++ camunda legacy wait

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/django/d8-ugmk-prod/backend.yaml

@@ -8,6 +8,9 @@ spec:
   values:
     services:
       backend:
+        deployment:
+          replicaCount:
+            _default: 2
         envs:
           - name: ALLOWED_HOSTS
             value:

apps/eav/wb/django-configmap.yaml

@@ -18,7 +18,7 @@ data:
 
     # DEBUG SETTINGS START
     # ---------------------------------------------------------------------------------------------------------------------
-    DEBUG = True
+    DEBUG = False
     ALLOWED_HOSTS = ['*']
     # ---------------------------------------------------------------------------------------------------------------------
     # DEBUG SETTINGS END

apps/flows/d8-ugmk-prod/backend.yaml

@@ -9,6 +9,8 @@ spec:
     services:
       backend:
         deployment:
+          replicaCount:
+            _default: 2
           args:
             _default:
               - |

apps/workspaces/base/frontend.yaml

@@ -29,7 +29,7 @@ spec:
         enabled: true
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_1b5d64e4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_2da2a00e
           pullPolicy:
             _default: IfNotPresent
         deployment:

apps/workspaces/ugok/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_07373a45
+            _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_1b5d64e4
           pullPolicy:
             _default: IfNotPresent
 

clusters/stand/00-vault/helm-repositories.yaml

@@ -7,6 +7,8 @@ metadata:
 spec:
   type: oci
   interval: 10m0s
-  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
+  url: ${CHART_REPO:=oci://cr.yandex/crp3ccidau046kdj8g9q/charts}
   secretRef:
-    name: yc-cr-auth
+    name: ${CHART_REPO_SECRET:=yc-cr-auth}
+  certSecretRef:
+    name: chart-repo-ca

clusters/stand/00-vault/kustomization.yaml

@@ -1,4 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - ./helm-repositories.yaml
   - ../../../infrastructure/vault/contour-template

clusters/stand/30-platform/kustomization.yaml

@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../../../infrastructure/zitadel/contour-template
+  - ../../../infrastructure/camunda/contour-template

clusters/stand/40-routing/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-config/contour-template

clusters/stand/kustomization.yaml

@@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./flux-system
-  - ./helm-repositories.yaml
   - ./layers.yaml

clusters/stand/layers.yaml

@@ -61,7 +61,7 @@ metadata:
   namespace: flux-system
 spec:
   interval: 10m0s
-  timeout: 20m0s
+  timeout: 35m0s
   path: ./clusters/stand/30-platform
   prune: true
   wait: true
@@ -72,3 +72,22 @@ spec:
     substituteFrom:
       - kind: ConfigMap
         name: contour-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 40-routing
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 10m0s
+  path: ./clusters/stand/40-routing
+  prune: true
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars

infrastructure/camunda/contour-template/camunda.yaml

@@ -0,0 +1,354 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: camunda
+  namespace: camunda
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 30m
+  waitStrategy:
+    name: legacy
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-connectors
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-identity
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-operate
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-optimize
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-tasklist
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: camunda-zeebe-gateway
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+          - target:
+              group: apps
+              version: v1
+              kind: StatefulSet
+              name: camunda-zeebe
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value:
+                  dedicated: processing
+              - op: add
+                path: /spec/template/spec/tolerations
+                value:
+                  - key: dedicated
+                    operator: Equal
+                    value: processing
+                    effect: NoSchedule
+  values:
+    global:
+      vault:
+        enabled: true
+        role: camunda-contour
+        authPath: auth/kubernetes
+        secrets:
+          postgresql:
+            path: secrets/data/camunda/identity-db
+            keys:
+              password: password
+              postgresPassword: password
+      image:
+        pullSecrets:
+          - name: regcred
+      identity:
+        auth:
+          publicIssuerUrl: "https://${HOST_CAMUNDA_KEYCLOAK}/auth/realms/camunda-platform"
+          identity:
+            redirectUrl: "https://${HOST_CAMUNDA_IDENTITY}"
+          operate:
+            redirectUrl: "https://${HOST_CAMUNDA}"
+          tasklist:
+            redirectUrl: "https://${HOST_CAMUNDA_TASKLIST}"
+          optimize:
+            redirectUrl: "https://${HOST_CAMUNDA_OPTIMIZE}"
+    identityPostgresql:
+      enabled: false
+      auth:
+        usePasswordFiles: true
+      primary:
+        automountServiceAccountToken: true
+        persistence:
+          size: 10Gi
+          storageClass: ${STORAGE_CLASS}
+    identityKeycloak:
+      externalDatabase:
+        host: pg-host.storage.svc.cluster.local
+        port: 5432
+        user: bn_keycloak
+        database: bitnami_keycloak
+        password: ""
+        existingSecret: ""
+        existingSecretPasswordKey: password
+      postgresql:
+        enabled: false
+        auth:
+          usePasswordFiles: true
+        primary:
+          automountServiceAccountToken: true
+          persistence:
+            size: 10Gi
+            storageClass: ${STORAGE_CLASS}
+      vaultEnv:
+        enabled: true
+        role: camunda-contour
+        authPath: auth/kubernetes
+        envFiles:
+          KEYCLOAK_ADMIN_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_PASSWORD:
+            path: secrets/data/camunda/keycloak-admin
+            key: admin-password
+          KEYCLOAK_DATABASE_PASSWORD:
+            path: secrets/data/camunda/keycloak-db
+            key: password
+      global:
+        storageClass: ${STORAGE_CLASS}
+      tolerations: []
+    elasticsearch:
+      sysctlImage:
+        registry: cr.yandex
+        repository: crp3ccidau046kdj8g9q/contour/camunda/os-shell
+        tag: 12-debian-12-r32
+        pullSecrets:
+          - regcred
+      master:
+        replicaCount: 1
+        podAntiAffinityPreset: soft
+        persistence:
+          size: 10Gi
+          storageClass: ${STORAGE_CLASS}
+        tolerations: []
+      metrics:
+        enabled: false
+        serviceMonitor:
+          enabled: false
+        prometheusRule:
+          enabled: false
+        tolerations: []
+    camundaCanary:
+      enabled: false
+    prometheusServiceMonitor:
+      enabled: false
+    console:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebe:
+      clusterSize: "1"
+      partitionCount: "1"
+      replicationFactor: "1"
+      pvcStorageClassName: ${STORAGE_CLASS}
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    zeebeGateway:
+      replicas: 1
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    identity:
+      fullURL: "https://${HOST_CAMUNDA_IDENTITY}"
+      externalDatabase:
+        enabled: true
+        host: pg-host.storage.svc.cluster.local
+        port: 5432
+        username: identity
+        database: identity
+        password: ""
+        existingSecret: ""
+        existingSecretPasswordKey: password
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    operate:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    tasklist:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    optimize:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []
+    executionIdentity:
+      image:
+        pullSecrets:
+          - name: regcred
+      tolerations: []
+    webModeler:
+      image:
+        pullSecrets:
+          - name: regcred
+      restapi:
+        tolerations: []
+      webapp:
+        tolerations: []
+      websockets:
+        tolerations: []
+    connectors:
+      image:
+        pullSecrets:
+          - name: regcred
+      serviceAccount:
+        automountServiceAccountToken: true
+      tolerations: []

infrastructure/camunda/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: camunda.yaml

infrastructure/istio-config/contour-template/istio-config.yaml

@@ -0,0 +1,117 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      env: contour
+    environments:
+      contour:
+        istio:
+          gateways:
+            platform:
+              name: platform-gateway
+              namespace: default
+              selector:
+                istio: ingressgateway
+              servers:
+              - hosts:
+                - ${HOST_LOGIN}
+                - ${HOST_CAMUNDA}
+                - ${HOST_CAMUNDA_IDENTITY}
+                - ${HOST_CAMUNDA_KEYCLOAK}
+                - ${HOST_CAMUNDA_OPTIMIZE}
+                - ${HOST_CAMUNDA_TASKLIST}
+                - ${HOST_RABBITMQ}
+                tls:
+                  credentialName: istio-ingress-tls
+          virtualServices:
+            zitadel:
+              name: zitadel-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_LOGIN}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: zitadel-idp-contour.zitadel.svc.cluster.local
+                port: 8080
+            camunda-operate:
+              name: camunda-operate-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-operate.camunda.svc.cluster.local
+                port: 80
+            camunda-identity:
+              name: camunda-identity-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_IDENTITY}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-identity.camunda.svc.cluster.local
+                port: 80
+            camunda-keycloak:
+              name: camunda-keycloak-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_KEYCLOAK}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-keycloak.camunda.svc.cluster.local
+                port: 80
+            camunda-optimize:
+              name: camunda-optimize-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_OPTIMIZE}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-optimize.camunda.svc.cluster.local
+                port: 80
+            camunda-tasklist:
+              name: camunda-tasklist-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_TASKLIST}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-tasklist.camunda.svc.cluster.local
+                port: 80
+            rabbitmq:
+              name: rabbitmq-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_RABBITMQ}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: rabbitmq.rabbitmq.svc.cluster.local
+                port: 15672

infrastructure/istio-config/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-config.yaml

infrastructure/kafka/contour-template/kafka.yaml

@@ -47,7 +47,7 @@ spec:
       automountServiceAccountToken: true
     listeners:
       client:
-        protocol: SASL_SSL
+        protocol: SASL_PLAINTEXT
         sslClientAuth: "none"
     provisioning:
       enabled: false

infrastructure/zitadel/contour-template/zitadel.yaml

@@ -110,6 +110,17 @@ spec:
       configmapConfig:
         ExternalDomain: ${HOST_LOGIN}
         ExternalSecure: true
+        # IAM_OWNER service user for sarexctl phase zitadel-setup; the chart stores its key
+        # in secret zitadel/sarex-installer. Created only on the first instance setup.
+        FirstInstance:
+          Org:
+            Machine:
+              Machine:
+                Username: sarex-installer
+                Name: sarexctl
+              MachineKey:
+                ExpirationDate: "2099-01-01T00:00:00Z"
+                Type: 1
       debug:
         enabled: false
     postgresqlSecret: