Compare commits
No commits in common. "master" and "3.9.36" have entirely different histories.
@ -4,8 +4,6 @@ include:
|
||||
|
||||
stages:
|
||||
- build
|
||||
- slices
|
||||
- slices-publish
|
||||
|
||||
variables:
|
||||
RELEASE_NAME: iac-offline
|
||||
@ -35,31 +33,3 @@ build_offline_mirror:
|
||||
- docker push ${IMAGE_NAME}
|
||||
- docker push ${CR}/${RELEASE_NAME}:latest
|
||||
timeout: 30m
|
||||
|
||||
generate_slice_jobs:
|
||||
stage: slices
|
||||
image: ${CR}/infra/slice-builder:1.0.0
|
||||
tags:
|
||||
- build
|
||||
rules:
|
||||
- if: $CI_COMMIT_TAG =~ /^v?(?:\d+\.){2}\d+$/
|
||||
variables:
|
||||
GIT_DEPTH: "1"
|
||||
script:
|
||||
- python3 ci/publish-slice.py generate --release "$CI_COMMIT_TAG" --commit "$CI_COMMIT_SHA" --out slices-pipeline.yml
|
||||
- cat slices-pipeline.yml
|
||||
artifacts:
|
||||
paths:
|
||||
- slices-pipeline.yml
|
||||
|
||||
publish_contour_slices:
|
||||
stage: slices-publish
|
||||
rules:
|
||||
- if: $CI_COMMIT_TAG =~ /^v?(?:\d+\.){2}\d+$/
|
||||
needs:
|
||||
- generate_slice_jobs
|
||||
trigger:
|
||||
include:
|
||||
- artifact: slices-pipeline.yml
|
||||
job: generate_slice_jobs
|
||||
strategy: depend
|
||||
|
||||
38
CLAUDE.md
38
CLAUDE.md
@ -25,13 +25,11 @@
|
||||
|
||||
| Путь | Что |
|
||||
|---|---|
|
||||
| `clusters/` | 17 точек входа Flux + шаблон `contour` — **источник истины «что где раскатано»** |
|
||||
| `infrastructure/` | 44 платформенных компонента |
|
||||
| `apps/` | 39 прикладных сервисов |
|
||||
| `docs/apps/` | 34 mermaid-диаграммы по сервисам + `README.md` с доменной группировкой |
|
||||
| `docs/architecture/` | модель контура в ArchiMate + скрипты-сканеры (`scan_calls.py`, `scan_contour.py`) и сборка (`build_archimate.py`); реальные значения инсталляций сюда не кладутся, только `*.example.json` |
|
||||
| `clusters/` | 10 точек входа Flux — **источник истины «что где раскатано»** |
|
||||
| `infrastructure/` | 36 платформенных компонентов |
|
||||
| `apps/` | 37 прикладных сервисов |
|
||||
| `docs/apps/` | 35 mermaid-диаграмм по сервисам + `README.md` с доменной группировкой |
|
||||
| `docs/closed-contour-deployment.md` | ранбук поднятия закрытого контура |
|
||||
| `ci/`, `.gitlab-ci.yml`, `Dockerfile` | на тег `vX.Y.Z`: образ офлайн-зеркала `iac-offline` и публикация «слайсов» контуров (см. ниже) |
|
||||
| `README.md` | mermaid-мегакарта платформы, структура репозитория, инструкции по добавлению app / infra / кластера |
|
||||
| `IAC-CATALOG.md` | каталог всего `infra/*`; §5 — про этот репозиторий |
|
||||
| `inventory.yaml` | сгенерированный снимок прода: 59 namespace → kind → имена |
|
||||
@ -40,18 +38,15 @@
|
||||
|
||||
**Кластер.** `clusters/<cluster>/kustomization.yaml` — плоский список `../../apps/<app>/<cluster>`. Инфраструктура подключается двумя разными способами:
|
||||
|
||||
- `d8-ugmk-prod`, `sarex-contour`, `ugok`, `uralkal`, `vad` — прямо в корневом kustomization как `../../infrastructure/<comp>/<c>`;
|
||||
- `brusnika-prod`, `brusnika-stage`, `vk-infra`, `vk-prod` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на оверлеи `../../../infrastructure/<comp>/<c>` (`base` + патч HelmRelease + сопутствующие манифесты компонента);
|
||||
- `wb`, `yc-cps-prod`, `yc-infra-prod`, `yc-k8s-test-02` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/<c>/infrastructure/patches/*.yaml`;
|
||||
- `stand` — послойно: `layers.yaml` объявляет Flux-`Kustomization` `00-vault → 10-mesh → 20-data → 30-platform → 40-routing` (каталоги `clusters/stand/<NN>-<layer>/`). Слои ссылаются на оверлеи `infrastructure/<comp>/contour-template`, а значения контура (`${STORAGE_CLASS}`, `${HOST_*}`, `${GATEWAY_REPLICAS}`) Flux подставляет через `postBuild.substituteFrom` из ConfigMap `contour-vars`.
|
||||
- `d8-ugmk-prod` — прямо в корневом kustomization как `../../infrastructure/<comp>/d8-ugmk-prod`;
|
||||
- `brusnika-prod`, `brusnika-stage` — через `clusters/<c>/infrastructure/kustomization.yaml`, который ссылается на оверлеи `../../../infrastructure/<comp>/<c>` (`base` + патч HelmRelease + сопутствующие манифесты компонента);
|
||||
- `wb` — через `clusters/wb/infrastructure/kustomization.yaml`, который ссылается на `../../../infrastructure/<comp>` (резолвится в `base`), а различия лежат в `clusters/wb/infrastructure/patches/*.yaml`.
|
||||
|
||||
Кластеры с приложениями: `asterus`, `brusnika-prod`, `brusnika-stage`, `d8-ugmk-prod`, `sarex-contour`, `ugok`, `uralkal`, `vad`, `wb`, `yc-ecp`, `yc-k8s-test`. Только инфраструктура: `stand`, `vk-infra`, `vk-prod`, `yc-cps-prod`, `yc-infra-prod`, `yc-k8s-test-02`. Шаблон: `contour`.
|
||||
Кластеры: `brusnika-prod`, `brusnika-stage`, `d8-ugmk-prod`, `wb`, `yc-cps-prod`, `yc-ecp`, `yc-infra-prod`, `yc-k8s-test`, `yc-k8s-test-02`, `contour`.
|
||||
|
||||
**Приложение.** `apps/<app>/base/` — по одному `.yaml` на процесс (`backend.yaml`, `celery.yaml`, `frontend.yaml`) плюс `namespace.yaml`; оверлеи в `apps/<app>/<cluster>/`. Namespace = имя приложения. Рядом с манифестами лежит документация: `CONFIGURATION.md` (все env-переменные и откуда берутся), `ENDPOINTS.md` (исходящие HTTP-вызовы), `openapi.yaml` (входящий контракт), `.env.example`. Если процессов несколько — файлы с префиксом процесса: `api.ENDPOINTS.md`, `pdm.CONFIGURATION.md`, `frontend.CONFIGURATION.md`.
|
||||
|
||||
**Инфра-компонент.** `infrastructure/<comp>/base/` + оверлеи `<comp>/<cluster>/`. Корневой `infrastructure/<comp>/kustomization.yaml` всегда указывает просто на `base`. Оверлей `contour-template` (есть у vault, istio-*, cert-manager, postgresql, kafka, rabbitmq, zitadel, camunda, istio-config) — параметризованный `${VAR}`, а не привязанный к конкретному кластеру. Чарты идут с суффиксом контура: `vault-contour`, `keycloak-contour`, `postgresql-contour` и — внимание — `idp-contour` это Zitadel.
|
||||
|
||||
**Слайсы.** На тег `vX.Y.Z` `ci/publish-slice.py generate` создаёт child-pipeline с отдельной джобой на каждый `clusters/*/kustomization.yaml`. Джоба вызывает `ci/build-slice.py`: тот обходит дерево Kustomize от `clusters/<c>` и упаковывает только нужные файлы в tar. Результат публикуется как OCI-артефакт `cr.yandex/crpct2b2lsmao4nm0cjk/<c>-iac:<tag>` (media type `application/vnd.sarex.slice.config.v1+json`). Так закрытый контур получает только свой срез. Тесты — `ci/tests/test_build_slice.py`.
|
||||
**Инфра-компонент.** `infrastructure/<comp>/base/` + оверлеи `<comp>/<cluster>/`. Корневой `infrastructure/<comp>/kustomization.yaml` всегда указывает просто на `base`. Чарты идут с суффиксом контура: `vault-contour`, `keycloak-contour`, `postgresql-contour` и — внимание — `idp-contour` это Zitadel.
|
||||
|
||||
## Где искать конкретное
|
||||
|
||||
@ -67,23 +62,18 @@
|
||||
| Тег образа в контуре | `apps/<app>/<cluster>/*.yaml`, поле `image.tag` |
|
||||
| Что реально в проде по namespace | `inventory.yaml` |
|
||||
| Где лежит исходный код приложения | `IAC-CATALOG.md` §5.3.8 |
|
||||
| Что попадёт в слайс контура | `python3 ci/build-slice.py` по `clusters/<c>` (логика сбора — там же) |
|
||||
| Переменные шаблонного контура | `${...}` в `infrastructure/*/contour-template`; значения — ConfigMap `contour-vars` в кластере, не в репозитории |
|
||||
|
||||
## Ловушки
|
||||
|
||||
- **`dsinv/`** — оверлей есть у 25 приложений, но `clusters/dsinv/` не существует. Это материализованный снимок живого контура WB, а не источник деплоя. Развёрнутым не считать.
|
||||
- **Две несовместимые конвенции оверлеев** (`IAC-CATALOG.md` §5.3.4). `d8-ugmk-prod`, `yc-k8s-test`, `vad`, `uralkal`, `sarex-contour`, `dsinv` наследуют `base` и патчат его. `brusnika-prod`, `brusnika-stage`, `yc-ecp`, `asterus` — полные копии HelmRelease, которые молча дрейфуют от base. Правка `base` на них не влияет. **`wb` (4 из 27) и `ugok` (9 из 33) смешанные** — проверяйте `resources:` конкретного оверлея; в `ugok` причина обычно указана комментарием в его `kustomization.yaml`.
|
||||
- **`asterus` подключён почти пустым**: оверлеи есть у 26 приложений, но в `clusters/asterus/kustomization.yaml` активен только `auth-flow`, остальные закомментированы. Инфраструктуры в кластере нет.
|
||||
- **Слайс публикуется для каждого `clusters/*/kustomization.yaml`** — в том числе для тестовых и инфраструктурных кластеров. Новая папка в `clusters/` с этим файлом автоматически станет слайсом на следующем теге. У `contour` такого файла нет, поэтому для него слайс не собирается.
|
||||
- **Две несовместимые конвенции оверлеев** (`IAC-CATALOG.md` §5.3.4). `d8-ugmk-prod`, `yc-k8s-test`, `dsinv` наследуют `base` и патчат его. `brusnika-prod`, `brusnika-stage`, `yc-ecp` — полные копии HelmRelease, которые молча дрейфуют от base. Правка `base` на них не влияет.
|
||||
- **`IAC-CATALOG.md` — снимок на 05.08.2026** и по составу приложений на контур уже расходится с реальностью (там у `wb` ноль приложений, фактически 26 оверлеев). Всегда сверяться с `clusters/*/kustomization.yaml`.
|
||||
- **Мегадиаграмма в `README.md` идеализирована** — рисована руками, показывает все приложения на одной Postgres и все фронтенды за `control-interface`. Проверяемые источники — env-переменные и istio-config.
|
||||
- **`clusters/contour/` — не кластер, а шаблон**: в нём нет `flux-system`, только `apps.yaml`, `infrastructure.yaml`, `helm-repositories.yaml`.
|
||||
- **Path-роутинг лежит в `infrastructure/istio-config/<c>/` у большинства контуров, но не у WB.** В `clusters/wb/infrastructure/patches/istio-config.yaml` через Istio публикуются только платформенные UI (Gitea, Grafana, OpenObserve, Superset, Vault, GoAlert), а прикладной трафик разводится вне репозитория. В Brusnika схема смешанная: часть путей идёт напрямую в сервисы, остальное — одним правилом в `yet-another-nginx-service.global-ingress`.
|
||||
- **`vk-prod` маршрутизирует в namespace с суффиксом `-prod`** (`eav-prod`, `pm-prod`, `inspections-prod`), а приложений из `apps/` в этом кластере нет: сервисы раскатываются не этим репозиторием.
|
||||
- **Имена namespace расходятся между источниками**: `inventory.yaml` и `vk-prod` используют суффикс (`flows-prod`), `apps/` — голое имя (`flows`).
|
||||
- **66 оверлеев приложений не подключены ни к одному кластеру**: 25 — `dsinv`, 25 — закомментированные в `asterus`, остальные 16 — мёртвый код (в основном `brusnika-prod`, плюс `bi`/`iam` в `wb` и `yc-k8s-test`).
|
||||
- **Нет диаграмм** в `docs/apps/` для `ams-sync`, `auth-flow`, `bi`, `iam`, `premises`.
|
||||
- **Path-роутинг виден в репозитории только у `d8-ugmk-prod` и `yc-ecp`.** В Brusnika и WB весь прикладной трафик уходит одним правилом в `nginx-service.global-ingress` / `yet-another-nginx-service.global-ingress`, а разводка по путям происходит вне репозитория. Через Istio там публикуются только платформенные UI (Gitea, Grafana, OpenObserve, Superset, Vault, Zitadel, Camunda, MinIO).
|
||||
- **Имена namespace расходятся между источниками**: `inventory.yaml` использует суффикс (`flows-prod`), `apps/` — голое имя (`flows`).
|
||||
- **17 оверлеев приложений не подключены ни к одному кластеру** — мёртвый код.
|
||||
- **Нет диаграмм** в `docs/apps/` для `iam`, `auth-flow`, `ams-sync`.
|
||||
- **Чистые фронтенды без бэкенда в этом репозитории**: `auth-flow`, `control-interface`, `cross-section`, `document-link`, `prescriptions`, `projects`, `remarks`, `reviews`, `stamp-verification`. Бэкенд `projects` живёт в `planning/projects-backend`.
|
||||
- Самые центральные сервисы по числу входящих ссылок: `documentations` (~85), `processing` / `workflow` (~76), `django` (~53), `eav` (~47), `resources` (~44), `bim` (~39), `flows` (~38). Менять их конфигурацию — дороже всего.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ spec:
|
||||
vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments
|
||||
vault.hashicorp.com/agent-inject-template-attachments-s3: |-
|
||||
{{- with secret "secrets/data/minio/apps/attachments" -}}
|
||||
YANDEX_S3_ENDPOINT_URL=10.133.0.245:9000
|
||||
YANDEX_S3_ENDPOINT_URL=s3-proxy.s3-proxy.svc.cluster.local
|
||||
YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
|
||||
YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
|
||||
YANDEX_S3_USE_SSL=false
|
||||
|
||||
@ -36,7 +36,7 @@ spec:
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend:contour_0570a1f1
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-frontend:prod_6dc6e0c2
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
|
||||
@ -8,105 +8,8 @@ spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/comparisons-api-v2:contour_9a2bab4e
|
||||
|
||||
deployment:
|
||||
port:
|
||||
_default: 8080
|
||||
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
set -a
|
||||
[ -f /vault/secrets/comparisons-db ] && . /vault/secrets/comparisons-db
|
||||
[ -f /vault/secrets/comparisons-jwt-public ] && export AUTH_PUBLIC_KEY="$(cat /vault/secrets/comparisons-jwt-public)"
|
||||
set +a
|
||||
cd /opt/comparisons
|
||||
./migrations up
|
||||
exec ./api
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: null
|
||||
memory: null
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
httpGet:
|
||||
port:
|
||||
_default: 8080
|
||||
readiness:
|
||||
httpGet:
|
||||
port:
|
||||
_default: 8080
|
||||
|
||||
service:
|
||||
targetPort:
|
||||
_default: 8080
|
||||
|
||||
envs:
|
||||
- name: APP_NAME
|
||||
value:
|
||||
_default: "comparisons-api-v2"
|
||||
|
||||
- name: APP_VERSION
|
||||
value:
|
||||
_default: "0.0.1"
|
||||
|
||||
- name: LOGGER_LOG_LEVEL
|
||||
value:
|
||||
_default: "info"
|
||||
|
||||
- name: DATABASE_NAME
|
||||
value:
|
||||
_default: "postgres"
|
||||
|
||||
- name: PGSSLMODE
|
||||
value:
|
||||
_default: "disable"
|
||||
|
||||
- name: HTTP_PORT
|
||||
value:
|
||||
_default: "8080"
|
||||
|
||||
- name: DOCUMENTATIONS_INTERNAL_HOST
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local"
|
||||
|
||||
- name: DOCUMENTATIONS_EXTERNAL_HOST
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local"
|
||||
|
||||
- name: WORKFLOWS_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.processing.svc.cluster.local"
|
||||
|
||||
- name: WORKFLOWS_IMAGE_VERSION
|
||||
value:
|
||||
_default: "master"
|
||||
|
||||
- name: WORKFLOWS_DJANGO_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com"
|
||||
|
||||
- name: WORKFLOWS_BIMV2_INTERNAL_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.bim.svc.cluster.local"
|
||||
|
||||
- name: WORKSPACES_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.workspaces.svc.cluster.local"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local"
|
||||
|
||||
- name: ABAP_FIXED_CONC
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: WORKFLOWS_CONFIG_FILEPATH
|
||||
value:
|
||||
_default: "/etc/app/tasks-execution-config.json"
|
||||
|
||||
@ -3,10 +3,6 @@ kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: tasks-execution-config.yaml
|
||||
target:
|
||||
kind: ConfigMap
|
||||
name: tasks-execution-config-comparisons-v2
|
||||
- path: backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
|
||||
@ -1,122 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: tasks-execution-config-comparisons-v2
|
||||
namespace: comparisons
|
||||
data:
|
||||
tasks-execution-config-comparisons-v2.json: |
|
||||
{
|
||||
"abap": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"bim2bim_comparison": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"bim_api_metadata_inserter_v2": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"bim_api_metadata_inserter_v4": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"bim_abap_updater": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"build_ooc": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"calculate_deviation_job": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"cloud_to_cloud": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"cloud_to_surface": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"convert_to_potree": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"deviation_icp": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"las_to_tiff": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"pdf_cv_comparer": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"pdf_georeferencing": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"split_pdf_document": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
},
|
||||
"webhook_caller": {
|
||||
"executor": "k8s",
|
||||
"resources": {
|
||||
"cpu_requests": "2",
|
||||
"memory_requests": "4Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -18,8 +18,10 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: debug
|
||||
image: cr.yandex/crp3ccidau046kdj8g9q/mc-files:dev5
|
||||
image: cr.yandex/crp3ccidau046kdj8g9q/mc-files:dev1
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["/bin/sh", "-c", "while true; do sleep 3600; done"]
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- while true; do sleep 3600; done
|
||||
imagePullSecrets:
|
||||
- name: regcred
|
||||
|
||||
@ -37,7 +37,7 @@ spec:
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/cross-section-app:contour_c5e5d476
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/cross-section-app:production_e09e648b
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
|
||||
@ -305,11 +305,6 @@ data:
|
||||
"uri": "/management/projects"
|
||||
},
|
||||
|
||||
{
|
||||
"name": "Справочники",
|
||||
"uri": "/assets"
|
||||
},
|
||||
|
||||
# {
|
||||
# "name": "Обзор",
|
||||
# "uri": "/projects"
|
||||
|
||||
@ -29,7 +29,7 @@ spec:
|
||||
enabled: true
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.30.1
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.3
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
deployment:
|
||||
|
||||
@ -8,9 +8,6 @@ spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
deployment:
|
||||
replicaCount:
|
||||
_default: 2
|
||||
envs:
|
||||
- name: ALLOWED_HOSTS
|
||||
value:
|
||||
|
||||
File diff suppressed because one or more lines are too long
@ -36,7 +36,7 @@ spec:
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_9dea5b64
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
|
||||
@ -65,7 +65,7 @@ spec:
|
||||
enabled: false
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_89c8039a
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
service:
|
||||
@ -89,9 +89,6 @@ spec:
|
||||
- name: POSTGRES_POOL_SIZE
|
||||
value:
|
||||
_default: "20"
|
||||
- name: CDE_API_ENABLED
|
||||
value:
|
||||
_default: "false"
|
||||
- name: USE_LEGACY_BIM_FLOW
|
||||
value:
|
||||
_default: "true"
|
||||
@ -239,9 +236,6 @@ spec:
|
||||
- name: VALKEY_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
- name: CDE_API_ENABLED
|
||||
value:
|
||||
_default: "false"
|
||||
podAnnotations:
|
||||
_default:
|
||||
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
|
||||
|
||||
@ -97,9 +97,6 @@ spec:
|
||||
- name: PUBLIC_LINK_FOLDER_CONNECTOR_ENABLED
|
||||
value:
|
||||
_default: "true"
|
||||
- name: CDE_API_ENABLED
|
||||
value:
|
||||
_default: "false"
|
||||
- name: USE_ZITADEL
|
||||
value:
|
||||
_default: "1"
|
||||
@ -226,9 +223,6 @@ spec:
|
||||
- name: VALKEY_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
- name: CDE_API_ENABLED
|
||||
value:
|
||||
_default: "false"
|
||||
podAnnotations:
|
||||
_default:
|
||||
traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
|
||||
|
||||
@ -37,7 +37,7 @@ spec:
|
||||
name:
|
||||
_default: pdf-markings-amqp
|
||||
replicaCount:
|
||||
_default: 2
|
||||
_default: 1
|
||||
port:
|
||||
_default: 8000
|
||||
command:
|
||||
@ -64,7 +64,7 @@ spec:
|
||||
enabled: false
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_9dea5b64
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
service:
|
||||
|
||||
@ -123,7 +123,7 @@ spec:
|
||||
_default: "false"
|
||||
- name: DRAWINGS_INTERNAL_URL
|
||||
value:
|
||||
_default: http://backend-service.drawings.svc.cluster.local:8000
|
||||
_default: http://drawings-api-service.drawings.svc.cluster.local:80
|
||||
- name: ATTACHMENTS_URL
|
||||
value:
|
||||
_default: http://attachments-service.attachments.svc.cluster.local:8000
|
||||
|
||||
@ -156,6 +156,3 @@ spec:
|
||||
- name: VALKEY_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
- name: CDE_API_ENABLED
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
@ -144,6 +144,3 @@ spec:
|
||||
- name: VALKEY_PORT
|
||||
value:
|
||||
_default: "6379"
|
||||
- name: CDE_API_ENABLED
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
@ -12,8 +12,4 @@ patches:
|
||||
- path: filestream.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: documentations-filestream
|
||||
- path: pdf-markings-amqp.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: documentations-pdf-markings-amqp
|
||||
name: documentations-filestream
|
||||
@ -1,62 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: documentations-pdf-markings-amqp
|
||||
namespace: documentations
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings:contour_ce9ed6d7
|
||||
|
||||
envs:
|
||||
- name: MARKS_APP__LOG_LEVEL
|
||||
value:
|
||||
_default: INFO
|
||||
|
||||
- name: MARKS_CRYPTO__HASHING_ALGO
|
||||
value:
|
||||
_default: md_gost12_256
|
||||
|
||||
- name: MARKS_QR__REDIRECT_URL
|
||||
value:
|
||||
_default: "https://sarex-stamp-verification.uralmine.com/"
|
||||
|
||||
- name: MARKS_QR__BASE_DOCUMENT_URL
|
||||
value:
|
||||
_default: "https://sarex.uralmine.com"
|
||||
|
||||
- name: MARKS_S3__REGION
|
||||
value:
|
||||
_default: ru-central1
|
||||
|
||||
- name: MARKS_S3__USE_SSL
|
||||
value:
|
||||
_default: "true"
|
||||
|
||||
- name: MARKS_S3__SSL_VERIFY
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: MARKS_S3__DEFAULT_BUCKET
|
||||
value:
|
||||
_default: documentations-marks
|
||||
|
||||
- name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
|
||||
value:
|
||||
_default: pdf_markings_input
|
||||
|
||||
- name: MARKS_RABBITMQ__HOST
|
||||
value:
|
||||
_default: rabbitmq.rabbitmq.svc.cluster.local
|
||||
|
||||
- name: MARKS_RABBITMQ__PORT
|
||||
value:
|
||||
_default: "5672"
|
||||
|
||||
- name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
|
||||
value:
|
||||
_default: "60"
|
||||
@ -36,7 +36,7 @@ spec:
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_0be18f51
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_98a23ef5
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
@ -134,10 +134,6 @@ spec:
|
||||
- name: POSTGRES_POOL_SIZE
|
||||
value:
|
||||
_default: "20"
|
||||
|
||||
- name: CDE_API_ENABLED
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: ZITADEL_ACCOUNT
|
||||
value:
|
||||
@ -219,13 +215,9 @@ spec:
|
||||
value:
|
||||
_default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
|
||||
|
||||
# Сервиса bim-api-service в контуре wb нет: в ns bim есть только
|
||||
# backend-service:8000 (bim v2), на него же BIM_API_URL смотрит в
|
||||
# brusnika-stage и asterus. Клиент bim-api (resty, retry 5 x 1s)
|
||||
# на неразрешимом DNS отваливался ровно за ~5 с.
|
||||
- name: BIM_API_URL
|
||||
value:
|
||||
_default: "http://backend-service.bim.svc.cluster.local:8000/"
|
||||
_default: "http://bim-api-service.bim.svc.cluster.local:8080/"
|
||||
|
||||
- name: BIM_API_V2_URL
|
||||
value:
|
||||
|
||||
@ -36,7 +36,7 @@ spec:
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_fef3add2
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_3f19a21d
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
@ -56,16 +56,13 @@ spec:
|
||||
limits:
|
||||
cpu:
|
||||
_default: 639m
|
||||
# Range-отдача BIM-моделей идёт стримом, но поверх неё работает
|
||||
# gorilla CompressHandler (gzip), и все поды регулярно уходили
|
||||
# в OOMKilled (exit 137) на 198Mi.
|
||||
memory:
|
||||
_default: 512Mi
|
||||
_default: 198Mi
|
||||
requests:
|
||||
cpu:
|
||||
_default: 50m
|
||||
memory:
|
||||
_default: 128Mi
|
||||
_default: 85Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
@ -137,10 +134,6 @@ spec:
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: "0.0.0.0:8080"
|
||||
|
||||
- name: CDE_API_ENABLED
|
||||
value:
|
||||
_default: "false"
|
||||
|
||||
- name: API_ADDRESS_FILE
|
||||
value:
|
||||
@ -198,13 +191,9 @@ spec:
|
||||
value:
|
||||
_default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
|
||||
|
||||
# Сервиса bim-api-service в контуре wb нет: в ns bim есть только
|
||||
# backend-service:8000 (bim v2), на него же BIM_API_URL смотрит в
|
||||
# brusnika-stage и asterus. Клиент bim-api (resty, retry 5 x 1s)
|
||||
# на неразрешимом DNS отваливался ровно за ~5 с.
|
||||
- name: BIM_API_URL
|
||||
value:
|
||||
_default: "http://backend-service.bim.svc.cluster.local:8000/"
|
||||
_default: "http://bim-api-service.bim.svc.cluster.local:8080/"
|
||||
|
||||
- name: BIM_API_V2_URL
|
||||
value:
|
||||
|
||||
@ -36,7 +36,7 @@ spec:
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_9dea5b64
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
|
||||
@ -1,46 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: drawings
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
envs:
|
||||
- name: POSTGRES_POOL_SIZE
|
||||
value:
|
||||
_default: "3"
|
||||
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: "0.0.0.0:8000"
|
||||
|
||||
- name: ENABLE_SSL
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: WORKFLOW_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.processing.svc.cluster.local/"
|
||||
|
||||
- name: IMAGE_NAME_EXPORT_TO_DWG
|
||||
value:
|
||||
_default: "cross-sections-to-dwg"
|
||||
|
||||
- name: IMAGE_TAG
|
||||
value:
|
||||
_default: "develop"
|
||||
|
||||
- name: TASK_VERSION
|
||||
value:
|
||||
_default: "1"
|
||||
|
||||
- name: DRAWING_INTERNAL_URL
|
||||
value:
|
||||
_default: "http://backend-service.drawings.svc.cluster.local:8000/"
|
||||
|
||||
- name: ATTACHMENT_URL
|
||||
value:
|
||||
_default: "http://attachments-service.attachments.svc.cluster.local:8000"
|
||||
@ -2,8 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
|
||||
@ -18,7 +18,7 @@ data:
|
||||
|
||||
# DEBUG SETTINGS START
|
||||
# ---------------------------------------------------------------------------------------------------------------------
|
||||
DEBUG = False
|
||||
DEBUG = True
|
||||
ALLOWED_HOSTS = ['*']
|
||||
# ---------------------------------------------------------------------------------------------------------------------
|
||||
# DEBUG SETTINGS END
|
||||
|
||||
@ -55,14 +55,14 @@ spec:
|
||||
resources:
|
||||
limits:
|
||||
cpu:
|
||||
_default: "1"
|
||||
_default: 23m
|
||||
memory:
|
||||
_default: 1Gi
|
||||
_default: 506Mi
|
||||
requests:
|
||||
cpu:
|
||||
_default: 100m
|
||||
_default: 12m
|
||||
memory:
|
||||
_default: 512Mi
|
||||
_default: 330Mi
|
||||
|
||||
probes:
|
||||
liveness:
|
||||
@ -97,23 +97,23 @@ spec:
|
||||
envs:
|
||||
- name: BASE_HOST
|
||||
value:
|
||||
_default: "http://frontend-service.django.svc.cluster.local:80"
|
||||
_default: "https://srx.wb.ru"
|
||||
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: "http://backend.django.svc.cluster.local:8000"
|
||||
_default: "https://srx.wb.ru"
|
||||
|
||||
- name: REVIEWS_HOST
|
||||
value:
|
||||
_default: "http://backend-service.flows.svc.cluster.local:8000"
|
||||
_default: "https://srx.wb.ru/flows"
|
||||
|
||||
- name: GATEWAY_HOST
|
||||
value:
|
||||
_default: "http://pdm-api.documentations.svc.cluster.local:8080"
|
||||
_default: "https://srx.wb.ru/gateway"
|
||||
|
||||
- name: DOCUMENTATIONS_HOST
|
||||
value:
|
||||
_default: "http://documentations-api.documentations.svc.cluster.local:8080"
|
||||
_default: "https://srx.wb.ru/documentations"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
@ -151,10 +151,6 @@ spec:
|
||||
value:
|
||||
_default: "180"
|
||||
|
||||
- name: GUNICORN_CMD_ARGS
|
||||
value:
|
||||
_default: "--timeout 3600 --graceful-timeout 30"
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
|
||||
@ -9,8 +9,6 @@ spec:
|
||||
services:
|
||||
backend:
|
||||
deployment:
|
||||
replicaCount:
|
||||
_default: 2
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
|
||||
@ -1,15 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: iams
|
||||
namespace: iam
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: iam-backend
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
@ -4,7 +4,6 @@ kind: Kustomization
|
||||
namespace: iam
|
||||
resources:
|
||||
- ../base
|
||||
- iams-service.yaml
|
||||
patches:
|
||||
- path: backend-s3.yaml
|
||||
target:
|
||||
|
||||
@ -1,15 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: iams
|
||||
namespace: iam
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: iam-backend
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
@ -3,7 +3,6 @@ kind: Kustomization
|
||||
namespace: iam
|
||||
resources:
|
||||
- ../base
|
||||
- iams-service.yaml
|
||||
patches:
|
||||
- path: backend-s3.yaml
|
||||
target:
|
||||
|
||||
@ -42,7 +42,7 @@ spec:
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/inspections-backend:contour_32f00e42
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_5fcce90d
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
|
||||
@ -122,7 +122,7 @@ data:
|
||||
"PUT",
|
||||
]
|
||||
|
||||
SAREX_API = os.getenv("SAREX_API", "https://srx.wb.ru")
|
||||
SAREX_API = "https://srx.wb.ru"
|
||||
|
||||
AERO_PUBLIC_HOST = os.getenv("AERO_PUBLIC_HOST", default=SAREX_API)
|
||||
|
||||
|
||||
@ -108,10 +108,6 @@ spec:
|
||||
# там SAREX_API переприсваивается после `from .base import *`.
|
||||
# См. apps/issues/d8-ugmk-prod/production-configmap.yaml (INFRA-3005).
|
||||
- name: SAREX_API
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_HOST
|
||||
value:
|
||||
_default: "https://sarex.uralmine.com"
|
||||
|
||||
|
||||
@ -102,10 +102,6 @@ spec:
|
||||
|
||||
# Реально действует значение из production-configmap, см. там.
|
||||
- name: SAREX_API
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_HOST
|
||||
value:
|
||||
_default: "https://sarex.uralmine.com"
|
||||
|
||||
|
||||
@ -1,5 +1,33 @@
|
||||
---
|
||||
|
||||
# ВНИМАНИЕ: data["production.py"] — одна строка, kustomize заменяет её ЦЕЛИКОМ,
|
||||
# поэтому здесь продублировано всё содержимое из
|
||||
# apps/issues/base/production-configmap.yaml (та же ловушка, что с envs).
|
||||
#
|
||||
# Зачем нужен этот патч:
|
||||
# production.py делает `from .base import *` (там всё через os.getenv), а затем
|
||||
# переприсваивает часть значений ХАРДКОДОМ — поэтому для этих переменных
|
||||
# ConfigMap ПОБЕЖДАЕТ env из HelmRelease, и правка env в оверлее
|
||||
# backend-s3.yaml/celery-s3.yaml сама по себе ни на что не влияет.
|
||||
#
|
||||
# INFRA-3005 (основная причина зависания экспорта в Excel):
|
||||
# в base хардкодом WORKFLOWS_HOST/WORKFLOWS_URL = workflows-api-service.workflow
|
||||
# — такого сервиса в УГМК нет. celery собирает xlsx, затем
|
||||
# ExportFinishedNotification → issues/mailing.py:122 делает POST на
|
||||
# {WORKFLOWS_HOST}/internal/v1/companies/{id}/workflows и падает с
|
||||
# ConnectionError (Name or service not known) — задача фейлится, фронт не
|
||||
# получает завершения и крутит загрузку бесконечно. Тем же путём с 26.08
|
||||
# падали ВСЕ уведомления (send_notification_on_create/on_update/
|
||||
# to_new_responsible/on_bulk_update, ~1770 ошибок).
|
||||
#
|
||||
# Отличия от base:
|
||||
# - WORKFLOWS_HOST / WORKFLOWS_URL → backend-svc.processing (через os.getenv,
|
||||
# чтобы env из оверлея снова начал работать)
|
||||
# - SAREX_API → https://sarex.uralmine.com (в base зашит https://srx.wb.ru)
|
||||
# - CORS/CSRF origins → https://sarex.uralmine.com (в base только lk.srx.wb.ru)
|
||||
# - убраны хардкоды KAFKA_USERNAME/KAFKA_PASSWORD/DJANGO_TOKEN и чужой
|
||||
# дефолт KAFKA_HOST: в УГМК всё это приходит из Vault
|
||||
# (см. podAnnotations в backend-s3.yaml / celery-s3.yaml / kafka-app.yaml)
|
||||
# - BASE_AERO_URL оставлен внутренним — он server-to-server
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
@ -118,9 +146,9 @@ data:
|
||||
|
||||
CORS_ALLOW_ALL_ORIGINS = True
|
||||
ENABLE_MAILGUN=False
|
||||
SMTP_PORT=587
|
||||
SMTP_HOST="post.uralmine.com"
|
||||
EMAIL_FROM="sarex@uralmine.com"
|
||||
SMTP_PORT=465
|
||||
SMTP_HOST="mail.rwb.ru"
|
||||
EMAIL_FROM="sarex@rwb.ru"
|
||||
|
||||
CORS_ALLOW_METHODS = [
|
||||
"DELETE",
|
||||
|
||||
149
apps/issues/uralkal/backend-s3.yaml
Normal file
149
apps/issues/uralkal/backend-s3.yaml
Normal file
@ -0,0 +1,149 @@
|
||||
---
|
||||
# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
|
||||
# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml.
|
||||
# podAnnotations — map, мержится по ключам.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: issues
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
deployment:
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
set -a
|
||||
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
|
||||
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
|
||||
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
|
||||
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
|
||||
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
|
||||
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
|
||||
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
|
||||
set +a
|
||||
exec /src/entrypoint.sh
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: production-configmap
|
||||
mountPath:
|
||||
_default: /src/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: production-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
- name: kafka-ca-cert
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
subPath:
|
||||
_default: kafka.crt
|
||||
readOnly:
|
||||
_default: true
|
||||
secret:
|
||||
secretName:
|
||||
_default: kafka-kafka-contour-tls
|
||||
items:
|
||||
- key: ca.crt
|
||||
path:
|
||||
_default: kafka.crt
|
||||
|
||||
envs:
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
_default: "production"
|
||||
|
||||
- name: AERO_PUBLIC_HOST
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: AERO_HOST
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: BASE_AERO_URL
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: BASE_AUTH_URL
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: WORKFLOWS_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.workflow.svc.cluster.local:80"
|
||||
|
||||
- name: WORKFLOWS_URL
|
||||
value:
|
||||
_default: "http://backend-svc.workflow.svc.cluster.local:80"
|
||||
|
||||
- name: RESOURCES_API_HOST
|
||||
value:
|
||||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_API
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: DOCUMENTATIONS_URL
|
||||
value:
|
||||
_default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
|
||||
|
||||
- name: DJANGO_SETTINGS_MODULE
|
||||
value:
|
||||
_default: "config.settings.production"
|
||||
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: "8000"
|
||||
|
||||
# Kafka — код (kafka_app/app.py) ждёт KAFKA_HOST единой строкой "host:port",
|
||||
# KAFKA_SSL_CAFILE — путь к файлу (не PEM-текст, в отличие от flows-backend).
|
||||
# Хост/порт/CA — те же проверенные значения, что у message-hub/pm/flows.
|
||||
- name: KAFKA_HOST
|
||||
value:
|
||||
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||||
|
||||
# Топики совпадают с тем, что уже провижено на брокере (см. topics
|
||||
# в секрете kafka/apps/pm) и с SETTINGS_TOPICS у message-hub.
|
||||
- name: KAFKA_ISSUES_TOPIC
|
||||
value:
|
||||
_default: "issues_broadcast_prod"
|
||||
|
||||
- name: KAFKA_EAV_ASSETS_TOPIC
|
||||
value:
|
||||
_default: "assets_broadcast"
|
||||
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-s3: |-
|
||||
{{- with secret "secrets/data/minio/apps/issues" -}}
|
||||
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
|
||||
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
|
||||
YC_S3_BUCKET_NAME=issues
|
||||
YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
|
||||
{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
|
||||
{{- with secret "secrets/data/kafka/apps/issues" -}}
|
||||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||||
{{- end -}}
|
||||
@ -8,145 +8,8 @@ spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_eb983275
|
||||
deployment:
|
||||
resources:
|
||||
requests:
|
||||
cpu: null
|
||||
memory: null
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
set -a
|
||||
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
|
||||
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
|
||||
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
|
||||
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
|
||||
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
|
||||
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
|
||||
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
|
||||
set +a
|
||||
exec /src/entrypoint.sh
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: production-configmap
|
||||
mountPath:
|
||||
_default: /src/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: production-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
- name: kafka-ca-cert
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
subPath:
|
||||
_default: kafka.crt
|
||||
readOnly:
|
||||
_default: true
|
||||
secret:
|
||||
secretName:
|
||||
_default: kafka-kafka-contour-tls
|
||||
items:
|
||||
- key: ca.crt
|
||||
path:
|
||||
_default: kafka.crt
|
||||
|
||||
envs:
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
_default: "production"
|
||||
|
||||
- name: AERO_PUBLIC_HOST
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: AERO_HOST
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: BASE_AERO_URL
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: BASE_AUTH_URL
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: WORKFLOWS_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.workflow.svc.cluster.local:80"
|
||||
|
||||
- name: WORKFLOWS_URL
|
||||
value:
|
||||
_default: "http://backend-svc.workflow.svc.cluster.local:80"
|
||||
|
||||
- name: RESOURCES_API_HOST
|
||||
value:
|
||||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_API
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com"
|
||||
|
||||
- name: DOCUMENTATIONS_URL
|
||||
value:
|
||||
_default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
|
||||
|
||||
- name: DJANGO_SETTINGS_MODULE
|
||||
value:
|
||||
_default: "config.settings.production"
|
||||
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: "8000"
|
||||
|
||||
- name: KAFKA_HOST
|
||||
value:
|
||||
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||||
|
||||
- name: KAFKA_ISSUES_TOPIC
|
||||
value:
|
||||
_default: "issues_broadcast_prod"
|
||||
|
||||
- name: KAFKA_EAV_ASSETS_TOPIC
|
||||
value:
|
||||
_default: "assets_broadcast"
|
||||
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-s3: |-
|
||||
{{- with secret "secrets/data/minio/apps/issues" -}}
|
||||
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
|
||||
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
|
||||
YC_S3_BUCKET_NAME=issues
|
||||
YC_S3_ENDPOINT_URL=http://10.133.0.245:9000
|
||||
{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
|
||||
{{- with secret "secrets/data/kafka/apps/issues" -}}
|
||||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||||
{{- end -}}
|
||||
|
||||
145
apps/issues/uralkal/celery-s3.yaml
Normal file
145
apps/issues/uralkal/celery-s3.yaml
Normal file
@ -0,0 +1,145 @@
|
||||
---
|
||||
# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch),
|
||||
# поэтому здесь продублирован весь набор из apps/issues/base/celery.yaml.
|
||||
# podAnnotations — map, мержится по ключам.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: celery
|
||||
namespace: issues
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
celery:
|
||||
deployment:
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
set -a
|
||||
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
|
||||
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
|
||||
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
|
||||
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
|
||||
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
|
||||
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
|
||||
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
|
||||
set +a
|
||||
exec celery -A config worker -l info -E
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: production-configmap
|
||||
mountPath:
|
||||
_default: /src/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: production-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
- name: kafka-ca-cert
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
subPath:
|
||||
_default: kafka.crt
|
||||
readOnly:
|
||||
_default: true
|
||||
secret:
|
||||
secretName:
|
||||
_default: kafka-kafka-contour-tls
|
||||
items:
|
||||
- key: ca.crt
|
||||
path:
|
||||
_default: kafka.crt
|
||||
|
||||
envs:
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
_default: "production"
|
||||
|
||||
- name: AERO_PUBLIC_HOST
|
||||
value:
|
||||
_default: "https://srx.wb.ru"
|
||||
|
||||
- name: AERO_HOST
|
||||
value:
|
||||
_default: "https://srx.wb.ru"
|
||||
|
||||
- name: BASE_AERO_URL
|
||||
value:
|
||||
_default: "https://srx.wb.ru"
|
||||
|
||||
- name: BASE_AUTH_URL
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: WORKFLOWS_HOST
|
||||
value:
|
||||
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
|
||||
|
||||
- name: WORKFLOWS_URL
|
||||
value:
|
||||
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
|
||||
|
||||
- name: RESOURCES_API_HOST
|
||||
value:
|
||||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_API
|
||||
value:
|
||||
_default: "https://srx.wb.ru"
|
||||
|
||||
- name: DOCUMENTATIONS_URL
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80"
|
||||
|
||||
- name: DJANGO_SETTINGS_MODULE
|
||||
value:
|
||||
_default: "config.settings.production"
|
||||
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: "8000"
|
||||
|
||||
# См. подробные комментарии в apps/issues/d8-ugmk-prod/backend-s3.yaml.
|
||||
- name: KAFKA_HOST
|
||||
value:
|
||||
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||||
|
||||
- name: KAFKA_ISSUES_TOPIC
|
||||
value:
|
||||
_default: "issues_broadcast_prod"
|
||||
|
||||
- name: KAFKA_EAV_ASSETS_TOPIC
|
||||
value:
|
||||
_default: "assets_broadcast"
|
||||
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-s3: |-
|
||||
{{- with secret "secrets/data/minio/apps/issues" -}}
|
||||
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
|
||||
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
|
||||
YC_S3_BUCKET_NAME=issues
|
||||
YC_S3_ENDPOINT_URL=http://s3-proxy.s3-proxy.svc.cluster.local
|
||||
{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
|
||||
{{- with secret "secrets/data/kafka/apps/issues" -}}
|
||||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||||
{{- end -}}
|
||||
@ -13,137 +13,3 @@ spec:
|
||||
requests:
|
||||
cpu: null
|
||||
memory: null
|
||||
args:
|
||||
_default:
|
||||
- |
|
||||
set -a
|
||||
[ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db
|
||||
[ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq
|
||||
[ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3
|
||||
[ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth
|
||||
[ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)"
|
||||
[ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)"
|
||||
[ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka
|
||||
set +a
|
||||
exec celery -A config worker -l info -E
|
||||
|
||||
volumes:
|
||||
_default:
|
||||
- name: production-configmap
|
||||
mountPath:
|
||||
_default: /src/config/settings/production.py
|
||||
subPath:
|
||||
_default: production.py
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: production-configmap
|
||||
items:
|
||||
- key: production.py
|
||||
path:
|
||||
_default: production.py
|
||||
- name: kafka-ca-cert
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
subPath:
|
||||
_default: kafka.crt
|
||||
readOnly:
|
||||
_default: true
|
||||
secret:
|
||||
secretName:
|
||||
_default: kafka-kafka-contour-tls
|
||||
items:
|
||||
- key: ca.crt
|
||||
path:
|
||||
_default: kafka.crt
|
||||
|
||||
envs:
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
_default: "production"
|
||||
|
||||
- name: AERO_PUBLIC_HOST
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: AERO_HOST
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: BASE_AERO_URL
|
||||
value:
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: BASE_AUTH_URL
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: WORKFLOWS_HOST
|
||||
value:
|
||||
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
|
||||
|
||||
- name: WORKFLOWS_URL
|
||||
value:
|
||||
_default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
|
||||
|
||||
- name: RESOURCES_API_HOST
|
||||
value:
|
||||
_default: "http://iam-backend.iam.svc.cluster.local:8000"
|
||||
|
||||
- name: EAV_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.eav.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_API
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com"
|
||||
|
||||
- name: DOCUMENTATIONS_URL
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local:80"
|
||||
|
||||
- name: DJANGO_SETTINGS_MODULE
|
||||
value:
|
||||
_default: "config.settings.production"
|
||||
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: "8000"
|
||||
|
||||
- name: KAFKA_HOST
|
||||
value:
|
||||
_default: "kafka-kafka-contour.kafka.svc.cluster.local:9092"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||||
|
||||
- name: KAFKA_ISSUES_TOPIC
|
||||
value:
|
||||
_default: "issues_broadcast_prod"
|
||||
|
||||
- name: KAFKA_EAV_ASSETS_TOPIC
|
||||
value:
|
||||
_default: "assets_broadcast"
|
||||
|
||||
podAnnotations:
|
||||
_default:
|
||||
vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-s3: |-
|
||||
{{- with secret "secrets/data/minio/apps/issues" -}}
|
||||
YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
|
||||
YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
|
||||
YC_S3_BUCKET_NAME=issues
|
||||
YC_S3_ENDPOINT_URL=http://10.133.0.245:9000
|
||||
{{- end -}}
|
||||
vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues
|
||||
vault.hashicorp.com/agent-inject-template-issues-kafka: |-
|
||||
{{- with secret "secrets/data/kafka/apps/issues" -}}
|
||||
KAFKA_USERNAME={{ index .Data.data "username" }}
|
||||
KAFKA_PASSWORD={{ index .Data.data "password" }}
|
||||
{{- end -}}
|
||||
|
||||
@ -3,6 +3,14 @@ kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: backend-s3.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
- path: celery-s3.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: celery
|
||||
- path: backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
|
||||
@ -96,11 +96,7 @@ spec:
|
||||
|
||||
- name: SAREX_API
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_HOST
|
||||
value:
|
||||
_default: "https://sarex.vadroad.ru"
|
||||
_default: "https://sarex.contour.infra.sarex.tech"
|
||||
|
||||
- name: DOCUMENTATIONS_URL
|
||||
value:
|
||||
|
||||
@ -96,11 +96,7 @@ spec:
|
||||
|
||||
- name: SAREX_API
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local:80"
|
||||
|
||||
- name: SAREX_HOST
|
||||
value:
|
||||
_default: "https://sarex.vadroad.ru"
|
||||
_default: "https://srx.wb.ru"
|
||||
|
||||
- name: DOCUMENTATIONS_URL
|
||||
value:
|
||||
|
||||
@ -12,6 +12,7 @@ data:
|
||||
|
||||
# DEBUG SETTINGS START
|
||||
# -----------------------------------------------------------------------------
|
||||
DEBUG = True
|
||||
# -----------------------------------------------------------------------------
|
||||
|
||||
TEST_MODE = False
|
||||
@ -39,7 +40,7 @@ data:
|
||||
|
||||
# DEBUG SETTINGS START
|
||||
# -----------------------------------------------------------------------------
|
||||
DEBUG = False
|
||||
DEBUG = True
|
||||
# -----------------------------------------------------------------------------
|
||||
|
||||
REVIEW_HOST='http://backend-service.flows.svc.cluster.local:8000'
|
||||
|
||||
@ -13,28 +13,3 @@ spec:
|
||||
requests:
|
||||
cpu: null
|
||||
memory: null
|
||||
|
||||
envs:
|
||||
- name: DOCUMENTATION_HOST
|
||||
value:
|
||||
_default: "http://backend-api-svc.documentations.svc.cluster.local/api/v1"
|
||||
|
||||
- name: FLOW_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.flows.svc.cluster.local/api/v1"
|
||||
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local/api"
|
||||
|
||||
- name: NOTE_HOST
|
||||
value:
|
||||
_default: "http://backend-service.notes.svc.cluster.local:8000/api/v1"
|
||||
|
||||
- name: REDIS_USE
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: TIMEOUT
|
||||
value:
|
||||
_default: "120"
|
||||
|
||||
@ -66,7 +66,7 @@ spec:
|
||||
enabled: false
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:preprod_c00faf6e
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/notes-backend:production_81366854
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
service:
|
||||
|
||||
@ -48,7 +48,7 @@ spec:
|
||||
enabled: false
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:contour_5ff34172
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/notes-frontend:production_0cb0909f
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
service:
|
||||
|
||||
@ -13,52 +13,3 @@ spec:
|
||||
requests:
|
||||
cpu: null
|
||||
memory: null
|
||||
|
||||
envs:
|
||||
- name: PG_SSL_MODE
|
||||
value:
|
||||
_default: "disable"
|
||||
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.django.svc.cluster.local"
|
||||
|
||||
- name: BASE_HOST
|
||||
value:
|
||||
_default: "https://sarex.local.uralkali.com/notes"
|
||||
|
||||
- name: TIMEOUT
|
||||
value:
|
||||
_default: "120"
|
||||
|
||||
- name: FAAS_SERVICE
|
||||
value:
|
||||
_default: "https://api.sarex.io/lambdas"
|
||||
|
||||
- name: WORKSPACE_URL
|
||||
value:
|
||||
_default: "http://backend-svc.workspaces.svc.cluster.local/api/v1"
|
||||
|
||||
- name: WORKFLOW_HOST
|
||||
value:
|
||||
_default: "http://backend-svc.processing.svc.cluster.local/api/v1"
|
||||
|
||||
- name: WORKFLOW_TAG
|
||||
value:
|
||||
_default: "stable"
|
||||
|
||||
- name: RESOURCE_URL
|
||||
value:
|
||||
_default: "https://api.sarex.io/resources/api/v1"
|
||||
|
||||
- name: SYNC_RESOURCE_ID
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: ENABLE_ND
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: ATTACHMENT_HOST
|
||||
value:
|
||||
_default: "http://attachments-service.attachments.svc.cluster.local:8000/api/v1"
|
||||
|
||||
@ -147,28 +147,6 @@ spec:
|
||||
value:
|
||||
_default: "/api/v1"
|
||||
|
||||
- name: KAFKA_ENABLE
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
- name: KAFKA_BOOTSTRAP_SERVERS
|
||||
value:
|
||||
_default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
|
||||
|
||||
- name: KAFKA_SECURITY_PROTOCOL
|
||||
value:
|
||||
_default: "SSL"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||||
|
||||
# Обязан совпадать с SETTINGS_TOPICS["planning"] в
|
||||
# apps/message-hub/wb/message-hub.yaml
|
||||
- name: KAFKA_TOPICS
|
||||
value:
|
||||
_default: '{"planning": "message-hub-prod"}'
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
|
||||
@ -141,26 +141,6 @@ spec:
|
||||
value:
|
||||
_default: "/api/v1"
|
||||
|
||||
- name: KAFKA_ENABLE
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
- name: KAFKA_BOOTSTRAP_SERVERS
|
||||
value:
|
||||
_default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
|
||||
|
||||
- name: KAFKA_SECURITY_PROTOCOL
|
||||
value:
|
||||
_default: "SSL"
|
||||
|
||||
- name: KAFKA_SSL_CAFILE
|
||||
value:
|
||||
_default: "/usr/local/share/ca-certificates/kafka.crt"
|
||||
|
||||
- name: KAFKA_TOPICS
|
||||
value:
|
||||
_default: '{"planning": "message-hub-prod"}'
|
||||
|
||||
commitSha: ""
|
||||
gitlabUri: ""
|
||||
gitlabJobUrl: ""
|
||||
|
||||
@ -1,31 +0,0 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: backend
|
||||
namespace: premises
|
||||
spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
deployment:
|
||||
resources:
|
||||
requests:
|
||||
cpu: null
|
||||
memory: null
|
||||
volumes:
|
||||
_default:
|
||||
- name: kafka-ca-cert
|
||||
mountPath:
|
||||
_default: /usr/local/share/ca-certificates/kafka.crt
|
||||
subPath:
|
||||
_default: kafka.crt
|
||||
readOnly:
|
||||
_default: true
|
||||
configMap:
|
||||
name:
|
||||
_default: kafka-ca-cert
|
||||
items:
|
||||
- key: kafka.crt
|
||||
path:
|
||||
_default: kafka.crt
|
||||
@ -1,27 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: kafka-ca-cert
|
||||
namespace: premises
|
||||
data:
|
||||
kafka.crt: |
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT
|
||||
MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw
|
||||
NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
|
||||
MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC
|
||||
h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy
|
||||
D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV
|
||||
tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM
|
||||
Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C
|
||||
GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC
|
||||
AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB
|
||||
Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA
|
||||
A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL
|
||||
QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP
|
||||
KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j
|
||||
kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j
|
||||
TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8
|
||||
fdA17/ibw6gFrH2b3vZKcx8D455V
|
||||
-----END CERTIFICATE-----
|
||||
@ -1,14 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
- kafka-ca-configmap.yaml
|
||||
patches:
|
||||
- path: namespace.yaml
|
||||
target:
|
||||
kind: Namespace
|
||||
name: premises
|
||||
- path: backend.yaml
|
||||
target:
|
||||
kind: HelmRelease
|
||||
name: backend
|
||||
@ -1,8 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: premises
|
||||
labels:
|
||||
istio-injection: enabled
|
||||
security.deckhouse.io/pod-policy: privileged
|
||||
@ -42,7 +42,7 @@ spec:
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_835b57c1
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_a03d37da-dirty2
|
||||
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
@ -111,10 +111,6 @@ spec:
|
||||
- name: POSTGRES_POOL_SIZE
|
||||
value:
|
||||
_default: "20"
|
||||
|
||||
- name: COMPARISONS_API_DB
|
||||
value:
|
||||
_default: "/etc/comparisons/comparisons-db-prod.json"
|
||||
|
||||
- name: ENVIRONMENT
|
||||
value:
|
||||
@ -131,20 +127,6 @@ spec:
|
||||
- name: API_ADDRESS
|
||||
value:
|
||||
_default: "0.0.0.0:8000"
|
||||
|
||||
- name: ENABLE_CROSS_SECTION_API_DB
|
||||
value:
|
||||
_default: "1"
|
||||
- name: CROSS_SECTION_API_DB
|
||||
value:
|
||||
_default: "/etc/cross_section/cross-section-api-db-prod.json"
|
||||
- name: CROSS_SECTION_API_DEBUG
|
||||
value:
|
||||
_default: "0"
|
||||
|
||||
- name: IGNORE_RESOURCES
|
||||
value:
|
||||
_default: "True"
|
||||
|
||||
- name: DJANGO_HOST
|
||||
value:
|
||||
|
||||
@ -8,9 +8,6 @@ spec:
|
||||
values:
|
||||
services:
|
||||
backend:
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:contour_7d2cd329
|
||||
deployment:
|
||||
resources:
|
||||
requests:
|
||||
|
||||
@ -35,7 +35,7 @@ spec:
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/remarks-frontend:contour_013c5091
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/remarks-frontend:wb_002f8896
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ spec:
|
||||
enabled: true
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_2da2a00e
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_828f1bfc
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
deployment:
|
||||
|
||||
@ -8,9 +8,6 @@ spec:
|
||||
values:
|
||||
services:
|
||||
frontend:
|
||||
image:
|
||||
name:
|
||||
_default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_1b5d64e4
|
||||
deployment:
|
||||
replicaCount:
|
||||
_default: 1
|
||||
@ -36,7 +36,7 @@ spec:
|
||||
|
||||
image:
|
||||
name:
|
||||
_default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_1b5d64e4
|
||||
_default: 10.4.10.187:80/library/workspaces-v2-frontend:contour_07373a45
|
||||
pullPolicy:
|
||||
_default: IfNotPresent
|
||||
|
||||
|
||||
@ -1,163 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
import argparse
|
||||
import io
|
||||
import subprocess
|
||||
import sys
|
||||
import tarfile
|
||||
from pathlib import Path, PurePosixPath
|
||||
|
||||
import yaml
|
||||
|
||||
FLUX_KUSTOMIZATION = "kustomize.toolkit.fluxcd.io"
|
||||
KUSTOMIZATION_FILES = ("kustomization.yaml", "kustomization.yml", "Kustomization")
|
||||
|
||||
|
||||
class SliceError(Exception):
|
||||
pass
|
||||
|
||||
|
||||
def is_remote(ref: str) -> bool:
|
||||
return "://" in ref or ref.startswith(("git@", "github.com/", "gitlab.com/"))
|
||||
|
||||
|
||||
def kustomization_file(directory: Path) -> Path | None:
|
||||
for name in KUSTOMIZATION_FILES:
|
||||
candidate = directory / name
|
||||
if candidate.is_file():
|
||||
return candidate
|
||||
return None
|
||||
|
||||
|
||||
def local_refs(doc: dict) -> list[str]:
|
||||
refs = []
|
||||
refs += doc.get("resources") or []
|
||||
refs += doc.get("components") or []
|
||||
refs += doc.get("patchesStrategicMerge") or []
|
||||
refs += [p["path"] for p in doc.get("patches") or [] if isinstance(p, dict) and "path" in p]
|
||||
for key in ("configMapGenerator", "secretGenerator"):
|
||||
for gen in doc.get(key) or []:
|
||||
for entry in (gen.get("files") or []) + (gen.get("envs") or []):
|
||||
refs.append(entry.split("=", 1)[-1])
|
||||
if gen.get("env"):
|
||||
refs.append(gen["env"])
|
||||
return [r for r in refs if isinstance(r, str)]
|
||||
|
||||
|
||||
def flux_paths(path: Path) -> list[str]:
|
||||
try:
|
||||
docs = list(yaml.safe_load_all(path.read_text()))
|
||||
except yaml.YAMLError:
|
||||
return []
|
||||
return [
|
||||
d["spec"]["path"]
|
||||
for d in docs
|
||||
if isinstance(d, dict)
|
||||
and str(d.get("apiVersion", "")).startswith(FLUX_KUSTOMIZATION)
|
||||
and d.get("kind") == "Kustomization"
|
||||
and d.get("spec", {}).get("path")
|
||||
]
|
||||
|
||||
|
||||
def collect(repo: Path, start: str) -> tuple[set[PurePosixPath], list[str]]:
|
||||
repo = repo.resolve()
|
||||
files: set[PurePosixPath] = set()
|
||||
entries: list[str] = []
|
||||
seen_dirs: set[Path] = set()
|
||||
|
||||
def rel(p: Path) -> PurePosixPath:
|
||||
try:
|
||||
return PurePosixPath(p.resolve().relative_to(repo).as_posix())
|
||||
except ValueError:
|
||||
raise SliceError(f"reference outside the repository: {p}")
|
||||
|
||||
def add_file(p: Path):
|
||||
r = rel(p)
|
||||
if r in files:
|
||||
return
|
||||
files.add(r)
|
||||
if p.suffix in (".yaml", ".yml"):
|
||||
for fp in flux_paths(p):
|
||||
visit_dir(repo / fp, entry=True)
|
||||
|
||||
def visit_dir(d: Path, entry: bool = False):
|
||||
d = d.resolve()
|
||||
if d in seen_dirs:
|
||||
return
|
||||
seen_dirs.add(d)
|
||||
kfile = kustomization_file(d)
|
||||
if kfile is None:
|
||||
raise SliceError(f"no kustomization.yaml in {rel(d)}")
|
||||
if entry:
|
||||
entries.append(str(rel(d)))
|
||||
add_file(kfile)
|
||||
doc = yaml.safe_load(kfile.read_text()) or {}
|
||||
for ref in local_refs(doc):
|
||||
if is_remote(ref):
|
||||
raise SliceError(f"remote reference {ref} in {rel(kfile)}")
|
||||
target = (d / ref)
|
||||
if target.is_dir():
|
||||
visit_dir(target)
|
||||
elif target.is_file():
|
||||
add_file(target)
|
||||
else:
|
||||
raise SliceError(f"reference {ref} in {rel(kfile)} does not exist")
|
||||
|
||||
visit_dir(repo / start, entry=True)
|
||||
return files, sorted(set(entries))
|
||||
|
||||
|
||||
def write_tar(repo: Path, files: set[PurePosixPath], out: Path):
|
||||
buf = io.BytesIO()
|
||||
with tarfile.open(fileobj=buf, mode="w", format=tarfile.PAX_FORMAT) as tar:
|
||||
for f in sorted(files):
|
||||
data = (repo / f).read_bytes()
|
||||
info = tarfile.TarInfo(str(f))
|
||||
info.size = len(data)
|
||||
info.mode = 0o644
|
||||
info.mtime = 0
|
||||
info.uid = info.gid = 0
|
||||
info.uname = info.gname = ""
|
||||
tar.addfile(info, io.BytesIO(data))
|
||||
out.write_bytes(buf.getvalue())
|
||||
|
||||
|
||||
def kustomize_build(path: Path) -> bytes:
|
||||
p = subprocess.run(["kubectl", "kustomize", str(path)], capture_output=True)
|
||||
if p.returncode != 0:
|
||||
raise SliceError(f"kustomize build {path} failed: {p.stderr.decode().strip()}")
|
||||
return p.stdout
|
||||
|
||||
|
||||
def verify(repo: Path, out: Path, entries: list[str]):
|
||||
import tempfile
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
with tarfile.open(out) as tar:
|
||||
tar.extractall(tmp, filter="data")
|
||||
for e in entries:
|
||||
if kustomize_build(repo / e) != kustomize_build(Path(tmp) / e):
|
||||
raise SliceError(f"kustomize build of {e} differs between slice and full repository")
|
||||
|
||||
|
||||
def main() -> int:
|
||||
ap = argparse.ArgumentParser()
|
||||
ap.add_argument("contour")
|
||||
ap.add_argument("--repo", default=".")
|
||||
ap.add_argument("--out", required=True)
|
||||
ap.add_argument("--no-verify", action="store_true")
|
||||
args = ap.parse_args()
|
||||
repo = Path(args.repo).resolve()
|
||||
out = Path(args.out)
|
||||
try:
|
||||
files, entries = collect(repo, f"clusters/{args.contour}")
|
||||
write_tar(repo, files, out)
|
||||
if not args.no_verify:
|
||||
verify(repo, out, entries)
|
||||
except SliceError as e:
|
||||
print(f"slice {args.contour}: {e}", file=sys.stderr)
|
||||
return 1
|
||||
print(f"slice {args.contour}: {len(files)} files, entry points: {', '.join(entries)}")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
@ -1,217 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
import argparse
|
||||
import base64
|
||||
import hashlib
|
||||
import importlib.util
|
||||
import json
|
||||
import re
|
||||
import sys
|
||||
import tempfile
|
||||
import time
|
||||
import urllib.error
|
||||
import urllib.parse
|
||||
import urllib.request
|
||||
from datetime import datetime, timezone
|
||||
from pathlib import Path
|
||||
|
||||
import yaml
|
||||
|
||||
spec = importlib.util.spec_from_file_location("build_slice", Path(__file__).with_name("build-slice.py"))
|
||||
bs = importlib.util.module_from_spec(spec)
|
||||
spec.loader.exec_module(bs)
|
||||
|
||||
REGISTRY_HOST = "cr.yandex"
|
||||
SLICE_REGISTRY = "crpct2b2lsmao4nm0cjk"
|
||||
CONFIG_TYPE = "application/vnd.sarex.slice.config.v1+json"
|
||||
LAYER_TYPE = "application/vnd.oci.image.layer.v1.tar"
|
||||
MANIFEST_TYPE = "application/vnd.oci.image.manifest.v1+json"
|
||||
JOB_IMAGE = "${CR}/infra/slice-builder:1.0.0"
|
||||
|
||||
|
||||
class PublishError(Exception):
|
||||
pass
|
||||
|
||||
|
||||
def digest(data: bytes) -> str:
|
||||
return "sha256:" + hashlib.sha256(data).hexdigest()
|
||||
|
||||
|
||||
def list_contours(repo: Path) -> list[str]:
|
||||
return sorted(p.parent.name for p in repo.glob("clusters/*/kustomization.yaml"))
|
||||
|
||||
|
||||
def child_pipeline(contours: list[str], release: str, commit: str) -> str:
|
||||
jobs: dict = {"stages": ["slices"]}
|
||||
for c in contours:
|
||||
jobs[f"slice {c}"] = {
|
||||
"stage": "slices",
|
||||
"image": JOB_IMAGE,
|
||||
"tags": ["build"],
|
||||
"allow_failure": True,
|
||||
"variables": {"GIT_DEPTH": "1"},
|
||||
"script": [
|
||||
"printf '%s' \"$SLICES_PUSHER_KEY\" | base64 -d > /tmp/slices-key.json",
|
||||
f"python3 ci/publish-slice.py publish --contour {c} --release {release} --commit {commit} --key-file /tmp/slices-key.json",
|
||||
],
|
||||
"after_script": ["rm -f /tmp/slices-key.json"],
|
||||
}
|
||||
if not contours:
|
||||
jobs["no contours"] = {"stage": "slices", "image": JOB_IMAGE, "tags": ["build"], "script": ["echo 'no clusters/*/kustomization.yaml found'"]}
|
||||
return yaml.safe_dump(jobs, sort_keys=False, allow_unicode=False)
|
||||
|
||||
|
||||
def build_manifest(layer: bytes, annotations: dict[str, str]) -> tuple[bytes, bytes]:
|
||||
config = b"{}"
|
||||
manifest = {
|
||||
"schemaVersion": 2,
|
||||
"mediaType": MANIFEST_TYPE,
|
||||
"config": {"mediaType": CONFIG_TYPE, "digest": digest(config), "size": len(config)},
|
||||
"layers": [{
|
||||
"mediaType": LAYER_TYPE,
|
||||
"digest": digest(layer),
|
||||
"size": len(layer),
|
||||
"annotations": {"org.opencontainers.image.title": "slice.tar"},
|
||||
}],
|
||||
"annotations": dict(sorted(annotations.items())),
|
||||
}
|
||||
return config, json.dumps(manifest, sort_keys=True, separators=(",", ":")).encode()
|
||||
|
||||
|
||||
class Registry:
|
||||
def __init__(self, username: str, password: str):
|
||||
self.base = f"https://{REGISTRY_HOST}"
|
||||
self.basic = "Basic " + base64.b64encode(f"{username}:{password}".encode()).decode()
|
||||
self.tokens: dict[str, str] = {}
|
||||
|
||||
def _send(self, method, url, data=None, headers=None):
|
||||
req = urllib.request.Request(url, data=data, method=method, headers=headers or {})
|
||||
try:
|
||||
with urllib.request.urlopen(req, timeout=60) as r:
|
||||
return r.status, dict(r.headers), r.read()
|
||||
except urllib.error.HTTPError as e:
|
||||
return e.code, dict(e.headers), e.read()
|
||||
|
||||
def _token(self, challenge: str, scope: str) -> str:
|
||||
params = dict(re.findall(r'(\w+)="([^"]*)"', challenge))
|
||||
realm = params.pop("realm")
|
||||
params["scope"] = scope
|
||||
status, _, body = self._send("GET", f"{realm}?{urllib.parse.urlencode(params)}", headers={"Authorization": self.basic})
|
||||
if status != 200:
|
||||
raise PublishError(f"registry auth failed: HTTP {status}")
|
||||
payload = json.loads(body)
|
||||
return payload.get("token") or payload.get("access_token")
|
||||
|
||||
def request(self, method, repo, path, data=None, headers=None):
|
||||
scope = f"repository:{repo}:pull,push"
|
||||
url = path if path.startswith("http") else f"{self.base}/v2/{repo}/{path}"
|
||||
headers = dict(headers or {})
|
||||
if scope in self.tokens:
|
||||
headers["Authorization"] = f"Bearer {self.tokens[scope]}"
|
||||
status, h, body = self._send(method, url, data, headers)
|
||||
if status == 401:
|
||||
challenge = {k.lower(): v for k, v in h.items()}.get("www-authenticate", "")
|
||||
self.tokens[scope] = self._token(challenge, scope)
|
||||
headers["Authorization"] = f"Bearer {self.tokens[scope]}"
|
||||
status, h, body = self._send(method, url, data, headers)
|
||||
return status, {k.lower(): v for k, v in h.items()}, body
|
||||
|
||||
def current_layer(self, repo: str) -> str | None:
|
||||
status, _, body = self.request("GET", repo, "manifests/current", headers={"Accept": MANIFEST_TYPE})
|
||||
if status == 404:
|
||||
return None
|
||||
if status != 200:
|
||||
raise PublishError(f"{repo}:current: HTTP {status}")
|
||||
return json.loads(body)["layers"][0]["digest"]
|
||||
|
||||
def put_blob(self, repo: str, data: bytes) -> bool:
|
||||
d = digest(data)
|
||||
if self.request("HEAD", repo, f"blobs/{d}")[0] == 200:
|
||||
return False
|
||||
status, h, _ = self.request("POST", repo, "blobs/uploads/")
|
||||
if status != 202:
|
||||
raise PublishError(f"blob upload to {repo}: HTTP {status}")
|
||||
location = h["location"]
|
||||
if location.startswith("/"):
|
||||
location = self.base + location
|
||||
sep = "&" if "?" in location else "?"
|
||||
status, _, _ = self.request("PUT", repo, f"{location}{sep}digest={d}", data, {"Content-Type": "application/octet-stream"})
|
||||
if status != 201:
|
||||
raise PublishError(f"blob upload to {repo}: HTTP {status}")
|
||||
return True
|
||||
|
||||
def push(self, repo: str, tags: list[str], layer: bytes, annotations: dict[str, str]) -> bool:
|
||||
config, manifest = build_manifest(layer, annotations)
|
||||
self.put_blob(repo, config)
|
||||
uploaded = self.put_blob(repo, layer)
|
||||
for tag in tags:
|
||||
status, _, body = self.request("PUT", repo, f"manifests/{tag}", manifest, {"Content-Type": MANIFEST_TYPE})
|
||||
if status != 201:
|
||||
raise PublishError(f"{repo}:{tag}: HTTP {status} {body[:200]!r}")
|
||||
return uploaded
|
||||
|
||||
|
||||
def log(msg: str):
|
||||
print(f"[{time.strftime('%H:%M:%S')}] {msg}", flush=True)
|
||||
|
||||
|
||||
def publish(repo: Path, contour: str, release: str, commit: str, key_file: Path) -> int:
|
||||
target = f"{SLICE_REGISTRY}/{contour}-iac"
|
||||
log(f"contour {contour}, source iac@{commit[:8]}, release {release}")
|
||||
try:
|
||||
with tempfile.TemporaryDirectory() as tmp:
|
||||
out = Path(tmp) / "slice.tar"
|
||||
files, entries = bs.collect(repo, f"clusters/{contour}")
|
||||
log(f"collected {len(files)} files, entry points: {', '.join(entries)}")
|
||||
bs.write_tar(repo, files, out)
|
||||
bs.verify(repo, out, entries)
|
||||
log(f"verified: kustomize build of {len(entries)} entry point(s) identical to full repository")
|
||||
layer = out.read_bytes()
|
||||
new = digest(layer)
|
||||
log(f"slice size {len(layer)} bytes, digest {new}")
|
||||
registry = Registry("json_key", key_file.read_text())
|
||||
current = registry.current_layer(f"{target}")
|
||||
changed = current != new
|
||||
log(f"registry {REGISTRY_HOST}/{target}, current " + (current or "absent") + (", content changed" if changed else ", content unchanged"))
|
||||
tags = [commit[:8], release] + (["current"] if changed else [])
|
||||
uploaded = registry.push(target, tags, layer, {
|
||||
"org.opencontainers.image.source": "iac",
|
||||
"org.opencontainers.image.revision": commit,
|
||||
"org.opencontainers.image.version": release,
|
||||
"org.opencontainers.image.created": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
|
||||
"io.sarex.slice.contour": contour,
|
||||
"io.sarex.slice.kind": "iac",
|
||||
})
|
||||
log(f"layer {'uploaded' if uploaded else 'already in registry'}, tags pushed: {', '.join(tags)}")
|
||||
except (bs.SliceError, PublishError) as e:
|
||||
log(f"FAILED: {e}")
|
||||
return 1
|
||||
log("done")
|
||||
return 0
|
||||
|
||||
|
||||
def main() -> int:
|
||||
ap = argparse.ArgumentParser()
|
||||
sub = ap.add_subparsers(dest="cmd", required=True)
|
||||
gen = sub.add_parser("generate")
|
||||
gen.add_argument("--repo", default=".")
|
||||
gen.add_argument("--release", required=True)
|
||||
gen.add_argument("--commit", required=True)
|
||||
gen.add_argument("--out", required=True)
|
||||
pub = sub.add_parser("publish")
|
||||
pub.add_argument("--repo", default=".")
|
||||
pub.add_argument("--contour", required=True)
|
||||
pub.add_argument("--release", required=True)
|
||||
pub.add_argument("--commit", required=True)
|
||||
pub.add_argument("--key-file", required=True)
|
||||
args = ap.parse_args()
|
||||
repo = Path(args.repo).resolve()
|
||||
if args.cmd == "generate":
|
||||
contours = list_contours(repo)
|
||||
Path(args.out).write_text(child_pipeline(contours, args.release, args.commit))
|
||||
log(f"{len(contours)} contours: {', '.join(contours)}")
|
||||
return 0
|
||||
return publish(repo, args.contour, args.release, args.commit, Path(args.key_file))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
@ -1,93 +0,0 @@
|
||||
import importlib.util
|
||||
import tarfile
|
||||
from pathlib import Path
|
||||
|
||||
import pytest
|
||||
import yaml
|
||||
|
||||
spec = importlib.util.spec_from_file_location("build_slice", Path(__file__).parents[1] / "build-slice.py")
|
||||
bs = importlib.util.module_from_spec(spec)
|
||||
spec.loader.exec_module(bs)
|
||||
|
||||
|
||||
def put(root: Path, rel: str, text: str):
|
||||
p = root / rel
|
||||
p.parent.mkdir(parents=True, exist_ok=True)
|
||||
p.write_text(text)
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def repo(tmp_path):
|
||||
put(tmp_path, "clusters/a/kustomization.yaml", "resources:\n - ./flux-system\n - ./layers.yaml\n")
|
||||
put(tmp_path, "clusters/a/flux-system/kustomization.yaml", "resources:\n - gotk-sync.yaml\n")
|
||||
put(tmp_path, "clusters/a/flux-system/gotk-sync.yaml",
|
||||
"apiVersion: kustomize.toolkit.fluxcd.io/v1\nkind: Kustomization\nspec:\n path: ./clusters/a\n")
|
||||
put(tmp_path, "clusters/a/layers.yaml",
|
||||
"apiVersion: kustomize.toolkit.fluxcd.io/v1\nkind: Kustomization\nspec:\n path: ./layers/a/00-vault\n")
|
||||
put(tmp_path, "layers/a/00-vault/kustomization.yaml", "resources:\n - ../../../infrastructure/vault/contour-template\n")
|
||||
put(tmp_path, "infrastructure/vault/contour-template/kustomization.yaml",
|
||||
"resources:\n - ../base\npatches:\n - path: vault.yaml\n")
|
||||
put(tmp_path, "infrastructure/vault/contour-template/vault.yaml", "kind: HelmRelease\n")
|
||||
put(tmp_path, "infrastructure/vault/base/kustomization.yaml", "resources:\n - helmrelease.yaml\n")
|
||||
put(tmp_path, "infrastructure/vault/base/helmrelease.yaml", "kind: HelmRelease\n")
|
||||
put(tmp_path, "infrastructure/vault/base/unused.yaml", "kind: ConfigMap\n")
|
||||
put(tmp_path, "infrastructure/vault/uralkal/kustomization.yaml", "resources:\n - ../base\n")
|
||||
put(tmp_path, "clusters/b/kustomization.yaml", "resources:\n - ../../infrastructure/vault/uralkal\n")
|
||||
return tmp_path
|
||||
|
||||
|
||||
def test_slice_follows_flux_paths_and_skips_foreign(repo):
|
||||
files, entries = bs.collect(repo, "clusters/a")
|
||||
names = {str(f) for f in files}
|
||||
assert "infrastructure/vault/base/helmrelease.yaml" in names
|
||||
assert "infrastructure/vault/contour-template/vault.yaml" in names
|
||||
assert "layers/a/00-vault/kustomization.yaml" in names
|
||||
assert not any("uralkal" in n or n.startswith("clusters/b") for n in names)
|
||||
assert "infrastructure/vault/base/unused.yaml" not in names
|
||||
assert entries == ["clusters/a", "layers/a/00-vault"]
|
||||
|
||||
|
||||
def test_remote_reference_stops_build(repo):
|
||||
put(repo, "clusters/a/kustomization.yaml", "resources:\n - https://github.com/x/y//z\n")
|
||||
with pytest.raises(bs.SliceError, match="remote reference"):
|
||||
bs.collect(repo, "clusters/a")
|
||||
|
||||
|
||||
def test_dangling_reference_stops_build(repo):
|
||||
put(repo, "clusters/a/kustomization.yaml", "resources:\n - ./missing.yaml\n")
|
||||
with pytest.raises(bs.SliceError, match="does not exist"):
|
||||
bs.collect(repo, "clusters/a")
|
||||
|
||||
|
||||
def test_tar_is_byte_identical_across_runs(repo, tmp_path_factory):
|
||||
files, _ = bs.collect(repo, "clusters/a")
|
||||
out1 = tmp_path_factory.mktemp("o") / "s.tar"
|
||||
out2 = tmp_path_factory.mktemp("o") / "s.tar"
|
||||
bs.write_tar(repo, files, out1)
|
||||
(repo / "clusters/a/layers.yaml").touch()
|
||||
bs.write_tar(repo, files, out2)
|
||||
assert out1.read_bytes() == out2.read_bytes()
|
||||
with tarfile.open(out1) as t:
|
||||
assert all(m.mtime == 0 for m in t.getmembers())
|
||||
|
||||
|
||||
|
||||
pspec = importlib.util.spec_from_file_location("publish_slice", Path(__file__).parents[1] / "publish-slice.py")
|
||||
ps = importlib.util.module_from_spec(pspec)
|
||||
pspec.loader.exec_module(ps)
|
||||
|
||||
|
||||
def test_every_cluster_with_kustomization_is_a_contour(tmp_path):
|
||||
put(tmp_path, "clusters/stand/kustomization.yaml", "resources: []\n")
|
||||
put(tmp_path, "clusters/vad/kustomization.yaml", "resources: []\n")
|
||||
put(tmp_path, "clusters/contour/apps.yaml", "kind: Kustomization\n")
|
||||
assert ps.list_contours(tmp_path) == ["stand", "vad"]
|
||||
|
||||
|
||||
def test_child_pipeline_has_one_job_per_contour():
|
||||
doc = yaml.safe_load(ps.child_pipeline(["stand", "vad"], "3.9.68", "abcdef1234"))
|
||||
jobs = {k: v for k, v in doc.items() if k != "stages"}
|
||||
assert sorted(jobs) == ["slice stand", "slice vad"]
|
||||
assert all(j["allow_failure"] for j in jobs.values())
|
||||
assert "--contour vad --release 3.9.68 --commit abcdef1234" in jobs["slice vad"]["script"][1]
|
||||
assert all(ord(ch) < 128 for ch in ps.child_pipeline(["stand"], "1.0.0", "a" * 40))
|
||||
@ -47,7 +47,6 @@ resources:
|
||||
- ../../apps/document-link/d8-ugmk-prod
|
||||
- ../../apps/bim/d8-ugmk-prod
|
||||
- ../../apps/cde/d8-ugmk-prod
|
||||
- ../../apps/premises/d8-ugmk-prod
|
||||
- ../../apps/flows/d8-ugmk-prod
|
||||
- ../../apps/inspections/d8-ugmk-prod
|
||||
- ../../apps/issues/d8-ugmk-prod
|
||||
|
||||
@ -1,14 +0,0 @@
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: yc-oci-charts
|
||||
namespace: flux-system
|
||||
spec:
|
||||
type: oci
|
||||
interval: 10m0s
|
||||
url: ${CHART_REPO:=oci://cr.yandex/crp3ccidau046kdj8g9q/charts}
|
||||
secretRef:
|
||||
name: ${CHART_REPO_SECRET:=yc-cr-auth}
|
||||
certSecretRef:
|
||||
name: chart-repo-ca
|
||||
@ -1,5 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./helm-repositories.yaml
|
||||
- ../../../infrastructure/vault/contour-template
|
||||
@ -1,7 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../../../infrastructure/istio-base/contour-template
|
||||
- ../../../infrastructure/istio-pilot/contour-template
|
||||
- ../../../infrastructure/istio-gateway/contour-template
|
||||
- ../../../infrastructure/cert-manager/contour-template
|
||||
@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../../../infrastructure/postgresql/contour-template
|
||||
- ../../../infrastructure/kafka/contour-template
|
||||
- ../../../infrastructure/rabbitmq/contour-template
|
||||
@ -1,5 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../../../infrastructure/zitadel/contour-template
|
||||
- ../../../infrastructure/camunda/contour-template
|
||||
@ -1,4 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../../../infrastructure/istio-config/contour-template
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,25 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: GitRepository
|
||||
metadata:
|
||||
name: flux-system
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
ref:
|
||||
branch: main
|
||||
url: http://gitea.gitea.svc:3000/infra/iac.git
|
||||
secretRef:
|
||||
name: flux-system
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: flux-system
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 10m0s
|
||||
path: ./clusters/stand
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
@ -1,13 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- gotk-components.yaml
|
||||
- gotk-sync.yaml
|
||||
patches:
|
||||
- target:
|
||||
kind: Deployment
|
||||
name: kustomize-controller
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/args/-
|
||||
value: --feature-gates=CancelHealthCheckOnNewRevision=true
|
||||
@ -1,5 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./flux-system
|
||||
- ./layers.yaml
|
||||
@ -1,93 +0,0 @@
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: 00-vault
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 10m0s
|
||||
timeout: 10m0s
|
||||
path: ./clusters/stand/00-vault
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
postBuild:
|
||||
substituteFrom:
|
||||
- kind: ConfigMap
|
||||
name: contour-vars
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: 10-mesh
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 10m0s
|
||||
timeout: 15m0s
|
||||
path: ./clusters/stand/10-mesh
|
||||
prune: true
|
||||
wait: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
postBuild:
|
||||
substituteFrom:
|
||||
- kind: ConfigMap
|
||||
name: contour-vars
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: 20-data
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 10m0s
|
||||
timeout: 20m0s
|
||||
path: ./clusters/stand/20-data
|
||||
prune: true
|
||||
wait: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
postBuild:
|
||||
substituteFrom:
|
||||
- kind: ConfigMap
|
||||
name: contour-vars
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: 30-platform
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 10m0s
|
||||
timeout: 35m0s
|
||||
path: ./clusters/stand/30-platform
|
||||
prune: true
|
||||
wait: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
postBuild:
|
||||
substituteFrom:
|
||||
- kind: ConfigMap
|
||||
name: contour-vars
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: 40-routing
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 10m0s
|
||||
timeout: 10m0s
|
||||
path: ./clusters/stand/40-routing
|
||||
prune: true
|
||||
wait: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
postBuild:
|
||||
substituteFrom:
|
||||
- kind: ConfigMap
|
||||
name: contour-vars
|
||||
@ -12,4 +12,3 @@ resources:
|
||||
- ../../../infrastructure/kb/vk-infra
|
||||
- ../../../infrastructure/gitlab-runner/vk-infra
|
||||
- ../../../infrastructure/nexus/vk-infra
|
||||
- ../../../infrastructure/outline/vk-infra
|
||||
|
||||
@ -12,4 +12,3 @@ resources:
|
||||
- ../../../infrastructure/valkey/vk-prod
|
||||
- ../../../infrastructure/clickhouse/vk-prod
|
||||
- ../../../infrastructure/camunda/vk-prod
|
||||
- ../../../infrastructure/spicedb/vk-prod
|
||||
|
||||
@ -137,25 +137,6 @@ spec:
|
||||
prefix: /
|
||||
service: goalert.goalert.svc.cluster.local
|
||||
port: 8081
|
||||
# Без этого VS /bimv2/api/* попадает в catch-all "/" фронта
|
||||
# (django/vs-sarex-frontend) и отдаёт 200 с HTML вместо JSON.
|
||||
bim-backend-v2:
|
||||
namespace: bim
|
||||
hosts:
|
||||
- srx.wb.ru
|
||||
- lk.srx.wb.ru
|
||||
gateways:
|
||||
- istio-system/main-gateway
|
||||
cors:
|
||||
allowOrigins:
|
||||
- exact: https://srx.wb.ru
|
||||
- exact: https://lk.srx.wb.ru
|
||||
routes:
|
||||
- path:
|
||||
prefix: /bimv2/api/
|
||||
rewrite: /api/
|
||||
service: backend-service.bim.svc.cluster.local
|
||||
port: 8000
|
||||
vault-vs:
|
||||
namespace: vault
|
||||
hosts:
|
||||
|
||||
@ -1,354 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: camunda
|
||||
namespace: camunda
|
||||
spec:
|
||||
dependsOn: []
|
||||
interval: 5m
|
||||
timeout: 30m
|
||||
waitStrategy:
|
||||
name: legacy
|
||||
postRenderers:
|
||||
- kustomize:
|
||||
patches:
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
dedicated: processing
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value:
|
||||
- key: dedicated
|
||||
operator: Equal
|
||||
value: processing
|
||||
effect: NoSchedule
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: StatefulSet
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
dedicated: processing
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value:
|
||||
- key: dedicated
|
||||
operator: Equal
|
||||
value: processing
|
||||
effect: NoSchedule
|
||||
- target:
|
||||
group: batch
|
||||
version: v1
|
||||
kind: Job
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
dedicated: processing
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value:
|
||||
- key: dedicated
|
||||
operator: Equal
|
||||
value: processing
|
||||
effect: NoSchedule
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
name: camunda-connectors
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
dedicated: processing
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value:
|
||||
- key: dedicated
|
||||
operator: Equal
|
||||
value: processing
|
||||
effect: NoSchedule
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
name: camunda-identity
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
dedicated: processing
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value:
|
||||
- key: dedicated
|
||||
operator: Equal
|
||||
value: processing
|
||||
effect: NoSchedule
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
name: camunda-operate
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
dedicated: processing
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value:
|
||||
- key: dedicated
|
||||
operator: Equal
|
||||
value: processing
|
||||
effect: NoSchedule
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
name: camunda-optimize
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
dedicated: processing
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value:
|
||||
- key: dedicated
|
||||
operator: Equal
|
||||
value: processing
|
||||
effect: NoSchedule
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
name: camunda-tasklist
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
dedicated: processing
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value:
|
||||
- key: dedicated
|
||||
operator: Equal
|
||||
value: processing
|
||||
effect: NoSchedule
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
name: camunda-zeebe-gateway
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
dedicated: processing
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value:
|
||||
- key: dedicated
|
||||
operator: Equal
|
||||
value: processing
|
||||
effect: NoSchedule
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: StatefulSet
|
||||
name: camunda-zeebe
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
dedicated: processing
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value:
|
||||
- key: dedicated
|
||||
operator: Equal
|
||||
value: processing
|
||||
effect: NoSchedule
|
||||
values:
|
||||
global:
|
||||
vault:
|
||||
enabled: true
|
||||
role: camunda-contour
|
||||
authPath: auth/kubernetes
|
||||
secrets:
|
||||
postgresql:
|
||||
path: secrets/data/camunda/identity-db
|
||||
keys:
|
||||
password: password
|
||||
postgresPassword: password
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: regcred
|
||||
identity:
|
||||
auth:
|
||||
publicIssuerUrl: "https://${HOST_CAMUNDA_KEYCLOAK}/auth/realms/camunda-platform"
|
||||
identity:
|
||||
redirectUrl: "https://${HOST_CAMUNDA_IDENTITY}"
|
||||
operate:
|
||||
redirectUrl: "https://${HOST_CAMUNDA}"
|
||||
tasklist:
|
||||
redirectUrl: "https://${HOST_CAMUNDA_TASKLIST}"
|
||||
optimize:
|
||||
redirectUrl: "https://${HOST_CAMUNDA_OPTIMIZE}"
|
||||
identityPostgresql:
|
||||
enabled: false
|
||||
auth:
|
||||
usePasswordFiles: true
|
||||
primary:
|
||||
automountServiceAccountToken: true
|
||||
persistence:
|
||||
size: 10Gi
|
||||
storageClass: ${STORAGE_CLASS}
|
||||
identityKeycloak:
|
||||
externalDatabase:
|
||||
host: pg-host.storage.svc.cluster.local
|
||||
port: 5432
|
||||
user: bn_keycloak
|
||||
database: bitnami_keycloak
|
||||
password: ""
|
||||
existingSecret: ""
|
||||
existingSecretPasswordKey: password
|
||||
postgresql:
|
||||
enabled: false
|
||||
auth:
|
||||
usePasswordFiles: true
|
||||
primary:
|
||||
automountServiceAccountToken: true
|
||||
persistence:
|
||||
size: 10Gi
|
||||
storageClass: ${STORAGE_CLASS}
|
||||
vaultEnv:
|
||||
enabled: true
|
||||
role: camunda-contour
|
||||
authPath: auth/kubernetes
|
||||
envFiles:
|
||||
KEYCLOAK_ADMIN_PASSWORD:
|
||||
path: secrets/data/camunda/keycloak-admin
|
||||
key: admin-password
|
||||
KEYCLOAK_PASSWORD:
|
||||
path: secrets/data/camunda/keycloak-admin
|
||||
key: admin-password
|
||||
KEYCLOAK_DATABASE_PASSWORD:
|
||||
path: secrets/data/camunda/keycloak-db
|
||||
key: password
|
||||
global:
|
||||
storageClass: ${STORAGE_CLASS}
|
||||
tolerations: []
|
||||
elasticsearch:
|
||||
sysctlImage:
|
||||
registry: cr.yandex
|
||||
repository: crp3ccidau046kdj8g9q/contour/camunda/os-shell
|
||||
tag: 12-debian-12-r32
|
||||
pullSecrets:
|
||||
- regcred
|
||||
master:
|
||||
replicaCount: 1
|
||||
podAntiAffinityPreset: soft
|
||||
persistence:
|
||||
size: 10Gi
|
||||
storageClass: ${STORAGE_CLASS}
|
||||
tolerations: []
|
||||
metrics:
|
||||
enabled: false
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
tolerations: []
|
||||
camundaCanary:
|
||||
enabled: false
|
||||
prometheusServiceMonitor:
|
||||
enabled: false
|
||||
console:
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: regcred
|
||||
tolerations: []
|
||||
zeebe:
|
||||
clusterSize: "1"
|
||||
partitionCount: "1"
|
||||
replicationFactor: "1"
|
||||
pvcStorageClassName: ${STORAGE_CLASS}
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: regcred
|
||||
tolerations: []
|
||||
zeebeGateway:
|
||||
replicas: 1
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: regcred
|
||||
tolerations: []
|
||||
identity:
|
||||
fullURL: "https://${HOST_CAMUNDA_IDENTITY}"
|
||||
externalDatabase:
|
||||
enabled: true
|
||||
host: pg-host.storage.svc.cluster.local
|
||||
port: 5432
|
||||
username: identity
|
||||
database: identity
|
||||
password: ""
|
||||
existingSecret: ""
|
||||
existingSecretPasswordKey: password
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: regcred
|
||||
tolerations: []
|
||||
operate:
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: regcred
|
||||
serviceAccount:
|
||||
automountServiceAccountToken: true
|
||||
tolerations: []
|
||||
tasklist:
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: regcred
|
||||
serviceAccount:
|
||||
automountServiceAccountToken: true
|
||||
tolerations: []
|
||||
optimize:
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: regcred
|
||||
serviceAccount:
|
||||
automountServiceAccountToken: true
|
||||
tolerations: []
|
||||
executionIdentity:
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: regcred
|
||||
tolerations: []
|
||||
webModeler:
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: regcred
|
||||
restapi:
|
||||
tolerations: []
|
||||
webapp:
|
||||
tolerations: []
|
||||
websockets:
|
||||
tolerations: []
|
||||
connectors:
|
||||
image:
|
||||
pullSecrets:
|
||||
- name: regcred
|
||||
serviceAccount:
|
||||
automountServiceAccountToken: true
|
||||
tolerations: []
|
||||
@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: camunda.yaml
|
||||
@ -147,24 +147,6 @@ spec:
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value: []
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: StatefulSet
|
||||
namespace: camunda
|
||||
name: camunda-elasticsearch-master
|
||||
patch: |-
|
||||
- op: add
|
||||
path: /spec/template/spec/nodeSelector
|
||||
value:
|
||||
node.deckhouse.io/group: processing
|
||||
- op: add
|
||||
path: /spec/template/spec/tolerations
|
||||
value:
|
||||
- key: dedicated.processing
|
||||
operator: Equal
|
||||
value: processing
|
||||
effect: NoExecute
|
||||
values:
|
||||
global:
|
||||
vault:
|
||||
@ -251,16 +233,6 @@ spec:
|
||||
master:
|
||||
replicaCount: 1
|
||||
podAntiAffinityPreset: soft
|
||||
heapSize: 7g
|
||||
extraEnvVars:
|
||||
- name: ELASTICSEARCH_ENABLE_REST_TLS
|
||||
value: "false"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 1
|
||||
memory: 12Gi
|
||||
limits:
|
||||
memory: 12Gi
|
||||
persistence:
|
||||
size: 10Gi
|
||||
storageClass: nfs01
|
||||
@ -332,32 +304,6 @@ spec:
|
||||
serviceAccount:
|
||||
automountServiceAccountToken: true
|
||||
tolerations: []
|
||||
configuration: |
|
||||
zeebe:
|
||||
enabled: true
|
||||
partitionCount: 3
|
||||
name: zeebe-record
|
||||
es:
|
||||
settings:
|
||||
index:
|
||||
number_of_replicas: 0
|
||||
connection:
|
||||
nodes:
|
||||
- host: "camunda-elasticsearch"
|
||||
httpPort: 9200
|
||||
spring:
|
||||
profiles:
|
||||
active: "ccsm"
|
||||
security:
|
||||
auth:
|
||||
cookie:
|
||||
same-site:
|
||||
enabled: false
|
||||
ccsm:
|
||||
redirectRootUrl: "https://camunda-optimize.sarex-k8s.uralmine.com"
|
||||
api:
|
||||
audience: "optimize-api"
|
||||
jwtSetUri: "http://camunda-keycloak:80/auth/realms/camunda-platform/protocol/openid-connect/certs"
|
||||
executionIdentity:
|
||||
image:
|
||||
pullSecrets:
|
||||
|
||||
@ -1,25 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
interval: 5m
|
||||
timeout: 10m
|
||||
values:
|
||||
controller:
|
||||
image:
|
||||
registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
|
||||
repository: cert-manager
|
||||
acmesolver:
|
||||
image:
|
||||
registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
|
||||
repository: acmesolver
|
||||
webhook:
|
||||
image:
|
||||
registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
|
||||
repository: cert-manager-webhook
|
||||
cainjector:
|
||||
image:
|
||||
registry: cr.yandex/crp3ccidau046kdj8g9q/cert-manager
|
||||
repository: cainjector
|
||||
@ -1,28 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: cert-manager.yaml
|
||||
- target:
|
||||
group: cert-manager.io
|
||||
version: v1
|
||||
kind: ClusterIssuer
|
||||
name: letsencrypt-issuer
|
||||
patch: |-
|
||||
$patch: delete
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-issuer
|
||||
- target:
|
||||
group: cert-manager.io
|
||||
version: v1
|
||||
kind: ClusterIssuer
|
||||
name: letsencrypt-issuer-istio
|
||||
patch: |-
|
||||
$patch: delete
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-issuer-istio
|
||||
@ -1,4 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
@ -1,117 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: istio-config
|
||||
namespace: default
|
||||
spec:
|
||||
dependsOn: []
|
||||
interval: 5m
|
||||
timeout: 10m
|
||||
values:
|
||||
global:
|
||||
env: contour
|
||||
environments:
|
||||
contour:
|
||||
istio:
|
||||
gateways:
|
||||
platform:
|
||||
name: platform-gateway
|
||||
namespace: default
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- hosts:
|
||||
- ${HOST_LOGIN}
|
||||
- ${HOST_CAMUNDA}
|
||||
- ${HOST_CAMUNDA_IDENTITY}
|
||||
- ${HOST_CAMUNDA_KEYCLOAK}
|
||||
- ${HOST_CAMUNDA_OPTIMIZE}
|
||||
- ${HOST_CAMUNDA_TASKLIST}
|
||||
- ${HOST_RABBITMQ}
|
||||
tls:
|
||||
credentialName: istio-ingress-tls
|
||||
virtualServices:
|
||||
zitadel:
|
||||
name: zitadel-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- ${HOST_LOGIN}
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: zitadel-idp-contour.zitadel.svc.cluster.local
|
||||
port: 8080
|
||||
camunda-operate:
|
||||
name: camunda-operate-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- ${HOST_CAMUNDA}
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: camunda-operate.camunda.svc.cluster.local
|
||||
port: 80
|
||||
camunda-identity:
|
||||
name: camunda-identity-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- ${HOST_CAMUNDA_IDENTITY}
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: camunda-identity.camunda.svc.cluster.local
|
||||
port: 80
|
||||
camunda-keycloak:
|
||||
name: camunda-keycloak-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- ${HOST_CAMUNDA_KEYCLOAK}
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: camunda-keycloak.camunda.svc.cluster.local
|
||||
port: 80
|
||||
camunda-optimize:
|
||||
name: camunda-optimize-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- ${HOST_CAMUNDA_OPTIMIZE}
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: camunda-optimize.camunda.svc.cluster.local
|
||||
port: 80
|
||||
camunda-tasklist:
|
||||
name: camunda-tasklist-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- ${HOST_CAMUNDA_TASKLIST}
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: camunda-tasklist.camunda.svc.cluster.local
|
||||
port: 80
|
||||
rabbitmq:
|
||||
name: rabbitmq-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- ${HOST_RABBITMQ}
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: rabbitmq.rabbitmq.svc.cluster.local
|
||||
port: 15672
|
||||
@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: istio-config.yaml
|
||||
@ -336,7 +336,7 @@ spec:
|
||||
service: backend-svc.transmittal.svc.cluster.local
|
||||
port: 80
|
||||
inspections-api:
|
||||
name: inspections-api-virt-service
|
||||
name: flows-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.uralmine.com
|
||||
@ -348,19 +348,6 @@ spec:
|
||||
rewrite: /api/
|
||||
service: backend-svc.inspections.svc.cluster.local
|
||||
port: 80
|
||||
premises-api:
|
||||
name: premises-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.uralmine.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /premises/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.premises.svc.cluster.local
|
||||
port: 80
|
||||
reviews-frontend:
|
||||
name: reviews-frontend-virt-service
|
||||
namespace: default
|
||||
@ -374,19 +361,6 @@ spec:
|
||||
rewrite: /
|
||||
service: frontend-svc.reviews.svc.cluster.local
|
||||
port: 80
|
||||
admin-frontend:
|
||||
name: admin-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.uralmine.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /admin-frontend/static/
|
||||
rewrite: /
|
||||
service: admin-frontend-svc.control-interface.svc.cluster.local
|
||||
port: 8080
|
||||
eav-api:
|
||||
name: eav-api-virt-service
|
||||
namespace: default
|
||||
|
||||
@ -89,19 +89,6 @@ spec:
|
||||
rewrite: /
|
||||
service: frontend-svc.documentations.svc.cluster.local
|
||||
port: 80
|
||||
mapper-api:
|
||||
name: mapper-api-virt-service
|
||||
namespace: gateway
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /mapper/api/
|
||||
rewrite: /api/
|
||||
service: backend-svc.mapper.svc.cluster.local
|
||||
port: 80
|
||||
rfi-frontend:
|
||||
name: rfi-frontend-virt-service
|
||||
namespace: default
|
||||
@ -338,7 +325,7 @@ spec:
|
||||
service: backend-svc.transmittal.svc.cluster.local
|
||||
port: 80
|
||||
inspections-api:
|
||||
name: inspections-api-virt-service
|
||||
name: flows-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
@ -363,84 +350,6 @@ spec:
|
||||
rewrite: /
|
||||
service: frontend-svc.reviews.svc.cluster.local
|
||||
port: 80
|
||||
comparisons-api:
|
||||
name: comparisons-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /comparisons/api/
|
||||
rewrite: /api/
|
||||
service: backend-service.comparisons.svc.cluster.local
|
||||
port: 8000
|
||||
comparisons-frontend:
|
||||
name: comparisons-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /comparisons/static/
|
||||
rewrite: /
|
||||
service: frontend-service.comparisons.svc.cluster.local
|
||||
port: 80
|
||||
cross-section-frontend:
|
||||
name: cross-section-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /cross-section/static/
|
||||
rewrite: /
|
||||
service: cross-section-static.cross-section.svc.cluster.local
|
||||
port: 80
|
||||
notes-api:
|
||||
name: notes-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /notes/api/
|
||||
rewrite: /api/
|
||||
service: backend-service.notes.svc.cluster.local
|
||||
port: 8000
|
||||
notes-frontend:
|
||||
name: notes-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /notes/static/
|
||||
rewrite: /
|
||||
service: frontend-service.notes.svc.cluster.local
|
||||
port: 80
|
||||
admin-frontend:
|
||||
name: admin-frontend-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.local.uralkali.com
|
||||
gateways:
|
||||
- default/platform-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /admin-frontend/static/
|
||||
rewrite: /
|
||||
service: admin-frontend-svc.control-interface.svc.cluster.local
|
||||
port: 8080
|
||||
eav-api:
|
||||
name: eav-api-virt-service
|
||||
namespace: default
|
||||
|
||||
@ -323,7 +323,7 @@ spec:
|
||||
service: backend-svc.transmittal.svc.cluster.local
|
||||
port: 80
|
||||
inspections-api:
|
||||
name: inspections-api-virt-service
|
||||
name: flows-api-virt-service
|
||||
namespace: default
|
||||
hosts:
|
||||
- sarex.vadroad.ru
|
||||
|
||||
@ -58,18 +58,6 @@ spec:
|
||||
renewBefore: 360h0m0s
|
||||
privateKey:
|
||||
rotationPolicy: Always
|
||||
srx-ui-kit-tls:
|
||||
dnsNames:
|
||||
- srx-ui-kit.infra.sarex.tech
|
||||
- srx-ui-kit-stage.infra.sarex.tech
|
||||
issuerRef:
|
||||
name: letsencrypt-issuer-istio
|
||||
kind: ClusterIssuer
|
||||
spec:
|
||||
duration: 2160h0m0s
|
||||
renewBefore: 360h0m0s
|
||||
privateKey:
|
||||
rotationPolicy: Always
|
||||
nexus-tls:
|
||||
dnsNames:
|
||||
- nexus.infra.sarex.tech
|
||||
@ -92,28 +80,6 @@ spec:
|
||||
renewBefore: 360h0m0s
|
||||
privateKey:
|
||||
rotationPolicy: Always
|
||||
wiki-tls:
|
||||
dnsNames:
|
||||
- wiki.sarex.space
|
||||
issuerRef:
|
||||
name: letsencrypt-issuer-istio
|
||||
kind: ClusterIssuer
|
||||
spec:
|
||||
duration: 2160h0m0s
|
||||
renewBefore: 360h0m0s
|
||||
privateKey:
|
||||
rotationPolicy: Always
|
||||
goalert-tls:
|
||||
dnsNames:
|
||||
- goalert.infra.sarex.io
|
||||
issuerRef:
|
||||
name: letsencrypt-issuer-istio
|
||||
kind: ClusterIssuer
|
||||
spec:
|
||||
duration: 2160h0m0s
|
||||
renewBefore: 360h0m0s
|
||||
privateKey:
|
||||
rotationPolicy: Always
|
||||
istio:
|
||||
gateways:
|
||||
vault:
|
||||
@ -138,18 +104,6 @@ spec:
|
||||
tls:
|
||||
credentialName: kb-tls
|
||||
mode: SIMPLE
|
||||
srx-ui-kit:
|
||||
name: srx-ui-kit-gateway
|
||||
namespace: istio-system
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- hosts:
|
||||
- srx-ui-kit.infra.sarex.tech
|
||||
- srx-ui-kit-stage.infra.sarex.tech
|
||||
tls:
|
||||
credentialName: srx-ui-kit-tls
|
||||
mode: SIMPLE
|
||||
nexus:
|
||||
name: nexus-gateway
|
||||
namespace: istio-system
|
||||
@ -172,28 +126,6 @@ spec:
|
||||
tls:
|
||||
credentialName: idp-tls
|
||||
mode: SIMPLE
|
||||
wiki:
|
||||
name: wiki-gateway
|
||||
namespace: istio-system
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- hosts:
|
||||
- wiki.sarex.space
|
||||
tls:
|
||||
credentialName: wiki-tls
|
||||
mode: SIMPLE
|
||||
goalert:
|
||||
name: goalert-gateway
|
||||
namespace: istio-system
|
||||
selector:
|
||||
istio: ingressgateway
|
||||
servers:
|
||||
- hosts:
|
||||
- goalert.infra.sarex.io
|
||||
tls:
|
||||
credentialName: goalert-tls
|
||||
mode: SIMPLE
|
||||
virtualServices:
|
||||
vault-virt-service:
|
||||
namespace: istio-system
|
||||
@ -217,28 +149,6 @@ spec:
|
||||
prefix: /
|
||||
service: kb-service.kb.svc.cluster.local
|
||||
port: 80
|
||||
srx-ui-kit-virt-service:
|
||||
namespace: istio-system
|
||||
hosts:
|
||||
- srx-ui-kit.infra.sarex.tech
|
||||
gateways:
|
||||
- istio-system/srx-ui-kit-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: universal-static-site-srx-ui-kit-pages.gitlab-pages-srx-ui-kit.svc.cluster.local
|
||||
port: 80
|
||||
srx-ui-kit-stage-virt-service:
|
||||
namespace: istio-system
|
||||
hosts:
|
||||
- srx-ui-kit-stage.infra.sarex.tech
|
||||
gateways:
|
||||
- istio-system/srx-ui-kit-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: universal-static-site-srx-ui-kit-stage-pages.gitlab-pages-srx-ui-kit-stage.svc.cluster.local
|
||||
port: 80
|
||||
nexus-virt-service:
|
||||
namespace: istio-system
|
||||
hosts:
|
||||
@ -261,25 +171,3 @@ spec:
|
||||
prefix: /
|
||||
service: idp.zitadel.svc.cluster.local
|
||||
port: 8080
|
||||
wiki-virt-service:
|
||||
namespace: istio-system
|
||||
hosts:
|
||||
- wiki.sarex.space
|
||||
gateways:
|
||||
- istio-system/wiki-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: outline.outline.svc.cluster.local
|
||||
port: 80
|
||||
goalert-virt-service:
|
||||
namespace: istio-system
|
||||
hosts:
|
||||
- goalert.infra.sarex.io
|
||||
gateways:
|
||||
- istio-system/goalert-gateway
|
||||
routes:
|
||||
- path:
|
||||
prefix: /
|
||||
service: goalert.goalert.svc.cluster.local
|
||||
port: 8081
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,31 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: ingressgateway
|
||||
namespace: istio-system
|
||||
spec:
|
||||
interval: 5m
|
||||
timeout: 10m
|
||||
dependsOn:
|
||||
- name: istio-base
|
||||
namespace: istio-system
|
||||
- name: istiod
|
||||
namespace: istio-system
|
||||
values:
|
||||
_internal_defaults_do_not_set:
|
||||
replicaCount: ${GATEWAY_REPLICAS}
|
||||
service:
|
||||
type: ClusterIP
|
||||
nodeSelector:
|
||||
sarex.io/gateway: "true"
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
istio: ingressgateway
|
||||
topologyKey: kubernetes.io/hostname
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: istio-gateway.yaml
|
||||
@ -10,7 +10,7 @@ metadata:
|
||||
istio: ingressgateway
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
loadBalancerIP: 168.113.132.114
|
||||
loadBalancerIP: 161.104.106.190
|
||||
externalTrafficPolicy: Local
|
||||
selector:
|
||||
app: istio-ingressgateway
|
||||
|
||||
@ -1,12 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: istiod
|
||||
namespace: istio-system
|
||||
spec:
|
||||
interval: 5m
|
||||
timeout: 10m
|
||||
values:
|
||||
global:
|
||||
imagePullSecrets:
|
||||
- regcred
|
||||
@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ../base
|
||||
patches:
|
||||
- path: istio-pilot.yaml
|
||||
@ -13,34 +13,3 @@ spec:
|
||||
global:
|
||||
imagePullSecrets:
|
||||
- regcred
|
||||
# Провайдер журнала доступа для security-audit (access-collector). Сам по себе ничего не включает:
|
||||
# работает только для workload'ов, на которые ссылается Telemetry (infrastructure/security-audit/mesh).
|
||||
meshConfig:
|
||||
extensionProviders:
|
||||
- name: audit-access
|
||||
envoyOtelAls:
|
||||
service: access-collector.security-audit.svc.cluster.local
|
||||
port: 4317
|
||||
logFormat:
|
||||
labels:
|
||||
sarex_kind: "mesh_access"
|
||||
start_time: "%START_TIME%"
|
||||
request_id: "%REQ(X-REQUEST-ID)%"
|
||||
trace_id: "%TRACE_ID%"
|
||||
authority: "%REQ(:AUTHORITY)%"
|
||||
method: "%REQ(:METHOD)%"
|
||||
path: "%REQ_WITHOUT_QUERY(:PATH)%"
|
||||
protocol: "%PROTOCOL%"
|
||||
response_code: "%RESPONSE_CODE%"
|
||||
response_flags: "%RESPONSE_FLAGS%"
|
||||
duration_ms: "%DURATION%"
|
||||
bytes_in: "%BYTES_RECEIVED%"
|
||||
bytes_out: "%BYTES_SENT%"
|
||||
x_forwarded_for: "%REQ(X-FORWARDED-FOR)%"
|
||||
downstream_ip: "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%"
|
||||
user_sub: "%REQ(X-SAREX-AUDIT-SUB)%"
|
||||
user_org: "%REQ(X-SAREX-AUDIT-ORG)%"
|
||||
user_agent: "%REQ(USER-AGENT)%"
|
||||
route: "%ROUTE_NAME%"
|
||||
upstream_cluster: "%UPSTREAM_CLUSTER%"
|
||||
# Authorization, Cookie, Set-Cookie и query-строка не логируются (п.23)
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user