diff --git a/apps/cde/base/cde-flowscallback.yaml b/apps/cde/base/cde-flowscallback.yaml index f629edc..b3f4689 100644 --- a/apps/cde/base/cde-flowscallback.yaml +++ b/apps/cde/base/cde-flowscallback.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-splitpdf.yaml b/apps/cde/base/cde-splitpdf.yaml index 044e1a3..081d967 100644 --- a/apps/cde/base/cde-splitpdf.yaml +++ b/apps/cde/base/cde-splitpdf.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-alert.yaml b/apps/cde/base/cde-worker-alert.yaml index 6cc5d01..a530a3d 100644 --- a/apps/cde/base/cde-worker-alert.yaml +++ b/apps/cde/base/cde-worker-alert.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-copy.yaml b/apps/cde/base/cde-worker-copy.yaml index e190b28..1b04c4c 100644 --- a/apps/cde/base/cde-worker-copy.yaml +++ b/apps/cde/base/cde-worker-copy.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-copyv2.yaml b/apps/cde/base/cde-worker-copyv2.yaml index 2961697..6a9e872 100644 --- a/apps/cde/base/cde-worker-copyv2.yaml +++ b/apps/cde/base/cde-worker-copyv2.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-create-versions.yaml b/apps/cde/base/cde-worker-create-versions.yaml index e67eb33..34dbebc 100644 --- a/apps/cde/base/cde-worker-create-versions.yaml +++ b/apps/cde/base/cde-worker-create-versions.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-create-versionsv2.yaml b/apps/cde/base/cde-worker-create-versionsv2.yaml index 2a0378a..16e15a9 100644 --- a/apps/cde/base/cde-worker-create-versionsv2.yaml +++ b/apps/cde/base/cde-worker-create-versionsv2.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-markings.yaml b/apps/cde/base/cde-worker-markings.yaml index bf01157..06dfb48 100644 --- a/apps/cde/base/cde-worker-markings.yaml +++ b/apps/cde/base/cde-worker-markings.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-markingsv2.yaml b/apps/cde/base/cde-worker-markingsv2.yaml index 4aff52e..f592c8b 100644 --- a/apps/cde/base/cde-worker-markingsv2.yaml +++ b/apps/cde/base/cde-worker-markingsv2.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-sign.yaml b/apps/cde/base/cde-worker-sign.yaml index eb64503..3d3f18e 100644 --- a/apps/cde/base/cde-worker-sign.yaml +++ b/apps/cde/base/cde-worker-sign.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-signv2.yaml b/apps/cde/base/cde-worker-signv2.yaml index fbbb009..7363a0a 100644 --- a/apps/cde/base/cde-worker-signv2.yaml +++ b/apps/cde/base/cde-worker-signv2.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde-worker-update-bundles.yaml b/apps/cde/base/cde-worker-update-bundles.yaml index be24a12..2c60e0b 100644 --- a/apps/cde/base/cde-worker-update-bundles.yaml +++ b/apps/cde/base/cde-worker-update-bundles.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /worker resources: diff --git a/apps/cde/base/cde.yaml b/apps/cde/base/cde.yaml index b9e2f4e..f147cb1 100644 --- a/apps/cde/base/cde.yaml +++ b/apps/cde/base/cde.yaml @@ -64,7 +64,8 @@ spec: _default: - | set -e - source /vault/secrets/cde-env + cp /vault/secrets/cde-env .env + source .env exec /http resources: diff --git a/apps/documentations/base/api.yaml b/apps/documentations/base/api.yaml index 83b7f10..86558b6 100644 --- a/apps/documentations/base/api.yaml +++ b/apps/documentations/base/api.yaml @@ -65,7 +65,7 @@ spec: enabled: false image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430 + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_3f19a21d pullPolicy: _default: IfNotPresent service: diff --git a/apps/documentations/base/frontend.yaml b/apps/documentations/base/frontend.yaml index 2698745..dd268de 100644 --- a/apps/documentations/base/frontend.yaml +++ b/apps/documentations/base/frontend.yaml @@ -29,7 +29,7 @@ spec: enabled: true image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ae1bb076 + _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_e5f99d7c pullPolicy: _default: IfNotPresent deployment: diff --git a/apps/documentations/brusnika-prod/api.yaml b/apps/documentations/brusnika-prod/api.yaml index e6752db..41dfd6c 100644 --- a/apps/documentations/brusnika-prod/api.yaml +++ b/apps/documentations/brusnika-prod/api.yaml @@ -212,6 +212,10 @@ spec: value: _default: "v1" + - name: USE_MARKS_RABBITMQ + value: + _default: "true" + - name: SYSTEM_LOG_URL value: _default: "http://api-service.system-log.svc.cluster.local:80" @@ -293,6 +297,32 @@ spec: secretName: _default: "django-auth" secretKey: "key" + + - name: MARKS_RABBITMQ_HOST + secretName: + _default: "rabbitmq" + secretKey: "host" + + - name: MARKS_RABBITMQ_PASSWORD + secretName: + _default: "rabbitmq" + secretKey: "password" + + - name: MARKS_RABBITMQ_USER + secretName: + _default: "rabbitmq" + secretKey: "username" + + - name: MARKS_RABBITMQ_API + secretName: + _default: "rabbitmq" + secretKey: "vhost" + + - name: MARKS_RABBITMQ_PORT + secretName: + _default: "rabbitmq" + secretKey: "port" + - name: DJANGO_BASIC_AUTH_FOR_GET_USER secretName: diff --git a/apps/documentations/brusnika-prod/hasher.yaml b/apps/documentations/brusnika-prod/hasher.yaml new file mode 100644 index 0000000..81a5096 --- /dev/null +++ b/apps/documentations/brusnika-prod/hasher.yaml @@ -0,0 +1,186 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-hasher + namespace: documentations + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + driftDetection: + mode: enabled + + values: + global: + env: _default + + services: + backend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: hasher + + replicaCount: + _default: 1 + + port: + _default: 8080 + + command: + _default: ["run-amqp-server"] + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: hasher-service + + type: + _default: ClusterIP + + port: + _default: 8080 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + labels: + monitoring: prometheus + + envs: + - name: HASHER_APP__LOG_LEVEL + value: + _default: "INFO" + + - name: HASHER_APP__NUM_WORKERS + value: + _default: "4" + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE + value: + _default: "hash.compute.normal.tasks" + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE + value: + _default: "hash.compute" + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE + value: + _default: "direct" + + - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY + value: + _default: "hash.compute.normal" + + - name: HASHER_S3__MAX_POOL_CONNECTIONS + value: + _default: "10" + + - name: HASHER_S3__CONNECT_TIMEOUT + value: + _default: "10" + + - name: HASHER_S3__READ_TIMEOUT + value: + _default: "30" + + - name: HASHER_S3__REGION_NAME + value: + _default: "ru-central1" + + - name: HASHER_S3__USE_SSL + value: + _default: "true" + + - name: HASHER_S3__VERIFY + value: + _default: "true" + + secretEnvs: + - name: HASHER_AMQP__HOST + secretName: + _default: "rabbitmq" + secretKey: "host" + + - name: HASHER_AMQP__PORT + secretName: + _default: "rabbitmq" + secretKey: "port" + + - name: HASHER_AMQP__USERNAME + secretName: + _default: "rabbitmq" + secretKey: "username" + + - name: HASHER_AMQP__PASSWORD + secretName: + _default: "rabbitmq" + secretKey: "password" + + - name: HASHER_AMQP__VHOST + secretName: + _default: "rabbitmq" + secretKey: "vhost" + + - name: HASHER_S3__ENDPOINT + secretName: + _default: "hasher-s3-secret" + secretKey: "endpoint" + + - name: HASHER_S3__ACCESS_KEY + secretName: + _default: "hasher-s3-secret" + secretKey: "access_key" + + - name: HASHER_S3__SECRET_KEY + secretName: + _default: "hasher-s3-secret" + secretKey: "secret_key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/brusnika-prod/kustomization.yaml b/apps/documentations/brusnika-prod/kustomization.yaml index 571e91d..4fbb3f9 100644 --- a/apps/documentations/brusnika-prod/kustomization.yaml +++ b/apps/documentations/brusnika-prod/kustomization.yaml @@ -7,3 +7,4 @@ resources: - pdm.yaml - api.yaml - filestream.yaml + - hasher.yaml diff --git a/apps/flows/base/backend.yaml b/apps/flows/base/backend.yaml index 1c8569e..206a6e3 100644 --- a/apps/flows/base/backend.yaml +++ b/apps/flows/base/backend.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_2a439111 + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216 pullPolicy: _default: IfNotPresent deployment: diff --git a/apps/flows/base/celery.yaml b/apps/flows/base/celery.yaml index 4e20e5f..1636648 100644 --- a/apps/flows/base/celery.yaml +++ b/apps/flows/base/celery.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_2a439111 + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216 pullPolicy: _default: IfNotPresent diff --git a/apps/flows/d8-ugmk-prod/backend.yaml b/apps/flows/d8-ugmk-prod/backend.yaml new file mode 100644 index 0000000..41ef91c --- /dev/null +++ b/apps/flows/d8-ugmk-prod/backend.yaml @@ -0,0 +1,167 @@ +--- +# Патч backend для контура УГМК — подключение к Kafka. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml. +# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: flows +spec: + values: + services: + backend: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql + [ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db + [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq + [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth + [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" + [ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka + set +a + exec /opt/entrypoint.sh + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://srx.wb.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@rwb.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-svc.documentations.svc.cluster.local:80" + + - name: RESOURCE_URL + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: SERVICE_HOST + value: + _default: "https://srx.wb.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "mail.rwb.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "465" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://backend-svc.processing.svc.cluster.local:80/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CERT + value: + _default: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw + NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC + h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy + D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV + tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM + Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C + GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA + A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL + QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP + KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j + kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j + TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8 + fdA17/ibw6gFrH2b3vZKcx8D455V + -----END CERTIFICATE----- + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows + vault.hashicorp.com/agent-inject-template-flows-kafka: |- + {{- with secret "secrets/data/kafka/apps/flows" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/flows/d8-ugmk-prod/celery.yaml b/apps/flows/d8-ugmk-prod/celery.yaml new file mode 100644 index 0000000..87b9226 --- /dev/null +++ b/apps/flows/d8-ugmk-prod/celery.yaml @@ -0,0 +1,168 @@ +--- +# Патч celery для контура УГМК — подключение к Kafka. +# +# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/flows/base/celery.yaml. +# args — тоже список, продублирован весь скрипт с добавленным sourcing flows-kafka. +# podAnnotations — map, мержится по ключам, поэтому переопределён только +# один ключ agent-inject-template-flows-kafka; остальные vault-аннотации берутся из base. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: flows +spec: + values: + services: + celery: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/flows-postgresql ] && . /vault/secrets/flows-postgresql + [ -f /vault/secrets/flows-documentations-db ] && . /vault/secrets/flows-documentations-db + [ -f /vault/secrets/flows-rabbitmq ] && . /vault/secrets/flows-rabbitmq + [ -f /vault/secrets/flows-django-auth ] && . /vault/secrets/flows-django-auth + [ -f /vault/secrets/flows-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/flows-jwt-public)" + [ -f /vault/secrets/flows-kafka ] && . /vault/secrets/flows-kafka + set +a + exec celery -A src.worker worker -l INFO -E --concurrency=1 -Q flow + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: BASE_HOST + value: + _default: "https://srx.wb.ru" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: DJANGO_HOST + value: + _default: "http://backend-svc.django.svc.cluster.local:80/api" + + - name: PLANNING_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:80/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: DOCUMENTATION_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "sarex@rwb.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: SERVICE_HOST + value: + _default: "https://srx.wb.ru/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "mail.rwb.ru" + + - name: CHECKLIST_HOST + value: + _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" + + - name: SMTP_PORT + value: + _default: "465" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + # См. подробные комментарии в apps/flows/d8-ugmk-prod/backend.yaml. + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CERT + value: + _default: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw + NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC + h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy + D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV + tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM + Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C + GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA + A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL + QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP + KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j + kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j + TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8 + fdA17/ibw6gFrH2b3vZKcx8D455V + -----END CERTIFICATE----- + + podAnnotations: + _default: + vault.hashicorp.com/agent-inject-secret-flows-kafka: secrets/data/kafka/apps/flows + vault.hashicorp.com/agent-inject-template-flows-kafka: |- + {{- with secret "secrets/data/kafka/apps/flows" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/flows/d8-ugmk-prod/kustomization.yaml b/apps/flows/d8-ugmk-prod/kustomization.yaml index d399533..21c47bf 100644 --- a/apps/flows/d8-ugmk-prod/kustomization.yaml +++ b/apps/flows/d8-ugmk-prod/kustomization.yaml @@ -8,3 +8,11 @@ patches: target: kind: Namespace name: flows + - path: backend.yaml + target: + kind: HelmRelease + name: backend + - path: celery.yaml + target: + kind: HelmRelease + name: celery diff --git a/apps/issues/base/backend.yaml b/apps/issues/base/backend.yaml index cc341c8..83e4616 100644 --- a/apps/issues/base/backend.yaml +++ b/apps/issues/base/backend.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909 pullPolicy: _default: IfNotPresent diff --git a/apps/issues/base/celery.yaml b/apps/issues/base/celery.yaml index 5caf9ee..a5c2565 100644 --- a/apps/issues/base/celery.yaml +++ b/apps/issues/base/celery.yaml @@ -42,7 +42,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909 pullPolicy: _default: IfNotPresent diff --git a/apps/issues/base/production-configmap.yaml b/apps/issues/base/production-configmap.yaml index 012e486..162690d 100644 --- a/apps/issues/base/production-configmap.yaml +++ b/apps/issues/base/production-configmap.yaml @@ -48,9 +48,9 @@ data: WORKFLOWS_URL = "http://workflows-api-service.workflow.svc.cluster.local:8000" DOCUMENTATIONS_URL = "http://backend-api-svc.documentations.svc.cluster.local:80" RESOURCES_API_HOST = os.getenv("RESOURCES_API_HOST", default="http://resources-service.resources.svc.cluster:8000") - KAFKA_HOST = "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093" - KAFKA_USERNAME = "sarex" - KAFKA_PASSWORD = "nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC" + KAFKA_HOST = os.getenv("KAFKA_HOST", "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093") + KAFKA_USERNAME = os.getenv("KAFKA_USERNAME", "sarex") + KAFKA_PASSWORD = os.getenv("KAFKA_PASSWORD", "nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC") KAFKA_SSL_CAFILE = os.getenv("KAFKA_SSL_CAFILE", "/usr/local/share/ca-certificates/kafka.crt") KAFKA_EAV_ASSETS_TOPIC = os.getenv("KAFKA_EAV_ASSETS_TOPIC", "sarex") KAFKA_ISSUES_TOPIC = os.getenv("KAFKA_ISSUES_TOPIC", "sarex-issues") diff --git a/apps/issues/d8-ugmk-prod/backend-s3.yaml b/apps/issues/d8-ugmk-prod/backend-s3.yaml index 4c56193..dd37264 100644 --- a/apps/issues/d8-ugmk-prod/backend-s3.yaml +++ b/apps/issues/d8-ugmk-prod/backend-s3.yaml @@ -1,4 +1,7 @@ --- +# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml. +# podAnnotations — map, мержится по ключам. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -8,6 +11,126 @@ spec: values: services: backend: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka + set +a + exec /src/entrypoint.sh + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: AERO_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AERO_URL + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: WORKFLOWS_URL + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + # Kafka — код (kafka_app/app.py) ждёт KAFKA_HOST единой строкой "host:port", + # KAFKA_SSL_CAFILE — путь к файлу (не PEM-текст, в отличие от flows-backend). + # Хост/порт/CA — те же проверенные значения, что у message-hub/pm/flows. + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + # Топики совпадают с тем, что уже провижено на брокере (см. topics + # в секрете kafka/apps/pm) и с SETTINGS_TOPICS у message-hub. + - name: KAFKA_ISSUES_TOPIC + value: + _default: "issues_broadcast_prod" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + podAnnotations: _default: vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues @@ -18,3 +141,9 @@ spec: YC_S3_BUCKET_NAME=sarex-issues YC_S3_ENDPOINT_URL=https://s3.uralmine.com {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-kafka: |- + {{- with secret "secrets/data/kafka/apps/issues" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/issues/d8-ugmk-prod/celery-s3.yaml b/apps/issues/d8-ugmk-prod/celery-s3.yaml index 9ab021a..7c02f31 100644 --- a/apps/issues/d8-ugmk-prod/celery-s3.yaml +++ b/apps/issues/d8-ugmk-prod/celery-s3.yaml @@ -1,4 +1,7 @@ --- +# ВНИМАНИЕ: envs и args — списки, kustomize заменяет их ЦЕЛИКОМ (JSON merge patch), +# поэтому здесь продублирован весь набор из apps/issues/base/celery.yaml. +# podAnnotations — map, мержится по ключам. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: @@ -8,6 +11,122 @@ spec: values: services: celery: + deployment: + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka + set +a + exec celery -A config worker -l info -E + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://srx.wb.ru" + + - name: AERO_HOST + value: + _default: "https://srx.wb.ru" + + - name: BASE_AERO_URL + value: + _default: "https://srx.wb.ru" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://srx.wb.ru" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + # См. подробные комментарии в apps/issues/d8-ugmk-prod/backend-s3.yaml. + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_ISSUES_TOPIC + value: + _default: "issues_broadcast_prod" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + podAnnotations: _default: vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues @@ -18,3 +137,9 @@ spec: YC_S3_BUCKET_NAME=sarex-issues YC_S3_ENDPOINT_URL=https://s3.uralmine.com {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-kafka: |- + {{- with secret "secrets/data/kafka/apps/issues" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} diff --git a/apps/issues/d8-ugmk-prod/kafka-app.yaml b/apps/issues/d8-ugmk-prod/kafka-app.yaml new file mode 100644 index 0000000..67f9ba7 --- /dev/null +++ b/apps/issues/d8-ugmk-prod/kafka-app.yaml @@ -0,0 +1,263 @@ +--- +# Отдельный процесс-консьюмер Kafka для issues (src/run_kafka_app.py, слушает +# eav_router — see kafka_app/consumers/eav_assets_consumer.py). В base этого +# сервиса нет вообще, аналогов в других контурах тоже — только для УГМК. +# Использует тот же образ/DB/S3-креды, что backend (django.setup() требует +# полный конфиг), плюс отдельно креды Kafka. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kafka-app + namespace: issues +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.9" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + kafka-app: + enabled: true + + serviceAccount: + enabled: + _default: true + name: + _default: issues-vault + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: kafka-app + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["/bin/sh", "-ec"] + args: + _default: + - | + set -a + [ -f /vault/secrets/issues-db ] && . /vault/secrets/issues-db + [ -f /vault/secrets/issues-rabbitmq ] && . /vault/secrets/issues-rabbitmq + [ -f /vault/secrets/issues-s3 ] && . /vault/secrets/issues-s3 + [ -f /vault/secrets/issues-django-auth ] && . /vault/secrets/issues-django-auth + [ -f /vault/secrets/issues-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/issues-jwt-private)" + [ -f /vault/secrets/issues-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/issues-jwt-public)" + [ -f /vault/secrets/issues-kafka ] && . /vault/secrets/issues-kafka + set +a + exec python3 run_kafka_app.py + + resources: + requests: + cpu: + _default: 25m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: regcred + + volumes: + _default: + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + - name: kafka-ca-cert + mountPath: + _default: /usr/local/share/ca-certificates/kafka.crt + subPath: + _default: kafka.crt + readOnly: + _default: true + configMap: + name: + _default: kafka-ca-cert + items: + - key: kafka.crt + path: + _default: kafka.crt + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: AERO_HOST + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AERO_URL + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: BASE_AUTH_URL + value: + _default: "http://backend-svc.django.svc.cluster.local:80" + + - name: WORKFLOWS_HOST + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: WORKFLOWS_URL + value: + _default: "http://backend-svc.workflow.svc.cluster.local:80" + + - name: RESOURCES_API_HOST + value: + _default: "http://iam-backend.iam.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://backend-svc.eav.svc.cluster.local:80" + + - name: SAREX_API + value: + _default: "https://sarex.contour.infra.sarex.tech" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: API_ADDRESS + value: + _default: "8000" + + - name: KAFKA_HOST + value: + _default: "kafka-kafka-contour.kafka.svc.cluster.local:9092" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_ISSUES_TOPIC + value: + _default: "issues_broadcast_prod" + + - name: KAFKA_EAV_ASSETS_TOPIC + value: + _default: "assets_broadcast" + + podAnnotations: + _default: + traffic.sidecar.istio.io/excludeOutboundPorts: "8200" + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: issues + vault.hashicorp.com/agent-inject-secret-issues-db: secrets/data/apps/issues/postgres + vault.hashicorp.com/agent-inject-template-issues-db: |- + {{- with secret "secrets/data/apps/issues/postgres" -}} + DATABASE_PORT={{ index .Data.data "port" }} + DATABASE_HOST={{ index .Data.data "host" }} + DATABASE_USER={{ index .Data.data "username" }} + DATABASE_PASSWORD={{ index .Data.data "password" }} + DATABASE_NAME={{ index .Data.data "database" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-rabbitmq: secrets/data/rabbitmq/apps/issues + vault.hashicorp.com/agent-inject-template-issues-rabbitmq: |- + {{- with secret "secrets/data/rabbitmq/apps/issues" -}} + RABBITMQ_VHOST={{ index .Data.data "vhost" }} + RABBITMQ_USERNAME={{ index .Data.data "username" }} + RABBITMQ_HOSTNAME=rabbitmq.rabbitmq.svc.cluster.local + RABBITMQ_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-s3: secrets/data/minio/apps/issues + vault.hashicorp.com/agent-inject-template-issues-s3: |- + {{- with secret "secrets/data/minio/apps/issues" -}} + YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} + YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} + YC_S3_BUCKET_NAME=sarex-issues + YC_S3_ENDPOINT_URL=https://s3.uralmine.com + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-django-auth: secrets/data/vault/common/django_auth + vault.hashicorp.com/agent-inject-template-issues-django-auth: |- + {{- with secret "secrets/data/vault/common/django_auth" -}} + DJANGO_TOKEN={{ index .Data.data "key" }} + SAREX_USERNAME={{ index .Data.data "username" }} + SAREX_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-private: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-private: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "private_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-jwt-public: secrets/data/vault/common/rsa_keys + vault.hashicorp.com/agent-inject-template-issues-jwt-public: |- + {{- with secret "secrets/data/vault/common/rsa_keys" -}} + {{ index .Data.data "public_key" }} + {{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-kafka: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-kafka: |- + {{- with secret "secrets/data/kafka/apps/issues" -}} + KAFKA_USERNAME={{ index .Data.data "username" }} + KAFKA_PASSWORD={{ index .Data.data "password" }} + {{- end -}} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/d8-ugmk-prod/kafka-ca-configmap.yaml b/apps/issues/d8-ugmk-prod/kafka-ca-configmap.yaml new file mode 100644 index 0000000..9424d65 --- /dev/null +++ b/apps/issues/d8-ugmk-prod/kafka-ca-configmap.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-ca-cert + namespace: issues +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIDETCCAfmgAwIBAgIQI30u4fwgUnGBxyLicuU5EzANBgkqhkiG9w0BAQsFADAT + MREwDwYDVQQDEwhrYWZrYS1jYTAeFw0yNjA3MTMxNzQwNDJaFw0yNzA3MTMxNzQw + NDJaMBMxETAPBgNVBAMTCGthZmthLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAudTWG0AwdqIMqbqGwjf9CY0BMMQm+HDPRkzMnXqVCSqAYLBLuPBC + h4+qm+IKAIpiJrO5pCDxeU1mVqMgRnXcdYyuefCzlTAKMNuM1CVM4ou695B0zKiy + D+7NHsdhuoH/ne3jCa8VpylDfKWsxcq3tDCdtZ5drPK80g2o0eo2LHx4erJtSABV + tqCrcIuy1nClAwGY4ejO+psr+gIzrHdYzve6YRRFBqVp6sJHcW1Cj6wOpHax4pcM + Srh5EcZ4dk434UNOZy2Ebji/9Lwxn0CiXtPTHYGTgNLhujurylFM1nUx69QgsR3C + GRZSY3R8Kegd4bzzhHfoBMQvl5Py+0o85QIDAQABo2EwXzAOBgNVHQ8BAf8EBAMC + AqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQFMAMB + Af8wHQYDVR0OBBYEFKhTGCqho/YjUZK1ndypuYs970kcMA0GCSqGSIb3DQEBCwUA + A4IBAQBvIzVhkzib6LJxt3tUkDFy87Yf1gG+rRVZiL/ZGrOsQlvBt4eLzZIytAvL + QaZHY+imIyzURj57IFfyFM1fEPRhc9et0VaRYxGwapLljez0jqPedM8rCsunJmVP + KrQxAfvbmHvcZ8k51tpD+YydmoARjBmoRdRIuLTDsuLv0Szg45M/7I4px2ycGN2j + kF7jVwF56u2eIrUGybnsH2qg+MY7devv3rG1Y1YV7HEwMAAeN1n5JLxxuA1AIW/j + TyZD8hICp8OLzWGTG9b3GZJK9FXbDHSKXemJr0hyjoxsW27nHsXcmV5Oe2OkTKw8 + fdA17/ibw6gFrH2b3vZKcx8D455V + -----END CERTIFICATE----- diff --git a/apps/issues/d8-ugmk-prod/kustomization.yaml b/apps/issues/d8-ugmk-prod/kustomization.yaml index a4cf8c2..549a8b2 100644 --- a/apps/issues/d8-ugmk-prod/kustomization.yaml +++ b/apps/issues/d8-ugmk-prod/kustomization.yaml @@ -3,6 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base + - kafka-ca-configmap.yaml + - kafka-app.yaml patches: - path: namespace.yaml target: diff --git a/apps/reviews/base/helmrelease.yaml b/apps/reviews/base/helmrelease.yaml index 4f8c42e..71bc808 100644 --- a/apps/reviews/base/helmrelease.yaml +++ b/apps/reviews/base/helmrelease.yaml @@ -35,7 +35,7 @@ spec: image: name: - _default: cr.yandex/crp3ccidau046kdj8g9q/reviews-frontend:contour_3a66be35 + _default: cr.yandex/crp3ccidau046kdj8g9q/reviews-frontend:contour_c5a6d3b4 pullPolicy: _default: IfNotPresent