++ camunda legacy wait

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/django/d8-ugmk-prod/backend.yaml

@@ -8,6 +8,9 @@ spec:
   values:
     services:
       backend:
+        deployment:
+          replicaCount:
+            _default: 2
         envs:
           - name: ALLOWED_HOSTS
             value:

apps/eav/wb/django-configmap.yaml

@@ -18,7 +18,7 @@ data:
 
     # DEBUG SETTINGS START
     # ---------------------------------------------------------------------------------------------------------------------
-    DEBUG = True
+    DEBUG = False
     ALLOWED_HOSTS = ['*']
     # ---------------------------------------------------------------------------------------------------------------------
     # DEBUG SETTINGS END

apps/flows/d8-ugmk-prod/backend.yaml

@@ -9,6 +9,8 @@ spec:
     services:
       backend:
         deployment:
+          replicaCount:
+            _default: 2
           args:
             _default:
               - |

apps/workspaces/base/frontend.yaml

@@ -29,7 +29,7 @@ spec:
         enabled: true
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_1b5d64e4
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_2da2a00e
           pullPolicy:
             _default: IfNotPresent
         deployment:

apps/workspaces/ugok/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_07373a45
+            _default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_1b5d64e4
           pullPolicy:
             _default: IfNotPresent
 

clusters/stand/00-vault/helm-repositories.yaml

@@ -7,6 +7,8 @@ metadata:
 spec:
   type: oci
   interval: 10m0s
-  url: oci://cr.yandex/crp3ccidau046kdj8g9q/charts
+  url: ${CHART_REPO:=oci://cr.yandex/crp3ccidau046kdj8g9q/charts}
   secretRef:
-    name: yc-cr-auth
+    name: ${CHART_REPO_SECRET:=yc-cr-auth}
+  certSecretRef:
+    name: chart-repo-ca

clusters/stand/00-vault/kustomization.yaml

@@ -1,4 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - ./helm-repositories.yaml
   - ../../../infrastructure/vault/contour-template

clusters/stand/40-routing/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/istio-config/contour-template

clusters/stand/kustomization.yaml

@@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./flux-system
-  - ./helm-repositories.yaml
   - ./layers.yaml

clusters/stand/layers.yaml

@@ -61,7 +61,7 @@ metadata:
   namespace: flux-system
 spec:
   interval: 10m0s
-  timeout: 20m0s
+  timeout: 35m0s
   path: ./clusters/stand/30-platform
   prune: true
   wait: true
@@ -72,3 +72,22 @@ spec:
     substituteFrom:
       - kind: ConfigMap
         name: contour-vars
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: 40-routing
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  timeout: 10m0s
+  path: ./clusters/stand/40-routing
+  prune: true
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: contour-vars

infrastructure/camunda/contour-template/camunda.yaml

@@ -6,7 +6,9 @@ metadata:
 spec:
   dependsOn: []
   interval: 5m
-  timeout: 15m
+  timeout: 30m
+  waitStrategy:
+    name: legacy
   postRenderers:
     - kustomize:
         patches:

infrastructure/istio-config/contour-template/istio-config.yaml

@@ -0,0 +1,117 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: istio-config
+  namespace: default
+spec:
+  dependsOn: []
+  interval: 5m
+  timeout: 10m
+  values:
+    global:
+      env: contour
+    environments:
+      contour:
+        istio:
+          gateways:
+            platform:
+              name: platform-gateway
+              namespace: default
+              selector:
+                istio: ingressgateway
+              servers:
+              - hosts:
+                - ${HOST_LOGIN}
+                - ${HOST_CAMUNDA}
+                - ${HOST_CAMUNDA_IDENTITY}
+                - ${HOST_CAMUNDA_KEYCLOAK}
+                - ${HOST_CAMUNDA_OPTIMIZE}
+                - ${HOST_CAMUNDA_TASKLIST}
+                - ${HOST_RABBITMQ}
+                tls:
+                  credentialName: istio-ingress-tls
+          virtualServices:
+            zitadel:
+              name: zitadel-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_LOGIN}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: zitadel-idp-contour.zitadel.svc.cluster.local
+                port: 8080
+            camunda-operate:
+              name: camunda-operate-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-operate.camunda.svc.cluster.local
+                port: 80
+            camunda-identity:
+              name: camunda-identity-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_IDENTITY}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-identity.camunda.svc.cluster.local
+                port: 80
+            camunda-keycloak:
+              name: camunda-keycloak-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_KEYCLOAK}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-keycloak.camunda.svc.cluster.local
+                port: 80
+            camunda-optimize:
+              name: camunda-optimize-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_OPTIMIZE}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-optimize.camunda.svc.cluster.local
+                port: 80
+            camunda-tasklist:
+              name: camunda-tasklist-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_CAMUNDA_TASKLIST}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: camunda-tasklist.camunda.svc.cluster.local
+                port: 80
+            rabbitmq:
+              name: rabbitmq-virt-service
+              namespace: default
+              hosts:
+              - ${HOST_RABBITMQ}
+              gateways:
+              - default/platform-gateway
+              routes:
+              - path:
+                  prefix: /
+                service: rabbitmq.rabbitmq.svc.cluster.local
+                port: 15672

infrastructure/istio-config/contour-template/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: istio-config.yaml

infrastructure/kafka/contour-template/kafka.yaml

@@ -47,7 +47,7 @@ spec:
       automountServiceAccountToken: true
     listeners:
       client:
-        protocol: SASL_SSL
+        protocol: SASL_PLAINTEXT
         sslClientAuth: "none"
     provisioning:
       enabled: false

infrastructure/zitadel/contour-template/zitadel.yaml

@@ -110,6 +110,17 @@ spec:
       configmapConfig:
         ExternalDomain: ${HOST_LOGIN}
         ExternalSecure: true
+        # IAM_OWNER service user for sarexctl phase zitadel-setup; the chart stores its key
+        # in secret zitadel/sarex-installer. Created only on the first instance setup.
+        FirstInstance:
+          Org:
+            Machine:
+              Machine:
+                Username: sarex-installer
+                Name: sarexctl
+              MachineKey:
+                ExpirationDate: "2099-01-01T00:00:00Z"
+                Type: 1
       debug:
         enabled: false
     postgresqlSecret: