sarex/iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
e5c01279b7
iac/apps/django/ugok/patch-celery.yaml
ivan e5c01279b7 ugok: bootstrap application layer on universal-chart from cluster dump 
Adds apps/<app>/ugok overlays for 31 applications, derived strictly from
a live cluster dump (kubectl get deployment/service/configmap/secret),
following the wb overlay pattern (standalone HelmRelease patches on
universal-chart, plain k8s Secret + secretKeyRef instead of Vault Agent
since the ugok cluster has zero Vault usage cluster-wide).

- processing (workflow namespace) does not extend base: base is
  vault-native, ugok is not, so it's four standalone HelmReleases
  modeled on apps/processing/wb/*.
- issues/redis and django/redis are raw Deployments patched via JSON6902.
- documentations/pdf-markings and django/auth-flow-frontend,
  export-project are copied in as standalone files (base has no
  HelmRelease for them, and kustomize forbids cross-overlay references
  outside a directory's own tree).
- Images and images-with-registry updated to match wb where the same
  build lineage applies; left as-is where the wb tag carries a distinct
  client/cluster name (donstroi1, brusnika_*, dev4, UGOK_*, ugok1_*) or
  points at a different image repository entirely.
- Missing backend envs backfilled from wb where safe (internal
  svc.cluster.local refs, feature flags, already-established ugok
  domains); skipped where wb-specific (external DB/Kafka hosts, TLS CA
  content, features not deployed in ugok like gatekeeper/Superset).
- message-hub patch was missing its entire env block from the original
  bootstrap; rebuilt from the raw dump (not wb, whose Kafka/DB config is
  incompatible) plus a handful of small env gaps found while
  cross-checking every ugok app's rendered envs against the raw dump.

clusters/ugok/kustomization.yaml keeps the apps section commented out —
not wired into the Flux Kustomization yet, pending review.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-28 23:41:50 +05:00

258 lines
8.1 KiB
YAML
Raw Blame History

---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: celery
namespace: django
spec:
values:
services:
celery:
image:
name:
_default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b
deployment:
command:
_default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "default", "-n", "default_worker.%h", "--concurrency=2"]
volumes:
_default:
- name: kafka-cert-volume
mountPath:
_default: /usr/local/share/ca-certificates
readOnly:
_default: true
configMap:
name:
_default: kafka-cert
envs:
- name: ALLOWED_HOSTS
value:
_default: "*"
- name: SERVER_USE_CHANGELOG
value:
_default: "0"
- name: SERVER_ZITADEL_ENABLED
value:
_default: "True"
- name: DJANGO_SETTINGS_MODULE
value:
_default: config.settings.production
- name: CELERY_REDIS_HOST
value:
_default: redis-service
- name: CELERY_REDIS_PORT
value:
_default: "6379"
- name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
value:
_default: "True"
- name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
value:
_default: "True"
- name: DJANGO_REDIS_HOST
value:
_default: redis-service
- name: DJANGO_REDIS_PORT
value:
_default: "6379"
- name: BIMV2_INTERNAL_HOST
value:
_default: http://bim-backend-v2-service.bim-api
- name: BIMV2_TIMEOUT
value:
_default: "60"
- name: JWT_KID
value:
_default: "1"
- name: PDM_SYNC
value:
_default: "1"
- name: KC_SYNC_ENABLE
value:
_default: "0"
- name: MEASUREMENTS_HOST
value:
_default: http://measurement-svc.measurements.svc.cluster.local:8000/api
- name: MEASUREMENTS_USE_MEASUREMENTS
value:
_default: "1"
- name: SERVER_API_HOST
value:
_default: https://sarex.ugok.la
- name: SERVER_HOST
value:
_default: https://sarex.ugok.la
- name: WORKFLOWS_HOST
value:
_default: https://sarex.ugok.la
- name: WORKFLOWS_BASE_HOST
value:
_default: https://sarex.ugok.la
- name: WORKFLOWS_USE
value:
_default: "1"
- name: SERVER_S3_STREAM_IMPORT
value:
_default: "1"
- name: SERVER_SAVE_DIFF_DEM
value:
_default: "1"
- name: SERVER_USE_CLICKHOUSE
value:
_default: "0"
- name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
value:
_default: "0"
- name: SERVER_USE_DJANGO_STORAGE
value:
_default: "1"
- name: SERVER_USE_METASHAPE
value:
_default: "0"
- name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
value:
_default: "1"
- name: SERVER_CHANGELOG_MODE
value:
_default: "0"
- name: SERVER_DJANGO_URLS
value:
_default: "1"
- name: CHECK_IMPORT_HASH
value:
_default: "1"
- name: EAV_ENABLE
value:
_default: "1"
- name: SERVER_CHECK_IMPORT_HASH
value:
_default: "1"
- name: SERVER_CHUNKED_PATH
value:
_default: /tmp/chunked_uploads/%Y/%m/%d
- name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
value:
_default: "0"
- name: SERVER_USE_WRORKFLOW_STATUS
value:
_default: "1"
- name: SERVER_KAFKA_ENABLED
value:
_default: "True"
- name: KAFKA_TOPICS
value:
_default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
- name: KAFKA_BOOTSTRAP_SERVERS
value:
_default: '["ugok-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
- name: KAFKA_SECURITY_PROTOCOL
value:
_default: SSL
- name: KAFKA_SASL_MECHANISM
value:
_default: SCRAM-SHA-512
- name: KAFKA_SSL_CAFILE
value:
_default: /usr/local/share/ca-certificates/kafka.crt
- name: S3_HOST
value:
_default: http://minio.minio.svc.cluster.local:9000
- name: CACHE_HOST
value:
_default: redis.pm.svc.cluster.local
- name: ZITADEL_HOST
value:
_default: https://ugok-zitadel-sarex.uralmine.com
- name: KC_USE_REDIRECT_LOGOUT
value:
_default: "False"
secretEnvs:
- name: ZITADEL_ACCESS_TOKEN
secretName:
_default: zitadel-secret
secretKey: access_token
- name: KAFKA_SASL_PLAIN_USERNAME
secretName:
_default: kafka-secret
secretKey: username
- name: KAFKA_SASL_PLAIN_PASSWORD
secretName:
_default: kafka-secret
secretKey: password
- name: AWS_S3_ENDPOINT_URL
secretName:
_default: sarex-s3-secret
secretKey: endpoint
- name: CELERY_RABBITMQ_HOST
secretName:
_default: sarex-rabbitmq-secret
secretKey: host
- name: CELERY_RABBITMQ_USER
secretName:
_default: sarex-rabbitmq-secret
secretKey: username
- name: CELERY_RABBITMQ_PASSWORD
secretName:
_default: sarex-rabbitmq-secret
secretKey: password
- name: CELERY_RABBITMQ_VHOST
secretName:
_default: sarex-rabbitmq-secret
secretKey: vhost
- name: DJANGO_POSTGRES_HOST
secretName:
_default: sarex-postgresql-secret
secretKey: host
- name: DJANGO_POSTGRES_PORTS
secretName:
_default: sarex-postgresql-secret
secretKey: port
- name: DJANGO_POSTGRES_USER
secretName:
_default: sarex-postgresql-secret
secretKey: username
- name: DJANGO_POSTGRES_PASSWORD
secretName:
_default: sarex-postgresql-secret
secretKey: password
- name: DJANGO_POSTGRES_DATABASE
secretName:
_default: sarex-postgresql-secret
secretKey: database
- name: DJANGO_RABBIT_HOSTNAME
secretName:
_default: sarex-rabbitmq-secret
secretKey: host
- name: DJANGO_RABBIT_USER
secretName:
_default: sarex-rabbitmq-secret
secretKey: username
- name: DJANGO_RABBIT_PASS
secretName:
_default: sarex-rabbitmq-secret
secretKey: password
- name: DJANGO_RABBIT_VHOST
secretName:
_default: sarex-rabbitmq-secret
secretKey: vhost
- name: JWT_PRIVATE_KEY
secretName:
_default: backend-secret
secretKey: ssh_private.key
- name: JWT_PUBLIC_KEY
secretName:
_default: backend-secret
secretKey: ssh_public.key
- name: S3_BUCKET
secretName:
_default: sarex-s3-secret
secretKey: bucket
- name: S3_LOGIN
secretName:
_default: sarex-s3-secret
secretKey: access_key
- name: S3_PASSWORD
secretName:
_default: sarex-s3-secret
secretKey: secret_key
Reference in New Issue View Git Blame Copy Permalink