310 changed files with 716 additions and 30679 deletions
--- a/.DS_Store
+++ b/.DS_Store
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -4,8 +4,6 @@ include:

 stages:
  - build
-  - slices
-  - slices-publish

 variables:
  RELEASE_NAME: iac-offline
@ -35,31 +33,3 @@ build_offline_mirror:
    - docker push ${IMAGE_NAME}
    - docker push ${CR}/${RELEASE_NAME}:latest
  timeout: 30m
-
-generate_slice_jobs:
-  stage: slices
-  image: ${CR}/infra/slice-builder:1.0.0
-  tags:
-    - build
-  rules:
-    - if: $CI_COMMIT_TAG =~ /^v?(?:\d+\.){2}\d+$/
-  variables:
-    GIT_DEPTH: "1"
-  script:
-    - python3 ci/publish-slice.py generate --release "$CI_COMMIT_TAG" --commit "$CI_COMMIT_SHA" --out slices-pipeline.yml
-    - cat slices-pipeline.yml
-  artifacts:
-    paths:
-      - slices-pipeline.yml
-
-publish_contour_slices:
-  stage: slices-publish
-  rules:
-    - if: $CI_COMMIT_TAG =~ /^v?(?:\d+\.){2}\d+$/
-  needs:
-    - generate_slice_jobs
-  trigger:
-    include:
-      - artifact: slices-pipeline.yml
-        job: generate_slice_jobs
-    strategy: depend
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -25,13 +25,11 @@

 | Путь | Что |
 |---|---|
-| `clusters/` | 17 точек входа Flux + шаблон `contour` — **источник истины «что где раскатано»** |
-| `infrastructure/` | 44 платформенных компонента |
-| `apps/` | 39 прикладных сервисов |
-| `docs/apps/` | 34 mermaid-диаграммы по сервисам + `README.md` с доменной группировкой |
-| `docs/architecture/` | модель контура в ArchiMate + скрипты-сканеры (`scan_calls.py`, `scan_contour.py`) и сборка (`build_archimate.py`); реальные значения инсталляций сюда не кладутся, только `*.example.json` |
+| `clusters/` | 10 точек входа Flux — **источник истины «что где раскатано»** |
+| `infrastructure/` | 36 платформенных компонентов |
+| `apps/` | 37 прикладных сервисов |
+| `docs/apps/` | 35 mermaid-диаграмм по сервисам + `README.md` с доменной группировкой |
 | `docs/closed-contour-deployment.md` | ранбук поднятия закрытого контура |
-| `ci/`, `.gitlab-ci.yml`, `Dockerfile` | на тег `vX.Y.Z`: образ офлайн-зеркала `iac-offline` и публикация «слайсов» контуров (см. ниже) |
 | `README.md` | mermaid-мегакарта платформы, структура репозитория, инструкции по добавлению app / infra / кластера |
 | `IAC-CATALOG.md` | каталог всего `infra/*`; §5 — про этот репозиторий |
 | `inventory.yaml` | сгенерированный снимок прода: 59 namespace → kind → имена |
@ -40,18 +38,14 @@

 **Кластер.** `clusters/<cluster>/kustomization.yaml` — плоский список `../../apps/<app>/<cluster>`. Инфраструктура подключается двумя разными способами:

- `d8-ugmk-prod`, `sarex-contour`, `ugok`, `uralkal`, `vad` — прямо в корневом kustomization как `../../infrastructure/<comp>/<c>`;
- `brusnika-prod`, `brusnika-stage`, `vk-infra`, `vk-prod` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на оверлеи `../../../infrastructure/<comp>/<c>` (`base` + патч HelmRelease + сопутствующие манифесты компонента);
- `wb`, `yc-cps-prod`, `yc-infra-prod`, `yc-k8s-test-02` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/<c>/infrastructure/patches/*.yaml`;
- `stand` — послойно: `layers.yaml` объявляет Flux-`Kustomization` `00-vault → 10-mesh → 20-data → 30-platform → 40-routing` (каталоги `clusters/stand/<NN>-<layer>/`). Слои ссылаются на оверлеи `infrastructure/<comp>/contour-template`, а значения контура (`${STORAGE_CLASS}`, `${HOST_*}`, `${GATEWAY_REPLICAS}`) Flux подставляет через `postBuild.substituteFrom` из ConfigMap `contour-vars`.
+- `d8-ugmk-prod` — прямо в корневом kustomization как `../../infrastructure/<comp>/d8-ugmk-prod`;
+- `brusnika-prod`, `brusnika-stage`, `wb` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/<c>/infrastructure/patches/*.yaml`.

-Кластеры с приложениями: `asterus`, `brusnika-prod`, `brusnika-stage`, `d8-ugmk-prod`, `sarex-contour`, `ugok`, `uralkal`, `vad`, `wb`, `yc-ecp`, `yc-k8s-test`. Только инфраструктура: `stand`, `vk-infra`, `vk-prod`, `yc-cps-prod`, `yc-infra-prod`, `yc-k8s-test-02`. Шаблон: `contour`.
+Кластеры: `brusnika-prod`, `brusnika-stage`, `d8-ugmk-prod`, `wb`, `yc-cps-prod`, `yc-ecp`, `yc-infra-prod`, `yc-k8s-test`, `yc-k8s-test-02`, `contour`.

 **Приложение.** `apps/<app>/base/` — по одному `.yaml` на процесс (`backend.yaml`, `celery.yaml`, `frontend.yaml`) плюс `namespace.yaml`; оверлеи в `apps/<app>/<cluster>/`. Namespace = имя приложения. Рядом с манифестами лежит документация: `CONFIGURATION.md` (все env-переменные и откуда берутся), `ENDPOINTS.md` (исходящие HTTP-вызовы), `openapi.yaml` (входящий контракт), `.env.example`. Если процессов несколько — файлы с префиксом процесса: `api.ENDPOINTS.md`, `pdm.CONFIGURATION.md`, `frontend.CONFIGURATION.md`.

-**Инфра-компонент.** `infrastructure/<comp>/base/` + оверлеи `<comp>/<cluster>/`. Корневой `infrastructure/<comp>/kustomization.yaml` всегда указывает просто на `base`. Оверлей `contour-template` (есть у vault, istio-*, cert-manager, postgresql, kafka, rabbitmq, zitadel, camunda, istio-config) — параметризованный `${VAR}`, а не привязанный к конкретному кластеру. Чарты идут с суффиксом контура: `vault-contour`, `keycloak-contour`, `postgresql-contour` и — внимание — `idp-contour` это Zitadel.
-
-**Слайсы.** На тег `vX.Y.Z` `ci/publish-slice.py generate` создаёт child-pipeline с отдельной джобой на каждый `clusters/*/kustomization.yaml`. Джоба вызывает `ci/build-slice.py`: тот обходит дерево Kustomize от `clusters/<c>` и упаковывает только нужные файлы в tar. Результат публикуется как OCI-артефакт `cr.yandex/crpct2b2lsmao4nm0cjk/<c>-iac:<tag>` (media type `application/vnd.sarex.slice.config.v1+json`). Так закрытый контур получает только свой срез. Тесты — `ci/tests/test_build_slice.py`.
+**Инфра-компонент.** `infrastructure/<comp>/base/` + оверлеи `<comp>/<cluster>/`. Корневой `infrastructure/<comp>/kustomization.yaml` всегда указывает просто на `base`. Чарты идут с суффиксом контура: `vault-contour`, `keycloak-contour`, `postgresql-contour` и — внимание — `idp-contour` это Zitadel.

 ## Где искать конкретное

@ -67,23 +61,18 @@
 | Тег образа в контуре | `apps/<app>/<cluster>/*.yaml`, поле `image.tag` |
 | Что реально в проде по namespace | `inventory.yaml` |
 | Где лежит исходный код приложения | `IAC-CATALOG.md` §5.3.8 |
-| Что попадёт в слайс контура | `python3 ci/build-slice.py` по `clusters/<c>` (логика сбора — там же) |
-| Переменные шаблонного контура | `${...}` в `infrastructure/*/contour-template`; значения — ConfigMap `contour-vars` в кластере, не в репозитории |

 ## Ловушки

 - **`dsinv/`** — оверлей есть у 25 приложений, но `clusters/dsinv/` не существует. Это материализованный снимок живого контура WB, а не источник деплоя. Развёрнутым не считать.
- **Две несовместимые конвенции оверлеев** (`IAC-CATALOG.md` §5.3.4). `d8-ugmk-prod`, `yc-k8s-test`, `vad`, `uralkal`, `sarex-contour`, `dsinv` наследуют `base` и патчат его. `brusnika-prod`, `brusnika-stage`, `yc-ecp`, `asterus` — полные копии HelmRelease, которые молча дрейфуют от base. Правка `base` на них не влияет. **`wb` (4 из 27) и `ugok` (9 из 33) смешанные** — проверяйте `resources:` конкретного оверлея; в `ugok` причина обычно указана комментарием в его `kustomization.yaml`.
- **`asterus` подключён почти пустым**: оверлеи есть у 26 приложений, но в `clusters/asterus/kustomization.yaml` активен только `auth-flow`, остальные закомментированы. Инфраструктуры в кластере нет.
- **Слайс публикуется для каждого `clusters/*/kustomization.yaml`** — в том числе для тестовых и инфраструктурных кластеров. Новая папка в `clusters/` с этим файлом автоматически станет слайсом на следующем теге. У `contour` такого файла нет, поэтому для него слайс не собирается.
+- **Две несовместимые конвенции оверлеев** (`IAC-CATALOG.md` §5.3.4). `d8-ugmk-prod`, `yc-k8s-test`, `dsinv` наследуют `base` и патчат его. `brusnika-prod`, `brusnika-stage`, `yc-ecp` — полные копии HelmRelease, которые молча дрейфуют от base. Правка `base` на них не влияет.
 - **`IAC-CATALOG.md` — снимок на 05.08.2026** и по составу приложений на контур уже расходится с реальностью (там у `wb` ноль приложений, фактически 26 оверлеев). Всегда сверяться с `clusters/*/kustomization.yaml`.
 - **Мегадиаграмма в `README.md` идеализирована** — рисована руками, показывает все приложения на одной Postgres и все фронтенды за `control-interface`. Проверяемые источники — env-переменные и istio-config.
 - **`clusters/contour/` — не кластер, а шаблон**: в нём нет `flux-system`, только `apps.yaml`, `infrastructure.yaml`, `helm-repositories.yaml`.
- **Path-роутинг лежит в `infrastructure/istio-config/<c>/` у большинства контуров, но не у WB.** В `clusters/wb/infrastructure/patches/istio-config.yaml` через Istio публикуются только платформенные UI (Gitea, Grafana, OpenObserve, Superset, Vault, GoAlert), а прикладной трафик разводится вне репозитория. В Brusnika схема смешанная: часть путей идёт напрямую в сервисы, остальное — одним правилом в `yet-another-nginx-service.global-ingress`.
- **`vk-prod` маршрутизирует в namespace с суффиксом `-prod`** (`eav-prod`, `pm-prod`, `inspections-prod`), а приложений из `apps/` в этом кластере нет: сервисы раскатываются не этим репозиторием.
- **Имена namespace расходятся между источниками**: `inventory.yaml` и `vk-prod` используют суффикс (`flows-prod`), `apps/` — голое имя (`flows`).
- **66 оверлеев приложений не подключены ни к одному кластеру**: 25 — `dsinv`, 25 — закомментированные в `asterus`, остальные 16 — мёртвый код (в основном `brusnika-prod`, плюс `bi`/`iam` в `wb` и `yc-k8s-test`).
- **Нет диаграмм** в `docs/apps/` для `ams-sync`, `auth-flow`, `bi`, `iam`, `premises`.
+- **Path-роутинг виден в репозитории только у `d8-ugmk-prod` и `yc-ecp`.** В Brusnika и WB весь прикладной трафик уходит одним правилом в `nginx-service.global-ingress` / `yet-another-nginx-service.global-ingress`, а разводка по путям происходит вне репозитория. Через Istio там публикуются только платформенные UI (Gitea, Grafana, OpenObserve, Superset, Vault, Zitadel, Camunda, MinIO).
+- **Имена namespace расходятся между источниками**: `inventory.yaml` использует суффикс (`flows-prod`), `apps/` — голое имя (`flows`).
+- **17 оверлеев приложений не подключены ни к одному кластеру** — мёртвый код.
+- **Нет диаграмм** в `docs/apps/` для `iam`, `auth-flow`, `ams-sync`.
 - **Чистые фронтенды без бэкенда в этом репозитории**: `auth-flow`, `control-interface`, `cross-section`, `document-link`, `prescriptions`, `projects`, `remarks`, `reviews`, `stamp-verification`. Бэкенд `projects` живёт в `planning/projects-backend`.
 - Самые центральные сервисы по числу входящих ссылок: `documentations` (~85), `processing` / `workflow` (~76), `django` (~53), `eav` (~47), `resources` (~44), `bim` (~39), `flows` (~38). Менять их конфигурацию — дороже всего.

--- a/apps/.DS_Store
+++ b/apps/.DS_Store
--- a/apps/attachments/brusnika-stage/backend.yaml
+++ b/apps/attachments/brusnika-stage/backend.yaml
@ -35,7 +35,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
+            _default: cr.yandex/crp3ccidau046kdj8g9q/attachments:production_6dbb4dce
          pullPolicy:
            _default: IfNotPresent

--- a/apps/attachments/uralkal/patch.yaml
+++ b/apps/attachments/uralkal/patch.yaml
@ -24,7 +24,7 @@ spec:
            vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments
            vault.hashicorp.com/agent-inject-template-attachments-s3: |-
              {{- with secret "secrets/data/minio/apps/attachments" -}}
-              YANDEX_S3_ENDPOINT_URL=10.133.0.245:9000
+              YANDEX_S3_ENDPOINT_URL=s3-proxy.s3-proxy.svc.cluster.local
              YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
              YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
              YANDEX_S3_USE_SSL=false
--- a/apps/bi/base/backend.yaml
+++ b/apps/bi/base/backend.yaml
@ -71,9 +71,9 @@ spec:
          resources:
            requests:
              cpu:
-                _default: 25m
+                _default: 500m
              memory:
-                _default: 128Mi
+                _default: 1Gi

          probes:
            liveness:
--- a/apps/bi/brusnika-stage/backend.yaml
+++ b/apps/bi/brusnika-stage/backend.yaml
@ -37,7 +37,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_e607dcc6
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bi-backend:production_37902c73
          pullPolicy:
            _default: IfNotPresent

@ -119,10 +119,6 @@ spec:
            _default: regcred

        envs:
-          - name: SUPERSET_HOST
-            value:
-              _default: "https://superset.test.sarex.brusnika.tech"
-
          - name: SETTINGS_DEBUG
            value:
              _default: "0"
--- a/apps/bim/brusnika-stage/backend.yaml
+++ b/apps/bim/brusnika-stage/backend.yaml
@ -35,7 +35,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:prod_2bde8e0a
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
          pullPolicy:
            _default: IfNotPresent

--- a/apps/cde/brusnika-stage/cde-flowscallback.yaml
+++ b/apps/cde/brusnika-stage/cde-flowscallback.yaml
@ -1,40 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-flowscallback
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-flowscallback
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-flowscallback
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-flowscallback
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/flowscallback-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-flowscallback
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/cde/brusnika-stage/cde-splitpdf.yaml
+++ b/apps/cde/brusnika-stage/cde-splitpdf.yaml
@ -1,40 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-splitpdf
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-splitpdf
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-splitpdf
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-splitpdf
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/splitpdf-worker:prod_4.4.1
-        imagePullPolicy: Always
-        name: cde-worker-splitpdf
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/cde/brusnika-stage/cde-worker-alert.yaml
+++ b/apps/cde/brusnika-stage/cde-worker-alert.yaml
@ -1,35 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-alert
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-alert
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 0
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-alert
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-alert
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/orchestrator:latest
-        imagePullPolicy: Always
-        name: cde-worker-alert
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/cde/brusnika-stage/cde-worker-copy.yaml
+++ b/apps/cde/brusnika-stage/cde-worker-copy.yaml
@ -1,40 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-copy
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-copy
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-copy
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-copy
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/copy-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-copy
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/cde/brusnika-stage/cde-worker-copyv2.yaml
+++ b/apps/cde/brusnika-stage/cde-worker-copyv2.yaml
@ -1,41 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-copyv2
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-copyv2
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-copy
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-copy
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/copyv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-copy
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/cde/brusnika-stage/cde-worker-markings.yaml
+++ b/apps/cde/brusnika-stage/cde-worker-markings.yaml
@ -1,40 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-markings
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-markings
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-markings
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-markings
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/markings-worker:preprod_eb50f30e
-        imagePullPolicy: Always
-        name: cde-worker-markings
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/cde/brusnika-stage/cde-worker-sign.yaml
+++ b/apps/cde/brusnika-stage/cde-worker-sign.yaml
@ -1,40 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-sign
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-sign
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-sign
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-sign
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/sign-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-sign
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/cde/brusnika-stage/cde-worker-update-bundles.yaml
+++ b/apps/cde/brusnika-stage/cde-worker-update-bundles.yaml
@ -1,40 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde-worker-update-bundles
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde-worker-updatebundles
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde-worker-updatebundles
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-updatebundles
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: IS_CONTOUR
-          value: 'True'
-        - name: S3_IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/updatebundles-worker:preprod_0986a572
-        imagePullPolicy: Always
-        name: cde-worker-update-bundles
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/cde/brusnika-stage/cde.yaml
+++ b/apps/cde/brusnika-stage/cde.yaml
@ -1,55 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: cde
-      app.kubernetes.io/name: cde
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: cde
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/cde:production_e5316bd0
-        imagePullPolicy: Always
-        livenessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 15
-          periodSeconds: 10
-          successThreshold: 1
-          tcpSocket:
-            port: 8080
-          timeoutSeconds: 1
-        name: cde
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-        readinessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 15
-          periodSeconds: 10
-          successThreshold: 1
-          tcpSocket:
-            port: 8080
-          timeoutSeconds: 1
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/cde/brusnika-stage/createversionsv2-worke.yaml
+++ b/apps/cde/brusnika-stage/createversionsv2-worke.yaml
@ -1,41 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: createversionsv2-worke
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-createversions
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-createversions
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-createversions
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'true'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/createversionsv2-worker:preprod_90202b78
-        imagePullPolicy: Always
-        name: createversionsv2-worke
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/cde/brusnika-stage/kustomization.yaml
+++ b/apps/cde/brusnika-stage/kustomization.yaml
@ -1,19 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: orchestrator
+namespace: contracts
 resources:
-  - serviceaccount.yaml
-  - service.yaml
-  - cde.yaml
-  - cde-flowscallback.yaml
-  - cde-splitpdf.yaml
-  - cde-worker-alert.yaml
-  - cde-worker-copy.yaml
-  - cde-worker-markings.yaml
-  - cde-worker-sign.yaml
-  - cde-worker-update-bundles.yaml
-  - cde-worker-copyv2.yaml
-  - createversionsv2-worke.yaml
-  - markingsv2-worker.yaml
-  - signv2-worker.yaml
+  - helmrelease.yaml
--- a/apps/cde/brusnika-stage/markingsv2-worker.yaml
+++ b/apps/cde/brusnika-stage/markingsv2-worker.yaml
@ -1,41 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: markingsv2-worker
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-markings
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-markings
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-markings
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/markingsv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-markings
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/cde/brusnika-stage/service.yaml
+++ b/apps/cde/brusnika-stage/service.yaml
@ -1,19 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-  ports:
-  - name: http
-    port: 8080
-    protocol: TCP
-    targetPort: 8080
--- a/apps/cde/brusnika-stage/serviceaccount.yaml
+++ b/apps/cde/brusnika-stage/serviceaccount.yaml
@ -1,10 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cde
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: cde
-    app.kubernetes.io/name: cde
-    app.kubernetes.io/version: 0.0.1
--- a/apps/cde/brusnika-stage/signv2-worker.yaml
+++ b/apps/cde/brusnika-stage/signv2-worker.yaml
@ -1,41 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: signv2-worker
-  namespace: orchestrator
-  labels:
-    app.kubernetes.io/instance: name
-    app.kubernetes.io/name: cde-worker-sign
-    app.kubernetes.io/version: 0.0.1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: name
-      app.kubernetes.io/name: cde-worker-sign
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: name
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: cde-worker-sign
-        app.kubernetes.io/version: 0.0.1
-        helm.sh/chart: cde-0.1.0
-    spec:
-      serviceAccountName: cde
-      containers:
-      - env:
-        - name: S3_IS_CONTOUR
-          value: 'true'
-        - name: IS_CONTOUR
-          value: 'True'
-        envFrom:
-        - secretRef:
-            name: cde-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/signv2-worker:prod_4.0.2
-        imagePullPolicy: Always
-        name: cde-worker-sign
-        securityContext: {}
-      imagePullSecrets:
-      - name: dockerhub
--- a/apps/comparisons/base/frontend.yaml
+++ b/apps/comparisons/base/frontend.yaml
@ -36,7 +36,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend:contour_0570a1f1
+            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend:prod_6dc6e0c2
          pullPolicy:
            _default: IfNotPresent

--- a/apps/comparisons/uralkal/backend.yaml
+++ b/apps/comparisons/uralkal/backend.yaml
@ -8,105 +8,8 @@ spec:
  values:
    services:
      backend:
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-api-v2:contour_9a2bab4e
-
        deployment:
-          port:
-            _default: 8080
-
-          args:
-            _default:
-              - |
-                set -a
-                [ -f /vault/secrets/comparisons-db ] && . /vault/secrets/comparisons-db
-                [ -f /vault/secrets/comparisons-jwt-public ] && export AUTH_PUBLIC_KEY="$(cat /vault/secrets/comparisons-jwt-public)"
-                set +a
-                cd /opt/comparisons
-                ./migrations up
-                exec ./api
-
          resources:
            requests:
              cpu: null
              memory: null
-
-          probes:
-            liveness:
-              httpGet:
-                port:
-                  _default: 8080
-            readiness:
-              httpGet:
-                port:
-                  _default: 8080
-
-        service:
-          targetPort:
-            _default: 8080
-
-        envs:
-          - name: APP_NAME
-            value:
-              _default: "comparisons-api-v2"
-
-          - name: APP_VERSION
-            value:
-              _default: "0.0.1"
-
-          - name: LOGGER_LOG_LEVEL
-            value:
-              _default: "info"
-
-          - name: DATABASE_NAME
-            value:
-              _default: "postgres"
-
-          - name: PGSSLMODE
-            value:
-              _default: "disable"
-
-          - name: HTTP_PORT
-            value:
-              _default: "8080"
-
-          - name: DOCUMENTATIONS_INTERNAL_HOST
-            value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local"
-
-          - name: DOCUMENTATIONS_EXTERNAL_HOST
-            value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://backend-svc.processing.svc.cluster.local"
-
-          - name: WORKFLOWS_IMAGE_VERSION
-            value:
-              _default: "master"
-
-          - name: WORKFLOWS_DJANGO_HOST
-            value:
-              _default: "https://sarex.local.uralkali.com"
-
-          - name: WORKFLOWS_BIMV2_INTERNAL_HOST
-            value:
-              _default: "http://backend-svc.bim.svc.cluster.local"
-
-          - name: WORKSPACES_HOST
-            value:
-              _default: "http://backend-svc.workspaces.svc.cluster.local"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://backend-svc.eav.svc.cluster.local"
-
-          - name: ABAP_FIXED_CONC
-            value:
-              _default: "0"
-
-          - name: WORKFLOWS_CONFIG_FILEPATH
-            value:
-              _default: "/etc/app/tasks-execution-config.json"
--- a/apps/comparisons/uralkal/kustomization.yaml
+++ b/apps/comparisons/uralkal/kustomization.yaml
@ -3,10 +3,6 @@ kind: Kustomization
 resources:
  - ../base
 patches:
-  - path: tasks-execution-config.yaml
-    target:
-      kind: ConfigMap
-      name: tasks-execution-config-comparisons-v2
  - path: backend.yaml
    target:
      kind: HelmRelease
--- a/apps/comparisons/uralkal/tasks-execution-config.yaml
+++ b/apps/comparisons/uralkal/tasks-execution-config.yaml
@ -1,122 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: tasks-execution-config-comparisons-v2
-  namespace: comparisons
-data:
-  tasks-execution-config-comparisons-v2.json: |
-    {
-        "abap": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "bim2bim_comparison": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "bim_api_metadata_inserter_v2": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "bim_api_metadata_inserter_v4": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "bim_abap_updater": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "build_ooc": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "calculate_deviation_job": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "cloud_to_cloud": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "cloud_to_surface": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "convert_to_potree": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "deviation_icp": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "las_to_tiff": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "pdf_cv_comparer": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "pdf_georeferencing": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "split_pdf_document": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        },
-        "webhook_caller": {
-            "executor": "k8s",
-            "resources": {
-                "cpu_requests": "2",
-                "memory_requests": "4Gi"
-            }
-        }
-    }
--- a/apps/control-interface/uralkal/kustomization.yaml
+++ b/apps/control-interface/uralkal/kustomization.yaml
@ -3,4 +3,3 @@ kind: Kustomization
 resources:
  - ../base
  - namespace.yaml
-  - psql-tools-debug.yaml
--- a/apps/control-interface/uralkal/psql-tools-debug.yaml
+++ b/apps/control-interface/uralkal/psql-tools-debug.yaml
@ -1,25 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: psql-tools-debug
-  namespace: control-interface
-  labels:
-    app: psql-tools-debug
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: psql-tools-debug
-  template:
-    metadata:
-      labels:
-        app: psql-tools-debug
-    spec:
-      containers:
-        - name: debug
-          image: cr.yandex/crp3ccidau046kdj8g9q/mc-files:dev5
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-c", "while true; do sleep 3600; done"]
-      imagePullSecrets:
-        - name: regcred
--- a/apps/cross-section/base/helmrelease.yaml
+++ b/apps/cross-section/base/helmrelease.yaml
@ -37,7 +37,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/cross-section-app:contour_c5e5d476
+            _default: cr.yandex/crp3ccidau046kdj8g9q/cross-section-app:production_e09e648b
          pullPolicy:
            _default: IfNotPresent

--- a/apps/django/base/django-configmap.yaml
+++ b/apps/django/base/django-configmap.yaml
@ -87,7 +87,7 @@ data:
        'Bearer',
    )

-    HOST = os.environ.get("DJANGO_HOST", "https://sarex.contour.infra.sarex.tech")
+    HOST = "https://sarex.contour.infra.sarex.tech"

    POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
    POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')
@ -305,11 +305,6 @@ data:
            "uri": "/management/projects"
        },

-        {
-            "name": "Справочники",
-            "uri": "/assets"
-        },
-
        #  {
        #     "name": "Обзор",
        #     "uri": "/projects"
--- a/apps/django/base/frontend.yaml
+++ b/apps/django/base/frontend.yaml
@ -29,7 +29,7 @@ spec:
        enabled: true
        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.30.1
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.3
          pullPolicy:
            _default: IfNotPresent
        deployment:
--- a/apps/django/brusnika-prod/s3-proxy.yaml
+++ b/apps/django/brusnika-prod/s3-proxy.yaml
@ -35,7 +35,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
+            _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_37a48176
          pullPolicy:
            _default: IfNotPresent

@ -89,7 +89,7 @@ spec:
        envs:
          - name: AWS_API_ENDPOINT
            value:
-              _default: "https://obs.ru-moscow-1.hc.sbercloud.ru"
+              _default: "http://minio-svc.minio.svc.cluster.local:9000"
          - name: APP_PORT
            value:
              _default: "8000"
--- a/apps/django/brusnika-stage/nginx-configmap.yaml
+++ b/apps/django/brusnika-stage/nginx-configmap.yaml
@ -101,8 +101,7 @@ data:

            location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
                alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
-                types { }
-                default_type application/wasm;
+                add_header Content-Type application/wasm always;
                add_header Cache-Control "public, max-age=31536000, immutable" always;
                add_header Access-Control-Allow-Origin "*" always;
                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@ -111,8 +110,7 @@ data:

            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
-                types { }
-                default_type application/javascript;
+                add_header Content-Type application/javascript always;
                add_header Cache-Control "public, max-age=31536000, immutable" always;
                add_header Access-Control-Allow-Origin "*" always;
                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@ -121,8 +119,7 @@ data:

            location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
                alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
-                types { }
-                default_type application/javascript;
+                add_header Content-Type application/javascript always;
                add_header Cache-Control "public, max-age=31536000, immutable" always;
                add_header Access-Control-Allow-Origin "*" always;
                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@ -131,8 +128,7 @@ data:

            location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
                alias /opt/react_client/static/viewer-pdf/mupdf.js;
-                types { }
-                default_type application/javascript;
+                add_header Content-Type application/javascript always;
                add_header Cache-Control "public, max-age=31536000, immutable" always;
                add_header Access-Control-Allow-Origin "*" always;
                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
@ -140,8 +136,7 @@ data:
            }

            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                types { }
-                default_type application/wasm;
+                add_header Content-Type application/wasm always;
                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
            }

@ -149,8 +144,7 @@ data:
            rewrite /workspaces-v2/(.+) /$1 break;
            proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;

-            proxy_hide_header Content-Type;
-            add_header Content-Type application/wasm always;
+            add_header Content-Type application/wasm;
            proxy_set_header Accept application/wasm;
        }

--- a/apps/django/d8-ugmk-prod/backend.yaml
+++ b/apps/django/d8-ugmk-prod/backend.yaml
@ -8,9 +8,6 @@ spec:
  values:
    services:
      backend:
-        deployment:
-          replicaCount:
-            _default: 2
        envs:
          - name: ALLOWED_HOSTS
            value:
@ -21,9 +18,6 @@ spec:
          - name: SERVER_ZITADEL_ENABLED
            value:
              _default: "True"
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.uralmine.com"
          - name: DJANGO_SETTINGS_MODULE
            value:
              _default: config.settings.production
--- a/apps/django/ugok/django-configmap.yaml
+++ b/apps/django/ugok/django-configmap.yaml
--- a/apps/django/uralkal/backend.yaml
+++ b/apps/django/uralkal/backend.yaml
@ -14,10 +14,6 @@ spec:
              cpu: null
              memory: null
        envs:
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.local.uralkali.com"
-
          - name: ALLOWED_HOSTS
            value:
              _default: "*"
--- a/apps/django/uralkal/nginx-configmap.yaml
+++ b/apps/django/uralkal/nginx-configmap.yaml
@ -60,12 +60,12 @@ data:
                expires off;
            }

-            location ~^/api/pm/ {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                proxy_set_header Host $host;
-                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
-            }
+            # location ~^/api/pm/ {
+            #     proxy_http_version 1.1;
+            #     proxy_set_header Connection "";
+            #     proxy_set_header Host $host;
+            #     proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+            # }

            location ~^/api/v1/documents/ {
                proxy_http_version 1.1;
--- a/apps/django/vad/backend.yaml
+++ b/apps/django/vad/backend.yaml
@ -9,10 +9,6 @@ spec:
    services:
      backend:
        envs:
-          - name: DJANGO_HOST
-            value:
-              _default: "https://sarex.vadroad.ru"
-
          - name: ALLOWED_HOSTS
            value:
              _default: "*"
--- a/apps/documentations/asterus/pdf-markings-amqp.yaml
+++ b/apps/documentations/asterus/pdf-markings-amqp.yaml
@ -36,7 +36,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_9dea5b64
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
          pullPolicy:
            _default: IfNotPresent

--- a/apps/documentations/base/api.yaml
+++ b/apps/documentations/base/api.yaml
@ -65,7 +65,7 @@ spec:
              enabled: false
        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_89c8039a
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
          pullPolicy:
            _default: IfNotPresent
        service:
@ -89,9 +89,6 @@ spec:
          - name: POSTGRES_POOL_SIZE
            value:
              _default: "20"
-          - name: CDE_API_ENABLED
-            value:
-              _default: "false"
          - name: USE_LEGACY_BIM_FLOW
            value:
              _default: "true"
@ -239,9 +236,6 @@ spec:
          - name: VALKEY_PORT
            value:
              _default: "6379"
-          - name: CDE_API_ENABLED
-            value:
-              _default: "false"
        podAnnotations:
          _default:
            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
--- a/apps/documentations/base/filestream.yaml
+++ b/apps/documentations/base/filestream.yaml
@ -97,9 +97,6 @@ spec:
          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
            value:
              _default: "true"
-          - name: CDE_API_ENABLED
-            value:
-              _default: "false"
          - name: USE_ZITADEL
            value:
              _default: "1"
@ -226,9 +223,6 @@ spec:
          - name: VALKEY_PORT
            value:
              _default: "6379"
-          - name: CDE_API_ENABLED
-            value:
-              _default: "false"
        podAnnotations:
          _default:
            traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
--- a/apps/documentations/base/pdf-markings-amqp.yaml
+++ b/apps/documentations/base/pdf-markings-amqp.yaml
@ -37,7 +37,7 @@ spec:
          name:
            _default: pdf-markings-amqp
          replicaCount:
-            _default: 2
+            _default: 1
          port:
            _default: 8000
          command:
@ -64,7 +64,7 @@ spec:
              enabled: false
        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_9dea5b64
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
          pullPolicy:
            _default: IfNotPresent
        service:
--- a/apps/documentations/base/pdm.yaml
+++ b/apps/documentations/base/pdm.yaml
@ -123,7 +123,7 @@ spec:
              _default: "false"
          - name: DRAWINGS_INTERNAL_URL
            value:
-              _default: http://backend-service.drawings.svc.cluster.local:8000
+              _default: http://drawings-api-service.drawings.svc.cluster.local:80
          - name: ATTACHMENTS_URL
            value:
              _default: http://attachments-service.attachments.svc.cluster.local:8000
@ -210,7 +210,7 @@ spec:
              _default: http://backend-svc.subscriptions.svc.cluster.local:80
          - name: SYSTEM_LOG_URL
            value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
+              _default: http://api-service.system-log.svc.cluster.local:80
          - name: TARGET_URL
            value:
              _default: http://backend-svc.django.svc.cluster.local:80
--- a/apps/documentations/brusnika-stage/api.yaml
+++ b/apps/documentations/brusnika-stage/api.yaml
@ -37,7 +37,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
          pullPolicy:
            _default: IfNotPresent

@ -100,10 +100,6 @@ spec:
        labels:
          monitoring: prometheus
        envs:
-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
-
          - name: POSTGRES_ADDRESS
            value:
              _default: "192.168.2.45"
--- a/apps/documentations/brusnika-stage/hasher.yaml
+++ b/apps/documentations/brusnika-stage/hasher.yaml
@ -1,95 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hasher
-  namespace: documentations
-  labels:
-    app: hasher
-    service: normal
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hasher
-  template:
-    metadata:
-      labels:
-        app: hasher
-        service: normal
-    spec:
-      containers:
-      - env:
-        - name: HASHER_APP__LOG_LEVEL
-          value: INFO
-        - name: HASHER_APP__NUM_WORKERS
-          value: '4'
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
-          value: hash.compute.normal.tasks
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
-          value: hash.compute
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
-          value: direct
-        - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
-          value: hash.compute.normal
-        - name: HASHER_S3__MAX_POOL_CONNECTIONS
-          value: '10'
-        - name: HASHER_S3__CONNECT_TIMEOUT
-          value: '10'
-        - name: HASHER_S3__READ_TIMEOUT
-          value: '30'
-        - name: HASHER_S3__REGION_NAME
-          value: ru-central1
-        - name: HASHER_S3__USE_SSL
-          value: 'true'
-        - name: HASHER_S3__VERIFY
-          value: 'true'
-        - name: HASHER_AMQP__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: user
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__PORT
-          valueFrom:
-            secretKeyRef:
-              key: port
-              name: hasher-rabbitmq-secret
-        - name: HASHER_AMQP__VHOST
-          valueFrom:
-            secretKeyRef:
-              key: vhost
-              name: hasher-rabbitmq-secret
-        - name: HASHER_S3__ENDPOINT
-          valueFrom:
-            secretKeyRef:
-              key: endpoint
-              name: hasher-s3-secret
-        - name: HASHER_S3__ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              key: access_key
-              name: hasher-s3-secret
-        - name: HASHER_S3__SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              key: secret_key
-              name: hasher-s3-secret
-        image: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
-        imagePullPolicy: IfNotPresent
-        name: normal
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-      imagePullSecrets:
-      - name: regcred
--- a/apps/documentations/brusnika-stage/kustomization.yaml
+++ b/apps/documentations/brusnika-stage/kustomization.yaml
@ -7,5 +7,3 @@ resources:
  - pdm.yaml
  - api.yaml
  - filestream.yaml
-  - hasher.yaml
-  - pdf-markings-amqp.yaml
--- a/apps/documentations/brusnika-stage/pdf-markings-amqp.yaml
+++ b/apps/documentations/brusnika-stage/pdf-markings-amqp.yaml
@ -1,125 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pdf-markings-amqp
-  namespace: documentations
-  labels:
-    app: pdf-markings-amqp
-    service: api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pdf-markings-amqp
-  strategy:
-    rollingUpdate:
-      maxSurge: 3
-      maxUnavailable: 3
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: pdf-markings-amqp
-        service: api
-    spec:
-      containers:
-      - env:
-        - name: MARKS_APP__LOG_LEVEL
-          value: INFO
-        - name: MARKS_CRYPTO__HASHING_ALGO
-          value: md_gost12_256
-        - name: MARKS_DOCUMENTS_DB__HOST
-          value: 192.168.2.45
-        - name: MARKS_DOCUMENTS_DB__PORT
-          value: '5432'
-        - name: MARKS_DOCUMENTS_DB__DATABASE
-          value: documentations
-        - name: MARKS_DOCUMENTS_DB__SSLMODE
-          value: disable
-        - name: MARKS_QR__REDIRECT_URL
-          value: https://stamp-verification.test.sarex.brusnika.tech/
-        - name: MARKS_QR__BASE_DOCUMENT_URL
-          value: https://test.sarex.brusnika.tech
-        - name: MARKS_S3__USE_SSL
-          value: 'false'
-        - name: MARKS_S3__SSL_VERIFY
-          value: 'false'
-        - name: MARKS_S3__REGION
-          value: ru-central1
-        - name: MARKS_S3__DEFAULT_BUCKET
-          value: documentations-stage-1-sarex-new
-        - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
-          value: pdf_markings_input
-        - name: MARKS_DOCUMENTS_DB__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: postgres-secret
-        - name: MARKS_DOCUMENTS_DB__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: postgres-secret
-        - name: MARKS_S3__URL
-          valueFrom:
-            secretKeyRef:
-              key: endpoint_url
-              name: yc-s3
-        - name: MARKS_S3__ACCESS_KEY
-          valueFrom:
-            secretKeyRef:
-              key: key_id
-              name: yc-s3
-        - name: MARKS_S3__SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              key: access_key
-              name: yc-s3
-        - name: MARKS_RABBITMQ__HOST
-          valueFrom:
-            secretKeyRef:
-              key: host
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__PORT
-          valueFrom:
-            secretKeyRef:
-              key: port
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__USERNAME
-          valueFrom:
-            secretKeyRef:
-              key: username
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__VHOST
-          valueFrom:
-            secretKeyRef:
-              key: vhost
-              name: rabbitmq
-        - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
-          valueFrom:
-            secretKeyRef:
-              key: heartbeat
-              name: rabbitmq
-        image: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
-        imagePullPolicy: IfNotPresent
-        name: api
-        ports:
-        - containerPort: 8000
-          name: http
-          protocol: TCP
-        volumeMounts:
-        - mountPath: /etc/sarex/yc-s3-storage
-          name: yc-s3
-          readOnly: true
-      volumes:
-      - name: yc-s3
-        secret:
-          secretName: yc-s3
-      imagePullSecrets:
-      - name: regcred
--- a/apps/documentations/brusnika-stage/pdm.yaml
+++ b/apps/documentations/brusnika-stage/pdm.yaml
@ -124,11 +124,11 @@ spec:

          - name: TRANSMITTALS_BASE_URL
            value:
-              _default: "http://transmittal-service.transmittal.svc.cluster.local:80"
+              _default: ""

          - name: TRANSMITTALS_ENABLE
            value:
-              _default: "true"
+              _default: "false"

          - name: DRAWINGS_INTERNAL_URL
            value:
--- a/apps/documentations/d8-ugmk-prod/api.yaml
+++ b/apps/documentations/d8-ugmk-prod/api.yaml
@ -156,6 +156,3 @@ spec:
          - name: VALKEY_PORT
            value:
              _default: "6379"
-          - name: CDE_API_ENABLED
-            value:
-              _default: "false"
--- a/apps/documentations/d8-ugmk-prod/filestream.yaml
+++ b/apps/documentations/d8-ugmk-prod/filestream.yaml
@ -83,7 +83,7 @@ spec:
              _default: v1
          - name: SYSTEM_LOG_URL
            value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
+              _default: http://api-service.system-log.svc.cluster.local:80
          - name: DJANGO_HOST
            value:
              _default: http://backend-svc.django.svc.cluster.local:80
@ -144,6 +144,3 @@ spec:
          - name: VALKEY_PORT
            value:
              _default: "6379"
-          - name: CDE_API_ENABLED
-            value:
-              _default: "false"
--- a/apps/documentations/d8-ugmk-prod/kustomization.yaml
+++ b/apps/documentations/d8-ugmk-prod/kustomization.yaml
@ -12,8 +12,4 @@ patches:
  - path: filestream.yaml
    target:
      kind: HelmRelease
-      name: documentations-filestream
-  - path: pdf-markings-amqp.yaml
-    target:
-      kind: HelmRelease
-      name: documentations-pdf-markings-amqp
+      name: documentations-filestream
--- a/apps/documentations/d8-ugmk-prod/pdf-markings-amqp.yaml
+++ b/apps/documentations/d8-ugmk-prod/pdf-markings-amqp.yaml
@ -1,62 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: documentations-pdf-markings-amqp
-  namespace: documentations
-spec:
-  values:
-    services:
-      backend:
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings:contour_ce9ed6d7
-
-        envs:
-          - name: MARKS_APP__LOG_LEVEL
-            value:
-              _default: INFO
-
-          - name: MARKS_CRYPTO__HASHING_ALGO
-            value:
-              _default: md_gost12_256
-
-          - name: MARKS_QR__REDIRECT_URL
-            value:
-              _default: "https://sarex-stamp-verification.uralmine.com/"
-
-          - name: MARKS_QR__BASE_DOCUMENT_URL
-            value:
-              _default: "https://sarex.uralmine.com"
-
-          - name: MARKS_S3__REGION
-            value:
-              _default: ru-central1
-
-          - name: MARKS_S3__USE_SSL
-            value:
-              _default: "true"
-
-          - name: MARKS_S3__SSL_VERIFY
-            value:
-              _default: "false"
-
-          - name: MARKS_S3__DEFAULT_BUCKET
-            value:
-              _default: documentations-marks
-
-          - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
-            value:
-              _default: pdf_markings_input
-
-          - name: MARKS_RABBITMQ__HOST
-            value:
-              _default: rabbitmq.rabbitmq.svc.cluster.local
-
-          - name: MARKS_RABBITMQ__PORT
-            value:
-              _default: "5672"
-
-          - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
-            value:
-              _default: "60"
--- a/apps/documentations/uralkal/api.yaml
+++ b/apps/documentations/uralkal/api.yaml
@ -13,9 +13,6 @@ spec:
            requests:
              cpu: null
              memory: null
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api:contour_8631bb0e
        envs:
          - name: POSTGRES_POOL_SIZE
            value:
@ -26,12 +23,9 @@ spec:
          - name: ZITADEL_DOMAIN
            value:
              _default: login.sarex.local.uralkali.com
-          - name: ZITADEL_INSECURE_SKIP_VERIFY
-            value:
-              _default: "true"
          - name: USE_ZITADEL
            value:
-              _default: "1"
+              _default: "0"
          - name: FLOWS_URL
            value:
              _default: http://backend-svc.flows.svc.cluster.local:80
--- a/apps/documentations/uralkal/filestream.yaml
+++ b/apps/documentations/uralkal/filestream.yaml
@ -13,16 +13,10 @@ spec:
            requests:
              cpu: null
              memory: null
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:contour_8631bb0e
        envs:
          - name: POSTGRES_POOL_SIZE
            value:
              _default: "20"
-          - name: ZITADEL_INSECURE_SKIP_VERIFY
-            value:
-              _default: "true"
          - name: ZITADEL_ACCOUNT
            value:
              _default: /vault/secrets/documentations-zitadel-account-json
@ -31,7 +25,7 @@ spec:
              _default: login.sarex.local.uralkali.com
          - name: USE_ZITADEL
            value:
-              _default: "1"
+              _default: "0"
          - name: FLOWS_URL
            value:
              _default: http://backend-svc.flows.svc.cluster.local:80
--- a/apps/documentations/wb/api.yaml
+++ b/apps/documentations/wb/api.yaml
@ -36,7 +36,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_0be18f51
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
          pullPolicy:
            _default: IfNotPresent

@ -134,10 +134,6 @@ spec:
          - name: POSTGRES_POOL_SIZE
            value:
              _default: "20"
-          
-          - name: CDE_API_ENABLED
-            value:
-              _default: "false"

          - name: ZITADEL_ACCOUNT
            value:
@ -219,13 +215,9 @@ spec:
            value:
              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"

-          # Сервиса bim-api-service в контуре wb нет: в ns bim есть только
-          # backend-service:8000 (bim v2), на него же BIM_API_URL смотрит в
-          # brusnika-stage и asterus. Клиент bim-api (resty, retry 5 x 1s)
-          # на неразрешимом DNS отваливался ровно за ~5 с.
          - name: BIM_API_URL
            value:
-              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"

          - name: BIM_API_V2_URL
            value:
@ -315,23 +307,6 @@ spec:
            value:
              _default: "6379"

-          - name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
-            value:
-              _default: "true"
-
-          - name: USE_MARKS_RABBITMQ
-            value:
-              _default: '1'
-          - name: MARKS_RABBITMQ_HOST
-            value: 
-              _default: rabbitmq.rabbitmq.svc.cluster.local
-          - name: MARKS_RABBITMQ_PORT
-            value: 
-              _default: '5672'
-          - name: MARKS_RABBITMQ_API
-            value: 
-              _default: cde
-
        secretEnvs:
          - name: PUBLIC_KEY
            secretName:
@ -363,16 +338,6 @@ spec:
              _default: "django-auth"
            secretKey: "key"

-          - name: MARKS_RABBITMQ_USER
-            secretName:
-              _default: "hasher-rabbitmq-secret"
-            secretKey: "user"
-
-          - name: MARKS_RABBITMQ_PASSWORD
-            secretName:
-              _default: "hasher-rabbitmq-secret"
-            secretKey: "password"
-
        commitSha: ""
        gitlabUri: ""
        gitlabJobUrl: ""
--- a/apps/documentations/wb/filestream.yaml
+++ b/apps/documentations/wb/filestream.yaml
@ -36,7 +36,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_fef3add2
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_3f19a21d
          pullPolicy:
            _default: IfNotPresent

@ -56,16 +56,13 @@ spec:
            limits:
              cpu:
                _default: 639m
-              # Range-отдача BIM-моделей идёт стримом, но поверх неё работает
-              # gorilla CompressHandler (gzip), и все поды регулярно уходили
-              # в OOMKilled (exit 137) на 198Mi.
              memory:
-                _default: 512Mi
+                _default: 198Mi
            requests:
              cpu:
                _default: 50m
              memory:
-                _default: 128Mi
+                _default: 85Mi

          probes:
            liveness:
@ -137,10 +134,6 @@ spec:
          - name: API_ADDRESS
            value:
              _default: "0.0.0.0:8080"
-          
-          - name: CDE_API_ENABLED
-            value:
-              _default: "false"

          - name: API_ADDRESS_FILE
            value:
@ -198,13 +191,9 @@ spec:
            value:
              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"

-          # Сервиса bim-api-service в контуре wb нет: в ns bim есть только
-          # backend-service:8000 (bim v2), на него же BIM_API_URL смотрит в
-          # brusnika-stage и asterus. Клиент bim-api (resty, retry 5 x 1s)
-          # на неразрешимом DNS отваливался ровно за ~5 с.
          - name: BIM_API_URL
            value:
-              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"

          - name: BIM_API_V2_URL
            value:
--- a/apps/documentations/wb/pdf-markings-amqp.yaml
+++ b/apps/documentations/wb/pdf-markings-amqp.yaml
@ -36,7 +36,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_9dea5b64
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
          pullPolicy:
            _default: IfNotPresent

--- a/apps/drawings/uralkal/backend.yaml
+++ b/apps/drawings/uralkal/backend.yaml
@ -1,46 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: drawings
-spec:
-  values:
-    services:
-      backend:
-        envs:
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "3"
-
-          - name: API_ADDRESS
-            value:
-              _default: "0.0.0.0:8000"
-
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-
-          - name: WORKFLOW_HOST
-            value:
-              _default: "http://backend-svc.processing.svc.cluster.local/"
-
-          - name: IMAGE_NAME_EXPORT_TO_DWG
-            value:
-              _default: "cross-sections-to-dwg"
-
-          - name: IMAGE_TAG
-            value:
-              _default: "develop"
-
-          - name: TASK_VERSION
-            value:
-              _default: "1"
-
-          - name: DRAWING_INTERNAL_URL
-            value:
-              _default: "http://backend-service.drawings.svc.cluster.local:8000/"
-
-          - name: ATTACHMENT_URL
-            value:
-              _default: "http://attachments-service.attachments.svc.cluster.local:8000"
--- a/apps/drawings/uralkal/kustomization.yaml
+++ b/apps/drawings/uralkal/kustomization.yaml
@ -2,8 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
-patches:
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: backend
--- a/apps/eav/wb/django-configmap.yaml
+++ b/apps/eav/wb/django-configmap.yaml
@ -18,7 +18,7 @@ data:

    # DEBUG SETTINGS START
    # ---------------------------------------------------------------------------------------------------------------------
-    DEBUG = False
+    DEBUG = True
    ALLOWED_HOSTS = ['*']
    # ---------------------------------------------------------------------------------------------------------------------
    # DEBUG SETTINGS END
--- a/apps/faas/wb/backend.yaml
+++ b/apps/faas/wb/backend.yaml
@ -55,14 +55,14 @@ spec:
          resources:
            limits:
              cpu:
-                _default: "1"
+                _default: 23m
              memory:
-                _default: 1Gi
+                _default: 506Mi
            requests:
              cpu:
-                _default: 100m
+                _default: 12m
              memory:
-                _default: 512Mi
+                _default: 330Mi

          probes:
            liveness:
@ -97,23 +97,23 @@ spec:
        envs:
          - name: BASE_HOST
            value:
-              _default: "http://frontend-service.django.svc.cluster.local:80"
+              _default: "https://srx.wb.ru"

          - name: DJANGO_HOST
            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
+              _default: "https://srx.wb.ru"

          - name: REVIEWS_HOST
            value:
-              _default: "http://backend-service.flows.svc.cluster.local:8000"
+              _default: "https://srx.wb.ru/flows"

          - name: GATEWAY_HOST
            value:
-              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+              _default: "https://srx.wb.ru/gateway"

          - name: DOCUMENTATIONS_HOST
            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+              _default: "https://srx.wb.ru/documentations"

          - name: EAV_HOST
            value:
@ -151,10 +151,6 @@ spec:
            value:
              _default: "180"

-          - name: GUNICORN_CMD_ARGS
-            value:
-              _default: "--timeout 3600 --graceful-timeout 30"
-
        commitSha: ""
        gitlabUri: ""
        gitlabJobUrl: ""
--- a/apps/flows/brusnika-stage/celery.yaml
+++ b/apps/flows/brusnika-stage/celery.yaml
@ -35,7 +35,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
          pullPolicy:
            _default: IfNotPresent

@ -252,26 +252,6 @@ spec:
              _default: "https://test.sarex.brusnika.tech"

        secretEnvs:
-          - name: FLOWS_DB_DB
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: FLOWS_DB_USERNAME
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: FLOWS_DB_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: DJANGO_AUTH
-            secretName:
-              _default: "django-secret"
-            secretKey: "token"
-
          - name: ADMIN_PANEL_SECRET_KEY
            secretName:
              _default: "admin-secret"
--- a/apps/flows/brusnika-stage/frontend.yaml
+++ b/apps/flows/brusnika-stage/frontend.yaml
@ -35,7 +35,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
          pullPolicy:
            _default: IfNotPresent

--- a/apps/flows/d8-ugmk-prod/backend.yaml
+++ b/apps/flows/d8-ugmk-prod/backend.yaml
@ -1,4 +1,11 @@
 ---
+# Патч backend для контура УГМК — подключение к Kafka.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
+# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@ -9,8 +16,6 @@ spec:
    services:
      backend:
        deployment:
-          replicaCount:
-            _default: 2
          args:
            _default:
              - |
@ -24,19 +29,6 @@ spec:
                set +a
                exec /opt/entrypoint.sh

-        volumes:
-          _default:
-            - name: authentication
-              mountPath:
-                _default: /opt/src/flow/admin/authentication.py
-              subPath:
-                _default: authentication.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: authentication
-
        envs:
          - name: LOG_LEVEL
            value:
@ -106,10 +98,6 @@ spec:
            value:
              _default: "https://sarex.uralmine.com/flows/api/v1"

-          - name: PROXY_PATH_PREFIX
-            value:
-              _default: /flows
-
          - name: SMTP_HOST
            value:
              _default: "post.uralmine.com"
--- a/apps/flows/uralkal/backend.yaml
+++ b/apps/flows/uralkal/backend.yaml
@ -82,10 +82,6 @@ spec:
          - name: ENABLE_MAILGUN
            value:
              _default: "0"
-          
-          - name: ENABLE_EVENTS
-            value:
-              _default: "0"

          - name: ENABLE_METRICS
            value:
@ -143,11 +139,28 @@ spec:
            value:
              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"

-        secretEnvs:
          - name: KAFKA_SSL_CERT
-            secretName:
-              _default: kafka-kafka-contour-tls
-            secretKey: "ca.crt"
+            value:
+              _default: |
+                -----BEGIN CERTIFICATE-----
+                MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+                MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+                MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+                tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+                h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+                k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+                GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+                zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+                Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+                A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+                vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+                OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+                fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+                ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+                0FC16VuidLG0HUCCawFjRiAg9rIA
+                -----END CERTIFICATE-----

        podAnnotations:
          _default:
--- a/apps/flows/uralkal/celery.yaml
+++ b/apps/flows/uralkal/celery.yaml
@ -1,4 +1,11 @@
 ---
+# Патч celery для контура УГМК — подключение к Kafka.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml.
+# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka.
+# podAnnotations — map, мержится по ключам, поэтому переопределён только
+# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@ -133,11 +140,28 @@ spec:
            value:
              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"

-        secretEnvs:
          - name: KAFKA_SSL_CERT
-            secretName:
-              _default: kafka-kafka-contour-tls
-            secretKey: "ca.crt"
+            value:
+              _default: |
+                -----BEGIN CERTIFICATE-----
+                MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+                MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+                MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+                MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+                tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+                h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+                k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+                GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+                zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+                AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+                Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+                A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+                vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+                OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+                fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+                ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+                0FC16VuidLG0HUCCawFjRiAg9rIA
+                -----END CERTIFICATE-----

        podAnnotations:
          _default:
--- a/apps/flows/wb/backend.yaml
+++ b/apps/flows/wb/backend.yaml
@ -36,7 +36,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_e8a366a3
          pullPolicy:
            _default: IfNotPresent

--- a/apps/flows/wb/celery.yaml
+++ b/apps/flows/wb/celery.yaml
@ -36,7 +36,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_81d0fa17
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_e8a366a3
          pullPolicy:
            _default: IfNotPresent

--- a/apps/flows/wb/frontend.yaml
+++ b/apps/flows/wb/frontend.yaml
@ -36,7 +36,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_4652ff61
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_ed219085
          pullPolicy:
            _default: IfNotPresent

--- a/apps/iam/base/backend.yaml
+++ b/apps/iam/base/backend.yaml
@ -42,7 +42,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_b52d632c
          pullPolicy:
            _default: IfNotPresent

--- a/apps/iam/brusnika-stage/backend.yaml
+++ b/apps/iam/brusnika-stage/backend.yaml
@ -35,7 +35,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_29754513
+            _default: cr.yandex/crp3ccidau046kdj8g9q/iams:contour_dada80a8
          pullPolicy:
            _default: IfNotPresent

--- a/apps/iam/d8-ugmk-prod/iams-service.yaml
+++ b/apps/iam/d8-ugmk-prod/iams-service.yaml
@ -1,15 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: iams
-  namespace: iam
-spec:
-  type: ClusterIP
-  selector:
-    app: iam-backend
-  ports:
-    - name: http
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
--- a/apps/iam/d8-ugmk-prod/kustomization.yaml
+++ b/apps/iam/d8-ugmk-prod/kustomization.yaml
@ -4,7 +4,6 @@ kind: Kustomization
 namespace: iam
 resources:
  - ../base
-  - iams-service.yaml
 patches:
  - path: backend-s3.yaml
    target:
--- a/apps/iam/uralkal/backend-s3.yaml
+++ b/apps/iam/uralkal/backend-s3.yaml
@ -57,10 +57,6 @@ spec:
            value:
              _default: "iam"

-          - name: ZITADEL_TLS_INSECURE_SKIP_VERIFY
-            value:
-              _default: "true"
-
          - name: S3_REGION
            value:
              _default: "ru-central1"
--- a/apps/iam/vad/iams-service.yaml
+++ b/apps/iam/vad/iams-service.yaml
@ -1,15 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: iams
-  namespace: iam
-spec:
-  type: ClusterIP
-  selector:
-    app: iam-backend
-  ports:
-    - name: http
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
--- a/apps/iam/vad/kustomization.yaml
+++ b/apps/iam/vad/kustomization.yaml
@ -3,7 +3,6 @@ kind: Kustomization
 namespace: iam
 resources:
  - ../base
-  - iams-service.yaml
 patches:
  - path: backend-s3.yaml
    target:
--- a/apps/inspections/base/backend.yaml
+++ b/apps/inspections/base/backend.yaml
@ -42,7 +42,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/inspections-backend:contour_32f00e42
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
          pullPolicy:
            _default: IfNotPresent

--- a/apps/inspections/brusnika-stage/backend.yaml
+++ b/apps/inspections/brusnika-stage/backend.yaml
@ -35,7 +35,7 @@ spec:

        image:
          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
          pullPolicy:
            _default: IfNotPresent

--- a/apps/issues/base/production-configmap.yaml
+++ b/apps/issues/base/production-configmap.yaml
@ -122,7 +122,7 @@ data:
        "PUT",
    ]

-    SAREX_API = os.getenv("SAREX_API", "https://srx.wb.ru")
+    SAREX_API = "https://srx.wb.ru"

    AERO_PUBLIC_HOST = os.getenv("AERO_PUBLIC_HOST", default=SAREX_API)

--- a/apps/issues/brusnika-stage/backend.yaml
+++ b/apps/issues/brusnika-stage/backend.yaml
@ -176,6 +176,9 @@ spec:
          - name: API_ADDRESS
            value:
              _default: "8000"
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"

        secretEnvs:
          - name: YC_S3_ACCESS_KEY_ID
--- a/apps/issues/d8-ugmk-prod/backend-s3.yaml
+++ b/apps/issues/d8-ugmk-prod/backend-s3.yaml
@ -64,37 +64,27 @@ spec:

          - name: AERO_PUBLIC_HOST
            value:
-              _default: "https://sarex.uralmine.com"
+              _default: "https://sarex.contour.infra.sarex.tech"

          - name: AERO_HOST
            value:
-              _default: "https://sarex.uralmine.com"
+              _default: "https://sarex.contour.infra.sarex.tech"

-          # server-to-server, не публичный хост: по коду issues-backend это
-          # базовый URL django (src/api/services.py, src/issues/notifications.py).
-          # Фактически значение всё равно берётся из production-configmap,
-          # где BASE_AERO_URL зашит на этот же адрес.
          - name: BASE_AERO_URL
            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
+              _default: "https://sarex.contour.infra.sarex.tech"

          - name: BASE_AUTH_URL
            value:
              _default: "http://backend-svc.django.svc.cluster.local:80"

-          # INFRA-3005: namespace workflow в УГМК не существует, processing
-          # поставляется как backend-svc в namespace processing
-          # (apps/processing/base/api.yaml:74 + d8-ugmk-prod/namespace.yaml).
-          # Формат — базовый URL без пути и без слэша на конце: код сам
-          # добавляет /internal/v1/... (src/issues/mailing.py:122,
-          # src/api/services.py:616).
          - name: WORKFLOWS_HOST
            value:
-              _default: "http://backend-svc.processing.svc.cluster.local:80"
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"

          - name: WORKFLOWS_URL
            value:
-              _default: "http://backend-svc.processing.svc.cluster.local:80"
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"

          - name: RESOURCES_API_HOST
            value:
@ -104,23 +94,13 @@ spec:
            value:
              _default: "http://backend-svc.eav.svc.cluster.local:80"

-          # Внимание: реально действует значение из production-configmap —
-          # там SAREX_API переприсваивается после `from .base import *`.
-          # См. apps/issues/d8-ugmk-prod/production-configmap.yaml (INFRA-3005).
          - name: SAREX_API
            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
+              _default: "https://sarex.contour.infra.sarex.tech"

-          - name: SAREX_HOST
-            value:
-              _default: "https://sarex.uralmine.com"
-
-          # Реальное имя сервиса — backend-api-svc (apps/documentations/base/api.yaml:74).
-          # Было documentations-api-svc — такого сервиса нет; не стреляло только
-          # потому, что production-configmap перетирает эту переменную хардкодом.
          - name: DOCUMENTATIONS_URL
            value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+              _default: "http://documentations-api-svc.documentations.svc.cluster.local:80"

          - name: DJANGO_SETTINGS_MODULE
            value:
--- a/apps/issues/d8-ugmk-prod/celery-s3.yaml
+++ b/apps/issues/d8-ugmk-prod/celery-s3.yaml
@ -62,35 +62,29 @@ spec:
            value:
              _default: "production"

-          # AERO_PUBLIC_HOST участвует в сборке ссылок в уведомлениях
-          # (src/issues/notifications.py:324) — с чужим хостом в письмах УГМК
-          # уходили ссылки на srx.wb.ru.
          - name: AERO_PUBLIC_HOST
            value:
-              _default: "https://sarex.uralmine.com"
+              _default: "https://srx.wb.ru"

          - name: AERO_HOST
            value:
-              _default: "https://sarex.uralmine.com"
+              _default: "https://srx.wb.ru"

-          # server-to-server — внутренний django, см. backend-s3.yaml.
          - name: BASE_AERO_URL
            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
+              _default: "https://srx.wb.ru"

          - name: BASE_AUTH_URL
            value:
              _default: "http://backend-svc.django.svc.cluster.local:80"

-          # INFRA-3005: именно этот хост ронял celery-задачу экспорта в Excel
-          # и все уведомления. См. backend-s3.yaml и production-configmap.yaml.
          - name: WORKFLOWS_HOST
            value:
-              _default: "http://backend-svc.processing.svc.cluster.local:80"
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"

          - name: WORKFLOWS_URL
            value:
-              _default: "http://backend-svc.processing.svc.cluster.local:80"
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"

          - name: RESOURCES_API_HOST
            value:
@ -100,14 +94,9 @@ spec:
            value:
              _default: "http://backend-svc.eav.svc.cluster.local:80"

-          # Реально действует значение из production-configmap, см. там.
          - name: SAREX_API
            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
-
-          - name: SAREX_HOST
-            value:
-              _default: "https://sarex.uralmine.com"
+              _default: "https://srx.wb.ru"

          - name: DOCUMENTATIONS_URL
            value:
--- a/apps/issues/d8-ugmk-prod/kafka-app.yaml
+++ b/apps/issues/d8-ugmk-prod/kafka-app.yaml
@ -138,29 +138,27 @@ spec:

          - name: AERO_PUBLIC_HOST
            value:
-              _default: "https://sarex.uralmine.com"
+              _default: "https://sarex.contour.infra.sarex.tech"

          - name: AERO_HOST
            value:
-              _default: "https://sarex.uralmine.com"
+              _default: "https://sarex.contour.infra.sarex.tech"

-          # server-to-server — внутренний django, см. backend-s3.yaml.
          - name: BASE_AERO_URL
            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
+              _default: "https://sarex.contour.infra.sarex.tech"

          - name: BASE_AUTH_URL
            value:
              _default: "http://backend-svc.django.svc.cluster.local:80"

-          # INFRA-3005: см. backend-s3.yaml и production-configmap.yaml.
          - name: WORKFLOWS_HOST
            value:
-              _default: "http://backend-svc.processing.svc.cluster.local:80"
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"

          - name: WORKFLOWS_URL
            value:
-              _default: "http://backend-svc.processing.svc.cluster.local:80"
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"

          - name: RESOURCES_API_HOST
            value:
@ -170,15 +168,13 @@ spec:
            value:
              _default: "http://backend-svc.eav.svc.cluster.local:80"

-          # Реально действует значение из production-configmap, см. там.
          - name: SAREX_API
            value:
-              _default: "https://sarex.uralmine.com"
+              _default: "https://sarex.contour.infra.sarex.tech"

-          # Реальное имя сервиса — backend-api-svc, см. backend-s3.yaml.
          - name: DOCUMENTATIONS_URL
            value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+              _default: "http://documentations-api-svc.documentations.svc.cluster.local:80"

          - name: DJANGO_SETTINGS_MODULE
            value:
--- a/apps/issues/d8-ugmk-prod/kustomization.yaml
+++ b/apps/issues/d8-ugmk-prod/kustomization.yaml
@ -18,7 +18,3 @@ patches:
    target:
      kind: HelmRelease
      name: celery
-  - path: production-configmap.yaml
-    target:
-      kind: ConfigMap
-      name: production-configmap
--- a/apps/issues/d8-ugmk-prod/production-configmap.yaml
+++ b/apps/issues/d8-ugmk-prod/production-configmap.yaml
@ -1,153 +0,0 @@
---
-
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: production-configmap
-  namespace: issues
-data:
-  production.py: |
-    from datetime import timedelta
-    import os
-    from .base import *
-
-    # DEBUG SETTINGS START
-    # -----------------------------------------------------------------------------
-    DEBUG = True
-    # -----------------------------------------------------------------------------
-
-    TEST_MODE = False
-
-    # SECRETS SETTINGS START
-    # -----------------------------------------------------------------------------
-    SECRET_KEY = "FromToMuchLoveOfLiving"  # Delete after Test
-    # -----------------------------------------------------------------------------
-
-    DJANGO_TOKEN = os.getenv("DJANGO_TOKEN")
-
-    # ALLOWED HOSTS START
-    # -----------------------------------------------------------------------------
-    ALLOWED_HOSTS = ["*"]
-    # -----------------------------------------------------------------------------
-
-    # APPS SETTINGS START
-    # -----------------------------------------------------------------------------
-    # INSTALLED_APPS += [
-    #     "django_extensions",
-    # ]
-    # -----------------------------------------------------------------------------
-
-    # DEBUG SETTINGS START
-    # -----------------------------------------------------------------------------
-    DEBUG = False
-    # -----------------------------------------------------------------------------
-
-    REVIEW_HOST='http://backend-svc.flows.svc.cluster.local:80'
-    # -----------------------------------------------------------------------------
-    # EXTERNAL SERVICES END
-
-    # INFRA-3005: в base здесь хардкод workflows-api-service.workflow — такого
-    # сервиса в УГМК нет (DNS: "Name or service not known"), из-за чего падал
-    # POST {WORKFLOWS_HOST}/internal/v1/companies/{id}/workflows в
-    # issues/mailing.py:122 (WorkflowsMailer) — а это и рассылка уведомлений,
-    # и финальный шаг celery-задачи экспорта в Excel.
-    # В УГМК workflows (processing) живёт как backend-svc в namespace processing.
-    WORKFLOWS_HOST = os.getenv("WORKFLOWS_HOST", "http://backend-svc.processing.svc.cluster.local:80")
-    WORKFLOWS_URL = os.getenv("WORKFLOWS_URL", "http://backend-svc.processing.svc.cluster.local:80")
-    # backend-api-svc — реальное имя сервиса documentations (base/api.yaml:74).
-    DOCUMENTATIONS_URL = "http://backend-api-svc.documentations.svc.cluster.local:80"
-    RESOURCES_API_HOST = os.getenv("RESOURCES_API_HOST", default="http://resources-service.resources.svc.cluster:8000")
-    KAFKA_HOST = os.getenv("KAFKA_HOST")
-    KAFKA_USERNAME = os.getenv("KAFKA_USERNAME")
-    KAFKA_PASSWORD = os.getenv("KAFKA_PASSWORD")
-    KAFKA_SSL_CAFILE = os.getenv("KAFKA_SSL_CAFILE", "/usr/local/share/ca-certificates/kafka.crt")
-    KAFKA_EAV_ASSETS_TOPIC = os.getenv("KAFKA_EAV_ASSETS_TOPIC", "sarex")
-    KAFKA_ISSUES_TOPIC = os.getenv("KAFKA_ISSUES_TOPIC", "sarex-issues")
-
-
-    USE_ASYNC_FUNCTIONS = True
-    USE_NOTIFICATIONS = True
-
-    # JWT SETTINGS START
-    if not os.environ.get("JWT_PRIVATE_KEY"):
-        os.environ["JWT_PRIVATE_KEY"] = _read_secret_file("/vault/secrets/django-jwt-private")
-    if not os.environ.get("JWT_PUBLIC_KEY"):
-        os.environ["JWT_PUBLIC_KEY"] = _read_secret_file("/vault/secrets/django-jwt-public")
-    # ---------------------------------------------------------------------------------------------------------------------
-    SIMPLE_JWT_ISSUER = os.getenv("SIMPLE_JWT_ISSUER", default="default_issuer")
-
-    SIMPLE_JWT = {
-        "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
-        "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
-        "ROTATE_REFRESH_TOKENS": False,
-        "UPDATE_LAST_LOGIN": False,
-
-        "ALGORITHM": "RS512",
-        "SIGNING_KEY": os.getenv("JWT_PRIVATE_KEY", default="").replace("\\n", "\n"),
-        "VERIFYING_KEY": os.getenv("JWT_PUBLIC_KEY").replace("\\n", "\n"),
-        "AUDIENCE": None,
-        "ISSUER": SIMPLE_JWT_ISSUER,
-
-        "AUTH_HEADER_TYPES": ("Bearer",),
-        "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
-        "USER_ID_FIELD": "id",
-        "USER_ID_CLAIM": "user_id",
-
-        "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
-        "TOKEN_TYPE_CLAIM": "token_type",
-
-        "JTI_CLAIM": "jti",
-
-        "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp",
-        "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5),
-        "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1),
-    }
-    # ---------------------------------------------------------------------------------------------------------------------
-
-    CORS_ALLOWED_ORIGINS = [
-        "https://sarex.uralmine.com",
-    ]
-
-    CORS_TRUSTED_ORIGINS = [
-        "https://sarex.uralmine.com",
-    ]
-
-    CSRF_TRUSTED_ORIGINS = [
-        "https://sarex.uralmine.com",
-    ]
-
-    CORS_ALLOW_ALL_ORIGINS = True
-    ENABLE_MAILGUN=False
-    SMTP_PORT=587
-    SMTP_HOST="post.uralmine.com"
-    EMAIL_FROM="sarex@uralmine.com"
-
-    CORS_ALLOW_METHODS = [
-        "DELETE",
-        "GET",
-        "OPTIONS",
-        "PATCH",
-        "POST",
-        "PUT",
-    ]
-
-    SAREX_API = os.getenv("SAREX_API", "https://sarex.uralmine.com")
-
-    AERO_PUBLIC_HOST = os.getenv("AERO_PUBLIC_HOST", default=SAREX_API)
-
-    BASE_AERO_URL = "http://backend-svc.django.svc.cluster.local:80"
-
-    ENVIRONMENT = "production"
-
-    SESSION_COOKIE_NAME = "issues-sessionid"
-    CSRF_COOKIE_NAME = "issues-csrftoken"
-    STATIC_URL = "/static/"
-    STORAGES = {
-        'default': {
-            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
-        },
-        'staticfiles': {
-            # Leave whatever setting you already have here, e.g.:
-            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
-        }
-    }
--- a/apps/issues/uralkal/backend-s3.yaml
+++ b/apps/issues/uralkal/backend-s3.yaml
@ -0,0 +1,149 @@
+---
+# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml.
+# podAnnotations — map, мержится по ключам.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: issues
+spec:
+  values:
+    services:
+      backend:
+        deployment:
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
+                [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
+                [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
+                [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
+                [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
+                [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
+                [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
+                set +a
+                exec /src/entrypoint.sh
+
+        volumes:
+          _default:
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+            - name: kafka-ca-cert
+              mountPath:
+                _default: /usr/local/share/ca-certificates/kafka.crt
+              subPath:
+                _default: kafka.crt
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-ca-cert
+                items:
+                  - key: kafka.crt
+                    path:
+                      _default: kafka.crt
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: SAREX_API
+            value:
+              _default: "https://sarex.contour.infra.sarex.tech"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          # Kafka — код (kafka_app/app.py) ждёт KAFKA_HOST единой строкой "host:port",
+          # KAFKA_SSL_CAFILE — путь к файлу (не PEM-текст, в отличие от flows-backend).
+          # Хост/порт/CA — те же проверенные значения, что у message-hub/pm/flows.
+          - name: KAFKA_HOST
+            value:
+              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          # Топики совпадают с тем, что уже провижено на брокере (см. topics
+          # в секрете kafka/apps/pm) и с SETTINGS_TOPICS у message-hub.
+          - name: KAFKA_ISSUES_TOPIC
+            value:
+              _default: "issues_broadcast_prod"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-s3: |-
+              {{- with secret "secrets/data/minio/apps/issues" -}}
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YC_S3_BUCKET_NAME=issues
+              YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/issues" -}}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
--- a/apps/issues/uralkal/backend.yaml
+++ b/apps/issues/uralkal/backend.yaml
@ -8,145 +8,8 @@ spec:
  values:
    services:
      backend:
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_eb983275
        deployment:
          resources:
            requests:
              cpu: null
              memory: null
-          args:
-            _default:
-              - |
-                set -a
-                [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
-                [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
-                [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
-                [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
-                [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
-                [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
-                [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
-                set +a
-                exec /src/entrypoint.sh
-
-        volumes:
-          _default:
-            - name: production-configmap
-              mountPath:
-                _default: /src/config/settings/production.py
-              subPath:
-                _default: production.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: production-configmap
-                items:
-                  - key: production.py
-                    path:
-                      _default: production.py
-            - name: kafka-ca-cert
-              mountPath:
-                _default: /usr/local/share/ca-certificates/kafka.crt
-              subPath:
-                _default: kafka.crt
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: kafka-kafka-contour-tls
-                items:
-                  - key: ca.crt
-                    path:
-                      _default: kafka.crt
-
-        envs:
-          - name: ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: AERO_PUBLIC_HOST
-            value:
-              _default: "https://sarex.contour.infra.sarex.tech"
-
-          - name: AERO_HOST
-            value:
-              _default: "https://sarex.contour.infra.sarex.tech"
-
-          - name: BASE_AERO_URL
-            value:
-              _default: "https://sarex.contour.infra.sarex.tech"
-
-          - name: BASE_AUTH_URL
-            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80"
-
-          - name: WORKFLOWS_URL
-            value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80"
-
-          - name: RESOURCES_API_HOST
-            value:
-              _default: "http://iam-backend.iam.svc.cluster.local:8000"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://backend-svc.eav.svc.cluster.local:80"
-
-          - name: SAREX_API
-            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
-
-          - name: SAREX_HOST
-            value:
-              _default: "https://sarex.local.uralkali.com"
-
-          - name: DOCUMENTATIONS_URL
-            value:
-              _default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
-
-          - name: DJANGO_SETTINGS_MODULE
-            value:
-              _default: "config.settings.production"
-
-          - name: API_ADDRESS
-            value:
-              _default: "8000"
-
-          - name: KAFKA_HOST
-            value:
-              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
-
-          - name: KAFKA_SSL_CAFILE
-            value:
-              _default: "/usr/local/share/ca-certificates/kafka.crt"
-
-          - name: KAFKA_ISSUES_TOPIC
-            value:
-              _default: "issues_broadcast_prod"
-
-          - name: KAFKA_EAV_ASSETS_TOPIC
-            value:
-              _default: "assets_broadcast"
-
-        podAnnotations:
-          _default:
-            vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
-            vault.hashicorp.com/agent-inject-template-issues-s3: |-
-              {{- with secret "secrets/data/minio/apps/issues" -}}
-              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-              YC_S3_BUCKET_NAME=issues
-              YC_S3_ENDPOINT_URL=http://10.133.0.245:9000
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
-            vault.hashicorp.com/agent-inject-template-issues-kafka: |-
-              {{- with secret "secrets/data/kafka/apps/issues" -}}
-              KAFKA_USERNAME={{ index .Data.data "username" }}
-              KAFKA_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
--- a/apps/issues/uralkal/celery-s3.yaml
+++ b/apps/issues/uralkal/celery-s3.yaml
@ -0,0 +1,145 @@
+---
+# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/issues/base/celery.yaml.
+# podAnnotations — map, мержится по ключам.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: issues
+spec:
+  values:
+    services:
+      celery:
+        deployment:
+          args:
+            _default:
+              - |
+                set -a
+                [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
+                [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
+                [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
+                [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
+                [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
+                [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
+                [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
+                set +a
+                exec celery -A config worker -l info -E
+
+        volumes:
+          _default:
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+            - name: kafka-ca-cert
+              mountPath:
+                _default: /usr/local/share/ca-certificates/kafka.crt
+              subPath:
+                _default: kafka.crt
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-ca-cert
+                items:
+                  - key: kafka.crt
+                    path:
+                      _default: kafka.crt
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "http://backend-svc.django.svc.cluster.local:80"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://backend-svc.eav.svc.cluster.local:80"
+
+          - name: SAREX_API
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          # См. подробные комментарии в apps/issues/d8-ugmk-prod/backend-s3.yaml.
+          - name: KAFKA_HOST
+            value:
+              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: KAFKA_ISSUES_TOPIC
+            value:
+              _default: "issues_broadcast_prod"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+        podAnnotations:
+          _default:
+            vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-s3: |-
+              {{- with secret "secrets/data/minio/apps/issues" -}}
+              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              YC_S3_BUCKET_NAME=issues
+              YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
+              {{- end -}}
+            vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
+            vault.hashicorp.com/agent-inject-template-issues-kafka: |-
+              {{- with secret "secrets/data/kafka/apps/issues" -}}
+              KAFKA_USERNAME={{ index .Data.data "username" }}
+              KAFKA_PASSWORD={{ index .Data.data "password" }}
+              {{- end -}}
--- a/apps/issues/uralkal/celery.yaml
+++ b/apps/issues/uralkal/celery.yaml
@ -13,137 +13,3 @@ spec:
            requests:
              cpu: null
              memory: null
-          args:
-            _default:
-              - |
-                set -a
-                [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
-                [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
-                [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
-                [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
-                [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
-                [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
-                [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
-                set +a
-                exec celery -A config worker -l info -E
-
-        volumes:
-          _default:
-            - name: production-configmap
-              mountPath:
-                _default: /src/config/settings/production.py
-              subPath:
-                _default: production.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: production-configmap
-                items:
-                  - key: production.py
-                    path:
-                      _default: production.py
-            - name: kafka-ca-cert
-              mountPath:
-                _default: /usr/local/share/ca-certificates/kafka.crt
-              subPath:
-                _default: kafka.crt
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: kafka-kafka-contour-tls
-                items:
-                  - key: ca.crt
-                    path:
-                      _default: kafka.crt
-
-        envs:
-          - name: ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: AERO_PUBLIC_HOST
-            value:
-              _default: "https://sarex.contour.infra.sarex.tech"
-
-          - name: AERO_HOST
-            value:
-              _default: "https://sarex.contour.infra.sarex.tech"
-
-          - name: BASE_AERO_URL
-            value:
-              _default: "https://sarex.contour.infra.sarex.tech"
-
-          - name: BASE_AUTH_URL
-            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
-
-          - name: WORKFLOWS_URL
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
-
-          - name: RESOURCES_API_HOST
-            value:
-              _default: "http://iam-backend.iam.svc.cluster.local:8000"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://backend-svc.eav.svc.cluster.local:80"
-
-          - name: SAREX_API
-            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
-
-          - name: SAREX_HOST
-            value:
-              _default: "https://sarex.local.uralkali.com"
-
-          - name: DOCUMENTATIONS_URL
-            value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
-
-          - name: DJANGO_SETTINGS_MODULE
-            value:
-              _default: "config.settings.production"
-
-          - name: API_ADDRESS
-            value:
-              _default: "8000"
-
-          - name: KAFKA_HOST
-            value:
-              _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
-
-          - name: KAFKA_SSL_CAFILE
-            value:
-              _default: "/usr/local/share/ca-certificates/kafka.crt"
-
-          - name: KAFKA_ISSUES_TOPIC
-            value:
-              _default: "issues_broadcast_prod"
-
-          - name: KAFKA_EAV_ASSETS_TOPIC
-            value:
-              _default: "assets_broadcast"
-
-        podAnnotations:
-          _default:
-            vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
-            vault.hashicorp.com/agent-inject-template-issues-s3: |-
-              {{- with secret "secrets/data/minio/apps/issues" -}}
-              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-              YC_S3_BUCKET_NAME=issues
-              YC_S3_ENDPOINT_URL=http://10.133.0.245:9000
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
-            vault.hashicorp.com/agent-inject-template-issues-kafka: |-
-              {{- with secret "secrets/data/kafka/apps/issues" -}}
-              KAFKA_USERNAME={{ index .Data.data "username" }}
-              KAFKA_PASSWORD={{ index .Data.data "password" }}
-              {{- end -}}
--- a/apps/issues/uralkal/kafka-ca-configmap.yaml
+++ b/apps/issues/uralkal/kafka-ca-configmap.yaml
@ -3,7 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
  name: kafka-ca-cert
-  namespace: premises
+  namespace: issues
 data:
  kafka.crt: |
    -----BEGIN CERTIFICATE-----
--- a/apps/issues/uralkal/kustomization.yaml
+++ b/apps/issues/uralkal/kustomization.yaml
@ -2,7 +2,16 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+  - kafka-ca-configmap.yaml
 patches:
+  - path: backend-s3.yaml
+    target:
+      kind: HelmRelease
+      name: backend
+  - path: celery-s3.yaml
+    target:
+      kind: HelmRelease
+      name: celery
  - path: backend.yaml
    target:
      kind: HelmRelease
--- a/apps/issues/vad/backend-s3.yaml
+++ b/apps/issues/vad/backend-s3.yaml
@ -96,11 +96,7 @@ spec:

          - name: SAREX_API
            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
-
-          - name: SAREX_HOST
-            value:
-              _default: "https://sarex.vadroad.ru"
+              _default: "https://sarex.contour.infra.sarex.tech"

          - name: DOCUMENTATIONS_URL
            value:
--- a/apps/issues/vad/celery-s3.yaml
+++ b/apps/issues/vad/celery-s3.yaml
@ -96,11 +96,7 @@ spec:

          - name: SAREX_API
            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
-
-          - name: SAREX_HOST
-            value:
-              _default: "https://sarex.vadroad.ru"
+              _default: "https://srx.wb.ru"

          - name: DOCUMENTATIONS_URL
            value:
--- a/apps/issues/wb/production-configmap.yaml
+++ b/apps/issues/wb/production-configmap.yaml
@ -12,6 +12,7 @@ data:

    # DEBUG SETTINGS START
    # -----------------------------------------------------------------------------
+    DEBUG = True
    # -----------------------------------------------------------------------------

    TEST_MODE = False
@ -39,7 +40,7 @@ data:

    # DEBUG SETTINGS START
    # -----------------------------------------------------------------------------
-    DEBUG = False
+    DEBUG = True
    # -----------------------------------------------------------------------------

    REVIEW_HOST='http://backend-service.flows.svc.cluster.local:8000'
--- a/apps/mapper/uralkal/backend.yaml
+++ b/apps/mapper/uralkal/backend.yaml
@ -13,28 +13,3 @@ spec:
            requests:
              cpu: null
              memory: null
-
-        envs:
-          - name: DOCUMENTATION_HOST
-            value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local/api/v1"
-
-          - name: FLOW_HOST
-            value:
-              _default: "http://backend-svc.flows.svc.cluster.local/api/v1"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend-svc.django.svc.cluster.local/api"
-
-          - name: NOTE_HOST
-            value:
-              _default: "http://backend-service.notes.svc.cluster.local:8000/api/v1"
-
-          - name: REDIS_USE
-            value:
-              _default: "0"
-
-          - name: TIMEOUT
-            value:
-              _default: "120"
--- a/apps/message-hub/uralkal/kafka-ca-configmap.yaml
+++ b/apps/message-hub/uralkal/kafka-ca-configmap.yaml
@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-ca-cert
+  namespace: message-hub
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDETCCAfmgAwIBAgIQNhHkZWgkcMSiuRD9FD3SKjANBgkqhkiG9w0BAQsFADAT
+    MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA4MjYwOTM4MzFaFw0yNzA4MjYwOTM4
+    MzFaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+    MIIBCgKCAQEA7Vvs1386xYZrKJ4qr/LwiibuhyoIHZm6AnjubChLKUSulP0+TIYC
+    tDgfSiEQsmASCkJKrvrpg2o0TGxj+LUTVnBCDWwBL3wXWSrbHTmpo9y2n0MH/SiN
+    h0n43/ReuXXGzuP+s4WF4Z6EkQyCqqGXZkqYx3PsiqQv2DYmnU/s6jdEqXBhDyU9
+    k6KGjMGxCmDN07E8iElfZp58KvZSISFNi2X5QWa3CIiPo7EKOyW20Hw8xVyQ8/SX
+    GE/Rt2I4G/LC+EhUBKrRB4UgHY1UcifO0EMvKeh8lLRBT5+yqQvkA2/cXYKmeEKc
+    zICZw5ve1DiImjQKvHoM257t6lf5yj9h+wIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
+    AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
+    Af8wHQYDVR0OBBYEFAANdtqbrWPSSQqiCh1Wii2jxHO5MA0GCSqGSIb3DQEBCwUA
+    A4IBAQBJOea+5wxUNQuWX+E1m3GA5WJz+mAyt8J37w1ZpFVSpOX9r/ptSjyGoNY2
+    vgP0G8bJH30s25D4kRHuvvPeeCGnOR3PKPceeNIa4CQYvHnYT2bf7WBP8rLd0TyS
+    OV/ApxvxipKjl0OQc+95xAxm2z0qWIeOh1dkurvyhdLasIhqyhuUguW8APB2U3dU
+    fIvJ/R992Hy/MYvW7cw1CMWoaoBX90TEl6JNCHQvfBxaQzvPRvSEWwnRgbGwSZwz
+    ZS6GaNGN7C70WCxP4gmmkWfUC9lphnFb0IMGxXr/nTu5Ez5PKqRG56THkW5vd45i
+    0FC16VuidLG0HUCCawFjRiAg9rIA
+    -----END CERTIFICATE-----
--- a/apps/message-hub/uralkal/kustomization.yaml
+++ b/apps/message-hub/uralkal/kustomization.yaml
@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+  - kafka-ca-configmap.yaml
 patches:
  - path: message-hub.yaml
    target:
--- a/apps/message-hub/uralkal/message-hub.yaml
+++ b/apps/message-hub/uralkal/message-hub.yaml
@ -91,11 +91,11 @@ spec:
                _default: kafka.crt
              readOnly:
                _default: true
-              secret:
-                secretName:
-                  _default: kafka-kafka-contour-tls
+              configMap:
+                name:
+                  _default: kafka-ca-cert
                items:
-                  - key: ca.crt
+                  - key: kafka.crt
                    path:
                      _default: kafka.crt

@ -106,5 +106,5 @@ spec:
              {{- with secret "secrets/data/kafka/apps/pm" -}}
              KAFKA_USERNAME={{ index .Data.data "username" }}
              KAFKA_PASSWORD={{ index .Data.data "password" }}
-              KAFKA_SASL_MECHANISM={{ if .Data.data.auth }}{{ index .Data.data.auth "sasl_mechanism" }}{{ else }}{{ index .Data.data "sasl_mechanism" }}{{ end }}
+              KAFKA_SASL_MECHANISM={{ index .Data.data.auth "sasl_mechanism" }}
              {{- end -}}
--- a/Show More
+++ b/Show More