt
+                    path:
+                      _default: kafka.crt
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: SAREX_API
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: SAREX_HOST
+            value:
+              _default: "https://sarex.local.uralkali.com"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          - name: KAFKA_HOST
+            value:
+              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: KAFKA_ISSUES_TOPIC
+            value:
+              _default: "issues_broadcast_prod"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-s3: |-
+              {{- with secret "secrets/data/minio/apps/issues" -}}
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YC_S3_BUCKET_NAME=issues
+              YC_S3_ENDPOINT_URL=http://10.133.0.245:9000
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/issues" -}}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}

apps/issues/uralkal/kustomization.yaml

@@ -3,14 +3,6 @@ kind: Kustomization
 resources:
   - ../base
 patches:
-  - path: backend-s3.yaml
-    target:
-      kind: HelmRelease
-      name: backend
-  - path: celery-s3.yaml
-    target:
-      kind: HelmRelease
-      name: celery
   - path: backend.yaml
     target:
       kind: HelmRelease

apps/issues/vad/backend-s3.yaml

@@ -96,7 +96,11 @@ spec:
 
           - name: SAREX_API
             value:
-              _default: "https://sarex.contour.infra.sarex.tech"
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: SAREX_HOST
+            value:
+              _default: "https://sarex.vadroad.ru"
 
           - name: DOCUMENTATIONS_URL
             value:

apps/issues/vad/celery-s3.yaml

@@ -96,7 +96,11 @@ spec:
 
           - name: SAREX_API
             value:
-              _default: "https://srx.wb.ru"
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: SAREX_HOST
+            value:
+              _default: "https://sarex.vadroad.ru"
 
           - name: DOCUMENTATIONS_URL
             value:

apps/issues/wb/production-configmap.yaml

@@ -12,7 +12,6 @@ data:
 
     # DEBUG SETTINGS START
     # -----------------------------------------------------------------------------
-    DEBUG = True
     # -----------------------------------------------------------------------------
 
     TEST_MODE = False
@@ -40,7 +39,7 @@ data:
 
     # DEBUG SETTINGS START
     # -----------------------------------------------------------------------------
-    DEBUG = True
+    DEBUG = False
     # -----------------------------------------------------------------------------
 
     REVIEW_HOST='http://backend-service.flows.svc.cluster.local:8000'

apps/mapper/uralkal/backend.yaml

@@ -13,3 +13,28 @@ spec:
             requests:
               cpu: null
               memory: null
+
+        envs:
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local/api/v1"
+
+          - name: FLOW_HOST
+            value:
+              _default: "http://backend-svc.flows.svc.cluster.local/api/v1"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local/api"
+
+          - name: NOTE_HOST
+            value:
+              _default: "http://backend-service.notes.svc.cluster.local:8000/api/v1"
+
+          - name: REDIS_USE
+            value:
+              _default: "0"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"

apps/notes/base/backend.yaml

@@ -66,7 +66,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:preprod_c00faf6e
           pullPolicy:
             _default: IfNotPresent
         service:

apps/notes/base/frontend.yaml

@@ -48,7 +48,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:contour_5ff34172
           pullPolicy:
             _default: IfNotPresent
         service:

apps/notes/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:0.3.7
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854
           pullPolicy:
             _default: IfNotPresent
 
@@ -87,6 +87,14 @@ spec:
           monitoring: prometheus
 
         envs:
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "0"
+
+          - name: ENABLE_ND
+            value:
+              _default: "0"
+
           - name: DJANGO_HOST
             value:
               _default: "http://backend.django.svc.cluster.local:8000"

apps/notes/brusnika-stage/frontend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:prod_55791cf6_relative
+            _default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f
           pullPolicy:
             _default: IfNotPresent
 

apps/notes/uralkal/backend.yaml

@@ -13,3 +13,52 @@ spec:
             requests:
               cpu: null
               memory: null
+
+        envs:
+          - name: PG_SSL_MODE
+            value:
+              _default: "disable"
+          
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local"
+
+          - name: BASE_HOST
+            value:
+              _default: "https://sarex.local.uralkali.com/notes"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"
+
+          - name: FAAS_SERVICE
+            value:
+              _default: "https://api.sarex.io/lambdas"
+
+          - name: WORKSPACE_URL
+            value:
+              _default: "http://backend-svc.workspaces.svc.cluster.local/api/v1"
+
+          - name: WORKFLOW_HOST
+            value:
+              _default: "http://backend-svc.processing.svc.cluster.local/api/v1"
+
+          - name: WORKFLOW_TAG
+            value:
+              _default: "stable"
+
+          - name: RESOURCE_URL
+            value:
+              _default: "https://api.sarex.io/resources/api/v1"
+
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "0"
+
+          - name: ENABLE_ND
+            value:
+              _default: "0"
+
+          - name: ATTACHMENT_HOST
+            value:
+              _default: "http://attachments-service.attachments.svc.cluster.local:8000/api/v1"

apps/pm/brusnika-stage/frontend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_7f125269
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-frontend:contour_abfaba7c
           pullPolicy:
             _default: IfNotPresent
 

apps/pm/wb/backend.yaml

@@ -147,6 +147,28 @@ spec:
             value:
               _default: "/api/v1"
 
+          - name: KAFKA_ENABLE
+            value:
+              _default: "True"
+
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          # Обязан совпадать с SETTINGS_TOPICS["planning"] в
+          # apps/message-hub/wb/message-hub.yaml
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-prod"}'
+
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/pm/wb/celery.yaml

@@ -141,6 +141,26 @@ spec:
             value:
               _default: "/api/v1"
 
+          - name: KAFKA_ENABLE
+            value:
+              _default: "True"
+
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-prod"}'
+
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/premises/base/backend.yaml

@@ -0,0 +1,313 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: premises
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: true
+          name:
+            _default: premises-vault
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/premises-backend:production_216148a9
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: premises-backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["/bin/sh", "-ec"]
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/premises-db ] && . /vault/secrets/premises-db
+                [ -f /vault/secrets/premises-kafka ] && . /vault/secrets/premises-kafka
+                [ -f /vault/secrets/premises-s3 ] && . /vault/secrets/premises-s3
+                [ -f /vault/secrets/premises-issues-db ] && . /vault/secrets/premises-issues-db
+                [ -f /vault/secrets/premises-inspections-db ] && . /vault/secrets/premises-inspections-db
+                [ -f /vault/secrets/premises-checklists-db ] && . /vault/secrets/premises-checklists-db
+                [ -f /vault/secrets/premises-eav-db ] && . /vault/secrets/premises-eav-db
+                [ -f /vault/secrets/premises-sarex-db ] && . /vault/secrets/premises-sarex-db
+                [ -f /usr/local/share/ca-certificates/kafka.crt ] && export KAFKA_SSL_CERT="$(cat /usr/local/share/ca-certificates/kafka.crt)"
+                set +a
+                exec ./entrypoint.sh
+
+          resources:
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 1Gi
+
+          probes:
+            liveness:
+              enabled:
+                _default: true
+              httpGet:
+                path:
+                  _default: /internal/healthz/live/
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 60
+            readiness:
+              enabled:
+                _default: true
+              httpGet:
+                path:
+                  _default: /internal/healthz/ready/
+              initialDelaySeconds:
+                _default: 10
+              periodSeconds:
+                _default: 30
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        envs:
+          - name: DEBUG
+            value:
+              _default: "false"
+
+          - name: HTTP_ROOT_PATH
+            value:
+              _default: "/premises"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: GUNICORN_WORKERS
+            value:
+              _default: "3"
+
+          - name: FASTSTREAM_WORKERS
+            value:
+              _default: "3"
+
+          - name: DATABASE_POOL_SIZE
+            value:
+              _default: "5"
+
+          - name: KAFKA_EAV_ASSET_TOPIC_NAME
+            value:
+              _default: "assets_broadcast"
+
+          - name: KAFKA_SSL_CERT
+            value:
+              _default: ""
+
+          - name: S3_BUCKET
+            value:
+              _default: "premises"
+
+          - name: EXPORT_TTL_MINUTES
+            value:
+              _default: "30"
+
+          - name: EXPORT_MAX_WORKERS
+            value:
+              _default: "4"
+
+          - name: EXPORT_S3_KEY_PREFIX
+            value:
+              _default: "premise-export"
+
+          - name: ATTACHMENT_MAX_SIZE_BYTES
+            value:
+              _default: "314572800"
+
+          - name: ATTACHMENT_S3_KEY_PREFIX
+            value:
+              _default: "attachment/"
+
+          - name: OTEL_ENABLE
+            value:
+              _default: "false"
+
+          - name: OTEL_URL
+            value:
+              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
+
+          - name: OTEL_SERVICE_NAME
+            value:
+              _default: "premises-backend"
+
+          - name: OTEL_INSECURE
+            value:
+              _default: "true"
+
+          - name: SRX_SDK_IAM_ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://backend-svc.processing.svc.cluster.local:80"
+
+          - name: WORKFLOWS_GENERATION_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/rendering-template:master"
+
+          - name: WORKFLOWS_DOCX_TO_PDF_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/docx-to-pdf:latest"
+
+          - name: WORKFLOWS_CALLBACK_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/webhook-caller:master"
+
+          - name: WORKFLOWS_CALLBACK_HOST
+            value:
+              _default: "http://backend-svc.premises.svc.cluster.local:80"
+
+          - name: WORKFLOWS_RESULT_PATH
+            value:
+              _default: "premises-prod"
+
+        podAnnotations:
+          _default:
+            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+            vault.hashicorp.com/agent-init-first: "true"
+            vault.hashicorp.com/agent-inject: "true"
+            vault.hashicorp.com/agent-pre-populate-only: "true"
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: premises
+            vault.hashicorp.com/agent-inject-secret-premises-db: secrets/data/apps/premises/postgres
+            vault.hashicorp.com/agent-inject-template-premises-db: |-
+              {{- with secret "secrets/data/apps/premises/postgres" -}}
+              DATABASE_HOST={{ index .Data.data "host" }}
+              DATABASE_PORT={{ index .Data.data "port" }}
+              DATABASE_NAME={{ index .Data.data "database" }}
+              DATABASE_USERNAME={{ index .Data.data "username" }}
+              DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-kafka: secrets/data/kafka/apps/premises
+            vault.hashicorp.com/agent-inject-template-premises-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/premises" -}}
+              KAFKA_HOST={{ if .Data.data.auth }}{{ index .Data.data.auth "bootstrap_servers" }}{{ else }}{{ index .Data.data "bootstrap_servers" }}{{ end }}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-s3: secrets/data/minio/apps/premises
+            vault.hashicorp.com/agent-inject-template-premises-s3: |-
+              {{- with secret "secrets/data/minio/apps/premises" -}}
+              S3_HOST={{ index .Data.data.client "endpoint" }}
+              S3_ACCESS_KEY={{ index .Data.data "access_key" }}
+              S3_SECRET_KEY={{ index .Data.data "secret_key" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-issues-db: secrets/data/apps/issues/postgres
+            vault.hashicorp.com/agent-inject-template-premises-issues-db: |-
+              {{- with secret "secrets/data/apps/issues/postgres" -}}
+              ISSUES_DATABASE_HOST={{ index .Data.data "host" }}
+              ISSUES_DATABASE_PORT={{ index .Data.data "port" }}
+              ISSUES_DATABASE_NAME={{ index .Data.data "database" }}
+              ISSUES_DATABASE_USERNAME={{ index .Data.data "username" }}
+              ISSUES_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-inspections-db: secrets/data/apps/inspections/postgres
+            vault.hashicorp.com/agent-inject-template-premises-inspections-db: |-
+              {{- with secret "secrets/data/apps/inspections/postgres" -}}
+              INSPECTIONS_DATABASE_HOST={{ index .Data.data "host" }}
+              INSPECTIONS_DATABASE_PORT={{ index .Data.data "port" }}
+              INSPECTIONS_DATABASE_NAME={{ index .Data.data "database" }}
+              INSPECTIONS_DATABASE_USERNAME={{ index .Data.data "username" }}
+              INSPECTIONS_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-checklists-db: secrets/data/apps/checklists/postgres
+            vault.hashicorp.com/agent-inject-template-premises-checklists-db: |-
+              {{- with secret "secrets/data/apps/checklists/postgres" -}}
+              CHECKLISTS_DATABASE_HOST={{ index .Data.data "host" }}
+              CHECKLISTS_DATABASE_PORT={{ index .Data.data "port" }}
+              CHECKLISTS_DATABASE_NAME={{ index .Data.data "database" }}
+              CHECKLISTS_DATABASE_USERNAME={{ index .Data.data "username" }}
+              CHECKLISTS_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-eav-db: secrets/data/apps/eav/postgres
+            vault.hashicorp.com/agent-inject-template-premises-eav-db: |-
+              {{- with secret "secrets/data/apps/eav/postgres" -}}
+              EAV_DATABASE_HOST={{ index .Data.data "host" }}
+              EAV_DATABASE_PORT={{ index .Data.data "port" }}
+              EAV_DATABASE_NAME={{ index .Data.data "database" }}
+              EAV_DATABASE_USERNAME={{ index .Data.data "username" }}
+              EAV_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-premises-sarex-db: secrets/data/apps/django/postgres
+            vault.hashicorp.com/agent-inject-template-premises-sarex-db: |-
+              {{- with secret "secrets/data/apps/django/postgres" -}}
+              SAREX_DATABASE_HOST={{ index .Data.data "host" }}
+              SAREX_DATABASE_PORT={{ index .Data.data "port" }}
+              SAREX_DATABASE_NAME={{ index .Data.data "database" }}
+              SAREX_DATABASE_USERNAME={{ index .Data.data "username" }}
+              SAREX_DATABASE_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/premises/base/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: premises
+resources:
+  - namespace.yaml
+  - backend.yaml

apps/premises/base/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: premises
+  labels:
+    istio-injection: enabled

apps/premises/d8-ugmk-prod/backend.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: premises
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        volumes:
+          _default:
+            - name: kafka-ca-cert
+              mountPath:
+                _default: /usr/local/share/ca-certificates/kafka.crt
+              subPath:
+                _default: kafka.crt
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-ca-cert
+                items:
+                  - key: kafka.crt
+                    path:
+                      _default: kafka.crt

apps/premises/d8-ugmk-prod/kafka-ca-configmap.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-ca-cert
+  namespace: premises
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
+    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
+    NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+    MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
+    h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
+    D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
+    tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
+    Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
+    GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
+    A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
+    QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
+    KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
+    kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
+    TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
+    fdA17/ibw6gFrH2b3vZKcx8D455V
+    -----END CERTIFICATE-----

apps/premises/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - kafka-ca-configmap.yaml
+patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: premises
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend

apps/premises/d8-ugmk-prod/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: premises
+  labels:
+    istio-injection: enabled
+    security.deckhouse.io/pod-policy: privileged

apps/premises/vad/backend.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: premises
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        volumes:
+          _default:
+            - name: kafka-ca-cert
+              mountPath:
+                _default: /usr/local/share/ca-certificates/kafka.crt
+              subPath:
+                _default: kafka.crt
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-ca-cert
+                items:
+                  - key: kafka.crt
+                    path:
+                      _default: kafka.crt