Add audit collector HelmRelease for security-audit namespace to process and export kube-apiserver audit logs, including Kafka and Vault integration

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitlab-ci.yml

@@ -4,6 +4,8 @@ include:
 
 stages:
   - build
+  - slices
+  - slices-publish
 
 variables:
   RELEASE_NAME: iac-offline
@@ -33,3 +35,31 @@ build_offline_mirror:
     - docker push ${IMAGE_NAME}
     - docker push ${CR}/${RELEASE_NAME}:latest
   timeout: 30m
+
+generate_slice_jobs:
+  stage: slices
+  image: ${CR}/infra/slice-builder:1.0.0
+  tags:
+    - build
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v?(?:\d+\.){2}\d+$/
+  variables:
+    GIT_DEPTH: "1"
+  script:
+    - python3 ci/publish-slice.py generate --release "$CI_COMMIT_TAG" --commit "$CI_COMMIT_SHA" --out slices-pipeline.yml
+    - cat slices-pipeline.yml
+  artifacts:
+    paths:
+      - slices-pipeline.yml
+
+publish_contour_slices:
+  stage: slices-publish
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v?(?:\d+\.){2}\d+$/
+  needs:
+    - generate_slice_jobs
+  trigger:
+    include:
+      - artifact: slices-pipeline.yml
+        job: generate_slice_jobs
+    strategy: depend

CLAUDE.md

@@ -25,11 +25,13 @@
 
 | Путь | Что |
 |---|---|
-| `clusters/` | 10 точек входа Flux — **источник истины «что где раскатано»** |
+| `clusters/` | 17 точек входа Flux + шаблон `contour` — **источник истины «что где раскатано»** |
-| `infrastructure/` | 36 платформенных компонентов |
+| `infrastructure/` | 44 платформенных компонента |
-| `apps/` | 37 прикладных сервисов |
+| `apps/` | 39 прикладных сервисов |
-| `docs/apps/` | 35 mermaid-диаграмм по сервисам + `README.md` с доменной группировкой |
+| `docs/apps/` | 34 mermaid-диаграммы по сервисам + `README.md` с доменной группировкой |
+| `docs/architecture/` | модель контура в ArchiMate + скрипты-сканеры (`scan_calls.py`, `scan_contour.py`) и сборка (`build_archimate.py`); реальные значения инсталляций сюда не кладутся, только `*.example.json` |
 | `docs/closed-contour-deployment.md` | ранбук поднятия закрытого контура |
+| `ci/`, `.gitlab-ci.yml`, `Dockerfile` | на тег `vX.Y.Z`: образ офлайн-зеркала `iac-offline` и публикация «слайсов» контуров (см. ниже) |
 | `README.md` | mermaid-мегакарта платформы, структура репозитория, инструкции по добавлению app / infra / кластера |
 | `IAC-CATALOG.md` | каталог всего `infra/*`; §5 — про этот репозиторий |
 | `inventory.yaml` | сгенерированный снимок прода: 59 namespace → kind → имена |
@@ -38,14 +40,18 @@
 
 **Кластер.** `clusters/<cluster>/kustomization.yaml` — плоский список `../../apps/<app>/<cluster>`. Инфраструктура подключается двумя разными способами:
 
-- `d8-ugmk-prod` — прямо в корневом kustomization как `../../infrastructure/<comp>/d8-ugmk-prod`;
+- `d8-ugmk-prod`, `sarex-contour`, `ugok`, `uralkal`, `vad` — прямо в корневом kustomization как `../../infrastructure/<comp>/<c>`;
-- `brusnika-prod`, `brusnika-stage`, `wb` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/<c>/infrastructure/patches/*.yaml`.
+- `brusnika-prod`, `brusnika-stage`, `vk-infra`, `vk-prod` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на оверлеи `../../../infrastructure/<comp>/<c>` (`base` + патч HelmRelease + сопутствующие манифесты компонента);
+- `wb`, `yc-cps-prod`, `yc-infra-prod`, `yc-k8s-test-02` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/<c>/infrastructure/patches/*.yaml`;
+- `stand` — послойно: `layers.yaml` объявляет Flux-`Kustomization` `00-vault → 10-mesh → 20-data → 30-platform → 40-routing` (каталоги `clusters/stand/<NN>-<layer>/`). Слои ссылаются на оверлеи `infrastructure/<comp>/contour-template`, а значения контура (`${STORAGE_CLASS}`, `${HOST_*}`, `${GATEWAY_REPLICAS}`) Flux подставляет через `postBuild.substituteFrom` из ConfigMap `contour-vars`.
 
-Кластеры: `brusnika-prod`, `brusnika-stage`, `d8-ugmk-prod`, `wb`, `yc-cps-prod`, `yc-ecp`, `yc-infra-prod`, `yc-k8s-test`, `yc-k8s-test-02`, `contour`.
+Кластеры с приложениями: `asterus`, `brusnika-prod`, `brusnika-stage`, `d8-ugmk-prod`, `sarex-contour`, `ugok`, `uralkal`, `vad`, `wb`, `yc-ecp`, `yc-k8s-test`. Только инфраструктура: `stand`, `vk-infra`, `vk-prod`, `yc-cps-prod`, `yc-infra-prod`, `yc-k8s-test-02`. Шаблон: `contour`.
 
 **Приложение.** `apps/<app>/base/` — по одному `.yaml` на процесс (`backend.yaml`, `celery.yaml`, `frontend.yaml`) плюс `namespace.yaml`; оверлеи в `apps/<app>/<cluster>/`. Namespace = имя приложения. Рядом с манифестами лежит документация: `CONFIGURATION.md` (все env-переменные и откуда берутся), `ENDPOINTS.md` (исходящие HTTP-вызовы), `openapi.yaml` (входящий контракт), `.env.example`. Если процессов несколько — файлы с префиксом процесса: `api.ENDPOINTS.md`, `pdm.CONFIGURATION.md`, `frontend.CONFIGURATION.md`.
 
-**Инфра-компонент.** `infrastructure/<comp>/base/` + оверлеи `<comp>/<cluster>/`. Корневой `infrastructure/<comp>/kustomization.yaml` всегда указывает просто на `base`. Чарты идут с суффиксом контура: `vault-contour`, `keycloak-contour`, `postgresql-contour` и — внимание — `idp-contour` это Zitadel.
+**Инфра-компонент.** `infrastructure/<comp>/base/` + оверлеи `<comp>/<cluster>/`. Корневой `infrastructure/<comp>/kustomization.yaml` всегда указывает просто на `base`. Оверлей `contour-template` (есть у vault, istio-*, cert-manager, postgresql, kafka, rabbitmq, zitadel, camunda, istio-config) — параметризованный `${VAR}`, а не привязанный к конкретному кластеру. Чарты идут с суффиксом контура: `vault-contour`, `keycloak-contour`, `postgresql-contour` и — внимание — `idp-contour` это Zitadel.
+
+**Слайсы.** На тег `vX.Y.Z` `ci/publish-slice.py generate` создаёт child-pipeline с отдельной джобой на каждый `clusters/*/kustomization.yaml`. Джоба вызывает `ci/build-slice.py`: тот обходит дерево Kustomize от `clusters/<c>` и упаковывает только нужные файлы в tar. Результат публикуется как OCI-артефакт `cr.yandex/crpct2b2lsmao4nm0cjk/<c>-iac:<tag>` (media type `application/vnd.sarex.slice.config.v1+json`). Так закрытый контур получает только свой срез. Тесты — `ci/tests/test_build_slice.py`.
 
 ## Где искать конкретное
 
@@ -61,18 +67,23 @@
 | Тег образа в контуре | `apps/<app>/<cluster>/*.yaml`, поле `image.tag` |
 | Что реально в проде по namespace | `inventory.yaml` |
 | Где лежит исходный код приложения | `IAC-CATALOG.md` §5.3.8 |
+| Что попадёт в слайс контура | `python3 ci/build-slice.py` по `clusters/<c>` (логика сбора — там же) |
+| Переменные шаблонного контура | `${...}` в `infrastructure/*/contour-template`; значения — ConfigMap `contour-vars` в кластере, не в репозитории |
 
 ## Ловушки
 
 - **`dsinv/`** — оверлей есть у 25 приложений, но `clusters/dsinv/` не существует. Это материализованный снимок живого контура WB, а не источник деплоя. Развёрнутым не считать.
-- **Две несовместимые конвенции оверлеев** (`IAC-CATALOG.md` §5.3.4). `d8-ugmk-prod`, `yc-k8s-test`, `dsinv` наследуют `base` и патчат его. `brusnika-prod`, `brusnika-stage`, `yc-ecp` — полные копии HelmRelease, которые молча дрейфуют от base. Правка `base` на них не влияет.
+- **Две несовместимые конвенции оверлеев** (`IAC-CATALOG.md` §5.3.4). `d8-ugmk-prod`, `yc-k8s-test`, `vad`, `uralkal`, `sarex-contour`, `dsinv` наследуют `base` и патчат его. `brusnika-prod`, `brusnika-stage`, `yc-ecp`, `asterus` — полные копии HelmRelease, которые молча дрейфуют от base. Правка `base` на них не влияет. **`wb` (4 из 27) и `ugok` (9 из 33) смешанные** — проверяйте `resources:` конкретного оверлея; в `ugok` причина обычно указана комментарием в его `kustomization.yaml`.
+- **`asterus` подключён почти пустым**: оверлеи есть у 26 приложений, но в `clusters/asterus/kustomization.yaml` активен только `auth-flow`, остальные закомментированы. Инфраструктуры в кластере нет.
+- **Слайс публикуется для каждого `clusters/*/kustomization.yaml`** — в том числе для тестовых и инфраструктурных кластеров. Новая папка в `clusters/` с этим файлом автоматически станет слайсом на следующем теге. У `contour` такого файла нет, поэтому для него слайс не собирается.
 - **`IAC-CATALOG.md` — снимок на 05.08.2026** и по составу приложений на контур уже расходится с реальностью (там у `wb` ноль приложений, фактически 26 оверлеев). Всегда сверяться с `clusters/*/kustomization.yaml`.
 - **Мегадиаграмма в `README.md` идеализирована** — рисована руками, показывает все приложения на одной Postgres и все фронтенды за `control-interface`. Проверяемые источники — env-переменные и istio-config.
 - **`clusters/contour/` — не кластер, а шаблон**: в нём нет `flux-system`, только `apps.yaml`, `infrastructure.yaml`, `helm-repositories.yaml`.
-- **Path-роутинг виден в репозитории только у `d8-ugmk-prod` и `yc-ecp`.** В Brusnika и WB весь прикладной трафик уходит одним правилом в `nginx-service.global-ingress` / `yet-another-nginx-service.global-ingress`, а разводка по путям происходит вне репозитория. Через Istio там публикуются только платформенные UI (Gitea, Grafana, OpenObserve, Superset, Vault, Zitadel, Camunda, MinIO).
+- **Path-роутинг лежит в `infrastructure/istio-config/<c>/` у большинства контуров, но не у WB.** В `clusters/wb/infrastructure/patches/istio-config.yaml` через Istio публикуются только платформенные UI (Gitea, Grafana, OpenObserve, Superset, Vault, GoAlert), а прикладной трафик разводится вне репозитория. В Brusnika схема смешанная: часть путей идёт напрямую в сервисы, остальное — одним правилом в `yet-another-nginx-service.global-ingress`.
-- **Имена namespace расходятся между источниками**: `inventory.yaml` использует суффикс (`flows-prod`), `apps/` — голое имя (`flows`).
+- **`vk-prod` маршрутизирует в namespace с суффиксом `-prod`** (`eav-prod`, `pm-prod`, `inspections-prod`), а приложений из `apps/` в этом кластере нет: сервисы раскатываются не этим репозиторием.
-- **17 оверлеев приложений не подключены ни к одному кластеру** — мёртвый код.
+- **Имена namespace расходятся между источниками**: `inventory.yaml` и `vk-prod` используют суффикс (`flows-prod`), `apps/` — голое имя (`flows`).
-- **Нет диаграмм** в `docs/apps/` для `iam`, `auth-flow`, `ams-sync`.
+- **66 оверлеев приложений не подключены ни к одному кластеру**: 25 — `dsinv`, 25 — закомментированные в `asterus`, остальные 16 — мёртвый код (в основном `brusnika-prod`, плюс `bi`/`iam` в `wb` и `yc-k8s-test`).
+- **Нет диаграмм** в `docs/apps/` для `ams-sync`, `auth-flow`, `bi`, `iam`, `premises`.
 - **Чистые фронтенды без бэкенда в этом репозитории**: `auth-flow`, `control-interface`, `cross-section`, `document-link`, `prescriptions`, `projects`, `remarks`, `reviews`, `stamp-verification`. Бэкенд `projects` живёт в `planning/projects-backend`.
 - Самые центральные сервисы по числу входящих ссылок: `documentations` (~85), `processing` / `workflow` (~76), `django` (~53), `eav` (~47), `resources` (~44), `bim` (~39), `flows` (~38). Менять их конфигурацию — дороже всего.
 

apps/ams-sync/brusnika-stage/backend.yaml

@@ -138,6 +138,10 @@ spec:
           - name: KAFKA_SASL_MECHANISM
             value:
               _default: "SCRAM-SHA-512"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: TELEGRAM_TOKEN
             secretName:

apps/attachments/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:production_6dbb4dce
+            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
           pullPolicy:
             _default: IfNotPresent
 
@@ -110,6 +110,10 @@ spec:
           - name: YANDEX_S3_VERIFY
             value:
               _default: "false"
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "false"
+
         secretEnvs:
           - name: DATABASE_HOST
             secretName:

apps/attachments/uralkal/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: attachments
+resources:
+  - ../base
+patches:
+  - path: patch.yaml
+    target:
+      kind: HelmRelease
+      name: attachments

apps/attachments/uralkal/patch.yaml

@@ -0,0 +1,34 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: attachments
+  namespace: attachments
+spec:
+  values:
+    services:
+      attachments:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/auth-path: auth/kubernetes
+            vault.hashicorp.com/role: attachments
+            vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/apps/attachments/postgres
+            vault.hashicorp.com/agent-inject-template-attachments-db: |-
+              {{- with secret "secrets/data/apps/attachments/postgres" -}}
+              DATABASE_HOST={{ index .Data.data "host" }}
+              DATABASE_PORT={{ index .Data.data "port" }}
+              DATABASE_NAME={{ index .Data.data "database" }}
+              DATABASE_USER={{ index .Data.data "username" }}
+              DATABASE_PASSWORD={{ index .Data.data "password" }}
+              DATABASE_SSL_MODE=disable
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments
+            vault.hashicorp.com/agent-inject-template-attachments-s3: |-
+              {{- with secret "secrets/data/minio/apps/attachments" -}}
+              YANDEX_S3_ENDPOINT_URL=10.133.0.245:9000
+              YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YANDEX_S3_USE_SSL=false
+              YANDEX_S3_REGION=ru-central
+              YANDEX_S3_VERIFY=false
+              BUCKET_NAME=attachments
+              {{- end -}}

apps/auth-flow/uralkal/helmrelease.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: auth-flow
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/auth-flow/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: frontend

apps/bi/base/backend.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 500m
+                _default: 25m
               memory:
-                _default: 1Gi
+                _default: 128Mi
 
           probes:
             liveness:

apps/bi/brusnika-stage/backend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_37902c73
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_e607dcc6
           pullPolicy:
             _default: IfNotPresent
 
@@ -119,6 +119,10 @@ spec:
             _default: regcred
 
         envs:
+          - name: SUPERSET_HOST
+            value:
+              _default: "https://superset.test.sarex.brusnika.tech"
+
           - name: SETTINGS_DEBUG
             value:
               _default: "0"

apps/bi/brusnika-stage/frontend.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:production_afb137d4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-frontend:contour_9cfd1a0b
           pullPolicy:
             _default: IfNotPresent
 

apps/bi/uralkal/backend.yaml

@@ -0,0 +1,79 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: bi-backend
+  namespace: bi
+spec:
+  values:
+    services:
+      main:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        envs:
+          - name: SETTINGS_DEBUG
+            value:
+              _default: "0"
+
+          - name: SETTINGS_VERIFY_SSL
+            value:
+              _default: "1"
+
+          - name: SETTINGS_API_V1_PREFIX
+            value:
+              _default: "/api/v1"
+
+          - name: AUTH_HOST
+            value:
+              _default: "https://sarex.local.uralkali.com"
+
+          - name: WORKER_TIMEOUT
+            value:
+              _default: "120"
+
+          - name: SUPERSET_HOST
+            value:
+              _default: "https://sarex-bi.sarex.local.uralkali.com/"
+
+          - name: PYTHONPATH
+            value:
+              _default: "src"
+
+          - name: ISSUES_SERVICE_HOST
+            value:
+              _default: "http://backend-svc.issues.svc.cluster.local"
+
+          - name: EAV_SERVICE_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local"
+
+          - name: PM_SERVICE_HOST
+            value:
+              _default: "http://backend-svc.pm.svc.cluster.local:8000"
+
+          - name: SUPERSET_SYSTEM_WIDGETS
+            value:
+              _default: '{"MDR": {"id": "e7343f21-1ee0-4a87-b712-e8cfd413cc49","name": "MDR"},"SC": {"id": "d63d25e4-eab6-452f-8b31-065094bc2cb6","name": "Стройконтроль"}}'
+
+          - name: SUPERSET_DOCUMENTATION_URL
+            value:
+              _default: "https://sarex.local.uralkali.com/documentations/"
+          
+          - name: SUPERSET_JWT_SECRET
+            value:
+              _default: "6TosZjqxxZ3kAPiht4miaGICRV5AbfvuenWnYfOUnxfbYJJXUNWedOS0QeJQaryr"
+
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["kafka-kafka-contour.kafka.svc.cluster.local:9092"]'
+
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-prod"}'
+
+          - name: KAFKA_ENABLE
+            value:
+              _default: "0"

apps/bi/uralkal/frontend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: bi-frontend
+  namespace: bi
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/bi/uralkal/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: bi-backend
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: bi-frontend

apps/bim/brusnika-stage/backend.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a
           pullPolicy:
             _default: IfNotPresent
 

apps/bim/uralkal/backend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: bim
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/bim/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend

apps/cde/base/cde-flowscallback.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 500m
+                _default: 25m
               memory:
-                _default: 1Gi
+                _default: 128Mi
 
           probes:
             liveness:

apps/cde/base/cde-worker-copy.yaml

@@ -71,9 +71,9 @@ spec:
           resources:
             requests:
               cpu:
-                _default: "1"
+                _default: 25m
               memory:
-                _default: 1Gi
+                _default: 228Mi
 
           probes:
             liveness:

apps/cde/base/cde.yaml

@@ -71,7 +71,7 @@ spec:
           resources:
             requests:
               cpu:
-                _default: 500m
+                _default: 250m
               memory:
                 _default: 512Mi
 

apps/cde/brusnika-stage/cde-flowscallback.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-flowscallback
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-flowscallback
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-flowscallback
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-flowscallback
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-flowscallback
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-splitpdf.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-splitpdf
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-splitpdf
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-splitpdf
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-splitpdf
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_4.4.1
+        imagePullPolicy: Always
+        name: cde-worker-splitpdf
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-alert.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-alert
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-alert
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-alert
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-alert
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/orchestrator:latest
+        imagePullPolicy: Always
+        name: cde-worker-alert
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copy.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-copy
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-copy
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-copy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-copy
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-copy
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-copyv2.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-copyv2
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-copyv2
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-copy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-copy
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/copyv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-copy
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-markings.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-markings
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-markings
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-markings
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-markings
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:preprod_eb50f30e
+        imagePullPolicy: Always
+        name: cde-worker-markings
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-sign.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-sign
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-sign
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-sign
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-sign
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-sign
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde-worker-update-bundles.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde-worker-update-bundles
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde-worker-updatebundles
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde-worker-updatebundles
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-updatebundles
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: IS_CONTOUR
+          value: 'True'
+        - name: S3_IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:preprod_0986a572
+        imagePullPolicy: Always
+        name: cde-worker-update-bundles
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/cde.yaml

@@ -0,0 +1,55 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cde
+      app.kubernetes.io/name: cde
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: cde
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/cde:production_e5316bd0
+        imagePullPolicy: Always
+        livenessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          successThreshold: 1
+          tcpSocket:
+            port: 8080
+          timeoutSeconds: 1
+        name: cde
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          successThreshold: 1
+          tcpSocket:
+            port: 8080
+          timeoutSeconds: 1
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/createversionsv2-worke.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: createversionsv2-worke
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-createversions
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-createversions
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-createversions
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'true'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/createversionsv2-worker:preprod_90202b78
+        imagePullPolicy: Always
+        name: createversionsv2-worke
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/kustomization.yaml

@@ -1,6 +1,19 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: contracts
+namespace: orchestrator
 resources:
-  - helmrelease.yaml
+  - serviceaccount.yaml
+  - service.yaml
+  - cde.yaml
+  - cde-flowscallback.yaml
+  - cde-splitpdf.yaml
+  - cde-worker-alert.yaml
+  - cde-worker-copy.yaml
+  - cde-worker-markings.yaml
+  - cde-worker-sign.yaml
+  - cde-worker-update-bundles.yaml
+  - cde-worker-copyv2.yaml
+  - createversionsv2-worke.yaml
+  - markingsv2-worker.yaml
+  - signv2-worker.yaml

apps/cde/brusnika-stage/markingsv2-worker.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: markingsv2-worker
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-markings
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-markings
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-markings
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/markingsv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-markings
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/brusnika-stage/service.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+  ports:
+  - name: http
+    port: 8080
+    protocol: TCP
+    targetPort: 8080

apps/cde/brusnika-stage/serviceaccount.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cde
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: cde
+    app.kubernetes.io/name: cde
+    app.kubernetes.io/version: 0.0.1

apps/cde/brusnika-stage/signv2-worker.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: signv2-worker
+  namespace: orchestrator
+  labels:
+    app.kubernetes.io/instance: name
+    app.kubernetes.io/name: cde-worker-sign
+    app.kubernetes.io/version: 0.0.1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: name
+      app.kubernetes.io/name: cde-worker-sign
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: cde-worker-sign
+        app.kubernetes.io/version: 0.0.1
+        helm.sh/chart: cde-0.1.0
+    spec:
+      serviceAccountName: cde
+      containers:
+      - env:
+        - name: S3_IS_CONTOUR
+          value: 'true'
+        - name: IS_CONTOUR
+          value: 'True'
+        envFrom:
+        - secretRef:
+            name: cde-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/signv2-worker:prod_4.0.2
+        imagePullPolicy: Always
+        name: cde-worker-sign
+        securityContext: {}
+      imagePullSecrets:
+      - name: dockerhub

apps/cde/uralkal/cde-flowscallback.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-flowscallback
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-flowscallback:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-splitpdf.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-splitpdf
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-splitpdf:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-alert.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-alert
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-alert:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-copy.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-copy
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-copy:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-copyv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-copyv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-copyv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-create-versions.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-create-versions
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-create-versions:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-create-versionsv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-create-versionsv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-create-versionsv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-markings.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-markings
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-markings:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-markingsv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-markingsv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-markingsv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-sign.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-sign
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-sign:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-signv2.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-signv2
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-signv2:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde-worker-update-bundles.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde-worker-update-bundles
+  namespace: cde
+spec:
+  values:
+    services:
+      cde-worker-update-bundles:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/cde.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cde
+  namespace: cde
+spec:
+  values:
+    services:
+      cde:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cde/uralkal/kustomization.yaml

@@ -0,0 +1,57 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: cde-flowscallback.yaml
+    target:
+      kind: HelmRelease
+      name: cde-flowscallback
+  - path: cde-splitpdf.yaml
+    target:
+      kind: HelmRelease
+      name: cde-splitpdf
+  - path: cde-worker-alert.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-alert
+  - path: cde-worker-copy.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-copy
+  - path: cde-worker-copyv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-copyv2
+  - path: cde-worker-create-versions.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-create-versions
+  - path: cde-worker-create-versionsv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-create-versionsv2
+  - path: cde-worker-markings.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-markings
+  - path: cde-worker-markingsv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-markingsv2
+  - path: cde-worker-sign.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-sign
+  - path: cde-worker-signv2.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-signv2
+  - path: cde-worker-update-bundles.yaml
+    target:
+      kind: HelmRelease
+      name: cde-worker-update-bundles
+  - path: cde.yaml
+    target:
+      kind: HelmRelease
+      name: cde

apps/checklists/uralkal/helmrelease.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: checklists
+  namespace: checklists
+spec:
+  values:
+    services:
+      checklists:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/checklists/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: checklists

apps/comparisons/base/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend:prod_6dc6e0c2
+            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend:contour_0570a1f1
           pullPolicy:
             _default: IfNotPresent
 

apps/comparisons/uralkal/backend.yaml

@@ -0,0 +1,112 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: comparisons
+spec:
+  values:
+    services:
+      backend:
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-api-v2:contour_9a2bab4e
+
+        deployment:
+          port:
+            _default: 8080
+
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/comparisons-db ] && . /vault/secrets/comparisons-db
+                [ -f /vault/secrets/comparisons-jwt-public ] && export AUTH_PUBLIC_KEY="$(cat /vault/secrets/comparisons-jwt-public)"
+                set +a
+                cd /opt/comparisons
+                ./migrations up
+                exec ./api
+
+          resources:
+            requests:
+              cpu: null
+              memory: null
+
+          probes:
+            liveness:
+              httpGet:
+                port:
+                  _default: 8080
+            readiness:
+              httpGet:
+                port:
+                  _default: 8080
+
+        service:
+          targetPort:
+            _default: 8080
+
+        envs:
+          - name: APP_NAME
+            value:
+              _default: "comparisons-api-v2"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOGGER_LOG_LEVEL
+            value:
+              _default: "info"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "postgres"
+
+          - name: PGSSLMODE
+            value:
+              _default: "disable"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+
+          - name: DOCUMENTATIONS_INTERNAL_HOST
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local"
+
+          - name: DOCUMENTATIONS_EXTERNAL_HOST
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://backend-svc.processing.svc.cluster.local"
+
+          - name: WORKFLOWS_IMAGE_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOWS_DJANGO_HOST
+            value:
+              _default: "https://sarex.local.uralkali.com"
+
+          - name: WORKFLOWS_BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://backend-svc.bim.svc.cluster.local"
+
+          - name: WORKSPACES_HOST
+            value:
+              _default: "http://backend-svc.workspaces.svc.cluster.local"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local"
+
+          - name: ABAP_FIXED_CONC
+            value:
+              _default: "0"
+
+          - name: WORKFLOWS_CONFIG_FILEPATH
+            value:
+              _default: "/etc/app/tasks-execution-config.json"

apps/comparisons/uralkal/frontend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: comparisons
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/comparisons/uralkal/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: tasks-execution-config.yaml
+    target:
+      kind: ConfigMap
+      name: tasks-execution-config-comparisons-v2
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend

apps/comparisons/uralkal/tasks-execution-config.yaml

@@ -0,0 +1,122 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: tasks-execution-config-comparisons-v2
+  namespace: comparisons
+data:
+  tasks-execution-config-comparisons-v2.json: |
+    {
+        "abap": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "bim2bim_comparison": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "bim_api_metadata_inserter_v2": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "bim_api_metadata_inserter_v4": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "bim_abap_updater": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "build_ooc": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "calculate_deviation_job": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "cloud_to_cloud": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "cloud_to_surface": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "convert_to_potree": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "deviation_icp": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "las_to_tiff": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "pdf_cv_comparer": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "pdf_georeferencing": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "split_pdf_document": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        },
+        "webhook_caller": {
+            "executor": "k8s",
+            "resources": {
+                "cpu_requests": "2",
+                "memory_requests": "4Gi"
+            }
+        }
+    }

apps/contracts/uralkal/backend.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: contracts
+  namespace: contracts
+spec:
+  values:
+    services:
+      contracts:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-contracts-db: |-
+              {{- with secret "secrets/data/apps/contracts/postgres" -}}
+              DB_URL=postgresql://{{ index .Data.data "username" }}:{{ index .Data.data "password" }}@{{ index .Data.data "host" }}:{{ index .Data.data "port" }}/{{ index .Data.data "database" }}?sslmode=disable
+              {{- end -}}

apps/contracts/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: contracts

apps/control-interface/base/admin-frontend.yaml

@@ -0,0 +1,94 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: admin-frontend
+  namespace: control-interface
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      admin-frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/admin-frontend:contour_9dc27b40
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: admin-frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: admin-frontend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/control-interface/base/kustomization.yaml

@@ -4,4 +4,5 @@ kind: Kustomization
 namespace: control-interface
 resources:
   - helmrelease.yaml
+  - admin-frontend.yaml
 

apps/control-interface/uralkal/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - namespace.yaml
+  - psql-tools-debug.yaml

apps/control-interface/uralkal/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: control-interface
+  labels:
+    istio-injection: enabled

apps/control-interface/uralkal/psql-tools-debug.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: psql-tools-debug
+  namespace: control-interface
+  labels:
+    app: psql-tools-debug
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: psql-tools-debug
+  template:
+    metadata:
+      labels:
+        app: psql-tools-debug
+    spec:
+      containers:
+        - name: debug
+          image: cr.yandex/crp3ccidau046kdj8g9q/mc-files:dev5
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-c", "while true; do sleep 3600; done"]
+      imagePullSecrets:
+        - name: regcred

apps/cross-section/base/helmrelease.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/cross-section-app:production_e09e648b
+            _default: cr.yandex/crp3ccidau046kdj8g9q/cross-section-app:contour_c5e5d476
           pullPolicy:
             _default: IfNotPresent
 

apps/cross-section/uralkal/helmrelease.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cross-section-static
+  namespace: cross-section
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/cross-section/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: helmrelease.yaml
+    target:
+      kind: HelmRelease
+      name: cross-section-static

apps/django/base/django-configmap.yaml

@@ -87,7 +87,7 @@ data:
         'Bearer',
     )
 
-    HOST = "https://sarex.contour.infra.sarex.tech"
+    HOST = os.environ.get("DJANGO_HOST", "https://sarex.contour.infra.sarex.tech")
 
     POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
     POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')
@@ -305,6 +305,11 @@ data:
             "uri": "/management/projects"
         },
 
+        {
+            "name": "Справочники",
+            "uri": "/assets"
+        },
+
         #  {
         #     "name": "Обзор",
         #     "uri": "/projects"

apps/django/base/frontend.yaml

@@ -29,7 +29,7 @@ spec:
         enabled: true
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.3
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.30.1
           pullPolicy:
             _default: IfNotPresent
         deployment:

apps/django/brusnika-prod/s3-proxy.yaml

@@ -35,7 +35,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_37a48176
+            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
           pullPolicy:
             _default: IfNotPresent
 
@@ -89,7 +89,7 @@ spec:
         envs:
           - name: AWS_API_ENDPOINT
             value:
-              _default: "http://minio-svc.minio.svc.cluster.local:9000"
+              _default: "https://obs.ru-moscow-1.hc.sbercloud.ru"
           - name: APP_PORT
             value:
               _default: "8000"

apps/django/brusnika-stage/celery.yaml

@@ -330,6 +330,14 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/brusnika-stage/export-project.yaml

@@ -88,6 +88,11 @@ spec:
         labels:
           monitoring: prometheus
 
+        envs:
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
         commitSha: ""
         gitlabUri: ""
         gitlabJobUrl: ""

apps/django/brusnika-stage/nginx-configmap.yaml

@@ -101,7 +101,8 @@ data:
 
             location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
                 alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
-                add_header Content-Type application/wasm always;
+                types { }
+                default_type application/wasm;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -110,7 +111,8 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -119,7 +121,8 @@ data:
 
             location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
                 alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -128,7 +131,8 @@ data:
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
                 alias /opt/react_client/static/viewer-pdf/mupdf.js;
-                add_header Content-Type application/javascript always;
+                types { }
+                default_type application/javascript;
                 add_header Cache-Control "public, max-age=31536000, immutable" always;
                 add_header Access-Control-Allow-Origin "*" always;
                 add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@@ -136,7 +140,8 @@ data:
             }
 
             location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                add_header Content-Type application/wasm always;
+                types { }
+                default_type application/wasm;
                 alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
             }
 
@@ -144,7 +149,8 @@ data:
             rewrite /workspaces-v2/(.+) /$1 break;
             proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
 
-            add_header Content-Type application/wasm;
+            proxy_hide_header Content-Type;
+            add_header Content-Type application/wasm always;
             proxy_set_header Accept application/wasm;
         }
 

apps/django/brusnika-stage/sarex-backend.yaml

@@ -313,6 +313,18 @@ spec:
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "True"
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+
         secretEnvs:
           - name: SERVER_SUPERSET_JWT_SECRET
             secretName:

apps/django/d8-ugmk-prod/backend.yaml

@@ -8,6 +8,9 @@ spec:
   values:
     services:
       backend:
+        deployment:
+          replicaCount:
+            _default: 2
         envs:
           - name: ALLOWED_HOSTS
             value:
@@ -18,6 +21,9 @@ spec:
           - name: SERVER_ZITADEL_ENABLED
             value:
               _default: "True"
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.uralmine.com"
           - name: DJANGO_SETTINGS_MODULE
             value:
               _default: config.settings.production

apps/django/uralkal/backend.yaml

@@ -0,0 +1,163 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: django
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.local.uralkali.com"
+
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "0"
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "True"
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: config.settings.production
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: redis
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: redis
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: http://bim-backend-v2-service.bim-api
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+          - name: JWT_KID
+            value:
+              _default: "1"
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+          - name: SERVER_API_HOST
+            value:
+              _default: https://sarex.local.uralkali.com
+          - name: SERVER_HOST
+            value:
+              _default: https://sarex.local.uralkali.com
+          - name: WORKFLOWS_HOST
+            value:
+              _default: http://backend-svc.processing.svc.cluster.local:80
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: http://backend-svc.django.svc.cluster.local:80
+          - name: WORKFLOWS_PREFIX
+            value:
+              _default: /internal/v1
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+          - name: SERVER_SAVE_DIFF_DEM
+            value:
+              _default: "1"
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "1"
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "0"
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: /tmp/chunked_uploads/%Y/%m/%d
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+          - name: ZITADEL_HOST
+            value:
+              _default: https://login.sarex.local.uralkali.com
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "False"
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: /usr/local/share/ca-certificates/kafka.crt
+          - name: KC_USE_REDIRECT_LOGOUT
+            value:
+              _default: "False"
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-django-s3: |-
+              {{- with secret "secrets/data/minio/apps/django" }}
+              AWS_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
+              S3_HOST=http://s3-proxy.s3-proxy.svc.cluster.local
+              {{- $buckets := index .Data.data "buckets" }}
+              S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              S3_LOGIN={{ index .Data.data "access_key" }}
+              S3_PASSWORD={{ index .Data.data "secret_key" }}
+              AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              {{- end }}

apps/django/uralkal/celery.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: django
+spec:
+  values:
+    services:
+      celery:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/django/uralkal/frontend.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: django
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/django/uralkal/kustomization.yaml

@@ -0,0 +1,33 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: nginx-configmap.yaml
+    target:
+      kind: ConfigMap
+      name: nginx-configmap
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: zitadel-configmap.yaml
+    target:
+      kind: ConfigMap
+      name: zitadel-configmap
+  - path: s3-proxy.yaml
+    target:
+      kind: HelmRelease
+      name: s3-proxy
+  - path: celery.yaml
+    target:
+      kind: HelmRelease
+      name: celery
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend
+  - path: srx-admin.yaml
+    target:
+      kind: HelmRelease
+      name: srx-admin-frontend

apps/django/uralkal/nginx-configmap.yaml

@@ -0,0 +1,160 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-configmap
+  namespace: django
+data:
+  nginx.conf: |
+    worker_processes auto;
+
+    pid /var/run/nginx.pid;
+
+    events {
+        use epoll;
+        worker_connections 1024;
+    }
+
+    http {
+
+        # Basic Settings
+        large_client_header_buffers 8 128k;
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        keepalive_timeout 300;
+        types_hash_max_size 2048;
+        client_max_body_size 5000M;
+        client_header_buffer_size 5M;
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+
+        # Logging Settings
+        access_log /var/log/nginx/access.log;
+        error_log /var/log/nginx/error.log;
+
+        # GZIP Settings
+        gzip on;
+        gzip_vary on;
+        gzip_proxied any;
+        gzip_comp_level 6;
+        gzip_buffers 16 8k;
+        gzip_http_version 1.1;
+        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                        '$status $body_bytes_sent "$http_referer" '
+                        '"$http_user_agent" "$http_x_forwarded_for"';
+
+        server {
+            listen 80;
+            listen [::]:80;
+            root /opt/react_client/;
+
+            add_header 'Access-Control-Allow-Origin' '*' always;
+            add_header 'Access-Control-Allow-Methods' '*' always;
+            add_header 'Access-Control-Allow-Headers' '*' always;
+
+            location = /static/index.bundle.js {
+                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+            }
+
+            location ~^/api/pm/ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                proxy_set_header Host $host;
+                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            }
+
+            location ~^/api/v1/documents/ {
+                proxy_http_version 1.1;
+                proxy_set_header Host $host;
+                proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80;
+            }
+
+            location ~^/(api|admin)/ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                proxy_set_header Host $host;
+                proxy_pass http://backend-svc.django.svc.cluster.local:80;
+            }
+
+            location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
+                alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
+                add_header Content-Type application/wasm always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
+                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
+                alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
+                alias /opt/react_client/static/viewer-pdf/mupdf.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
+                add_header Content-Type application/wasm always;
+                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
+            }
+
+             location ~^/workspaces-v2/(.+).js {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                rewrite /workspaces-v2/(.+) /$1 break;
+                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
+            }
+
+            location ~^/workspaces-v2/(.+)\.wasm$ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                rewrite ^/workspaces-v2/(.+) /$1 break;
+                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
+            }
+
+            location @index {
+                add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+                try_files /static/index.html =404;
+            }
+
+            location ~^/workflows/(.+).js {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                rewrite /workflows/(.+) /$1 break;
+                proxy_pass http://frontend-svc.processing.svc.cluster.local:80;
+            }
+
+            location /service-worker.js {
+                try_files /static/$uri @index;
+            }
+
+            location / {
+                try_files $uri @index;
+            }
+        }
+    }

apps/django/uralkal/s3-proxy.yaml

@@ -0,0 +1,31 @@
+---
+# Патч s3-proxy для vad.
+#
+# В base зашит AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech —
+# в закрытом контуре этот хост недоступен, прокси не достучится до MinIO
+# и маршрут /media/ (s3-proxy-virt-service в istio-config) вернёт ошибку.
+#
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# agent-inject-template-s3; остальные vault-аннотации берутся из base.
+# Эндпоинт задан литералом, а не через .Data.data.client.endpoint: так же
+# сделано в apps/django/vad/backend.yaml для того же секрета
+# secrets/data/minio/apps/django — держим один способ на весь ns.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-proxy
+  namespace: django
+spec:
+  values:
+    services:
+      s3-proxy:
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-template-s3: |
+              {{- with secret "secrets/data/minio/apps/django" }}
+              AWS_API_ENDPOINT=http://s3-proxy.s3-proxy.svc.cluster.local
+              {{- $buckets := index .Data.data "buckets" }}
+              AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+              AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              {{- end }}

apps/django/uralkal/srx-admin.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: srx-admin-frontend
+  namespace: django
+spec:
+  values:
+    services:
+      srx-admin:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null

apps/django/uralkal/zitadel-configmap.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: zitadel-configmap
+  namespace: django
+data:
+  config.json: |
+    {
+      "auth_type": "zitadel",
+      "zitadel": {
+        "client_id": "392748840802936023",
+        "host": "https://login.sarex.local.uralkali.com"
+      }
+    }

apps/django/vad/backend.yaml

@@ -9,6 +9,10 @@ spec:
     services:
       backend:
         envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://sarex.vadroad.ru"
+
           - name: ALLOWED_HOSTS
             value:
               _default: "*"
@@ -126,10 +130,6 @@ spec:
           - name: ZITADEL_HOST
             value:
               _default: https://sarex-login.vadroad.ru
-          # Включено вместе с message-hub: он консьюмер топика message-hub-stage
-          # (SETTINGS_TOPICS в apps/message-hub/d8-ugmk-prod/message-hub.yaml),
-          # а писать в этот топик должен django. Vault-шаблон django-kafka
-          # и KAFKA_SSL_CAFILE уже есть в base — здесь только флаг.
           - name: SERVER_KAFKA_ENABLED
             value:
               _default: "True"

apps/django/vad/nginx-configmap.yaml

@@ -60,12 +60,12 @@ data:
                 expires off;
             }
 
-            # location ~^/api/pm/ {
+            location ~^/api/pm/ {
-            #     proxy_http_version 1.1;
+                proxy_http_version 1.1;
-            #     proxy_set_header Connection "";
+                proxy_set_header Connection "";
-            #     proxy_set_header Host $host;
+                proxy_set_header Host $host;
-            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            # }
+            }
 
             location ~^/api/v1/documents/ {
                 proxy_http_version 1.1;
@@ -142,12 +142,12 @@ data:
                 try_files /static/index.html =404;
             }
 
-            # location ~^/workflows/(.+).js {
+            location ~^/workflows/(.+).js {
-            #     proxy_http_version 1.1;
+                proxy_http_version 1.1;
-            #     proxy_set_header Connection "";
+                proxy_set_header Connection "";
-            #     rewrite /workflows/(.+) /$1 break;
+                rewrite /workflows/(.+) /$1 break;
-            #     proxy_pass http://frontend-svc.processing.svc.cluster.local:80;
+                proxy_pass http://frontend-svc.processing.svc.cluster.local:80;
-            # }
+            }
 
             location /service-worker.js {
                 try_files /static/$uri @index;

apps/django/wb/django-configmap.yaml

@@ -248,7 +248,10 @@ data:
             "name": "Рабочие процессы",
             "uri": "/processes"
         },
-
+        {
+          "name": "Справочники",
+          "uri": "/assets"
+        },
         {
           "name": "Аналитика",
           "uri": "/analytics"

apps/document-link/uralkal/frontend.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: document-link
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          resources:
+            requests:
+              cpu: null
+              memory: null
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:vad_60487abb

apps/document-link/uralkal/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: frontend.yaml
+    target:
+      kind: HelmRelease
+      name: frontend

apps/documentations/asterus/pdf-markings-amqp.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_9dea5b64
           pullPolicy:
             _default: IfNotPresent
 

apps/documentations/base/api.yaml

@@ -65,7 +65,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_3f19a21d
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_89c8039a
           pullPolicy:
             _default: IfNotPresent
         service:
@@ -89,6 +89,9 @@ spec:
           - name: POSTGRES_POOL_SIZE
             value:
               _default: "20"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
           - name: USE_LEGACY_BIM_FLOW
             value:
               _default: "true"
@@ -116,6 +119,9 @@ spec:
           - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
             value:
               _default: "5"
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
           - name: ENABLE_SQL_QUERY
             value:
               _default: "0"
@@ -233,6 +239,9 @@ spec:
           - name: VALKEY_PORT
             value:
               _default: "6379"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
         podAnnotations:
           _default:
             traffic.sidecar.istio.io/excludeOutboundPorts: "8200"

apps/documentations/base/filestream.yaml

@@ -64,7 +64,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_179e518c
           pullPolicy:
             _default: IfNotPresent
         service:
@@ -94,6 +94,12 @@ spec:
           - name: ZITADEL_DOMAIN
             value:
               _default: zitadel-srx.wb.ru
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
           - name: USE_ZITADEL
             value:
               _default: "1"
@@ -220,6 +226,9 @@ spec:
           - name: VALKEY_PORT
             value:
               _default: "6379"
+          - name: CDE_API_ENABLED
+            value:
+              _default: "false"
         podAnnotations:
           _default:
             traffic.sidecar.istio.io/excludeOutboundPorts: "8200"

apps/documentations/base/pdf-markings-amqp.yaml

@@ -37,7 +37,7 @@ spec:
           name:
             _default: pdf-markings-amqp
           replicaCount:
-            _default: 1
+            _default: 2
           port:
             _default: 8000
           command:
@@ -64,7 +64,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_9dea5b64
           pullPolicy:
             _default: IfNotPresent
         service:

apps/documentations/base/pdm.yaml

@@ -123,7 +123,7 @@ spec:
               _default: "false"
           - name: DRAWINGS_INTERNAL_URL
             value:
-              _default: http://drawings-api-service.drawings.svc.cluster.local:80
+              _default: http://backend-service.drawings.svc.cluster.local:8000
           - name: ATTACHMENTS_URL
             value:
               _default: http://attachments-service.attachments.svc.cluster.local:8000
@@ -210,7 +210,7 @@ spec:
               _default: http://backend-svc.subscriptions.svc.cluster.local:80
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://api-service.system-log.svc.cluster.local:80
+              _default: http://backend-svc.system-log.svc.cluster.local:80
           - name: TARGET_URL
             value:
               _default: http://backend-svc.django.svc.cluster.local:80

apps/documentations/brusnika-prod/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_b34286a7
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
           pullPolicy:
             _default: IfNotPresent
 
@@ -267,6 +267,15 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/api.yaml

@@ -37,7 +37,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
           pullPolicy:
             _default: IfNotPresent
 
@@ -100,6 +100,10 @@ spec:
         labels:
           monitoring: prometheus
         envs:
+          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
+            value:
+              _default: "true"
+
           - name: POSTGRES_ADDRESS
             value:
               _default: "192.168.2.45"
@@ -255,6 +259,34 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+          - name: USE_LEGACY_BIM_FLOW
+            value:
+              _default: "true"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/filestream.yaml

@@ -255,6 +255,19 @@ spec:
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
               _default: "1"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "0"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
         secretEnvs:
           - name: PUBLIC_KEY
             secretName:

apps/documentations/brusnika-stage/hasher.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hasher
+  namespace: documentations
+  labels:
+    app: hasher
+    service: normal
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: hasher
+  template:
+    metadata:
+      labels:
+        app: hasher
+        service: normal
+    spec:
+      containers:
+      - env:
+        - name: HASHER_APP__LOG_LEVEL
+          value: INFO
+        - name: HASHER_APP__NUM_WORKERS
+          value: '4'
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
+          value: hash.compute.normal.tasks
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
+          value: hash.compute
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
+          value: direct
+        - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
+          value: hash.compute.normal
+        - name: HASHER_S3__MAX_POOL_CONNECTIONS
+          value: '10'
+        - name: HASHER_S3__CONNECT_TIMEOUT
+          value: '10'
+        - name: HASHER_S3__READ_TIMEOUT
+          value: '30'
+        - name: HASHER_S3__REGION_NAME
+          value: ru-central1
+        - name: HASHER_S3__USE_SSL
+          value: 'true'
+        - name: HASHER_S3__VERIFY
+          value: 'true'
+        - name: HASHER_AMQP__USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: user
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__HOST
+          valueFrom:
+            secretKeyRef:
+              key: host
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__PORT
+          valueFrom:
+            secretKeyRef:
+              key: port
+              name: hasher-rabbitmq-secret
+        - name: HASHER_AMQP__VHOST
+          valueFrom:
+            secretKeyRef:
+              key: vhost
+              name: hasher-rabbitmq-secret
+        - name: HASHER_S3__ENDPOINT
+          valueFrom:
+            secretKeyRef:
+              key: endpoint
+              name: hasher-s3-secret
+        - name: HASHER_S3__ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: access_key
+              name: hasher-s3-secret
+        - name: HASHER_S3__SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: secret_key
+              name: hasher-s3-secret
+        image: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
+        imagePullPolicy: IfNotPresent
+        name: normal
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+      imagePullSecrets:
+      - name: regcred

apps/documentations/brusnika-stage/kustomization.yaml

@@ -7,3 +7,5 @@ resources:
   - pdm.yaml
   - api.yaml
   - filestream.yaml
+  - hasher.yaml
+  - pdf-markings-amqp.yaml