apps/premises/base/backend.yaml

@@ -1,313 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: premises
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.9"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      backend:
-        enabled: true
-
-        serviceAccount:
-          enabled:
-            _default: true
-          name:
-            _default: premises-vault
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/premises-backend:production_216148a9
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: premises-backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          command:
-            _default: ["/bin/sh", "-ec"]
-          args:
-            _default:
-              - |
-                set -a
-                [ -f /vault/secrets/premises-db ] && . /vault/secrets/premises-db
-                [ -f /vault/secrets/premises-kafka ] && . /vault/secrets/premises-kafka
-                [ -f /vault/secrets/premises-s3 ] && . /vault/secrets/premises-s3
-                [ -f /vault/secrets/premises-issues-db ] && . /vault/secrets/premises-issues-db
-                [ -f /vault/secrets/premises-inspections-db ] && . /vault/secrets/premises-inspections-db
-                [ -f /vault/secrets/premises-checklists-db ] && . /vault/secrets/premises-checklists-db
-                [ -f /vault/secrets/premises-eav-db ] && . /vault/secrets/premises-eav-db
-                [ -f /vault/secrets/premises-sarex-db ] && . /vault/secrets/premises-sarex-db
-                [ -f /usr/local/share/ca-certificates/kafka.crt ] && export KAFKA_SSL_CERT="$(cat /usr/local/share/ca-certificates/kafka.crt)"
-                set +a
-                exec ./entrypoint.sh
-
-          resources:
-            requests:
-              cpu:
-                _default: "1"
-              memory:
-                _default: 1Gi
-
-          probes:
-            liveness:
-              enabled:
-                _default: true
-              httpGet:
-                path:
-                  _default: /internal/healthz/live/
-              initialDelaySeconds:
-                _default: 10
-              periodSeconds:
-                _default: 60
-            readiness:
-              enabled:
-                _default: true
-              httpGet:
-                path:
-                  _default: /internal/healthz/ready/
-              initialDelaySeconds:
-                _default: 10
-              periodSeconds:
-                _default: 30
-
-        service:
-          enabled: true
-
-          name:
-            _default: backend-svc
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: regcred
-
-        envs:
-          - name: DEBUG
-            value:
-              _default: "false"
-
-          - name: HTTP_ROOT_PATH
-            value:
-              _default: "/premises"
-
-          - name: JWT_AUTH_ENABLE
-            value:
-              _default: "true"
-
-          - name: GUNICORN_WORKERS
-            value:
-              _default: "3"
-
-          - name: FASTSTREAM_WORKERS
-            value:
-              _default: "3"
-
-          - name: DATABASE_POOL_SIZE
-            value:
-              _default: "5"
-
-          - name: KAFKA_EAV_ASSET_TOPIC_NAME
-            value:
-              _default: "assets_broadcast"
-
-          - name: KAFKA_SSL_CERT
-            value:
-              _default: ""
-
-          - name: S3_BUCKET
-            value:
-              _default: "premises"
-
-          - name: EXPORT_TTL_MINUTES
-            value:
-              _default: "30"
-
-          - name: EXPORT_MAX_WORKERS
-            value:
-              _default: "4"
-
-          - name: EXPORT_S3_KEY_PREFIX
-            value:
-              _default: "premise-export"
-
-          - name: ATTACHMENT_MAX_SIZE_BYTES
-            value:
-              _default: "314572800"
-
-          - name: ATTACHMENT_S3_KEY_PREFIX
-            value:
-              _default: "attachment/"
-
-          - name: OTEL_ENABLE
-            value:
-              _default: "false"
-
-          - name: OTEL_URL
-            value:
-              _default: "http://signoz-otel-collector-external.signoz.svc.cluster.local:4317"
-
-          - name: OTEL_SERVICE_NAME
-            value:
-              _default: "premises-backend"
-
-          - name: OTEL_INSECURE
-            value:
-              _default: "true"
-
-          - name: SRX_SDK_IAM_ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://backend-svc.processing.svc.cluster.local:80"
-
-          - name: WORKFLOWS_GENERATION_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/rendering-template:master"
-
-          - name: WORKFLOWS_DOCX_TO_PDF_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/docx-to-pdf:latest"
-
-          - name: WORKFLOWS_CALLBACK_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/webhook-caller:master"
-
-          - name: WORKFLOWS_CALLBACK_HOST
-            value:
-              _default: "http://backend-svc.premises.svc.cluster.local:80"
-
-          - name: WORKFLOWS_RESULT_PATH
-            value:
-              _default: "premises-prod"
-
-        podAnnotations:
-          _default:
-            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-            vault.hashicorp.com/agent-init-first: "true"
-            vault.hashicorp.com/agent-inject: "true"
-            vault.hashicorp.com/agent-pre-populate-only: "true"
-            vault.hashicorp.com/auth-path: auth/kubernetes
-            vault.hashicorp.com/role: premises
-            vault.hashicorp.com/agent-inject-secret-premises-db: secrets/data/apps/premises/postgres
-            vault.hashicorp.com/agent-inject-template-premises-db: |-
-              {{- with secret "secrets/data/apps/premises/postgres" -}}
-              DATABASE_HOST={{ index .Data.data "host" }}
-              DATABASE_PORT={{ index .Data.data "port" }}
-              DATABASE_NAME={{ index .Data.data "database" }}
-              DATABASE_USERNAME={{ index .Data.data "username" }}
-              DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-kafka: secrets/data/kafka/apps/premises
-            vault.hashicorp.com/agent-inject-template-premises-kafka: |-
-              {{- with secret "secrets/data/kafka/apps/premises" -}}
-              KAFKA_HOST={{ if .Data.data.auth }}{{ index .Data.data.auth "bootstrap_servers" }}{{ else }}{{ index .Data.data "bootstrap_servers" }}{{ end }}
-              KAFKA_USERNAME={{ index .Data.data "username" }}
-              KAFKA_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-s3: secrets/data/minio/apps/premises
-            vault.hashicorp.com/agent-inject-template-premises-s3: |-
-              {{- with secret "secrets/data/minio/apps/premises" -}}
-              S3_HOST={{ index .Data.data.client "endpoint" }}
-              S3_ACCESS_KEY={{ index .Data.data "access_key" }}
-              S3_SECRET_KEY={{ index .Data.data "secret_key" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-issues-db: secrets/data/apps/issues/postgres
-            vault.hashicorp.com/agent-inject-template-premises-issues-db: |-
-              {{- with secret "secrets/data/apps/issues/postgres" -}}
-              ISSUES_DATABASE_HOST={{ index .Data.data "host" }}
-              ISSUES_DATABASE_PORT={{ index .Data.data "port" }}
-              ISSUES_DATABASE_NAME={{ index .Data.data "database" }}
-              ISSUES_DATABASE_USERNAME={{ index .Data.data "username" }}
-              ISSUES_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-inspections-db: secrets/data/apps/inspections/postgres
-            vault.hashicorp.com/agent-inject-template-premises-inspections-db: |-
-              {{- with secret "secrets/data/apps/inspections/postgres" -}}
-              INSPECTIONS_DATABASE_HOST={{ index .Data.data "host" }}
-              INSPECTIONS_DATABASE_PORT={{ index .Data.data "port" }}
-              INSPECTIONS_DATABASE_NAME={{ index .Data.data "database" }}
-              INSPECTIONS_DATABASE_USERNAME={{ index .Data.data "username" }}
-              INSPECTIONS_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-checklists-db: secrets/data/apps/checklists/postgres
-            vault.hashicorp.com/agent-inject-template-premises-checklists-db: |-
-              {{- with secret "secrets/data/apps/checklists/postgres" -}}
-              CHECKLISTS_DATABASE_HOST={{ index .Data.data "host" }}
-              CHECKLISTS_DATABASE_PORT={{ index .Data.data "port" }}
-              CHECKLISTS_DATABASE_NAME={{ index .Data.data "database" }}
-              CHECKLISTS_DATABASE_USERNAME={{ index .Data.data "username" }}
-              CHECKLISTS_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-eav-db: secrets/data/apps/eav/postgres
-            vault.hashicorp.com/agent-inject-template-premises-eav-db: |-
-              {{- with secret "secrets/data/apps/eav/postgres" -}}
-              EAV_DATABASE_HOST={{ index .Data.data "host" }}
-              EAV_DATABASE_PORT={{ index .Data.data "port" }}
-              EAV_DATABASE_NAME={{ index .Data.data "database" }}
-              EAV_DATABASE_USERNAME={{ index .Data.data "username" }}
-              EAV_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-premises-sarex-db: secrets/data/apps/django/postgres
-            vault.hashicorp.com/agent-inject-template-premises-sarex-db: |-
-              {{- with secret "secrets/data/apps/django/postgres" -}}
-              SAREX_DATABASE_HOST={{ index .Data.data "host" }}
-              SAREX_DATABASE_PORT={{ index .Data.data "port" }}
-              SAREX_DATABASE_NAME={{ index .Data.data "database" }}
-              SAREX_DATABASE_USERNAME={{ index .Data.data "username" }}
-              SAREX_DATABASE_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/premises/base/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: premises
-resources:
-  - namespace.yaml
-  - backend.yaml

apps/premises/base/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: premises
-  labels:
-    istio-injection: enabled

apps/premises/vad/backend.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: premises
-spec:
-  values:
-    services:
-      backend:
-        deployment:
-          resources:
-            requests:
-              cpu: null
-              memory: null
-        volumes:
-          _default:
-            - name: kafka-ca-cert
-              mountPath:
-                _default: /usr/local/share/ca-certificates/kafka.crt
-              subPath:
-                _default: kafka.crt
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-ca-cert
-                items:
-                  - key: kafka.crt
-                    path:
-                      _default: kafka.crt

apps/premises/vad/kafka-ca-configmap.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-ca-cert
-  namespace: premises
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
-    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
-    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
-    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
-    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
-    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
-    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
-    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
-    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
-    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
-    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
-    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
-    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
-    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
-    0FC16VuidLG0HUCCawFjRiAg9rIA
-    -----END CERTIFICATE-----

apps/premises/vad/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - kafka-ca-configmap.yaml
-patches:
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: backend

apps/workspaces/base/frontend.yaml

@@ -29,7 +29,7 @@ spec:
         enabled: true
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_828f1bfc
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_07373a45
           pullPolicy:
             _default: IfNotPresent
         deployment:

clusters/vad/kustomization.yaml

@@ -52,4 +52,3 @@ resources:
   - ../../apps/pm/vad
   - ../../apps/message-hub/vad
   - ../../apps/cde/vad
-  - ../../apps/premises/vad

infrastructure/istio-config/vad/istio-config.yaml

@@ -335,19 +335,6 @@ spec:
                   rewrite: /api/
                   service: backend-svc.inspections.svc.cluster.local
                   port: 80
-            premises-api:
-              name: premises-api-virt-service
-              namespace: default
-              hosts:
-                - sarex.vadroad.ru
-              gateways:
-                - default/platform-gateway
-              routes:
-                - path:
-                    prefix: /premises/api/
-                  rewrite: /api/
-                  service: backend-svc.premises.svc.cluster.local
-                  port: 80
             reviews-frontend:
               name: reviews-frontend-virt-service
               namespace: default